From 971db63e0c992735a18f9d7bd4faf9066bc79b4c Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Sat, 21 Mar 2020 12:49:13 +0200 Subject: [PATCH 001/425] Fix samba_requires_eq macro definition Resolves rhbz#1815739 --- samba.spec | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index 6ea36db..d2dc2a1 100644 --- a/samba.spec +++ b/samba.spec @@ -6,9 +6,9 @@ # ctdb is enabled by default, you can disable it with: --without clustering %bcond_without clustering -%define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") +%define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%define main_release 5 +%define main_release 6 %define samba_version 4.12.0 %define talloc_version 2.3.1 @@ -3560,6 +3560,10 @@ fi %endif %changelog +* Sat Mar 21 2020 Alexander Bokovoy - 4.12.0-6 +- Fix samba_requires_eq macro definition +- Resolves rhbz#1815739 + * Tue Mar 10 2020 Guenther Deschner - 4.12.0-5 - Add build requirement for perl-FindBin - resolves: #1661213 - Add winexe subpackage for remote windows command execution From 4893087a27a02c7e61030c0fa995caf557900af7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 7 Apr 2020 10:59:13 +0200 Subject: [PATCH 002/425] Update to Samba 4.12.1 Guenther --- .gitignore | 2 + samba-4.12.0-winexe.patch | 438 -------------------------------------- samba.spec | 8 +- sources | 4 +- 4 files changed, 9 insertions(+), 443 deletions(-) delete mode 100644 samba-4.12.0-winexe.patch diff --git a/.gitignore b/.gitignore index 105b67b..802994e 100644 --- a/.gitignore +++ b/.gitignore @@ -199,3 +199,5 @@ samba-3.6.0pre1.tar.gz /samba-4.12.0rc4.tar.asc /samba-4.12.0.tar.xz /samba-4.12.0.tar.asc +/samba-4.12.1.tar.xz +/samba-4.12.1.tar.asc diff --git a/samba-4.12.0-winexe.patch b/samba-4.12.0-winexe.patch deleted file mode 100644 index b5ae3bb..0000000 --- a/samba-4.12.0-winexe.patch +++ /dev/null @@ -1,438 +0,0 @@ -From a1fdd83ab776f981e992c3f2fc8c341d6b37a0d4 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?G=C3=BCnther=20Deschner?= -Date: Thu, 5 Mar 2020 22:45:48 +0100 -Subject: [PATCH 1/3] s4-torture: add rpc test for ChangeServiceConfigW - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14313 - -Guenther - -Signed-off-by: Guenther Deschner -Reviewed-by: Andreas Schneider -(cherry picked from commit 0825324bc75d2ab10164a1f137be782d84c822b8) ---- - selftest/knownfail | 3 ++ - source4/torture/rpc/svcctl.c | 78 +++++++++++++++++++++++++++++++++++- - 2 files changed, 80 insertions(+), 1 deletion(-) - -diff --git a/selftest/knownfail b/selftest/knownfail -index c9ef0851172..20441c078b4 100644 ---- a/selftest/knownfail -+++ b/selftest/knownfail -@@ -234,6 +234,9 @@ - ^samba3.rpc.eventlog.eventlog.GetNumRecords\(ad_dc\) - ^samba3.rpc.eventlog.eventlog.OpenEventLog\(ad_dc\) - ^samba3.rap.basic.netsessiongetinfo\(ad_dc\) -+# not implemented -+^samba3.rpc.svcctl.svcctl.ChangeServiceConfigW\(ad_dc\) -+^samba3.rpc.svcctl.svcctl.ChangeServiceConfigW\(nt4_dc\) - # - # This makes less sense when not running against an AD DC - # -diff --git a/source4/torture/rpc/svcctl.c b/source4/torture/rpc/svcctl.c -index ebb2bc6ad0e..bd16ed4627d 100644 ---- a/source4/torture/rpc/svcctl.c -+++ b/source4/torture/rpc/svcctl.c -@@ -3,7 +3,7 @@ - test suite for svcctl rpc operations - - Copyright (C) Jelmer Vernooij 2004 -- Copyright (C) Guenther Deschner 2008,2009 -+ Copyright (C) Guenther Deschner 2008,2009,2020 - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by -@@ -623,6 +623,80 @@ static bool test_SCManager(struct torture_context *tctx, - return true; - } - -+static bool test_ChangeServiceConfigW(struct torture_context *tctx, -+ struct dcerpc_pipe *p) -+{ -+ struct svcctl_ChangeServiceConfigW r; -+ struct svcctl_QueryServiceConfigW q; -+ struct policy_handle h, s; -+ NTSTATUS status; -+ struct dcerpc_binding_handle *b = p->binding_handle; -+ struct QUERY_SERVICE_CONFIG query; -+ bool ok; -+ -+ uint32_t offered = 0; -+ uint32_t needed = 0; -+ -+ ok = test_OpenSCManager(b, tctx, &h); -+ if (!ok) { -+ return false; -+ } -+ -+ ok = test_OpenService(b, tctx, &h, TORTURE_DEFAULT_SERVICE, &s); -+ if (!ok) { -+ return false; -+ } -+ -+ q.in.handle = &s; -+ q.in.offered = offered; -+ q.out.query = &query; -+ q.out.needed = &needed; -+ -+ status = dcerpc_svcctl_QueryServiceConfigW_r(b, tctx, &q); -+ torture_assert_ntstatus_ok(tctx, status, "QueryServiceConfigW failed!"); -+ -+ if (W_ERROR_EQUAL(q.out.result, WERR_INSUFFICIENT_BUFFER)) { -+ q.in.offered = needed; -+ status = dcerpc_svcctl_QueryServiceConfigW_r(b, tctx, &q); -+ torture_assert_ntstatus_ok(tctx, status, "QueryServiceConfigW failed!"); -+ } -+ torture_assert_werr_ok(tctx, q.out.result, "QueryServiceConfigW failed!"); -+ -+ r.in.handle = &s; -+ r.in.type = query.service_type; -+ r.in.start_type = query.start_type; -+ r.in.error_control = query.error_control; -+ -+ /* -+ * according to MS-SCMR 3.1.4.11 NULL params are supposed to leave the -+ * existing values intact. -+ */ -+ -+ r.in.binary_path = NULL; -+ r.in.load_order_group = NULL; -+ r.in.dependencies = NULL; -+ r.in.service_start_name = NULL; -+ r.in.password = NULL; -+ r.in.display_name = NULL; -+ r.out.tag_id = NULL; -+ -+ status = dcerpc_svcctl_ChangeServiceConfigW_r(b, tctx, &r); -+ torture_assert_ntstatus_ok(tctx, status, "ChangeServiceConfigW failed!"); -+ torture_assert_werr_ok(tctx, r.out.result, "ChangeServiceConfigW failed!"); -+ -+ ok = test_CloseServiceHandle(b, tctx, &s); -+ if (!ok) { -+ return false; -+ } -+ -+ ok = test_CloseServiceHandle(b, tctx, &h); -+ if (!ok) { -+ return false; -+ } -+ -+ return true; -+} -+ - struct torture_suite *torture_rpc_svcctl(TALLOC_CTX *mem_ctx) - { - struct torture_suite *suite = torture_suite_create(mem_ctx, "svcctl"); -@@ -652,6 +726,8 @@ struct torture_suite *torture_rpc_svcctl(TALLOC_CTX *mem_ctx) - test_StartServiceW); - torture_rpc_tcase_add_test(tcase, "ControlService", - test_ControlService); -+ torture_rpc_tcase_add_test(tcase, "ChangeServiceConfigW", -+ test_ChangeServiceConfigW); - - return suite; - } --- -2.24.1 - - -From 1168f1c392b3e315b5a4af9be793b93234420786 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?G=C3=BCnther=20Deschner?= -Date: Thu, 5 Mar 2020 20:42:21 +0100 -Subject: [PATCH 2/3] s4-torture: add ndr svcctl testsuite - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14313 - -Guenther - -Signed-off-by: Guenther Deschner -Reviewed-by: Andreas Schneider -(cherry picked from commit c3fa0b2df9fc53dddcc3160b6a3dc751bbb389a4) ---- - librpc/idl/svcctl.idl | 2 +- - selftest/knownfail | 5 +++ - source4/torture/ndr/ndr.c | 1 + - source4/torture/ndr/svcctl.c | 85 +++++++++++++++++++++++++++++++++++ - source4/torture/wscript_build | 1 + - 5 files changed, 93 insertions(+), 1 deletion(-) - create mode 100644 source4/torture/ndr/svcctl.c - -diff --git a/librpc/idl/svcctl.idl b/librpc/idl/svcctl.idl -index 671a1dc47be..e909bf2dbed 100644 ---- a/librpc/idl/svcctl.idl -+++ b/librpc/idl/svcctl.idl -@@ -188,7 +188,7 @@ import "misc.idl", "security.idl"; - SVCCTL_DISABLED = 0x00000004 - } svcctl_StartType; - -- WERROR svcctl_ChangeServiceConfigW( -+ [public] WERROR svcctl_ChangeServiceConfigW( - [in,ref] policy_handle *handle, - [in] uint32 type, - [in] svcctl_StartType start_type, -diff --git a/selftest/knownfail b/selftest/knownfail -index 20441c078b4..c5d4cdd9419 100644 ---- a/selftest/knownfail -+++ b/selftest/knownfail -@@ -237,6 +237,11 @@ - # not implemented - ^samba3.rpc.svcctl.svcctl.ChangeServiceConfigW\(ad_dc\) - ^samba3.rpc.svcctl.svcctl.ChangeServiceConfigW\(nt4_dc\) -+# broken IDL -+^samba4.local.ndr.svcctl_ChangeServiceConfigW_NDR_IN -+^samba4.local.ndr.svcctl_ChangeServiceConfigW_NDR_OUT -+^samba4.local.ndr.system.iconv.svcctl_ChangeServiceConfigW_NDR_IN -+^samba4.local.ndr.system.iconv.svcctl_ChangeServiceConfigW_NDR_OUT - # - # This makes less sense when not running against an AD DC - # -diff --git a/source4/torture/ndr/ndr.c b/source4/torture/ndr/ndr.c -index 32efe90757d..690301f31b1 100644 ---- a/source4/torture/ndr/ndr.c -+++ b/source4/torture/ndr/ndr.c -@@ -708,6 +708,7 @@ struct torture_suite *torture_local_ndr(TALLOC_CTX *mem_ctx) - torture_suite_add_suite(suite, ndr_krb5pac_suite(suite)); - torture_suite_add_suite(suite, ndr_cabinet_suite(suite)); - torture_suite_add_suite(suite, ndr_charset_suite(suite)); -+ torture_suite_add_suite(suite, ndr_svcctl_suite(suite)); - - torture_suite_add_simple_test(suite, "string terminator", - test_check_string_terminator); -diff --git a/source4/torture/ndr/svcctl.c b/source4/torture/ndr/svcctl.c -new file mode 100644 -index 00000000000..1c9404597cd ---- /dev/null -+++ b/source4/torture/ndr/svcctl.c -@@ -0,0 +1,85 @@ -+/* -+ Unix SMB/CIFS implementation. -+ test suite for svcctl ndr operations -+ -+ Copyright (C) Guenther Deschner 2020 -+ -+ This program is free software; you can redistribute it and/or modify -+ it under the terms of the GNU General Public License as published by -+ the Free Software Foundation; either version 3 of the License, or -+ (at your option) any later version. -+ -+ This program is distributed in the hope that it will be useful, -+ but WITHOUT ANY WARRANTY; without even the implied warranty of -+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ GNU General Public License for more details. -+ -+ You should have received a copy of the GNU General Public License -+ along with this program. If not, see . -+*/ -+ -+#include "includes.h" -+#include "torture/ndr/ndr.h" -+#include "librpc/gen_ndr/ndr_svcctl.h" -+#include "torture/ndr/proto.h" -+#include "param/param.h" -+ -+static const uint8_t svcctl_ChangeServiceConfigW_req_data[] = { -+ 0x00, 0x00, 0x00, 0x00, 0xcd, 0x94, 0x05, 0x40, 0x30, 0x28, 0x00, 0x49, -+ 0x8d, 0xe4, 0x8e, 0x85, 0xb7, 0x19, 0x5c, 0x83, 0x10, 0x01, 0x00, 0x00, -+ 0x02, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 -+}; -+ -+static bool svcctl_ChangeServiceConfigW_req_check(struct torture_context *tctx, -+ struct svcctl_ChangeServiceConfigW *r) -+{ -+ struct policy_handle handle = { 0 }; -+ GUID_from_string("400594cd-2830-4900-8de4-8e85b7195c83", &handle.uuid); -+ -+ torture_assert_guid_equal(tctx, r->in.handle->uuid, handle.uuid, "handle"); -+ torture_assert_u32_equal(tctx, r->in.type, 0x00000110, "type"); -+ torture_assert_u32_equal(tctx, r->in.start_type, SVCCTL_AUTO_START, "start_type"); -+ torture_assert_u32_equal(tctx, r->in.error_control, SVCCTL_SVC_ERROR_NORMAL, "error_control"); -+ torture_assert_str_equal(tctx, r->in.binary_path, NULL, "binary_path"); -+ torture_assert_str_equal(tctx, r->in.load_order_group, NULL, "load_order_group"); -+ torture_assert_str_equal(tctx, r->in.dependencies, NULL, "dependencies"); -+ torture_assert_str_equal(tctx, r->in.service_start_name, NULL, "service_start_name"); -+ torture_assert_str_equal(tctx, r->in.password, NULL, "password"); -+ torture_assert_str_equal(tctx, r->in.display_name, NULL, "display_name"); -+ -+ return true; -+} -+ -+static const uint8_t svcctl_ChangeServiceConfigW_rep_data[] = { -+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 -+}; -+ -+static bool svcctl_ChangeServiceConfigW_rep_check(struct torture_context *tctx, -+ struct svcctl_ChangeServiceConfigW *r) -+{ -+ torture_assert(tctx, r->out.tag_id == NULL, "tag_id"); -+ torture_assert_werr_ok(tctx, r->out.result, "result"); -+ -+ return true; -+} -+ -+struct torture_suite *ndr_svcctl_suite(TALLOC_CTX *ctx) -+{ -+ struct torture_suite *suite = torture_suite_create(ctx, "svcctl"); -+ -+ torture_suite_add_ndr_pull_fn_test(suite, -+ svcctl_ChangeServiceConfigW, -+ svcctl_ChangeServiceConfigW_req_data, -+ NDR_IN, -+ svcctl_ChangeServiceConfigW_req_check); -+ -+ torture_suite_add_ndr_pull_fn_test(suite, -+ svcctl_ChangeServiceConfigW, -+ svcctl_ChangeServiceConfigW_rep_data, -+ NDR_OUT, -+ svcctl_ChangeServiceConfigW_rep_check); -+ return suite; -+} -diff --git a/source4/torture/wscript_build b/source4/torture/wscript_build -index 65af160b322..05a6fbcbf14 100644 ---- a/source4/torture/wscript_build -+++ b/source4/torture/wscript_build -@@ -71,6 +71,7 @@ bld.SAMBA_SUBSYSTEM('TORTURE_NDR', - ndr/winspool.c - ndr/cabinet.c - ndr/charset.c -+ ndr/svcctl.c - ''', - autoproto='ndr/proto.h', - deps='torture krb5samba', --- -2.24.1 - - -From 28d86d48adfee6c1d03ea192b69be87a0b9ce400 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?G=C3=BCnther=20Deschner?= -Date: Wed, 4 Mar 2020 15:23:43 +0100 -Subject: [PATCH 3/3] librpc: fix IDL for svcctl_ChangeServiceConfigW - -Found while trying to run winexe against Windows Server 2019. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14313 - -Guenther - -Signed-off-by: Guenther Deschner -Reviewed-by: Andreas Schneider -(cherry picked from commit ebda529b59105e9b70cc74377fe4d54cc16b4f37) ---- - examples/winexe/winexe.c | 2 ++ - librpc/idl/svcctl.idl | 23 ++++++++++++++++++----- - selftest/knownfail | 5 ----- - source4/torture/ndr/svcctl.c | 3 +++ - source4/torture/rpc/svcctl.c | 3 +++ - 5 files changed, 26 insertions(+), 10 deletions(-) - -diff --git a/examples/winexe/winexe.c b/examples/winexe/winexe.c -index 22f748b1d45..fc6b15f8e52 100644 ---- a/examples/winexe/winexe.c -+++ b/examples/winexe/winexe.c -@@ -625,8 +625,10 @@ static NTSTATUS winexe_svc_install( - NULL, /* load_order_group */ - NULL, /* tag_id */ - NULL, /* dependencies */ -+ 0, /* dwDependSize */ - NULL, /* service_start_name */ - NULL, /* password */ -+ 0, /* dwPwSize */ - NULL, /* display_name */ - &werr); - -diff --git a/librpc/idl/svcctl.idl b/librpc/idl/svcctl.idl -index e909bf2dbed..a9dd3dec990 100644 ---- a/librpc/idl/svcctl.idl -+++ b/librpc/idl/svcctl.idl -@@ -13,6 +13,17 @@ import "misc.idl", "security.idl"; - helpstring("Service Control") - ] interface svcctl - { -+ const int MAX_SERVICE_NAME_LENGTH = 256; -+ const short SC_MAX_DEPEND_SIZE = 4 * 1024; -+ const short SC_MAX_NAME_LENGTH = MAX_SERVICE_NAME_LENGTH + 1; -+ const short SC_MAX_PATH_LENGTH = 32 * 1024; -+ const short SC_MAX_PWD_SIZE = 514; -+ const short SC_MAX_COMPUTER_NAME_LENGTH = 1024; -+ const short SC_MAX_ACCOUNT_NAME_LENGTH = 2 * 1024; -+ const short SC_MAX_COMMENT_LENGTH = 128; -+ const short SC_MAX_ARGUMENT_LENGTH = 1024; -+ const short SC_MAX_ARGUMENTS = 1024; -+ - typedef struct { - uint32 is_locked; - [string,charset(UTF16)] uint16 *lock_owner; -@@ -195,11 +206,13 @@ import "misc.idl", "security.idl"; - [in] svcctl_ErrorControl error_control, - [in,unique] [string,charset(UTF16)] uint16 *binary_path, - [in,unique] [string,charset(UTF16)] uint16 *load_order_group, -- [out,ref] uint32 *tag_id, -- [in,unique] [string,charset(UTF16)] uint16 *dependencies, -- [in,unique] [string,charset(UTF16)] uint16 *service_start_name, -- [in,unique] [string,charset(UTF16)] uint16 *password, -- [in,unique] [string,charset(UTF16)] uint16 *display_name -+ [in,out,unique] uint32 *tag_id, -+ [in,unique,size_is(dwDependSize)] [string,charset(UTF16)] uint16 *dependencies, -+ [in,range(0, SC_MAX_DEPEND_SIZE)] uint32 dwDependSize, -+ [in,unique,range(0, SC_MAX_ACCOUNT_NAME_LENGTH)] [string,charset(UTF16)] uint16 *service_start_name, -+ [in,unique,size_is(dwPwSize)] [string,charset(UTF16)] uint16 *password, -+ [in,range(0, SC_MAX_PWD_SIZE)] uint32 dwPwSize, -+ [in,unique,range(0, SC_MAX_NAME_LENGTH)] [string,charset(UTF16)] uint16 *display_name - ); - - /*****************/ -diff --git a/selftest/knownfail b/selftest/knownfail -index c5d4cdd9419..20441c078b4 100644 ---- a/selftest/knownfail -+++ b/selftest/knownfail -@@ -237,11 +237,6 @@ - # not implemented - ^samba3.rpc.svcctl.svcctl.ChangeServiceConfigW\(ad_dc\) - ^samba3.rpc.svcctl.svcctl.ChangeServiceConfigW\(nt4_dc\) --# broken IDL --^samba4.local.ndr.svcctl_ChangeServiceConfigW_NDR_IN --^samba4.local.ndr.svcctl_ChangeServiceConfigW_NDR_OUT --^samba4.local.ndr.system.iconv.svcctl_ChangeServiceConfigW_NDR_IN --^samba4.local.ndr.system.iconv.svcctl_ChangeServiceConfigW_NDR_OUT - # - # This makes less sense when not running against an AD DC - # -diff --git a/source4/torture/ndr/svcctl.c b/source4/torture/ndr/svcctl.c -index 1c9404597cd..6592beda02e 100644 ---- a/source4/torture/ndr/svcctl.c -+++ b/source4/torture/ndr/svcctl.c -@@ -45,9 +45,12 @@ static bool svcctl_ChangeServiceConfigW_req_check(struct torture_context *tctx, - torture_assert_u32_equal(tctx, r->in.error_control, SVCCTL_SVC_ERROR_NORMAL, "error_control"); - torture_assert_str_equal(tctx, r->in.binary_path, NULL, "binary_path"); - torture_assert_str_equal(tctx, r->in.load_order_group, NULL, "load_order_group"); -+ torture_assert(tctx, r->in.tag_id == NULL, "tag_id"); - torture_assert_str_equal(tctx, r->in.dependencies, NULL, "dependencies"); -+ torture_assert_u32_equal(tctx, r->in.dwDependSize, 0, "dwDependSize"); - torture_assert_str_equal(tctx, r->in.service_start_name, NULL, "service_start_name"); - torture_assert_str_equal(tctx, r->in.password, NULL, "password"); -+ torture_assert_u32_equal(tctx, r->in.dwPwSize, 0, "dwPwSize"); - torture_assert_str_equal(tctx, r->in.display_name, NULL, "display_name"); - - return true; -diff --git a/source4/torture/rpc/svcctl.c b/source4/torture/rpc/svcctl.c -index bd16ed4627d..746b399360e 100644 ---- a/source4/torture/rpc/svcctl.c -+++ b/source4/torture/rpc/svcctl.c -@@ -675,9 +675,12 @@ static bool test_ChangeServiceConfigW(struct torture_context *tctx, - r.in.binary_path = NULL; - r.in.load_order_group = NULL; - r.in.dependencies = NULL; -+ r.in.dwDependSize = 0; - r.in.service_start_name = NULL; - r.in.password = NULL; -+ r.in.dwPwSize = 0; - r.in.display_name = NULL; -+ r.in.tag_id = NULL; - r.out.tag_id = NULL; - - status = dcerpc_svcctl_ChangeServiceConfigW_r(b, tctx, &r); --- -2.24.1 - diff --git a/samba.spec b/samba.spec index d2dc2a1..e4fd049 100644 --- a/samba.spec +++ b/samba.spec @@ -8,9 +8,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%define main_release 6 +%define main_release 0 -%define samba_version 4.12.0 +%define samba_version 4.12.1 %define talloc_version 2.3.1 %define tdb_version 1.4.3 %define tevent_version 0.10.2 @@ -125,7 +125,6 @@ Source14: samba.pamd Source201: README.downgrade Patch100: new_mit_118.patch -Patch101: samba-4.12.0-winexe.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -3560,6 +3559,9 @@ fi %endif %changelog +* Tue Apr 07 2020 Guenther Deschner - 4.12.1-0 +- Update to Samba 4.12.1 + * Sat Mar 21 2020 Alexander Bokovoy - 4.12.0-6 - Fix samba_requires_eq macro definition - Resolves rhbz#1815739 diff --git a/sources b/sources index 85d472a..15a3c5c 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.12.0.tar.xz) = d9d99136702d339803c96004d68c978405759059e6f71fa303b52d21f4bf5093c43bcec44b22aeee3610a1cdf033edf758ccb4c551de20b7d66632e9a23866b1 -SHA512 (samba-4.12.0.tar.asc) = b833e0917b3b244ce727d80c0b600a88aa986455b7dfa24df1306fd848e2d192a46e2dfd5a5e878cd0ca3f76e0827ee42f704f93ac86b063e57027b786d262f0 +SHA512 (samba-4.12.1.tar.xz) = 46b68312cd0b390ccb0644cc48a551c5edcd336fcb4ca9fea7602466f3127b6238037a3372933427739c927bfa96816c6c70d96627cce740bd98f4c6ba984a2d +SHA512 (samba-4.12.1.tar.asc) = a2abe3445ee2eb9b2b5a97fad89b0cf59d31d8e90a008584e14e6a8d63c28e7f7c15644c9ebd67b535c80ec5849ea5770ba078c437ff20ba3b5773f90e20eed6 From 9899557a0c3e125000175f308edda2a489afe237 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Sun, 12 Apr 2020 11:01:50 +0300 Subject: [PATCH 003/425] Revert POSIX stat tuning code Resolves: rhbz#1801442 --- ...-to-find-posix-stat-info-in-SMBC_get.patch | 91 +++++++++++++++++++ samba.spec | 7 +- 2 files changed, 97 insertions(+), 1 deletion(-) create mode 100644 0001-libsmb-Don-t-try-to-find-posix-stat-info-in-SMBC_get.patch diff --git a/0001-libsmb-Don-t-try-to-find-posix-stat-info-in-SMBC_get.patch b/0001-libsmb-Don-t-try-to-find-posix-stat-info-in-SMBC_get.patch new file mode 100644 index 0000000..ba901a4 --- /dev/null +++ b/0001-libsmb-Don-t-try-to-find-posix-stat-info-in-SMBC_get.patch @@ -0,0 +1,91 @@ +From 686ea46cbc9538355815fe800e441d67fee6a9db Mon Sep 17 00:00:00 2001 +From: Volker Lendecke +Date: Thu, 19 Mar 2020 11:01:41 +0100 +Subject: [PATCH] libsmb: Don't try to find posix stat info in SMBC_getatr() + +This wrongly used "frame" instead of "fname", which can never have +worked. A first attempt to fix in 51551e0d53fa6 caused a few followup +patches in an attempt to clean up the test failures 51551e0d53fa6 +introduced. They were reverted after a few discussions. So rather than +changing behaviour, just remove the code that introduced the valgrind +error again. + +Signed-off-by: Volker Lendecke +Reviewed-by: Andreas Schneider + +Autobuild-User(master): Jeremy Allison +Autobuild-Date(master): Fri Mar 20 05:06:07 UTC 2020 on sn-devel-184 + +(cherry picked from commit 39c910fd9cba3caf7414274b678b9eee33d7e20b) +--- + source3/include/libsmb_internal.h | 1 - + source3/libsmb/libsmb_file.c | 20 -------------------- + source3/libsmb/libsmb_server.c | 9 --------- + 3 files changed, 30 deletions(-) + +diff --git a/source3/include/libsmb_internal.h b/source3/include/libsmb_internal.h +index 21a11c1a024..feedddd0877 100644 +--- a/source3/include/libsmb_internal.h ++++ b/source3/include/libsmb_internal.h +@@ -76,7 +76,6 @@ typedef struct DOS_ATTR_DESC { + struct _SMBCSRV { + struct cli_state *cli; + dev_t dev; +- bool try_posixinfo; + bool no_pathinfo; + bool no_pathinfo2; + bool no_pathinfo3; +diff --git a/source3/libsmb/libsmb_file.c b/source3/libsmb/libsmb_file.c +index 1577010e490..f0a16c61a83 100644 +--- a/source3/libsmb/libsmb_file.c ++++ b/source3/libsmb/libsmb_file.c +@@ -504,26 +504,6 @@ SMBC_getatr(SMBCCTX * context, + return False; + } + +- if (srv->try_posixinfo) { +- SMB_STRUCT_STAT sbuf; +- +- status = cli_posix_stat(targetcli, frame, &sbuf); +- if (NT_STATUS_IS_OK(status)) { +- setup_stat_from_stat_ex(&sbuf, path, sb); +- +- TALLOC_FREE(frame); +- return true; +- } +- if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_IMPLEMENTED) || +- NT_STATUS_EQUAL(status, NT_STATUS_INVALID_LEVEL)) { +- /* +- * Turn this off if the server doesn't +- * support it. +- */ +- srv->try_posixinfo = false; +- } +- } +- + if (!srv->no_pathinfo2) { + status = cli_qpathinfo2(targetcli, + targetpath, +diff --git a/source3/libsmb/libsmb_server.c b/source3/libsmb/libsmb_server.c +index d4f71d8c8b7..0067df48cac 100644 +--- a/source3/libsmb/libsmb_server.c ++++ b/source3/libsmb/libsmb_server.c +@@ -657,15 +657,6 @@ SMBC_server_internal(TALLOC_CTX *ctx, + ZERO_STRUCTP(srv); + DLIST_ADD(srv->cli, c); + srv->dev = (dev_t)(str_checksum(server) ^ str_checksum(share)); +- srv->try_posixinfo = false; +- /* +- * Until SMB2 POSIX is done, only +- * try POSIX stat on SMB1 with POSIX capabilities. +- */ +- if ((smbXcli_conn_protocol(c->conn) < PROTOCOL_SMB2_02) && +- (smb1cli_conn_capabilities(c->conn) & CAP_UNIX)) { +- srv->try_posixinfo = true; +- } + srv->no_pathinfo = False; + srv->no_pathinfo2 = False; + srv->no_pathinfo3 = False; +-- +2.26.0 + diff --git a/samba.spec b/samba.spec index e4fd049..45731d1 100644 --- a/samba.spec +++ b/samba.spec @@ -8,7 +8,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%define main_release 0 +%define main_release 1 %define samba_version 4.12.1 %define talloc_version 2.3.1 @@ -125,6 +125,7 @@ Source14: samba.pamd Source201: README.downgrade Patch100: new_mit_118.patch +Patch101: 0001-libsmb-Don-t-try-to-find-posix-stat-info-in-SMBC_get.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -3559,6 +3560,10 @@ fi %endif %changelog +* Sun Apr 12 2020 Alexander Bokovoy - 4.12.1-1 +- Revert POSIX stat tuning in libsmbclient +- Resolves: rhbz#1801442 + * Tue Apr 07 2020 Guenther Deschner - 4.12.1-0 - Update to Samba 4.12.1 From 7b0139b018d2f1ea703b224c5b35c51575928a1a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 28 Apr 2020 11:07:56 +0200 Subject: [PATCH 004/425] Update to Samba 4.12.2 resolves: #1825731, #1828870 - Security fixes for CVE-2020-10700 resolves: #1825734, #1828872 - Security fixes for CVE-2020-10704 Guenther --- .gitignore | 2 ++ samba.spec | 13 ++++++++++--- sources | 4 ++-- 3 files changed, 14 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 802994e..fe44f1a 100644 --- a/.gitignore +++ b/.gitignore @@ -201,3 +201,5 @@ samba-3.6.0pre1.tar.gz /samba-4.12.0.tar.asc /samba-4.12.1.tar.xz /samba-4.12.1.tar.asc +/samba-4.12.2.tar.xz +/samba-4.12.2.tar.asc diff --git a/samba.spec b/samba.spec index 45731d1..e77f9b0 100644 --- a/samba.spec +++ b/samba.spec @@ -8,13 +8,13 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%define main_release 1 +%define main_release 0 -%define samba_version 4.12.1 +%define samba_version 4.12.2 %define talloc_version 2.3.1 %define tdb_version 1.4.3 %define tevent_version 0.10.2 -%define ldb_version 2.1.1 +%define ldb_version 2.1.2 # This should be rc1 or nil %define pre_release %nil @@ -2299,6 +2299,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/hostconfig.*.pyc %{python3_sitearch}/samba/tests/__pycache__/join.*.pyc %{python3_sitearch}/samba/tests/__pycache__/krb5_credentials.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/ldap_raw.*.pyc %{python3_sitearch}/samba/tests/__pycache__/ldap_referrals.*.pyc %{python3_sitearch}/samba/tests/__pycache__/loadparm.*.pyc %{python3_sitearch}/samba/tests/__pycache__/libsmb.*.pyc @@ -2484,6 +2485,7 @@ fi %{python3_sitearch}/samba/tests/kcc/kcc_utils.py %{python3_sitearch}/samba/tests/kcc/ldif_import_export.py %{python3_sitearch}/samba/tests/krb5_credentials.py +%{python3_sitearch}/samba/tests/ldap_raw.py %{python3_sitearch}/samba/tests/ldap_referrals.py %{python3_sitearch}/samba/tests/libsmb.py %{python3_sitearch}/samba/tests/loadparm.py @@ -3560,6 +3562,11 @@ fi %endif %changelog +* Tue Apr 28 2020 Guenther Deschner - 4.12.2-0 +- Update to Samba 4.12.2 +- resolves: #1825731, #1828870 - Security fixes for CVE-2020-10700 +- resolves: #1825734, #1828872 - Security fixes for CVE-2020-10704 + * Sun Apr 12 2020 Alexander Bokovoy - 4.12.1-1 - Revert POSIX stat tuning in libsmbclient - Resolves: rhbz#1801442 diff --git a/sources b/sources index 15a3c5c..ada3fb2 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.12.1.tar.xz) = 46b68312cd0b390ccb0644cc48a551c5edcd336fcb4ca9fea7602466f3127b6238037a3372933427739c927bfa96816c6c70d96627cce740bd98f4c6ba984a2d -SHA512 (samba-4.12.1.tar.asc) = a2abe3445ee2eb9b2b5a97fad89b0cf59d31d8e90a008584e14e6a8d63c28e7f7c15644c9ebd67b535c80ec5849ea5770ba078c437ff20ba3b5773f90e20eed6 +SHA512 (samba-4.12.2.tar.xz) = ab89b8f6f0c14b5e8712bf281f7f2cc8e3dae6a69147a826bb58538ed5a22457f4d9a1ec500cbd49da42a5918fe2dd1f2726bb9a7838d9ee5507424ecf75774b +SHA512 (samba-4.12.2.tar.asc) = b585cc5e919405a0910f1aea303959e92e293645296654805c65f20b92bd58098fc08be82ae17a9a281e04339f6af5579658f1b5c768498c75127c9dc254cd3d From ccd630af90fec658083bd34937ba412f826ba8d2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 4 May 2020 16:30:30 +0200 Subject: [PATCH 005/425] Add support for building the new experimental io_uring VFS module Guenther --- samba-4.12.3-vfs_io_uring-bz14361.patch | 2423 +++++++++++++++++++++++ samba.spec | 18 +- 2 files changed, 2440 insertions(+), 1 deletion(-) create mode 100644 samba-4.12.3-vfs_io_uring-bz14361.patch diff --git a/samba-4.12.3-vfs_io_uring-bz14361.patch b/samba-4.12.3-vfs_io_uring-bz14361.patch new file mode 100644 index 0000000..ad796ba --- /dev/null +++ b/samba-4.12.3-vfs_io_uring-bz14361.patch @@ -0,0 +1,2423 @@ +From d7ab59f80f535e960780ec3a643101dfe96627ac Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Mon, 11 May 2020 12:37:41 +0200 +Subject: [PATCH 01/31] s4:torture: add tests to test the SMB2 read/write + offset/length boundaries + +[MS-FSA] 2.1.5.2 Server Requests a Read and +2.1.5.3 Server Requests a Write define some contraints. + +These tests demonstrate that ((int64_t)offset) < 0) is +not allowed for both reads and writes for SMB. +Also the special case for writes at offset -2 is not possible +nor the append mode with offset < 0. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Jeremy Allison +(cherry picked from commit 54de0e4a3e46a53db5262963e64b109c567554a1) +--- + selftest/knownfail.d/rw-invalid | 2 + + source4/torture/smb2/read_write.c | 189 ++++++++++++++++++++++++++++++ + 2 files changed, 191 insertions(+) + create mode 100644 selftest/knownfail.d/rw-invalid + +diff --git a/selftest/knownfail.d/rw-invalid b/selftest/knownfail.d/rw-invalid +new file mode 100644 +index 00000000000..c6f11e03d20 +--- /dev/null ++++ b/selftest/knownfail.d/rw-invalid +@@ -0,0 +1,2 @@ ++samba3.smb2.rw.invalid ++samba4.smb2.rw.invalid +diff --git a/source4/torture/smb2/read_write.c b/source4/torture/smb2/read_write.c +index bc8898cec31..b0eea55d7f1 100644 +--- a/source4/torture/smb2/read_write.c ++++ b/source4/torture/smb2/read_write.c +@@ -23,8 +23,19 @@ + #include "libcli/smb2/smb2.h" + #include "libcli/smb2/smb2_calls.h" + #include "torture/torture.h" ++#include "torture/util.h" + #include "torture/smb2/proto.h" + ++#define CHECK_STATUS(_status, _expected) \ ++ torture_assert_ntstatus_equal_goto(torture, _status, _expected, \ ++ ret, done, "Incorrect status") ++ ++#define CHECK_VALUE(v, correct) \ ++ torture_assert_int_equal_goto(torture, v, correct, \ ++ ret, done, "Incorrect value") ++ ++#define FNAME "smb2_writetest.dat" ++ + static bool run_smb2_readwritetest(struct torture_context *tctx, + struct smb2_tree *t1, struct smb2_tree *t2) + { +@@ -150,12 +161,190 @@ static bool run_smb2_wrap_readwritetest(struct torture_context *tctx, + return run_smb2_readwritetest(tctx, tree1, tree1); + } + ++static bool test_rw_invalid(struct torture_context *torture, struct smb2_tree *tree) ++{ ++ bool ret = true; ++ NTSTATUS status; ++ struct smb2_handle h; ++ uint8_t buf[64*1024]; ++ struct smb2_read rd; ++ struct smb2_write w = {0}; ++ TALLOC_CTX *tmp_ctx = talloc_new(tree); ++ ++ ZERO_STRUCT(buf); ++ ++ smb2_util_unlink(tree, FNAME); ++ ++ status = torture_smb2_testfile(tree, FNAME, &h); ++ CHECK_STATUS(status, NT_STATUS_OK); ++ ++ status = smb2_util_write(tree, h, buf, 0, ARRAY_SIZE(buf)); ++ CHECK_STATUS(status, NT_STATUS_OK); ++ ++ ZERO_STRUCT(rd); ++ rd.in.file.handle = h; ++ rd.in.length = 10; ++ rd.in.offset = 0; ++ rd.in.min_count = 1; ++ ++ status = smb2_read(tree, tmp_ctx, &rd); ++ CHECK_STATUS(status, NT_STATUS_OK); ++ CHECK_VALUE(rd.out.data.length, 10); ++ ++ rd.in.min_count = 0; ++ rd.in.length = 10; ++ rd.in.offset = sizeof(buf); ++ status = smb2_read(tree, tmp_ctx, &rd); ++ CHECK_STATUS(status, NT_STATUS_END_OF_FILE); ++ ++ rd.in.min_count = 0; ++ rd.in.length = 0; ++ rd.in.offset = sizeof(buf); ++ status = smb2_read(tree, tmp_ctx, &rd); ++ CHECK_STATUS(status, NT_STATUS_OK); ++ CHECK_VALUE(rd.out.data.length, 0); ++ ++ rd.in.min_count = 0; ++ rd.in.length = 1; ++ rd.in.offset = INT64_MAX - 1; ++ status = smb2_read(tree, tmp_ctx, &rd); ++ CHECK_STATUS(status, NT_STATUS_END_OF_FILE); ++ ++ rd.in.min_count = 0; ++ rd.in.length = 0; ++ rd.in.offset = INT64_MAX; ++ status = smb2_read(tree, tmp_ctx, &rd); ++ CHECK_STATUS(status, NT_STATUS_OK); ++ CHECK_VALUE(rd.out.data.length, 0); ++ ++ rd.in.min_count = 0; ++ rd.in.length = 1; ++ rd.in.offset = INT64_MAX; ++ status = smb2_read(tree, tmp_ctx, &rd); ++ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); ++ ++ rd.in.min_count = 0; ++ rd.in.length = 0; ++ rd.in.offset = (uint64_t)INT64_MAX + 1; ++ status = smb2_read(tree, tmp_ctx, &rd); ++ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); ++ ++ rd.in.min_count = 0; ++ rd.in.length = 0; ++ rd.in.offset = (uint64_t)INT64_MIN; ++ status = smb2_read(tree, tmp_ctx, &rd); ++ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); ++ ++ rd.in.min_count = 0; ++ rd.in.length = 0; ++ rd.in.offset = (uint64_t)(int64_t)-1; ++ status = smb2_read(tree, tmp_ctx, &rd); ++ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); ++ ++ rd.in.min_count = 0; ++ rd.in.length = 0; ++ rd.in.offset = (uint64_t)(int64_t)-2; ++ status = smb2_read(tree, tmp_ctx, &rd); ++ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); ++ ++ rd.in.min_count = 0; ++ rd.in.length = 0; ++ rd.in.offset = (uint64_t)(int64_t)-3; ++ status = smb2_read(tree, tmp_ctx, &rd); ++ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); ++ ++ w.in.file.handle = h; ++ w.in.offset = (int64_t)-1; ++ w.in.data.data = buf; ++ w.in.data.length = ARRAY_SIZE(buf); ++ ++ status = smb2_write(tree, &w); ++ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); ++ ++ w.in.file.handle = h; ++ w.in.offset = (int64_t)-2; ++ w.in.data.data = buf; ++ w.in.data.length = ARRAY_SIZE(buf); ++ ++ status = smb2_write(tree, &w); ++ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); ++ ++ w.in.file.handle = h; ++ w.in.offset = INT64_MIN; ++ w.in.data.data = buf; ++ w.in.data.length = 1; ++ ++ status = smb2_write(tree, &w); ++ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); ++ ++ w.in.file.handle = h; ++ w.in.offset = INT64_MIN; ++ w.in.data.data = buf; ++ w.in.data.length = 0; ++ status = smb2_write(tree, &w); ++ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); ++ ++ w.in.file.handle = h; ++ w.in.offset = INT64_MAX; ++ w.in.data.data = buf; ++ w.in.data.length = 0; ++ status = smb2_write(tree, &w); ++ CHECK_STATUS(status, NT_STATUS_OK); ++ CHECK_VALUE(w.out.nwritten, 0); ++ ++ w.in.file.handle = h; ++ w.in.offset = INT64_MAX; ++ w.in.data.data = buf; ++ w.in.data.length = 1; ++ status = smb2_write(tree, &w); ++ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); ++ ++ w.in.file.handle = h; ++ w.in.offset = (uint64_t)INT64_MAX + 1; ++ w.in.data.data = buf; ++ w.in.data.length = 0; ++ status = smb2_write(tree, &w); ++ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); ++ ++ w.in.file.handle = h; ++ w.in.offset = 0xfffffff0000; /* MAXFILESIZE */ ++ w.in.data.data = buf; ++ w.in.data.length = 1; ++ status = smb2_write(tree, &w); ++ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); ++ ++ w.in.file.handle = h; ++ w.in.offset = 0xfffffff0000 - 1; /* MAXFILESIZE - 1 */ ++ w.in.data.data = buf; ++ w.in.data.length = 1; ++ status = smb2_write(tree, &w); ++ if (TARGET_IS_SAMBA3(torture) || TARGET_IS_SAMBA4(torture)) { ++ CHECK_STATUS(status, NT_STATUS_OK); ++ CHECK_VALUE(w.out.nwritten, 1); ++ } else { ++ CHECK_STATUS(status, NT_STATUS_DISK_FULL); ++ } ++ ++ w.in.file.handle = h; ++ w.in.offset = 0xfffffff0000; /* MAXFILESIZE */ ++ w.in.data.data = buf; ++ w.in.data.length = 0; ++ status = smb2_write(tree, &w); ++ CHECK_STATUS(status, NT_STATUS_OK); ++ CHECK_VALUE(w.out.nwritten, 0); ++ ++done: ++ talloc_free(tmp_ctx); ++ return ret; ++} ++ + struct torture_suite *torture_smb2_readwrite_init(TALLOC_CTX *ctx) + { + struct torture_suite *suite = torture_suite_create(ctx, "rw"); + + torture_suite_add_2smb2_test(suite, "rw1", run_smb2_readwritetest); + torture_suite_add_2smb2_test(suite, "rw2", run_smb2_wrap_readwritetest); ++ torture_suite_add_1smb2_test(suite, "invalid", test_rw_invalid); + + suite->description = talloc_strdup(suite, "SMB2 Samba4 Read/Write"); + +-- +2.20.1 + + +From cb8661162b9d344288a776a9e4ff29a47f2cc37d Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Fri, 8 May 2020 13:06:54 +0200 +Subject: [PATCH 02/31] lib: util: Add sys_valid_io_range() + +This implements the contraints of +[MS-FSA] 2.1.5.2 Server Requests a Read. + +The special handling of [MS-FSA] 2.1.5.3 Server Requests a Write +with offset < 0, should be handled by higher layers! +Which means the check can also be used for writes. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Jeremy Allison +(cherry picked from commit e02cbd5c3ea6903d2b7b43c3193b8662d029ecdd) +--- + lib/util/sys_rw.c | 24 ++++++++++++++++++++++++ + lib/util/sys_rw.h | 1 + + 2 files changed, 25 insertions(+) + +diff --git a/lib/util/sys_rw.c b/lib/util/sys_rw.c +index 9a6cdcaa606..6fa7ca57365 100644 +--- a/lib/util/sys_rw.c ++++ b/lib/util/sys_rw.c +@@ -24,6 +24,30 @@ + #include "system/filesys.h" + #include "lib/util/sys_rw.h" + ++bool sys_valid_io_range(off_t offset, size_t length) ++{ ++ uint64_t last_byte_ofs; ++ ++ if (offset < 0) { ++ return false; ++ } ++ ++ if (offset > INT64_MAX) { ++ return false; ++ } ++ ++ if (length > UINT32_MAX) { ++ return false; ++ } ++ ++ last_byte_ofs = (uint64_t)offset + (uint64_t)length; ++ if (last_byte_ofs > INT64_MAX) { ++ return false; ++ } ++ ++ return true; ++} ++ + /******************************************************************* + A read wrapper that will deal with EINTR/EWOULDBLOCK + ********************************************************************/ +diff --git a/lib/util/sys_rw.h b/lib/util/sys_rw.h +index ab456d87b22..70864cb2b74 100644 +--- a/lib/util/sys_rw.h ++++ b/lib/util/sys_rw.h +@@ -27,6 +27,7 @@ + + struct iovec; + ++bool sys_valid_io_range(off_t offset, size_t length); + ssize_t sys_read(int fd, void *buf, size_t count); + void sys_read_v(int fd, void *buf, size_t count); + ssize_t sys_write(int fd, const void *buf, size_t count); +-- +2.20.1 + + +From 640a6715dacfaf7ec9a2b4e4b36fa22b625f571f Mon Sep 17 00:00:00 2001 +From: Jeremy Allison +Date: Thu, 7 May 2020 12:32:48 -0700 +Subject: [PATCH 03/31] lib: util: Add sys_pread_full(). + +A pread wrapper that will deal with EINTR and never return a short +read unless pread returns zero meaning EOF. + +Thread-safe so may be used as a replacement for pread +inside pread_do() thread functions. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Pair-Programmed-With: Stefan Metzmacher + +Signed-off-by: Jeremy Allison +Signed-off-by: Stefan Metzmacher +(cherry picked from commit 36af33bf9fcdf93fce5ef1520fcb7ddbb07b355e) +--- + lib/util/sys_rw.c | 48 +++++++++++++++++++++++++++++++++++++++++++++++ + lib/util/sys_rw.h | 1 + + 2 files changed, 49 insertions(+) + +diff --git a/lib/util/sys_rw.c b/lib/util/sys_rw.c +index 6fa7ca57365..bfeb2e6b466 100644 +--- a/lib/util/sys_rw.c ++++ b/lib/util/sys_rw.c +@@ -143,6 +143,54 @@ ssize_t sys_pread(int fd, void *buf, size_t count, off_t off) + return ret; + } + ++/******************************************************************* ++ A pread wrapper that will deal with EINTR and never return a short ++ read unless pread returns zero meaning EOF. ++********************************************************************/ ++ ++ssize_t sys_pread_full(int fd, void *buf, size_t count, off_t off) ++{ ++ ssize_t total_read = 0; ++ uint8_t *curr_buf = (uint8_t *)buf; ++ size_t curr_count = count; ++ off_t curr_off = off; ++ bool ok; ++ ++ ok = sys_valid_io_range(off, count); ++ if (!ok) { ++ errno = EINVAL; ++ return -1; ++ } ++ ++ while (curr_count != 0) { ++ ssize_t ret = sys_pread(fd, ++ curr_buf, ++ curr_count, ++ curr_off); ++ ++ if (ret == -1) { ++ return -1; ++ } ++ if (ret == 0) { ++ /* EOF */ ++ break; ++ } ++ ++ if (ret > curr_count) { ++ errno = EIO; ++ return -1; ++ } ++ ++ curr_buf += ret; ++ curr_count -= ret; ++ curr_off += ret; ++ ++ total_read += ret; ++ } ++ ++ return total_read; ++} ++ + /******************************************************************* + A write wrapper that will deal with EINTR + ********************************************************************/ +diff --git a/lib/util/sys_rw.h b/lib/util/sys_rw.h +index 70864cb2b74..1e0dd3730a6 100644 +--- a/lib/util/sys_rw.h ++++ b/lib/util/sys_rw.h +@@ -34,6 +34,7 @@ ssize_t sys_write(int fd, const void *buf, size_t count); + void sys_write_v(int fd, const void *buf, size_t count); + ssize_t sys_writev(int fd, const struct iovec *iov, int iovcnt); + ssize_t sys_pread(int fd, void *buf, size_t count, off_t off); ++ssize_t sys_pread_full(int fd, void *buf, size_t count, off_t off); + ssize_t sys_pwrite(int fd, const void *buf, size_t count, off_t off); + + #endif +-- +2.20.1 + + +From c1f14bb9bb4dc2601814dda398e361a9ef097b12 Mon Sep 17 00:00:00 2001 +From: Jeremy Allison +Date: Thu, 7 May 2020 12:34:32 -0700 +Subject: [PATCH 04/31] lib: util: Add sys_pwrite_full(). + +A pwrite wrapper that will deal with EINTR and never return a short +write unless the file system returns an error. Copes with the +unspecified edge condition of pwrite returning zero by changing +the return to -1, errno = ENOSPC. + +Thread-safe so may be used as a replacement for pwrite +inside pwrite_do() thread functions. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Pair-Programmed-With: Stefan Metzmacher + +Signed-off-by: Jeremy Allison +Signed-off-by: Stefan Metzmacher +(cherry picked from commit 3ba7a89cea85d134eacf1e624e011fe6f66146fc) +--- + lib/util/sys_rw.c | 49 +++++++++++++++++++++++++++++++++++++++++++++++ + lib/util/sys_rw.h | 1 + + 2 files changed, 50 insertions(+) + +diff --git a/lib/util/sys_rw.c b/lib/util/sys_rw.c +index bfeb2e6b466..d74395fc409 100644 +--- a/lib/util/sys_rw.c ++++ b/lib/util/sys_rw.c +@@ -204,3 +204,52 @@ ssize_t sys_pwrite(int fd, const void *buf, size_t count, off_t off) + } while (ret == -1 && errno == EINTR); + return ret; + } ++ ++/******************************************************************* ++ A pwrite wrapper that will deal with EINTR and never allow a short ++ write unless the file system returns an error. ++********************************************************************/ ++ ++ssize_t sys_pwrite_full(int fd, const void *buf, size_t count, off_t off) ++{ ++ ssize_t total_written = 0; ++ const uint8_t *curr_buf = (const uint8_t *)buf; ++ size_t curr_count = count; ++ off_t curr_off = off; ++ bool ok; ++ ++ ok = sys_valid_io_range(off, count); ++ if (!ok) { ++ errno = EINVAL; ++ return -1; ++ } ++ ++ while (curr_count != 0) { ++ ssize_t ret = sys_pwrite(fd, ++ curr_buf, ++ curr_count, ++ curr_off); ++ ++ if (ret == -1) { ++ return -1; ++ } ++ if (ret == 0) { ++ /* Ensure we can never spin. */ ++ errno = ENOSPC; ++ return -1; ++ } ++ ++ if (ret > curr_count) { ++ errno = EIO; ++ return -1; ++ } ++ ++ curr_buf += ret; ++ curr_count -= ret; ++ curr_off += ret; ++ ++ total_written += ret; ++ } ++ ++ return total_written; ++} +diff --git a/lib/util/sys_rw.h b/lib/util/sys_rw.h +index 1e0dd3730a6..b224ecb30ac 100644 +--- a/lib/util/sys_rw.h ++++ b/lib/util/sys_rw.h +@@ -36,5 +36,6 @@ ssize_t sys_writev(int fd, const struct iovec *iov, int iovcnt); + ssize_t sys_pread(int fd, void *buf, size_t count, off_t off); + ssize_t sys_pread_full(int fd, void *buf, size_t count, off_t off); + ssize_t sys_pwrite(int fd, const void *buf, size_t count, off_t off); ++ssize_t sys_pwrite_full(int fd, const void *buf, size_t count, off_t off); + + #endif +-- +2.20.1 + + +From c4a08bd0b1ecebdbbbbbb257696e0f9b93eebeaa Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Mon, 11 May 2020 18:18:24 +0200 +Subject: [PATCH 05/31] smb2_server: fix smbd_smb2_request_verify_sizes() for + SMB2_OP_WRITE + +Writes with a length of 0 are allowed. + +The readfile related check we had before was not really useful +as min_dyn_len can only every be 0 or 1 (and for SMB2_OP_WRITE it's +always 1). So we checked + if (unread_bytes > 0) { + if (unread_bytes < 1) { + return error; + } + } + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Jeremy Allison +(cherry picked from commit a6eee38ba2f89280676f0a32d26745afd95b551c) +--- + source3/smbd/smb2_server.c | 10 +--------- + 1 file changed, 1 insertion(+), 9 deletions(-) + +diff --git a/source3/smbd/smb2_server.c b/source3/smbd/smb2_server.c +index 8c66d74c8de..88937ac19b0 100644 +--- a/source3/smbd/smb2_server.c ++++ b/source3/smbd/smb2_server.c +@@ -2073,16 +2073,8 @@ NTSTATUS smbd_smb2_request_verify_sizes(struct smbd_smb2_request *req, + switch (opcode) { + case SMB2_OP_IOCTL: + case SMB2_OP_GETINFO: +- min_dyn_size = 0; +- break; + case SMB2_OP_WRITE: +- if (req->smb1req != NULL && req->smb1req->unread_bytes > 0) { +- if (req->smb1req->unread_bytes < min_dyn_size) { +- return NT_STATUS_INVALID_PARAMETER; +- } +- +- min_dyn_size = 0; +- } ++ min_dyn_size = 0; + break; + } + +-- +2.20.1 + + +From 74fadf2f083daaf4358a9b64c1092586595894d5 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Mon, 11 May 2020 18:18:24 +0200 +Subject: [PATCH 06/31] s3:smbd: handle 0 length writes as no-op. + +They should never touch the SMB_VFS layer +and they never trigger an DISK_FULL error. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Jeremy Allison +(cherry picked from commit ba68f21286c2c2f1fef8bf8c9cd500a622077887) +--- + source3/smbd/aio.c | 5 +++++ + source3/smbd/fileio.c | 4 ++++ + 2 files changed, 9 insertions(+) + +diff --git a/source3/smbd/aio.c b/source3/smbd/aio.c +index cf35f3297ec..088ea603788 100644 +--- a/source3/smbd/aio.c ++++ b/source3/smbd/aio.c +@@ -339,6 +339,11 @@ static struct tevent_req *pwrite_fsync_send(TALLOC_CTX *mem_ctx, + state->fsp = fsp; + state->write_through = write_through; + ++ if (n == 0) { ++ tevent_req_done(req); ++ return tevent_req_post(req, ev); ++ } ++ + subreq = SMB_VFS_PWRITE_SEND(state, ev, fsp, data, n, offset); + if (tevent_req_nomem(subreq, req)) { + return tevent_req_post(req, ev); +diff --git a/source3/smbd/fileio.c b/source3/smbd/fileio.c +index 31d5b7510b7..f4a3dde66b7 100644 +--- a/source3/smbd/fileio.c ++++ b/source3/smbd/fileio.c +@@ -70,6 +70,10 @@ static ssize_t real_write_file(struct smb_request *req, + { + ssize_t ret; + ++ if (n == 0) { ++ return 0; ++ } ++ + fsp->fh->pos = pos; + if (pos && lp_strict_allocate(SNUM(fsp->conn) && + !fsp->is_sparse)) { +-- +2.20.1 + + +From c593b105e646792cf19901e94ed764dc3b50d752 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Mon, 11 May 2020 22:00:37 +0200 +Subject: [PATCH 07/31] s3:smbd: add vfs_valid_{pread,pwrite}_range() helper + functions + +These implement the SMB2 visible behavior of the [MS-FSA] +2.1.5.2 Server Requests a Read and 2.1.5.3 Server Requests a Write +constraints. Note that offset < 0 is not allowed over SMB. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Jeremy Allison +(cherry picked from commit 70fa4b884d2c22669984c25fe757c2fc528f7331) +--- + source3/smbd/proto.h | 2 ++ + source3/smbd/vfs.c | 32 ++++++++++++++++++++++++++++++++ + 2 files changed, 34 insertions(+) + +diff --git a/source3/smbd/proto.h b/source3/smbd/proto.h +index 8e33c473d44..60941ce6c1b 100644 +--- a/source3/smbd/proto.h ++++ b/source3/smbd/proto.h +@@ -1246,6 +1246,8 @@ void sys_utmp_yield(const char *username, const char *hostname, + bool vfs_init_custom(connection_struct *conn, const char *vfs_object); + bool smbd_vfs_init(connection_struct *conn); + NTSTATUS vfs_file_exist(connection_struct *conn, struct smb_filename *smb_fname); ++bool vfs_valid_pread_range(off_t offset, size_t length); ++bool vfs_valid_pwrite_range(off_t offset, size_t length); + ssize_t vfs_pwrite_data(struct smb_request *req, + files_struct *fsp, + const char *buffer, +diff --git a/source3/smbd/vfs.c b/source3/smbd/vfs.c +index 7dc15158ccb..566eed35d9b 100644 +--- a/source3/smbd/vfs.c ++++ b/source3/smbd/vfs.c +@@ -32,6 +32,7 @@ + #include "ntioctl.h" + #include "lib/util/tevent_unix.h" + #include "lib/util/tevent_ntstatus.h" ++#include "lib/util/sys_rw.h" + + #undef DBGC_CLASS + #define DBGC_CLASS DBGC_VFS +@@ -399,6 +400,37 @@ NTSTATUS vfs_file_exist(connection_struct *conn, struct smb_filename *smb_fname) + return NT_STATUS_OBJECT_NAME_NOT_FOUND; + } + ++bool vfs_valid_pread_range(off_t offset, size_t length) ++{ ++ return sys_valid_io_range(offset, length); ++} ++ ++bool vfs_valid_pwrite_range(off_t offset, size_t length) ++{ ++ /* ++ * See MAXFILESIZE in [MS-FSA] 2.1.5.3 Server Requests a Write ++ */ ++ static const uint64_t maxfilesize = 0xfffffff0000; ++ uint64_t last_byte_ofs; ++ bool ok; ++ ++ ok = sys_valid_io_range(offset, length); ++ if (!ok) { ++ return false; ++ } ++ ++ if (length == 0) { ++ return true; ++ } ++ ++ last_byte_ofs = offset + length; ++ if (last_byte_ofs > maxfilesize) { ++ return false; ++ } ++ ++ return true; ++} ++ + ssize_t vfs_pwrite_data(struct smb_request *req, + files_struct *fsp, + const char *buffer, +-- +2.20.1 + + +From 9e1f6bb08d5e814e9894d643c46ff1aac6a8da0b Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Mon, 11 May 2020 18:18:24 +0200 +Subject: [PATCH 08/31] smbd: add vfs_valid_{pread,pwrite}_range() checks where + needed + +I checked all callers of SMB_VFS_PWRITE[_SEND](), +all callers of SMB_VFS_PREAD[_SEND]() and also +places where we append to the file and allocate +more space. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Jeremy Allison +(cherry picked from commit 6fa753a1a67d563cd22d0cad73ae15ee267512fc) +--- + selftest/knownfail.d/rw-invalid | 3 +-- + source3/modules/vfs_default.c | 7 +++++++ + source3/smbd/aio.c | 19 ++++++++++++++++++ + source3/smbd/fileio.c | 14 ++++++++++++++ + source3/smbd/vfs.c | 34 +++++++++++++++++++++++++++++++-- + 5 files changed, 73 insertions(+), 4 deletions(-) + +diff --git a/selftest/knownfail.d/rw-invalid b/selftest/knownfail.d/rw-invalid +index c6f11e03d20..ac5fe573239 100644 +--- a/selftest/knownfail.d/rw-invalid ++++ b/selftest/knownfail.d/rw-invalid +@@ -1,2 +1 @@ +-samba3.smb2.rw.invalid +-samba4.smb2.rw.invalid ++samba4.smb2.rw.invalid.ad_dc_ntvfs +diff --git a/source3/modules/vfs_default.c b/source3/modules/vfs_default.c +index a30f3ba1d31..3511c548166 100644 +--- a/source3/modules/vfs_default.c ++++ b/source3/modules/vfs_default.c +@@ -2582,6 +2582,13 @@ static int strict_allocate_ftruncate(vfs_handle_struct *handle, files_struct *fs + int ret; + NTSTATUS status; + SMB_STRUCT_STAT *pst; ++ bool ok; ++ ++ ok = vfs_valid_pwrite_range(len, 0); ++ if (!ok) { ++ errno = EINVAL; ++ return -1; ++ } + + status = vfs_stat_fsp(fsp); + if (!NT_STATUS_IS_OK(status)) { +diff --git a/source3/smbd/aio.c b/source3/smbd/aio.c +index 088ea603788..af8a01461a7 100644 +--- a/source3/smbd/aio.c ++++ b/source3/smbd/aio.c +@@ -166,6 +166,12 @@ NTSTATUS schedule_aio_read_and_X(connection_struct *conn, + size_t bufsize; + size_t min_aio_read_size = lp_aio_read_size(SNUM(conn)); + struct tevent_req *req; ++ bool ok; ++ ++ ok = vfs_valid_pread_range(startpos, smb_maxcnt); ++ if (!ok) { ++ return NT_STATUS_INVALID_PARAMETER; ++ } + + if (fsp->base_fsp != NULL) { + /* No AIO on streams yet */ +@@ -330,6 +336,7 @@ static struct tevent_req *pwrite_fsync_send(TALLOC_CTX *mem_ctx, + { + struct tevent_req *req, *subreq; + struct pwrite_fsync_state *state; ++ bool ok; + + req = tevent_req_create(mem_ctx, &state, struct pwrite_fsync_state); + if (req == NULL) { +@@ -339,6 +346,12 @@ static struct tevent_req *pwrite_fsync_send(TALLOC_CTX *mem_ctx, + state->fsp = fsp; + state->write_through = write_through; + ++ ok = vfs_valid_pwrite_range(offset, n); ++ if (!ok) { ++ tevent_req_error(req, EINVAL); ++ return tevent_req_post(req, ev); ++ } ++ + if (n == 0) { + tevent_req_done(req); + return tevent_req_post(req, ev); +@@ -665,6 +678,12 @@ NTSTATUS schedule_smb2_aio_read(connection_struct *conn, + struct aio_extra *aio_ex; + size_t min_aio_read_size = lp_aio_read_size(SNUM(conn)); + struct tevent_req *req; ++ bool ok; ++ ++ ok = vfs_valid_pread_range(startpos, smb_maxcnt); ++ if (!ok) { ++ return NT_STATUS_INVALID_PARAMETER; ++ } + + if (fsp->base_fsp != NULL) { + /* No AIO on streams yet */ +diff --git a/source3/smbd/fileio.c b/source3/smbd/fileio.c +index f4a3dde66b7..000a01e2c0f 100644 +--- a/source3/smbd/fileio.c ++++ b/source3/smbd/fileio.c +@@ -32,6 +32,7 @@ + ssize_t read_file(files_struct *fsp,char *data,off_t pos,size_t n) + { + ssize_t ret = 0; ++ bool ok; + + /* you can't read from print files */ + if (fsp->print_file) { +@@ -39,6 +40,12 @@ ssize_t read_file(files_struct *fsp,char *data,off_t pos,size_t n) + return -1; + } + ++ ok = vfs_valid_pread_range(pos, n); ++ if (!ok) { ++ errno = EINVAL; ++ return -1; ++ } ++ + fsp->fh->pos = pos; + + if (n > 0) { +@@ -69,6 +76,13 @@ static ssize_t real_write_file(struct smb_request *req, + size_t n) + { + ssize_t ret; ++ bool ok; ++ ++ ok = vfs_valid_pwrite_range(pos, n); ++ if (!ok) { ++ errno = EINVAL; ++ return -1; ++ } + + if (n == 0) { + return 0; +diff --git a/source3/smbd/vfs.c b/source3/smbd/vfs.c +index 566eed35d9b..96067e45005 100644 +--- a/source3/smbd/vfs.c ++++ b/source3/smbd/vfs.c +@@ -439,6 +439,13 @@ ssize_t vfs_pwrite_data(struct smb_request *req, + { + size_t total=0; + ssize_t ret; ++ bool ok; ++ ++ ok = vfs_valid_pwrite_range(offset, N); ++ if (!ok) { ++ errno = EINVAL; ++ return -1; ++ } + + if (req && req->unread_bytes) { + int sockfd = req->xconn->transport.sock; +@@ -515,6 +522,7 @@ int vfs_allocate_file_space(files_struct *fsp, uint64_t len) + uint64_t space_avail; + uint64_t bsize,dfree,dsize; + NTSTATUS status; ++ bool ok; + + /* + * Actually try and commit the space on disk.... +@@ -523,8 +531,9 @@ int vfs_allocate_file_space(files_struct *fsp, uint64_t len) + DEBUG(10,("vfs_allocate_file_space: file %s, len %.0f\n", + fsp_str_dbg(fsp), (double)len)); + +- if (((off_t)len) < 0) { +- DEBUG(0,("vfs_allocate_file_space: %s negative len " ++ ok = vfs_valid_pwrite_range((off_t)len, 0); ++ if (!ok) { ++ DEBUG(0,("vfs_allocate_file_space: %s negative/invalid len " + "requested.\n", fsp_str_dbg(fsp))); + errno = EINVAL; + return -1; +@@ -609,6 +618,13 @@ int vfs_allocate_file_space(files_struct *fsp, uint64_t len) + int vfs_set_filelen(files_struct *fsp, off_t len) + { + int ret; ++ bool ok; ++ ++ ok = vfs_valid_pwrite_range(len, 0); ++ if (!ok) { ++ errno = EINVAL; ++ return -1; ++ } + + contend_level2_oplocks_begin(fsp, LEVEL2_CONTEND_SET_FILE_LEN); + +@@ -640,6 +656,13 @@ int vfs_slow_fallocate(files_struct *fsp, off_t offset, off_t len) + { + ssize_t pwrite_ret; + size_t total = 0; ++ bool ok; ++ ++ ok = vfs_valid_pwrite_range(offset, len); ++ if (!ok) { ++ errno = EINVAL; ++ return -1; ++ } + + if (!sparse_buf) { + sparse_buf = SMB_CALLOC_ARRAY(char, SPARSE_BUF_WRITE_SIZE); +@@ -680,6 +703,13 @@ int vfs_fill_sparse(files_struct *fsp, off_t len) + NTSTATUS status; + off_t offset; + size_t num_to_write; ++ bool ok; ++ ++ ok = vfs_valid_pwrite_range(len, 0); ++ if (!ok) { ++ errno = EINVAL; ++ return -1; ++ } + + status = vfs_stat_fsp(fsp); + if (!NT_STATUS_IS_OK(status)) { +-- +2.20.1 + + +From af989582036a929eb0e2594b1e2ee54145d41286 Mon Sep 17 00:00:00 2001 +From: Jeremy Allison +Date: Thu, 7 May 2020 12:42:10 -0700 +Subject: [PATCH 09/31] s3: VFS: aio_fork: Change sys_pread() -> + sys_pread_full() to protect against short reads. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Jeremy Allison +Reviewed-by: Stefan Metzmacher +(cherry picked from commit 60f590000d545292760018694deb34a7cc4ded6d) +--- + source3/modules/vfs_aio_fork.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/source3/modules/vfs_aio_fork.c b/source3/modules/vfs_aio_fork.c +index a1fed5c0655..285b331ff9c 100644 +--- a/source3/modules/vfs_aio_fork.c ++++ b/source3/modules/vfs_aio_fork.c +@@ -342,7 +342,7 @@ static void aio_child_loop(int sockfd, struct mmap_area *map) + + switch (cmd_struct.cmd) { + case READ_CMD: +- ret_struct.size = sys_pread( ++ ret_struct.size = sys_pread_full( + fd, discard_const(map->ptr), cmd_struct.n, + cmd_struct.offset); + #if 0 +-- +2.20.1 + + +From 52b13fda0509f3bb28026a3d0f7d304c3bf28b08 Mon Sep 17 00:00:00 2001 +From: Jeremy Allison +Date: Thu, 7 May 2020 12:42:53 -0700 +Subject: [PATCH 10/31] s3: VFS: aio_fork: Change sys_pwrite() -> + sys_pwrite_full() to protect against short writes. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Jeremy Allison +Reviewed-by: Stefan Metzmacher +(cherry picked from commit 20ee8b03bbe5bef4ea968170808e3c4c9d22318e) +--- + source3/modules/vfs_aio_fork.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/source3/modules/vfs_aio_fork.c b/source3/modules/vfs_aio_fork.c +index 285b331ff9c..7c6f4b00fd0 100644 +--- a/source3/modules/vfs_aio_fork.c ++++ b/source3/modules/vfs_aio_fork.c +@@ -353,7 +353,7 @@ static void aio_child_loop(int sockfd, struct mmap_area *map) + #endif + break; + case WRITE_CMD: +- ret_struct.size = sys_pwrite( ++ ret_struct.size = sys_pwrite_full( + fd, discard_const(map->ptr), cmd_struct.n, + cmd_struct.offset); + break; +-- +2.20.1 + + +From bd99244e029ef1df6a60a276d794bcd465a7bb5b Mon Sep 17 00:00:00 2001 +From: Jeremy Allison +Date: Thu, 7 May 2020 12:43:34 -0700 +Subject: [PATCH 11/31] s3: VFS: default. Change sys_pread() -> + sys_pread_full() in SMB_VFS_PREAD() to protect against short reads. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Jeremy Allison +Reviewed-by: Stefan Metzmacher +(cherry picked from commit 7daa79908b6a0362db30276b3b6f0db176b6ae3c) +--- + source3/modules/vfs_default.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/source3/modules/vfs_default.c b/source3/modules/vfs_default.c +index 3511c548166..1170629b084 100644 +--- a/source3/modules/vfs_default.c ++++ b/source3/modules/vfs_default.c +@@ -739,7 +739,7 @@ static ssize_t vfswrap_pread(vfs_handle_struct *handle, files_struct *fsp, void + + #if defined(HAVE_PREAD) || defined(HAVE_PREAD64) + START_PROFILE_BYTES(syscall_pread, n); +- result = sys_pread(fsp->fh->fd, data, n, offset); ++ result = sys_pread_full(fsp->fh->fd, data, n, offset); + END_PROFILE_BYTES(syscall_pread); + + if (result == -1 && errno == ESPIPE) { +-- +2.20.1 + + +From 26ec59040879427166e04cdadbff175a40018c87 Mon Sep 17 00:00:00 2001 +From: Jeremy Allison +Date: Thu, 7 May 2020 12:44:26 -0700 +Subject: [PATCH 12/31] s3: VFS: default. Change sys_pwrite() -> + sys_pwrite_full() in SMB_VFS_PWRITE() to protect against short writes. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Jeremy Allison +Reviewed-by: Stefan Metzmacher +(cherry picked from commit ca8c3619f657dc38db7cb248f1a657f5bfe20757) +--- + source3/modules/vfs_default.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/source3/modules/vfs_default.c b/source3/modules/vfs_default.c +index 1170629b084..e516c733e69 100644 +--- a/source3/modules/vfs_default.c ++++ b/source3/modules/vfs_default.c +@@ -763,7 +763,7 @@ static ssize_t vfswrap_pwrite(vfs_handle_struct *handle, files_struct *fsp, cons + + #if defined(HAVE_PWRITE) || defined(HAVE_PRWITE64) + START_PROFILE_BYTES(syscall_pwrite, n); +- result = sys_pwrite(fsp->fh->fd, data, n, offset); ++ result = sys_pwrite_full(fsp->fh->fd, data, n, offset); + END_PROFILE_BYTES(syscall_pwrite); + + if (result == -1 && errno == ESPIPE) { +-- +2.20.1 + + +From fa25bd26d1fe02c7480f2af7e22af8a03127157e Mon Sep 17 00:00:00 2001 +From: Jeremy Allison +Date: Thu, 7 May 2020 12:45:10 -0700 +Subject: [PATCH 13/31] s3: VFS: default. Change pread() -> sys_pread_full() in + SMB_VFS_PREAD_SEND() to protect against short reads. + +Note that as sys_pread_full() deals with the EINTR case +we can remove the do {} while loop here. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Jeremy Allison +Reviewed-by: Stefan Metzmacher +(cherry picked from commit bf2e546be38abfc77cf40e0b0fef42937696dcde) +--- + source3/modules/vfs_default.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/source3/modules/vfs_default.c b/source3/modules/vfs_default.c +index e516c733e69..809c9b3d92f 100644 +--- a/source3/modules/vfs_default.c ++++ b/source3/modules/vfs_default.c +@@ -843,10 +843,10 @@ static void vfs_pread_do(void *private_data) + + PROFILE_TIMESTAMP(&start_time); + +- do { +- state->ret = pread(state->fd, state->buf, state->count, +- state->offset); +- } while ((state->ret == -1) && (errno == EINTR)); ++ state->ret = sys_pread_full(state->fd, ++ state->buf, ++ state->count, ++ state->offset); + + if (state->ret == -1) { + state->vfs_aio_state.error = errno; +-- +2.20.1 + + +From 9a4639d6500900e18dfb685fbf4dc597f98cc63c Mon Sep 17 00:00:00 2001 +From: Jeremy Allison +Date: Thu, 7 May 2020 12:48:49 -0700 +Subject: [PATCH 14/31] s3: VFS: default. Change pwrite() -> sys_pwrite_full() + in SMB_VFS_PWRITE_SEND() to protect against short writes. + +Note that as sys_pwrite_full() deals with the EINTR case +we can remove the do {} while loop here. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Jeremy Allison +Reviewed-by: Stefan Metzmacher +(cherry picked from commit 801c06f4c9400343b72cad998086288931f7c6b3) +--- + source3/modules/vfs_default.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/source3/modules/vfs_default.c b/source3/modules/vfs_default.c +index 809c9b3d92f..4cf553411cb 100644 +--- a/source3/modules/vfs_default.c ++++ b/source3/modules/vfs_default.c +@@ -971,10 +971,10 @@ static void vfs_pwrite_do(void *private_data) + + PROFILE_TIMESTAMP(&start_time); + +- do { +- state->ret = pwrite(state->fd, state->buf, state->count, +- state->offset); +- } while ((state->ret == -1) && (errno == EINTR)); ++ state->ret = sys_pwrite_full(state->fd, ++ state->buf, ++ state->count, ++ state->offset); + + if (state->ret == -1) { + state->vfs_aio_state.error = errno; +-- +2.20.1 + + +From 9ecf0e23c6b5f40cf73df600b4ce2e6469d32065 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Wed, 6 May 2020 03:05:47 -0700 +Subject: [PATCH 15/31] vfs_io_uring: fix the prefix for parametric options + from 'vfs_io_uring' to 'io_uring' + +This is what the manpage describes. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Jeremy Allison +(cherry picked from commit fadc7043a71b409ad60a1a4076a7f88f379d2056) +--- + source3/modules/vfs_io_uring.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c +index 378e48d112f..b409d075337 100644 +--- a/source3/modules/vfs_io_uring.c ++++ b/source3/modules/vfs_io_uring.c +@@ -172,13 +172,13 @@ static int vfs_io_uring_connect(vfs_handle_struct *handle, const char *service, + } + + num_entries = lp_parm_ulong(SNUM(handle->conn), +- "vfs_io_uring", ++ "io_uring", + "num_entries", + 128); + num_entries = MAX(num_entries, 1); + + sqpoll = lp_parm_bool(SNUM(handle->conn), +- "vfs_io_uring", ++ "io_uring", + "sqpoll", + false); + if (sqpoll) { +-- +2.20.1 + + +From 0f22fb3e27bdda29e4969e4ddb64f0287deb5599 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Fri, 8 May 2020 10:39:52 +0200 +Subject: [PATCH 16/31] vfs_io_uring: replace vfs_io_uring_request->state with + _tevent_req_data() + +We don't need a direct pointer to the state... + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Jeremy Allison +(cherry picked from commit f78e98e0226fe70899b613e0aa5c804d8458bdb0) +--- + source3/modules/vfs_io_uring.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c +index b409d075337..988b309da52 100644 +--- a/source3/modules/vfs_io_uring.c ++++ b/source3/modules/vfs_io_uring.c +@@ -42,7 +42,6 @@ struct vfs_io_uring_request { + struct vfs_io_uring_request **list_head; + struct vfs_io_uring_config *config; + struct tevent_req *req; +- void *state; + struct io_uring_sqe sqe; + struct io_uring_cqe cqe; + struct timespec start_time; +@@ -58,8 +57,9 @@ static void vfs_io_uring_finish_req(struct vfs_io_uring_request *cur, + struct tevent_req *req = + talloc_get_type_abort(cur->req, + struct tevent_req); ++ void *state = _tevent_req_data(req); + +- talloc_set_destructor(cur->state, NULL); ++ talloc_set_destructor(state, NULL); + if (cur->list_head != NULL) { + DLIST_REMOVE((*cur->list_head), cur); + cur->list_head = NULL; +@@ -238,6 +238,7 @@ static void vfs_io_uring_queue_run(struct vfs_io_uring_config *config) + + for (cur = config->queue; cur != NULL; cur = next) { + struct io_uring_sqe *sqe = NULL; ++ void *state = _tevent_req_data(cur->req); + + next = cur->next; + +@@ -246,7 +247,7 @@ static void vfs_io_uring_queue_run(struct vfs_io_uring_config *config) + break; + } + +- talloc_set_destructor(cur->state, ++ talloc_set_destructor(state, + vfs_io_uring_request_state_deny_destructor); + DLIST_REMOVE(config->queue, cur); + *sqe = cur->sqe; +@@ -318,7 +319,6 @@ static struct tevent_req *vfs_io_uring_pread_send(struct vfs_handle_struct *hand + } + state->ur.config = config; + state->ur.req = req; +- state->ur.state = state; + + SMBPROFILE_BYTES_ASYNC_START(syscall_asys_pread, profile_p, + state->ur.profile_bytes, n); +@@ -398,7 +398,6 @@ static struct tevent_req *vfs_io_uring_pwrite_send(struct vfs_handle_struct *han + } + state->ur.config = config; + state->ur.req = req; +- state->ur.state = state; + + SMBPROFILE_BYTES_ASYNC_START(syscall_asys_pwrite, profile_p, + state->ur.profile_bytes, n); +@@ -475,7 +474,6 @@ static struct tevent_req *vfs_io_uring_fsync_send(struct vfs_handle_struct *hand + } + state->ur.config = config; + state->ur.req = req; +- state->ur.state = state; + + SMBPROFILE_BYTES_ASYNC_START(syscall_asys_fsync, profile_p, + state->ur.profile_bytes, 0); +-- +2.20.1 + + +From 61d1e13c927a8fb8439d576026dc56a2379f127d Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Fri, 8 May 2020 10:42:59 +0200 +Subject: [PATCH 17/31] vfs_io_uring: introduce + vfs_io_uring_request->completion_fn() + +We'll need to add more logic than a simple _tevent_req_done() + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Jeremy Allison +(cherry picked from commit 456533c9cfc332d3a83ea03a6f969b0d64ccbeb6) +--- + source3/modules/vfs_io_uring.c | 49 +++++++++++++++++++++++++++++++++- + 1 file changed, 48 insertions(+), 1 deletion(-) + +diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c +index 988b309da52..abdd4d16e9f 100644 +--- a/source3/modules/vfs_io_uring.c ++++ b/source3/modules/vfs_io_uring.c +@@ -44,6 +44,8 @@ struct vfs_io_uring_request { + struct tevent_req *req; + struct io_uring_sqe sqe; + struct io_uring_cqe cqe; ++ void (*completion_fn)(struct vfs_io_uring_request *cur, ++ const char *location); + struct timespec start_time; + struct timespec end_time; + SMBPROFILE_BYTES_ASYNC_STATE(profile_bytes); +@@ -74,7 +76,7 @@ static void vfs_io_uring_finish_req(struct vfs_io_uring_request *cur, + * or tevent_req_defer_callback() being called + * already. + */ +- _tevent_req_done(req, location); ++ cur->completion_fn(cur, location); + } + + static void vfs_io_uring_config_destroy(struct vfs_io_uring_config *config, +@@ -297,6 +299,9 @@ struct vfs_io_uring_pread_state { + struct iovec iov; + }; + ++static void vfs_io_uring_pread_completion(struct vfs_io_uring_request *cur, ++ const char *location); ++ + static struct tevent_req *vfs_io_uring_pread_send(struct vfs_handle_struct *handle, + TALLOC_CTX *mem_ctx, + struct tevent_context *ev, +@@ -319,6 +324,7 @@ static struct tevent_req *vfs_io_uring_pread_send(struct vfs_handle_struct *hand + } + state->ur.config = config; + state->ur.req = req; ++ state->ur.completion_fn = vfs_io_uring_pread_completion; + + SMBPROFILE_BYTES_ASYNC_START(syscall_asys_pread, profile_p, + state->ur.profile_bytes, n); +@@ -344,6 +350,17 @@ static struct tevent_req *vfs_io_uring_pread_send(struct vfs_handle_struct *hand + return req; + } + ++static void vfs_io_uring_pread_completion(struct vfs_io_uring_request *cur, ++ const char *location) ++{ ++ /* ++ * We rely on being inside the _send() function ++ * or tevent_req_defer_callback() being called ++ * already. ++ */ ++ _tevent_req_done(cur->req, location); ++} ++ + static ssize_t vfs_io_uring_pread_recv(struct tevent_req *req, + struct vfs_aio_state *vfs_aio_state) + { +@@ -376,6 +393,9 @@ struct vfs_io_uring_pwrite_state { + struct iovec iov; + }; + ++static void vfs_io_uring_pwrite_completion(struct vfs_io_uring_request *cur, ++ const char *location); ++ + static struct tevent_req *vfs_io_uring_pwrite_send(struct vfs_handle_struct *handle, + TALLOC_CTX *mem_ctx, + struct tevent_context *ev, +@@ -398,6 +418,7 @@ static struct tevent_req *vfs_io_uring_pwrite_send(struct vfs_handle_struct *han + } + state->ur.config = config; + state->ur.req = req; ++ state->ur.completion_fn = vfs_io_uring_pwrite_completion; + + SMBPROFILE_BYTES_ASYNC_START(syscall_asys_pwrite, profile_p, + state->ur.profile_bytes, n); +@@ -423,6 +444,17 @@ static struct tevent_req *vfs_io_uring_pwrite_send(struct vfs_handle_struct *han + return req; + } + ++static void vfs_io_uring_pwrite_completion(struct vfs_io_uring_request *cur, ++ const char *location) ++{ ++ /* ++ * We rely on being inside the _send() function ++ * or tevent_req_defer_callback() being called ++ * already. ++ */ ++ _tevent_req_done(cur->req, location); ++} ++ + static ssize_t vfs_io_uring_pwrite_recv(struct tevent_req *req, + struct vfs_aio_state *vfs_aio_state) + { +@@ -454,6 +486,9 @@ struct vfs_io_uring_fsync_state { + struct vfs_io_uring_request ur; + }; + ++static void vfs_io_uring_fsync_completion(struct vfs_io_uring_request *cur, ++ const char *location); ++ + static struct tevent_req *vfs_io_uring_fsync_send(struct vfs_handle_struct *handle, + TALLOC_CTX *mem_ctx, + struct tevent_context *ev, +@@ -474,6 +509,7 @@ static struct tevent_req *vfs_io_uring_fsync_send(struct vfs_handle_struct *hand + } + state->ur.config = config; + state->ur.req = req; ++ state->ur.completion_fn = vfs_io_uring_fsync_completion; + + SMBPROFILE_BYTES_ASYNC_START(syscall_asys_fsync, profile_p, + state->ur.profile_bytes, 0); +@@ -496,6 +532,17 @@ static struct tevent_req *vfs_io_uring_fsync_send(struct vfs_handle_struct *hand + return req; + } + ++static void vfs_io_uring_fsync_completion(struct vfs_io_uring_request *cur, ++ const char *location) ++{ ++ /* ++ * We rely on being inside the _send() function ++ * or tevent_req_defer_callback() being called ++ * already. ++ */ ++ _tevent_req_done(cur->req, location); ++} ++ + static int vfs_io_uring_fsync_recv(struct tevent_req *req, + struct vfs_aio_state *vfs_aio_state) + { +-- +2.20.1 + + +From 1d670bd14381a00c872ec56033f602b9e18f11b0 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Fri, 8 May 2020 10:52:52 +0200 +Subject: [PATCH 18/31] vfs_io_uring: move error handling out of + vfs_io_uring_pread_recv() + +We should do that as early as possible and that's in +vfs_io_uring_pread_completion(). + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Jeremy Allison +(cherry picked from commit a1487067a6c9df3136fd5d4d16dda4c0f63cb662) +--- + source3/modules/vfs_io_uring.c | 26 +++++++++++++++++--------- + 1 file changed, 17 insertions(+), 9 deletions(-) + +diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c +index abdd4d16e9f..0d8e1833009 100644 +--- a/source3/modules/vfs_io_uring.c ++++ b/source3/modules/vfs_io_uring.c +@@ -297,6 +297,7 @@ static void vfs_io_uring_fd_handler(struct tevent_context *ev, + struct vfs_io_uring_pread_state { + struct vfs_io_uring_request ur; + struct iovec iov; ++ size_t nread; + }; + + static void vfs_io_uring_pread_completion(struct vfs_io_uring_request *cur, +@@ -353,12 +354,23 @@ static struct tevent_req *vfs_io_uring_pread_send(struct vfs_handle_struct *hand + static void vfs_io_uring_pread_completion(struct vfs_io_uring_request *cur, + const char *location) + { ++ struct vfs_io_uring_pread_state *state = tevent_req_data( ++ cur->req, struct vfs_io_uring_pread_state); ++ + /* + * We rely on being inside the _send() function + * or tevent_req_defer_callback() being called + * already. + */ +- _tevent_req_done(cur->req, location); ++ ++ if (cur->cqe.res < 0) { ++ int err = -cur->cqe.res; ++ _tevent_req_error(cur->req, err, location); ++ return; ++ } ++ ++ state->nread = state->ur.cqe.res; ++ tevent_req_done(cur->req); + } + + static ssize_t vfs_io_uring_pread_recv(struct tevent_req *req, +@@ -366,23 +378,19 @@ static ssize_t vfs_io_uring_pread_recv(struct tevent_req *req, + { + struct vfs_io_uring_pread_state *state = tevent_req_data( + req, struct vfs_io_uring_pread_state); +- int ret; ++ ssize_t ret; + + SMBPROFILE_BYTES_ASYNC_END(state->ur.profile_bytes); + vfs_aio_state->duration = nsec_time_diff(&state->ur.end_time, + &state->ur.start_time); + + if (tevent_req_is_unix_error(req, &vfs_aio_state->error)) { ++ tevent_req_received(req); + return -1; + } + +- if (state->ur.cqe.res < 0) { +- vfs_aio_state->error = -state->ur.cqe.res; +- ret = -1; +- } else { +- vfs_aio_state->error = 0; +- ret = state->ur.cqe.res; +- } ++ vfs_aio_state->error = 0; ++ ret = state->nread; + + tevent_req_received(req); + return ret; +-- +2.20.1 + + +From d340f961466be94d1467b4953389b721421fb86a Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Fri, 8 May 2020 10:52:52 +0200 +Subject: [PATCH 19/31] vfs_io_uring: move error handling out of + vfs_io_uring_pwrite_recv() + +We should do that as early as possible and that's in +vfs_io_uring_pwrite_completion(). + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Jeremy Allison +(cherry picked from commit a51969b8c7e6e49c0d3b776d897aea4f309f8678) +--- + source3/modules/vfs_io_uring.c | 26 +++++++++++++++++--------- + 1 file changed, 17 insertions(+), 9 deletions(-) + +diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c +index 0d8e1833009..a8da341e7b7 100644 +--- a/source3/modules/vfs_io_uring.c ++++ b/source3/modules/vfs_io_uring.c +@@ -399,6 +399,7 @@ static ssize_t vfs_io_uring_pread_recv(struct tevent_req *req, + struct vfs_io_uring_pwrite_state { + struct vfs_io_uring_request ur; + struct iovec iov; ++ size_t nwritten; + }; + + static void vfs_io_uring_pwrite_completion(struct vfs_io_uring_request *cur, +@@ -455,12 +456,23 @@ static struct tevent_req *vfs_io_uring_pwrite_send(struct vfs_handle_struct *han + static void vfs_io_uring_pwrite_completion(struct vfs_io_uring_request *cur, + const char *location) + { ++ struct vfs_io_uring_pwrite_state *state = tevent_req_data( ++ cur->req, struct vfs_io_uring_pwrite_state); ++ + /* + * We rely on being inside the _send() function + * or tevent_req_defer_callback() being called + * already. + */ +- _tevent_req_done(cur->req, location); ++ ++ if (cur->cqe.res < 0) { ++ int err = -cur->cqe.res; ++ _tevent_req_error(cur->req, err, location); ++ return; ++ } ++ ++ state->nwritten = state->ur.cqe.res; ++ tevent_req_done(cur->req); + } + + static ssize_t vfs_io_uring_pwrite_recv(struct tevent_req *req, +@@ -468,23 +480,19 @@ static ssize_t vfs_io_uring_pwrite_recv(struct tevent_req *req, + { + struct vfs_io_uring_pwrite_state *state = tevent_req_data( + req, struct vfs_io_uring_pwrite_state); +- int ret; ++ ssize_t ret; + + SMBPROFILE_BYTES_ASYNC_END(state->ur.profile_bytes); + vfs_aio_state->duration = nsec_time_diff(&state->ur.end_time, + &state->ur.start_time); + + if (tevent_req_is_unix_error(req, &vfs_aio_state->error)) { ++ tevent_req_received(req); + return -1; + } + +- if (state->ur.cqe.res < 0) { +- vfs_aio_state->error = -state->ur.cqe.res; +- ret = -1; +- } else { +- vfs_aio_state->error = 0; +- ret = state->ur.cqe.res; +- } ++ vfs_aio_state->error = 0; ++ ret = state->nwritten; + + tevent_req_received(req); + return ret; +-- +2.20.1 + + +From 3da1624f4f6a674dd1e83d2b327e7a38cca7c252 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Fri, 8 May 2020 10:52:52 +0200 +Subject: [PATCH 20/31] vfs_io_uring: move error handling out of + vfs_io_uring_fsync_recv() + +We should do that as early as possible and that's in +vfs_io_uring_fsync_completion(). + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Jeremy Allison +(cherry picked from commit 40be2232a44a86cb5dfdda330801e615826408ba) +--- + source3/modules/vfs_io_uring.c | 21 +++++++++++---------- + 1 file changed, 11 insertions(+), 10 deletions(-) + +diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c +index a8da341e7b7..0f560c95b67 100644 +--- a/source3/modules/vfs_io_uring.c ++++ b/source3/modules/vfs_io_uring.c +@@ -556,7 +556,14 @@ static void vfs_io_uring_fsync_completion(struct vfs_io_uring_request *cur, + * or tevent_req_defer_callback() being called + * already. + */ +- _tevent_req_done(cur->req, location); ++ ++ if (cur->cqe.res < 0) { ++ int err = -cur->cqe.res; ++ _tevent_req_error(cur->req, err, location); ++ return; ++ } ++ ++ tevent_req_done(cur->req); + } + + static int vfs_io_uring_fsync_recv(struct tevent_req *req, +@@ -564,26 +571,20 @@ static int vfs_io_uring_fsync_recv(struct tevent_req *req, + { + struct vfs_io_uring_fsync_state *state = tevent_req_data( + req, struct vfs_io_uring_fsync_state); +- int ret; + + SMBPROFILE_BYTES_ASYNC_END(state->ur.profile_bytes); + vfs_aio_state->duration = nsec_time_diff(&state->ur.end_time, + &state->ur.start_time); + + if (tevent_req_is_unix_error(req, &vfs_aio_state->error)) { ++ tevent_req_received(req); + return -1; + } + +- if (state->ur.cqe.res < 0) { +- vfs_aio_state->error = -state->ur.cqe.res; +- ret = -1; +- } else { +- vfs_aio_state->error = 0; +- ret = state->ur.cqe.res; +- } ++ vfs_aio_state->error = 0; + + tevent_req_received(req); +- return ret; ++ return 0; + } + + static struct vfs_fn_pointers vfs_io_uring_fns = { +-- +2.20.1 + + +From 8bac62120864dc40285ae680f4493116dd2abe6d Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Fri, 8 May 2020 13:17:05 +0200 +Subject: [PATCH 21/31] vfs_io_uring: make use of sys_valid_io_range() in + vfs_io_uring_pread_send() + +This makes the follow up commits easier as we don't have to care +about overflows. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Jeremy Allison +(cherry picked from commit 5005ae3fb24018e370ae60cc23c5e9cfe8357bc9) +--- + source3/modules/vfs_io_uring.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c +index 0f560c95b67..c7565b8c39d 100644 +--- a/source3/modules/vfs_io_uring.c ++++ b/source3/modules/vfs_io_uring.c +@@ -25,6 +25,7 @@ + #include "smbd/smbd.h" + #include "smbd/globals.h" + #include "lib/util/tevent_unix.h" ++#include "lib/util/sys_rw.h" + #include "smbprofile.h" + #include + +@@ -313,6 +314,7 @@ static struct tevent_req *vfs_io_uring_pread_send(struct vfs_handle_struct *hand + struct tevent_req *req = NULL; + struct vfs_io_uring_pread_state *state = NULL; + struct vfs_io_uring_config *config = NULL; ++ bool ok; + + SMB_VFS_HANDLE_GET_DATA(handle, config, + struct vfs_io_uring_config, +@@ -331,6 +333,12 @@ static struct tevent_req *vfs_io_uring_pread_send(struct vfs_handle_struct *hand + state->ur.profile_bytes, n); + SMBPROFILE_BYTES_ASYNC_SET_IDLE(state->ur.profile_bytes); + ++ ok = sys_valid_io_range(offset, n); ++ if (!ok) { ++ tevent_req_error(req, EINVAL); ++ return tevent_req_post(req, ev); ++ } ++ + state->iov.iov_base = (void *)data; + state->iov.iov_len = n; + io_uring_prep_readv(&state->ur.sqe, +-- +2.20.1 + + +From 371195310fc9510692e0ee7f63361094bd7a4911 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Fri, 8 May 2020 13:17:05 +0200 +Subject: [PATCH 22/31] vfs_io_uring: make use of sys_valid_io_range() in + vfs_io_uring_pwrite_send() + +This makes the follow up commits easier as we don't have to care +about overflows. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Jeremy Allison +(cherry picked from commit 388bc2e6e44470ea4043ecb22750e241145355d2) +--- + source3/modules/vfs_io_uring.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c +index c7565b8c39d..ee23449c63c 100644 +--- a/source3/modules/vfs_io_uring.c ++++ b/source3/modules/vfs_io_uring.c +@@ -423,6 +423,7 @@ static struct tevent_req *vfs_io_uring_pwrite_send(struct vfs_handle_struct *han + struct tevent_req *req = NULL; + struct vfs_io_uring_pwrite_state *state = NULL; + struct vfs_io_uring_config *config = NULL; ++ bool ok; + + SMB_VFS_HANDLE_GET_DATA(handle, config, + struct vfs_io_uring_config, +@@ -441,6 +442,12 @@ static struct tevent_req *vfs_io_uring_pwrite_send(struct vfs_handle_struct *han + state->ur.profile_bytes, n); + SMBPROFILE_BYTES_ASYNC_SET_IDLE(state->ur.profile_bytes); + ++ ok = sys_valid_io_range(offset, n); ++ if (!ok) { ++ tevent_req_error(req, EINVAL); ++ return tevent_req_post(req, ev); ++ } ++ + state->iov.iov_base = discard_const(data); + state->iov.iov_len = n; + io_uring_prep_writev(&state->ur.sqe, +-- +2.20.1 + + +From fec90a44a6eb56a883e19268c399b9475a20220d Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Fri, 8 May 2020 21:29:53 +0200 +Subject: [PATCH 23/31] vfs_io_uring: avoid stack recursion of + vfs_io_uring_queue_run() + +Instead we remember if recursion was triggered and jump to +the start of the function again from the end. + +This should make it safe to be called from the completion_fn(). + +This is hideously complex stuff, so document the hell +out of it. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Jeremy Allison +(cherry picked from commit f96f45c9ba8d4c8fa4026c22ac4201d66335e5c4) +--- + source3/modules/vfs_io_uring.c | 93 +++++++++++++++++++++++++++++++++- + 1 file changed, 92 insertions(+), 1 deletion(-) + +diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c +index ee23449c63c..f94453d9995 100644 +--- a/source3/modules/vfs_io_uring.c ++++ b/source3/modules/vfs_io_uring.c +@@ -34,6 +34,10 @@ struct vfs_io_uring_request; + struct vfs_io_uring_config { + struct io_uring uring; + struct tevent_fd *fde; ++ /* recursion guard. See comment above vfs_io_uring_queue_run() */ ++ bool busy; ++ /* recursion guard. See comment above vfs_io_uring_queue_run() */ ++ bool need_retry; + struct vfs_io_uring_request *queue; + struct vfs_io_uring_request *pending; + }; +@@ -222,7 +226,7 @@ static int vfs_io_uring_connect(vfs_handle_struct *handle, const char *service, + return 0; + } + +-static void vfs_io_uring_queue_run(struct vfs_io_uring_config *config) ++static void _vfs_io_uring_queue_run(struct vfs_io_uring_config *config) + { + struct vfs_io_uring_request *cur = NULL, *next = NULL; + struct io_uring_cqe *cqe = NULL; +@@ -280,6 +284,93 @@ static void vfs_io_uring_queue_run(struct vfs_io_uring_config *config) + io_uring_cq_advance(&config->uring, nr); + } + ++/* ++ * Wrapper function to prevent recursion which could happen ++ * if we called _vfs_io_uring_queue_run() directly without ++ * recursion checks. ++ * ++ * Looking at the pread call, we can have: ++ * ++ * vfs_io_uring_pread_send() ++ * ->vfs_io_uring_pread_submit() <----------------------------------- ++ * ->vfs_io_uring_request_submit() | ++ * ->vfs_io_uring_queue_run() | ++ * ->_vfs_io_uring_queue_run() | ++ * | ++ * But inside _vfs_io_uring_queue_run() looks like: | ++ * | ++ * _vfs_io_uring_queue_run() { | ++ * if (THIS_IO_COMPLETED) { | ++ * ->vfs_io_uring_finish_req() | ++ * ->cur->completion_fn() | ++ * } | ++ * } | ++ * | ++ * cur->completion_fn() for pread is set to vfs_io_uring_pread_completion() | ++ * | ++ * vfs_io_uring_pread_completion() { | ++ * if (READ_TERMINATED) { | ++ * -> tevent_req_done() - We're done, go back up the stack. | ++ * return; | ++ * } | ++ * | ++ * We have a short read - adjust the io vectors | ++ * | ++ * ->vfs_io_uring_pread_submit() --------------------------------------- ++ * } ++ * ++ * So before calling _vfs_io_uring_queue_run() we backet it with setting ++ * a flag config->busy, and unset it once _vfs_io_uring_queue_run() finally ++ * exits the retry loop. ++ * ++ * If we end up back into vfs_io_uring_queue_run() we notice we've done so ++ * as config->busy is set and don't recurse into _vfs_io_uring_queue_run(). ++ * ++ * We set the second flag config->need_retry that tells us to loop in the ++ * vfs_io_uring_queue_run() call above us in the stack and return. ++ * ++ * When the outer call to _vfs_io_uring_queue_run() returns we are in ++ * a loop checking if config->need_retry was set. That happens if ++ * the short read case occurs and _vfs_io_uring_queue_run() ended up ++ * recursing into vfs_io_uring_queue_run(). ++ * ++ * Once vfs_io_uring_pread_completion() finishes without a short ++ * read (the READ_TERMINATED case, tevent_req_done() is called) ++ * then config->need_retry is left as false, we exit the loop, ++ * set config->busy to false so the next top level call into ++ * vfs_io_uring_queue_run() won't think it's a recursed call ++ * and return. ++ * ++ */ ++ ++static void vfs_io_uring_queue_run(struct vfs_io_uring_config *config) ++{ ++ if (config->busy) { ++ /* ++ * We've recursed due to short read/write. ++ * Set need_retry to ensure we retry the ++ * io_uring_submit(). ++ */ ++ config->need_retry = true; ++ return; ++ } ++ ++ /* ++ * Bracket the loop calling _vfs_io_uring_queue_run() ++ * with busy = true / busy = false. ++ * so we can detect recursion above. ++ */ ++ ++ config->busy = true; ++ ++ do { ++ config->need_retry = false; ++ _vfs_io_uring_queue_run(config); ++ } while (config->need_retry); ++ ++ config->busy = false; ++} ++ + static void vfs_io_uring_fd_handler(struct tevent_context *ev, + struct tevent_fd *fde, + uint16_t flags, +-- +2.20.1 + + +From f7baf726bbb2c048c243857347731628ae1f112b Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Fri, 8 May 2020 11:17:51 +0200 +Subject: [PATCH 24/31] vfs_io_uring: split out a vfs_io_uring_request_submit() + function + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Jeremy Allison +(cherry picked from commit ab89b8e75354c5fd571985e924e1ccbec99de990) +--- + source3/modules/vfs_io_uring.c | 29 ++++++++++++++--------------- + 1 file changed, 14 insertions(+), 15 deletions(-) + +diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c +index f94453d9995..1d48bd192fe 100644 +--- a/source3/modules/vfs_io_uring.c ++++ b/source3/modules/vfs_io_uring.c +@@ -371,6 +371,17 @@ static void vfs_io_uring_queue_run(struct vfs_io_uring_config *config) + config->busy = false; + } + ++static void vfs_io_uring_request_submit(struct vfs_io_uring_request *cur) ++{ ++ struct vfs_io_uring_config *config = cur->config; ++ ++ io_uring_sqe_set_data(&cur->sqe, cur); ++ DLIST_ADD_END(config->queue, cur); ++ cur->list_head = &config->queue; ++ ++ vfs_io_uring_queue_run(config); ++} ++ + static void vfs_io_uring_fd_handler(struct tevent_context *ev, + struct tevent_fd *fde, + uint16_t flags, +@@ -436,11 +447,7 @@ static struct tevent_req *vfs_io_uring_pread_send(struct vfs_handle_struct *hand + fsp->fh->fd, + &state->iov, 1, + offset); +- io_uring_sqe_set_data(&state->ur.sqe, &state->ur); +- DLIST_ADD_END(config->queue, &state->ur); +- state->ur.list_head = &config->queue; +- +- vfs_io_uring_queue_run(config); ++ vfs_io_uring_request_submit(&state->ur); + + if (!tevent_req_is_in_progress(req)) { + return tevent_req_post(req, ev); +@@ -545,11 +552,7 @@ static struct tevent_req *vfs_io_uring_pwrite_send(struct vfs_handle_struct *han + fsp->fh->fd, + &state->iov, 1, + offset); +- io_uring_sqe_set_data(&state->ur.sqe, &state->ur); +- DLIST_ADD_END(config->queue, &state->ur); +- state->ur.list_head = &config->queue; +- +- vfs_io_uring_queue_run(config); ++ vfs_io_uring_request_submit(&state->ur); + + if (!tevent_req_is_in_progress(req)) { + return tevent_req_post(req, ev); +@@ -640,11 +643,7 @@ static struct tevent_req *vfs_io_uring_fsync_send(struct vfs_handle_struct *hand + io_uring_prep_fsync(&state->ur.sqe, + fsp->fh->fd, + 0); /* fsync_flags */ +- io_uring_sqe_set_data(&state->ur.sqe, &state->ur); +- DLIST_ADD_END(config->queue, &state->ur); +- state->ur.list_head = &config->queue; +- +- vfs_io_uring_queue_run(config); ++ vfs_io_uring_request_submit(&state->ur); + + if (!tevent_req_is_in_progress(req)) { + return tevent_req_post(req, ev); +-- +2.20.1 + + +From ccda7ef339d743ee90df6739ddcdce22c169b70e Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Fri, 8 May 2020 11:17:51 +0200 +Subject: [PATCH 25/31] vfs_io_uring: split out a vfs_io_uring_pread_submit() + function + +This can be reused when we add handling for short reads. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Jeremy Allison +(cherry picked from commit 9de4f8be1dc8b4274891016191a5ca1f724e08b3) +--- + source3/modules/vfs_io_uring.c | 20 +++++++++++++++----- + 1 file changed, 15 insertions(+), 5 deletions(-) + +diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c +index 1d48bd192fe..19e268e63db 100644 +--- a/source3/modules/vfs_io_uring.c ++++ b/source3/modules/vfs_io_uring.c +@@ -399,10 +399,13 @@ static void vfs_io_uring_fd_handler(struct tevent_context *ev, + + struct vfs_io_uring_pread_state { + struct vfs_io_uring_request ur; ++ struct files_struct *fsp; ++ off_t offset; + struct iovec iov; + size_t nread; + }; + ++static void vfs_io_uring_pread_submit(struct vfs_io_uring_pread_state *state); + static void vfs_io_uring_pread_completion(struct vfs_io_uring_request *cur, + const char *location); + +@@ -441,13 +444,11 @@ static struct tevent_req *vfs_io_uring_pread_send(struct vfs_handle_struct *hand + return tevent_req_post(req, ev); + } + ++ state->fsp = fsp; ++ state->offset = offset; + state->iov.iov_base = (void *)data; + state->iov.iov_len = n; +- io_uring_prep_readv(&state->ur.sqe, +- fsp->fh->fd, +- &state->iov, 1, +- offset); +- vfs_io_uring_request_submit(&state->ur); ++ vfs_io_uring_pread_submit(state); + + if (!tevent_req_is_in_progress(req)) { + return tevent_req_post(req, ev); +@@ -457,6 +458,15 @@ static struct tevent_req *vfs_io_uring_pread_send(struct vfs_handle_struct *hand + return req; + } + ++static void vfs_io_uring_pread_submit(struct vfs_io_uring_pread_state *state) ++{ ++ io_uring_prep_readv(&state->ur.sqe, ++ state->fsp->fh->fd, ++ &state->iov, 1, ++ state->offset); ++ vfs_io_uring_request_submit(&state->ur); ++} ++ + static void vfs_io_uring_pread_completion(struct vfs_io_uring_request *cur, + const char *location) + { +-- +2.20.1 + + +From def543bf2c96db54475b3a48a77f68a500f7a248 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Fri, 8 May 2020 11:17:51 +0200 +Subject: [PATCH 26/31] vfs_io_uring: split out a vfs_io_uring_pwrite_submit() + function + +This can be reused when we add handling for short writes. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Jeremy Allison +(cherry picked from commit 2f6abb00b0daeb4de9ad0aea1b5c56559391aef9) +--- + source3/modules/vfs_io_uring.c | 20 +++++++++++++++----- + 1 file changed, 15 insertions(+), 5 deletions(-) + +diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c +index 19e268e63db..3e004f48aa0 100644 +--- a/source3/modules/vfs_io_uring.c ++++ b/source3/modules/vfs_io_uring.c +@@ -514,10 +514,13 @@ static ssize_t vfs_io_uring_pread_recv(struct tevent_req *req, + + struct vfs_io_uring_pwrite_state { + struct vfs_io_uring_request ur; ++ struct files_struct *fsp; ++ off_t offset; + struct iovec iov; + size_t nwritten; + }; + ++static void vfs_io_uring_pwrite_submit(struct vfs_io_uring_pwrite_state *state); + static void vfs_io_uring_pwrite_completion(struct vfs_io_uring_request *cur, + const char *location); + +@@ -556,13 +559,11 @@ static struct tevent_req *vfs_io_uring_pwrite_send(struct vfs_handle_struct *han + return tevent_req_post(req, ev); + } + ++ state->fsp = fsp; ++ state->offset = offset; + state->iov.iov_base = discard_const(data); + state->iov.iov_len = n; +- io_uring_prep_writev(&state->ur.sqe, +- fsp->fh->fd, +- &state->iov, 1, +- offset); +- vfs_io_uring_request_submit(&state->ur); ++ vfs_io_uring_pwrite_submit(state); + + if (!tevent_req_is_in_progress(req)) { + return tevent_req_post(req, ev); +@@ -572,6 +573,15 @@ static struct tevent_req *vfs_io_uring_pwrite_send(struct vfs_handle_struct *han + return req; + } + ++static void vfs_io_uring_pwrite_submit(struct vfs_io_uring_pwrite_state *state) ++{ ++ io_uring_prep_writev(&state->ur.sqe, ++ state->fsp->fh->fd, ++ &state->iov, 1, ++ state->offset); ++ vfs_io_uring_request_submit(&state->ur); ++} ++ + static void vfs_io_uring_pwrite_completion(struct vfs_io_uring_request *cur, + const char *location) + { +-- +2.20.1 + + +From 92a105453c9479ff70efc9a1cf5b4fd3b36764e0 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Fri, 8 May 2020 11:38:56 +0200 +Subject: [PATCH 27/31] vfs_io_uring: protect vfs_io_uring_pread_completion() + against invalid results + +We should never get back more than we asked for. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Jeremy Allison +(cherry picked from commit f085dbf8b2bed2695e0065a5bf4523232cb532c7) +--- + source3/modules/vfs_io_uring.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c +index 3e004f48aa0..46fab116e9d 100644 +--- a/source3/modules/vfs_io_uring.c ++++ b/source3/modules/vfs_io_uring.c +@@ -26,6 +26,7 @@ + #include "smbd/globals.h" + #include "lib/util/tevent_unix.h" + #include "lib/util/sys_rw.h" ++#include "lib/util/iov_buf.h" + #include "smbprofile.h" + #include + +@@ -472,6 +473,9 @@ static void vfs_io_uring_pread_completion(struct vfs_io_uring_request *cur, + { + struct vfs_io_uring_pread_state *state = tevent_req_data( + cur->req, struct vfs_io_uring_pread_state); ++ struct iovec *iov = &state->iov; ++ int num_iov = 1; ++ bool ok; + + /* + * We rely on being inside the _send() function +@@ -485,6 +489,16 @@ static void vfs_io_uring_pread_completion(struct vfs_io_uring_request *cur, + return; + } + ++ ok = iov_advance(&iov, &num_iov, cur->cqe.res); ++ if (!ok) { ++ /* This is not expected! */ ++ DBG_ERR("iov_advance() failed cur->cqe.res=%d > iov_len=%d\n", ++ (int)cur->cqe.res, ++ (int)state->iov.iov_len); ++ tevent_req_error(cur->req, EIO); ++ return; ++ } ++ + state->nread = state->ur.cqe.res; + tevent_req_done(cur->req); + } +-- +2.20.1 + + +From 2153f89d521d61f303a1ab55abb4b3e65825c7bd Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Fri, 8 May 2020 11:38:56 +0200 +Subject: [PATCH 28/31] vfs_io_uring: protect vfs_io_uring_pwrite_completion() + against invalid results + +We should never get more acked than we asked for. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Jeremy Allison +(cherry picked from commit 283f96872237517f0b3bc4e63e8d3c482ecd5fa4) +--- + source3/modules/vfs_io_uring.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c +index 46fab116e9d..0ea785aae85 100644 +--- a/source3/modules/vfs_io_uring.c ++++ b/source3/modules/vfs_io_uring.c +@@ -601,6 +601,9 @@ static void vfs_io_uring_pwrite_completion(struct vfs_io_uring_request *cur, + { + struct vfs_io_uring_pwrite_state *state = tevent_req_data( + cur->req, struct vfs_io_uring_pwrite_state); ++ struct iovec *iov = &state->iov; ++ int num_iov = 1; ++ bool ok; + + /* + * We rely on being inside the _send() function +@@ -614,6 +617,16 @@ static void vfs_io_uring_pwrite_completion(struct vfs_io_uring_request *cur, + return; + } + ++ ok = iov_advance(&iov, &num_iov, cur->cqe.res); ++ if (!ok) { ++ /* This is not expected! */ ++ DBG_ERR("iov_advance() failed cur->cqe.res=%d > iov_len=%d\n", ++ (int)cur->cqe.res, ++ (int)state->iov.iov_len); ++ tevent_req_error(cur->req, EIO); ++ return; ++ } ++ + state->nwritten = state->ur.cqe.res; + tevent_req_done(cur->req); + } +-- +2.20.1 + + +From 16fe7c511d019990318db5b44278ed9f6ae18a00 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Fri, 8 May 2020 11:38:56 +0200 +Subject: [PATCH 29/31] vfs_io_uring: protect vfs_io_uring_fsync_completion() + against invalid results + +We should never get back a value > 0. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Jeremy Allison +(cherry picked from commit c57a731c4ce395fd710f0b066cd6f1b72223ae07) +--- + source3/modules/vfs_io_uring.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c +index 0ea785aae85..0b1583f962a 100644 +--- a/source3/modules/vfs_io_uring.c ++++ b/source3/modules/vfs_io_uring.c +@@ -715,6 +715,13 @@ static void vfs_io_uring_fsync_completion(struct vfs_io_uring_request *cur, + return; + } + ++ if (cur->cqe.res > 0) { ++ /* This is not expected! */ ++ DBG_ERR("got cur->cqe.res=%d\n", (int)cur->cqe.res); ++ tevent_req_error(cur->req, EIO); ++ return; ++ } ++ + tevent_req_done(cur->req); + } + +-- +2.20.1 + + +From 81deb9fe0b2991c7da3f0165c24fb449c5ce879b Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Fri, 8 May 2020 13:30:17 +0200 +Subject: [PATCH 30/31] vfs_io_uring: retry after a short read in + vfs_io_uring_pread_completion() + +We need to be prepared for short reads from the kernel depending on +the state of the page cache. Windows and Mac clients don't +expect short reads for files, so we need to retry ourself. + +For the future we may be able to play with some io_uring flags +in order to avoid the retries in userspace, but for now we just fix +the data corruption bug... + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Jeremy Allison +(cherry picked from commit 42e77c4cf245d8420641d216d1abefe81f7a3b79) +--- + source3/modules/vfs_io_uring.c | 24 ++++++++++++++++++++++-- + 1 file changed, 22 insertions(+), 2 deletions(-) + +diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c +index 0b1583f962a..f16c9ae56d3 100644 +--- a/source3/modules/vfs_io_uring.c ++++ b/source3/modules/vfs_io_uring.c +@@ -489,6 +489,14 @@ static void vfs_io_uring_pread_completion(struct vfs_io_uring_request *cur, + return; + } + ++ if (cur->cqe.res == 0) { ++ /* ++ * We reached EOF, we're done ++ */ ++ tevent_req_done(cur->req); ++ return; ++ } ++ + ok = iov_advance(&iov, &num_iov, cur->cqe.res); + if (!ok) { + /* This is not expected! */ +@@ -499,8 +507,20 @@ static void vfs_io_uring_pread_completion(struct vfs_io_uring_request *cur, + return; + } + +- state->nread = state->ur.cqe.res; +- tevent_req_done(cur->req); ++ /* sys_valid_io_range() already checked the boundaries */ ++ state->nread += state->ur.cqe.res; ++ if (num_iov == 0) { ++ /* We're done */ ++ tevent_req_done(cur->req); ++ return; ++ } ++ ++ /* ++ * sys_valid_io_range() already checked the boundaries ++ * now try to get the rest. ++ */ ++ state->offset += state->ur.cqe.res; ++ vfs_io_uring_pread_submit(state); + } + + static ssize_t vfs_io_uring_pread_recv(struct tevent_req *req, +-- +2.20.1 + + +From 382b5a8b7263ff1dfb428cdebef0c17d622e2066 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Fri, 8 May 2020 13:30:17 +0200 +Subject: [PATCH 31/31] vfs_io_uring: retry after a short writes in + vfs_io_uring_pwrite_completion() + +We need to be prepared for short writes from the kernel depending on +the state of the page cache. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Jeremy Allison +(cherry picked from commit 0f01b10679c06dbd28da72ca6c6280ddf81672ba) +--- + source3/modules/vfs_io_uring.c | 24 ++++++++++++++++++++++-- + 1 file changed, 22 insertions(+), 2 deletions(-) + +diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c +index f16c9ae56d3..4625e16c37e 100644 +--- a/source3/modules/vfs_io_uring.c ++++ b/source3/modules/vfs_io_uring.c +@@ -637,6 +637,14 @@ static void vfs_io_uring_pwrite_completion(struct vfs_io_uring_request *cur, + return; + } + ++ if (cur->cqe.res == 0) { ++ /* ++ * Ensure we can never spin. ++ */ ++ tevent_req_error(cur->req, ENOSPC); ++ return; ++ } ++ + ok = iov_advance(&iov, &num_iov, cur->cqe.res); + if (!ok) { + /* This is not expected! */ +@@ -647,8 +655,20 @@ static void vfs_io_uring_pwrite_completion(struct vfs_io_uring_request *cur, + return; + } + +- state->nwritten = state->ur.cqe.res; +- tevent_req_done(cur->req); ++ /* sys_valid_io_range() already checked the boundaries */ ++ state->nwritten += state->ur.cqe.res; ++ if (num_iov == 0) { ++ /* We're done */ ++ tevent_req_done(cur->req); ++ return; ++ } ++ ++ /* ++ * sys_valid_io_range() already checked the boundaries ++ * now try to write the rest. ++ */ ++ state->offset += state->ur.cqe.res; ++ vfs_io_uring_pwrite_submit(state); + } + + static ssize_t vfs_io_uring_pwrite_recv(struct tevent_req *req, +-- +2.20.1 + diff --git a/samba.spec b/samba.spec index e77f9b0..a85aa07 100644 --- a/samba.spec +++ b/samba.spec @@ -8,7 +8,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%define main_release 0 +%define main_release 1 %define samba_version 4.12.2 %define talloc_version 2.3.1 @@ -88,6 +88,8 @@ %global with_winexe 0 %endif +%global with_vfs_io_uring 1 + %global _systemd_extra "Environment=KRB5CCNAME=FILE:/run/samba/krb5cc_samba" Name: samba @@ -126,6 +128,7 @@ Source201: README.downgrade Patch100: new_mit_118.patch Patch101: 0001-libsmb-Don-t-try-to-find-posix-stat-info-in-SMBC_get.patch +Patch102: samba-4.12.3-vfs_io_uring-bz14361.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -224,6 +227,10 @@ BuildRequires: glusterfs-devel >= 3.4.0.16 BuildRequires: libcephfs-devel %endif +%if %{with_vfs_io_uring} +BuildRequires: liburing-devel +%endif + %if %{with_dc} # Add python3-iso8601 to avoid that the # version in Samba is being packaged @@ -1299,6 +1306,9 @@ fi %{_libdir}/samba/vfs/full_audit.so %{_libdir}/samba/vfs/gpfs.so %{_libdir}/samba/vfs/glusterfs_fuse.so +%if %{with_vfs_io_uring} +%{_libdir}/samba/vfs/io_uring.so +%endif %{_libdir}/samba/vfs/linux_xfs_sgid.so %{_libdir}/samba/vfs/media_harmony.so %{_libdir}/samba/vfs/offline.so @@ -1348,6 +1358,9 @@ fi %{_mandir}/man8/vfs_full_audit.8* %{_mandir}/man8/vfs_gpfs.8* %{_mandir}/man8/vfs_glusterfs_fuse.8* +%if %{with_vfs_io_uring} +%{_mandir}/man8/vfs_io_uring.8* +%endif %{_mandir}/man8/vfs_linux_xfs_sgid.8* %{_mandir}/man8/vfs_media_harmony.8* %{_mandir}/man8/vfs_offline.8* @@ -3562,6 +3575,9 @@ fi %endif %changelog +* Wed May 13 2020 Guenther Deschner - 4.12.2-1 +- Add support for building the new experimental io_uring VFS module + * Tue Apr 28 2020 Guenther Deschner - 4.12.2-0 - Update to Samba 4.12.2 - resolves: #1825731, #1828870 - Security fixes for CVE-2020-10700 From 469f892911146d0961851f1e39bf0e243aae4314 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 13 May 2020 15:35:56 +0200 Subject: [PATCH 006/425] Fix build on arm (which does not have liburing) Guenther --- samba.spec | 3 +++ 1 file changed, 3 insertions(+) diff --git a/samba.spec b/samba.spec index a85aa07..f6773fd 100644 --- a/samba.spec +++ b/samba.spec @@ -88,7 +88,10 @@ %global with_winexe 0 %endif +%global with_vfs_io_uring 0 +%ifarch aarch64 ppc64le s390x x86_64 i686 %global with_vfs_io_uring 1 +%endif %global _systemd_extra "Environment=KRB5CCNAME=FILE:/run/samba/krb5cc_samba" From 14beb524918dc15caa22adfe0b9d9d362c765f50 Mon Sep 17 00:00:00 2001 From: Pete Walter Date: Fri, 15 May 2020 14:12:43 +0100 Subject: [PATCH 007/425] Rebuild for ICU 67 --- samba.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index f6773fd..133e4eb 100644 --- a/samba.spec +++ b/samba.spec @@ -97,7 +97,7 @@ Name: samba Version: %{samba_version} -Release: %{samba_release}.1 +Release: %{samba_release}.2 %if 0%{?rhel} Epoch: 0 @@ -3578,6 +3578,9 @@ fi %endif %changelog +* Fri May 15 2020 Pete Walter - 2:4.12.2-1.2 +- Rebuild for ICU 67 + * Wed May 13 2020 Guenther Deschner - 4.12.2-1 - Add support for building the new experimental io_uring VFS module From 95698d54c935292c633459f60f01744cabd3cdd3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 22 May 2020 16:10:39 +0200 Subject: [PATCH 008/425] Update to samba 4.12.3 Guenther --- .gitignore | 2 + ...-to-find-posix-stat-info-in-SMBC_get.patch | 91 - new_mit_118.patch | 174 -- samba-4.12.3-vfs_io_uring-bz14361.patch | 2423 ----------------- samba.spec | 13 +- sources | 4 +- 6 files changed, 10 insertions(+), 2697 deletions(-) delete mode 100644 0001-libsmb-Don-t-try-to-find-posix-stat-info-in-SMBC_get.patch delete mode 100644 new_mit_118.patch delete mode 100644 samba-4.12.3-vfs_io_uring-bz14361.patch diff --git a/.gitignore b/.gitignore index fe44f1a..0081dcb 100644 --- a/.gitignore +++ b/.gitignore @@ -203,3 +203,5 @@ samba-3.6.0pre1.tar.gz /samba-4.12.1.tar.asc /samba-4.12.2.tar.xz /samba-4.12.2.tar.asc +/samba-4.12.3.tar.xz +/samba-4.12.3.tar.asc diff --git a/0001-libsmb-Don-t-try-to-find-posix-stat-info-in-SMBC_get.patch b/0001-libsmb-Don-t-try-to-find-posix-stat-info-in-SMBC_get.patch deleted file mode 100644 index ba901a4..0000000 --- a/0001-libsmb-Don-t-try-to-find-posix-stat-info-in-SMBC_get.patch +++ /dev/null @@ -1,91 +0,0 @@ -From 686ea46cbc9538355815fe800e441d67fee6a9db Mon Sep 17 00:00:00 2001 -From: Volker Lendecke -Date: Thu, 19 Mar 2020 11:01:41 +0100 -Subject: [PATCH] libsmb: Don't try to find posix stat info in SMBC_getatr() - -This wrongly used "frame" instead of "fname", which can never have -worked. A first attempt to fix in 51551e0d53fa6 caused a few followup -patches in an attempt to clean up the test failures 51551e0d53fa6 -introduced. They were reverted after a few discussions. So rather than -changing behaviour, just remove the code that introduced the valgrind -error again. - -Signed-off-by: Volker Lendecke -Reviewed-by: Andreas Schneider - -Autobuild-User(master): Jeremy Allison -Autobuild-Date(master): Fri Mar 20 05:06:07 UTC 2020 on sn-devel-184 - -(cherry picked from commit 39c910fd9cba3caf7414274b678b9eee33d7e20b) ---- - source3/include/libsmb_internal.h | 1 - - source3/libsmb/libsmb_file.c | 20 -------------------- - source3/libsmb/libsmb_server.c | 9 --------- - 3 files changed, 30 deletions(-) - -diff --git a/source3/include/libsmb_internal.h b/source3/include/libsmb_internal.h -index 21a11c1a024..feedddd0877 100644 ---- a/source3/include/libsmb_internal.h -+++ b/source3/include/libsmb_internal.h -@@ -76,7 +76,6 @@ typedef struct DOS_ATTR_DESC { - struct _SMBCSRV { - struct cli_state *cli; - dev_t dev; -- bool try_posixinfo; - bool no_pathinfo; - bool no_pathinfo2; - bool no_pathinfo3; -diff --git a/source3/libsmb/libsmb_file.c b/source3/libsmb/libsmb_file.c -index 1577010e490..f0a16c61a83 100644 ---- a/source3/libsmb/libsmb_file.c -+++ b/source3/libsmb/libsmb_file.c -@@ -504,26 +504,6 @@ SMBC_getatr(SMBCCTX * context, - return False; - } - -- if (srv->try_posixinfo) { -- SMB_STRUCT_STAT sbuf; -- -- status = cli_posix_stat(targetcli, frame, &sbuf); -- if (NT_STATUS_IS_OK(status)) { -- setup_stat_from_stat_ex(&sbuf, path, sb); -- -- TALLOC_FREE(frame); -- return true; -- } -- if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_IMPLEMENTED) || -- NT_STATUS_EQUAL(status, NT_STATUS_INVALID_LEVEL)) { -- /* -- * Turn this off if the server doesn't -- * support it. -- */ -- srv->try_posixinfo = false; -- } -- } -- - if (!srv->no_pathinfo2) { - status = cli_qpathinfo2(targetcli, - targetpath, -diff --git a/source3/libsmb/libsmb_server.c b/source3/libsmb/libsmb_server.c -index d4f71d8c8b7..0067df48cac 100644 ---- a/source3/libsmb/libsmb_server.c -+++ b/source3/libsmb/libsmb_server.c -@@ -657,15 +657,6 @@ SMBC_server_internal(TALLOC_CTX *ctx, - ZERO_STRUCTP(srv); - DLIST_ADD(srv->cli, c); - srv->dev = (dev_t)(str_checksum(server) ^ str_checksum(share)); -- srv->try_posixinfo = false; -- /* -- * Until SMB2 POSIX is done, only -- * try POSIX stat on SMB1 with POSIX capabilities. -- */ -- if ((smbXcli_conn_protocol(c->conn) < PROTOCOL_SMB2_02) && -- (smb1cli_conn_capabilities(c->conn) & CAP_UNIX)) { -- srv->try_posixinfo = true; -- } - srv->no_pathinfo = False; - srv->no_pathinfo2 = False; - srv->no_pathinfo3 = False; --- -2.26.0 - diff --git a/new_mit_118.patch b/new_mit_118.patch deleted file mode 100644 index 78177ef..0000000 --- a/new_mit_118.patch +++ /dev/null @@ -1,174 +0,0 @@ -From 04b262f686b5b16ba659ade1e4b5778e2b219f0a Mon Sep 17 00:00:00 2001 -From: Isaac Boukris -Date: Mon, 16 Sep 2019 16:40:12 +0300 -Subject: [PATCH 1/2] Adapt sign_authdata in our KDB module for krb5 v1.18 - -Signed-off-by: Isaac Boukris ---- - source4/kdc/mit-kdb/kdb_samba.c | 2 +- - source4/kdc/mit-kdb/kdb_samba.h | 21 +++++++++++++++++++++ - source4/kdc/mit-kdb/kdb_samba_policies.c | 24 ++++++++++++++++++++++++ - 3 files changed, 46 insertions(+), 1 deletion(-) - -diff --git a/source4/kdc/mit-kdb/kdb_samba.c b/source4/kdc/mit-kdb/kdb_samba.c -index c5157d6ed1b..02bbdca9f54 100644 ---- a/source4/kdc/mit-kdb/kdb_samba.c -+++ b/source4/kdc/mit-kdb/kdb_samba.c -@@ -139,7 +139,7 @@ static void kdb_samba_db_free_principal_e_data(krb5_context context, - - kdb_vftabl kdb_function_table = { - .maj_ver = KRB5_KDB_DAL_MAJOR_VERSION, -- .min_ver = 1, -+ .min_ver = KRB5_KDB_DAL_MAJOR_VERSION == 6 ? 1 : 0, - - .init_library = kdb_samba_init_library, - .fini_library = kdb_samba_fini_library, -diff --git a/source4/kdc/mit-kdb/kdb_samba.h b/source4/kdc/mit-kdb/kdb_samba.h -index 22ef9085b6a..ad4f6e27573 100644 ---- a/source4/kdc/mit-kdb/kdb_samba.h -+++ b/source4/kdc/mit-kdb/kdb_samba.h -@@ -114,6 +114,7 @@ krb5_error_code kdb_samba_dbekd_encrypt_key_data(krb5_context context, - - /* from kdb_samba_policies.c */ - -+#if KRB5_KDB_API_VERSION < 10 - krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - unsigned int flags, - krb5_const_principal client_princ, -@@ -127,6 +128,26 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - krb5_timestamp authtime, - krb5_authdata **tgt_auth_data, - krb5_authdata ***signed_auth_data); -+#else -+krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, -+ unsigned int flags, -+ krb5_const_principal client_princ, -+ krb5_const_principal server_princ, -+ krb5_db_entry *client, -+ krb5_db_entry *server, -+ krb5_db_entry *krbtgt, -+ krb5_db_entry *local_krbtgt, -+ krb5_keyblock *client_key, -+ krb5_keyblock *server_key, -+ krb5_keyblock *krbtgt_key, -+ krb5_keyblock *local_krbtgt_key, -+ krb5_keyblock *session_key, -+ krb5_timestamp authtime, -+ krb5_authdata **tgt_auth_data, -+ void *authdata_info, -+ krb5_data ***auth_indicators, -+ krb5_authdata ***signed_auth_data); -+#endif - - krb5_error_code kdb_samba_db_check_policy_as(krb5_context context, - krb5_kdc_req *kdcreq, -diff --git a/source4/kdc/mit-kdb/kdb_samba_policies.c b/source4/kdc/mit-kdb/kdb_samba_policies.c -index fc80329f221..e2f7174b0c2 100644 ---- a/source4/kdc/mit-kdb/kdb_samba_policies.c -+++ b/source4/kdc/mit-kdb/kdb_samba_policies.c -@@ -287,6 +287,7 @@ done: - return code; - } - -+#if KRB5_KDB_API_VERSION < 10 - krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - unsigned int flags, - krb5_const_principal client_princ, -@@ -301,6 +302,29 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - krb5_authdata **tgt_auth_data, - krb5_authdata ***signed_auth_data) - { -+#else -+krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, -+ unsigned int flags, -+ krb5_const_principal client_princ, -+ krb5_const_principal server_princ, -+ krb5_db_entry *client, -+ krb5_db_entry *server, -+ krb5_db_entry *krbtgt, -+ krb5_db_entry *local_krbtgt, -+ krb5_keyblock *client_key, -+ krb5_keyblock *server_key, -+ krb5_keyblock *krbtgt_key, -+ krb5_keyblock *local_krbtgt_key, -+ krb5_keyblock *session_key, -+ krb5_timestamp authtime, -+ krb5_authdata **tgt_auth_data, -+ void *authdata_info, -+ krb5_data ***auth_indicators, -+ krb5_authdata ***signed_auth_data) -+{ -+ krbtgt = krbtgt == NULL ? local_krbtgt : krbtgt; -+ krbtgt_key = krbtgt_key == NULL ? local_krbtgt_key : krbtgt_key; -+#endif - krb5_const_principal ks_client_princ; - krb5_authdata **authdata = NULL; - krb5_boolean is_as_req; --- -2.24.1 - - -From c968ec07fa403ed919dcda7b3087e0d10d1e7a32 Mon Sep 17 00:00:00 2001 -From: Isaac Boukris -Date: Thu, 16 Jan 2020 22:00:21 +0100 -Subject: [PATCH 2/2] Sign and verify PAC with ticket principal instead of - canon principal - -With MIT library 1.18 the KDC no longer set -KRB5_KDB_FLAG_CANONICALIZE for enterprise principals which allows -us to not canonicalize them (like in Windwos / Heimdal). - -However, it now breaks the PAC signature verification as it was -wrongly done using canonical client rather than ticket client name. - -Signed-off-by: Isaac Boukris ---- - source4/kdc/mit-kdb/kdb_samba_policies.c | 12 ++---------- - 1 file changed, 2 insertions(+), 10 deletions(-) - -diff --git a/source4/kdc/mit-kdb/kdb_samba_policies.c b/source4/kdc/mit-kdb/kdb_samba_policies.c -index e2f7174b0c2..6a5f06a8a8c 100644 ---- a/source4/kdc/mit-kdb/kdb_samba_policies.c -+++ b/source4/kdc/mit-kdb/kdb_samba_policies.c -@@ -325,20 +325,12 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - krbtgt = krbtgt == NULL ? local_krbtgt : krbtgt; - krbtgt_key = krbtgt_key == NULL ? local_krbtgt_key : krbtgt_key; - #endif -- krb5_const_principal ks_client_princ; - krb5_authdata **authdata = NULL; - krb5_boolean is_as_req; - krb5_error_code code; - krb5_pac pac = NULL; - krb5_data pac_data; - -- /* Prefer canonicalised name from client entry */ -- if (client != NULL) { -- ks_client_princ = client->princ; -- } else { -- ks_client_princ = client_princ; -- } -- - is_as_req = ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) != 0); - - if (is_as_req && (flags & KRB5_KDB_FLAG_INCLUDE_PAC)) { -@@ -351,7 +343,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - if (!is_as_req) { - code = ks_verify_pac(context, - flags, -- ks_client_princ, -+ client_princ, - client, - server, - krbtgt, -@@ -378,7 +370,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - goto done; - } - -- code = krb5_pac_sign(context, pac, authtime, ks_client_princ, -+ code = krb5_pac_sign(context, pac, authtime, client_princ, - server_key, krbtgt_key, &pac_data); - if (code != 0) { - DBG_ERR("krb5_pac_sign failed: %d\n", code); --- -2.24.1 - diff --git a/samba-4.12.3-vfs_io_uring-bz14361.patch b/samba-4.12.3-vfs_io_uring-bz14361.patch deleted file mode 100644 index ad796ba..0000000 --- a/samba-4.12.3-vfs_io_uring-bz14361.patch +++ /dev/null @@ -1,2423 +0,0 @@ -From d7ab59f80f535e960780ec3a643101dfe96627ac Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Mon, 11 May 2020 12:37:41 +0200 -Subject: [PATCH 01/31] s4:torture: add tests to test the SMB2 read/write - offset/length boundaries - -[MS-FSA] 2.1.5.2 Server Requests a Read and -2.1.5.3 Server Requests a Write define some contraints. - -These tests demonstrate that ((int64_t)offset) < 0) is -not allowed for both reads and writes for SMB. -Also the special case for writes at offset -2 is not possible -nor the append mode with offset < 0. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Jeremy Allison -(cherry picked from commit 54de0e4a3e46a53db5262963e64b109c567554a1) ---- - selftest/knownfail.d/rw-invalid | 2 + - source4/torture/smb2/read_write.c | 189 ++++++++++++++++++++++++++++++ - 2 files changed, 191 insertions(+) - create mode 100644 selftest/knownfail.d/rw-invalid - -diff --git a/selftest/knownfail.d/rw-invalid b/selftest/knownfail.d/rw-invalid -new file mode 100644 -index 00000000000..c6f11e03d20 ---- /dev/null -+++ b/selftest/knownfail.d/rw-invalid -@@ -0,0 +1,2 @@ -+samba3.smb2.rw.invalid -+samba4.smb2.rw.invalid -diff --git a/source4/torture/smb2/read_write.c b/source4/torture/smb2/read_write.c -index bc8898cec31..b0eea55d7f1 100644 ---- a/source4/torture/smb2/read_write.c -+++ b/source4/torture/smb2/read_write.c -@@ -23,8 +23,19 @@ - #include "libcli/smb2/smb2.h" - #include "libcli/smb2/smb2_calls.h" - #include "torture/torture.h" -+#include "torture/util.h" - #include "torture/smb2/proto.h" - -+#define CHECK_STATUS(_status, _expected) \ -+ torture_assert_ntstatus_equal_goto(torture, _status, _expected, \ -+ ret, done, "Incorrect status") -+ -+#define CHECK_VALUE(v, correct) \ -+ torture_assert_int_equal_goto(torture, v, correct, \ -+ ret, done, "Incorrect value") -+ -+#define FNAME "smb2_writetest.dat" -+ - static bool run_smb2_readwritetest(struct torture_context *tctx, - struct smb2_tree *t1, struct smb2_tree *t2) - { -@@ -150,12 +161,190 @@ static bool run_smb2_wrap_readwritetest(struct torture_context *tctx, - return run_smb2_readwritetest(tctx, tree1, tree1); - } - -+static bool test_rw_invalid(struct torture_context *torture, struct smb2_tree *tree) -+{ -+ bool ret = true; -+ NTSTATUS status; -+ struct smb2_handle h; -+ uint8_t buf[64*1024]; -+ struct smb2_read rd; -+ struct smb2_write w = {0}; -+ TALLOC_CTX *tmp_ctx = talloc_new(tree); -+ -+ ZERO_STRUCT(buf); -+ -+ smb2_util_unlink(tree, FNAME); -+ -+ status = torture_smb2_testfile(tree, FNAME, &h); -+ CHECK_STATUS(status, NT_STATUS_OK); -+ -+ status = smb2_util_write(tree, h, buf, 0, ARRAY_SIZE(buf)); -+ CHECK_STATUS(status, NT_STATUS_OK); -+ -+ ZERO_STRUCT(rd); -+ rd.in.file.handle = h; -+ rd.in.length = 10; -+ rd.in.offset = 0; -+ rd.in.min_count = 1; -+ -+ status = smb2_read(tree, tmp_ctx, &rd); -+ CHECK_STATUS(status, NT_STATUS_OK); -+ CHECK_VALUE(rd.out.data.length, 10); -+ -+ rd.in.min_count = 0; -+ rd.in.length = 10; -+ rd.in.offset = sizeof(buf); -+ status = smb2_read(tree, tmp_ctx, &rd); -+ CHECK_STATUS(status, NT_STATUS_END_OF_FILE); -+ -+ rd.in.min_count = 0; -+ rd.in.length = 0; -+ rd.in.offset = sizeof(buf); -+ status = smb2_read(tree, tmp_ctx, &rd); -+ CHECK_STATUS(status, NT_STATUS_OK); -+ CHECK_VALUE(rd.out.data.length, 0); -+ -+ rd.in.min_count = 0; -+ rd.in.length = 1; -+ rd.in.offset = INT64_MAX - 1; -+ status = smb2_read(tree, tmp_ctx, &rd); -+ CHECK_STATUS(status, NT_STATUS_END_OF_FILE); -+ -+ rd.in.min_count = 0; -+ rd.in.length = 0; -+ rd.in.offset = INT64_MAX; -+ status = smb2_read(tree, tmp_ctx, &rd); -+ CHECK_STATUS(status, NT_STATUS_OK); -+ CHECK_VALUE(rd.out.data.length, 0); -+ -+ rd.in.min_count = 0; -+ rd.in.length = 1; -+ rd.in.offset = INT64_MAX; -+ status = smb2_read(tree, tmp_ctx, &rd); -+ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); -+ -+ rd.in.min_count = 0; -+ rd.in.length = 0; -+ rd.in.offset = (uint64_t)INT64_MAX + 1; -+ status = smb2_read(tree, tmp_ctx, &rd); -+ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); -+ -+ rd.in.min_count = 0; -+ rd.in.length = 0; -+ rd.in.offset = (uint64_t)INT64_MIN; -+ status = smb2_read(tree, tmp_ctx, &rd); -+ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); -+ -+ rd.in.min_count = 0; -+ rd.in.length = 0; -+ rd.in.offset = (uint64_t)(int64_t)-1; -+ status = smb2_read(tree, tmp_ctx, &rd); -+ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); -+ -+ rd.in.min_count = 0; -+ rd.in.length = 0; -+ rd.in.offset = (uint64_t)(int64_t)-2; -+ status = smb2_read(tree, tmp_ctx, &rd); -+ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); -+ -+ rd.in.min_count = 0; -+ rd.in.length = 0; -+ rd.in.offset = (uint64_t)(int64_t)-3; -+ status = smb2_read(tree, tmp_ctx, &rd); -+ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); -+ -+ w.in.file.handle = h; -+ w.in.offset = (int64_t)-1; -+ w.in.data.data = buf; -+ w.in.data.length = ARRAY_SIZE(buf); -+ -+ status = smb2_write(tree, &w); -+ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); -+ -+ w.in.file.handle = h; -+ w.in.offset = (int64_t)-2; -+ w.in.data.data = buf; -+ w.in.data.length = ARRAY_SIZE(buf); -+ -+ status = smb2_write(tree, &w); -+ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); -+ -+ w.in.file.handle = h; -+ w.in.offset = INT64_MIN; -+ w.in.data.data = buf; -+ w.in.data.length = 1; -+ -+ status = smb2_write(tree, &w); -+ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); -+ -+ w.in.file.handle = h; -+ w.in.offset = INT64_MIN; -+ w.in.data.data = buf; -+ w.in.data.length = 0; -+ status = smb2_write(tree, &w); -+ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); -+ -+ w.in.file.handle = h; -+ w.in.offset = INT64_MAX; -+ w.in.data.data = buf; -+ w.in.data.length = 0; -+ status = smb2_write(tree, &w); -+ CHECK_STATUS(status, NT_STATUS_OK); -+ CHECK_VALUE(w.out.nwritten, 0); -+ -+ w.in.file.handle = h; -+ w.in.offset = INT64_MAX; -+ w.in.data.data = buf; -+ w.in.data.length = 1; -+ status = smb2_write(tree, &w); -+ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); -+ -+ w.in.file.handle = h; -+ w.in.offset = (uint64_t)INT64_MAX + 1; -+ w.in.data.data = buf; -+ w.in.data.length = 0; -+ status = smb2_write(tree, &w); -+ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); -+ -+ w.in.file.handle = h; -+ w.in.offset = 0xfffffff0000; /* MAXFILESIZE */ -+ w.in.data.data = buf; -+ w.in.data.length = 1; -+ status = smb2_write(tree, &w); -+ CHECK_STATUS(status, NT_STATUS_INVALID_PARAMETER); -+ -+ w.in.file.handle = h; -+ w.in.offset = 0xfffffff0000 - 1; /* MAXFILESIZE - 1 */ -+ w.in.data.data = buf; -+ w.in.data.length = 1; -+ status = smb2_write(tree, &w); -+ if (TARGET_IS_SAMBA3(torture) || TARGET_IS_SAMBA4(torture)) { -+ CHECK_STATUS(status, NT_STATUS_OK); -+ CHECK_VALUE(w.out.nwritten, 1); -+ } else { -+ CHECK_STATUS(status, NT_STATUS_DISK_FULL); -+ } -+ -+ w.in.file.handle = h; -+ w.in.offset = 0xfffffff0000; /* MAXFILESIZE */ -+ w.in.data.data = buf; -+ w.in.data.length = 0; -+ status = smb2_write(tree, &w); -+ CHECK_STATUS(status, NT_STATUS_OK); -+ CHECK_VALUE(w.out.nwritten, 0); -+ -+done: -+ talloc_free(tmp_ctx); -+ return ret; -+} -+ - struct torture_suite *torture_smb2_readwrite_init(TALLOC_CTX *ctx) - { - struct torture_suite *suite = torture_suite_create(ctx, "rw"); - - torture_suite_add_2smb2_test(suite, "rw1", run_smb2_readwritetest); - torture_suite_add_2smb2_test(suite, "rw2", run_smb2_wrap_readwritetest); -+ torture_suite_add_1smb2_test(suite, "invalid", test_rw_invalid); - - suite->description = talloc_strdup(suite, "SMB2 Samba4 Read/Write"); - --- -2.20.1 - - -From cb8661162b9d344288a776a9e4ff29a47f2cc37d Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Fri, 8 May 2020 13:06:54 +0200 -Subject: [PATCH 02/31] lib: util: Add sys_valid_io_range() - -This implements the contraints of -[MS-FSA] 2.1.5.2 Server Requests a Read. - -The special handling of [MS-FSA] 2.1.5.3 Server Requests a Write -with offset < 0, should be handled by higher layers! -Which means the check can also be used for writes. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Jeremy Allison -(cherry picked from commit e02cbd5c3ea6903d2b7b43c3193b8662d029ecdd) ---- - lib/util/sys_rw.c | 24 ++++++++++++++++++++++++ - lib/util/sys_rw.h | 1 + - 2 files changed, 25 insertions(+) - -diff --git a/lib/util/sys_rw.c b/lib/util/sys_rw.c -index 9a6cdcaa606..6fa7ca57365 100644 ---- a/lib/util/sys_rw.c -+++ b/lib/util/sys_rw.c -@@ -24,6 +24,30 @@ - #include "system/filesys.h" - #include "lib/util/sys_rw.h" - -+bool sys_valid_io_range(off_t offset, size_t length) -+{ -+ uint64_t last_byte_ofs; -+ -+ if (offset < 0) { -+ return false; -+ } -+ -+ if (offset > INT64_MAX) { -+ return false; -+ } -+ -+ if (length > UINT32_MAX) { -+ return false; -+ } -+ -+ last_byte_ofs = (uint64_t)offset + (uint64_t)length; -+ if (last_byte_ofs > INT64_MAX) { -+ return false; -+ } -+ -+ return true; -+} -+ - /******************************************************************* - A read wrapper that will deal with EINTR/EWOULDBLOCK - ********************************************************************/ -diff --git a/lib/util/sys_rw.h b/lib/util/sys_rw.h -index ab456d87b22..70864cb2b74 100644 ---- a/lib/util/sys_rw.h -+++ b/lib/util/sys_rw.h -@@ -27,6 +27,7 @@ - - struct iovec; - -+bool sys_valid_io_range(off_t offset, size_t length); - ssize_t sys_read(int fd, void *buf, size_t count); - void sys_read_v(int fd, void *buf, size_t count); - ssize_t sys_write(int fd, const void *buf, size_t count); --- -2.20.1 - - -From 640a6715dacfaf7ec9a2b4e4b36fa22b625f571f Mon Sep 17 00:00:00 2001 -From: Jeremy Allison -Date: Thu, 7 May 2020 12:32:48 -0700 -Subject: [PATCH 03/31] lib: util: Add sys_pread_full(). - -A pread wrapper that will deal with EINTR and never return a short -read unless pread returns zero meaning EOF. - -Thread-safe so may be used as a replacement for pread -inside pread_do() thread functions. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Pair-Programmed-With: Stefan Metzmacher - -Signed-off-by: Jeremy Allison -Signed-off-by: Stefan Metzmacher -(cherry picked from commit 36af33bf9fcdf93fce5ef1520fcb7ddbb07b355e) ---- - lib/util/sys_rw.c | 48 +++++++++++++++++++++++++++++++++++++++++++++++ - lib/util/sys_rw.h | 1 + - 2 files changed, 49 insertions(+) - -diff --git a/lib/util/sys_rw.c b/lib/util/sys_rw.c -index 6fa7ca57365..bfeb2e6b466 100644 ---- a/lib/util/sys_rw.c -+++ b/lib/util/sys_rw.c -@@ -143,6 +143,54 @@ ssize_t sys_pread(int fd, void *buf, size_t count, off_t off) - return ret; - } - -+/******************************************************************* -+ A pread wrapper that will deal with EINTR and never return a short -+ read unless pread returns zero meaning EOF. -+********************************************************************/ -+ -+ssize_t sys_pread_full(int fd, void *buf, size_t count, off_t off) -+{ -+ ssize_t total_read = 0; -+ uint8_t *curr_buf = (uint8_t *)buf; -+ size_t curr_count = count; -+ off_t curr_off = off; -+ bool ok; -+ -+ ok = sys_valid_io_range(off, count); -+ if (!ok) { -+ errno = EINVAL; -+ return -1; -+ } -+ -+ while (curr_count != 0) { -+ ssize_t ret = sys_pread(fd, -+ curr_buf, -+ curr_count, -+ curr_off); -+ -+ if (ret == -1) { -+ return -1; -+ } -+ if (ret == 0) { -+ /* EOF */ -+ break; -+ } -+ -+ if (ret > curr_count) { -+ errno = EIO; -+ return -1; -+ } -+ -+ curr_buf += ret; -+ curr_count -= ret; -+ curr_off += ret; -+ -+ total_read += ret; -+ } -+ -+ return total_read; -+} -+ - /******************************************************************* - A write wrapper that will deal with EINTR - ********************************************************************/ -diff --git a/lib/util/sys_rw.h b/lib/util/sys_rw.h -index 70864cb2b74..1e0dd3730a6 100644 ---- a/lib/util/sys_rw.h -+++ b/lib/util/sys_rw.h -@@ -34,6 +34,7 @@ ssize_t sys_write(int fd, const void *buf, size_t count); - void sys_write_v(int fd, const void *buf, size_t count); - ssize_t sys_writev(int fd, const struct iovec *iov, int iovcnt); - ssize_t sys_pread(int fd, void *buf, size_t count, off_t off); -+ssize_t sys_pread_full(int fd, void *buf, size_t count, off_t off); - ssize_t sys_pwrite(int fd, const void *buf, size_t count, off_t off); - - #endif --- -2.20.1 - - -From c1f14bb9bb4dc2601814dda398e361a9ef097b12 Mon Sep 17 00:00:00 2001 -From: Jeremy Allison -Date: Thu, 7 May 2020 12:34:32 -0700 -Subject: [PATCH 04/31] lib: util: Add sys_pwrite_full(). - -A pwrite wrapper that will deal with EINTR and never return a short -write unless the file system returns an error. Copes with the -unspecified edge condition of pwrite returning zero by changing -the return to -1, errno = ENOSPC. - -Thread-safe so may be used as a replacement for pwrite -inside pwrite_do() thread functions. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Pair-Programmed-With: Stefan Metzmacher - -Signed-off-by: Jeremy Allison -Signed-off-by: Stefan Metzmacher -(cherry picked from commit 3ba7a89cea85d134eacf1e624e011fe6f66146fc) ---- - lib/util/sys_rw.c | 49 +++++++++++++++++++++++++++++++++++++++++++++++ - lib/util/sys_rw.h | 1 + - 2 files changed, 50 insertions(+) - -diff --git a/lib/util/sys_rw.c b/lib/util/sys_rw.c -index bfeb2e6b466..d74395fc409 100644 ---- a/lib/util/sys_rw.c -+++ b/lib/util/sys_rw.c -@@ -204,3 +204,52 @@ ssize_t sys_pwrite(int fd, const void *buf, size_t count, off_t off) - } while (ret == -1 && errno == EINTR); - return ret; - } -+ -+/******************************************************************* -+ A pwrite wrapper that will deal with EINTR and never allow a short -+ write unless the file system returns an error. -+********************************************************************/ -+ -+ssize_t sys_pwrite_full(int fd, const void *buf, size_t count, off_t off) -+{ -+ ssize_t total_written = 0; -+ const uint8_t *curr_buf = (const uint8_t *)buf; -+ size_t curr_count = count; -+ off_t curr_off = off; -+ bool ok; -+ -+ ok = sys_valid_io_range(off, count); -+ if (!ok) { -+ errno = EINVAL; -+ return -1; -+ } -+ -+ while (curr_count != 0) { -+ ssize_t ret = sys_pwrite(fd, -+ curr_buf, -+ curr_count, -+ curr_off); -+ -+ if (ret == -1) { -+ return -1; -+ } -+ if (ret == 0) { -+ /* Ensure we can never spin. */ -+ errno = ENOSPC; -+ return -1; -+ } -+ -+ if (ret > curr_count) { -+ errno = EIO; -+ return -1; -+ } -+ -+ curr_buf += ret; -+ curr_count -= ret; -+ curr_off += ret; -+ -+ total_written += ret; -+ } -+ -+ return total_written; -+} -diff --git a/lib/util/sys_rw.h b/lib/util/sys_rw.h -index 1e0dd3730a6..b224ecb30ac 100644 ---- a/lib/util/sys_rw.h -+++ b/lib/util/sys_rw.h -@@ -36,5 +36,6 @@ ssize_t sys_writev(int fd, const struct iovec *iov, int iovcnt); - ssize_t sys_pread(int fd, void *buf, size_t count, off_t off); - ssize_t sys_pread_full(int fd, void *buf, size_t count, off_t off); - ssize_t sys_pwrite(int fd, const void *buf, size_t count, off_t off); -+ssize_t sys_pwrite_full(int fd, const void *buf, size_t count, off_t off); - - #endif --- -2.20.1 - - -From c4a08bd0b1ecebdbbbbbb257696e0f9b93eebeaa Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Mon, 11 May 2020 18:18:24 +0200 -Subject: [PATCH 05/31] smb2_server: fix smbd_smb2_request_verify_sizes() for - SMB2_OP_WRITE - -Writes with a length of 0 are allowed. - -The readfile related check we had before was not really useful -as min_dyn_len can only every be 0 or 1 (and for SMB2_OP_WRITE it's -always 1). So we checked - if (unread_bytes > 0) { - if (unread_bytes < 1) { - return error; - } - } - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Jeremy Allison -(cherry picked from commit a6eee38ba2f89280676f0a32d26745afd95b551c) ---- - source3/smbd/smb2_server.c | 10 +--------- - 1 file changed, 1 insertion(+), 9 deletions(-) - -diff --git a/source3/smbd/smb2_server.c b/source3/smbd/smb2_server.c -index 8c66d74c8de..88937ac19b0 100644 ---- a/source3/smbd/smb2_server.c -+++ b/source3/smbd/smb2_server.c -@@ -2073,16 +2073,8 @@ NTSTATUS smbd_smb2_request_verify_sizes(struct smbd_smb2_request *req, - switch (opcode) { - case SMB2_OP_IOCTL: - case SMB2_OP_GETINFO: -- min_dyn_size = 0; -- break; - case SMB2_OP_WRITE: -- if (req->smb1req != NULL && req->smb1req->unread_bytes > 0) { -- if (req->smb1req->unread_bytes < min_dyn_size) { -- return NT_STATUS_INVALID_PARAMETER; -- } -- -- min_dyn_size = 0; -- } -+ min_dyn_size = 0; - break; - } - --- -2.20.1 - - -From 74fadf2f083daaf4358a9b64c1092586595894d5 Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Mon, 11 May 2020 18:18:24 +0200 -Subject: [PATCH 06/31] s3:smbd: handle 0 length writes as no-op. - -They should never touch the SMB_VFS layer -and they never trigger an DISK_FULL error. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Jeremy Allison -(cherry picked from commit ba68f21286c2c2f1fef8bf8c9cd500a622077887) ---- - source3/smbd/aio.c | 5 +++++ - source3/smbd/fileio.c | 4 ++++ - 2 files changed, 9 insertions(+) - -diff --git a/source3/smbd/aio.c b/source3/smbd/aio.c -index cf35f3297ec..088ea603788 100644 ---- a/source3/smbd/aio.c -+++ b/source3/smbd/aio.c -@@ -339,6 +339,11 @@ static struct tevent_req *pwrite_fsync_send(TALLOC_CTX *mem_ctx, - state->fsp = fsp; - state->write_through = write_through; - -+ if (n == 0) { -+ tevent_req_done(req); -+ return tevent_req_post(req, ev); -+ } -+ - subreq = SMB_VFS_PWRITE_SEND(state, ev, fsp, data, n, offset); - if (tevent_req_nomem(subreq, req)) { - return tevent_req_post(req, ev); -diff --git a/source3/smbd/fileio.c b/source3/smbd/fileio.c -index 31d5b7510b7..f4a3dde66b7 100644 ---- a/source3/smbd/fileio.c -+++ b/source3/smbd/fileio.c -@@ -70,6 +70,10 @@ static ssize_t real_write_file(struct smb_request *req, - { - ssize_t ret; - -+ if (n == 0) { -+ return 0; -+ } -+ - fsp->fh->pos = pos; - if (pos && lp_strict_allocate(SNUM(fsp->conn) && - !fsp->is_sparse)) { --- -2.20.1 - - -From c593b105e646792cf19901e94ed764dc3b50d752 Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Mon, 11 May 2020 22:00:37 +0200 -Subject: [PATCH 07/31] s3:smbd: add vfs_valid_{pread,pwrite}_range() helper - functions - -These implement the SMB2 visible behavior of the [MS-FSA] -2.1.5.2 Server Requests a Read and 2.1.5.3 Server Requests a Write -constraints. Note that offset < 0 is not allowed over SMB. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Jeremy Allison -(cherry picked from commit 70fa4b884d2c22669984c25fe757c2fc528f7331) ---- - source3/smbd/proto.h | 2 ++ - source3/smbd/vfs.c | 32 ++++++++++++++++++++++++++++++++ - 2 files changed, 34 insertions(+) - -diff --git a/source3/smbd/proto.h b/source3/smbd/proto.h -index 8e33c473d44..60941ce6c1b 100644 ---- a/source3/smbd/proto.h -+++ b/source3/smbd/proto.h -@@ -1246,6 +1246,8 @@ void sys_utmp_yield(const char *username, const char *hostname, - bool vfs_init_custom(connection_struct *conn, const char *vfs_object); - bool smbd_vfs_init(connection_struct *conn); - NTSTATUS vfs_file_exist(connection_struct *conn, struct smb_filename *smb_fname); -+bool vfs_valid_pread_range(off_t offset, size_t length); -+bool vfs_valid_pwrite_range(off_t offset, size_t length); - ssize_t vfs_pwrite_data(struct smb_request *req, - files_struct *fsp, - const char *buffer, -diff --git a/source3/smbd/vfs.c b/source3/smbd/vfs.c -index 7dc15158ccb..566eed35d9b 100644 ---- a/source3/smbd/vfs.c -+++ b/source3/smbd/vfs.c -@@ -32,6 +32,7 @@ - #include "ntioctl.h" - #include "lib/util/tevent_unix.h" - #include "lib/util/tevent_ntstatus.h" -+#include "lib/util/sys_rw.h" - - #undef DBGC_CLASS - #define DBGC_CLASS DBGC_VFS -@@ -399,6 +400,37 @@ NTSTATUS vfs_file_exist(connection_struct *conn, struct smb_filename *smb_fname) - return NT_STATUS_OBJECT_NAME_NOT_FOUND; - } - -+bool vfs_valid_pread_range(off_t offset, size_t length) -+{ -+ return sys_valid_io_range(offset, length); -+} -+ -+bool vfs_valid_pwrite_range(off_t offset, size_t length) -+{ -+ /* -+ * See MAXFILESIZE in [MS-FSA] 2.1.5.3 Server Requests a Write -+ */ -+ static const uint64_t maxfilesize = 0xfffffff0000; -+ uint64_t last_byte_ofs; -+ bool ok; -+ -+ ok = sys_valid_io_range(offset, length); -+ if (!ok) { -+ return false; -+ } -+ -+ if (length == 0) { -+ return true; -+ } -+ -+ last_byte_ofs = offset + length; -+ if (last_byte_ofs > maxfilesize) { -+ return false; -+ } -+ -+ return true; -+} -+ - ssize_t vfs_pwrite_data(struct smb_request *req, - files_struct *fsp, - const char *buffer, --- -2.20.1 - - -From 9e1f6bb08d5e814e9894d643c46ff1aac6a8da0b Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Mon, 11 May 2020 18:18:24 +0200 -Subject: [PATCH 08/31] smbd: add vfs_valid_{pread,pwrite}_range() checks where - needed - -I checked all callers of SMB_VFS_PWRITE[_SEND](), -all callers of SMB_VFS_PREAD[_SEND]() and also -places where we append to the file and allocate -more space. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Jeremy Allison -(cherry picked from commit 6fa753a1a67d563cd22d0cad73ae15ee267512fc) ---- - selftest/knownfail.d/rw-invalid | 3 +-- - source3/modules/vfs_default.c | 7 +++++++ - source3/smbd/aio.c | 19 ++++++++++++++++++ - source3/smbd/fileio.c | 14 ++++++++++++++ - source3/smbd/vfs.c | 34 +++++++++++++++++++++++++++++++-- - 5 files changed, 73 insertions(+), 4 deletions(-) - -diff --git a/selftest/knownfail.d/rw-invalid b/selftest/knownfail.d/rw-invalid -index c6f11e03d20..ac5fe573239 100644 ---- a/selftest/knownfail.d/rw-invalid -+++ b/selftest/knownfail.d/rw-invalid -@@ -1,2 +1 @@ --samba3.smb2.rw.invalid --samba4.smb2.rw.invalid -+samba4.smb2.rw.invalid.ad_dc_ntvfs -diff --git a/source3/modules/vfs_default.c b/source3/modules/vfs_default.c -index a30f3ba1d31..3511c548166 100644 ---- a/source3/modules/vfs_default.c -+++ b/source3/modules/vfs_default.c -@@ -2582,6 +2582,13 @@ static int strict_allocate_ftruncate(vfs_handle_struct *handle, files_struct *fs - int ret; - NTSTATUS status; - SMB_STRUCT_STAT *pst; -+ bool ok; -+ -+ ok = vfs_valid_pwrite_range(len, 0); -+ if (!ok) { -+ errno = EINVAL; -+ return -1; -+ } - - status = vfs_stat_fsp(fsp); - if (!NT_STATUS_IS_OK(status)) { -diff --git a/source3/smbd/aio.c b/source3/smbd/aio.c -index 088ea603788..af8a01461a7 100644 ---- a/source3/smbd/aio.c -+++ b/source3/smbd/aio.c -@@ -166,6 +166,12 @@ NTSTATUS schedule_aio_read_and_X(connection_struct *conn, - size_t bufsize; - size_t min_aio_read_size = lp_aio_read_size(SNUM(conn)); - struct tevent_req *req; -+ bool ok; -+ -+ ok = vfs_valid_pread_range(startpos, smb_maxcnt); -+ if (!ok) { -+ return NT_STATUS_INVALID_PARAMETER; -+ } - - if (fsp->base_fsp != NULL) { - /* No AIO on streams yet */ -@@ -330,6 +336,7 @@ static struct tevent_req *pwrite_fsync_send(TALLOC_CTX *mem_ctx, - { - struct tevent_req *req, *subreq; - struct pwrite_fsync_state *state; -+ bool ok; - - req = tevent_req_create(mem_ctx, &state, struct pwrite_fsync_state); - if (req == NULL) { -@@ -339,6 +346,12 @@ static struct tevent_req *pwrite_fsync_send(TALLOC_CTX *mem_ctx, - state->fsp = fsp; - state->write_through = write_through; - -+ ok = vfs_valid_pwrite_range(offset, n); -+ if (!ok) { -+ tevent_req_error(req, EINVAL); -+ return tevent_req_post(req, ev); -+ } -+ - if (n == 0) { - tevent_req_done(req); - return tevent_req_post(req, ev); -@@ -665,6 +678,12 @@ NTSTATUS schedule_smb2_aio_read(connection_struct *conn, - struct aio_extra *aio_ex; - size_t min_aio_read_size = lp_aio_read_size(SNUM(conn)); - struct tevent_req *req; -+ bool ok; -+ -+ ok = vfs_valid_pread_range(startpos, smb_maxcnt); -+ if (!ok) { -+ return NT_STATUS_INVALID_PARAMETER; -+ } - - if (fsp->base_fsp != NULL) { - /* No AIO on streams yet */ -diff --git a/source3/smbd/fileio.c b/source3/smbd/fileio.c -index f4a3dde66b7..000a01e2c0f 100644 ---- a/source3/smbd/fileio.c -+++ b/source3/smbd/fileio.c -@@ -32,6 +32,7 @@ - ssize_t read_file(files_struct *fsp,char *data,off_t pos,size_t n) - { - ssize_t ret = 0; -+ bool ok; - - /* you can't read from print files */ - if (fsp->print_file) { -@@ -39,6 +40,12 @@ ssize_t read_file(files_struct *fsp,char *data,off_t pos,size_t n) - return -1; - } - -+ ok = vfs_valid_pread_range(pos, n); -+ if (!ok) { -+ errno = EINVAL; -+ return -1; -+ } -+ - fsp->fh->pos = pos; - - if (n > 0) { -@@ -69,6 +76,13 @@ static ssize_t real_write_file(struct smb_request *req, - size_t n) - { - ssize_t ret; -+ bool ok; -+ -+ ok = vfs_valid_pwrite_range(pos, n); -+ if (!ok) { -+ errno = EINVAL; -+ return -1; -+ } - - if (n == 0) { - return 0; -diff --git a/source3/smbd/vfs.c b/source3/smbd/vfs.c -index 566eed35d9b..96067e45005 100644 ---- a/source3/smbd/vfs.c -+++ b/source3/smbd/vfs.c -@@ -439,6 +439,13 @@ ssize_t vfs_pwrite_data(struct smb_request *req, - { - size_t total=0; - ssize_t ret; -+ bool ok; -+ -+ ok = vfs_valid_pwrite_range(offset, N); -+ if (!ok) { -+ errno = EINVAL; -+ return -1; -+ } - - if (req && req->unread_bytes) { - int sockfd = req->xconn->transport.sock; -@@ -515,6 +522,7 @@ int vfs_allocate_file_space(files_struct *fsp, uint64_t len) - uint64_t space_avail; - uint64_t bsize,dfree,dsize; - NTSTATUS status; -+ bool ok; - - /* - * Actually try and commit the space on disk.... -@@ -523,8 +531,9 @@ int vfs_allocate_file_space(files_struct *fsp, uint64_t len) - DEBUG(10,("vfs_allocate_file_space: file %s, len %.0f\n", - fsp_str_dbg(fsp), (double)len)); - -- if (((off_t)len) < 0) { -- DEBUG(0,("vfs_allocate_file_space: %s negative len " -+ ok = vfs_valid_pwrite_range((off_t)len, 0); -+ if (!ok) { -+ DEBUG(0,("vfs_allocate_file_space: %s negative/invalid len " - "requested.\n", fsp_str_dbg(fsp))); - errno = EINVAL; - return -1; -@@ -609,6 +618,13 @@ int vfs_allocate_file_space(files_struct *fsp, uint64_t len) - int vfs_set_filelen(files_struct *fsp, off_t len) - { - int ret; -+ bool ok; -+ -+ ok = vfs_valid_pwrite_range(len, 0); -+ if (!ok) { -+ errno = EINVAL; -+ return -1; -+ } - - contend_level2_oplocks_begin(fsp, LEVEL2_CONTEND_SET_FILE_LEN); - -@@ -640,6 +656,13 @@ int vfs_slow_fallocate(files_struct *fsp, off_t offset, off_t len) - { - ssize_t pwrite_ret; - size_t total = 0; -+ bool ok; -+ -+ ok = vfs_valid_pwrite_range(offset, len); -+ if (!ok) { -+ errno = EINVAL; -+ return -1; -+ } - - if (!sparse_buf) { - sparse_buf = SMB_CALLOC_ARRAY(char, SPARSE_BUF_WRITE_SIZE); -@@ -680,6 +703,13 @@ int vfs_fill_sparse(files_struct *fsp, off_t len) - NTSTATUS status; - off_t offset; - size_t num_to_write; -+ bool ok; -+ -+ ok = vfs_valid_pwrite_range(len, 0); -+ if (!ok) { -+ errno = EINVAL; -+ return -1; -+ } - - status = vfs_stat_fsp(fsp); - if (!NT_STATUS_IS_OK(status)) { --- -2.20.1 - - -From af989582036a929eb0e2594b1e2ee54145d41286 Mon Sep 17 00:00:00 2001 -From: Jeremy Allison -Date: Thu, 7 May 2020 12:42:10 -0700 -Subject: [PATCH 09/31] s3: VFS: aio_fork: Change sys_pread() -> - sys_pread_full() to protect against short reads. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Jeremy Allison -Reviewed-by: Stefan Metzmacher -(cherry picked from commit 60f590000d545292760018694deb34a7cc4ded6d) ---- - source3/modules/vfs_aio_fork.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/source3/modules/vfs_aio_fork.c b/source3/modules/vfs_aio_fork.c -index a1fed5c0655..285b331ff9c 100644 ---- a/source3/modules/vfs_aio_fork.c -+++ b/source3/modules/vfs_aio_fork.c -@@ -342,7 +342,7 @@ static void aio_child_loop(int sockfd, struct mmap_area *map) - - switch (cmd_struct.cmd) { - case READ_CMD: -- ret_struct.size = sys_pread( -+ ret_struct.size = sys_pread_full( - fd, discard_const(map->ptr), cmd_struct.n, - cmd_struct.offset); - #if 0 --- -2.20.1 - - -From 52b13fda0509f3bb28026a3d0f7d304c3bf28b08 Mon Sep 17 00:00:00 2001 -From: Jeremy Allison -Date: Thu, 7 May 2020 12:42:53 -0700 -Subject: [PATCH 10/31] s3: VFS: aio_fork: Change sys_pwrite() -> - sys_pwrite_full() to protect against short writes. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Jeremy Allison -Reviewed-by: Stefan Metzmacher -(cherry picked from commit 20ee8b03bbe5bef4ea968170808e3c4c9d22318e) ---- - source3/modules/vfs_aio_fork.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/source3/modules/vfs_aio_fork.c b/source3/modules/vfs_aio_fork.c -index 285b331ff9c..7c6f4b00fd0 100644 ---- a/source3/modules/vfs_aio_fork.c -+++ b/source3/modules/vfs_aio_fork.c -@@ -353,7 +353,7 @@ static void aio_child_loop(int sockfd, struct mmap_area *map) - #endif - break; - case WRITE_CMD: -- ret_struct.size = sys_pwrite( -+ ret_struct.size = sys_pwrite_full( - fd, discard_const(map->ptr), cmd_struct.n, - cmd_struct.offset); - break; --- -2.20.1 - - -From bd99244e029ef1df6a60a276d794bcd465a7bb5b Mon Sep 17 00:00:00 2001 -From: Jeremy Allison -Date: Thu, 7 May 2020 12:43:34 -0700 -Subject: [PATCH 11/31] s3: VFS: default. Change sys_pread() -> - sys_pread_full() in SMB_VFS_PREAD() to protect against short reads. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Jeremy Allison -Reviewed-by: Stefan Metzmacher -(cherry picked from commit 7daa79908b6a0362db30276b3b6f0db176b6ae3c) ---- - source3/modules/vfs_default.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/source3/modules/vfs_default.c b/source3/modules/vfs_default.c -index 3511c548166..1170629b084 100644 ---- a/source3/modules/vfs_default.c -+++ b/source3/modules/vfs_default.c -@@ -739,7 +739,7 @@ static ssize_t vfswrap_pread(vfs_handle_struct *handle, files_struct *fsp, void - - #if defined(HAVE_PREAD) || defined(HAVE_PREAD64) - START_PROFILE_BYTES(syscall_pread, n); -- result = sys_pread(fsp->fh->fd, data, n, offset); -+ result = sys_pread_full(fsp->fh->fd, data, n, offset); - END_PROFILE_BYTES(syscall_pread); - - if (result == -1 && errno == ESPIPE) { --- -2.20.1 - - -From 26ec59040879427166e04cdadbff175a40018c87 Mon Sep 17 00:00:00 2001 -From: Jeremy Allison -Date: Thu, 7 May 2020 12:44:26 -0700 -Subject: [PATCH 12/31] s3: VFS: default. Change sys_pwrite() -> - sys_pwrite_full() in SMB_VFS_PWRITE() to protect against short writes. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Jeremy Allison -Reviewed-by: Stefan Metzmacher -(cherry picked from commit ca8c3619f657dc38db7cb248f1a657f5bfe20757) ---- - source3/modules/vfs_default.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/source3/modules/vfs_default.c b/source3/modules/vfs_default.c -index 1170629b084..e516c733e69 100644 ---- a/source3/modules/vfs_default.c -+++ b/source3/modules/vfs_default.c -@@ -763,7 +763,7 @@ static ssize_t vfswrap_pwrite(vfs_handle_struct *handle, files_struct *fsp, cons - - #if defined(HAVE_PWRITE) || defined(HAVE_PRWITE64) - START_PROFILE_BYTES(syscall_pwrite, n); -- result = sys_pwrite(fsp->fh->fd, data, n, offset); -+ result = sys_pwrite_full(fsp->fh->fd, data, n, offset); - END_PROFILE_BYTES(syscall_pwrite); - - if (result == -1 && errno == ESPIPE) { --- -2.20.1 - - -From fa25bd26d1fe02c7480f2af7e22af8a03127157e Mon Sep 17 00:00:00 2001 -From: Jeremy Allison -Date: Thu, 7 May 2020 12:45:10 -0700 -Subject: [PATCH 13/31] s3: VFS: default. Change pread() -> sys_pread_full() in - SMB_VFS_PREAD_SEND() to protect against short reads. - -Note that as sys_pread_full() deals with the EINTR case -we can remove the do {} while loop here. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Jeremy Allison -Reviewed-by: Stefan Metzmacher -(cherry picked from commit bf2e546be38abfc77cf40e0b0fef42937696dcde) ---- - source3/modules/vfs_default.c | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - -diff --git a/source3/modules/vfs_default.c b/source3/modules/vfs_default.c -index e516c733e69..809c9b3d92f 100644 ---- a/source3/modules/vfs_default.c -+++ b/source3/modules/vfs_default.c -@@ -843,10 +843,10 @@ static void vfs_pread_do(void *private_data) - - PROFILE_TIMESTAMP(&start_time); - -- do { -- state->ret = pread(state->fd, state->buf, state->count, -- state->offset); -- } while ((state->ret == -1) && (errno == EINTR)); -+ state->ret = sys_pread_full(state->fd, -+ state->buf, -+ state->count, -+ state->offset); - - if (state->ret == -1) { - state->vfs_aio_state.error = errno; --- -2.20.1 - - -From 9a4639d6500900e18dfb685fbf4dc597f98cc63c Mon Sep 17 00:00:00 2001 -From: Jeremy Allison -Date: Thu, 7 May 2020 12:48:49 -0700 -Subject: [PATCH 14/31] s3: VFS: default. Change pwrite() -> sys_pwrite_full() - in SMB_VFS_PWRITE_SEND() to protect against short writes. - -Note that as sys_pwrite_full() deals with the EINTR case -we can remove the do {} while loop here. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Jeremy Allison -Reviewed-by: Stefan Metzmacher -(cherry picked from commit 801c06f4c9400343b72cad998086288931f7c6b3) ---- - source3/modules/vfs_default.c | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - -diff --git a/source3/modules/vfs_default.c b/source3/modules/vfs_default.c -index 809c9b3d92f..4cf553411cb 100644 ---- a/source3/modules/vfs_default.c -+++ b/source3/modules/vfs_default.c -@@ -971,10 +971,10 @@ static void vfs_pwrite_do(void *private_data) - - PROFILE_TIMESTAMP(&start_time); - -- do { -- state->ret = pwrite(state->fd, state->buf, state->count, -- state->offset); -- } while ((state->ret == -1) && (errno == EINTR)); -+ state->ret = sys_pwrite_full(state->fd, -+ state->buf, -+ state->count, -+ state->offset); - - if (state->ret == -1) { - state->vfs_aio_state.error = errno; --- -2.20.1 - - -From 9ecf0e23c6b5f40cf73df600b4ce2e6469d32065 Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Wed, 6 May 2020 03:05:47 -0700 -Subject: [PATCH 15/31] vfs_io_uring: fix the prefix for parametric options - from 'vfs_io_uring' to 'io_uring' - -This is what the manpage describes. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Jeremy Allison -(cherry picked from commit fadc7043a71b409ad60a1a4076a7f88f379d2056) ---- - source3/modules/vfs_io_uring.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c -index 378e48d112f..b409d075337 100644 ---- a/source3/modules/vfs_io_uring.c -+++ b/source3/modules/vfs_io_uring.c -@@ -172,13 +172,13 @@ static int vfs_io_uring_connect(vfs_handle_struct *handle, const char *service, - } - - num_entries = lp_parm_ulong(SNUM(handle->conn), -- "vfs_io_uring", -+ "io_uring", - "num_entries", - 128); - num_entries = MAX(num_entries, 1); - - sqpoll = lp_parm_bool(SNUM(handle->conn), -- "vfs_io_uring", -+ "io_uring", - "sqpoll", - false); - if (sqpoll) { --- -2.20.1 - - -From 0f22fb3e27bdda29e4969e4ddb64f0287deb5599 Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Fri, 8 May 2020 10:39:52 +0200 -Subject: [PATCH 16/31] vfs_io_uring: replace vfs_io_uring_request->state with - _tevent_req_data() - -We don't need a direct pointer to the state... - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Jeremy Allison -(cherry picked from commit f78e98e0226fe70899b613e0aa5c804d8458bdb0) ---- - source3/modules/vfs_io_uring.c | 10 ++++------ - 1 file changed, 4 insertions(+), 6 deletions(-) - -diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c -index b409d075337..988b309da52 100644 ---- a/source3/modules/vfs_io_uring.c -+++ b/source3/modules/vfs_io_uring.c -@@ -42,7 +42,6 @@ struct vfs_io_uring_request { - struct vfs_io_uring_request **list_head; - struct vfs_io_uring_config *config; - struct tevent_req *req; -- void *state; - struct io_uring_sqe sqe; - struct io_uring_cqe cqe; - struct timespec start_time; -@@ -58,8 +57,9 @@ static void vfs_io_uring_finish_req(struct vfs_io_uring_request *cur, - struct tevent_req *req = - talloc_get_type_abort(cur->req, - struct tevent_req); -+ void *state = _tevent_req_data(req); - -- talloc_set_destructor(cur->state, NULL); -+ talloc_set_destructor(state, NULL); - if (cur->list_head != NULL) { - DLIST_REMOVE((*cur->list_head), cur); - cur->list_head = NULL; -@@ -238,6 +238,7 @@ static void vfs_io_uring_queue_run(struct vfs_io_uring_config *config) - - for (cur = config->queue; cur != NULL; cur = next) { - struct io_uring_sqe *sqe = NULL; -+ void *state = _tevent_req_data(cur->req); - - next = cur->next; - -@@ -246,7 +247,7 @@ static void vfs_io_uring_queue_run(struct vfs_io_uring_config *config) - break; - } - -- talloc_set_destructor(cur->state, -+ talloc_set_destructor(state, - vfs_io_uring_request_state_deny_destructor); - DLIST_REMOVE(config->queue, cur); - *sqe = cur->sqe; -@@ -318,7 +319,6 @@ static struct tevent_req *vfs_io_uring_pread_send(struct vfs_handle_struct *hand - } - state->ur.config = config; - state->ur.req = req; -- state->ur.state = state; - - SMBPROFILE_BYTES_ASYNC_START(syscall_asys_pread, profile_p, - state->ur.profile_bytes, n); -@@ -398,7 +398,6 @@ static struct tevent_req *vfs_io_uring_pwrite_send(struct vfs_handle_struct *han - } - state->ur.config = config; - state->ur.req = req; -- state->ur.state = state; - - SMBPROFILE_BYTES_ASYNC_START(syscall_asys_pwrite, profile_p, - state->ur.profile_bytes, n); -@@ -475,7 +474,6 @@ static struct tevent_req *vfs_io_uring_fsync_send(struct vfs_handle_struct *hand - } - state->ur.config = config; - state->ur.req = req; -- state->ur.state = state; - - SMBPROFILE_BYTES_ASYNC_START(syscall_asys_fsync, profile_p, - state->ur.profile_bytes, 0); --- -2.20.1 - - -From 61d1e13c927a8fb8439d576026dc56a2379f127d Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Fri, 8 May 2020 10:42:59 +0200 -Subject: [PATCH 17/31] vfs_io_uring: introduce - vfs_io_uring_request->completion_fn() - -We'll need to add more logic than a simple _tevent_req_done() - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Jeremy Allison -(cherry picked from commit 456533c9cfc332d3a83ea03a6f969b0d64ccbeb6) ---- - source3/modules/vfs_io_uring.c | 49 +++++++++++++++++++++++++++++++++- - 1 file changed, 48 insertions(+), 1 deletion(-) - -diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c -index 988b309da52..abdd4d16e9f 100644 ---- a/source3/modules/vfs_io_uring.c -+++ b/source3/modules/vfs_io_uring.c -@@ -44,6 +44,8 @@ struct vfs_io_uring_request { - struct tevent_req *req; - struct io_uring_sqe sqe; - struct io_uring_cqe cqe; -+ void (*completion_fn)(struct vfs_io_uring_request *cur, -+ const char *location); - struct timespec start_time; - struct timespec end_time; - SMBPROFILE_BYTES_ASYNC_STATE(profile_bytes); -@@ -74,7 +76,7 @@ static void vfs_io_uring_finish_req(struct vfs_io_uring_request *cur, - * or tevent_req_defer_callback() being called - * already. - */ -- _tevent_req_done(req, location); -+ cur->completion_fn(cur, location); - } - - static void vfs_io_uring_config_destroy(struct vfs_io_uring_config *config, -@@ -297,6 +299,9 @@ struct vfs_io_uring_pread_state { - struct iovec iov; - }; - -+static void vfs_io_uring_pread_completion(struct vfs_io_uring_request *cur, -+ const char *location); -+ - static struct tevent_req *vfs_io_uring_pread_send(struct vfs_handle_struct *handle, - TALLOC_CTX *mem_ctx, - struct tevent_context *ev, -@@ -319,6 +324,7 @@ static struct tevent_req *vfs_io_uring_pread_send(struct vfs_handle_struct *hand - } - state->ur.config = config; - state->ur.req = req; -+ state->ur.completion_fn = vfs_io_uring_pread_completion; - - SMBPROFILE_BYTES_ASYNC_START(syscall_asys_pread, profile_p, - state->ur.profile_bytes, n); -@@ -344,6 +350,17 @@ static struct tevent_req *vfs_io_uring_pread_send(struct vfs_handle_struct *hand - return req; - } - -+static void vfs_io_uring_pread_completion(struct vfs_io_uring_request *cur, -+ const char *location) -+{ -+ /* -+ * We rely on being inside the _send() function -+ * or tevent_req_defer_callback() being called -+ * already. -+ */ -+ _tevent_req_done(cur->req, location); -+} -+ - static ssize_t vfs_io_uring_pread_recv(struct tevent_req *req, - struct vfs_aio_state *vfs_aio_state) - { -@@ -376,6 +393,9 @@ struct vfs_io_uring_pwrite_state { - struct iovec iov; - }; - -+static void vfs_io_uring_pwrite_completion(struct vfs_io_uring_request *cur, -+ const char *location); -+ - static struct tevent_req *vfs_io_uring_pwrite_send(struct vfs_handle_struct *handle, - TALLOC_CTX *mem_ctx, - struct tevent_context *ev, -@@ -398,6 +418,7 @@ static struct tevent_req *vfs_io_uring_pwrite_send(struct vfs_handle_struct *han - } - state->ur.config = config; - state->ur.req = req; -+ state->ur.completion_fn = vfs_io_uring_pwrite_completion; - - SMBPROFILE_BYTES_ASYNC_START(syscall_asys_pwrite, profile_p, - state->ur.profile_bytes, n); -@@ -423,6 +444,17 @@ static struct tevent_req *vfs_io_uring_pwrite_send(struct vfs_handle_struct *han - return req; - } - -+static void vfs_io_uring_pwrite_completion(struct vfs_io_uring_request *cur, -+ const char *location) -+{ -+ /* -+ * We rely on being inside the _send() function -+ * or tevent_req_defer_callback() being called -+ * already. -+ */ -+ _tevent_req_done(cur->req, location); -+} -+ - static ssize_t vfs_io_uring_pwrite_recv(struct tevent_req *req, - struct vfs_aio_state *vfs_aio_state) - { -@@ -454,6 +486,9 @@ struct vfs_io_uring_fsync_state { - struct vfs_io_uring_request ur; - }; - -+static void vfs_io_uring_fsync_completion(struct vfs_io_uring_request *cur, -+ const char *location); -+ - static struct tevent_req *vfs_io_uring_fsync_send(struct vfs_handle_struct *handle, - TALLOC_CTX *mem_ctx, - struct tevent_context *ev, -@@ -474,6 +509,7 @@ static struct tevent_req *vfs_io_uring_fsync_send(struct vfs_handle_struct *hand - } - state->ur.config = config; - state->ur.req = req; -+ state->ur.completion_fn = vfs_io_uring_fsync_completion; - - SMBPROFILE_BYTES_ASYNC_START(syscall_asys_fsync, profile_p, - state->ur.profile_bytes, 0); -@@ -496,6 +532,17 @@ static struct tevent_req *vfs_io_uring_fsync_send(struct vfs_handle_struct *hand - return req; - } - -+static void vfs_io_uring_fsync_completion(struct vfs_io_uring_request *cur, -+ const char *location) -+{ -+ /* -+ * We rely on being inside the _send() function -+ * or tevent_req_defer_callback() being called -+ * already. -+ */ -+ _tevent_req_done(cur->req, location); -+} -+ - static int vfs_io_uring_fsync_recv(struct tevent_req *req, - struct vfs_aio_state *vfs_aio_state) - { --- -2.20.1 - - -From 1d670bd14381a00c872ec56033f602b9e18f11b0 Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Fri, 8 May 2020 10:52:52 +0200 -Subject: [PATCH 18/31] vfs_io_uring: move error handling out of - vfs_io_uring_pread_recv() - -We should do that as early as possible and that's in -vfs_io_uring_pread_completion(). - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Jeremy Allison -(cherry picked from commit a1487067a6c9df3136fd5d4d16dda4c0f63cb662) ---- - source3/modules/vfs_io_uring.c | 26 +++++++++++++++++--------- - 1 file changed, 17 insertions(+), 9 deletions(-) - -diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c -index abdd4d16e9f..0d8e1833009 100644 ---- a/source3/modules/vfs_io_uring.c -+++ b/source3/modules/vfs_io_uring.c -@@ -297,6 +297,7 @@ static void vfs_io_uring_fd_handler(struct tevent_context *ev, - struct vfs_io_uring_pread_state { - struct vfs_io_uring_request ur; - struct iovec iov; -+ size_t nread; - }; - - static void vfs_io_uring_pread_completion(struct vfs_io_uring_request *cur, -@@ -353,12 +354,23 @@ static struct tevent_req *vfs_io_uring_pread_send(struct vfs_handle_struct *hand - static void vfs_io_uring_pread_completion(struct vfs_io_uring_request *cur, - const char *location) - { -+ struct vfs_io_uring_pread_state *state = tevent_req_data( -+ cur->req, struct vfs_io_uring_pread_state); -+ - /* - * We rely on being inside the _send() function - * or tevent_req_defer_callback() being called - * already. - */ -- _tevent_req_done(cur->req, location); -+ -+ if (cur->cqe.res < 0) { -+ int err = -cur->cqe.res; -+ _tevent_req_error(cur->req, err, location); -+ return; -+ } -+ -+ state->nread = state->ur.cqe.res; -+ tevent_req_done(cur->req); - } - - static ssize_t vfs_io_uring_pread_recv(struct tevent_req *req, -@@ -366,23 +378,19 @@ static ssize_t vfs_io_uring_pread_recv(struct tevent_req *req, - { - struct vfs_io_uring_pread_state *state = tevent_req_data( - req, struct vfs_io_uring_pread_state); -- int ret; -+ ssize_t ret; - - SMBPROFILE_BYTES_ASYNC_END(state->ur.profile_bytes); - vfs_aio_state->duration = nsec_time_diff(&state->ur.end_time, - &state->ur.start_time); - - if (tevent_req_is_unix_error(req, &vfs_aio_state->error)) { -+ tevent_req_received(req); - return -1; - } - -- if (state->ur.cqe.res < 0) { -- vfs_aio_state->error = -state->ur.cqe.res; -- ret = -1; -- } else { -- vfs_aio_state->error = 0; -- ret = state->ur.cqe.res; -- } -+ vfs_aio_state->error = 0; -+ ret = state->nread; - - tevent_req_received(req); - return ret; --- -2.20.1 - - -From d340f961466be94d1467b4953389b721421fb86a Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Fri, 8 May 2020 10:52:52 +0200 -Subject: [PATCH 19/31] vfs_io_uring: move error handling out of - vfs_io_uring_pwrite_recv() - -We should do that as early as possible and that's in -vfs_io_uring_pwrite_completion(). - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Jeremy Allison -(cherry picked from commit a51969b8c7e6e49c0d3b776d897aea4f309f8678) ---- - source3/modules/vfs_io_uring.c | 26 +++++++++++++++++--------- - 1 file changed, 17 insertions(+), 9 deletions(-) - -diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c -index 0d8e1833009..a8da341e7b7 100644 ---- a/source3/modules/vfs_io_uring.c -+++ b/source3/modules/vfs_io_uring.c -@@ -399,6 +399,7 @@ static ssize_t vfs_io_uring_pread_recv(struct tevent_req *req, - struct vfs_io_uring_pwrite_state { - struct vfs_io_uring_request ur; - struct iovec iov; -+ size_t nwritten; - }; - - static void vfs_io_uring_pwrite_completion(struct vfs_io_uring_request *cur, -@@ -455,12 +456,23 @@ static struct tevent_req *vfs_io_uring_pwrite_send(struct vfs_handle_struct *han - static void vfs_io_uring_pwrite_completion(struct vfs_io_uring_request *cur, - const char *location) - { -+ struct vfs_io_uring_pwrite_state *state = tevent_req_data( -+ cur->req, struct vfs_io_uring_pwrite_state); -+ - /* - * We rely on being inside the _send() function - * or tevent_req_defer_callback() being called - * already. - */ -- _tevent_req_done(cur->req, location); -+ -+ if (cur->cqe.res < 0) { -+ int err = -cur->cqe.res; -+ _tevent_req_error(cur->req, err, location); -+ return; -+ } -+ -+ state->nwritten = state->ur.cqe.res; -+ tevent_req_done(cur->req); - } - - static ssize_t vfs_io_uring_pwrite_recv(struct tevent_req *req, -@@ -468,23 +480,19 @@ static ssize_t vfs_io_uring_pwrite_recv(struct tevent_req *req, - { - struct vfs_io_uring_pwrite_state *state = tevent_req_data( - req, struct vfs_io_uring_pwrite_state); -- int ret; -+ ssize_t ret; - - SMBPROFILE_BYTES_ASYNC_END(state->ur.profile_bytes); - vfs_aio_state->duration = nsec_time_diff(&state->ur.end_time, - &state->ur.start_time); - - if (tevent_req_is_unix_error(req, &vfs_aio_state->error)) { -+ tevent_req_received(req); - return -1; - } - -- if (state->ur.cqe.res < 0) { -- vfs_aio_state->error = -state->ur.cqe.res; -- ret = -1; -- } else { -- vfs_aio_state->error = 0; -- ret = state->ur.cqe.res; -- } -+ vfs_aio_state->error = 0; -+ ret = state->nwritten; - - tevent_req_received(req); - return ret; --- -2.20.1 - - -From 3da1624f4f6a674dd1e83d2b327e7a38cca7c252 Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Fri, 8 May 2020 10:52:52 +0200 -Subject: [PATCH 20/31] vfs_io_uring: move error handling out of - vfs_io_uring_fsync_recv() - -We should do that as early as possible and that's in -vfs_io_uring_fsync_completion(). - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Jeremy Allison -(cherry picked from commit 40be2232a44a86cb5dfdda330801e615826408ba) ---- - source3/modules/vfs_io_uring.c | 21 +++++++++++---------- - 1 file changed, 11 insertions(+), 10 deletions(-) - -diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c -index a8da341e7b7..0f560c95b67 100644 ---- a/source3/modules/vfs_io_uring.c -+++ b/source3/modules/vfs_io_uring.c -@@ -556,7 +556,14 @@ static void vfs_io_uring_fsync_completion(struct vfs_io_uring_request *cur, - * or tevent_req_defer_callback() being called - * already. - */ -- _tevent_req_done(cur->req, location); -+ -+ if (cur->cqe.res < 0) { -+ int err = -cur->cqe.res; -+ _tevent_req_error(cur->req, err, location); -+ return; -+ } -+ -+ tevent_req_done(cur->req); - } - - static int vfs_io_uring_fsync_recv(struct tevent_req *req, -@@ -564,26 +571,20 @@ static int vfs_io_uring_fsync_recv(struct tevent_req *req, - { - struct vfs_io_uring_fsync_state *state = tevent_req_data( - req, struct vfs_io_uring_fsync_state); -- int ret; - - SMBPROFILE_BYTES_ASYNC_END(state->ur.profile_bytes); - vfs_aio_state->duration = nsec_time_diff(&state->ur.end_time, - &state->ur.start_time); - - if (tevent_req_is_unix_error(req, &vfs_aio_state->error)) { -+ tevent_req_received(req); - return -1; - } - -- if (state->ur.cqe.res < 0) { -- vfs_aio_state->error = -state->ur.cqe.res; -- ret = -1; -- } else { -- vfs_aio_state->error = 0; -- ret = state->ur.cqe.res; -- } -+ vfs_aio_state->error = 0; - - tevent_req_received(req); -- return ret; -+ return 0; - } - - static struct vfs_fn_pointers vfs_io_uring_fns = { --- -2.20.1 - - -From 8bac62120864dc40285ae680f4493116dd2abe6d Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Fri, 8 May 2020 13:17:05 +0200 -Subject: [PATCH 21/31] vfs_io_uring: make use of sys_valid_io_range() in - vfs_io_uring_pread_send() - -This makes the follow up commits easier as we don't have to care -about overflows. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Jeremy Allison -(cherry picked from commit 5005ae3fb24018e370ae60cc23c5e9cfe8357bc9) ---- - source3/modules/vfs_io_uring.c | 8 ++++++++ - 1 file changed, 8 insertions(+) - -diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c -index 0f560c95b67..c7565b8c39d 100644 ---- a/source3/modules/vfs_io_uring.c -+++ b/source3/modules/vfs_io_uring.c -@@ -25,6 +25,7 @@ - #include "smbd/smbd.h" - #include "smbd/globals.h" - #include "lib/util/tevent_unix.h" -+#include "lib/util/sys_rw.h" - #include "smbprofile.h" - #include - -@@ -313,6 +314,7 @@ static struct tevent_req *vfs_io_uring_pread_send(struct vfs_handle_struct *hand - struct tevent_req *req = NULL; - struct vfs_io_uring_pread_state *state = NULL; - struct vfs_io_uring_config *config = NULL; -+ bool ok; - - SMB_VFS_HANDLE_GET_DATA(handle, config, - struct vfs_io_uring_config, -@@ -331,6 +333,12 @@ static struct tevent_req *vfs_io_uring_pread_send(struct vfs_handle_struct *hand - state->ur.profile_bytes, n); - SMBPROFILE_BYTES_ASYNC_SET_IDLE(state->ur.profile_bytes); - -+ ok = sys_valid_io_range(offset, n); -+ if (!ok) { -+ tevent_req_error(req, EINVAL); -+ return tevent_req_post(req, ev); -+ } -+ - state->iov.iov_base = (void *)data; - state->iov.iov_len = n; - io_uring_prep_readv(&state->ur.sqe, --- -2.20.1 - - -From 371195310fc9510692e0ee7f63361094bd7a4911 Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Fri, 8 May 2020 13:17:05 +0200 -Subject: [PATCH 22/31] vfs_io_uring: make use of sys_valid_io_range() in - vfs_io_uring_pwrite_send() - -This makes the follow up commits easier as we don't have to care -about overflows. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Jeremy Allison -(cherry picked from commit 388bc2e6e44470ea4043ecb22750e241145355d2) ---- - source3/modules/vfs_io_uring.c | 7 +++++++ - 1 file changed, 7 insertions(+) - -diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c -index c7565b8c39d..ee23449c63c 100644 ---- a/source3/modules/vfs_io_uring.c -+++ b/source3/modules/vfs_io_uring.c -@@ -423,6 +423,7 @@ static struct tevent_req *vfs_io_uring_pwrite_send(struct vfs_handle_struct *han - struct tevent_req *req = NULL; - struct vfs_io_uring_pwrite_state *state = NULL; - struct vfs_io_uring_config *config = NULL; -+ bool ok; - - SMB_VFS_HANDLE_GET_DATA(handle, config, - struct vfs_io_uring_config, -@@ -441,6 +442,12 @@ static struct tevent_req *vfs_io_uring_pwrite_send(struct vfs_handle_struct *han - state->ur.profile_bytes, n); - SMBPROFILE_BYTES_ASYNC_SET_IDLE(state->ur.profile_bytes); - -+ ok = sys_valid_io_range(offset, n); -+ if (!ok) { -+ tevent_req_error(req, EINVAL); -+ return tevent_req_post(req, ev); -+ } -+ - state->iov.iov_base = discard_const(data); - state->iov.iov_len = n; - io_uring_prep_writev(&state->ur.sqe, --- -2.20.1 - - -From fec90a44a6eb56a883e19268c399b9475a20220d Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Fri, 8 May 2020 21:29:53 +0200 -Subject: [PATCH 23/31] vfs_io_uring: avoid stack recursion of - vfs_io_uring_queue_run() - -Instead we remember if recursion was triggered and jump to -the start of the function again from the end. - -This should make it safe to be called from the completion_fn(). - -This is hideously complex stuff, so document the hell -out of it. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Jeremy Allison -(cherry picked from commit f96f45c9ba8d4c8fa4026c22ac4201d66335e5c4) ---- - source3/modules/vfs_io_uring.c | 93 +++++++++++++++++++++++++++++++++- - 1 file changed, 92 insertions(+), 1 deletion(-) - -diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c -index ee23449c63c..f94453d9995 100644 ---- a/source3/modules/vfs_io_uring.c -+++ b/source3/modules/vfs_io_uring.c -@@ -34,6 +34,10 @@ struct vfs_io_uring_request; - struct vfs_io_uring_config { - struct io_uring uring; - struct tevent_fd *fde; -+ /* recursion guard. See comment above vfs_io_uring_queue_run() */ -+ bool busy; -+ /* recursion guard. See comment above vfs_io_uring_queue_run() */ -+ bool need_retry; - struct vfs_io_uring_request *queue; - struct vfs_io_uring_request *pending; - }; -@@ -222,7 +226,7 @@ static int vfs_io_uring_connect(vfs_handle_struct *handle, const char *service, - return 0; - } - --static void vfs_io_uring_queue_run(struct vfs_io_uring_config *config) -+static void _vfs_io_uring_queue_run(struct vfs_io_uring_config *config) - { - struct vfs_io_uring_request *cur = NULL, *next = NULL; - struct io_uring_cqe *cqe = NULL; -@@ -280,6 +284,93 @@ static void vfs_io_uring_queue_run(struct vfs_io_uring_config *config) - io_uring_cq_advance(&config->uring, nr); - } - -+/* -+ * Wrapper function to prevent recursion which could happen -+ * if we called _vfs_io_uring_queue_run() directly without -+ * recursion checks. -+ * -+ * Looking at the pread call, we can have: -+ * -+ * vfs_io_uring_pread_send() -+ * ->vfs_io_uring_pread_submit() <----------------------------------- -+ * ->vfs_io_uring_request_submit() | -+ * ->vfs_io_uring_queue_run() | -+ * ->_vfs_io_uring_queue_run() | -+ * | -+ * But inside _vfs_io_uring_queue_run() looks like: | -+ * | -+ * _vfs_io_uring_queue_run() { | -+ * if (THIS_IO_COMPLETED) { | -+ * ->vfs_io_uring_finish_req() | -+ * ->cur->completion_fn() | -+ * } | -+ * } | -+ * | -+ * cur->completion_fn() for pread is set to vfs_io_uring_pread_completion() | -+ * | -+ * vfs_io_uring_pread_completion() { | -+ * if (READ_TERMINATED) { | -+ * -> tevent_req_done() - We're done, go back up the stack. | -+ * return; | -+ * } | -+ * | -+ * We have a short read - adjust the io vectors | -+ * | -+ * ->vfs_io_uring_pread_submit() --------------------------------------- -+ * } -+ * -+ * So before calling _vfs_io_uring_queue_run() we backet it with setting -+ * a flag config->busy, and unset it once _vfs_io_uring_queue_run() finally -+ * exits the retry loop. -+ * -+ * If we end up back into vfs_io_uring_queue_run() we notice we've done so -+ * as config->busy is set and don't recurse into _vfs_io_uring_queue_run(). -+ * -+ * We set the second flag config->need_retry that tells us to loop in the -+ * vfs_io_uring_queue_run() call above us in the stack and return. -+ * -+ * When the outer call to _vfs_io_uring_queue_run() returns we are in -+ * a loop checking if config->need_retry was set. That happens if -+ * the short read case occurs and _vfs_io_uring_queue_run() ended up -+ * recursing into vfs_io_uring_queue_run(). -+ * -+ * Once vfs_io_uring_pread_completion() finishes without a short -+ * read (the READ_TERMINATED case, tevent_req_done() is called) -+ * then config->need_retry is left as false, we exit the loop, -+ * set config->busy to false so the next top level call into -+ * vfs_io_uring_queue_run() won't think it's a recursed call -+ * and return. -+ * -+ */ -+ -+static void vfs_io_uring_queue_run(struct vfs_io_uring_config *config) -+{ -+ if (config->busy) { -+ /* -+ * We've recursed due to short read/write. -+ * Set need_retry to ensure we retry the -+ * io_uring_submit(). -+ */ -+ config->need_retry = true; -+ return; -+ } -+ -+ /* -+ * Bracket the loop calling _vfs_io_uring_queue_run() -+ * with busy = true / busy = false. -+ * so we can detect recursion above. -+ */ -+ -+ config->busy = true; -+ -+ do { -+ config->need_retry = false; -+ _vfs_io_uring_queue_run(config); -+ } while (config->need_retry); -+ -+ config->busy = false; -+} -+ - static void vfs_io_uring_fd_handler(struct tevent_context *ev, - struct tevent_fd *fde, - uint16_t flags, --- -2.20.1 - - -From f7baf726bbb2c048c243857347731628ae1f112b Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Fri, 8 May 2020 11:17:51 +0200 -Subject: [PATCH 24/31] vfs_io_uring: split out a vfs_io_uring_request_submit() - function - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Jeremy Allison -(cherry picked from commit ab89b8e75354c5fd571985e924e1ccbec99de990) ---- - source3/modules/vfs_io_uring.c | 29 ++++++++++++++--------------- - 1 file changed, 14 insertions(+), 15 deletions(-) - -diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c -index f94453d9995..1d48bd192fe 100644 ---- a/source3/modules/vfs_io_uring.c -+++ b/source3/modules/vfs_io_uring.c -@@ -371,6 +371,17 @@ static void vfs_io_uring_queue_run(struct vfs_io_uring_config *config) - config->busy = false; - } - -+static void vfs_io_uring_request_submit(struct vfs_io_uring_request *cur) -+{ -+ struct vfs_io_uring_config *config = cur->config; -+ -+ io_uring_sqe_set_data(&cur->sqe, cur); -+ DLIST_ADD_END(config->queue, cur); -+ cur->list_head = &config->queue; -+ -+ vfs_io_uring_queue_run(config); -+} -+ - static void vfs_io_uring_fd_handler(struct tevent_context *ev, - struct tevent_fd *fde, - uint16_t flags, -@@ -436,11 +447,7 @@ static struct tevent_req *vfs_io_uring_pread_send(struct vfs_handle_struct *hand - fsp->fh->fd, - &state->iov, 1, - offset); -- io_uring_sqe_set_data(&state->ur.sqe, &state->ur); -- DLIST_ADD_END(config->queue, &state->ur); -- state->ur.list_head = &config->queue; -- -- vfs_io_uring_queue_run(config); -+ vfs_io_uring_request_submit(&state->ur); - - if (!tevent_req_is_in_progress(req)) { - return tevent_req_post(req, ev); -@@ -545,11 +552,7 @@ static struct tevent_req *vfs_io_uring_pwrite_send(struct vfs_handle_struct *han - fsp->fh->fd, - &state->iov, 1, - offset); -- io_uring_sqe_set_data(&state->ur.sqe, &state->ur); -- DLIST_ADD_END(config->queue, &state->ur); -- state->ur.list_head = &config->queue; -- -- vfs_io_uring_queue_run(config); -+ vfs_io_uring_request_submit(&state->ur); - - if (!tevent_req_is_in_progress(req)) { - return tevent_req_post(req, ev); -@@ -640,11 +643,7 @@ static struct tevent_req *vfs_io_uring_fsync_send(struct vfs_handle_struct *hand - io_uring_prep_fsync(&state->ur.sqe, - fsp->fh->fd, - 0); /* fsync_flags */ -- io_uring_sqe_set_data(&state->ur.sqe, &state->ur); -- DLIST_ADD_END(config->queue, &state->ur); -- state->ur.list_head = &config->queue; -- -- vfs_io_uring_queue_run(config); -+ vfs_io_uring_request_submit(&state->ur); - - if (!tevent_req_is_in_progress(req)) { - return tevent_req_post(req, ev); --- -2.20.1 - - -From ccda7ef339d743ee90df6739ddcdce22c169b70e Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Fri, 8 May 2020 11:17:51 +0200 -Subject: [PATCH 25/31] vfs_io_uring: split out a vfs_io_uring_pread_submit() - function - -This can be reused when we add handling for short reads. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Jeremy Allison -(cherry picked from commit 9de4f8be1dc8b4274891016191a5ca1f724e08b3) ---- - source3/modules/vfs_io_uring.c | 20 +++++++++++++++----- - 1 file changed, 15 insertions(+), 5 deletions(-) - -diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c -index 1d48bd192fe..19e268e63db 100644 ---- a/source3/modules/vfs_io_uring.c -+++ b/source3/modules/vfs_io_uring.c -@@ -399,10 +399,13 @@ static void vfs_io_uring_fd_handler(struct tevent_context *ev, - - struct vfs_io_uring_pread_state { - struct vfs_io_uring_request ur; -+ struct files_struct *fsp; -+ off_t offset; - struct iovec iov; - size_t nread; - }; - -+static void vfs_io_uring_pread_submit(struct vfs_io_uring_pread_state *state); - static void vfs_io_uring_pread_completion(struct vfs_io_uring_request *cur, - const char *location); - -@@ -441,13 +444,11 @@ static struct tevent_req *vfs_io_uring_pread_send(struct vfs_handle_struct *hand - return tevent_req_post(req, ev); - } - -+ state->fsp = fsp; -+ state->offset = offset; - state->iov.iov_base = (void *)data; - state->iov.iov_len = n; -- io_uring_prep_readv(&state->ur.sqe, -- fsp->fh->fd, -- &state->iov, 1, -- offset); -- vfs_io_uring_request_submit(&state->ur); -+ vfs_io_uring_pread_submit(state); - - if (!tevent_req_is_in_progress(req)) { - return tevent_req_post(req, ev); -@@ -457,6 +458,15 @@ static struct tevent_req *vfs_io_uring_pread_send(struct vfs_handle_struct *hand - return req; - } - -+static void vfs_io_uring_pread_submit(struct vfs_io_uring_pread_state *state) -+{ -+ io_uring_prep_readv(&state->ur.sqe, -+ state->fsp->fh->fd, -+ &state->iov, 1, -+ state->offset); -+ vfs_io_uring_request_submit(&state->ur); -+} -+ - static void vfs_io_uring_pread_completion(struct vfs_io_uring_request *cur, - const char *location) - { --- -2.20.1 - - -From def543bf2c96db54475b3a48a77f68a500f7a248 Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Fri, 8 May 2020 11:17:51 +0200 -Subject: [PATCH 26/31] vfs_io_uring: split out a vfs_io_uring_pwrite_submit() - function - -This can be reused when we add handling for short writes. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Jeremy Allison -(cherry picked from commit 2f6abb00b0daeb4de9ad0aea1b5c56559391aef9) ---- - source3/modules/vfs_io_uring.c | 20 +++++++++++++++----- - 1 file changed, 15 insertions(+), 5 deletions(-) - -diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c -index 19e268e63db..3e004f48aa0 100644 ---- a/source3/modules/vfs_io_uring.c -+++ b/source3/modules/vfs_io_uring.c -@@ -514,10 +514,13 @@ static ssize_t vfs_io_uring_pread_recv(struct tevent_req *req, - - struct vfs_io_uring_pwrite_state { - struct vfs_io_uring_request ur; -+ struct files_struct *fsp; -+ off_t offset; - struct iovec iov; - size_t nwritten; - }; - -+static void vfs_io_uring_pwrite_submit(struct vfs_io_uring_pwrite_state *state); - static void vfs_io_uring_pwrite_completion(struct vfs_io_uring_request *cur, - const char *location); - -@@ -556,13 +559,11 @@ static struct tevent_req *vfs_io_uring_pwrite_send(struct vfs_handle_struct *han - return tevent_req_post(req, ev); - } - -+ state->fsp = fsp; -+ state->offset = offset; - state->iov.iov_base = discard_const(data); - state->iov.iov_len = n; -- io_uring_prep_writev(&state->ur.sqe, -- fsp->fh->fd, -- &state->iov, 1, -- offset); -- vfs_io_uring_request_submit(&state->ur); -+ vfs_io_uring_pwrite_submit(state); - - if (!tevent_req_is_in_progress(req)) { - return tevent_req_post(req, ev); -@@ -572,6 +573,15 @@ static struct tevent_req *vfs_io_uring_pwrite_send(struct vfs_handle_struct *han - return req; - } - -+static void vfs_io_uring_pwrite_submit(struct vfs_io_uring_pwrite_state *state) -+{ -+ io_uring_prep_writev(&state->ur.sqe, -+ state->fsp->fh->fd, -+ &state->iov, 1, -+ state->offset); -+ vfs_io_uring_request_submit(&state->ur); -+} -+ - static void vfs_io_uring_pwrite_completion(struct vfs_io_uring_request *cur, - const char *location) - { --- -2.20.1 - - -From 92a105453c9479ff70efc9a1cf5b4fd3b36764e0 Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Fri, 8 May 2020 11:38:56 +0200 -Subject: [PATCH 27/31] vfs_io_uring: protect vfs_io_uring_pread_completion() - against invalid results - -We should never get back more than we asked for. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Jeremy Allison -(cherry picked from commit f085dbf8b2bed2695e0065a5bf4523232cb532c7) ---- - source3/modules/vfs_io_uring.c | 14 ++++++++++++++ - 1 file changed, 14 insertions(+) - -diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c -index 3e004f48aa0..46fab116e9d 100644 ---- a/source3/modules/vfs_io_uring.c -+++ b/source3/modules/vfs_io_uring.c -@@ -26,6 +26,7 @@ - #include "smbd/globals.h" - #include "lib/util/tevent_unix.h" - #include "lib/util/sys_rw.h" -+#include "lib/util/iov_buf.h" - #include "smbprofile.h" - #include - -@@ -472,6 +473,9 @@ static void vfs_io_uring_pread_completion(struct vfs_io_uring_request *cur, - { - struct vfs_io_uring_pread_state *state = tevent_req_data( - cur->req, struct vfs_io_uring_pread_state); -+ struct iovec *iov = &state->iov; -+ int num_iov = 1; -+ bool ok; - - /* - * We rely on being inside the _send() function -@@ -485,6 +489,16 @@ static void vfs_io_uring_pread_completion(struct vfs_io_uring_request *cur, - return; - } - -+ ok = iov_advance(&iov, &num_iov, cur->cqe.res); -+ if (!ok) { -+ /* This is not expected! */ -+ DBG_ERR("iov_advance() failed cur->cqe.res=%d > iov_len=%d\n", -+ (int)cur->cqe.res, -+ (int)state->iov.iov_len); -+ tevent_req_error(cur->req, EIO); -+ return; -+ } -+ - state->nread = state->ur.cqe.res; - tevent_req_done(cur->req); - } --- -2.20.1 - - -From 2153f89d521d61f303a1ab55abb4b3e65825c7bd Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Fri, 8 May 2020 11:38:56 +0200 -Subject: [PATCH 28/31] vfs_io_uring: protect vfs_io_uring_pwrite_completion() - against invalid results - -We should never get more acked than we asked for. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Jeremy Allison -(cherry picked from commit 283f96872237517f0b3bc4e63e8d3c482ecd5fa4) ---- - source3/modules/vfs_io_uring.c | 13 +++++++++++++ - 1 file changed, 13 insertions(+) - -diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c -index 46fab116e9d..0ea785aae85 100644 ---- a/source3/modules/vfs_io_uring.c -+++ b/source3/modules/vfs_io_uring.c -@@ -601,6 +601,9 @@ static void vfs_io_uring_pwrite_completion(struct vfs_io_uring_request *cur, - { - struct vfs_io_uring_pwrite_state *state = tevent_req_data( - cur->req, struct vfs_io_uring_pwrite_state); -+ struct iovec *iov = &state->iov; -+ int num_iov = 1; -+ bool ok; - - /* - * We rely on being inside the _send() function -@@ -614,6 +617,16 @@ static void vfs_io_uring_pwrite_completion(struct vfs_io_uring_request *cur, - return; - } - -+ ok = iov_advance(&iov, &num_iov, cur->cqe.res); -+ if (!ok) { -+ /* This is not expected! */ -+ DBG_ERR("iov_advance() failed cur->cqe.res=%d > iov_len=%d\n", -+ (int)cur->cqe.res, -+ (int)state->iov.iov_len); -+ tevent_req_error(cur->req, EIO); -+ return; -+ } -+ - state->nwritten = state->ur.cqe.res; - tevent_req_done(cur->req); - } --- -2.20.1 - - -From 16fe7c511d019990318db5b44278ed9f6ae18a00 Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Fri, 8 May 2020 11:38:56 +0200 -Subject: [PATCH 29/31] vfs_io_uring: protect vfs_io_uring_fsync_completion() - against invalid results - -We should never get back a value > 0. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Jeremy Allison -(cherry picked from commit c57a731c4ce395fd710f0b066cd6f1b72223ae07) ---- - source3/modules/vfs_io_uring.c | 7 +++++++ - 1 file changed, 7 insertions(+) - -diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c -index 0ea785aae85..0b1583f962a 100644 ---- a/source3/modules/vfs_io_uring.c -+++ b/source3/modules/vfs_io_uring.c -@@ -715,6 +715,13 @@ static void vfs_io_uring_fsync_completion(struct vfs_io_uring_request *cur, - return; - } - -+ if (cur->cqe.res > 0) { -+ /* This is not expected! */ -+ DBG_ERR("got cur->cqe.res=%d\n", (int)cur->cqe.res); -+ tevent_req_error(cur->req, EIO); -+ return; -+ } -+ - tevent_req_done(cur->req); - } - --- -2.20.1 - - -From 81deb9fe0b2991c7da3f0165c24fb449c5ce879b Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Fri, 8 May 2020 13:30:17 +0200 -Subject: [PATCH 30/31] vfs_io_uring: retry after a short read in - vfs_io_uring_pread_completion() - -We need to be prepared for short reads from the kernel depending on -the state of the page cache. Windows and Mac clients don't -expect short reads for files, so we need to retry ourself. - -For the future we may be able to play with some io_uring flags -in order to avoid the retries in userspace, but for now we just fix -the data corruption bug... - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Jeremy Allison -(cherry picked from commit 42e77c4cf245d8420641d216d1abefe81f7a3b79) ---- - source3/modules/vfs_io_uring.c | 24 ++++++++++++++++++++++-- - 1 file changed, 22 insertions(+), 2 deletions(-) - -diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c -index 0b1583f962a..f16c9ae56d3 100644 ---- a/source3/modules/vfs_io_uring.c -+++ b/source3/modules/vfs_io_uring.c -@@ -489,6 +489,14 @@ static void vfs_io_uring_pread_completion(struct vfs_io_uring_request *cur, - return; - } - -+ if (cur->cqe.res == 0) { -+ /* -+ * We reached EOF, we're done -+ */ -+ tevent_req_done(cur->req); -+ return; -+ } -+ - ok = iov_advance(&iov, &num_iov, cur->cqe.res); - if (!ok) { - /* This is not expected! */ -@@ -499,8 +507,20 @@ static void vfs_io_uring_pread_completion(struct vfs_io_uring_request *cur, - return; - } - -- state->nread = state->ur.cqe.res; -- tevent_req_done(cur->req); -+ /* sys_valid_io_range() already checked the boundaries */ -+ state->nread += state->ur.cqe.res; -+ if (num_iov == 0) { -+ /* We're done */ -+ tevent_req_done(cur->req); -+ return; -+ } -+ -+ /* -+ * sys_valid_io_range() already checked the boundaries -+ * now try to get the rest. -+ */ -+ state->offset += state->ur.cqe.res; -+ vfs_io_uring_pread_submit(state); - } - - static ssize_t vfs_io_uring_pread_recv(struct tevent_req *req, --- -2.20.1 - - -From 382b5a8b7263ff1dfb428cdebef0c17d622e2066 Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Fri, 8 May 2020 13:30:17 +0200 -Subject: [PATCH 31/31] vfs_io_uring: retry after a short writes in - vfs_io_uring_pwrite_completion() - -We need to be prepared for short writes from the kernel depending on -the state of the page cache. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Jeremy Allison -(cherry picked from commit 0f01b10679c06dbd28da72ca6c6280ddf81672ba) ---- - source3/modules/vfs_io_uring.c | 24 ++++++++++++++++++++++-- - 1 file changed, 22 insertions(+), 2 deletions(-) - -diff --git a/source3/modules/vfs_io_uring.c b/source3/modules/vfs_io_uring.c -index f16c9ae56d3..4625e16c37e 100644 ---- a/source3/modules/vfs_io_uring.c -+++ b/source3/modules/vfs_io_uring.c -@@ -637,6 +637,14 @@ static void vfs_io_uring_pwrite_completion(struct vfs_io_uring_request *cur, - return; - } - -+ if (cur->cqe.res == 0) { -+ /* -+ * Ensure we can never spin. -+ */ -+ tevent_req_error(cur->req, ENOSPC); -+ return; -+ } -+ - ok = iov_advance(&iov, &num_iov, cur->cqe.res); - if (!ok) { - /* This is not expected! */ -@@ -647,8 +655,20 @@ static void vfs_io_uring_pwrite_completion(struct vfs_io_uring_request *cur, - return; - } - -- state->nwritten = state->ur.cqe.res; -- tevent_req_done(cur->req); -+ /* sys_valid_io_range() already checked the boundaries */ -+ state->nwritten += state->ur.cqe.res; -+ if (num_iov == 0) { -+ /* We're done */ -+ tevent_req_done(cur->req); -+ return; -+ } -+ -+ /* -+ * sys_valid_io_range() already checked the boundaries -+ * now try to write the rest. -+ */ -+ state->offset += state->ur.cqe.res; -+ vfs_io_uring_pwrite_submit(state); - } - - static ssize_t vfs_io_uring_pwrite_recv(struct tevent_req *req, --- -2.20.1 - diff --git a/samba.spec b/samba.spec index 133e4eb..51680af 100644 --- a/samba.spec +++ b/samba.spec @@ -8,13 +8,13 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%define main_release 1 +%define main_release 0 -%define samba_version 4.12.2 +%define samba_version 4.12.3 %define talloc_version 2.3.1 %define tdb_version 1.4.3 %define tevent_version 0.10.2 -%define ldb_version 2.1.2 +%define ldb_version 2.1.3 # This should be rc1 or nil %define pre_release %nil @@ -129,10 +129,6 @@ Source14: samba.pamd Source201: README.downgrade -Patch100: new_mit_118.patch -Patch101: 0001-libsmb-Don-t-try-to-find-posix-stat-info-in-SMBC_get.patch -Patch102: samba-4.12.3-vfs_io_uring-bz14361.patch - Requires(pre): /usr/sbin/groupadd Requires(post): systemd Requires(preun): systemd @@ -3578,6 +3574,9 @@ fi %endif %changelog +* Tue May 19 2020 Guenther Deschner - 4.12.3-0 +- Update to Samba 4.12.3 + * Fri May 15 2020 Pete Walter - 2:4.12.2-1.2 - Rebuild for ICU 67 diff --git a/sources b/sources index ada3fb2..3d96a8f 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.12.2.tar.xz) = ab89b8f6f0c14b5e8712bf281f7f2cc8e3dae6a69147a826bb58538ed5a22457f4d9a1ec500cbd49da42a5918fe2dd1f2726bb9a7838d9ee5507424ecf75774b -SHA512 (samba-4.12.2.tar.asc) = b585cc5e919405a0910f1aea303959e92e293645296654805c65f20b92bd58098fc08be82ae17a9a281e04339f6af5579658f1b5c768498c75127c9dc254cd3d +SHA512 (samba-4.12.3.tar.xz) = 1810734a5f8645c3784f0341b5a75de240d8227aa9bc66b87b491a438b4623f6bfcf873049bf148ce73d22bfd97da9319c9d9468142063cd377d73503616b632 +SHA512 (samba-4.12.3.tar.asc) = d8911ad4b03cbeb0d35bb0dcaa83dca30dcbe1630cf888f56dc46a821b9e96c57bb3526573478cdb986e881c1577b03e30b6329166e87192fe51fdcabb415b53 From d974e2dba34df41e2461b0c6582b71d9ee31f687 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Tue, 26 May 2020 03:50:13 +0200 Subject: [PATCH 009/425] Rebuilt for Python 3.9 --- samba.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 51680af..d7dbe46 100644 --- a/samba.spec +++ b/samba.spec @@ -97,7 +97,7 @@ Name: samba Version: %{samba_version} -Release: %{samba_release}.2 +Release: %{samba_release}.3 %if 0%{?rhel} Epoch: 0 @@ -3574,6 +3574,9 @@ fi %endif %changelog +* Tue May 26 2020 Miro Hrončok - 2:4.12.3-0.3 +- Rebuilt for Python 3.9 + * Tue May 19 2020 Guenther Deschner - 4.12.3-0 - Update to Samba 4.12.3 From 840072c33afb72b5501ebb7dbb6e3a80e95151e8 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 2 Jun 2020 15:48:02 +0200 Subject: [PATCH 010/425] Do not require liburing for RHEL yet We need at least version 0.4 --- samba.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index d7dbe46..1f40310 100644 --- a/samba.spec +++ b/samba.spec @@ -89,9 +89,13 @@ %endif %global with_vfs_io_uring 0 +# We need liburing >= 0.4 which is not available in RHEL yet +%if 0%{?fedora} %ifarch aarch64 ppc64le s390x x86_64 i686 %global with_vfs_io_uring 1 %endif +# /fedora +%endif %global _systemd_extra "Environment=KRB5CCNAME=FILE:/run/samba/krb5cc_samba" @@ -227,7 +231,7 @@ BuildRequires: libcephfs-devel %endif %if %{with_vfs_io_uring} -BuildRequires: liburing-devel +BuildRequires: liburing-devel >= 0.4 %endif %if %{with_dc} From 31a5dced620a3d4f7f1b8c417ce15c36a136bc23 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 8 Jun 2020 09:24:32 +0200 Subject: [PATCH 011/425] Move libdcerpc-server-core to samba-libs This is used by the AD and FS RPC server implementation. --- samba.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index 1f40310..5bc62f9 100644 --- a/samba.spec +++ b/samba.spec @@ -1715,7 +1715,6 @@ fi %{_libdir}/samba/service/winbindd.so %{_libdir}/samba/service/wrepl.so %{_libdir}/libdcerpc-server.so.* -%{_libdir}/libdcerpc-server-core.so.* %{_libdir}/samba/libdnsserver-common-samba4.so %{_libdir}/samba/libdsdb-module-samba4.so %{_libdir}/samba/libdsdb-garbage-collect-tombstones-samba4.so @@ -1820,6 +1819,7 @@ fi %{_includedir}/samba-4.0/util_ldb.h %{_libdir}/libdcerpc-binding.so %{_libdir}/libdcerpc-samr.so +%{_libdir}/libdcerpc-server-core.so %{_libdir}/libdcerpc.so %{_libdir}/libndr-krb5pac.so %{_libdir}/libndr-nbt.so @@ -1850,7 +1850,6 @@ fi %if %with_dc %{_includedir}/samba-4.0/dcerpc_server.h %{_libdir}/libdcerpc-server.so -%{_libdir}/libdcerpc-server-core.so %{_libdir}/pkgconfig/dcerpc_server.pc %endif @@ -1888,6 +1887,7 @@ fi ### LIBS %files libs %{_libdir}/libdcerpc-samr.so.* +%{_libdir}/libdcerpc-server-core.so.* %{_libdir}/samba/libLIBWBCLIENT-OLD-samba4.so %{_libdir}/samba/libauth4-samba4.so From 08a93e1392445394dc86be24bf1a86d55ec1311b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 8 Jun 2020 09:25:20 +0200 Subject: [PATCH 012/425] Fix indentation for --without-winexe --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 5bc62f9..f7c0825 100644 --- a/samba.spec +++ b/samba.spec @@ -901,7 +901,7 @@ export LDFLAGS="%{__global_ldflags} -fuse-ld=gold" --enable-selftest \ %endif %if ! %with_winexe - --without-winexe \ + --without-winexe \ %endif --with-systemd \ --systemd-install-services \ From 341aa469a1c3b0d8fb7939df5975f922be51988d Mon Sep 17 00:00:00 2001 From: Jitka Plesnikova Date: Thu, 25 Jun 2020 15:07:59 +0200 Subject: [PATCH 013/425] Perl 5.32 rebuild --- samba.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index f7c0825..1caa065 100644 --- a/samba.spec +++ b/samba.spec @@ -101,7 +101,7 @@ Name: samba Version: %{samba_version} -Release: %{samba_release}.3 +Release: %{samba_release}.4 %if 0%{?rhel} Epoch: 0 @@ -3578,6 +3578,9 @@ fi %endif %changelog +* Thu Jun 25 2020 Jitka Plesnikova - 2:4.12.3-0.4 +- Perl 5.32 rebuild + * Tue May 26 2020 Miro Hrončok - 2:4.12.3-0.3 - Rebuilt for Python 3.9 From aa67a46ac716636e6e17636a0afbf9590367e61d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 25 Jun 2020 15:14:51 +0200 Subject: [PATCH 014/425] Add BuildRequires for python3-setuptools Guenther --- samba.spec | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index 1caa065..63cbe6c 100644 --- a/samba.spec +++ b/samba.spec @@ -8,7 +8,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%define main_release 0 +%define main_release 1 %define samba_version 4.12.3 %define talloc_version 2.3.1 @@ -101,7 +101,7 @@ Name: samba Version: %{samba_version} -Release: %{samba_release}.4 +Release: %{samba_release} %if 0%{?rhel} Epoch: 0 @@ -207,6 +207,7 @@ BuildRequires: perl(Archive::Tar) BuildRequires: perl(Test::More) BuildRequires: popt-devel BuildRequires: python3-devel +BuildRequires: python3-setuptools BuildRequires: quota-devel BuildRequires: readline-devel BuildRequires: rpcgen @@ -3578,6 +3579,9 @@ fi %endif %changelog +* Thu Jun 25 2020 Guenther Deschner - 4.12.3-1 +- Add BuildRequires for python3-setuptools + * Thu Jun 25 2020 Jitka Plesnikova - 2:4.12.3-0.4 - Perl 5.32 rebuild From 03ec1b226bb0dfd541468403606a8c5426ad6ae8 Mon Sep 17 00:00:00 2001 From: Jitka Plesnikova Date: Sat, 27 Jun 2020 06:57:43 +0200 Subject: [PATCH 015/425] Perl 5.32 re-rebuild updated packages --- samba.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 63cbe6c..88e4250 100644 --- a/samba.spec +++ b/samba.spec @@ -101,7 +101,7 @@ Name: samba Version: %{samba_version} -Release: %{samba_release} +Release: %{samba_release}.1 %if 0%{?rhel} Epoch: 0 @@ -3579,6 +3579,9 @@ fi %endif %changelog +* Sat Jun 27 2020 Jitka Plesnikova - 2:4.12.3-1.1 +- Perl 5.32 re-rebuild updated packages + * Thu Jun 25 2020 Guenther Deschner - 4.12.3-1 - Add BuildRequires for python3-setuptools From a8b268e88299d225585c1a648b400e74f9c4aeca Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 8 Jun 2020 09:31:01 +0200 Subject: [PATCH 016/425] Don't remove buildroot on install This is obsolete since ages. --- samba.spec | 2 -- 1 file changed, 2 deletions(-) diff --git a/samba.spec b/samba.spec index 88e4250..cde20d0 100644 --- a/samba.spec +++ b/samba.spec @@ -921,8 +921,6 @@ make %{?_smp_mflags} popd %install -rm -rf %{buildroot} - make %{?_smp_mflags} install DESTDIR=%{buildroot} install -d -m 0755 %{buildroot}/usr/{sbin,bin} From 39f81f495aa6aad57502028631e98b6b81624a10 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 8 Jun 2020 09:31:34 +0200 Subject: [PATCH 017/425] Remove manages when not needed instead of exluding them --- samba.spec | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/samba.spec b/samba.spec index cde20d0..0d41176 100644 --- a/samba.spec +++ b/samba.spec @@ -1073,6 +1073,15 @@ for i in \ done %endif +%if ! %{with_vfs_glusterfs} +rm -f %{buildroot}%{_mandir}/man8/vfs_glusterfs.8* +%endif + +%if ! %{with_vfs_cephfs} +rm -f %{buildroot}%{_mandir}/man8/vfs_ceph.8* +rm -f %{buildroot}%{_mandir}/man8/vfs_ceph_snapshots.8* +%endif + # This makes the right links, as rpmlint requires that # the ldconfig-created links be recorded in the RPM. /sbin/ldconfig -N -n %{buildroot}%{_libdir} @@ -1383,15 +1392,6 @@ fi %{_mandir}/man8/vfs_worm.8* %{_mandir}/man8/vfs_xattr_tdb.8* -%if ! %{with_vfs_glusterfs} -%exclude %{_mandir}/man8/vfs_glusterfs.8* -%endif - -%if ! %{with_vfs_cephfs} -%exclude %{_mandir}/man8/vfs_ceph.8* -%exclude %{_mandir}/man8/vfs_ceph_snapshots.8* -%endif - %attr(775,root,printadmin) %dir /var/lib/samba/drivers ### CLIENT From cd517c5be5d671b32fc98a635a373730ed4dabc4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 2 Jul 2020 11:41:22 +0200 Subject: [PATCH 018/425] Update to Samba 4.12.4 resolves: #1849489, #1853255 - Security fixes for CVE-2020-10730 resolves: #1849491, #1853256 - Security fixes for CVE-2020-10745 resolves: #1849509, #1853276 - Security fixes for CVE-2020-10760 resolves: #1851298, #1853259 - Security fixes for CVE-2020-14303 Guenther --- .gitignore | 2 ++ samba.spec | 17 +++++++++++++---- sources | 4 ++-- 3 files changed, 17 insertions(+), 6 deletions(-) diff --git a/.gitignore b/.gitignore index 0081dcb..4a5eb65 100644 --- a/.gitignore +++ b/.gitignore @@ -205,3 +205,5 @@ samba-3.6.0pre1.tar.gz /samba-4.12.2.tar.asc /samba-4.12.3.tar.xz /samba-4.12.3.tar.asc +/samba-4.12.4.tar.xz +/samba-4.12.4.tar.asc diff --git a/samba.spec b/samba.spec index 0d41176..1bbc0e8 100644 --- a/samba.spec +++ b/samba.spec @@ -8,13 +8,13 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%define main_release 1 +%define main_release 0 -%define samba_version 4.12.3 +%define samba_version 4.12.4 %define talloc_version 2.3.1 %define tdb_version 1.4.3 %define tevent_version 0.10.2 -%define ldb_version 2.1.3 +%define ldb_version 2.1.4 # This should be rc1 or nil %define pre_release %nil @@ -101,7 +101,7 @@ Name: samba Version: %{samba_version} -Release: %{samba_release}.1 +Release: %{samba_release} %if 0%{?rhel} Epoch: 0 @@ -2295,6 +2295,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/dns_base.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dns_forwarder.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dns_invalid.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/dns_packet.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dns_tkey.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dns_wildcard.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dsdb.*.pyc @@ -2461,6 +2462,7 @@ fi %{python3_sitearch}/samba/tests/dns_forwarder_helpers/__pycache__/server.*.pyc %{python3_sitearch}/samba/tests/dns_forwarder_helpers/server.py %{python3_sitearch}/samba/tests/dns_invalid.py +%{python3_sitearch}/samba/tests/dns_packet.py %{python3_sitearch}/samba/tests/dns_tkey.py %{python3_sitearch}/samba/tests/dns_wildcard.py %{python3_sitearch}/samba/tests/dsdb.py @@ -3577,6 +3579,13 @@ fi %endif %changelog +* Thu Jul 02 2020 Guenther Deschner - 4.12.4-0 +- Update to Samba 4.12.4 +- resolves: #1849489, #1853255 - Security fixes for CVE-2020-10730 +- resolves: #1849491, #1853256 - Security fixes for CVE-2020-10745 +- resolves: #1849509, #1853276 - Security fixes for CVE-2020-10760 +- resolves: #1851298, #1853259 - Security fixes for CVE-2020-14303 + * Sat Jun 27 2020 Jitka Plesnikova - 2:4.12.3-1.1 - Perl 5.32 re-rebuild updated packages diff --git a/sources b/sources index 3d96a8f..e96dccd 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.12.3.tar.xz) = 1810734a5f8645c3784f0341b5a75de240d8227aa9bc66b87b491a438b4623f6bfcf873049bf148ce73d22bfd97da9319c9d9468142063cd377d73503616b632 -SHA512 (samba-4.12.3.tar.asc) = d8911ad4b03cbeb0d35bb0dcaa83dca30dcbe1630cf888f56dc46a821b9e96c57bb3526573478cdb986e881c1577b03e30b6329166e87192fe51fdcabb415b53 +SHA512 (samba-4.12.4.tar.xz) = 4d6afa4a5975944ef665f081e0a761d2c71917f8226de3439fb29c7168397de110b0818e93f5db53f76628b5672b9971b9cfdd4f8fd1bdebf00717995ccc747e +SHA512 (samba-4.12.4.tar.asc) = 2f48477ed0db124349ddcbd8560ecc67f860543dd36d6f623ce7b17e3af7dfb90ee4a1f2d65dbe1c9cfdf9e2fcb0749ff91769066c64733164e4b559155d6876 From 3331e7aaff685dc18f145594b20ba50a803d3848 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 2 Jul 2020 19:50:30 +0200 Subject: [PATCH 019/425] Update to Samba 4.12.5 Guenther --- .gitignore | 2 ++ samba.spec | 5 ++++- sources | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 4a5eb65..bbc4895 100644 --- a/.gitignore +++ b/.gitignore @@ -207,3 +207,5 @@ samba-3.6.0pre1.tar.gz /samba-4.12.3.tar.asc /samba-4.12.4.tar.xz /samba-4.12.4.tar.asc +/samba-4.12.5.tar.xz +/samba-4.12.5.tar.asc diff --git a/samba.spec b/samba.spec index 1bbc0e8..41e61da 100644 --- a/samba.spec +++ b/samba.spec @@ -10,7 +10,7 @@ %define main_release 0 -%define samba_version 4.12.4 +%define samba_version 4.12.5 %define talloc_version 2.3.1 %define tdb_version 1.4.3 %define tevent_version 0.10.2 @@ -3579,6 +3579,9 @@ fi %endif %changelog +* Thu Jul 02 2020 Guenther Deschner - 4.12.5-0 +- Update to Samba 4.12.5 + * Thu Jul 02 2020 Guenther Deschner - 4.12.4-0 - Update to Samba 4.12.4 - resolves: #1849489, #1853255 - Security fixes for CVE-2020-10730 diff --git a/sources b/sources index e96dccd..6113667 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.12.4.tar.xz) = 4d6afa4a5975944ef665f081e0a761d2c71917f8226de3439fb29c7168397de110b0818e93f5db53f76628b5672b9971b9cfdd4f8fd1bdebf00717995ccc747e -SHA512 (samba-4.12.4.tar.asc) = 2f48477ed0db124349ddcbd8560ecc67f860543dd36d6f623ce7b17e3af7dfb90ee4a1f2d65dbe1c9cfdf9e2fcb0749ff91769066c64733164e4b559155d6876 +SHA512 (samba-4.12.5.tar.xz) = 3098eeb6beda126ec718b225172e9bc7a7715db70373655f9e3df67b5139c0ee2376daf4e1defb044148f0de81ae2d2c06e34559e9293f5717e9df1176dd2ba9 +SHA512 (samba-4.12.5.tar.asc) = a8f730795a2f58c428e21fe89b249893e6fcaaf84f848642c4183517c7b2c75e23fc98311b3cb32d5ef7f289c71c9fce3646eda2adbd702e6eeb7be79fda645b From a8b28d5d29fe7c162d0e1cf09a9999a63a5575c3 Mon Sep 17 00:00:00 2001 From: Merlin Mathesius Date: Wed, 8 Jul 2020 11:12:01 -0500 Subject: [PATCH 020/425] Remove nonexistent --without-winexe option from configure Signed-off-by: Merlin Mathesius --- samba.spec | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/samba.spec b/samba.spec index 41e61da..7eaa743 100644 --- a/samba.spec +++ b/samba.spec @@ -8,7 +8,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%define main_release 0 +%define main_release 1 %define samba_version 4.12.5 %define talloc_version 2.3.1 @@ -900,9 +900,6 @@ export LDFLAGS="%{__global_ldflags} -fuse-ld=gold" %endif %if %{with testsuite} --enable-selftest \ -%endif -%if ! %with_winexe - --without-winexe \ %endif --with-systemd \ --systemd-install-services \ @@ -3579,6 +3576,9 @@ fi %endif %changelog +* Wed Jul 08 2020 Merlin Mathesius - 4.12.5-1 +- Remove nonexistent --without-winexe option from configure + * Thu Jul 02 2020 Guenther Deschner - 4.12.5-0 - Update to Samba 4.12.5 From 82da6b03e3f6882910de4de2ffbf9aec8b94ecad Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 9 Jul 2020 11:27:48 +0200 Subject: [PATCH 021/425] Update to Samba 4.13.0rc1 Guenther --- .gitignore | 2 ++ samba.spec | 55 +++++++++++++++++++++++++++++++++++++++++++++++++----- sources | 4 ++-- 3 files changed, 54 insertions(+), 7 deletions(-) diff --git a/.gitignore b/.gitignore index bbc4895..6348e2d 100644 --- a/.gitignore +++ b/.gitignore @@ -209,3 +209,5 @@ samba-3.6.0pre1.tar.gz /samba-4.12.4.tar.asc /samba-4.12.5.tar.xz /samba-4.12.5.tar.asc +/samba-4.13.0rc1.tar.xz +/samba-4.13.0rc1.tar.asc diff --git a/samba.spec b/samba.spec index 7eaa743..405a0b4 100644 --- a/samba.spec +++ b/samba.spec @@ -8,15 +8,15 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%define main_release 1 +%define main_release 0 -%define samba_version 4.12.5 +%define samba_version 4.13.0 %define talloc_version 2.3.1 %define tdb_version 1.4.3 %define tevent_version 0.10.2 -%define ldb_version 2.1.4 +%define ldb_version 2.2.0 # This should be rc1 or nil -%define pre_release %nil +%define pre_release rc1 %if "x%{?pre_release}" != "x" %define samba_release 0.%{main_release}.%{pre_release}%{?dist} @@ -1334,6 +1334,7 @@ fi %{_libdir}/samba/vfs/time_audit.so %{_libdir}/samba/vfs/unityed_media.so %{_libdir}/samba/vfs/virusfilter.so +%{_libdir}/samba/vfs/widelinks.so %{_libdir}/samba/vfs/worm.so %{_libdir}/samba/vfs/xattr_tdb.so @@ -1386,6 +1387,7 @@ fi %{_mandir}/man8/vfs_time_audit.8* %{_mandir}/man8/vfs_unityed_media.8* %{_mandir}/man8/vfs_virusfilter.8* +%{_mandir}/man8/vfs_widelinks.8* %{_mandir}/man8/vfs_worm.8* %{_mandir}/man8/vfs_xattr_tdb.8* @@ -1683,6 +1685,10 @@ fi %{_mandir}/man8/samba_downgrade_db.8* %{_mandir}/man8/samba-gpupdate.8* %{_mandir}/man8/samba-tool.8* +%dir %{_datadir}/samba/admx +%{_datadir}/samba/admx/samba.admx +%dir %{_datadir}/samba/admx/en-US +%{_datadir}/samba/admx/en-US/samba.adml %files dc-provision %license source4/setup/ad-schema/licence.txt @@ -1796,7 +1802,6 @@ fi %dir %{_includedir}/samba-4.0/util %{_includedir}/samba-4.0/util/attr.h %{_includedir}/samba-4.0/util/blocking.h -%{_includedir}/samba-4.0/util/byteorder.h %{_includedir}/samba-4.0/util/data_blob.h %{_includedir}/samba-4.0/util/debug.h %{_includedir}/samba-4.0/util/discard.h @@ -1954,6 +1959,7 @@ fi %attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/Samba4/Template.pm %dir %{perl_vendorlib}/Parse/Pidl/Samba4/NDR %attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/Samba4/NDR/Server.pm +%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/Samba4/NDR/ServerCompat.pm %attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/Samba4/NDR/Client.pm %attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/Samba4/NDR/Parser.pm %attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/Samba4/TDR.pm @@ -1982,6 +1988,7 @@ fi %{python3_sitearch}/samba/__pycache__/getopt.*.pyc %{python3_sitearch}/samba/__pycache__/gpclass.*.pyc %{python3_sitearch}/samba/__pycache__/gp_ext_loader.*.pyc +%{python3_sitearch}/samba/__pycache__/gp_scripts_ext.*.pyc %{python3_sitearch}/samba/__pycache__/gp_sec_ext.*.pyc %{python3_sitearch}/samba/__pycache__/graph.*.pyc %{python3_sitearch}/samba/__pycache__/hostconfig.*.pyc @@ -2058,6 +2065,7 @@ fi %{python3_sitearch}/samba/gensec.*.so %{python3_sitearch}/samba/getopt.py %{python3_sitearch}/samba/gpclass.py +%{python3_sitearch}/samba/gp_scripts_ext.py %{python3_sitearch}/samba/gp_sec_ext.py %{python3_sitearch}/samba/gpo.*.so %{python3_sitearch}/samba/graph.py @@ -2394,6 +2402,8 @@ fi %{python3_sitearch}/samba/tests/blackbox/__pycache__/ndrdump.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/netads_json.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/samba_dnsupdate.*.pyc +%{python3_sitearch}/samba/tests/blackbox/__pycache__/smbcacls.*.pyc +%{python3_sitearch}/samba/tests/blackbox/__pycache__/smbcacls_basic.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/smbcontrol.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/smbcontrol_process.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/traffic_learner.*.pyc @@ -2406,6 +2416,8 @@ fi %{python3_sitearch}/samba/tests/blackbox/ndrdump.py %{python3_sitearch}/samba/tests/blackbox/netads_json.py %{python3_sitearch}/samba/tests/blackbox/samba_dnsupdate.py +%{python3_sitearch}/samba/tests/blackbox/smbcacls.py +%{python3_sitearch}/samba/tests/blackbox/smbcacls_basic.py %{python3_sitearch}/samba/tests/blackbox/smbcontrol.py %{python3_sitearch}/samba/tests/blackbox/smbcontrol_process.py %{python3_sitearch}/samba/tests/blackbox/traffic_learner.py @@ -2498,6 +2510,20 @@ fi %{python3_sitearch}/samba/tests/kcc/graph_utils.py %{python3_sitearch}/samba/tests/kcc/kcc_utils.py %{python3_sitearch}/samba/tests/kcc/ldif_import_export.py +%dir %{python3_sitearch}/samba/tests/krb5 +%dir %{python3_sitearch}/samba/tests/krb5/__pycache__ +%{python3_sitearch}/samba/tests/krb5/__pycache__/kcrypto.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/raw_testcase.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/rfc4120_pyasn1.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/simple_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/s4u_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/xrealm_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/kcrypto.py +%{python3_sitearch}/samba/tests/krb5/raw_testcase.py +%{python3_sitearch}/samba/tests/krb5/rfc4120_pyasn1.py +%{python3_sitearch}/samba/tests/krb5/simple_tests.py +%{python3_sitearch}/samba/tests/krb5/s4u_tests.py +%{python3_sitearch}/samba/tests/krb5/xrealm_tests.py %{python3_sitearch}/samba/tests/krb5_credentials.py %{python3_sitearch}/samba/tests/ldap_raw.py %{python3_sitearch}/samba/tests/ldap_referrals.py @@ -2574,6 +2600,9 @@ fi %{python3_sitearch}/samba/tests/samba_tool/__pycache__/user.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_check_password_script.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_virtualCryptSHA.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_virtualCryptSHA_base.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_virtualCryptSHA_gpg.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_virtualCryptSHA_userPassword.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_wdigest.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/visualize.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/visualize_drs.*.pyc @@ -2605,6 +2634,9 @@ fi %{python3_sitearch}/samba/tests/samba_tool/user.py %{python3_sitearch}/samba/tests/samba_tool/user_check_password_script.py %{python3_sitearch}/samba/tests/samba_tool/user_virtualCryptSHA.py +%{python3_sitearch}/samba/tests/samba_tool/user_virtualCryptSHA_base.py +%{python3_sitearch}/samba/tests/samba_tool/user_virtualCryptSHA_gpg.py +%{python3_sitearch}/samba/tests/samba_tool/user_virtualCryptSHA_userPassword.py %{python3_sitearch}/samba/tests/samba_tool/user_wdigest.py %{python3_sitearch}/samba/tests/samba_tool/visualize.py %{python3_sitearch}/samba/tests/samba_tool/visualize_drs.py @@ -2789,6 +2821,7 @@ fi %{_datadir}/ctdb/events/legacy/31.clamd.script %{_datadir}/ctdb/events/legacy/40.vsftpd.script %{_datadir}/ctdb/events/legacy/41.httpd.script +%{_datadir}/ctdb/events/legacy/48.netbios.script %{_datadir}/ctdb/events/legacy/49.winbind.script %{_datadir}/ctdb/events/legacy/50.samba.script %{_datadir}/ctdb/events/legacy/60.nfs.script @@ -2889,6 +2922,7 @@ fi %{_datadir}/ctdb/tests/INTEGRATION/database/basics.004.wipe.sh %{_datadir}/ctdb/tests/INTEGRATION/database/basics.010.backup_restore.sh %{_datadir}/ctdb/tests/INTEGRATION/database/fetch.001.ring.sh +%{_datadir}/ctdb/tests/INTEGRATION/database/fetch.002.ring-hotkeys.sh %{_datadir}/ctdb/tests/INTEGRATION/database/readonly.001.basic.sh %{_datadir}/ctdb/tests/INTEGRATION/database/recovery.001.volatile.sh %{_datadir}/ctdb/tests/INTEGRATION/database/recovery.002.large.sh @@ -2999,6 +3033,8 @@ fi %{_datadir}/ctdb/tests/UNIT/cunit/sock_io_test_001.sh %{_datadir}/ctdb/tests/UNIT/cunit/srvid_test_001.sh %{_datadir}/ctdb/tests/UNIT/cunit/system_socket_test_001.sh +%{_datadir}/ctdb/tests/UNIT/cunit/system_socket_test_002.sh +%{_datadir}/ctdb/tests/UNIT/cunit/system_socket_test_003.sh %dir %{_datadir}/ctdb/tests/UNIT/eventd %dir %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/ctdb.conf @@ -3182,6 +3218,8 @@ fi %{_datadir}/ctdb/tests/UNIT/eventscripts/41.httpd.monitor.002.sh %{_datadir}/ctdb/tests/UNIT/eventscripts/41.httpd.shutdown.002.sh %{_datadir}/ctdb/tests/UNIT/eventscripts/41.httpd.startup.002.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/48.netbios.shutdown.011.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/48.netbios.startup.011.sh %{_datadir}/ctdb/tests/UNIT/eventscripts/49.winbind.monitor.101.sh %{_datadir}/ctdb/tests/UNIT/eventscripts/49.winbind.monitor.102.sh %{_datadir}/ctdb/tests/UNIT/eventscripts/49.winbind.shutdown.002.sh @@ -3271,6 +3309,7 @@ fi %{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/31.clamd.sh %{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/40.vsftpd.sh %{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/41.httpd.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/48.netbios.sh %{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/49.winbind.sh %{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/50.samba.sh %{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/60.nfs.sh @@ -3462,6 +3501,7 @@ fi %{_datadir}/ctdb/tests/UNIT/tool/ctdb.getdbstatus.001.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.getdbstatus.002.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.getpid.001.sh +%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getpid.010.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.getreclock.001.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.getreclock.002.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.getvar.001.sh @@ -3488,6 +3528,7 @@ fi %{_datadir}/ctdb/tests/UNIT/tool/ctdb.lvs.006.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.lvs.007.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.lvs.008.sh +%{_datadir}/ctdb/tests/UNIT/tool/ctdb.lvs.010.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.natgw.001.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.natgw.002.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.natgw.003.sh @@ -3496,6 +3537,7 @@ fi %{_datadir}/ctdb/tests/UNIT/tool/ctdb.natgw.006.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.natgw.007.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.natgw.008.sh +%{_datadir}/ctdb/tests/UNIT/tool/ctdb.natgw.010.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.nodestatus.001.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.nodestatus.002.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.nodestatus.003.sh @@ -3576,6 +3618,9 @@ fi %endif %changelog +* Thu Jul 09 2020 Guenther Deschner - 4.13.0rc1-0 +- Update to Samba 4.13.0rc1 + * Wed Jul 08 2020 Merlin Mathesius - 4.12.5-1 - Remove nonexistent --without-winexe option from configure diff --git a/sources b/sources index 6113667..ef075e3 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.12.5.tar.xz) = 3098eeb6beda126ec718b225172e9bc7a7715db70373655f9e3df67b5139c0ee2376daf4e1defb044148f0de81ae2d2c06e34559e9293f5717e9df1176dd2ba9 -SHA512 (samba-4.12.5.tar.asc) = a8f730795a2f58c428e21fe89b249893e6fcaaf84f848642c4183517c7b2c75e23fc98311b3cb32d5ef7f289c71c9fce3646eda2adbd702e6eeb7be79fda645b +SHA512 (samba-4.13.0rc1.tar.xz) = 3e6d431998907ad8c81f488ddf78dcef5fd6a4cdf8ca684e5ad0ce9bf7217d82fcca7501155446c83d804f939bea7012f1d37c1f738d8ec7bc769a9148a6592a +SHA512 (samba-4.13.0rc1.tar.asc) = 6dfe9467fd7fd28db91ae15fa3314a7707cfeb88c8ecd2af532d57614bec311119546a2fd4ced71063df9b7d6879a62f9ba512ae05d494323e0362a5492d33fa From d13ee7d45ec19fd7548e7850addf279d81ce0869 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 14 Jul 2020 13:03:01 +0200 Subject: [PATCH 022/425] Move mdssvc data files to correct package --- samba.spec | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/samba.spec b/samba.spec index 405a0b4..7523dd8 100644 --- a/samba.spec +++ b/samba.spec @@ -8,7 +8,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%define main_release 0 +%define main_release 1 %define samba_version 4.13.0 %define talloc_version 2.3.1 @@ -1338,6 +1338,10 @@ fi %{_libdir}/samba/vfs/worm.so %{_libdir}/samba/vfs/xattr_tdb.so +%dir %{_datadir}/samba +%dir %{_datadir}/samba/mdssvc +%{_datadir}/samba/mdssvc/elasticsearch_mappings.json + %{_unitdir}/nmb.service %{_unitdir}/smb.service %attr(1777,root,root) %dir /var/spool/samba @@ -1446,9 +1450,6 @@ fi %{_mandir}/man8/cifsdd.8.* %{_mandir}/man8/samba-regedit.8* %{_mandir}/man8/smbspool.8* -%dir %{_datadir}/samba -%dir %{_datadir}/samba/mdssvc -%{_datadir}/samba/mdssvc/elasticsearch_mappings.json ### CLIENT-LIBS %files client-libs @@ -3618,6 +3619,9 @@ fi %endif %changelog +* Tue Jul 14 2020 Andreas Schneider - 4.13.0rc1-1 +- Move mdssvc data files to correct package + * Thu Jul 09 2020 Guenther Deschner - 4.13.0rc1-0 - Update to Samba 4.13.0rc1 From 2659a5f9b54916019cc9de94d840461e275b8f97 Mon Sep 17 00:00:00 2001 From: Tom Stellard Date: Tue, 14 Jul 2020 13:45:51 +0000 Subject: [PATCH 023/425] Use make macros https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro --- samba.spec | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/samba.spec b/samba.spec index 7523dd8..8101daf 100644 --- a/samba.spec +++ b/samba.spec @@ -101,7 +101,7 @@ Name: samba Version: %{samba_version} -Release: %{samba_release} +Release: %{samba_release}.1 %if 0%{?rhel} Epoch: 0 @@ -909,16 +909,16 @@ export LDFLAGS="%{__global_ldflags} -fuse-ld=gold" --systemd-winbind-extra=%{_systemd_extra} \ --systemd-samba-extra=%{_systemd_extra} -make %{?_smp_mflags} +%make_build pushd pidl %__perl Makefile.PL PREFIX=%{_prefix} -make %{?_smp_mflags} +%make_build popd %install -make %{?_smp_mflags} install DESTDIR=%{buildroot} +%make_install install -d -m 0755 %{buildroot}/usr/{sbin,bin} install -d -m 0755 %{buildroot}%{_libdir}/security @@ -1105,7 +1105,7 @@ popd %if %{with testsuite} %check -TDB_NO_FSYNC=1 make %{?_smp_mflags} test FAIL_IMMEDIATELY=1 +TDB_NO_FSYNC=1 %make_build test FAIL_IMMEDIATELY=1 #endif with testsuite %endif @@ -3619,6 +3619,10 @@ fi %endif %changelog +* Tue Jul 14 2020 Tom Stellard - 2:4.13.0-0.1.rc1.1 +- Use make macros +- https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro + * Tue Jul 14 2020 Andreas Schneider - 4.13.0rc1-1 - Move mdssvc data files to correct package From a000c31c78c41a02094b53f1464807dc09ec8a38 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 21 Jul 2020 09:11:08 +0200 Subject: [PATCH 024/425] Fix release number --- samba.spec | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/samba.spec b/samba.spec index 8101daf..25c004e 100644 --- a/samba.spec +++ b/samba.spec @@ -8,7 +8,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%define main_release 1 +%define main_release 2 %define samba_version 4.13.0 %define talloc_version 2.3.1 @@ -101,7 +101,7 @@ Name: samba Version: %{samba_version} -Release: %{samba_release}.1 +Release: %{samba_release} %if 0%{?rhel} Epoch: 0 @@ -3619,9 +3619,9 @@ fi %endif %changelog -* Tue Jul 14 2020 Tom Stellard - 2:4.13.0-0.1.rc1.1 +* Tue Jul 14 2020 Tom Stellard - 2:4.13.0-0.2.rc1 - Use make macros -- https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro + https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro * Tue Jul 14 2020 Andreas Schneider - 4.13.0rc1-1 - Move mdssvc data files to correct package From 0e393ad6d6d6857daeef2c7eaf9938497e4e73d7 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 29 Jul 2020 10:11:53 +0000 Subject: [PATCH 025/425] - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- samba.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 25c004e..d9d388b 100644 --- a/samba.spec +++ b/samba.spec @@ -101,7 +101,7 @@ Name: samba Version: %{samba_version} -Release: %{samba_release} +Release: %{samba_release}.1 %if 0%{?rhel} Epoch: 0 @@ -3619,6 +3619,9 @@ fi %endif %changelog +* Wed Jul 29 2020 Fedora Release Engineering - 2:4.13.0-0.2.rc1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + * Tue Jul 14 2020 Tom Stellard - 2:4.13.0-0.2.rc1 - Use make macros https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro From 67ed8f8f783b6d9ec11e4e4cb99e7d034a090338 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 12 Aug 2020 10:16:17 +0200 Subject: [PATCH 026/425] Fix requires and missing dirs --- samba.spec | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index d9d388b..a3f7d5b 100644 --- a/samba.spec +++ b/samba.spec @@ -8,7 +8,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%define main_release 2 +%define main_release 3 %define samba_version 4.13.0 %define talloc_version 2.3.1 @@ -101,7 +101,7 @@ Name: samba Version: %{samba_version} -Release: %{samba_release}.1 +Release: %{samba_release} %if 0%{?rhel} Epoch: 0 @@ -391,7 +391,6 @@ Requires: ldb-tools # See bug 1507420 %samba_requires_eq libldb -Requires: python3-crypto Requires: python3-%{name} = %{samba_depver} Requires: python3-%{name}-dc = %{samba_depver} Requires: krb5-server >= %{required_mit_krb5} @@ -2712,6 +2711,7 @@ fi ### WINBIND-KRB5-LOCATOR %files winbind-krb5-locator %ghost %{_libdir}/krb5/plugins/libkrb5/winbind_krb5_locator.so +%dir %{_libdir}/samba/krb5 %{_libdir}/samba/krb5/winbind_krb5_locator.so %{_mandir}/man8/winbind_krb5_locator.8* @@ -3619,6 +3619,10 @@ fi %endif %changelog +* Wed Aug 12 2020 Andreas Schneider - 4.13.0rc1-3 +- resolves: #1865831 - Add missing /usr/lib64/samba/krb5 directory +- resolves: #1866989 - Remove obsolete python3-crypto dependency + * Wed Jul 29 2020 Fedora Release Engineering - 2:4.13.0-0.2.rc1.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild From 3f3c9ecde94e1d6efa549b7490c67c233d8994f9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 12 Aug 2020 11:10:29 +0200 Subject: [PATCH 027/425] Update to Samba 4.13.0rc2 Guenther --- .gitignore | 2 ++ samba.spec | 8 ++++++-- sources | 4 ++-- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 6348e2d..4554cfb 100644 --- a/.gitignore +++ b/.gitignore @@ -211,3 +211,5 @@ samba-3.6.0pre1.tar.gz /samba-4.12.5.tar.asc /samba-4.13.0rc1.tar.xz /samba-4.13.0rc1.tar.asc +/samba-4.13.0rc2.tar.xz +/samba-4.13.0rc2.tar.asc diff --git a/samba.spec b/samba.spec index a3f7d5b..a166549 100644 --- a/samba.spec +++ b/samba.spec @@ -8,7 +8,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%define main_release 3 +%define main_release 4 %define samba_version 4.13.0 %define talloc_version 2.3.1 @@ -16,7 +16,7 @@ %define tevent_version 0.10.2 %define ldb_version 2.2.0 # This should be rc1 or nil -%define pre_release rc1 +%define pre_release rc2 %if "x%{?pre_release}" != "x" %define samba_release 0.%{main_release}.%{pre_release}%{?dist} @@ -3342,6 +3342,7 @@ fi %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/kill %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/killall %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/multipath +%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/nfsconf %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/net %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/pidof %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/pkill @@ -3619,6 +3620,9 @@ fi %endif %changelog +* Fri Aug 14 2020 Guenther Deschner - 4.13.0rc2-4 +- Update to Samba 4.13.0rc2 + * Wed Aug 12 2020 Andreas Schneider - 4.13.0rc1-3 - resolves: #1865831 - Add missing /usr/lib64/samba/krb5 directory - resolves: #1866989 - Remove obsolete python3-crypto dependency diff --git a/sources b/sources index ef075e3..accebcc 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.13.0rc1.tar.xz) = 3e6d431998907ad8c81f488ddf78dcef5fd6a4cdf8ca684e5ad0ce9bf7217d82fcca7501155446c83d804f939bea7012f1d37c1f738d8ec7bc769a9148a6592a -SHA512 (samba-4.13.0rc1.tar.asc) = 6dfe9467fd7fd28db91ae15fa3314a7707cfeb88c8ecd2af532d57614bec311119546a2fd4ced71063df9b7d6879a62f9ba512ae05d494323e0362a5492d33fa +SHA512 (samba-4.13.0rc2.tar.xz) = e634a9b4c5f98c7917b9b33765dab30946da9928e026e03e4e4596544f51cc42e81be387e68a212edacfaa162aa2f2e0bccf959a0d13ce781fd02eca6968bcae +SHA512 (samba-4.13.0rc2.tar.asc) = 736f21e9e0640dd6f9e2889d500e3f5904d8c64455d6e48fe603cb16677b89a930fb80c1bc3bb13d51c82aa7fcf2a03c88ed181214582be80aa1233098dd5b89 From 57015c72af6b048948d189fa9a2096857de91994 Mon Sep 17 00:00:00 2001 From: Anoop C S Date: Thu, 27 Aug 2020 18:05:17 +0530 Subject: [PATCH 028/425] Add a note for disabled SMB1 in default smb.conf resolves: #1773149 --- smb.conf.vendor | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/smb.conf.vendor b/smb.conf.vendor index fe3f806..32441aa 100644 --- a/smb.conf.vendor +++ b/smb.conf.vendor @@ -2,6 +2,10 @@ # read the smb.conf manpage. # Run 'testparm' to verify the config is correct after # you modified it. +# +# Note: +# SMB1 is disabled by default. This means clients without support for SMB2 or +# SMB3 are no longer able to connect to smbd (by default). [global] workgroup = SAMBA From a31354402a0a7a8c451ac9d5424ff0987c43d933 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 28 Aug 2020 11:49:44 +0200 Subject: [PATCH 029/425] Update to Samba 4.13.0rc3 Guenther --- .gitignore | 2 ++ samba.spec | 8 ++++++-- sources | 4 ++-- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 4554cfb..23a2b6a 100644 --- a/.gitignore +++ b/.gitignore @@ -213,3 +213,5 @@ samba-3.6.0pre1.tar.gz /samba-4.13.0rc1.tar.asc /samba-4.13.0rc2.tar.xz /samba-4.13.0rc2.tar.asc +/samba-4.13.0rc3.tar.xz +/samba-4.13.0rc3.tar.asc diff --git a/samba.spec b/samba.spec index a166549..f3ad0c9 100644 --- a/samba.spec +++ b/samba.spec @@ -8,7 +8,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%define main_release 4 +%define main_release 5 %define samba_version 4.13.0 %define talloc_version 2.3.1 @@ -16,7 +16,7 @@ %define tevent_version 0.10.2 %define ldb_version 2.2.0 # This should be rc1 or nil -%define pre_release rc2 +%define pre_release rc3 %if "x%{?pre_release}" != "x" %define samba_release 0.%{main_release}.%{pre_release}%{?dist} @@ -3617,9 +3617,13 @@ fi ### WINEXE %files winexe %{_bindir}/winexe +%{_mandir}/man1/winexe.1.gz %endif %changelog +* Fri Aug 28 2020 Guenther Deschner - 4.13.0rc2-5 +- Update to Samba 4.13.0rc3 + * Fri Aug 14 2020 Guenther Deschner - 4.13.0rc2-4 - Update to Samba 4.13.0rc2 diff --git a/sources b/sources index accebcc..c01658d 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.13.0rc2.tar.xz) = e634a9b4c5f98c7917b9b33765dab30946da9928e026e03e4e4596544f51cc42e81be387e68a212edacfaa162aa2f2e0bccf959a0d13ce781fd02eca6968bcae -SHA512 (samba-4.13.0rc2.tar.asc) = 736f21e9e0640dd6f9e2889d500e3f5904d8c64455d6e48fe603cb16677b89a930fb80c1bc3bb13d51c82aa7fcf2a03c88ed181214582be80aa1233098dd5b89 +SHA512 (samba-4.13.0rc3.tar.xz) = 5f5546f5a5309d841d656ecf331665b7d2777c08afd9c86476d2acb3f68ded3cdc52b196777bdf3d06be681796965d1937275069d2edc6329a394941ffb4a7da +SHA512 (samba-4.13.0rc3.tar.asc) = 5e5a4e860a3131866fad933459127642bd8b1bc286d89461e842e4bdb9efcff4ee8bfe78b4c0005c8c4b967f84ec3521d4ab6a981ac8625b6838cac2a39b5a35 From 692491a4566ad950da59b28e6299d65acd996153 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 28 Aug 2020 14:58:18 +0200 Subject: [PATCH 030/425] Fix changelog Guenther --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index f3ad0c9..d0a3c8f 100644 --- a/samba.spec +++ b/samba.spec @@ -3621,7 +3621,7 @@ fi %endif %changelog -* Fri Aug 28 2020 Guenther Deschner - 4.13.0rc2-5 +* Fri Aug 28 2020 Guenther Deschner - 4.13.0rc3-5 - Update to Samba 4.13.0rc3 * Fri Aug 14 2020 Guenther Deschner - 4.13.0rc2-4 From 41ab0cd76dd3892d8f61ef8c375bbd33888fff4a Mon Sep 17 00:00:00 2001 From: Neal Gompa Date: Fri, 28 Aug 2020 11:57:42 -0400 Subject: [PATCH 031/425] Enable winexe by default everywhere --- samba.spec | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/samba.spec b/samba.spec index d0a3c8f..bd13ea6 100644 --- a/samba.spec +++ b/samba.spec @@ -8,7 +8,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%define main_release 5 +%define main_release 6 %define samba_version 4.13.0 %define talloc_version 2.3.1 @@ -83,10 +83,8 @@ %global with_clustering_support 1 %endif -%global with_winexe 1 -%if 0%{?rhel} -%global with_winexe 0 -%endif +# Enable winexe by default +%bcond_without winexe %global with_vfs_io_uring 0 # We need liburing >= 0.4 which is not available in RHEL yet @@ -194,7 +192,7 @@ BuildRequires: libtirpc-devel BuildRequires: libuuid-devel BuildRequires: libxslt BuildRequires: lmdb -%if %{with_winexe} +%if %{with winexe} BuildRequires: mingw32-gcc BuildRequires: mingw64-gcc %endif @@ -753,7 +751,7 @@ The samba-winbind-modules package provides the NSS library and a PAM module necessary to communicate to the Winbind Daemon ### WINEXE -%if %{with_winexe} +%if %{with winexe} %package winexe Summary: Samba Winexe Windows Binary License: GPLv3 @@ -3613,7 +3611,7 @@ fi #endif with_clustering_support %endif -%if %{with_winexe} +%if %{with winexe} ### WINEXE %files winexe %{_bindir}/winexe @@ -3621,6 +3619,9 @@ fi %endif %changelog +* Fri Aug 28 2020 Neal Gompa - 4.13.0rc3-6 +- Enable winexe by default everywhere + * Fri Aug 28 2020 Guenther Deschner - 4.13.0rc3-5 - Update to Samba 4.13.0rc3 From a2f88f217fc2f3d0f8445eaa771333df27013d11 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 7 Sep 2020 23:06:08 +0200 Subject: [PATCH 032/425] Update to Samba 4.13.0rc4 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 23a2b6a..db86936 100644 --- a/.gitignore +++ b/.gitignore @@ -215,3 +215,5 @@ samba-3.6.0pre1.tar.gz /samba-4.13.0rc2.tar.asc /samba-4.13.0rc3.tar.xz /samba-4.13.0rc3.tar.asc +/samba-4.13.0rc4.tar.xz +/samba-4.13.0rc4.tar.asc diff --git a/samba.spec b/samba.spec index bd13ea6..7911578 100644 --- a/samba.spec +++ b/samba.spec @@ -8,7 +8,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%define main_release 6 +%define main_release 7 %define samba_version 4.13.0 %define talloc_version 2.3.1 @@ -16,7 +16,7 @@ %define tevent_version 0.10.2 %define ldb_version 2.2.0 # This should be rc1 or nil -%define pre_release rc3 +%define pre_release rc4 %if "x%{?pre_release}" != "x" %define samba_release 0.%{main_release}.%{pre_release}%{?dist} @@ -3619,6 +3619,9 @@ fi %endif %changelog +* Mon Sep 07 2020 Guenther Deschner - 4.13.0rc4-7 +- Update to Samba 4.13.0rc4 + * Fri Aug 28 2020 Neal Gompa - 4.13.0rc3-6 - Enable winexe by default everywhere diff --git a/sources b/sources index c01658d..bc58ea9 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.13.0rc3.tar.xz) = 5f5546f5a5309d841d656ecf331665b7d2777c08afd9c86476d2acb3f68ded3cdc52b196777bdf3d06be681796965d1937275069d2edc6329a394941ffb4a7da -SHA512 (samba-4.13.0rc3.tar.asc) = 5e5a4e860a3131866fad933459127642bd8b1bc286d89461e842e4bdb9efcff4ee8bfe78b4c0005c8c4b967f84ec3521d4ab6a981ac8625b6838cac2a39b5a35 +SHA512 (samba-4.13.0rc4.tar.xz) = ece39d11de0d72aaae9f05b77e607c1fb27c6f2182721601a0a9649e5a57a2f3d89e6e568830aad1bca0ade1ed0c17df64fa55be1d6ff4ea87462f9405d3f551 +SHA512 (samba-4.13.0rc4.tar.asc) = 66104533e171250d00154a9a19d723ace380638498021a13b032c2f652c3d4e0128e49c6581ebf03bfc76148a826feb8aa1c54af66ee3a47d181cd648cf9c6f8 From 2804f931d084e1f4f7a57ad7603bcdb8b686c71a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 8 Sep 2020 09:58:33 +0200 Subject: [PATCH 033/425] Increase build version Guenther --- samba.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index 7911578..3ae254e 100644 --- a/samba.spec +++ b/samba.spec @@ -8,7 +8,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%define main_release 7 +%define main_release 8 %define samba_version 4.13.0 %define talloc_version 2.3.1 @@ -3619,7 +3619,7 @@ fi %endif %changelog -* Mon Sep 07 2020 Guenther Deschner - 4.13.0rc4-7 +* Mon Sep 07 2020 Guenther Deschner - 4.13.0rc4-8 - Update to Samba 4.13.0rc4 * Fri Aug 28 2020 Neal Gompa - 4.13.0rc3-6 From 0a5021c37e3204a12dbc31d30e2b24dd6bd171de Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 16 Sep 2020 14:33:18 +0200 Subject: [PATCH 034/425] Update to Samba 4.13.0rc5 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index db86936..05b33ad 100644 --- a/.gitignore +++ b/.gitignore @@ -217,3 +217,5 @@ samba-3.6.0pre1.tar.gz /samba-4.13.0rc3.tar.asc /samba-4.13.0rc4.tar.xz /samba-4.13.0rc4.tar.asc +/samba-4.13.0rc5.tar.xz +/samba-4.13.0rc5.tar.asc diff --git a/samba.spec b/samba.spec index 3ae254e..7c3527b 100644 --- a/samba.spec +++ b/samba.spec @@ -8,7 +8,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%define main_release 8 +%define main_release 9 %define samba_version 4.13.0 %define talloc_version 2.3.1 @@ -16,7 +16,7 @@ %define tevent_version 0.10.2 %define ldb_version 2.2.0 # This should be rc1 or nil -%define pre_release rc4 +%define pre_release rc5 %if "x%{?pre_release}" != "x" %define samba_release 0.%{main_release}.%{pre_release}%{?dist} @@ -3619,6 +3619,9 @@ fi %endif %changelog +* Wed Sep 16 2020 Guenther Deschner - 4.13.0rc5-9 +- Update to Samba 4.13.0rc5 + * Mon Sep 07 2020 Guenther Deschner - 4.13.0rc4-8 - Update to Samba 4.13.0rc4 diff --git a/sources b/sources index bc58ea9..fa70e3b 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.13.0rc4.tar.xz) = ece39d11de0d72aaae9f05b77e607c1fb27c6f2182721601a0a9649e5a57a2f3d89e6e568830aad1bca0ade1ed0c17df64fa55be1d6ff4ea87462f9405d3f551 -SHA512 (samba-4.13.0rc4.tar.asc) = 66104533e171250d00154a9a19d723ace380638498021a13b032c2f652c3d4e0128e49c6581ebf03bfc76148a826feb8aa1c54af66ee3a47d181cd648cf9c6f8 +SHA512 (samba-4.13.0rc5.tar.xz) = 9e33b746a5579a424c1e3f05bd61259993d0329d8af00705b5388cc764b0c65dc64a708b6171150a709135c036983f0c186617c415c8690bfd451275e14f09b8 +SHA512 (samba-4.13.0rc5.tar.asc) = afe748854639b301f275690752ee7bcbf317afb2bdcfc4e8f015d68634d8fdf715f032ff44a9c7403cbf624ce4b7a6834d0b084926f5e8ae06cfda1f81991d3b From c0da1c53030c05e3a145d6d38abd7c0636a08a0c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Sat, 19 Sep 2020 02:55:37 +0200 Subject: [PATCH 035/425] Update to Samba 4.13.0rc6 resolves: #1879822, #1880703 - Security fixes for CVE-2020-1472 Guenther --- .gitignore | 2 ++ samba.spec | 8 ++++++-- sources | 4 ++-- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 05b33ad..4284c88 100644 --- a/.gitignore +++ b/.gitignore @@ -219,3 +219,5 @@ samba-3.6.0pre1.tar.gz /samba-4.13.0rc4.tar.asc /samba-4.13.0rc5.tar.xz /samba-4.13.0rc5.tar.asc +/samba-4.13.0rc6.tar.xz +/samba-4.13.0rc6.tar.asc diff --git a/samba.spec b/samba.spec index 7c3527b..1a0aef0 100644 --- a/samba.spec +++ b/samba.spec @@ -8,7 +8,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%define main_release 9 +%define main_release 10 %define samba_version 4.13.0 %define talloc_version 2.3.1 @@ -16,7 +16,7 @@ %define tevent_version 0.10.2 %define ldb_version 2.2.0 # This should be rc1 or nil -%define pre_release rc5 +%define pre_release rc6 %if "x%{?pre_release}" != "x" %define samba_release 0.%{main_release}.%{pre_release}%{?dist} @@ -3619,6 +3619,10 @@ fi %endif %changelog +* Fri Sep 18 2020 Guenther Deschner - 4.13.0rc6-10 +- Update to Samba 4.13.0rc6 +- resolves: #1879822, #1880703 - Security fixes for CVE-2020-1472 + * Wed Sep 16 2020 Guenther Deschner - 4.13.0rc5-9 - Update to Samba 4.13.0rc5 diff --git a/sources b/sources index fa70e3b..45f9070 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.13.0rc5.tar.xz) = 9e33b746a5579a424c1e3f05bd61259993d0329d8af00705b5388cc764b0c65dc64a708b6171150a709135c036983f0c186617c415c8690bfd451275e14f09b8 -SHA512 (samba-4.13.0rc5.tar.asc) = afe748854639b301f275690752ee7bcbf317afb2bdcfc4e8f015d68634d8fdf715f032ff44a9c7403cbf624ce4b7a6834d0b084926f5e8ae06cfda1f81991d3b +SHA512 (samba-4.13.0rc6.tar.xz) = e241119b82376ca95662a46387ecdf9c9d1f89af6430b9fd45c86b70ecb0e0e52dd026ade51a642738a4d802c9822cf41f9dccac385f5c0bcc77ee6bd1d1eb72 +SHA512 (samba-4.13.0rc6.tar.asc) = 4cea6741c38c42f79491ed44be701e264bf25d4b16e1893d68d4e000debcb65552bbbb3a0c1f2111349da34f643c3e0125b5811ab3af03fab2c22884f4b6781b From b62fe7916002c85596b7802fa1ca0b10f46fcabc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 22 Sep 2020 17:56:01 +0200 Subject: [PATCH 036/425] Update to Samba 4.13.0 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 4284c88..78dd1f3 100644 --- a/.gitignore +++ b/.gitignore @@ -221,3 +221,5 @@ samba-3.6.0pre1.tar.gz /samba-4.13.0rc5.tar.asc /samba-4.13.0rc6.tar.xz /samba-4.13.0rc6.tar.asc +/samba-4.13.0.tar.xz +/samba-4.13.0.tar.asc diff --git a/samba.spec b/samba.spec index 1a0aef0..7948d6b 100644 --- a/samba.spec +++ b/samba.spec @@ -8,7 +8,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%define main_release 10 +%define main_release 11 %define samba_version 4.13.0 %define talloc_version 2.3.1 @@ -16,7 +16,7 @@ %define tevent_version 0.10.2 %define ldb_version 2.2.0 # This should be rc1 or nil -%define pre_release rc6 +%define pre_release %nil %if "x%{?pre_release}" != "x" %define samba_release 0.%{main_release}.%{pre_release}%{?dist} @@ -3619,6 +3619,9 @@ fi %endif %changelog +* Tue Sep 22 2020 Guenther Deschner - 4.13.0-11 +- Update to Samba 4.13.0 + * Fri Sep 18 2020 Guenther Deschner - 4.13.0rc6-10 - Update to Samba 4.13.0rc6 - resolves: #1879822, #1880703 - Security fixes for CVE-2020-1472 diff --git a/sources b/sources index 45f9070..36e8498 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.13.0rc6.tar.xz) = e241119b82376ca95662a46387ecdf9c9d1f89af6430b9fd45c86b70ecb0e0e52dd026ade51a642738a4d802c9822cf41f9dccac385f5c0bcc77ee6bd1d1eb72 -SHA512 (samba-4.13.0rc6.tar.asc) = 4cea6741c38c42f79491ed44be701e264bf25d4b16e1893d68d4e000debcb65552bbbb3a0c1f2111349da34f643c3e0125b5811ab3af03fab2c22884f4b6781b +SHA512 (samba-4.13.0.tar.xz) = 38370adfad7b7a9a8633d48782f0bcf812299858be20770d2e3406c7f450a2fd1ae646e2a143d22ce3c5ac22d54c4a229b019686ff2f16ca503c958d4afed825 +SHA512 (samba-4.13.0.tar.asc) = 7f71d1402d752cbdb09ec9e2539d35347c4025c332c4acb8590d5cab190b2b23bc2b1f99f3d66c3488bbdb6898528dd78e3893c33c92e3d9167236e8048dfbf2 From a1725106468cb513a1d9d85e5d0ca8d6db98ba67 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Sat, 19 Sep 2020 19:05:57 +0200 Subject: [PATCH 037/425] Add preliminary S4U support resolves: #1836630 - Samba DC: Remote Desktop cannot access files --- samba-s4u.patch | 726 ++++++++++++++++++++++++++++++++++++++++++++++++ samba.spec | 7 +- 2 files changed, 732 insertions(+), 1 deletion(-) create mode 100644 samba-s4u.patch diff --git a/samba-s4u.patch b/samba-s4u.patch new file mode 100644 index 0000000..83ed873 --- /dev/null +++ b/samba-s4u.patch @@ -0,0 +1,726 @@ +From fe300549844509624d944b93fc64dc6d382e71c1 Mon Sep 17 00:00:00 2001 +From: Isaac Boukris +Date: Fri, 27 Sep 2019 18:25:03 +0300 +Subject: [PATCH 3/7] mit-kdc: add basic loacl realm S4U support + +Signed-off-by: Isaac Boukris +Pair-Programmed-With: Andreas Schneider +--- + source4/kdc/mit-kdb/kdb_samba_policies.c | 148 +++++++++--------- + source4/kdc/mit_samba.c | 47 ++---- + source4/kdc/mit_samba.h | 6 +- + wscript_configure_system_mitkrb5 | 3 + + 6 files changed, 91 insertions(+), 115 deletions(-) + +diff --git a/source4/kdc/mit-kdb/kdb_samba_policies.c b/source4/kdc/mit-kdb/kdb_samba_policies.c +index 9197551ed61..944324d9a2f 100644 +--- a/source4/kdc/mit-kdb/kdb_samba_policies.c ++++ b/source4/kdc/mit-kdb/kdb_samba_policies.c +@@ -192,13 +192,17 @@ static krb5_error_code ks_verify_pac(krb5_context context, + krb5_keyblock *krbtgt_key, + krb5_timestamp authtime, + krb5_authdata **tgt_auth_data, +- krb5_pac *pac) ++ krb5_pac *out_pac) + { + struct mit_samba_context *mit_ctx; + krb5_authdata **authdata = NULL; +- krb5_pac ipac = NULL; +- DATA_BLOB logon_data = { NULL, 0 }; ++ krb5_keyblock *header_server_key = NULL; ++ krb5_key_data *impersonator_kd = NULL; ++ krb5_keyblock impersonator_key = {0}; + krb5_error_code code; ++ krb5_pac pac; ++ ++ *out_pac = NULL; + + mit_ctx = ks_get_context(context); + if (mit_ctx == NULL) { +@@ -230,41 +234,43 @@ static krb5_error_code ks_verify_pac(krb5_context context, + code = krb5_pac_parse(context, + authdata[0]->contents, + authdata[0]->length, +- &ipac); ++ &pac); + if (code != 0) { + goto done; + } + +- /* TODO: verify this is correct +- * +- * In the constrained delegation case, the PAC is from a service +- * ticket rather than a TGT; we must verify the server and KDC +- * signatures to assert that the server did not forge the PAC. ++ /* ++ * For constrained delegation in MIT version < 1.18 we aren't provided ++ * with the 2nd ticket server key to verify the PAC. ++ * We can workaround that by fetching the key from the client db entry, ++ * which is the impersonator account in that version. ++ * TODO: use the provided entry in the new 1.18 version. + */ + if (flags & KRB5_KDB_FLAG_CONSTRAINED_DELEGATION) { +- code = krb5_pac_verify(context, +- ipac, +- authtime, +- client_princ, +- server_key, +- krbtgt_key); ++ /* The impersonator must be local. */ ++ if (client == NULL) { ++ code = KRB5KDC_ERR_BADOPTION; ++ goto done; ++ } ++ /* Fetch and decrypt 2nd ticket server's current key. */ ++ code = krb5_dbe_find_enctype(context, client, -1, -1, 0, ++ &impersonator_kd); ++ if (code != 0) { ++ goto done; ++ } ++ code = krb5_dbe_decrypt_key_data(context, NULL, ++ impersonator_kd, ++ &impersonator_key, NULL); ++ if (code != 0) { ++ goto done; ++ } ++ header_server_key = &impersonator_key; + } else { +- code = krb5_pac_verify(context, +- ipac, +- authtime, +- client_princ, +- krbtgt_key, +- NULL); +- } +- if (code != 0) { +- goto done; ++ header_server_key = krbtgt_key; + } + +- /* check and update PAC */ +- code = krb5_pac_parse(context, +- authdata[0]->contents, +- authdata[0]->length, +- pac); ++ code = krb5_pac_verify(context, pac, authtime, client_princ, ++ header_server_key, NULL); + if (code != 0) { + goto done; + } +@@ -272,17 +278,22 @@ static krb5_error_code ks_verify_pac(krb5_context context, + code = mit_samba_reget_pac(mit_ctx, + context, + flags, +- client_princ, + client, + server, + krbtgt, + krbtgt_key, +- pac); ++ &pac); ++ if (code != 0) { ++ goto done; ++ } ++ ++ *out_pac = pac; ++ pac = NULL; + + done: ++ krb5_free_keyblock_contents(context, &impersonator_key); + krb5_free_authdata(context, authdata); +- krb5_pac_free(context, ipac); +- free(logon_data.data); ++ krb5_pac_free(context, pac); + + return code; + } +@@ -324,7 +335,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, + { + #endif + krb5_authdata **authdata = NULL; +- krb5_boolean is_as_req; ++ krb5_const_principal pac_client; + krb5_error_code code; + krb5_pac pac = NULL; + krb5_data pac_data; +@@ -334,24 +345,21 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, + krbtgt_key = krbtgt_key == NULL ? local_krbtgt_key : krbtgt_key; + #endif + +- /* FIXME: We don't support S4U yet */ +- if (flags & KRB5_KDB_FLAGS_S4U) { +- return KRB5_KDB_DBTYPE_NOSUP; +- } +- +- is_as_req = ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) != 0); +- +- if (is_as_req && (flags & KRB5_KDB_FLAG_INCLUDE_PAC)) { +- code = ks_get_pac(context, client, client_key, &pac); +- if (code != 0) { +- goto done; +- } ++ /* In protocol transition, we are currently not provided with the tgt ++ * client name to verify the PAC, we could probably skip the name ++ * verification and just verify the signatures, but since we don't ++ * support cross-realm nor aliases, we can just use server->princ */ ++ if (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION) { ++ pac_client = server->princ; ++ } else { ++ pac_client = client_princ; + } + +- if (!is_as_req) { ++ /* TGS request */ ++ if (!(flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY)) { + code = ks_verify_pac(context, + flags, +- client_princ, ++ pac_client, + client, + server, + krbtgt, +@@ -363,14 +371,28 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, + if (code != 0) { + goto done; + } ++ ++ /* We require PAC as we don't support LSA_TRUST_TYPE_MIT */ ++ if (pac == NULL) { ++ code = KRB5_KDB_DBTYPE_NOSUP; ++ goto done; ++ } + } + +- if (pac == NULL && client != NULL) { ++ if (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION) { ++ krb5_pac_free(context, pac); ++ pac = NULL; ++ } + ++ /* AS request or local realm protocol transition */ ++ if ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) || ++ (client != NULL && (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION))) { + code = ks_get_pac(context, client, client_key, &pac); + if (code != 0) { + goto done; + } ++ /* We require a pac! */ ++ SMB_ASSERT(pac != NULL); + } + + if (pac == NULL) { +@@ -379,7 +401,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, + } + + code = krb5_pac_sign(context, pac, authtime, client_princ, +- server_key, krbtgt_key, &pac_data); ++ server_key, krbtgt_key, &pac_data); + if (code != 0) { + DBG_ERR("krb5_pac_sign failed: %d\n", code); + goto done; +@@ -405,11 +427,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, + KRB5_AUTHDATA_IF_RELEVANT, + authdata, + signed_auth_data); +- if (code != 0) { +- goto done; +- } +- +- code = 0; + + done: + krb5_pac_free(context, pac); +@@ -432,32 +449,13 @@ krb5_error_code kdb_samba_db_check_allowed_to_delegate(krb5_context context, + * server; -> delegating service + * proxy; -> target principal + */ +- krb5_db_entry *delegating_service = discard_const_p(krb5_db_entry, server); +- +- char *target_name = NULL; +- bool is_enterprise; +- krb5_error_code code; + + mit_ctx = ks_get_context(context); + if (mit_ctx == NULL) { + return KRB5_KDB_DBNOTINITED; + } + +- code = krb5_unparse_name(context, proxy, &target_name); +- if (code) { +- goto done; +- } +- +- is_enterprise = (proxy->type == KRB5_NT_ENTERPRISE_PRINCIPAL); +- +- code = mit_samba_check_s4u2proxy(mit_ctx, +- delegating_service, +- target_name, +- is_enterprise); +- +-done: +- free(target_name); +- return code; ++ return mit_samba_check_s4u2proxy(mit_ctx, server, proxy); + } + + +diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c +index 54dcd545ea1..f23327c9613 100644 +--- a/source4/kdc/mit_samba.c ++++ b/source4/kdc/mit_samba.c +@@ -467,7 +467,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx, + krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, + krb5_context context, + int flags, +- krb5_const_principal client_principal, + krb5_db_entry *client, + krb5_db_entry *server, + krb5_db_entry *krbtgt, +@@ -615,7 +614,7 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, + context, + *pac, + server->princ, +- discard_const(client_principal), ++ client->princ, + deleg_blob); + if (!NT_STATUS_IS_OK(nt_status)) { + DEBUG(0, ("Update delegation info failed: %s\n", +@@ -937,41 +936,17 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx, + } + + int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx, +- krb5_db_entry *kentry, +- const char *target_name, +- bool is_nt_enterprise_name) ++ const krb5_db_entry *server, ++ krb5_const_principal target_principal) + { +-#if 1 +- /* +- * This is disabled because mit_samba_update_pac_data() does not handle +- * S4U_DELEGATION_INFO +- */ +- +- return KRB5KDC_ERR_BADOPTION; +-#else +- krb5_principal target_principal; +- int flags = 0; +- int ret; +- +- if (is_nt_enterprise_name) { +- flags = KRB5_PRINCIPAL_PARSE_ENTERPRISE; +- } +- +- ret = krb5_parse_name_flags(ctx->context, target_name, +- flags, &target_principal); +- if (ret) { +- return ret; +- } +- +- ret = samba_kdc_check_s4u2proxy(ctx->context, +- ctx->db_ctx, +- skdc_entry, +- target_principal); +- +- krb5_free_principal(ctx->context, target_principal); +- +- return ret; +-#endif ++ struct samba_kdc_entry *server_skdc_entry = ++ talloc_get_type_abort(server->e_data, ++ struct samba_kdc_entry); ++ ++ return samba_kdc_check_s4u2proxy(ctx->context, ++ ctx->db_ctx, ++ server_skdc_entry, ++ target_principal); + } + + static krb5_error_code mit_samba_change_pwd_error(krb5_context context, +diff --git a/source4/kdc/mit_samba.h b/source4/kdc/mit_samba.h +index ba824557bd5..5aadf206443 100644 +--- a/source4/kdc/mit_samba.h ++++ b/source4/kdc/mit_samba.h +@@ -56,7 +56,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx, + krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, + krb5_context context, + int flags, +- krb5_const_principal client_principal, + krb5_db_entry *client, + krb5_db_entry *server, + krb5_db_entry *krbtgt, +@@ -73,9 +72,8 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx, + DATA_BLOB *e_data); + + int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx, +- krb5_db_entry *kentry, +- const char *target_name, +- bool is_nt_enterprise_name); ++ const krb5_db_entry *server, ++ krb5_const_principal target_principal); + + int mit_samba_kpasswd_change_password(struct mit_samba_context *ctx, + char *pwd, +-- +2.25.4 + +From ff1b225493ede3d43cfad571770dacb73f75ec42 Mon Sep 17 00:00:00 2001 +From: Isaac Boukris +Date: Fri, 27 Sep 2019 18:35:30 +0300 +Subject: [PATCH 5/7] krb5-mit: enable S4U client support for MIT build + +Signed-off-by: Isaac Boukris +Pair-Programmed-With: Andreas Schneider +--- + lib/krb5_wrap/krb5_samba.c | 185 ++++++++++++++++++++++++++ + lib/krb5_wrap/krb5_samba.h | 2 - + source4/auth/kerberos/kerberos_util.c | 11 -- + 4 files changed, 185 insertions(+), 14 deletions(-) + +diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c +index 20ce86c708d..e72ab3c30f7 100644 +--- a/lib/krb5_wrap/krb5_samba.c ++++ b/lib/krb5_wrap/krb5_samba.c +@@ -2568,6 +2568,191 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx, + + return 0; + } ++ ++#else /* MIT */ ++ ++static bool princ_compare_no_dollar(krb5_context ctx, ++ krb5_principal a, ++ krb5_principal b) ++{ ++ bool cmp; ++ krb5_principal mod = NULL; ++ ++ if (a->length == 1 && b->length == 1 && ++ a->data[0].length != 0 && b->data[0].length != 0 && ++ a->data[0].data[a->data[0].length -1] != ++ b->data[0].data[b->data[0].length -1]) { ++ if (a->data[0].data[a->data[0].length -1] == '$') { ++ mod = a; ++ mod->data[0].length--; ++ } else if (b->data[0].data[b->data[0].length -1] == '$') { ++ mod = b; ++ mod->data[0].length--; ++ } ++ } ++ ++ cmp = krb5_principal_compare_flags(ctx, a, b, ++ KRB5_PRINCIPAL_COMPARE_CASEFOLD); ++ ++ if (mod != NULL) { ++ mod->data[0].length++; ++ } ++ ++ return cmp; ++} ++ ++krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx, ++ krb5_ccache store_cc, ++ krb5_principal init_principal, ++ const char *init_password, ++ krb5_principal impersonate_principal, ++ const char *self_service, ++ const char *target_service, ++ krb5_get_init_creds_opt *krb_options, ++ time_t *expire_time, ++ time_t *kdc_time) ++{ ++ krb5_error_code code; ++ krb5_principal self_princ = NULL; ++ krb5_principal target_princ = NULL; ++ krb5_creds *store_creds; ++ krb5_creds *s4u2self_creds = NULL; ++ krb5_creds *s4u2proxy_creds = NULL; ++ krb5_creds init_creds = {0}; ++ krb5_creds mcreds = {0}; ++ krb5_flags options = KRB5_GC_NO_STORE; ++ krb5_ccache tmp_cc; ++ bool s4u2proxy; ++ ++ code = krb5_cc_new_unique(ctx, "MEMORY", NULL, &tmp_cc); ++ if (code != 0) { ++ return code; ++ } ++ ++ code = krb5_get_init_creds_password(ctx, &init_creds, ++ init_principal, ++ init_password, ++ NULL, NULL, ++ 0, ++ NULL, ++ krb_options); ++ if (code != 0) { ++ goto done; ++ } ++ ++ code = krb5_cc_initialize(ctx, tmp_cc, init_creds.client); ++ if (code != 0) { ++ goto done; ++ } ++ ++ code = krb5_cc_store_cred(ctx, tmp_cc, &init_creds); ++ if (code != 0) { ++ goto done; ++ } ++ ++ /* ++ * Check if we also need S4U2Proxy or if S4U2Self is ++ * enough in order to get a ticket for the target. ++ */ ++ if (target_service == NULL) { ++ s4u2proxy = false; ++ } else if (strcmp(target_service, self_service) == 0) { ++ s4u2proxy = false; ++ } else { ++ s4u2proxy = true; ++ } ++ ++ code = krb5_parse_name(ctx, self_service, &self_princ); ++ if (code != 0) { ++ goto done; ++ } ++ ++ /* MIT lacks aliases support in S4U, for S4U2Self we require the tgt ++ * client and the request server to be the same principal name. */ ++ if (!princ_compare_no_dollar(ctx, init_creds.client, self_princ)) { ++ code = KRB5KDC_ERR_PADATA_TYPE_NOSUPP; ++ goto done; ++ } ++ ++ mcreds.client = impersonate_principal; ++ mcreds.server = init_creds.client; ++ ++ code = krb5_get_credentials_for_user(ctx, options, tmp_cc, &mcreds, ++ NULL, &s4u2self_creds); ++ if (code != 0) { ++ goto done; ++ } ++ ++ if (s4u2proxy) { ++ code = krb5_parse_name(ctx, target_service, &target_princ); ++ if (code != 0) { ++ goto done; ++ } ++ ++ mcreds.client = init_creds.client; ++ mcreds.server = target_princ; ++ mcreds.second_ticket = s4u2self_creds->ticket; ++ ++ code = krb5_get_credentials(ctx, options | ++ KRB5_GC_CONSTRAINED_DELEGATION, ++ tmp_cc, &mcreds, &s4u2proxy_creds); ++ if (code != 0) { ++ goto done; ++ } ++ ++ /* Check KDC support of S4U2Proxy extension */ ++ if (!krb5_principal_compare(ctx, s4u2self_creds->client, ++ s4u2proxy_creds->client)) { ++ code = KRB5KDC_ERR_PADATA_TYPE_NOSUPP; ++ goto done; ++ } ++ ++ store_creds = s4u2proxy_creds; ++ } else { ++ store_creds = s4u2self_creds;; ++ ++ /* We need to save the ticket with the requested server name ++ * or the caller won't be able to find it in cache. */ ++ if (!krb5_principal_compare(ctx, self_princ, ++ store_creds->server)) { ++ krb5_free_principal(ctx, store_creds->server); ++ store_creds->server = NULL; ++ code = krb5_copy_principal(ctx, self_princ, ++ &store_creds->server); ++ if (code != 0) { ++ goto done; ++ } ++ } ++ } ++ ++ code = krb5_cc_initialize(ctx, store_cc, store_creds->client); ++ if (code != 0) { ++ goto done; ++ } ++ ++ code = krb5_cc_store_cred(ctx, store_cc, store_creds); ++ if (code != 0) { ++ goto done; ++ } ++ ++ if (expire_time) { ++ *expire_time = (time_t) store_creds->times.endtime; ++ } ++ ++ if (kdc_time) { ++ *kdc_time = (time_t) store_creds->times.starttime; ++ } ++ ++done: ++ krb5_cc_destroy(ctx, tmp_cc); ++ krb5_free_cred_contents(ctx, &init_creds); ++ krb5_free_creds(ctx, s4u2self_creds); ++ krb5_free_creds(ctx, s4u2proxy_creds); ++ krb5_free_principal(ctx, self_princ); ++ krb5_free_principal(ctx, target_princ); ++ ++ return code; ++} + #endif + + #if !defined(HAVE_KRB5_MAKE_PRINCIPAL) && defined(HAVE_KRB5_BUILD_PRINCIPAL_ALLOC_VA) +diff --git a/lib/krb5_wrap/krb5_samba.h b/lib/krb5_wrap/krb5_samba.h +index ca9a893e4f7..3264ce5eb3b 100644 +--- a/lib/krb5_wrap/krb5_samba.h ++++ b/lib/krb5_wrap/krb5_samba.h +@@ -252,7 +252,6 @@ krb5_error_code smb_krb5_kinit_password_ccache(krb5_context ctx, + krb5_get_init_creds_opt *krb_options, + time_t *expire_time, + time_t *kdc_time); +-#ifdef SAMBA4_USES_HEIMDAL + krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx, + krb5_ccache store_cc, + krb5_principal init_principal, +@@ -263,7 +262,6 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx, + krb5_get_init_creds_opt *krb_options, + time_t *expire_time, + time_t *kdc_time); +-#endif + + #if defined(HAVE_KRB5_MAKE_PRINCIPAL) + #define smb_krb5_make_principal krb5_make_principal +diff --git a/source4/auth/kerberos/kerberos_util.c b/source4/auth/kerberos/kerberos_util.c +index 544d9d853cc..c14d8c72d8c 100644 +--- a/source4/auth/kerberos/kerberos_util.c ++++ b/source4/auth/kerberos/kerberos_util.c +@@ -234,9 +234,7 @@ done: + { + krb5_error_code ret; + const char *password; +-#ifdef SAMBA4_USES_HEIMDAL + const char *self_service; +-#endif + const char *target_service; + time_t kdc_time = 0; + krb5_principal princ; +@@ -268,9 +266,7 @@ done: + return ret; + } + +-#ifdef SAMBA4_USES_HEIMDAL + self_service = cli_credentials_get_self_service(credentials); +-#endif + target_service = cli_credentials_get_target_service(credentials); + + password = cli_credentials_get_password(credentials); +@@ -331,7 +327,6 @@ done: + #endif + if (password) { + if (impersonate_principal) { +-#ifdef SAMBA4_USES_HEIMDAL + ret = smb_krb5_kinit_s4u2_ccache(smb_krb5_context->krb5_context, + ccache, + princ, +@@ -342,12 +337,6 @@ done: + krb_options, + NULL, + &kdc_time); +-#else +- talloc_free(mem_ctx); +- (*error_string) = "INTERNAL error: s4u2 ops " +- "are not supported with MIT build yet"; +- return EINVAL; +-#endif + } else { + ret = smb_krb5_kinit_password_ccache(smb_krb5_context->krb5_context, + ccache, +-- +2.25.4 + + + +From cf1b9bdc09180d68e2b30258839d2f78b7af9c62 Mon Sep 17 00:00:00 2001 +From: Isaac Boukris +Date: Sat, 19 Sep 2020 14:16:20 +0200 +Subject: [PATCH 7/7] wip: for canonicalization with new MIT kdc code + +--- + source4/heimdal/lib/hdb/hdb.h | 1 + + source4/kdc/db-glue.c | 8 ++++++-- + source4/kdc/mit_samba.c | 3 +++ + source4/kdc/sdb.h | 1 + + 4 files changed, 11 insertions(+), 2 deletions(-) + +diff --git a/source4/heimdal/lib/hdb/hdb.h b/source4/heimdal/lib/hdb/hdb.h +index 6a09ecb6fe1..bc5211fef35 100644 +--- a/source4/heimdal/lib/hdb/hdb.h ++++ b/source4/heimdal/lib/hdb/hdb.h +@@ -63,6 +63,7 @@ enum hdb_lockop{ HDB_RLOCK, HDB_WLOCK }; + #define HDB_F_ALL_KVNOS 2048 /* we want all the keys, live or not */ + #define HDB_F_FOR_AS_REQ 4096 /* fetch is for a AS REQ */ + #define HDB_F_FOR_TGS_REQ 8192 /* fetch is for a TGS REQ */ ++#define HDB_F_FORCE_CANON 16384 /* force canonicalition */ + + /* hdb_capability_flags */ + #define HDB_CAP_F_HANDLE_ENTERPRISE_PRINCIPAL 1 +diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c +index a560a1cd84b..c27b6a8ef4c 100644 +--- a/source4/kdc/db-glue.c ++++ b/source4/kdc/db-glue.c +@@ -916,17 +916,21 @@ static krb5_error_code samba_kdc_message2entry(krb5_context context, + } + } + +- } else if (ent_type == SAMBA_KDC_ENT_TYPE_ANY && principal == NULL) { ++ } else if (ent_type == SAMBA_KDC_ENT_TYPE_ANY && principal == NULL) { // was this supposed to be || ? + ret = smb_krb5_make_principal(context, &entry_ex->entry.principal, lpcfg_realm(lp_ctx), samAccountName, NULL); + if (ret) { + krb5_clear_error_message(context); + goto out; + } +- } else if ((flags & SDB_F_CANON) && (flags & SDB_F_FOR_AS_REQ)) { ++ } else if (((flags & SDB_F_CANON) && (flags & SDB_F_FOR_AS_REQ)) || (flags & SDB_F_FORCE_CANON)){ + /* + * SDB_F_CANON maps from the canonicalize flag in the + * packet, and has a different meaning between AS-REQ + * and TGS-REQ. We only change the principal in the AS-REQ case ++ * ++ * The SDB_F_FORCE_CANON if for the new MIT kdc code that wants ++ * the canonical name in all lookups, and takes care to canonicalize ++ * only when appropriate. + */ + ret = smb_krb5_make_principal(context, &entry_ex->entry.principal, lpcfg_realm(lp_ctx), samAccountName, NULL); + if (ret) { +diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c +index f23327c9613..4084e893cc2 100644 +--- a/source4/kdc/mit_samba.c ++++ b/source4/kdc/mit_samba.c +@@ -198,6 +198,9 @@ int mit_samba_get_principal(struct mit_samba_context *ctx, + if (kflags & KRB5_KDB_FLAG_CANONICALIZE) { + sflags |= SDB_F_CANON; + } ++#if KRB5_KDB_API_VERSION >= 10 ++ sflags |= SDB_F_FORCE_CANON; ++#endif + if (kflags & (KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY | + KRB5_KDB_FLAG_INCLUDE_PAC)) { + /* +diff --git a/source4/kdc/sdb.h b/source4/kdc/sdb.h +index c929acccce6..a9115ec23d7 100644 +--- a/source4/kdc/sdb.h ++++ b/source4/kdc/sdb.h +@@ -116,6 +116,7 @@ struct sdb_entry_ex { + #define SDB_F_KVNO_SPECIFIED 128 /* we want a particular KVNO */ + #define SDB_F_FOR_AS_REQ 4096 /* fetch is for a AS REQ */ + #define SDB_F_FOR_TGS_REQ 8192 /* fetch is for a TGS REQ */ ++#define SDB_F_FORCE_CANON 16384 /* force canonicalition */ + + void sdb_free_entry(struct sdb_entry_ex *e); + void free_sdb_entry(struct sdb_entry *s); +-- +2.25.4 + diff --git a/samba.spec b/samba.spec index 7948d6b..dac3754 100644 --- a/samba.spec +++ b/samba.spec @@ -8,7 +8,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%define main_release 11 +%define main_release 12 %define samba_version 4.13.0 %define talloc_version 2.3.1 @@ -130,6 +130,7 @@ Source13: pam_winbind.conf Source14: samba.pamd Source201: README.downgrade +Patch1: samba-s4u.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -3619,6 +3620,10 @@ fi %endif %changelog +* Thu Oct 22 2020 Alexander Bokovoy - 4.13.0-12 +- Add preliminary support for S4U operations in Samba AD DC + resolves: #1836630 - Samba DC: Remote Desktop cannot access files + * Tue Sep 22 2020 Guenther Deschner - 4.13.0-11 - Update to Samba 4.13.0 From 1e29c417eb5e3dbfad31e7e7ff121367d4397a3d Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Thu, 22 Oct 2020 10:12:06 +0300 Subject: [PATCH 038/425] Fix lookup_unix_user_name to support realm-qualified lookups Fixes lookups from Windows clients when using Global Catalog searches. Required for upcoming FreeIPA Global Catalog support. --- ...user_name-allow-lookup-for-own-realm.patch | 210 ++++++++++++++++++ samba.spec | 3 + 2 files changed, 213 insertions(+) create mode 100644 samba-gc-lookup_unix_user_name-allow-lookup-for-own-realm.patch diff --git a/samba-gc-lookup_unix_user_name-allow-lookup-for-own-realm.patch b/samba-gc-lookup_unix_user_name-allow-lookup-for-own-realm.patch new file mode 100644 index 0000000..e0ed8ae --- /dev/null +++ b/samba-gc-lookup_unix_user_name-allow-lookup-for-own-realm.patch @@ -0,0 +1,210 @@ +From 81d6949acdad70ecfb130d3286eeab1b3a51937f Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Wed, 7 Oct 2020 19:25:24 +0300 +Subject: [PATCH 1/2] cli_credentials_parse_string: fix parsing of principals + +When parsing a principal-like name, user name was left with full +principal instead of taking only the left part before '@' sign. + +>>> from samba import credentials +>>> t = credentials.Credentials() +>>> t.parse_string('admin@realm.test', credentials.SPECIFIED) +>>> t.get_username() +'admin@realm.test' + +The issue is that cli_credentials_set_username() does a talloc_strdup() +of the argument, so we need to change order of assignment to allow +talloc_strdup() to copy the right part of the string. + +Signed-off-by: Alexander Bokovoy +--- + auth/credentials/credentials.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c +index 77c35dd104b..06ac79058f9 100644 +--- a/auth/credentials/credentials.c ++++ b/auth/credentials/credentials.c +@@ -840,11 +840,10 @@ _PUBLIC_ void cli_credentials_parse_string(struct cli_credentials *credentials, + * in order to undo the effect of + * cli_credentials_guess(). + */ +- cli_credentials_set_username(credentials, uname, obtained); +- cli_credentials_set_domain(credentials, "", obtained); +- + cli_credentials_set_principal(credentials, uname, obtained); + *p = 0; ++ cli_credentials_set_username(credentials, uname, obtained); ++ cli_credentials_set_domain(credentials, "", obtained); + cli_credentials_set_realm(credentials, p+1, obtained); + return; + } else if ((p = strchr_m(uname,'\\')) +-- +2.28.0 + + +From fa38bebb993011428612d51819530218d8358f5e Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Mon, 13 Jan 2020 16:04:20 +0200 +Subject: [PATCH 2/2] lookup_name: allow lookup for own realm + +When using security tab in Windows Explorer, a lookup over a trusted +forest might come as realm\name instead of NetBIOS domain name: + +-------------------------------------------------------------------- +[2020/01/13 11:12:39.859134, 1, pid=33253, effective(1732401004, 1732401004), real(1732401004, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:471(ndr_print_function_debug) + lsa_LookupNames3: struct lsa_LookupNames3 + in: struct lsa_LookupNames3 + handle : * + handle: struct policy_handle + handle_type : 0x00000000 (0) + uuid : 0000000e-0000-0000-1c5e-a750e5810000 + num_names : 0x00000001 (1) + names: ARRAY(1) + names: struct lsa_String + length : 0x001e (30) + size : 0x0020 (32) + string : * + string : 'ipa.test\admins' + sids : * + sids: struct lsa_TransSidArray3 + count : 0x00000000 (0) + sids : NULL + level : LSA_LOOKUP_NAMES_UPLEVEL_TRUSTS_ONLY2 (6) + count : * + count : 0x00000000 (0) + lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) + client_revision : LSA_CLIENT_REVISION_2 (2) +-------------------------------------------------------------------- + +Allow this lookup using realm to be done against primary domain. + +Refactor user name parsing code to reuse cli_credentials_* API to be +consistent with other places. cli_credentials_parse_string() handles +both domain and realm-based user name variants. + +Signed-off-by: Alexander Bokovoy +--- + source3/passdb/lookup_sid.c | 75 ++++++++++++++++++++++++++----------- + 1 file changed, 53 insertions(+), 22 deletions(-) + +diff --git a/source3/passdb/lookup_sid.c b/source3/passdb/lookup_sid.c +index 82c47b3145b..39d599fed27 100644 +--- a/source3/passdb/lookup_sid.c ++++ b/source3/passdb/lookup_sid.c +@@ -29,6 +29,7 @@ + #include "../libcli/security/security.h" + #include "lib/winbind_util.h" + #include "../librpc/gen_ndr/idmap.h" ++#include "auth/credentials/credentials.h" + + static bool lookup_unix_user_name(const char *name, struct dom_sid *sid) + { +@@ -78,52 +79,82 @@ bool lookup_name(TALLOC_CTX *mem_ctx, + const char **ret_domain, const char **ret_name, + struct dom_sid *ret_sid, enum lsa_SidType *ret_type) + { +- char *p; + const char *tmp; + const char *domain = NULL; + const char *name = NULL; ++ const char *realm = NULL; + uint32_t rid; + struct dom_sid sid; + enum lsa_SidType type; + TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx); ++ struct cli_credentials *creds = NULL; + + if (tmp_ctx == NULL) { + DEBUG(0, ("talloc_new failed\n")); + return false; + } + +- p = strchr_m(full_name, '\\'); +- +- if (p != NULL) { +- domain = talloc_strndup(tmp_ctx, full_name, +- PTR_DIFF(p, full_name)); +- name = talloc_strdup(tmp_ctx, p+1); +- } else { +- domain = talloc_strdup(tmp_ctx, ""); +- name = talloc_strdup(tmp_ctx, full_name); ++ creds = cli_credentials_init(tmp_ctx); ++ if (creds == NULL) { ++ DEBUG(0, ("cli_credentials_init failed\n")); ++ return false; + } + +- if ((domain == NULL) || (name == NULL)) { +- DEBUG(0, ("talloc failed\n")); +- TALLOC_FREE(tmp_ctx); ++ cli_credentials_parse_string(creds, full_name, CRED_SPECIFIED); ++ name = cli_credentials_get_username(creds); ++ domain = cli_credentials_get_domain(creds); ++ realm = cli_credentials_get_realm(creds); ++ ++ /* At this point we have: ++ * - name -- normal name or empty string ++ * - domain -- either NULL or domain name ++ * - realm -- either NULL or realm name ++ * ++ * domain and realm are exclusive to each other ++ * the code below in lookup_name assumes domain ++ * to be at least empty string, not NULL ++ */ ++ ++ if ((name == NULL) || (name[0] == '\0')) { ++ DEBUG(0, ("lookup_name with empty name, exit\n")); + return false; + } + ++ if ((domain == NULL) && (realm == NULL)) { ++ domain = talloc_strdup(creds, ""); ++ } ++ + DEBUG(10,("lookup_name: %s => domain=[%s], name=[%s]\n", + full_name, domain, name)); + DEBUG(10, ("lookup_name: flags = 0x0%x\n", flags)); + +- if (((flags & LOOKUP_NAME_DOMAIN) || (flags == 0)) && +- strequal(domain, get_global_sam_name())) +- { ++ /* Windows clients may send a LookupNames request with both NetBIOS ++ * domain name- and realm-qualified user names. Thus, we need to check ++ * both against both of the SAM domain name and realm, if set. Since ++ * domain name and realm in the request are exclusive, test the one ++ * that is specified. cli_credentials_parse_string() will either set ++ * realm or wouldn't so we can use it to detect if realm was specified. ++ */ ++ if ((flags & LOOKUP_NAME_DOMAIN) || (flags == 0)) { ++ const char *domain_name = realm ? realm : domain; ++ bool check_global_sam = false; ++ ++ if (domain_name[0] != '\0') { ++ check_global_sam = strequal(domain_name, get_global_sam_name()); ++ if (!check_global_sam && lp_realm() != NULL) { ++ check_global_sam = strequal(domain_name, lp_realm()); ++ } ++ } + +- /* It's our own domain, lookup the name in passdb */ +- if (lookup_global_sam_name(name, flags, &rid, &type)) { +- sid_compose(&sid, get_global_sam_sid(), rid); +- goto ok; ++ if (check_global_sam) { ++ /* It's our own domain, lookup the name in passdb */ ++ if (lookup_global_sam_name(name, flags, &rid, &type)) { ++ sid_compose(&sid, get_global_sam_sid(), rid); ++ goto ok; ++ } ++ TALLOC_FREE(tmp_ctx); ++ return false; + } +- TALLOC_FREE(tmp_ctx); +- return false; + } + + if ((flags & LOOKUP_NAME_BUILTIN) && +-- +2.28.0 + diff --git a/samba.spec b/samba.spec index dac3754..16edcd2 100644 --- a/samba.spec +++ b/samba.spec @@ -131,6 +131,7 @@ Source14: samba.pamd Source201: README.downgrade Patch1: samba-s4u.patch +Patch2: samba-gc-lookup_unix_user_name-allow-lookup-for-own-realm.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -3623,6 +3624,8 @@ fi * Thu Oct 22 2020 Alexander Bokovoy - 4.13.0-12 - Add preliminary support for S4U operations in Samba AD DC resolves: #1836630 - Samba DC: Remote Desktop cannot access files +- Fix lookup_unix_user_name to allow lookup of realm-qualified users and groups + required for upcoming FreeIPA Global Catalog support * Tue Sep 22 2020 Guenther Deschner - 4.13.0-11 - Update to Samba 4.13.0 From 92693f66e9562c3d1e5a037f1a695393a63fc893 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Sun, 25 Oct 2020 09:54:45 +0200 Subject: [PATCH 039/425] Fix Samba AD DC operations on F33 or later - Report 'samba' daemon status back to systemd - Support dnspython 2.0.0 or later in samba_dnsupdate --- samba-dnspython-2.0.0-v4.13.patch | 143 ++++++++++++++++++++++++++++++ samba-systemd-notification.patch | 118 ++++++++++++++++++++++++ samba.spec | 10 ++- 3 files changed, 270 insertions(+), 1 deletion(-) create mode 100644 samba-dnspython-2.0.0-v4.13.patch create mode 100644 samba-systemd-notification.patch diff --git a/samba-dnspython-2.0.0-v4.13.patch b/samba-dnspython-2.0.0-v4.13.patch new file mode 100644 index 0000000..88aead2 --- /dev/null +++ b/samba-dnspython-2.0.0-v4.13.patch @@ -0,0 +1,143 @@ +From 12b51be8633689763080f2eb1e0b13487e3e71e1 Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Sat, 24 Oct 2020 12:17:44 +0300 +Subject: [PATCH] DNS Resolver: support both dnspython before and after 2.0.0 + +`dnspython` 2.0.0 has many changes and several deprecations like: + +``` +> dns.resolver.resolve() has been added, allowing control of whether +search lists are used. dns.resolver.query() is retained for backwards +compatibility, but deprecated. The default for search list behavior can +be set at in the resolver object with the use_search_by_default +parameter. The default is False. + +> dns.resolver.resolve_address() has been added, allowing easy +address-to-name lookups. +``` + +The new class `DNSResolver`: +- provides the compatibility layer +- defaults the previous behavior (the search list configured in the + system's resolver configuration is used for relative names) +- defaults lifetime to 15sec (determines the number of seconds + to spend trying to get an answer to the question) + +The compatibility shim was developed by Stanislav Levin for FreeIPA and +adopted for Samba by Alexander Bokovoy. + +Signed-off-by: Stanislav Levin +Signed-off-by: Alexander Bokovoy +--- + python/samba/dnsresolver.py | 68 +++++++++++++++++++++++++++ + source4/scripting/bin/samba_dnsupdate | 5 +- + 2 files changed, 71 insertions(+), 2 deletions(-) + create mode 100644 python/samba/dnsresolver.py + +diff --git a/python/samba/dnsresolver.py b/python/samba/dnsresolver.py +new file mode 100644 +index 00000000000..a627555a855 +--- /dev/null ++++ b/python/samba/dnsresolver.py +@@ -0,0 +1,68 @@ ++# Samba wrapper for DNS resolvers ++# ++# Copyright (C) Stanislav Levin ++# Copyright (C) Alexander Bokovoy ++# ++# This program is free software; you can redistribute it and/or modify ++# it under the terms of the GNU General Public License as published by ++# the Free Software Foundation; either version 3 of the License, or ++# (at your option) any later version. ++# ++# This program is distributed in the hope that it will be useful, ++# but WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++# GNU General Public License for more details. ++# ++# You should have received a copy of the GNU General Public License ++# along with this program. If not, see . ++# ++ ++import dns.resolver ++import dns.rdatatype ++import dns.reversename ++ ++class DNSResolver(dns.resolver.Resolver): ++ """DNS stub resolver compatible with both dnspython < 2.0.0 ++ and dnspython >= 2.0.0. ++ ++ Set `use_search_by_default` attribute to `True`, which ++ determines the default for whether the search list configured ++ in the system's resolver configuration is used for relative ++ names, and whether the resolver's domain may be added to relative ++ names. ++ ++ Increase the default lifetime which determines the number of seconds ++ to spend trying to get an answer to the question. dnspython 2.0.0 ++ changes this to 5sec, while the previous one was 30sec. ++ """ ++ def __init__(self, *args, **kwargs): ++ super().__init__(*args, **kwargs) ++ self.reset_defaults() ++ self.resolve = getattr(super(), "resolve", self.query) ++ self.resolve_address = getattr( ++ super(), ++ "resolve_address", ++ self._resolve_address ++ ) ++ ++ def reset_defaults(self): ++ self.use_search_by_default = True ++ # the default is 5sec ++ self.lifetime = 15 ++ ++ def reset(self): ++ super().reset() ++ self.reset_defaults() ++ ++ def _resolve_address(self, ip_address, *args, **kwargs): ++ """Query nameservers for PTR records. ++ ++ :param ip_address: IPv4 or IPv6 address ++ :type ip_address: str ++ """ ++ return self.resolve( ++ dns.reversename.from_address(ip_address), ++ rdtype=dns.rdatatype.PTR, ++ *args, ++ **kwargs, ++ ) +diff --git a/source4/scripting/bin/samba_dnsupdate b/source4/scripting/bin/samba_dnsupdate +index 44eb1cadd27..fe04ce71338 100755 +--- a/source4/scripting/bin/samba_dnsupdate ++++ b/source4/scripting/bin/samba_dnsupdate +@@ -53,6 +53,7 @@ from samba.compat import get_string + from samba.compat import text_type + import ldb + ++from samba.dnsresolver import DNSResolver + import dns.resolver + import dns.exception + +@@ -259,7 +260,7 @@ def hostname_match(h1, h2): + + def get_resolver(d=None): + resolv_conf = os.getenv('RESOLV_CONF', default='/etc/resolv.conf') +- resolver = dns.resolver.Resolver(filename=resolv_conf, configure=True) ++ resolver = DNSResolver(filename=resolv_conf, configure=True) + + if d is not None and d.nameservers != []: + resolver.nameservers = d.nameservers +@@ -271,7 +272,7 @@ def check_one_dns_name(name, name_type, d=None): + if d and not d.nameservers: + d.nameservers = resolver.nameservers + # dns.resolver.Answer +- return resolver.query(name, name_type) ++ return resolver.resolve(name, name_type) + + def check_dns_name(d): + """check that a DNS entry exists.""" +-- +2.28.0 + diff --git a/samba-systemd-notification.patch b/samba-systemd-notification.patch new file mode 100644 index 0000000..1011460 --- /dev/null +++ b/samba-systemd-notification.patch @@ -0,0 +1,118 @@ +From 9dd1a4809b1b6d65bfb2258b443b0fe36e0a32f7 Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Sat, 24 Oct 2020 16:52:43 +0300 +Subject: [PATCH] daemons: report status to systemd even when running in + foreground + +When systemd launches samba services, the configuration we have in +systemd service files expects that the main process (/usr/sbin/*) +would use sd_notify() to report back its status. However, we only use +sd_notify() when running become_daemon(). + +As a result, samba/smbd/winbindd/nmbd processes never report back its +status and the status updates from other childs (smbd, winbindd, etc) +are not accepted as we now have implied NotifyAccess=main since commit +d1740fb3d5a72cb49e30b330bb0b01e7ef3e09cc + +This leads to a timeout and killing samba process by systemd. Situation +is reproducible in Fedora 33, for example. + +Make sure that we have required status updates for all daemons in case +we aren't runnning in interactive mode. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14552 + +Signed-off-by: Alexander Bokovoy +--- + source3/nmbd/nmbd.c | 4 +++- + source3/smbd/server.c | 4 +++- + source3/winbindd/winbindd.c | 5 ++++- + source4/smbd/server.c | 4 +++- + 4 files changed, 13 insertions(+), 4 deletions(-) + +diff --git a/source3/nmbd/nmbd.c b/source3/nmbd/nmbd.c +index 0b881d13f7b..f6aeba1f714 100644 +--- a/source3/nmbd/nmbd.c ++++ b/source3/nmbd/nmbd.c +@@ -1009,6 +1009,8 @@ static bool open_sockets(bool isdaemon, int port) + if (is_daemon && !opt_interactive) { + DEBUG(3, ("Becoming a daemon.\n")); + become_daemon(Fork, no_process_group, log_stdout); ++ } else if (!opt_interactive) { ++ daemon_status("nmbd", "Starting process..."); + } + + #ifdef HAVE_SETPGID +@@ -1135,7 +1137,7 @@ static bool open_sockets(bool isdaemon, int port) + exit_daemon( "NMBD failed to setup packet server.", EACCES); + } + +- if (is_daemon && !opt_interactive) { ++ if (!opt_interactive) { + daemon_ready("nmbd"); + } + +diff --git a/source3/smbd/server.c b/source3/smbd/server.c +index 153dd3c9323..3d9db5d8407 100644 +--- a/source3/smbd/server.c ++++ b/source3/smbd/server.c +@@ -1893,6 +1893,8 @@ extern void build_options(bool screen); + if (is_daemon && !interactive) { + DEBUG(3, ("Becoming a daemon.\n")); + become_daemon(Fork, no_process_group, log_stdout); ++ } else { ++ daemon_status("smbd", "Starting process ..."); + } + + #ifdef HAVE_SETPGID +@@ -2100,7 +2102,7 @@ extern void build_options(bool screen); + exit_daemon("Samba cannot setup ep pipe", EACCES); + } + +- if (is_daemon && !interactive) { ++ if (!interactive) { + daemon_ready("smbd"); + } + +diff --git a/source3/winbindd/winbindd.c b/source3/winbindd/winbindd.c +index 4397a1bc0d1..1e08237905a 100644 +--- a/source3/winbindd/winbindd.c ++++ b/source3/winbindd/winbindd.c +@@ -1880,8 +1880,11 @@ int main(int argc, const char **argv) + BlockSignals(False, SIGHUP); + BlockSignals(False, SIGCHLD); + +- if (!interactive) ++ if (!interactive) { + become_daemon(Fork, no_process_group, log_stdout); ++ } else { ++ daemon_status("winbindd", "Starting process ..."); ++ } + + pidfile_create(lp_pid_directory(), "winbindd"); + +diff --git a/source4/smbd/server.c b/source4/smbd/server.c +index 95acb99b86c..ee2e7508bb3 100644 +--- a/source4/smbd/server.c ++++ b/source4/smbd/server.c +@@ -648,6 +648,8 @@ static int binary_smbd_main(const char *binary_name, + if (opt_daemon) { + DBG_NOTICE("Becoming a daemon.\n"); + become_daemon(opt_fork, opt_no_process_group, false); ++ } else if (!opt_interactive) { ++ daemon_status("samba", "Starting process..."); + } + + /* Create the memory context to hang everything off. */ +@@ -931,7 +933,7 @@ static int binary_smbd_main(const char *binary_name, + } + } + +- if (opt_daemon) { ++ if (!opt_interactive) { + daemon_ready("samba"); + } + +-- +2.28.0 + diff --git a/samba.spec b/samba.spec index 16edcd2..2a8bab3 100644 --- a/samba.spec +++ b/samba.spec @@ -8,7 +8,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%define main_release 12 +%define main_release 13 %define samba_version 4.13.0 %define talloc_version 2.3.1 @@ -132,6 +132,8 @@ Source14: samba.pamd Source201: README.downgrade Patch1: samba-s4u.patch Patch2: samba-gc-lookup_unix_user_name-allow-lookup-for-own-realm.patch +Patch3: samba-dnspython-2.0.0-v4.13.patch +Patch4: samba-systemd-notification.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -1984,6 +1986,7 @@ fi %{python3_sitearch}/samba/__pycache__/compat.*.pyc %{python3_sitearch}/samba/__pycache__/dbchecker.*.pyc %{python3_sitearch}/samba/__pycache__/descriptor.*.pyc +%{python3_sitearch}/samba/__pycache__/dnsresolver.*.pyc %{python3_sitearch}/samba/__pycache__/drs_utils.*.pyc %{python3_sitearch}/samba/__pycache__/getopt.*.pyc %{python3_sitearch}/samba/__pycache__/gpclass.*.pyc @@ -2061,6 +2064,7 @@ fi %{python3_sitearch}/samba/dcerpc/wkssvc.*.so %{python3_sitearch}/samba/dcerpc/xattr.*.so %{python3_sitearch}/samba/descriptor.py +%{python3_sitearch}/samba/dnsresolver.py %{python3_sitearch}/samba/drs_utils.py %{python3_sitearch}/samba/gensec.*.so %{python3_sitearch}/samba/getopt.py @@ -3621,6 +3625,10 @@ fi %endif %changelog +* Sun Oct 25 2020 Alexander Bokovoy - 4.13.0-13 +- Report 'samba' daemon status back to systemd +- Support dnspython 2.0.0 or later in samba_dnsupdate + * Thu Oct 22 2020 Alexander Bokovoy - 4.13.0-12 - Add preliminary support for S4U operations in Samba AD DC resolves: #1836630 - Samba DC: Remote Desktop cannot access files From a31119d9e4fbcf50c3b46cc777df66e18270bc70 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 19 Oct 2020 17:11:25 +0200 Subject: [PATCH 040/425] Always build with profiling support --- samba.spec | 5 ----- 1 file changed, 5 deletions(-) diff --git a/samba.spec b/samba.spec index 2a8bab3..dc9b9b1 100644 --- a/samba.spec +++ b/samba.spec @@ -37,8 +37,6 @@ %global with_libsmbclient 1 %global with_libwbclient 1 -%global with_profiling 1 - %global with_vfs_cephfs 0 %if 0%{?fedora} %ifarch aarch64 ppc64le s390x x86_64 @@ -896,9 +894,6 @@ export LDFLAGS="%{__global_ldflags} -fuse-ld=gold" %if %with_clustering_support --with-cluster-support \ %endif -%if %with_profiling - --with-profiling-data \ -%endif %if %{with testsuite} --enable-selftest \ %endif From 0ac733db9b76aede0b283d6c11d62b915f5718fd Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 19 Oct 2020 15:53:32 +0200 Subject: [PATCH 041/425] Use %bcond_without for libsmbclient --- samba.spec | 33 ++++++++++++++++++--------------- 1 file changed, 18 insertions(+), 15 deletions(-) diff --git a/samba.spec b/samba.spec index dc9b9b1..996f5de 100644 --- a/samba.spec +++ b/samba.spec @@ -3,9 +3,13 @@ # The testsuite is disabled by default. Set --with testsuite or bcond_without # to run the Samba torture testsuite. %bcond_with testsuite + # ctdb is enabled by default, you can disable it with: --without clustering %bcond_without clustering +# Build a libsmbclient package by default +%bcond_without libsmbclient + %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %define main_release 13 @@ -34,7 +38,6 @@ # https://src.fedoraproject.org/rpms/redhat-rpm-config/blob/master/f/buildflags.md %undefine _strict_symbol_defs_build -%global with_libsmbclient 1 %global with_libwbclient 1 %global with_vfs_cephfs 0 @@ -290,7 +293,7 @@ Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} -%if %with_libsmbclient +%if %{with libsmbclient} Requires: libsmbclient = %{samba_depver} %endif %if %with_libwbclient @@ -515,7 +518,7 @@ The %{name}-libs package contains the libraries needed by programs that link against the SMB, RPC and other protocols provided by the Samba suite. ### LIBSMBCLIENT -%if %with_libsmbclient +%if %{with libsmbclient} %package -n libsmbclient Summary: The SMB client library Requires(pre): %{name}-common = %{samba_depver} @@ -537,7 +540,7 @@ Requires: libsmbclient = %{samba_depver} The libsmbclient-devel package contains the header files and libraries needed to develop programs that link against the SMB client library in the Samba suite. -#endif with_libsmbclient +#endif {with libsmbclient} %endif ### LIBWBCLIENT @@ -575,7 +578,7 @@ Requires: python3-tevent Requires: python3-tdb Requires: python3-ldb Requires: python3-dns -%if %with_libsmbclient +%if %{with libsmbclient} Requires: libsmbclient = %{samba_depver} %endif %if %with_libwbclient @@ -637,7 +640,7 @@ Requires: %{name}-test-libs = %{samba_depver} Requires: %{name}-dc-libs = %{samba_depver} %endif Requires: %{name}-libs = %{samba_depver} -%if %with_libsmbclient +%if %{with libsmbclient} Requires: libsmbclient = %{samba_depver} %endif %if %with_libwbclient @@ -848,7 +851,7 @@ xzcat %{SOURCE0} | gpgv2 --quiet --keyring %{SOURCE2} %{SOURCE1} - %global _libsmbclient %nil %global _libwbclient %nil -%if ! %with_libsmbclient +%if %{without libsmbclient} %global _libsmbclient smbclient, %endif @@ -880,7 +883,7 @@ export LDFLAGS="%{__global_ldflags} -fuse-ld=gold" --with-pie \ --with-relro \ --without-fam \ -%if (! %with_libsmbclient) || (! %with_libwbclient) +%if (%{without libsmbclient}) || (! %with_libwbclient) --private-libraries=%{_samba_private_libraries} \ %endif --with-system-mitkrb5 \ @@ -1170,7 +1173,7 @@ fi %ldconfig_scriptlets libs -%if %with_libsmbclient +%if %{with libsmbclient} %ldconfig_scriptlets -n libsmbclient %endif @@ -1555,10 +1558,10 @@ fi #endif ! with_libwbclient %endif -%if ! %with_libsmbclient +%if %{without libsmbclient} %{_libdir}/samba/libsmbclient.so.* %{_mandir}/man7/libsmbclient.7* -#endif ! with_libsmbclient +#endif without libsmbclient %endif ### COMMON @@ -1851,9 +1854,9 @@ fi %{_libdir}/pkgconfig/dcerpc_server.pc %endif -%if ! %with_libsmbclient +%if %{without libsmbclient} %{_includedir}/samba-4.0/libsmbclient.h -#endif ! with_libsmbclient +#endif without libsmbclient %endif %if ! %with_libwbclient @@ -1896,7 +1899,7 @@ fi %{_libdir}/samba/libxattr-tdb-samba4.so ### LIBSMBCLIENT -%if %with_libsmbclient +%if %{with libsmbclient} %files -n libsmbclient %{_libdir}/libsmbclient.so.* @@ -1906,7 +1909,7 @@ fi %{_libdir}/libsmbclient.so %{_libdir}/pkgconfig/smbclient.pc %{_mandir}/man7/libsmbclient.7* -#endif with_libsmbclient +#endif {with libsmbclient} %endif ### LIBWBCLIENT From 89d751d1bfc73ad19b5e13f52d5c36270440950c Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 19 Oct 2020 15:54:28 +0200 Subject: [PATCH 042/425] Use %bcond_without for libwbclient --- samba.spec | 57 +++++++++++++++++++++++++++--------------------------- 1 file changed, 29 insertions(+), 28 deletions(-) diff --git a/samba.spec b/samba.spec index 996f5de..280eb0f 100644 --- a/samba.spec +++ b/samba.spec @@ -10,6 +10,9 @@ # Build a libsmbclient package by default %bcond_without libsmbclient +# Build a libwbclient package by default +%bcond_without libwbclient + %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %define main_release 13 @@ -38,8 +41,6 @@ # https://src.fedoraproject.org/rpms/redhat-rpm-config/blob/master/f/buildflags.md %undefine _strict_symbol_defs_build -%global with_libwbclient 1 - %global with_vfs_cephfs 0 %if 0%{?fedora} %ifarch aarch64 ppc64le s390x x86_64 @@ -147,7 +148,7 @@ Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-common-tools = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} -%if %with_libwbclient +%if %{with libwbclient} Requires: libwbclient = %{samba_depver} %endif @@ -296,7 +297,7 @@ Requires: %{name}-client-libs = %{samba_depver} %if %{with libsmbclient} Requires: libsmbclient = %{samba_depver} %endif -%if %with_libwbclient +%if %{with libwbclient} Requires: libwbclient = %{samba_depver} %endif @@ -317,7 +318,7 @@ Summary: Samba client libraries Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} -%if %with_libwbclient +%if %{with libwbclient} Requires: libwbclient = %{samba_depver} %endif Requires: krb5-libs >= %{required_mit_krb5} @@ -353,7 +354,7 @@ Summary: Libraries used by both Samba servers and clients Requires(pre): samba-common = %{samba_depver} Requires: samba-common = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} -%if %with_libwbclient +%if %{with libwbclient} Requires: libwbclient = %{samba_depver} %endif @@ -367,7 +368,7 @@ Summary: Tools for Samba servers and clients Requires: samba-common-libs = %{samba_depver} Requires: samba-client-libs = %{samba_depver} Requires: samba-libs = %{samba_depver} -%if %with_libwbclient +%if %{with libwbclient} Requires: libwbclient = %{samba_depver} %endif @@ -475,7 +476,7 @@ Requires: %{name} = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} -%if %with_libwbclient +%if %{with libwbclient} Requires: libwbclient = %{samba_depver} %endif @@ -506,7 +507,7 @@ the Kerberos credentials cache of the user issuing the print job. Summary: Samba libraries Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} -%if %with_libwbclient +%if %{with libwbclient} Requires: libwbclient = %{samba_depver} %endif @@ -525,7 +526,7 @@ Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} -%if %with_libwbclient +%if %{with libwbclient} Requires: libwbclient = %{samba_depver} %endif @@ -544,7 +545,7 @@ suite. %endif ### LIBWBCLIENT -%if %with_libwbclient +%if %{with libwbclient} %package -n libwbclient Summary: The winbind client library Requires: %{name}-client-libs = %{samba_depver} @@ -563,7 +564,7 @@ Obsoletes: samba-winbind-devel < %{samba_depver} %description -n libwbclient-devel The libwbclient-devel package provides developer tools for the wbclient library. -#endif with_libwbclient +#endif {with libwbclient} %endif ### PYTHON3 @@ -581,7 +582,7 @@ Requires: python3-dns %if %{with libsmbclient} Requires: libsmbclient = %{samba_depver} %endif -%if %with_libwbclient +%if %{with libwbclient} Requires: libwbclient = %{samba_depver} %endif @@ -643,7 +644,7 @@ Requires: %{name}-libs = %{samba_depver} %if %{with libsmbclient} Requires: libsmbclient = %{samba_depver} %endif -%if %with_libwbclient +%if %{with libwbclient} Requires: libwbclient = %{samba_depver} %endif Requires: python3-%{name} = %{samba_depver} @@ -662,7 +663,7 @@ Summary: Libraries need by the testing tools for Samba servers and clients Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} -%if %with_libwbclient +%if %{with libwbclient} Requires: libwbclient = %{samba_depver} %endif @@ -703,7 +704,7 @@ Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-winbind = %{samba_depver} -%if %with_libwbclient +%if %{with libwbclient} Requires: libwbclient = %{samba_depver} %endif @@ -717,7 +718,7 @@ tool. ### WINBIND-KRB5-LOCATOR %package winbind-krb5-locator Summary: Samba winbind krb5 locator -%if %with_libwbclient +%if %{with libwbclient} Requires: libwbclient = %{samba_depver} Requires: %{name}-winbind = %{samba_depver} %else @@ -746,7 +747,7 @@ the local kerberos library to use the same KDC as samba and winbind use Summary: Samba winbind modules Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} -%if %with_libwbclient +%if %{with libwbclient} Requires: libwbclient = %{samba_depver} %endif Requires: pam @@ -855,7 +856,7 @@ xzcat %{SOURCE0} | gpgv2 --quiet --keyring %{SOURCE2} %{SOURCE1} - %global _libsmbclient smbclient, %endif -%if ! %with_libwbclient +%if %{without libwbclient} %global _libwbclient wbclient, %endif @@ -883,7 +884,7 @@ export LDFLAGS="%{__global_ldflags} -fuse-ld=gold" --with-pie \ --with-relro \ --without-fam \ -%if (%{without libsmbclient}) || (! %with_libwbclient) +%if (%{without libsmbclient}) || (%{without libwbclient}) --private-libraries=%{_samba_private_libraries} \ %endif --with-system-mitkrb5 \ @@ -1177,7 +1178,7 @@ fi %ldconfig_scriptlets -n libsmbclient %endif -%if %with_libwbclient +%if %{with libwbclient} %posttrans -n libwbclient # It has to be posttrans here to make sure all files of a previous version # without alternatives support are removed @@ -1224,7 +1225,7 @@ if [ $1 -eq 0 ]; then fi fi -#endif with_libwbclient +#endif {with libwbclient} %endif %ldconfig_scriptlets test @@ -1552,10 +1553,10 @@ fi %{_libdir}/samba/libutil-setid-samba4.so %{_libdir}/samba/libutil-tdb-samba4.so -%if ! %with_libwbclient +%if %{without libwbclient} %{_libdir}/samba/libwbclient.so.* %{_libdir}/samba/libwinbind-client-samba4.so -#endif ! with_libwbclient +#endif without libwbclient %endif %if %{without libsmbclient} @@ -1859,9 +1860,9 @@ fi #endif without libsmbclient %endif -%if ! %with_libwbclient +%if %{without libwbclient} %{_includedir}/samba-4.0/wbclient.h -#endif ! with_libwbclient +#endif without libwbclient %endif ### VFS-CEPHFS @@ -1913,7 +1914,7 @@ fi %endif ### LIBWBCLIENT -%if %with_libwbclient +%if %{with libwbclient} %files -n libwbclient %{_libdir}/samba/wbclient/libwbclient.so.* %{_libdir}/samba/libwinbind-client-samba4.so @@ -1923,7 +1924,7 @@ fi %{_includedir}/samba-4.0/wbclient.h %{_libdir}/samba/wbclient/libwbclient.so %{_libdir}/pkgconfig/wbclient.pc -#endif with_libwbclient +#endif {with libwbclient} %endif ### PIDL From cab0cecf589e57b80529f81d6dccfe9dfc201854 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 19 Oct 2020 17:23:08 +0200 Subject: [PATCH 043/425] Use %bcond_without for vfs_cephfs --- samba.spec | 34 ++++++++++++++++++++-------------- 1 file changed, 20 insertions(+), 14 deletions(-) diff --git a/samba.spec b/samba.spec index 280eb0f..a8d6176 100644 --- a/samba.spec +++ b/samba.spec @@ -13,6 +13,21 @@ # Build a libwbclient package by default %bcond_without libwbclient +# Build vfs_ceph module by default on 64bit Fedora +%if 0%{?fedora} + +%ifarch aarch64 ppc64le s390x x86_64 +%bcond_without vfs_cephfs +%else +%bcond_with vfs_cephfs +#endifarch +%endif + +%else +%bcond_with vfs_cephfs +#endif fedora +%endif + %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %define main_release 13 @@ -41,15 +56,6 @@ # https://src.fedoraproject.org/rpms/redhat-rpm-config/blob/master/f/buildflags.md %undefine _strict_symbol_defs_build -%global with_vfs_cephfs 0 -%if 0%{?fedora} -%ifarch aarch64 ppc64le s390x x86_64 -%global with_vfs_cephfs 1 -#endifarch -%endif -#endif fedora -%endif - %global with_vfs_glusterfs 1 %if 0%{?rhel} %global with_vfs_glusterfs 0 @@ -231,7 +237,7 @@ BuildRequires: glusterfs-api-devel >= 3.4.0.16 BuildRequires: glusterfs-devel >= 3.4.0.16 %endif -%if %{with_vfs_cephfs} +%if %{with vfs_cephfs} BuildRequires: libcephfs-devel %endif @@ -455,7 +461,7 @@ needed to develop programs that link against the SMB, RPC and other libraries in the Samba suite. ### CEPH -%if %{with_vfs_cephfs} +%if %{with vfs_cephfs} %package vfs-cephfs Summary: Samba VFS module for Ceph distributed storage system Requires: %{name} = %{samba_depver} @@ -463,7 +469,7 @@ Requires: %{name}-libs = %{samba_depver} %description vfs-cephfs Samba VFS module for Ceph distributed storage system integration. -#endif with_vfs_cephfs +#endif with vfs_cephfs %endif ### GLUSTER @@ -1074,7 +1080,7 @@ done rm -f %{buildroot}%{_mandir}/man8/vfs_glusterfs.8* %endif -%if ! %{with_vfs_cephfs} +%if %{without vfs_cephfs} rm -f %{buildroot}%{_mandir}/man8/vfs_ceph.8* rm -f %{buildroot}%{_mandir}/man8/vfs_ceph_snapshots.8* %endif @@ -1866,7 +1872,7 @@ fi %endif ### VFS-CEPHFS -%if %{with_vfs_cephfs} +%if %{with vfs_cephfs} %files vfs-cephfs %{_libdir}/samba/vfs/ceph.so %{_libdir}/samba/vfs/ceph_snapshots.so From a04dd9958d891cab4969ef289c9e3bef4511385b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 19 Oct 2020 17:25:56 +0200 Subject: [PATCH 044/425] Use %bcond_without for vfs_glusterfs --- samba.spec | 36 ++++++++++++++++++++---------------- 1 file changed, 20 insertions(+), 16 deletions(-) diff --git a/samba.spec b/samba.spec index a8d6176..d33b910 100644 --- a/samba.spec +++ b/samba.spec @@ -28,6 +28,21 @@ #endif fedora %endif +# Build vfs_gluster module by default on 64bit Fedora +%if 0%{?fedora} + +%ifarch aarch64 ppc64le s390x x86_64 +%bcond_without vfs_glusterfs +%else +%bcond_with vfs_glusterfs +#endifarch +%endif + +%else +%bcond_with vfs_glusterfs +#endif fedora +%endif + %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %define main_release 13 @@ -56,17 +71,6 @@ # https://src.fedoraproject.org/rpms/redhat-rpm-config/blob/master/f/buildflags.md %undefine _strict_symbol_defs_build -%global with_vfs_glusterfs 1 -%if 0%{?rhel} -%global with_vfs_glusterfs 0 -# Only enable on x86_64 -%ifarch x86_64 -%global with_vfs_glusterfs 1 -#endif arch -%endif -#endif rhel -%endif - %global libwbc_alternatives_version 0.15 %global libwbc_alternatives_suffix %nil %if 0%{?__isa_bits} == 64 @@ -232,7 +236,7 @@ BuildRequires: zlib-devel >= 1.2.3 BuildRequires: pkgconfig(libsystemd) -%if %{with_vfs_glusterfs} +%if %{with vfs_glusterfs} BuildRequires: glusterfs-api-devel >= 3.4.0.16 BuildRequires: glusterfs-devel >= 3.4.0.16 %endif @@ -473,7 +477,7 @@ Samba VFS module for Ceph distributed storage system integration. %endif ### GLUSTER -%if %{with_vfs_glusterfs} +%if %{with vfs_glusterfs} %package vfs-glusterfs Summary: Samba VFS module for GlusterFS Requires: glusterfs-api >= 3.4.0.16 @@ -898,7 +902,7 @@ export LDFLAGS="%{__global_ldflags} -fuse-ld=gold" %if ! %with_dc --without-ad-dc \ %endif -%if ! %with_vfs_glusterfs +%if %{without vfs_glusterfs} --disable-glusterfs \ %endif %if %with_clustering_support @@ -1076,7 +1080,7 @@ for i in \ done %endif -%if ! %{with_vfs_glusterfs} +%if %{without vfs_glusterfs} rm -f %{buildroot}%{_mandir}/man8/vfs_glusterfs.8* %endif @@ -1881,7 +1885,7 @@ fi %endif ### VFS-GLUSTERFS -%if %{with_vfs_glusterfs} +%if %{with vfs_glusterfs} %files vfs-glusterfs %{_libdir}/samba/vfs/glusterfs.so %{_mandir}/man8/vfs_glusterfs.8* From f172c59a671888210eace7450a7e9ecf99182a10 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 20 Oct 2020 07:25:57 +0200 Subject: [PATCH 045/425] Use %bcond_without for AD DC --- samba.spec | 68 +++++++++++++++++++++++++----------------------------- 1 file changed, 31 insertions(+), 37 deletions(-) diff --git a/samba.spec b/samba.spec index d33b910..c6fe147 100644 --- a/samba.spec +++ b/samba.spec @@ -7,6 +7,13 @@ # ctdb is enabled by default, you can disable it with: --without clustering %bcond_without clustering +# Build with Active Directory Domain Controller support by default on Fedora +%if 0%{?fedora} +%bcond_without dc +%else +%bcond_with dc +%endif + # Build a libsmbclient package by default %bcond_without libsmbclient @@ -77,16 +84,6 @@ %global libwbc_alternatives_suffix -64 %endif -%global with_dc 1 - -%if 0%{?rhel} -%global with_dc 0 -%endif - -%if %{with testsuite} -%global with_dc 1 -%endif - %global required_mit_krb5 1.18 %global with_clustering_support 0 @@ -249,14 +246,14 @@ BuildRequires: libcephfs-devel BuildRequires: liburing-devel >= 0.4 %endif -%if %{with_dc} +%if %{with dc} || %{with testsuite} # Add python3-iso8601 to avoid that the # version in Samba is being packaged BuildRequires: python3-iso8601 BuildRequires: bind BuildRequires: krb5-server >= %{required_mit_krb5} -#endif with_dc +#endif with dc %endif # pidl requirements @@ -276,16 +273,13 @@ BuildRequires: python3-tdb >= %{tdb_version} BuildRequires: libldb-devel >= %{ldb_version} BuildRequires: python3-ldb-devel >= %{ldb_version} -%if %{with testsuite} || %{with_dc} +%if %{with dc} || %{with testsuite} +BuildRequires: bind +BuildRequires: krb5-server >= %{required_mit_krb5} BuildRequires: ldb-tools -BuildRequires: tdb-tools BuildRequires: python3-gpg BuildRequires: python3-markdown -%endif - -%if %{with_dc} -BuildRequires: krb5-server >= %{required_mit_krb5} -BuildRequires: bind +BuildRequires: tdb-tools %endif # filter out perl requirements pulled in from examples in the docdir. @@ -348,7 +342,7 @@ Recommends: logrotate Provides: samba4-common = %{samba_depver} Obsoletes: samba4-common < %{samba_depver} -%if ! %{with_dc} +%if %{with dc} || %{with testsuite} Obsoletes: samba-dc < %{samba_depver} Obsoletes: samba-dc-libs < %{samba_depver} Obsoletes: samba-dc-bind-dlz < %{samba_depver} @@ -387,7 +381,7 @@ The samba-common-tools package contains tools for Samba servers and SMB/CIFS clients. ### DC -%if %{with_dc} +%if %{with dc} || %{with testsuite} %package dc Summary: Samba AD Domain Controller Requires: %{name} = %{samba_depver} @@ -447,7 +441,7 @@ Requires: bind %description dc-bind-dlz The %{name}-dc-bind-dlz package contains the libraries for bind to manage all name server related details of Samba AD. -#endif with_dc +#endif with dc %endif ### DEVEL @@ -610,7 +604,7 @@ Requires: %{name}-libs = %{samba_depver} The python3-%{name}-test package contains the Python libraries used by the test suite of Samba. If you want to run full set of Samba tests, you need to install this package. -%if %{with_dc} +%if %{with dc} || %{with testsuite} %package -n python3-samba-dc Summary: Samba Python libraries for Samba AD Requires: python3-%{name} = %{samba_depver} @@ -647,7 +641,7 @@ Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-test-libs = %{samba_depver} -%if %with_dc +%if %{with dc} || %{with testsuite} Requires: %{name}-dc-libs = %{samba_depver} %endif Requires: %{name}-libs = %{samba_depver} @@ -899,7 +893,7 @@ export LDFLAGS="%{__global_ldflags} -fuse-ld=gold" %endif --with-system-mitkrb5 \ --with-experimental-mit-ad-dc \ -%if ! %with_dc +%if %{without dc} && %{without testsuite} --without-ad-dc \ %endif %if %{without vfs_glusterfs} @@ -1014,7 +1008,7 @@ install -m 0755 packaging/NetworkManager/30-winbind-systemd \ install -d -m 0755 %{buildroot}%{_libdir}/krb5/plugins/libkrb5 touch %{buildroot}%{_libdir}/krb5/plugins/libkrb5/winbind_krb5_locator.so -%if ! %with_dc +%if %{without dc} && %{without testsuite} for i in \ %{_libdir}/samba/libdfs-server-ad-samba4.so \ %{_libdir}/samba/libdnsserver-common-samba4.so \ @@ -1093,14 +1087,14 @@ rm -f %{buildroot}%{_mandir}/man8/vfs_ceph_snapshots.8* # the ldconfig-created links be recorded in the RPM. /sbin/ldconfig -N -n %{buildroot}%{_libdir} -%if ! %with_dc +%if %{without dc} && %{without testsuite} for f in samba/libsamba-net-samba4.so \ samba/libsamba-python-samba4.so \ libsamba-policy.so* \ pkgconfig/samba-policy.pc ; do rm -f %{buildroot}%{_libdir}/$f done -#endif ! with_dc +#endif without dc %endif pushd pidl @@ -1158,7 +1152,7 @@ fi %ldconfig_scriptlets common-libs -%if %{with_dc} +%if %{with dc} || %{with testsuite} %ldconfig_scriptlets dc-libs %post dc @@ -1169,7 +1163,7 @@ fi %postun dc %systemd_postun_with_restart samba.service -#endif with_dc +#endif with dc %endif %post krb5-printing @@ -1294,7 +1288,7 @@ fi %{_sbindir}/eventlogadm %{_sbindir}/nmbd %{_sbindir}/smbd -%if %{with_dc} +%if %{with dc} || %{with testsuite} # This is only used by vfs_dfs_samba4 %{_libdir}/samba/libdfs-server-ad-samba4.so %endif @@ -1312,7 +1306,7 @@ fi %{_libdir}/samba/vfs/commit.so %{_libdir}/samba/vfs/crossrename.so %{_libdir}/samba/vfs/default_quota.so -%if %{with_dc} +%if %{with dc} || %{with testsuite} %{_libdir}/samba/vfs/dfs_samba4.so %endif %{_libdir}/samba/vfs/dirsort.so @@ -1625,7 +1619,7 @@ fi %{_mandir}/man8/smbpasswd.8* ### DC -%if %{with_dc} +%if %{with dc} || %{with testsuite} %files dc %{_unitdir}/samba.service %{_bindir}/samba-tool @@ -1742,7 +1736,7 @@ fi %{_libdir}/samba/bind9/dlz_bind9_10.so %{_libdir}/samba/bind9/dlz_bind9_11.so %{_libdir}/samba/bind9/dlz_bind9_12.so -#endif with_dc +#endif with dc %endif ### DEVEL @@ -1859,7 +1853,7 @@ fi %{_libdir}/libsamba-passdb.so %{_libdir}/libsmbldap.so -%if %with_dc +%if %{with dc} || %{with testsuite} %{_includedir}/samba-4.0/dcerpc_server.h %{_libdir}/libdcerpc-server.so %{_libdir}/pkgconfig/dcerpc_server.pc @@ -2226,7 +2220,7 @@ fi %{_libdir}/samba/libsamba-net.*-samba4.so %{_libdir}/samba/libsamba-python.*-samba4.so -%if %{with_dc} +%if %{with dc} || %{with testsuite} %files -n python3-%{name}-dc %{python3_sitearch}/samba/samdb.py %{python3_sitearch}/samba/schema.py @@ -2693,7 +2687,7 @@ fi ### TEST-LIBS %files test-libs -%if %with_dc +%if %{with dc} || %{with testsuite} %{_libdir}/samba/libdlz-bind9-for-torture-samba4.so %else %{_libdir}/samba/libdsdb-module-samba4.so From a72748f232f2c72f59304bf8ff50ef88ffbc5bcd Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 20 Oct 2020 08:25:09 +0200 Subject: [PATCH 046/425] Remove unneeded with_clustering_support define --- samba.spec | 24 +++++++++--------------- 1 file changed, 9 insertions(+), 15 deletions(-) diff --git a/samba.spec b/samba.spec index c6fe147..d5ab7af 100644 --- a/samba.spec +++ b/samba.spec @@ -86,12 +86,6 @@ %global required_mit_krb5 1.18 -%global with_clustering_support 0 - -%if %{with clustering} -%global with_clustering_support 1 -%endif - # Enable winexe by default %bcond_without winexe @@ -771,7 +765,7 @@ Winexe is a Remote Windows®-command executor %endif ### CTDB -%if %with_clustering_support +%if %{with clustering} %package -n ctdb Summary: A Clustered Database based on Samba's Trivial Database (TDB) @@ -824,7 +818,7 @@ CTDB is a cluster implementation of the TDB database used by Samba and other projects to store temporary data. If an application is already using TDB for temporary data it is very easy to convert that application to be cluster aware and use CTDB instead. -#endif with_clustering_support +#endif with clustering %endif @@ -899,7 +893,7 @@ export LDFLAGS="%{__global_ldflags} -fuse-ld=gold" %if %{without vfs_glusterfs} --disable-glusterfs \ %endif -%if %with_clustering_support +%if %{with clustering} --with-cluster-support \ %endif %if %{with testsuite} @@ -978,13 +972,13 @@ install -m 0744 packaging/printing/smbprint %{buildroot}%{_bindir}/smbprint install -d -m 0755 %{buildroot}%{_tmpfilesdir} # Create /run/samba. echo "d /run/samba 755 root root" > %{buildroot}%{_tmpfilesdir}/samba.conf -%if %with_clustering_support +%if %{with clustering} echo "d /run/ctdb 755 root root" > %{buildroot}%{_tmpfilesdir}/ctdb.conf %endif install -d -m 0755 %{buildroot}%{_sysconfdir}/sysconfig install -m 0644 packaging/systemd/samba.sysconfig %{buildroot}%{_sysconfdir}/sysconfig/samba -%if %with_clustering_support +%if %{with clustering} cat > %{buildroot}%{_sysconfdir}/sysconfig/ctdb < Date: Tue, 20 Oct 2020 08:26:31 +0200 Subject: [PATCH 047/425] Move %bcond_without winexe further up --- samba.spec | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index d5ab7af..cabac3e 100644 --- a/samba.spec +++ b/samba.spec @@ -20,6 +20,9 @@ # Build a libwbclient package by default %bcond_without libwbclient +# Build with winexe by default +%bcond_without winexe + # Build vfs_ceph module by default on 64bit Fedora %if 0%{?fedora} @@ -86,9 +89,6 @@ %global required_mit_krb5 1.18 -# Enable winexe by default -%bcond_without winexe - %global with_vfs_io_uring 0 # We need liburing >= 0.4 which is not available in RHEL yet %if 0%{?fedora} From b1b788374ba334b7e728285cb5f7a97628e35e81 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 20 Oct 2020 08:28:57 +0200 Subject: [PATCH 048/425] Use %bcond_without for vfs_io_uring --- samba.spec | 30 ++++++++++++++++++------------ 1 file changed, 18 insertions(+), 12 deletions(-) diff --git a/samba.spec b/samba.spec index cabac3e..54f3ce5 100644 --- a/samba.spec +++ b/samba.spec @@ -53,6 +53,21 @@ #endif fedora %endif +# Build vfs_io_uring module by default on 64bit Fedora +%if 0%{?fedora} + +%ifarch aarch64 ppc64le s390x x86_64 +%bcond_without vfs_io_uring +%else +%bcond_with vfs_io_uring +#endifarch +%endif + +%else +%bcond_with vfs_io_uring +#endif fedora +%endif + %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %define main_release 13 @@ -89,15 +104,6 @@ %global required_mit_krb5 1.18 -%global with_vfs_io_uring 0 -# We need liburing >= 0.4 which is not available in RHEL yet -%if 0%{?fedora} -%ifarch aarch64 ppc64le s390x x86_64 i686 -%global with_vfs_io_uring 1 -%endif -# /fedora -%endif - %global _systemd_extra "Environment=KRB5CCNAME=FILE:/run/samba/krb5cc_samba" Name: samba @@ -236,7 +242,7 @@ BuildRequires: glusterfs-devel >= 3.4.0.16 BuildRequires: libcephfs-devel %endif -%if %{with_vfs_io_uring} +%if %{with vfs_io_uring} BuildRequires: liburing-devel >= 0.4 %endif @@ -1312,7 +1318,7 @@ fi %{_libdir}/samba/vfs/full_audit.so %{_libdir}/samba/vfs/gpfs.so %{_libdir}/samba/vfs/glusterfs_fuse.so -%if %{with_vfs_io_uring} +%if %{with vfs_io_uring} %{_libdir}/samba/vfs/io_uring.so %endif %{_libdir}/samba/vfs/linux_xfs_sgid.so @@ -1369,7 +1375,7 @@ fi %{_mandir}/man8/vfs_full_audit.8* %{_mandir}/man8/vfs_gpfs.8* %{_mandir}/man8/vfs_glusterfs_fuse.8* -%if %{with_vfs_io_uring} +%if %{with vfs_io_uring} %{_mandir}/man8/vfs_io_uring.8* %endif %{_mandir}/man8/vfs_linux_xfs_sgid.8* From f6c5528ad035365df9631e9bc4a04ef2689b2461 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 20 Oct 2020 12:13:15 +0200 Subject: [PATCH 049/425] Update comment for the testsuite --- samba.spec | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index 54f3ce5..3b9bb31 100644 --- a/samba.spec +++ b/samba.spec @@ -1,7 +1,9 @@ +# The testsuite is disabled by default. +# +# To build and run the tests use: +# # rpmbuild --rebuild --with testsuite --without clustering samba.src.rpm # -# The testsuite is disabled by default. Set --with testsuite or bcond_without -# to run the Samba torture testsuite. %bcond_with testsuite # ctdb is enabled by default, you can disable it with: --without clustering From 36b4604ec174447d739546a1030033c5550d1ab3 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 20 Oct 2020 12:14:50 +0200 Subject: [PATCH 050/425] Use %global instead of %define for variables --- samba.spec | 23 +++++++++++------------ 1 file changed, 11 insertions(+), 12 deletions(-) diff --git a/samba.spec b/samba.spec index 3b9bb31..e872bd5 100644 --- a/samba.spec +++ b/samba.spec @@ -72,20 +72,19 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%define main_release 13 +%global main_release 13 -%define samba_version 4.13.0 -%define talloc_version 2.3.1 -%define tdb_version 1.4.3 -%define tevent_version 0.10.2 -%define ldb_version 2.2.0 +%global samba_version 4.13.0 +%global talloc_version 2.3.1 +%global tdb_version 1.4.3 +%global tevent_version 0.10.2 +%global ldb_version 2.2.0 # This should be rc1 or nil -%define pre_release %nil +%global pre_release %nil +%global samba_release %{main_release}%{?dist} %if "x%{?pre_release}" != "x" -%define samba_release 0.%{main_release}.%{pre_release}%{?dist} -%else -%define samba_release %{main_release}%{?dist} +%global samba_release 0.%{main_release}.%{pre_release}%{?dist} %endif # This is a network daemon, do a hardened build @@ -119,9 +118,9 @@ Epoch: 2 %endif %if 0%{?epoch} > 0 -%define samba_depver %{epoch}:%{version}-%{release} +%global samba_depver %{epoch}:%{version}-%{release} %else -%define samba_depver %{version}-%{release} +%global samba_depver %{version}-%{release} %endif Summary: Server and Client software to interoperate with Windows machines From 5856c50271b3cc00e24356c992990518e265ada9 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 20 Oct 2020 16:14:49 +0200 Subject: [PATCH 051/425] Do not use %make_build Samba is using waf as the build system, make is just a wrapper and sync make output doesn't work! --- samba.spec | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index e872bd5..3dcf43e 100644 --- a/samba.spec +++ b/samba.spec @@ -914,7 +914,8 @@ export LDFLAGS="%{__global_ldflags} -fuse-ld=gold" --systemd-winbind-extra=%{_systemd_extra} \ --systemd-samba-extra=%{_systemd_extra} -%make_build +# Do not use %%make_build, make is just a wrapper around waf in Samba! +%{__make} %{?_smp_mflags} %{_make_verbose} pushd pidl %__perl Makefile.PL PREFIX=%{_prefix} From 586addaaf84058c383efa9c609deba812910eb71 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 22 Oct 2020 09:08:27 +0200 Subject: [PATCH 052/425] Fixed dbcheck running in a release tarball --- 1624.patch | 1389 ++++++++++++++++++++++++++++++++++++++++++++++++++++ samba.spec | 8 +- 2 files changed, 1396 insertions(+), 1 deletion(-) create mode 100644 1624.patch diff --git a/1624.patch b/1624.patch new file mode 100644 index 0000000..124c239 --- /dev/null +++ b/1624.patch @@ -0,0 +1,1389 @@ +From 9cf2118afce0b1534c0daea4ab97f29225f7fcb1 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 21 Oct 2020 07:43:08 +0200 +Subject: [PATCH 1/9] python: Create targetdir recursively + +This fixes `make test` in a release tarball. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14542 + +Signed-off-by: Andreas Schneider +--- + python/samba/netcmd/domain.py | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/python/samba/netcmd/domain.py b/python/samba/netcmd/domain.py +index 000688f4e7a..5f08ddf6007 100644 +--- a/python/samba/netcmd/domain.py ++++ b/python/samba/netcmd/domain.py +@@ -445,7 +445,7 @@ class cmd_domain_provision(Command): + + if targetdir is not None: + if not os.path.isdir(targetdir): +- os.mkdir(targetdir) ++ os.makedirs(targetdir) + + eadb = True + +-- +GitLab + + +From f69a5a15550a2330710ba09e06daf826deedeb34 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 22 Oct 2020 11:39:04 +0200 +Subject: [PATCH 2/9] testprogs: Add remove_directory to common test functions + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14542 + +Signed-off-by: Andreas Schneider +--- + testprogs/blackbox/common_test_fns.inc | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/testprogs/blackbox/common_test_fns.inc b/testprogs/blackbox/common_test_fns.inc +index a5611c63fa0..7b421e9eb08 100755 +--- a/testprogs/blackbox/common_test_fns.inc ++++ b/testprogs/blackbox/common_test_fns.inc +@@ -107,3 +107,14 @@ kerberos_kinit() { + fi + return $status + } ++ ++remove_directory() { ++ local xdir=${1} ++ shift ++ ++ if [ "$xdir" == "/" ] || [ ! -d "$xdir" ] || [ ! $(ls -A "$xdir") ]; then ++ return ++ fi ++ ++ rm -rf "$xdir" ++} +-- +GitLab + + +From 5c65e1a9e99d9dcfadb90433b2465db277814666 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 20 Oct 2020 20:47:43 +0200 +Subject: [PATCH 3/9] testprogs: Fix and improve demote-saveddb test + +This fixes running `make test` in a release tarball! + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14542 + +Signed-off-by: Andreas Schneider +--- + testprogs/blackbox/demote-saveddb.sh | 75 ++++++++++++++++------------ + 1 file changed, 43 insertions(+), 32 deletions(-) + +diff --git a/testprogs/blackbox/demote-saveddb.sh b/testprogs/blackbox/demote-saveddb.sh +index 3d5fabd72e3..d8fccf32011 100755 +--- a/testprogs/blackbox/demote-saveddb.sh ++++ b/testprogs/blackbox/demote-saveddb.sh +@@ -10,58 +10,69 @@ fi + PREFIX_ABS="$1" + shift 1 + +-. `dirname $0`/subunit.sh ++failed=0 + +-tree_dir=`dirname $0`/../../source4/selftest/provisions/multi-dc-samba-master-c596ac6 ++. `dirname $0`/subunit.sh ++. `dirname $0`/common_test_fns.inc + +-undump() { +- if test -x $BINDIR/tdbrestore; +- then +- `dirname $0`/../../source4/selftest/provisions/undump.sh $tree_dir $PREFIX_ABS $BINDIR/tdbrestore +- else +- `dirname $0`/../../source4/selftest/provisions/undump.sh $tree_dir $PREFIX_ABS +- fi +-} ++samba_tree_dir="$SRCDIR_ABS/source4/selftest/provisions/multi-dc-samba-master-c596ac6" + +-demote() { +- $PYTHON $BINDIR/samba-tool domain demote -H tdb://$PREFIX_ABS/private/sam.ldb --remove-other-dead-server=$1 +-} ++samba_tdbrestore="tdbrestore" ++if [ -x $BINDIR/tdbrestore ]; then ++ samba_tdbrestore="$BINDIR/tdbrestore" ++fi + ++# The undump script and the provision data is not part of release tarballs, ++# skip the tests in this case! ++samba_undump="$SRCDIR_ABS/source4/selftest/provisions/undump.sh" ++if [ ! -x $samba_undump ] || [ ! -d $samba_tree_dir ]; then ++ subunit_start_test "undump" ++ subunit_skip_test "undump" < +Date: Wed, 21 Oct 2020 17:04:12 +0200 +Subject: [PATCH 4/9] testprogs: Fix and improve tombstones-expunge test + +This fixes running `make test` in a release tarball! + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14542 + +Signed-off-by: Andreas Schneider +--- + testprogs/blackbox/tombstones-expunge.sh | 94 +++++++++++++----------- + 1 file changed, 50 insertions(+), 44 deletions(-) + +diff --git a/testprogs/blackbox/tombstones-expunge.sh b/testprogs/blackbox/tombstones-expunge.sh +index aa37cfe278f..9e0588377d7 100755 +--- a/testprogs/blackbox/tombstones-expunge.sh ++++ b/testprogs/blackbox/tombstones-expunge.sh +@@ -11,9 +11,12 @@ PREFIX_ABS="$1" + RELEASE="$2" + shift 2 + ++failed=0 ++ + . `dirname $0`/subunit.sh ++. `dirname $0`/common_test_fns.inc + +-release_dir=`dirname $0`/../../source4/selftest/provisions/$RELEASE ++release_dir="$SRCDIR_ABS/source4/selftest/provisions/$RELEASE" + + ldbadd="ldbadd" + if [ -x "$BINDIR/ldbadd" ]; then +@@ -35,13 +38,28 @@ if [ -x "$BINDIR/ldbsearch" ]; then + ldbsearch="$BINDIR/ldbsearch" + fi + ++samba_tdbrestore="tdbrestore" ++if [ -x "$BINDIR/tdbrestore" ]; then ++ samba_tdbrestore="$BINDIR/tdbrestore" ++fi ++ ++samba_undump="$SRCDIR_ABS/source4/selftest/provisions/undump.sh" ++if [ ! -x $samba_undump ] || [ ! -d $release_dir ]; then ++ subunit_start_test $RELEASE ++ subunit_skip_test $RELEASE < +Date: Wed, 21 Oct 2020 17:35:34 +0200 +Subject: [PATCH 5/9] testprogs: Fix and improve runtime-links test + +This fixes running `make test` in a release tarball! + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14542 + +Signed-off-by: Andreas Schneider +--- + testprogs/blackbox/common-links.sh | 16 +++---- + testprogs/blackbox/runtime-links.sh | 65 ++++++++++++++++------------- + 2 files changed, 44 insertions(+), 37 deletions(-) + +diff --git a/testprogs/blackbox/common-links.sh b/testprogs/blackbox/common-links.sh +index ee7310b5108..363234ae11c 100644 +--- a/testprogs/blackbox/common-links.sh ++++ b/testprogs/blackbox/common-links.sh +@@ -1,4 +1,4 @@ +-release_dir=`dirname $0`/../../source4/selftest/provisions/$RELEASE ++release_dir=$SRCDIR_ABS/source4/selftest/provisions/$RELEASE + + ldbadd="ldbadd" + if [ -x "$BINDIR/ldbadd" ]; then +@@ -25,13 +25,15 @@ if [ -x "$BINDIR/ldbrename" ]; then + ldbrename="$BINDIR/ldbrename" + fi + ++samba_tdbrestore="tdbrestore" ++if [ -x "$BINDIR/tdbrestore" ]; then ++ samba_tdbrestore="$BINDIR/tdbrestore" ++fi ++ ++samba_undump="$SRCDIR_ABS/source4/selftest/provisions/undump.sh" ++ + undump() { +- if test -x $BINDIR/tdbrestore; +- then +- `dirname $0`/../../source4/selftest/provisions/undump.sh $release_dir $PREFIX_ABS/$RELEASE $BINDIR/tdbrestore +- else +- `dirname $0`/../../source4/selftest/provisions/undump.sh $release_dir $PREFIX_ABS/$RELEASE +- fi ++ $samba_undump $release_dir $PREFIX_ABS/$RELEASE $samba_tdbrestore + } + + add_dangling_link() { +diff --git a/testprogs/blackbox/runtime-links.sh b/testprogs/blackbox/runtime-links.sh +index 344b822f07e..f8de66c60e7 100755 +--- a/testprogs/blackbox/runtime-links.sh ++++ b/testprogs/blackbox/runtime-links.sh +@@ -11,10 +11,28 @@ PREFIX_ABS="$1" + RELEASE="$2" + shift 2 + ++failed=0 ++ + . `dirname $0`/subunit.sh + + . `dirname $0`/common-links.sh + ++. `dirname $0`/common_test_fns.inc ++ ++if [ ! -x $samba_undump ] || [ ! -d $release_dir ]; then ++ subunit_start_test $RELEASE ++ subunit_skip_test $RELEASE < +Date: Wed, 21 Oct 2020 17:41:27 +0200 +Subject: [PATCH 6/9] testprogs: Fix and improve dbcheck-links test + +This fixes running `make test` in a release tarball! + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14542 + +Signed-off-by: Andreas Schneider +--- + testprogs/blackbox/dbcheck-links.sh | 160 ++++++++++++++-------------- + 1 file changed, 82 insertions(+), 78 deletions(-) + +diff --git a/testprogs/blackbox/dbcheck-links.sh b/testprogs/blackbox/dbcheck-links.sh +index eb0e0b3163f..ead59d691e0 100755 +--- a/testprogs/blackbox/dbcheck-links.sh ++++ b/testprogs/blackbox/dbcheck-links.sh +@@ -14,6 +14,23 @@ shift 2 + . `dirname $0`/subunit.sh + + . `dirname $0`/common-links.sh ++. `dirname $0`/common_test_fns.inc ++ ++failed=0 ++ ++if [ ! -x $samba_undump ] || [ ! -d $release_dir ]; then ++ subunit_start_test $RELEASE ++ subunit_skip_test $RELEASE < +Date: Wed, 21 Oct 2020 17:54:54 +0200 +Subject: [PATCH 7/9] testprogs: Fix and improve functionalprep test + +This fixes running `make test` in a release tarball! + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14542 + +Signed-off-by: Andreas Schneider +--- + testprogs/blackbox/functionalprep.sh | 77 ++++++++++++++++------------ + 1 file changed, 44 insertions(+), 33 deletions(-) + +diff --git a/testprogs/blackbox/functionalprep.sh b/testprogs/blackbox/functionalprep.sh +index 1d37611ef7a..a5ac4b8bc7f 100755 +--- a/testprogs/blackbox/functionalprep.sh ++++ b/testprogs/blackbox/functionalprep.sh +@@ -10,45 +10,56 @@ fi + PREFIX_ABS="$1" + shift 1 + ++failed=0 ++ + . `dirname $0`/subunit.sh ++. `dirname $0`/common_test_fns.inc + + RELEASE="release-4-8-0-pre1" +-release_dir=`dirname $0`/../../source4/selftest/provisions/$RELEASE ++release_dir="$SRCDIR_ABS/source4/selftest/provisions/$RELEASE" + + OLD_RELEASE="release-4-1-0rc3" +-old_release_dir=`dirname $0`/../../source4/selftest/provisions/$OLD_RELEASE ++old_release_dir="$SRCDIR_ABS/source4/selftest/provisions/$OLD_RELEASE" + +-cleanup_output_directories() +-{ +- if [ -d $PREFIX_ABS/2012R2_schema ]; then +- rm -fr $PREFIX_ABS/2012R2_schema +- fi ++samba_tdbrestore="tdbrestore" ++if [ -x "$BINDIR/tdbrestore" ]; then ++ samba_tdbrestore="$BINDIR/tdbrestore" ++fi ++ ++samba_undump="$SRCDIR_ABS/source4/selftest/provisions/undump.sh" ++ ++if [ ! -x $samba_undump ] || [ ! -d $release_dir ] || [ ! -d $old_release_dir ]; then ++ subunit_start_test $RELEASE ++ subunit_skip_test $RELEASE < +Date: Wed, 21 Oct 2020 18:03:25 +0200 +Subject: [PATCH 8/9] testprogs: Fix and improve dbcheck-oldrelease test + +This fixes running `make test` in a release tarball! + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14542 + +Signed-off-by: Andreas Schneider +--- + testprogs/blackbox/dbcheck-oldrelease.sh | 240 ++++++++++++----------- + 1 file changed, 123 insertions(+), 117 deletions(-) + +diff --git a/testprogs/blackbox/dbcheck-oldrelease.sh b/testprogs/blackbox/dbcheck-oldrelease.sh +index 41c55178d4e..9e9924654be 100755 +--- a/testprogs/blackbox/dbcheck-oldrelease.sh ++++ b/testprogs/blackbox/dbcheck-oldrelease.sh +@@ -11,7 +11,10 @@ PREFIX_ABS="$1" + RELEASE="$2" + shift 2 + ++failed=0 ++ + . `dirname $0`/subunit.sh ++. `dirname $0`/common_test_fns.inc + + release_dir=`dirname $0`/../../source4/selftest/provisions/$RELEASE + +@@ -30,13 +33,94 @@ if [ -x "$BINDIR/ldbsearch" ]; then + ldbsearch="$BINDIR/ldbsearch" + fi + ++samba_tdbrestore="tdbrestore" ++if [ -x "$BINDIR/tdbrestore" ]; then ++ samba_tdbrestore="$BINDIR/tdbrestore" ++fi ++ ++samba_undump="$SRCDIR_ABS/source4/selftest/provisions/undump.sh" ++if [ ! -x $samba_undump ] || [ ! -d $release_dir ]; then ++ subunit_start_test $RELEASE ++ subunit_skip_test $RELEASE < +Date: Wed, 21 Oct 2020 19:14:32 +0200 +Subject: [PATCH 9/9] testprogs: Fix and improve upgradeprovision-oldrelease + test + +This fixes running `make test` in a release tarball! + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14542 + +Signed-off-by: Andreas Schneider +--- + .../blackbox/upgradeprovision-oldrelease.sh | 254 +++++++++--------- + 1 file changed, 121 insertions(+), 133 deletions(-) + +diff --git a/testprogs/blackbox/upgradeprovision-oldrelease.sh b/testprogs/blackbox/upgradeprovision-oldrelease.sh +index 208baa54a02..5b095fca05e 100755 +--- a/testprogs/blackbox/upgradeprovision-oldrelease.sh ++++ b/testprogs/blackbox/upgradeprovision-oldrelease.sh +@@ -11,37 +11,113 @@ PREFIX_ABS="$1" + RELEASE="$2" + shift 2 + ++failed=0 ++ + . `dirname $0`/subunit.sh ++. `dirname $0`/common_test_fns.inc + +-release_dir=`dirname $0`/../../source4/selftest/provisions/${RELEASE} ++release_dir="$SRCDIR_ABS/source4/selftest/provisions/${RELEASE}" + + LDBDEL_BIN=ldbdel + if [ -x "$BINDIR/ldbdel" ]; then + LDBDEL_BIN=$BINDIR/ldbdel + fi + ++samba_tdbrestore="tdbrestore" ++if [ -x "$BINDIR/tdbrestore" ]; then ++ samba_tdbrestore="$BINDIR/tdbrestore" ++fi ++ ++samba_undump="$SRCDIR_ABS/source4/selftest/provisions/undump.sh" ++if [ ! -x $samba_undump ] || [ ! -d $release_dir ]; then ++ subunit_start_test "${RELEASE}" ++ subunit_skip_test "${RELEASE}" < $PREFIX_ABS/${RELEASE}_upgrade/etc/smb.conf +- +- cp -a $release_dir/private/*.keytab $PREFIX_ABS/${RELEASE}_upgrade_full/private/ +- cp -a $release_dir/sysvol $PREFIX_ABS/${RELEASE}_upgrade_full/ +- mkdir $PREFIX_ABS/${RELEASE}_upgrade_full/etc/ +- cat $release_dir/etc/smb.conf.template | \ +- sed "s|@@PREFIX@@|$PREFIX_ABS/${RELEASE}_upgrade_full|g" \ +- > $PREFIX_ABS/${RELEASE}_upgrade_full/etc/smb.conf ++ $samba_undump $release_dir $PREFIX_ABS/${RELEASE}_upgrade $samba_tdbrestore ++ $samba_undump $release_dir $PREFIX_ABS/${RELEASE}_upgrade_full $samba_tdbrestore ++ ++ cp -a $release_dir/private/*.keytab $PREFIX_ABS/${RELEASE}_upgrade/private/ ++ cp -a $release_dir/sysvol $PREFIX_ABS/${RELEASE}_upgrade/ ++ mkdir $PREFIX_ABS/${RELEASE}_upgrade/etc/ ++ sed -e "s|@@PREFIX@@|$PREFIX_ABS/${RELEASE}_upgrade|g" $release_dir/etc/smb.conf.template \ ++ > $PREFIX_ABS/${RELEASE}_upgrade/etc/smb.conf ++ ++ cp -a $release_dir/private/*.keytab $PREFIX_ABS/${RELEASE}_upgrade_full/private/ ++ cp -a $release_dir/sysvol $PREFIX_ABS/${RELEASE}_upgrade_full/ ++ mkdir $PREFIX_ABS/${RELEASE}_upgrade_full/etc/ ++ sed -e "s|@@PREFIX@@|$PREFIX_ABS/${RELEASE}_upgrade_full|g" $release_dir/etc/smb.conf.template \ ++ > $PREFIX_ABS/${RELEASE}_upgrade_full/etc/smb.conf + } + + remove_dns_user() { +@@ -122,116 +198,28 @@ ldapcmp_full_sd() { + $PYTHON $BINDIR/samba-tool ldapcmp tdb://$PREFIX_ABS/${RELEASE}_upgrade_reference/private/sam.ldb tdb://$PREFIX_ABS/${RELEASE}_upgrade_full/private/sam.ldb --two --sd --skip-missing-dn + } + +-if [ -d $PREFIX_ABS/${RELEASE}_upgrade ]; then +- rm -fr $PREFIX_ABS/${RELEASE}_upgrade +-fi +- +-if [ -d $PREFIX_ABS/${RELEASE}_upgrade_full ]; then +- rm -fr $PREFIX_ABS/${RELEASE}_upgrade_full +-fi +- +-if [ -d $PREFIX_ABS/${RELEASE}_upgrade_reference ]; then +- rm -fr $PREFIX_ABS/${RELEASE}_upgrade_reference +-fi +- +-if [ -d $release_dir ]; then +- testit $RELEASE undump +- testit "remove_dns_user" remove_dns_user +- testit "upgradeprovision" upgradeprovision +- testit "upgradeprovision_full" upgradeprovision_full +- testit "reindex" reindex +- testit_expect_failure "dbcheck" dbcheck +- testit_expect_failure "dbcheck_full" dbcheck_full +- testit "dbcheck_clean" dbcheck_clean +- testit "dbcheck_full_clean" dbcheck_full_clean +- testit "dbcheck_full_clean_well_known_acls" dbcheck_full_clean_well_known_acls +- testit "referenceprovision" referenceprovision +- testit "samba_upgradedns" samba_upgradedns +- testit "ldapcmp" ldapcmp +- testit "ldapcmp_sd" ldapcmp_sd +- testit "ldapcmp_full_sd" ldapcmp_full_sd +-else +- subunit_start_test "${RELEASE}" +- subunit_skip_test "${RELEASE}" < - 4.13.0-14 +- Fixed dbcheck running in a release tarball + * Sun Oct 25 2020 Alexander Bokovoy - 4.13.0-13 - Report 'samba' daemon status back to systemd - Support dnspython 2.0.0 or later in samba_dnsupdate From 04e828d22afef1a1fb9fb82141d93ddcd8c1e7db Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 22 Oct 2020 10:19:49 +0200 Subject: [PATCH 053/425] Update internal resolv_wrapper to 1.1.7 This fixes some Samba tests which redirect stderr to stdout and then get more messages than expected. --- 1528.patch | 66 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ samba.spec | 3 +++ 2 files changed, 69 insertions(+) create mode 100644 1528.patch diff --git a/1528.patch b/1528.patch new file mode 100644 index 0000000..52ecfab --- /dev/null +++ b/1528.patch @@ -0,0 +1,66 @@ +From e3629a3924107507be9ddb2c001f9843854ddf3b Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 25 Aug 2020 17:39:18 +0200 +Subject: [PATCH] third_party: Update resolv_wrapper to version 1.1.7 + +This fixes some Samba tests which redirect stderr to stdout and then get +more messages than expected. + +Signed-off-by: Andreas Schneider +--- + buildtools/wafsamba/samba_third_party.py | 2 +- + third_party/resolv_wrapper/resolv_wrapper.c | 4 ++-- + third_party/resolv_wrapper/wscript | 2 +- + 3 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/buildtools/wafsamba/samba_third_party.py b/buildtools/wafsamba/samba_third_party.py +index 318da4f4eff..bc2b21f2a55 100644 +--- a/buildtools/wafsamba/samba_third_party.py ++++ b/buildtools/wafsamba/samba_third_party.py +@@ -34,7 +34,7 @@ Build.BuildContext.CHECK_NSS_WRAPPER = CHECK_NSS_WRAPPER + + @conf + def CHECK_RESOLV_WRAPPER(conf): +- return conf.CHECK_BUNDLED_SYSTEM_PKG('resolv_wrapper', minversion='1.1.6') ++ return conf.CHECK_BUNDLED_SYSTEM_PKG('resolv_wrapper', minversion='1.1.7') + Build.BuildContext.CHECK_RESOLV_WRAPPER = CHECK_RESOLV_WRAPPER + + @conf +diff --git a/third_party/resolv_wrapper/resolv_wrapper.c b/third_party/resolv_wrapper/resolv_wrapper.c +index 0d3f34ce591..b69a55a80e0 100644 +--- a/third_party/resolv_wrapper/resolv_wrapper.c ++++ b/third_party/resolv_wrapper/resolv_wrapper.c +@@ -1844,7 +1844,7 @@ static int rwrap_parse_resolv_conf(struct __res_state *state, + + fp = fopen(resolv_conf, "r"); + if (fp == NULL) { +- RWRAP_LOG(RWRAP_LOG_ERROR, ++ RWRAP_LOG(RWRAP_LOG_WARN, + "Opening %s failed: %s", + resolv_conf, strerror(errno)); + return -1; +@@ -1930,7 +1930,7 @@ static int rwrap_parse_resolv_conf(struct __res_state *state, + fclose(fp); + + if (nserv == 0) { +- RWRAP_LOG(RWRAP_LOG_ERROR, ++ RWRAP_LOG(RWRAP_LOG_WARN, + "No usable nameservers found in %s", + resolv_conf); + errno = ESRCH; +diff --git a/third_party/resolv_wrapper/wscript b/third_party/resolv_wrapper/wscript +index ea3df498a6e..a7f18389b0f 100644 +--- a/third_party/resolv_wrapper/wscript ++++ b/third_party/resolv_wrapper/wscript +@@ -2,7 +2,7 @@ + + import os + +-VERSION="1.1.6" ++VERSION="1.1.7" + + def configure(conf): + if conf.CHECK_RESOLV_WRAPPER(): +-- +GitLab + diff --git a/samba.spec b/samba.spec index 132e267..864fbc5 100644 --- a/samba.spec +++ b/samba.spec @@ -147,6 +147,8 @@ Patch4: samba-systemd-notification.patch # Fix `make test` in release tarballs Patch5: https://gitlab.com/samba-team/samba/-/merge_requests/1624.patch +# Update resolv_wrapper to version 1.1.7 +Patch6: https://gitlab.com/samba-team/samba/-/merge_requests/1528.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -3635,6 +3637,7 @@ fi %changelog * Mon Oct 26 2020 Andreas Schneider - 4.13.0-14 - Fixed dbcheck running in a release tarball +- Updated internal resolv_wrapper copy to verison 1.1.7 * Sun Oct 25 2020 Alexander Bokovoy - 4.13.0-13 - Report 'samba' daemon status back to systemd From efa876d95a02913a341dfc94008f28127956e205 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 20 Oct 2020 14:18:49 +0200 Subject: [PATCH 054/425] Fix running --with testsuite --- 1635.patch | 197 +++++++++++++++++++++++++++++++++++++++++++++++++++++ samba.spec | 132 ++++++++++++++++++++++++++++++++++- 2 files changed, 326 insertions(+), 3 deletions(-) create mode 100644 1635.patch diff --git a/1635.patch b/1635.patch new file mode 100644 index 0000000..bf7ad11 --- /dev/null +++ b/1635.patch @@ -0,0 +1,197 @@ +From 0daa6a2bc688146f4e1d7b5604a6fe231f6d069e Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 22 Oct 2020 11:08:19 +0200 +Subject: [PATCH 1/5] s3:script: Fix test_dfree_quota.sh + +source3/script/tests/test_dfree_quota.sh: line 200: [: missing `]' + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14550 + +Signed-off-by: Andreas Schneider +--- + source3/script/tests/test_dfree_quota.sh | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/source3/script/tests/test_dfree_quota.sh b/source3/script/tests/test_dfree_quota.sh +index e86d431180a..a1403a8c4ba 100755 +--- a/source3/script/tests/test_dfree_quota.sh ++++ b/source3/script/tests/test_dfree_quota.sh +@@ -197,7 +197,7 @@ test_smbcquotas() { + return $status + } + +-if [ $protocol != "SMB3" -a $protocol != "NT1"]; then ++if [ $protocol != "SMB3" ] && [ $protocol != "NT1" ]; then + echo "unsupported protocol $protocol" | subunit_fail_test "Test dfree quota" + failed=`expr $failed + 1` + fi +-- +GitLab + + +From 4867cafe766fa8aa69ce005dc5c4f05a4af676c8 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 22 Oct 2020 17:40:01 +0200 +Subject: [PATCH 2/5] buildtools: Do not install binaries which are for + selftest + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14550 + +Signed-off-by: Andreas Schneider +--- + buildtools/wafsamba/wafsamba.py | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/buildtools/wafsamba/wafsamba.py b/buildtools/wafsamba/wafsamba.py +index 9f6ee4f5c7f..9dd6d05b91b 100644 +--- a/buildtools/wafsamba/wafsamba.py ++++ b/buildtools/wafsamba/wafsamba.py +@@ -365,8 +365,10 @@ def SAMBA_BINARY(bld, binname, source, + for_selftest=False): + '''define a Samba binary''' + +- if for_selftest and not bld.CONFIG_GET('ENABLE_SELFTEST'): +- enabled=False ++ if for_selftest: ++ install=False ++ if not bld.CONFIG_GET('ENABLE_SELFTEST'): ++ enabled=False + + if not enabled: + SET_TARGET_TYPE(bld, binname, 'DISABLED') +-- +GitLab + + +From a4d5a21880b1cc8adfcbebd6940d06e2fdab3f14 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 22 Oct 2020 17:41:01 +0200 +Subject: [PATCH 3/5] unittests: Mark test binaries for selftest + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14550 + +Signed-off-by: Andreas Schneider +--- + testsuite/unittests/wscript | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/testsuite/unittests/wscript b/testsuite/unittests/wscript +index 40fcb01ad57..2b4b37b92de 100644 +--- a/testsuite/unittests/wscript ++++ b/testsuite/unittests/wscript +@@ -9,7 +9,7 @@ def build(bld): + bld.SAMBA_BINARY('test_krb5samba', + source='test_krb5_samba.c', + deps='krb5samba cmocka', +- install=False) ++ for_selftest=True) + + bld.SAMBA_BINARY('test_sambafs_srv_pipe', + source='test_sambafs_srv_pipe.c', +@@ -18,7 +18,7 @@ def build(bld): + RPC_SAMR + cmocka + ''', +- install=False) ++ for_selftest=True) + + bld.SAMBA_BINARY('test_lib_util_modules', + source='test_lib_util_modules.c', +@@ -26,7 +26,7 @@ def build(bld): + samba-modules + cmocka + ''', +- install=False) ++ for_selftest=True) + + bld.SAMBA_MODULE('rpc_test_dummy_module', + source='rpc_test_dummy_module.c', +-- +GitLab + + +From d399761e8261a4de5ce9449f97ade61388e8a1e2 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Fri, 23 Oct 2020 08:53:43 +0200 +Subject: [PATCH 4/5] s3:modules: Do not install vfs modules only used for + testing + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14550 + +Signed-off-by: Andreas Schneider +--- + source3/modules/wscript_build | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/source3/modules/wscript_build b/source3/modules/wscript_build +index c4f3db22296..36b047ef79b 100644 +--- a/source3/modules/wscript_build ++++ b/source3/modules/wscript_build +@@ -114,7 +114,8 @@ bld.SAMBA3_MODULE('vfs_fake_acls', + deps='samba-util', + init_function='', + internal_module=bld.SAMBA3_IS_STATIC_MODULE('vfs_fake_acls'), +- enabled=bld.SAMBA3_IS_ENABLED_MODULE('vfs_fake_acls')) ++ enabled=bld.SAMBA3_IS_ENABLED_MODULE('vfs_fake_acls'), ++ install=False) + + bld.SAMBA3_MODULE('vfs_recycle', + subsystem='vfs', +@@ -622,21 +623,24 @@ bld.SAMBA3_MODULE('vfs_fake_dfq', + source='vfs_fake_dfq.c', + init_function='', + internal_module=bld.SAMBA3_IS_STATIC_MODULE('vfs_fake_dfq'), +- enabled=bld.SAMBA3_IS_ENABLED_MODULE('vfs_fake_dfq')) ++ enabled=bld.SAMBA3_IS_ENABLED_MODULE('vfs_fake_dfq'), ++ install=False) + + bld.SAMBA3_MODULE('vfs_error_inject', + subsystem='vfs', + source='vfs_error_inject.c', + init_function='', + internal_module=bld.SAMBA3_IS_STATIC_MODULE('vfs_error_inject'), +- enabled=bld.SAMBA3_IS_ENABLED_MODULE('vfs_error_inject')) ++ enabled=bld.SAMBA3_IS_ENABLED_MODULE('vfs_error_inject'), ++ install=False) + + bld.SAMBA3_MODULE('vfs_delay_inject', + subsystem='vfs', + source='vfs_delay_inject.c', + init_function='', + internal_module=bld.SAMBA3_IS_STATIC_MODULE('vfs_delay_inject'), +- enabled=bld.SAMBA3_IS_ENABLED_MODULE('vfs_delay_inject')) ++ enabled=bld.SAMBA3_IS_ENABLED_MODULE('vfs_delay_inject'), ++ install=False) + + bld.SAMBA3_MODULE('vfs_widelinks', + subsystem='vfs', +-- +GitLab + + +From 58e412ac6d9822aa65639d7c1171a2723ca3ee8a Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Fri, 23 Oct 2020 08:57:12 +0200 +Subject: [PATCH 5/5] examples:auth: Do not install example plugin + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14550 + +Signed-off-by: Andreas Schneider +--- + examples/auth/wscript_build | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/examples/auth/wscript_build b/examples/auth/wscript_build +index 91f5302918b..03221238e5f 100644 +--- a/examples/auth/wscript_build ++++ b/examples/auth/wscript_build +@@ -6,4 +6,5 @@ bld.SAMBA3_MODULE('auth_skel', + deps='samba-util', + init_function='', + internal_module=bld.SAMBA3_IS_STATIC_MODULE('auth_skel'), +- enabled=bld.SAMBA3_IS_ENABLED_MODULE('auth_skel')) ++ enabled=bld.SAMBA3_IS_ENABLED_MODULE('auth_skel'), ++ install=False) +-- +GitLab + diff --git a/samba.spec b/samba.spec index 864fbc5..9841740 100644 --- a/samba.spec +++ b/samba.spec @@ -2,10 +2,16 @@ # # To build and run the tests use: # -# rpmbuild --rebuild --with testsuite --without clustering samba.src.rpm +# rpmbuild --rebuild --with testsuite samba.src.rpm # %bcond_with testsuite +# Build with internal talloc, tevent, tdb and ldb. +# +# rpmbuild --rebuild --with=testsuite --with=includelibs samba.src.rpm +# +%bcond_with includelibs + # ctdb is enabled by default, you can disable it with: --without clustering %bcond_without clustering @@ -149,6 +155,8 @@ Patch4: samba-systemd-notification.patch Patch5: https://gitlab.com/samba-team/samba/-/merge_requests/1624.patch # Update resolv_wrapper to version 1.1.7 Patch6: https://gitlab.com/samba-team/samba/-/merge_requests/1528.patch +# Do not install test binaries for selftest +Patch7: https://gitlab.com/samba-team/samba/-/merge_requests/1635.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -267,6 +275,7 @@ BuildRequires: perl(ExtUtils::MakeMaker) BuildRequires: perl(FindBin) BuildRequires: perl(Parse::Yapp) +%if %{without testsuite} BuildRequires: libtalloc-devel >= %{talloc_version} BuildRequires: python3-talloc-devel >= %{talloc_version} @@ -278,6 +287,10 @@ BuildRequires: python3-tdb >= %{tdb_version} BuildRequires: libldb-devel >= %{ldb_version} BuildRequires: python3-ldb-devel >= %{ldb_version} +%else +BuildRequires: lmdb-devel +#endif without testsuite +%endif %if %{with dc} || %{with testsuite} BuildRequires: bind @@ -840,22 +853,31 @@ xzcat %{SOURCE0} | gpgv2 --quiet --keyring %{SOURCE2} %{SOURCE1} - %autosetup -n samba-%{version}%{pre_release} -p1 %build +%if %{with includelibs} %global _talloc_lib ,talloc,pytalloc,pytalloc-util %global _tevent_lib ,tevent,pytevent %global _tdb_lib ,tdb,pytdb %global _ldb_lib ,ldb,pyldb,pyldb-util - +%else %global _talloc_lib ,!talloc,!pytalloc,!pytalloc-util %global _tevent_lib ,!tevent,!pytevent %global _tdb_lib ,!tdb,!pytdb %global _ldb_lib ,!ldb,!pyldb,!pyldb-util +#endif with includelibs +%endif %global _samba_libraries !zlib,!popt%{_talloc_lib}%{_tevent_lib}%{_tdb_lib}%{_ldb_lib} %global _samba_idmap_modules idmap_ad,idmap_rid,idmap_ldap,idmap_hash,idmap_tdb2 %global _samba_pdb_modules pdb_tdbsam,pdb_ldap,pdb_smbpasswd,pdb_wbc_sam,pdb_samba4 + +%if %{with testsuite} +%global _samba_auth_modules auth_wbc,auth_unix,auth_server,auth_samba4,auth_skel +%global _samba_vfs_modules vfs_dfs_samba4,vfs_fake_dfq +%else %global _samba_auth_modules auth_wbc,auth_unix,auth_server,auth_samba4 %global _samba_vfs_modules vfs_dfs_samba4 +%endif %global _samba_modules %{_samba_idmap_modules},%{_samba_pdb_modules},%{_samba_auth_modules},%{_samba_vfs_modules} @@ -1104,6 +1126,11 @@ done #endif without dc %endif +%if %{with testsuite} +rm -f %{buildroot}%{_mandir}/man8/vfs_nfs4acl_xattr.8* +#endif with testsuite +%endif + pushd pidl make DESTDIR=%{buildroot} install_vendor @@ -1116,7 +1143,26 @@ popd %if %{with testsuite} %check -TDB_NO_FSYNC=1 %make_build test FAIL_IMMEDIATELY=1 +# +# samba3.smb2.timestamps.*: +# +# The test fails on ext4 as it uses two high-order bits +# in the timestamp so the year 2038 problem is deferred till 2446. +# https://bugzilla.samba.org/show_bug.cgi?id=14546 +# +for t in samba3.smb2.timestamps.time_t_15032385535 \ + samba3.smb2.timestamps.time_t_10000000000 \ + samba3.smb2.timestamps.time_t_4294967295 \ + ; do + echo "^$t" >> selftest/knownfail.d/fedora.%{dist} +done +cat selftest/knownfail.d/fedora.%{dist} + +export TDB_NO_FSYNC=1 +export NMBD_DONT_LOG_STDOUT=1 +export SMBD_DONT_LOG_STDOUT=1 +export WINBINDD_DONT_LOG_STDOUT=1 +make %{?_smp_mflags} test FAIL_IMMEDIATELY=1 #endif with testsuite %endif @@ -1349,6 +1395,10 @@ fi %{_libdir}/samba/vfs/worm.so %{_libdir}/samba/vfs/xattr_tdb.so +%if %{with testsuite} +%{_libdir}/samba/vfs/nfs4acl_xattr.so +%endif + %dir %{_datadir}/samba %dir %{_datadir}/samba/mdssvc %{_datadir}/samba/mdssvc/elasticsearch_mappings.json @@ -1462,6 +1512,31 @@ fi %{_mandir}/man8/samba-regedit.8* %{_mandir}/man8/smbspool.8* +%if %{with includelibs} +%{_bindir}/ldbadd +%{_bindir}/ldbdel +%{_bindir}/ldbedit +%{_bindir}/ldbmodify +%{_bindir}/ldbrename +%{_bindir}/ldbsearch +%{_bindir}/tdbbackup +%{_bindir}/tdbdump +%{_bindir}/tdbrestore +%{_bindir}/tdbtool + +%{_mandir}/man1/ldbadd.1.gz +%{_mandir}/man1/ldbdel.1.gz +%{_mandir}/man1/ldbedit.1.gz +%{_mandir}/man1/ldbmodify.1.gz +%{_mandir}/man1/ldbrename.1.gz +%{_mandir}/man1/ldbsearch.1.gz +%{_mandir}/man8/tdbbackup.8.gz +%{_mandir}/man8/tdbdump.8.gz +%{_mandir}/man8/tdbrestore.8.gz +%{_mandir}/man8/tdbtool.8.gz +#endif with includelibs +%endif + ### CLIENT-LIBS %files client-libs %{_libdir}/libdcerpc-binding.so.* @@ -1576,6 +1651,18 @@ fi #endif without libsmbclient %endif +%if %{with includelibs} +%{_libdir}/samba/libldb-*.so +%{_libdir}/samba/libldb.so.* +%{_libdir}/samba/libtalloc.so.* +%{_libdir}/samba/libtdb.so.* +%{_libdir}/samba/libtevent.so.* + +%{_mandir}/man3/ldb.3.gz +%{_mandir}/man3/talloc.3.gz +#endif with includelibs +%endif + ### COMMON %files common %{_tmpfilesdir}/samba.conf @@ -1691,6 +1778,20 @@ fi %{_libdir}/samba/ldb/update_keytab.so %{_libdir}/samba/ldb/vlv.so %{_libdir}/samba/ldb/wins_ldb.so + +%if %{with includelibs} +%{_libdir}/samba/ldb/asq.so +%{_libdir}/samba/ldb/ldb.so +%{_libdir}/samba/ldb/mdb.so +%{_libdir}/samba/ldb/paged_searches.so +%{_libdir}/samba/ldb/rdn_name.so +%{_libdir}/samba/ldb/sample.so +%{_libdir}/samba/ldb/server_sort.so +%{_libdir}/samba/ldb/skel.so +%{_libdir}/samba/ldb/tdb.so +#endif with includelibs +%endif + %{_libdir}/samba/vfs/posix_eadb.so %dir /var/lib/samba/sysvol %{_mandir}/man8/samba.8* @@ -1711,6 +1812,11 @@ fi %{_libdir}/samba/libdb-glue-samba4.so %{_libdir}/samba/libprocess-model-samba4.so %{_libdir}/samba/libservice-samba4.so + +%if %{with testsuite} +%{_libdir}/samba/libntvfs-samba4.so +%endif + %dir %{_libdir}/samba/process_model %{_libdir}/samba/process_model/prefork.so %{_libdir}/samba/process_model/standard.so @@ -1728,6 +1834,11 @@ fi %{_libdir}/samba/service/s3fs.so %{_libdir}/samba/service/winbindd.so %{_libdir}/samba/service/wrepl.so + +%if %{with testsuite} +%{_libdir}/samba/service/smb.so +%endif + %{_libdir}/libdcerpc-server.so.* %{_libdir}/samba/libdnsserver-common-samba4.so %{_libdir}/samba/libdsdb-module-samba4.so @@ -2227,6 +2338,21 @@ fi %{_libdir}/samba/libsamba-net.*-samba4.so %{_libdir}/samba/libsamba-python.*-samba4.so +%if %{with testsuite} +%{_libdir}/samba/libpyldb-util.*.so.* + +%{python3_sitearch}/__pycache__/_ldb_text*.pyc +%{python3_sitearch}/__pycache__/_tdb_text*.pyc +%{python3_sitearch}/__pycache__/tevent*.pyc +%{python3_sitearch}/_ldb_text.py +%{python3_sitearch}/_tdb_text.py +%{python3_sitearch}/_tevent.cpython*.so +%{python3_sitearch}/ldb.cpython*.so +%{python3_sitearch}/tdb.cpython*.so +%{python3_sitearch}/tevent.py +#endif with testsuite +%endif + %if %{with dc} || %{with testsuite} %files -n python3-%{name}-dc %{python3_sitearch}/samba/samdb.py From b44802fb9c78aa9c179d6d0a15070168345501b8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 29 Oct 2020 10:11:56 +0100 Subject: [PATCH 055/425] Update to Samba 4.13.1 resolves: #1892631, #1892634 - Security fixes for CVE-2020-14318 resolves: #1891685, #1892628 - Security fixes for CVE-2020-14323 resolves: #1892636, #1892640 - Security fixes for CVE-2020-14383 Guenther --- .gitignore | 2 ++ samba.spec | 10 ++++++++-- sources | 4 ++-- 3 files changed, 12 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 78dd1f3..474af1a 100644 --- a/.gitignore +++ b/.gitignore @@ -223,3 +223,5 @@ samba-3.6.0pre1.tar.gz /samba-4.13.0rc6.tar.asc /samba-4.13.0.tar.xz /samba-4.13.0.tar.asc +/samba-4.13.1.tar.xz +/samba-4.13.1.tar.asc diff --git a/samba.spec b/samba.spec index 9841740..7d11a1c 100644 --- a/samba.spec +++ b/samba.spec @@ -78,9 +78,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global main_release 14 +%global main_release 0 -%global samba_version 4.13.0 +%global samba_version 4.13.1 %global talloc_version 2.3.1 %global tdb_version 1.4.3 %global tevent_version 0.10.2 @@ -3761,6 +3761,12 @@ fi %endif %changelog +* Thu Oct 29 2020 Guenther Deschner - 4.13.1-0 +- Update to Samba 4.13.1 +- resolves: #1892631, #1892634 - Security fixes for CVE-2020-14318 +- resolves: #1891685, #1892628 - Security fixes for CVE-2020-14323 +- resolves: #1892636, #1892640 - Security fixes for CVE-2020-14383 + * Mon Oct 26 2020 Andreas Schneider - 4.13.0-14 - Fixed dbcheck running in a release tarball - Updated internal resolv_wrapper copy to verison 1.1.7 diff --git a/sources b/sources index 36e8498..3dda01b 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.13.0.tar.xz) = 38370adfad7b7a9a8633d48782f0bcf812299858be20770d2e3406c7f450a2fd1ae646e2a143d22ce3c5ac22d54c4a229b019686ff2f16ca503c958d4afed825 -SHA512 (samba-4.13.0.tar.asc) = 7f71d1402d752cbdb09ec9e2539d35347c4025c332c4acb8590d5cab190b2b23bc2b1f99f3d66c3488bbdb6898528dd78e3893c33c92e3d9167236e8048dfbf2 +SHA512 (samba-4.13.1.tar.xz) = 251664d53eb4a53509a3032d3519b11ddd07231887ec7a1965d20bae92bb03e0dc63898aef0bb7565de66c77e9cbc34fcf42a078190c97425c3662c5da4d5480 +SHA512 (samba-4.13.1.tar.asc) = 1ead1ae10f4d25a1f43842e31eb24ecfa1e0076b48a8b7c57d9286f7162d4b0c12cf29de6526447f16c60e04cb5f07105bdc0b48a51d72e63cc8cc9fe7782b01 From 5f0457d04233e91f8551598c31720be4d158273e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 3 Nov 2020 11:11:51 +0100 Subject: [PATCH 056/425] Update to Samba 4.13.2 Guenther --- .gitignore | 2 ++ samba.spec | 5 ++++- sources | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 474af1a..6578c2a 100644 --- a/.gitignore +++ b/.gitignore @@ -225,3 +225,5 @@ samba-3.6.0pre1.tar.gz /samba-4.13.0.tar.asc /samba-4.13.1.tar.xz /samba-4.13.1.tar.asc +/samba-4.13.2.tar.xz +/samba-4.13.2.tar.asc diff --git a/samba.spec b/samba.spec index 7d11a1c..b2d2670 100644 --- a/samba.spec +++ b/samba.spec @@ -80,7 +80,7 @@ %global main_release 0 -%global samba_version 4.13.1 +%global samba_version 4.13.2 %global talloc_version 2.3.1 %global tdb_version 1.4.3 %global tevent_version 0.10.2 @@ -3761,6 +3761,9 @@ fi %endif %changelog +* Tue Nov 03 2020 Guenther Deschner - 4.13.2-0 +- Update to Samba 4.13.2 + * Thu Oct 29 2020 Guenther Deschner - 4.13.1-0 - Update to Samba 4.13.1 - resolves: #1892631, #1892634 - Security fixes for CVE-2020-14318 diff --git a/sources b/sources index 3dda01b..b1e4a0b 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.13.1.tar.xz) = 251664d53eb4a53509a3032d3519b11ddd07231887ec7a1965d20bae92bb03e0dc63898aef0bb7565de66c77e9cbc34fcf42a078190c97425c3662c5da4d5480 -SHA512 (samba-4.13.1.tar.asc) = 1ead1ae10f4d25a1f43842e31eb24ecfa1e0076b48a8b7c57d9286f7162d4b0c12cf29de6526447f16c60e04cb5f07105bdc0b48a51d72e63cc8cc9fe7782b01 +SHA512 (samba-4.13.2.tar.xz) = c5d1c4b74b458ab6da9314540043edb8129a17870a9a335fb26bbdaf194aeae647aa3d6cdc00fd4487fd459c123cc8feecb58d02633515c62f00287b652a502b +SHA512 (samba-4.13.2.tar.asc) = 07cce2f4f5130c56548ea14193b3d829dac7926141da56f7e1624fd48f73afcd875af6eaae0ce56396d5b23837b3bc7e3518f569d581afd6c5ee1dc7d49a8eb7 From 19efd0180f9d68348516f032bd93d7524400cfe8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 3 Nov 2020 13:49:44 +0100 Subject: [PATCH 057/425] Remove obsolete patches Guenther --- 1528.patch | 66 -- 1624.patch | 1389 ----------------------------- 1635.patch | 197 ---- samba-dnspython-2.0.0-v4.13.patch | 143 --- samba-systemd-notification.patch | 118 --- samba.spec | 9 - 6 files changed, 1922 deletions(-) delete mode 100644 1528.patch delete mode 100644 1624.patch delete mode 100644 1635.patch delete mode 100644 samba-dnspython-2.0.0-v4.13.patch delete mode 100644 samba-systemd-notification.patch diff --git a/1528.patch b/1528.patch deleted file mode 100644 index 52ecfab..0000000 --- a/1528.patch +++ /dev/null @@ -1,66 +0,0 @@ -From e3629a3924107507be9ddb2c001f9843854ddf3b Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Tue, 25 Aug 2020 17:39:18 +0200 -Subject: [PATCH] third_party: Update resolv_wrapper to version 1.1.7 - -This fixes some Samba tests which redirect stderr to stdout and then get -more messages than expected. - -Signed-off-by: Andreas Schneider ---- - buildtools/wafsamba/samba_third_party.py | 2 +- - third_party/resolv_wrapper/resolv_wrapper.c | 4 ++-- - third_party/resolv_wrapper/wscript | 2 +- - 3 files changed, 4 insertions(+), 4 deletions(-) - -diff --git a/buildtools/wafsamba/samba_third_party.py b/buildtools/wafsamba/samba_third_party.py -index 318da4f4eff..bc2b21f2a55 100644 ---- a/buildtools/wafsamba/samba_third_party.py -+++ b/buildtools/wafsamba/samba_third_party.py -@@ -34,7 +34,7 @@ Build.BuildContext.CHECK_NSS_WRAPPER = CHECK_NSS_WRAPPER - - @conf - def CHECK_RESOLV_WRAPPER(conf): -- return conf.CHECK_BUNDLED_SYSTEM_PKG('resolv_wrapper', minversion='1.1.6') -+ return conf.CHECK_BUNDLED_SYSTEM_PKG('resolv_wrapper', minversion='1.1.7') - Build.BuildContext.CHECK_RESOLV_WRAPPER = CHECK_RESOLV_WRAPPER - - @conf -diff --git a/third_party/resolv_wrapper/resolv_wrapper.c b/third_party/resolv_wrapper/resolv_wrapper.c -index 0d3f34ce591..b69a55a80e0 100644 ---- a/third_party/resolv_wrapper/resolv_wrapper.c -+++ b/third_party/resolv_wrapper/resolv_wrapper.c -@@ -1844,7 +1844,7 @@ static int rwrap_parse_resolv_conf(struct __res_state *state, - - fp = fopen(resolv_conf, "r"); - if (fp == NULL) { -- RWRAP_LOG(RWRAP_LOG_ERROR, -+ RWRAP_LOG(RWRAP_LOG_WARN, - "Opening %s failed: %s", - resolv_conf, strerror(errno)); - return -1; -@@ -1930,7 +1930,7 @@ static int rwrap_parse_resolv_conf(struct __res_state *state, - fclose(fp); - - if (nserv == 0) { -- RWRAP_LOG(RWRAP_LOG_ERROR, -+ RWRAP_LOG(RWRAP_LOG_WARN, - "No usable nameservers found in %s", - resolv_conf); - errno = ESRCH; -diff --git a/third_party/resolv_wrapper/wscript b/third_party/resolv_wrapper/wscript -index ea3df498a6e..a7f18389b0f 100644 ---- a/third_party/resolv_wrapper/wscript -+++ b/third_party/resolv_wrapper/wscript -@@ -2,7 +2,7 @@ - - import os - --VERSION="1.1.6" -+VERSION="1.1.7" - - def configure(conf): - if conf.CHECK_RESOLV_WRAPPER(): --- -GitLab - diff --git a/1624.patch b/1624.patch deleted file mode 100644 index 124c239..0000000 --- a/1624.patch +++ /dev/null @@ -1,1389 +0,0 @@ -From 9cf2118afce0b1534c0daea4ab97f29225f7fcb1 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Wed, 21 Oct 2020 07:43:08 +0200 -Subject: [PATCH 1/9] python: Create targetdir recursively - -This fixes `make test` in a release tarball. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14542 - -Signed-off-by: Andreas Schneider ---- - python/samba/netcmd/domain.py | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/python/samba/netcmd/domain.py b/python/samba/netcmd/domain.py -index 000688f4e7a..5f08ddf6007 100644 ---- a/python/samba/netcmd/domain.py -+++ b/python/samba/netcmd/domain.py -@@ -445,7 +445,7 @@ class cmd_domain_provision(Command): - - if targetdir is not None: - if not os.path.isdir(targetdir): -- os.mkdir(targetdir) -+ os.makedirs(targetdir) - - eadb = True - --- -GitLab - - -From f69a5a15550a2330710ba09e06daf826deedeb34 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Thu, 22 Oct 2020 11:39:04 +0200 -Subject: [PATCH 2/9] testprogs: Add remove_directory to common test functions - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14542 - -Signed-off-by: Andreas Schneider ---- - testprogs/blackbox/common_test_fns.inc | 11 +++++++++++ - 1 file changed, 11 insertions(+) - -diff --git a/testprogs/blackbox/common_test_fns.inc b/testprogs/blackbox/common_test_fns.inc -index a5611c63fa0..7b421e9eb08 100755 ---- a/testprogs/blackbox/common_test_fns.inc -+++ b/testprogs/blackbox/common_test_fns.inc -@@ -107,3 +107,14 @@ kerberos_kinit() { - fi - return $status - } -+ -+remove_directory() { -+ local xdir=${1} -+ shift -+ -+ if [ "$xdir" == "/" ] || [ ! -d "$xdir" ] || [ ! $(ls -A "$xdir") ]; then -+ return -+ fi -+ -+ rm -rf "$xdir" -+} --- -GitLab - - -From 5c65e1a9e99d9dcfadb90433b2465db277814666 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Tue, 20 Oct 2020 20:47:43 +0200 -Subject: [PATCH 3/9] testprogs: Fix and improve demote-saveddb test - -This fixes running `make test` in a release tarball! - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14542 - -Signed-off-by: Andreas Schneider ---- - testprogs/blackbox/demote-saveddb.sh | 75 ++++++++++++++++------------ - 1 file changed, 43 insertions(+), 32 deletions(-) - -diff --git a/testprogs/blackbox/demote-saveddb.sh b/testprogs/blackbox/demote-saveddb.sh -index 3d5fabd72e3..d8fccf32011 100755 ---- a/testprogs/blackbox/demote-saveddb.sh -+++ b/testprogs/blackbox/demote-saveddb.sh -@@ -10,58 +10,69 @@ fi - PREFIX_ABS="$1" - shift 1 - --. `dirname $0`/subunit.sh -+failed=0 - --tree_dir=`dirname $0`/../../source4/selftest/provisions/multi-dc-samba-master-c596ac6 -+. `dirname $0`/subunit.sh -+. `dirname $0`/common_test_fns.inc - --undump() { -- if test -x $BINDIR/tdbrestore; -- then -- `dirname $0`/../../source4/selftest/provisions/undump.sh $tree_dir $PREFIX_ABS $BINDIR/tdbrestore -- else -- `dirname $0`/../../source4/selftest/provisions/undump.sh $tree_dir $PREFIX_ABS -- fi --} -+samba_tree_dir="$SRCDIR_ABS/source4/selftest/provisions/multi-dc-samba-master-c596ac6" - --demote() { -- $PYTHON $BINDIR/samba-tool domain demote -H tdb://$PREFIX_ABS/private/sam.ldb --remove-other-dead-server=$1 --} -+samba_tdbrestore="tdbrestore" -+if [ -x $BINDIR/tdbrestore ]; then -+ samba_tdbrestore="$BINDIR/tdbrestore" -+fi - -+# The undump script and the provision data is not part of release tarballs, -+# skip the tests in this case! -+samba_undump="$SRCDIR_ABS/source4/selftest/provisions/undump.sh" -+if [ ! -x $samba_undump ] || [ ! -d $samba_tree_dir ]; then -+ subunit_start_test "undump" -+ subunit_skip_test "undump" < -Date: Wed, 21 Oct 2020 17:04:12 +0200 -Subject: [PATCH 4/9] testprogs: Fix and improve tombstones-expunge test - -This fixes running `make test` in a release tarball! - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14542 - -Signed-off-by: Andreas Schneider ---- - testprogs/blackbox/tombstones-expunge.sh | 94 +++++++++++++----------- - 1 file changed, 50 insertions(+), 44 deletions(-) - -diff --git a/testprogs/blackbox/tombstones-expunge.sh b/testprogs/blackbox/tombstones-expunge.sh -index aa37cfe278f..9e0588377d7 100755 ---- a/testprogs/blackbox/tombstones-expunge.sh -+++ b/testprogs/blackbox/tombstones-expunge.sh -@@ -11,9 +11,12 @@ PREFIX_ABS="$1" - RELEASE="$2" - shift 2 - -+failed=0 -+ - . `dirname $0`/subunit.sh -+. `dirname $0`/common_test_fns.inc - --release_dir=`dirname $0`/../../source4/selftest/provisions/$RELEASE -+release_dir="$SRCDIR_ABS/source4/selftest/provisions/$RELEASE" - - ldbadd="ldbadd" - if [ -x "$BINDIR/ldbadd" ]; then -@@ -35,13 +38,28 @@ if [ -x "$BINDIR/ldbsearch" ]; then - ldbsearch="$BINDIR/ldbsearch" - fi - -+samba_tdbrestore="tdbrestore" -+if [ -x "$BINDIR/tdbrestore" ]; then -+ samba_tdbrestore="$BINDIR/tdbrestore" -+fi -+ -+samba_undump="$SRCDIR_ABS/source4/selftest/provisions/undump.sh" -+if [ ! -x $samba_undump ] || [ ! -d $release_dir ]; then -+ subunit_start_test $RELEASE -+ subunit_skip_test $RELEASE < -Date: Wed, 21 Oct 2020 17:35:34 +0200 -Subject: [PATCH 5/9] testprogs: Fix and improve runtime-links test - -This fixes running `make test` in a release tarball! - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14542 - -Signed-off-by: Andreas Schneider ---- - testprogs/blackbox/common-links.sh | 16 +++---- - testprogs/blackbox/runtime-links.sh | 65 ++++++++++++++++------------- - 2 files changed, 44 insertions(+), 37 deletions(-) - -diff --git a/testprogs/blackbox/common-links.sh b/testprogs/blackbox/common-links.sh -index ee7310b5108..363234ae11c 100644 ---- a/testprogs/blackbox/common-links.sh -+++ b/testprogs/blackbox/common-links.sh -@@ -1,4 +1,4 @@ --release_dir=`dirname $0`/../../source4/selftest/provisions/$RELEASE -+release_dir=$SRCDIR_ABS/source4/selftest/provisions/$RELEASE - - ldbadd="ldbadd" - if [ -x "$BINDIR/ldbadd" ]; then -@@ -25,13 +25,15 @@ if [ -x "$BINDIR/ldbrename" ]; then - ldbrename="$BINDIR/ldbrename" - fi - -+samba_tdbrestore="tdbrestore" -+if [ -x "$BINDIR/tdbrestore" ]; then -+ samba_tdbrestore="$BINDIR/tdbrestore" -+fi -+ -+samba_undump="$SRCDIR_ABS/source4/selftest/provisions/undump.sh" -+ - undump() { -- if test -x $BINDIR/tdbrestore; -- then -- `dirname $0`/../../source4/selftest/provisions/undump.sh $release_dir $PREFIX_ABS/$RELEASE $BINDIR/tdbrestore -- else -- `dirname $0`/../../source4/selftest/provisions/undump.sh $release_dir $PREFIX_ABS/$RELEASE -- fi -+ $samba_undump $release_dir $PREFIX_ABS/$RELEASE $samba_tdbrestore - } - - add_dangling_link() { -diff --git a/testprogs/blackbox/runtime-links.sh b/testprogs/blackbox/runtime-links.sh -index 344b822f07e..f8de66c60e7 100755 ---- a/testprogs/blackbox/runtime-links.sh -+++ b/testprogs/blackbox/runtime-links.sh -@@ -11,10 +11,28 @@ PREFIX_ABS="$1" - RELEASE="$2" - shift 2 - -+failed=0 -+ - . `dirname $0`/subunit.sh - - . `dirname $0`/common-links.sh - -+. `dirname $0`/common_test_fns.inc -+ -+if [ ! -x $samba_undump ] || [ ! -d $release_dir ]; then -+ subunit_start_test $RELEASE -+ subunit_skip_test $RELEASE < -Date: Wed, 21 Oct 2020 17:41:27 +0200 -Subject: [PATCH 6/9] testprogs: Fix and improve dbcheck-links test - -This fixes running `make test` in a release tarball! - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14542 - -Signed-off-by: Andreas Schneider ---- - testprogs/blackbox/dbcheck-links.sh | 160 ++++++++++++++-------------- - 1 file changed, 82 insertions(+), 78 deletions(-) - -diff --git a/testprogs/blackbox/dbcheck-links.sh b/testprogs/blackbox/dbcheck-links.sh -index eb0e0b3163f..ead59d691e0 100755 ---- a/testprogs/blackbox/dbcheck-links.sh -+++ b/testprogs/blackbox/dbcheck-links.sh -@@ -14,6 +14,23 @@ shift 2 - . `dirname $0`/subunit.sh - - . `dirname $0`/common-links.sh -+. `dirname $0`/common_test_fns.inc -+ -+failed=0 -+ -+if [ ! -x $samba_undump ] || [ ! -d $release_dir ]; then -+ subunit_start_test $RELEASE -+ subunit_skip_test $RELEASE < -Date: Wed, 21 Oct 2020 17:54:54 +0200 -Subject: [PATCH 7/9] testprogs: Fix and improve functionalprep test - -This fixes running `make test` in a release tarball! - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14542 - -Signed-off-by: Andreas Schneider ---- - testprogs/blackbox/functionalprep.sh | 77 ++++++++++++++++------------ - 1 file changed, 44 insertions(+), 33 deletions(-) - -diff --git a/testprogs/blackbox/functionalprep.sh b/testprogs/blackbox/functionalprep.sh -index 1d37611ef7a..a5ac4b8bc7f 100755 ---- a/testprogs/blackbox/functionalprep.sh -+++ b/testprogs/blackbox/functionalprep.sh -@@ -10,45 +10,56 @@ fi - PREFIX_ABS="$1" - shift 1 - -+failed=0 -+ - . `dirname $0`/subunit.sh -+. `dirname $0`/common_test_fns.inc - - RELEASE="release-4-8-0-pre1" --release_dir=`dirname $0`/../../source4/selftest/provisions/$RELEASE -+release_dir="$SRCDIR_ABS/source4/selftest/provisions/$RELEASE" - - OLD_RELEASE="release-4-1-0rc3" --old_release_dir=`dirname $0`/../../source4/selftest/provisions/$OLD_RELEASE -+old_release_dir="$SRCDIR_ABS/source4/selftest/provisions/$OLD_RELEASE" - --cleanup_output_directories() --{ -- if [ -d $PREFIX_ABS/2012R2_schema ]; then -- rm -fr $PREFIX_ABS/2012R2_schema -- fi -+samba_tdbrestore="tdbrestore" -+if [ -x "$BINDIR/tdbrestore" ]; then -+ samba_tdbrestore="$BINDIR/tdbrestore" -+fi -+ -+samba_undump="$SRCDIR_ABS/source4/selftest/provisions/undump.sh" -+ -+if [ ! -x $samba_undump ] || [ ! -d $release_dir ] || [ ! -d $old_release_dir ]; then -+ subunit_start_test $RELEASE -+ subunit_skip_test $RELEASE < -Date: Wed, 21 Oct 2020 18:03:25 +0200 -Subject: [PATCH 8/9] testprogs: Fix and improve dbcheck-oldrelease test - -This fixes running `make test` in a release tarball! - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14542 - -Signed-off-by: Andreas Schneider ---- - testprogs/blackbox/dbcheck-oldrelease.sh | 240 ++++++++++++----------- - 1 file changed, 123 insertions(+), 117 deletions(-) - -diff --git a/testprogs/blackbox/dbcheck-oldrelease.sh b/testprogs/blackbox/dbcheck-oldrelease.sh -index 41c55178d4e..9e9924654be 100755 ---- a/testprogs/blackbox/dbcheck-oldrelease.sh -+++ b/testprogs/blackbox/dbcheck-oldrelease.sh -@@ -11,7 +11,10 @@ PREFIX_ABS="$1" - RELEASE="$2" - shift 2 - -+failed=0 -+ - . `dirname $0`/subunit.sh -+. `dirname $0`/common_test_fns.inc - - release_dir=`dirname $0`/../../source4/selftest/provisions/$RELEASE - -@@ -30,13 +33,94 @@ if [ -x "$BINDIR/ldbsearch" ]; then - ldbsearch="$BINDIR/ldbsearch" - fi - -+samba_tdbrestore="tdbrestore" -+if [ -x "$BINDIR/tdbrestore" ]; then -+ samba_tdbrestore="$BINDIR/tdbrestore" -+fi -+ -+samba_undump="$SRCDIR_ABS/source4/selftest/provisions/undump.sh" -+if [ ! -x $samba_undump ] || [ ! -d $release_dir ]; then -+ subunit_start_test $RELEASE -+ subunit_skip_test $RELEASE < -Date: Wed, 21 Oct 2020 19:14:32 +0200 -Subject: [PATCH 9/9] testprogs: Fix and improve upgradeprovision-oldrelease - test - -This fixes running `make test` in a release tarball! - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14542 - -Signed-off-by: Andreas Schneider ---- - .../blackbox/upgradeprovision-oldrelease.sh | 254 +++++++++--------- - 1 file changed, 121 insertions(+), 133 deletions(-) - -diff --git a/testprogs/blackbox/upgradeprovision-oldrelease.sh b/testprogs/blackbox/upgradeprovision-oldrelease.sh -index 208baa54a02..5b095fca05e 100755 ---- a/testprogs/blackbox/upgradeprovision-oldrelease.sh -+++ b/testprogs/blackbox/upgradeprovision-oldrelease.sh -@@ -11,37 +11,113 @@ PREFIX_ABS="$1" - RELEASE="$2" - shift 2 - -+failed=0 -+ - . `dirname $0`/subunit.sh -+. `dirname $0`/common_test_fns.inc - --release_dir=`dirname $0`/../../source4/selftest/provisions/${RELEASE} -+release_dir="$SRCDIR_ABS/source4/selftest/provisions/${RELEASE}" - - LDBDEL_BIN=ldbdel - if [ -x "$BINDIR/ldbdel" ]; then - LDBDEL_BIN=$BINDIR/ldbdel - fi - -+samba_tdbrestore="tdbrestore" -+if [ -x "$BINDIR/tdbrestore" ]; then -+ samba_tdbrestore="$BINDIR/tdbrestore" -+fi -+ -+samba_undump="$SRCDIR_ABS/source4/selftest/provisions/undump.sh" -+if [ ! -x $samba_undump ] || [ ! -d $release_dir ]; then -+ subunit_start_test "${RELEASE}" -+ subunit_skip_test "${RELEASE}" < $PREFIX_ABS/${RELEASE}_upgrade/etc/smb.conf -- -- cp -a $release_dir/private/*.keytab $PREFIX_ABS/${RELEASE}_upgrade_full/private/ -- cp -a $release_dir/sysvol $PREFIX_ABS/${RELEASE}_upgrade_full/ -- mkdir $PREFIX_ABS/${RELEASE}_upgrade_full/etc/ -- cat $release_dir/etc/smb.conf.template | \ -- sed "s|@@PREFIX@@|$PREFIX_ABS/${RELEASE}_upgrade_full|g" \ -- > $PREFIX_ABS/${RELEASE}_upgrade_full/etc/smb.conf -+ $samba_undump $release_dir $PREFIX_ABS/${RELEASE}_upgrade $samba_tdbrestore -+ $samba_undump $release_dir $PREFIX_ABS/${RELEASE}_upgrade_full $samba_tdbrestore -+ -+ cp -a $release_dir/private/*.keytab $PREFIX_ABS/${RELEASE}_upgrade/private/ -+ cp -a $release_dir/sysvol $PREFIX_ABS/${RELEASE}_upgrade/ -+ mkdir $PREFIX_ABS/${RELEASE}_upgrade/etc/ -+ sed -e "s|@@PREFIX@@|$PREFIX_ABS/${RELEASE}_upgrade|g" $release_dir/etc/smb.conf.template \ -+ > $PREFIX_ABS/${RELEASE}_upgrade/etc/smb.conf -+ -+ cp -a $release_dir/private/*.keytab $PREFIX_ABS/${RELEASE}_upgrade_full/private/ -+ cp -a $release_dir/sysvol $PREFIX_ABS/${RELEASE}_upgrade_full/ -+ mkdir $PREFIX_ABS/${RELEASE}_upgrade_full/etc/ -+ sed -e "s|@@PREFIX@@|$PREFIX_ABS/${RELEASE}_upgrade_full|g" $release_dir/etc/smb.conf.template \ -+ > $PREFIX_ABS/${RELEASE}_upgrade_full/etc/smb.conf - } - - remove_dns_user() { -@@ -122,116 +198,28 @@ ldapcmp_full_sd() { - $PYTHON $BINDIR/samba-tool ldapcmp tdb://$PREFIX_ABS/${RELEASE}_upgrade_reference/private/sam.ldb tdb://$PREFIX_ABS/${RELEASE}_upgrade_full/private/sam.ldb --two --sd --skip-missing-dn - } - --if [ -d $PREFIX_ABS/${RELEASE}_upgrade ]; then -- rm -fr $PREFIX_ABS/${RELEASE}_upgrade --fi -- --if [ -d $PREFIX_ABS/${RELEASE}_upgrade_full ]; then -- rm -fr $PREFIX_ABS/${RELEASE}_upgrade_full --fi -- --if [ -d $PREFIX_ABS/${RELEASE}_upgrade_reference ]; then -- rm -fr $PREFIX_ABS/${RELEASE}_upgrade_reference --fi -- --if [ -d $release_dir ]; then -- testit $RELEASE undump -- testit "remove_dns_user" remove_dns_user -- testit "upgradeprovision" upgradeprovision -- testit "upgradeprovision_full" upgradeprovision_full -- testit "reindex" reindex -- testit_expect_failure "dbcheck" dbcheck -- testit_expect_failure "dbcheck_full" dbcheck_full -- testit "dbcheck_clean" dbcheck_clean -- testit "dbcheck_full_clean" dbcheck_full_clean -- testit "dbcheck_full_clean_well_known_acls" dbcheck_full_clean_well_known_acls -- testit "referenceprovision" referenceprovision -- testit "samba_upgradedns" samba_upgradedns -- testit "ldapcmp" ldapcmp -- testit "ldapcmp_sd" ldapcmp_sd -- testit "ldapcmp_full_sd" ldapcmp_full_sd --else -- subunit_start_test "${RELEASE}" -- subunit_skip_test "${RELEASE}" < -Date: Thu, 22 Oct 2020 11:08:19 +0200 -Subject: [PATCH 1/5] s3:script: Fix test_dfree_quota.sh - -source3/script/tests/test_dfree_quota.sh: line 200: [: missing `]' - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14550 - -Signed-off-by: Andreas Schneider ---- - source3/script/tests/test_dfree_quota.sh | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/source3/script/tests/test_dfree_quota.sh b/source3/script/tests/test_dfree_quota.sh -index e86d431180a..a1403a8c4ba 100755 ---- a/source3/script/tests/test_dfree_quota.sh -+++ b/source3/script/tests/test_dfree_quota.sh -@@ -197,7 +197,7 @@ test_smbcquotas() { - return $status - } - --if [ $protocol != "SMB3" -a $protocol != "NT1"]; then -+if [ $protocol != "SMB3" ] && [ $protocol != "NT1" ]; then - echo "unsupported protocol $protocol" | subunit_fail_test "Test dfree quota" - failed=`expr $failed + 1` - fi --- -GitLab - - -From 4867cafe766fa8aa69ce005dc5c4f05a4af676c8 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Thu, 22 Oct 2020 17:40:01 +0200 -Subject: [PATCH 2/5] buildtools: Do not install binaries which are for - selftest - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14550 - -Signed-off-by: Andreas Schneider ---- - buildtools/wafsamba/wafsamba.py | 6 ++++-- - 1 file changed, 4 insertions(+), 2 deletions(-) - -diff --git a/buildtools/wafsamba/wafsamba.py b/buildtools/wafsamba/wafsamba.py -index 9f6ee4f5c7f..9dd6d05b91b 100644 ---- a/buildtools/wafsamba/wafsamba.py -+++ b/buildtools/wafsamba/wafsamba.py -@@ -365,8 +365,10 @@ def SAMBA_BINARY(bld, binname, source, - for_selftest=False): - '''define a Samba binary''' - -- if for_selftest and not bld.CONFIG_GET('ENABLE_SELFTEST'): -- enabled=False -+ if for_selftest: -+ install=False -+ if not bld.CONFIG_GET('ENABLE_SELFTEST'): -+ enabled=False - - if not enabled: - SET_TARGET_TYPE(bld, binname, 'DISABLED') --- -GitLab - - -From a4d5a21880b1cc8adfcbebd6940d06e2fdab3f14 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Thu, 22 Oct 2020 17:41:01 +0200 -Subject: [PATCH 3/5] unittests: Mark test binaries for selftest - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14550 - -Signed-off-by: Andreas Schneider ---- - testsuite/unittests/wscript | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/testsuite/unittests/wscript b/testsuite/unittests/wscript -index 40fcb01ad57..2b4b37b92de 100644 ---- a/testsuite/unittests/wscript -+++ b/testsuite/unittests/wscript -@@ -9,7 +9,7 @@ def build(bld): - bld.SAMBA_BINARY('test_krb5samba', - source='test_krb5_samba.c', - deps='krb5samba cmocka', -- install=False) -+ for_selftest=True) - - bld.SAMBA_BINARY('test_sambafs_srv_pipe', - source='test_sambafs_srv_pipe.c', -@@ -18,7 +18,7 @@ def build(bld): - RPC_SAMR - cmocka - ''', -- install=False) -+ for_selftest=True) - - bld.SAMBA_BINARY('test_lib_util_modules', - source='test_lib_util_modules.c', -@@ -26,7 +26,7 @@ def build(bld): - samba-modules - cmocka - ''', -- install=False) -+ for_selftest=True) - - bld.SAMBA_MODULE('rpc_test_dummy_module', - source='rpc_test_dummy_module.c', --- -GitLab - - -From d399761e8261a4de5ce9449f97ade61388e8a1e2 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Fri, 23 Oct 2020 08:53:43 +0200 -Subject: [PATCH 4/5] s3:modules: Do not install vfs modules only used for - testing - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14550 - -Signed-off-by: Andreas Schneider ---- - source3/modules/wscript_build | 12 ++++++++---- - 1 file changed, 8 insertions(+), 4 deletions(-) - -diff --git a/source3/modules/wscript_build b/source3/modules/wscript_build -index c4f3db22296..36b047ef79b 100644 ---- a/source3/modules/wscript_build -+++ b/source3/modules/wscript_build -@@ -114,7 +114,8 @@ bld.SAMBA3_MODULE('vfs_fake_acls', - deps='samba-util', - init_function='', - internal_module=bld.SAMBA3_IS_STATIC_MODULE('vfs_fake_acls'), -- enabled=bld.SAMBA3_IS_ENABLED_MODULE('vfs_fake_acls')) -+ enabled=bld.SAMBA3_IS_ENABLED_MODULE('vfs_fake_acls'), -+ install=False) - - bld.SAMBA3_MODULE('vfs_recycle', - subsystem='vfs', -@@ -622,21 +623,24 @@ bld.SAMBA3_MODULE('vfs_fake_dfq', - source='vfs_fake_dfq.c', - init_function='', - internal_module=bld.SAMBA3_IS_STATIC_MODULE('vfs_fake_dfq'), -- enabled=bld.SAMBA3_IS_ENABLED_MODULE('vfs_fake_dfq')) -+ enabled=bld.SAMBA3_IS_ENABLED_MODULE('vfs_fake_dfq'), -+ install=False) - - bld.SAMBA3_MODULE('vfs_error_inject', - subsystem='vfs', - source='vfs_error_inject.c', - init_function='', - internal_module=bld.SAMBA3_IS_STATIC_MODULE('vfs_error_inject'), -- enabled=bld.SAMBA3_IS_ENABLED_MODULE('vfs_error_inject')) -+ enabled=bld.SAMBA3_IS_ENABLED_MODULE('vfs_error_inject'), -+ install=False) - - bld.SAMBA3_MODULE('vfs_delay_inject', - subsystem='vfs', - source='vfs_delay_inject.c', - init_function='', - internal_module=bld.SAMBA3_IS_STATIC_MODULE('vfs_delay_inject'), -- enabled=bld.SAMBA3_IS_ENABLED_MODULE('vfs_delay_inject')) -+ enabled=bld.SAMBA3_IS_ENABLED_MODULE('vfs_delay_inject'), -+ install=False) - - bld.SAMBA3_MODULE('vfs_widelinks', - subsystem='vfs', --- -GitLab - - -From 58e412ac6d9822aa65639d7c1171a2723ca3ee8a Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Fri, 23 Oct 2020 08:57:12 +0200 -Subject: [PATCH 5/5] examples:auth: Do not install example plugin - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14550 - -Signed-off-by: Andreas Schneider ---- - examples/auth/wscript_build | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/examples/auth/wscript_build b/examples/auth/wscript_build -index 91f5302918b..03221238e5f 100644 ---- a/examples/auth/wscript_build -+++ b/examples/auth/wscript_build -@@ -6,4 +6,5 @@ bld.SAMBA3_MODULE('auth_skel', - deps='samba-util', - init_function='', - internal_module=bld.SAMBA3_IS_STATIC_MODULE('auth_skel'), -- enabled=bld.SAMBA3_IS_ENABLED_MODULE('auth_skel')) -+ enabled=bld.SAMBA3_IS_ENABLED_MODULE('auth_skel'), -+ install=False) --- -GitLab - diff --git a/samba-dnspython-2.0.0-v4.13.patch b/samba-dnspython-2.0.0-v4.13.patch deleted file mode 100644 index 88aead2..0000000 --- a/samba-dnspython-2.0.0-v4.13.patch +++ /dev/null @@ -1,143 +0,0 @@ -From 12b51be8633689763080f2eb1e0b13487e3e71e1 Mon Sep 17 00:00:00 2001 -From: Alexander Bokovoy -Date: Sat, 24 Oct 2020 12:17:44 +0300 -Subject: [PATCH] DNS Resolver: support both dnspython before and after 2.0.0 - -`dnspython` 2.0.0 has many changes and several deprecations like: - -``` -> dns.resolver.resolve() has been added, allowing control of whether -search lists are used. dns.resolver.query() is retained for backwards -compatibility, but deprecated. The default for search list behavior can -be set at in the resolver object with the use_search_by_default -parameter. The default is False. - -> dns.resolver.resolve_address() has been added, allowing easy -address-to-name lookups. -``` - -The new class `DNSResolver`: -- provides the compatibility layer -- defaults the previous behavior (the search list configured in the - system's resolver configuration is used for relative names) -- defaults lifetime to 15sec (determines the number of seconds - to spend trying to get an answer to the question) - -The compatibility shim was developed by Stanislav Levin for FreeIPA and -adopted for Samba by Alexander Bokovoy. - -Signed-off-by: Stanislav Levin -Signed-off-by: Alexander Bokovoy ---- - python/samba/dnsresolver.py | 68 +++++++++++++++++++++++++++ - source4/scripting/bin/samba_dnsupdate | 5 +- - 2 files changed, 71 insertions(+), 2 deletions(-) - create mode 100644 python/samba/dnsresolver.py - -diff --git a/python/samba/dnsresolver.py b/python/samba/dnsresolver.py -new file mode 100644 -index 00000000000..a627555a855 ---- /dev/null -+++ b/python/samba/dnsresolver.py -@@ -0,0 +1,68 @@ -+# Samba wrapper for DNS resolvers -+# -+# Copyright (C) Stanislav Levin -+# Copyright (C) Alexander Bokovoy -+# -+# This program is free software; you can redistribute it and/or modify -+# it under the terms of the GNU General Public License as published by -+# the Free Software Foundation; either version 3 of the License, or -+# (at your option) any later version. -+# -+# This program is distributed in the hope that it will be useful, -+# but WITHOUT ANY WARRANTY; without even the implied warranty of -+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+# GNU General Public License for more details. -+# -+# You should have received a copy of the GNU General Public License -+# along with this program. If not, see . -+# -+ -+import dns.resolver -+import dns.rdatatype -+import dns.reversename -+ -+class DNSResolver(dns.resolver.Resolver): -+ """DNS stub resolver compatible with both dnspython < 2.0.0 -+ and dnspython >= 2.0.0. -+ -+ Set `use_search_by_default` attribute to `True`, which -+ determines the default for whether the search list configured -+ in the system's resolver configuration is used for relative -+ names, and whether the resolver's domain may be added to relative -+ names. -+ -+ Increase the default lifetime which determines the number of seconds -+ to spend trying to get an answer to the question. dnspython 2.0.0 -+ changes this to 5sec, while the previous one was 30sec. -+ """ -+ def __init__(self, *args, **kwargs): -+ super().__init__(*args, **kwargs) -+ self.reset_defaults() -+ self.resolve = getattr(super(), "resolve", self.query) -+ self.resolve_address = getattr( -+ super(), -+ "resolve_address", -+ self._resolve_address -+ ) -+ -+ def reset_defaults(self): -+ self.use_search_by_default = True -+ # the default is 5sec -+ self.lifetime = 15 -+ -+ def reset(self): -+ super().reset() -+ self.reset_defaults() -+ -+ def _resolve_address(self, ip_address, *args, **kwargs): -+ """Query nameservers for PTR records. -+ -+ :param ip_address: IPv4 or IPv6 address -+ :type ip_address: str -+ """ -+ return self.resolve( -+ dns.reversename.from_address(ip_address), -+ rdtype=dns.rdatatype.PTR, -+ *args, -+ **kwargs, -+ ) -diff --git a/source4/scripting/bin/samba_dnsupdate b/source4/scripting/bin/samba_dnsupdate -index 44eb1cadd27..fe04ce71338 100755 ---- a/source4/scripting/bin/samba_dnsupdate -+++ b/source4/scripting/bin/samba_dnsupdate -@@ -53,6 +53,7 @@ from samba.compat import get_string - from samba.compat import text_type - import ldb - -+from samba.dnsresolver import DNSResolver - import dns.resolver - import dns.exception - -@@ -259,7 +260,7 @@ def hostname_match(h1, h2): - - def get_resolver(d=None): - resolv_conf = os.getenv('RESOLV_CONF', default='/etc/resolv.conf') -- resolver = dns.resolver.Resolver(filename=resolv_conf, configure=True) -+ resolver = DNSResolver(filename=resolv_conf, configure=True) - - if d is not None and d.nameservers != []: - resolver.nameservers = d.nameservers -@@ -271,7 +272,7 @@ def check_one_dns_name(name, name_type, d=None): - if d and not d.nameservers: - d.nameservers = resolver.nameservers - # dns.resolver.Answer -- return resolver.query(name, name_type) -+ return resolver.resolve(name, name_type) - - def check_dns_name(d): - """check that a DNS entry exists.""" --- -2.28.0 - diff --git a/samba-systemd-notification.patch b/samba-systemd-notification.patch deleted file mode 100644 index 1011460..0000000 --- a/samba-systemd-notification.patch +++ /dev/null @@ -1,118 +0,0 @@ -From 9dd1a4809b1b6d65bfb2258b443b0fe36e0a32f7 Mon Sep 17 00:00:00 2001 -From: Alexander Bokovoy -Date: Sat, 24 Oct 2020 16:52:43 +0300 -Subject: [PATCH] daemons: report status to systemd even when running in - foreground - -When systemd launches samba services, the configuration we have in -systemd service files expects that the main process (/usr/sbin/*) -would use sd_notify() to report back its status. However, we only use -sd_notify() when running become_daemon(). - -As a result, samba/smbd/winbindd/nmbd processes never report back its -status and the status updates from other childs (smbd, winbindd, etc) -are not accepted as we now have implied NotifyAccess=main since commit -d1740fb3d5a72cb49e30b330bb0b01e7ef3e09cc - -This leads to a timeout and killing samba process by systemd. Situation -is reproducible in Fedora 33, for example. - -Make sure that we have required status updates for all daemons in case -we aren't runnning in interactive mode. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14552 - -Signed-off-by: Alexander Bokovoy ---- - source3/nmbd/nmbd.c | 4 +++- - source3/smbd/server.c | 4 +++- - source3/winbindd/winbindd.c | 5 ++++- - source4/smbd/server.c | 4 +++- - 4 files changed, 13 insertions(+), 4 deletions(-) - -diff --git a/source3/nmbd/nmbd.c b/source3/nmbd/nmbd.c -index 0b881d13f7b..f6aeba1f714 100644 ---- a/source3/nmbd/nmbd.c -+++ b/source3/nmbd/nmbd.c -@@ -1009,6 +1009,8 @@ static bool open_sockets(bool isdaemon, int port) - if (is_daemon && !opt_interactive) { - DEBUG(3, ("Becoming a daemon.\n")); - become_daemon(Fork, no_process_group, log_stdout); -+ } else if (!opt_interactive) { -+ daemon_status("nmbd", "Starting process..."); - } - - #ifdef HAVE_SETPGID -@@ -1135,7 +1137,7 @@ static bool open_sockets(bool isdaemon, int port) - exit_daemon( "NMBD failed to setup packet server.", EACCES); - } - -- if (is_daemon && !opt_interactive) { -+ if (!opt_interactive) { - daemon_ready("nmbd"); - } - -diff --git a/source3/smbd/server.c b/source3/smbd/server.c -index 153dd3c9323..3d9db5d8407 100644 ---- a/source3/smbd/server.c -+++ b/source3/smbd/server.c -@@ -1893,6 +1893,8 @@ extern void build_options(bool screen); - if (is_daemon && !interactive) { - DEBUG(3, ("Becoming a daemon.\n")); - become_daemon(Fork, no_process_group, log_stdout); -+ } else { -+ daemon_status("smbd", "Starting process ..."); - } - - #ifdef HAVE_SETPGID -@@ -2100,7 +2102,7 @@ extern void build_options(bool screen); - exit_daemon("Samba cannot setup ep pipe", EACCES); - } - -- if (is_daemon && !interactive) { -+ if (!interactive) { - daemon_ready("smbd"); - } - -diff --git a/source3/winbindd/winbindd.c b/source3/winbindd/winbindd.c -index 4397a1bc0d1..1e08237905a 100644 ---- a/source3/winbindd/winbindd.c -+++ b/source3/winbindd/winbindd.c -@@ -1880,8 +1880,11 @@ int main(int argc, const char **argv) - BlockSignals(False, SIGHUP); - BlockSignals(False, SIGCHLD); - -- if (!interactive) -+ if (!interactive) { - become_daemon(Fork, no_process_group, log_stdout); -+ } else { -+ daemon_status("winbindd", "Starting process ..."); -+ } - - pidfile_create(lp_pid_directory(), "winbindd"); - -diff --git a/source4/smbd/server.c b/source4/smbd/server.c -index 95acb99b86c..ee2e7508bb3 100644 ---- a/source4/smbd/server.c -+++ b/source4/smbd/server.c -@@ -648,6 +648,8 @@ static int binary_smbd_main(const char *binary_name, - if (opt_daemon) { - DBG_NOTICE("Becoming a daemon.\n"); - become_daemon(opt_fork, opt_no_process_group, false); -+ } else if (!opt_interactive) { -+ daemon_status("samba", "Starting process..."); - } - - /* Create the memory context to hang everything off. */ -@@ -931,7 +933,7 @@ static int binary_smbd_main(const char *binary_name, - } - } - -- if (opt_daemon) { -+ if (!opt_interactive) { - daemon_ready("samba"); - } - --- -2.28.0 - diff --git a/samba.spec b/samba.spec index b2d2670..cb0ce28 100644 --- a/samba.spec +++ b/samba.spec @@ -148,15 +148,6 @@ Source14: samba.pamd Source201: README.downgrade Patch1: samba-s4u.patch Patch2: samba-gc-lookup_unix_user_name-allow-lookup-for-own-realm.patch -Patch3: samba-dnspython-2.0.0-v4.13.patch -Patch4: samba-systemd-notification.patch - -# Fix `make test` in release tarballs -Patch5: https://gitlab.com/samba-team/samba/-/merge_requests/1624.patch -# Update resolv_wrapper to version 1.1.7 -Patch6: https://gitlab.com/samba-team/samba/-/merge_requests/1528.patch -# Do not install test binaries for selftest -Patch7: https://gitlab.com/samba-team/samba/-/merge_requests/1635.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd From c6b149506ed8845e3ce51c682a8053d6284e2bee Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 3 Nov 2020 14:47:34 +0100 Subject: [PATCH 058/425] Add missing dlz_bind.so files Guenther --- samba.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/samba.spec b/samba.spec index cb0ce28..4f29aef 100644 --- a/samba.spec +++ b/samba.spec @@ -1845,6 +1845,8 @@ fi %{_libdir}/samba/bind9/dlz_bind9_10.so %{_libdir}/samba/bind9/dlz_bind9_11.so %{_libdir}/samba/bind9/dlz_bind9_12.so +%{_libdir}/samba/bind9/dlz_bind9_14.so +%{_libdir}/samba/bind9/dlz_bind9_16.so #endif with dc %endif From f3b2e2942f67d28c55e00dad7fd51a3bd2e8d8f9 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 3 Nov 2020 14:31:00 +0100 Subject: [PATCH 059/425] Use %{__make} --- samba.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index 4f29aef..e4914df 100644 --- a/samba.spec +++ b/samba.spec @@ -1123,7 +1123,7 @@ rm -f %{buildroot}%{_mandir}/man8/vfs_nfs4acl_xattr.8* %endif pushd pidl -make DESTDIR=%{buildroot} install_vendor +%{__make} DESTDIR=%{buildroot} install_vendor rm -f %{buildroot}%{perl_archlib}/perllocal.pod rm -f %{buildroot}%{perl_archlib}/vendor_perl/auto/Parse/Pidl/.packlist @@ -1153,7 +1153,7 @@ export TDB_NO_FSYNC=1 export NMBD_DONT_LOG_STDOUT=1 export SMBD_DONT_LOG_STDOUT=1 export WINBINDD_DONT_LOG_STDOUT=1 -make %{?_smp_mflags} test FAIL_IMMEDIATELY=1 +%{__make} %{?_smp_mflags} test FAIL_IMMEDIATELY=1 #endif with testsuite %endif From a324d7bf6ffffb0aa0ca81180f3a6fc6a065d9fa Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 3 Nov 2020 17:17:46 +0100 Subject: [PATCH 060/425] Split out a python3-samba-devel package This fixes a dependency of python3-samba on libtalloc-devel --- samba.spec | 28 ++++++++++++++++------------ 1 file changed, 16 insertions(+), 12 deletions(-) diff --git a/samba.spec b/samba.spec index e4914df..8c8e5e5 100644 --- a/samba.spec +++ b/samba.spec @@ -78,7 +78,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global main_release 0 +%global main_release 1 %global samba_version 4.13.2 %global talloc_version 2.3.1 @@ -604,6 +604,13 @@ Requires: libwbclient = %{samba_depver} The python3-%{name} package contains the Python 3 libraries needed by programs that use SMB, RPC and other Samba provided protocols in Python 3 programs. +%package -n python3-%{name}-devel +Summary: Samba python devel files +Requires: python3-%{name} = %{samba_depver} + +%description -n python3-%{name}-devel +The python3-%{name}-devel package contains the Python 3 defel files. + %package -n python3-samba-test Summary: Samba Python libraries Requires: python3-%{name} = %{samba_depver} @@ -2317,17 +2324,7 @@ fi %{python3_sitearch}/samba/xattr.py %{python3_sitearch}/samba/xattr_native.*.so %{python3_sitearch}/samba/xattr_tdb.*.so -# FIXME: -# /usr/lib64/libsamba-policy.cpython-36m-x86-64-linux-gnu.so -# /usr/lib64/libsamba-policy.cpython-36m-x86-64-linux-gnu.so.0 -# /usr/lib64/libsamba-policy.cpython-36m-x86-64-linux-gnu.so.0.0.1 -%{_libdir}/libsamba-policy.*.so* -# FIXME: -# /usr/lib64/pkgconfig/samba-policy.cpython-36m-x86_64-linux-gnu.pc -%{_libdir}/pkgconfig/samba-policy.*.pc -# FIXME: -# /usr/lib64/samba/libsamba-net.cpython-36m-x86-64-linux-gnu-samba4.so -# /usr/lib64/samba/libsamba-python.cpython-36m-x86-64-linux-gnu-samba4.so +%{_libdir}/libsamba-policy.*.so.* %{_libdir}/samba/libsamba-net.*-samba4.so %{_libdir}/samba/libsamba-python.*-samba4.so @@ -2346,6 +2343,10 @@ fi #endif with testsuite %endif +%files -n python3-%{name}-devel +%{_libdir}/libsamba-policy.*.so +%{_libdir}/pkgconfig/samba-policy.*.pc + %if %{with dc} || %{with testsuite} %files -n python3-%{name}-dc %{python3_sitearch}/samba/samdb.py @@ -3754,6 +3755,9 @@ fi %endif %changelog +* Tue Nov 03 2020 Andreas Schneider - 4.13.2-1 +- Create a python3-samba-devel package to avoid unnessary dependencies + * Tue Nov 03 2020 Guenther Deschner - 4.13.2-0 - Update to Samba 4.13.2 From 0d567d3ab93b26381d11f2e1885cfbd3a832365e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 3 Nov 2020 14:20:23 +0100 Subject: [PATCH 061/425] Fix --with includelibs --- samba.spec | 39 +++++++++++++++++++-------------------- 1 file changed, 19 insertions(+), 20 deletions(-) diff --git a/samba.spec b/samba.spec index 8c8e5e5..9a3160a 100644 --- a/samba.spec +++ b/samba.spec @@ -266,7 +266,7 @@ BuildRequires: perl(ExtUtils::MakeMaker) BuildRequires: perl(FindBin) BuildRequires: perl(Parse::Yapp) -%if %{without testsuite} +%if %{without includelibs} BuildRequires: libtalloc-devel >= %{talloc_version} BuildRequires: python3-talloc-devel >= %{talloc_version} @@ -1656,6 +1656,16 @@ fi %{_libdir}/samba/libtdb.so.* %{_libdir}/samba/libtevent.so.* +%{_libdir}/samba/ldb/asq.so +%{_libdir}/samba/ldb/ldb.so +#%%{_libdir}/samba/ldb/mdb.so +%{_libdir}/samba/ldb/paged_searches.so +%{_libdir}/samba/ldb/rdn_name.so +%{_libdir}/samba/ldb/sample.so +%{_libdir}/samba/ldb/server_sort.so +%{_libdir}/samba/ldb/skel.so +%{_libdir}/samba/ldb/tdb.so + %{_mandir}/man3/ldb.3.gz %{_mandir}/man3/talloc.3.gz #endif with includelibs @@ -1777,19 +1787,6 @@ fi %{_libdir}/samba/ldb/vlv.so %{_libdir}/samba/ldb/wins_ldb.so -%if %{with includelibs} -%{_libdir}/samba/ldb/asq.so -%{_libdir}/samba/ldb/ldb.so -%{_libdir}/samba/ldb/mdb.so -%{_libdir}/samba/ldb/paged_searches.so -%{_libdir}/samba/ldb/rdn_name.so -%{_libdir}/samba/ldb/sample.so -%{_libdir}/samba/ldb/server_sort.so -%{_libdir}/samba/ldb/skel.so -%{_libdir}/samba/ldb/tdb.so -#endif with includelibs -%endif - %{_libdir}/samba/vfs/posix_eadb.so %dir /var/lib/samba/sysvol %{_mandir}/man8/samba.8* @@ -2324,12 +2321,13 @@ fi %{python3_sitearch}/samba/xattr.py %{python3_sitearch}/samba/xattr_native.*.so %{python3_sitearch}/samba/xattr_tdb.*.so -%{_libdir}/libsamba-policy.*.so.* -%{_libdir}/samba/libsamba-net.*-samba4.so -%{_libdir}/samba/libsamba-python.*-samba4.so +%{_libdir}/libsamba-policy.cpython*.so.* +%{_libdir}/samba/libsamba-net.cpython*.so +%{_libdir}/samba/libsamba-python.cpython*.so -%if %{with testsuite} -%{_libdir}/samba/libpyldb-util.*.so.* +%if %{with includelibs} +%{_libdir}/samba/libpyldb-util.cpython*.so.* +%{_libdir}/samba/libpytalloc-util.cpython*.so.* %{python3_sitearch}/__pycache__/_ldb_text*.pyc %{python3_sitearch}/__pycache__/_tdb_text*.pyc @@ -2338,9 +2336,10 @@ fi %{python3_sitearch}/_tdb_text.py %{python3_sitearch}/_tevent.cpython*.so %{python3_sitearch}/ldb.cpython*.so +%{python3_sitearch}/talloc.cpython*.so %{python3_sitearch}/tdb.cpython*.so %{python3_sitearch}/tevent.py -#endif with testsuite +#endif with includelibs %endif %files -n python3-%{name}-devel From 8316f0ac998cc32a680a1d0b7beac622d2305ba8 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 13 Nov 2020 17:05:12 +0100 Subject: [PATCH 062/425] Fix winexe and glusterfs on rhel --- samba.spec | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/samba.spec b/samba.spec index 9a3160a..3bd7e49 100644 --- a/samba.spec +++ b/samba.spec @@ -29,7 +29,18 @@ %bcond_without libwbclient # Build with winexe by default +%if 0%{?rhel} + +%ifarch x86_64 %bcond_without winexe +%else +%bcond_with winexe +#endifarch +%endif + +%else +%bcond_without winexe +%endif # Build vfs_ceph module by default on 64bit Fedora %if 0%{?fedora} @@ -56,8 +67,15 @@ #endifarch %endif +#else rhel +%else +# Enable on rhel x86_64 +%ifarch x86_64 +%bcond_without vfs_glusterfs %else %bcond_with vfs_glusterfs +#endifarch +%endif #endif fedora %endif From f88d234f1444399c0182f802f4b3e2da4797951b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 20 Nov 2020 15:15:20 +0100 Subject: [PATCH 063/425] Add missing require to samba-winexe --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index 3bd7e49..e4beb11 100644 --- a/samba.spec +++ b/samba.spec @@ -800,6 +800,7 @@ necessary to communicate to the Winbind Daemon %package winexe Summary: Samba Winexe Windows Binary License: GPLv3 +Requires: %{name}-client-libs = %{samba_depver} %description winexe Winexe is a Remote Windows®-command executor From 0867e962ba00f0f447a372c4d6fca2d04c5133cb Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 20 Nov 2020 15:15:40 +0100 Subject: [PATCH 064/425] Add back --with-profiling-data Should be enabled by default. --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index e4beb11..8e05aee 100644 --- a/samba.spec +++ b/samba.spec @@ -950,6 +950,7 @@ export LDFLAGS="%{__global_ldflags} -fuse-ld=gold" %if %{with testsuite} --enable-selftest \ %endif + --with-profiling-data \ --with-systemd \ --systemd-install-services \ --with-systemddir=/usr/lib/systemd/system \ From 772e0d9aa6a3ea6615c23fa0c45ea03fe45e098b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 20 Nov 2020 15:15:56 +0100 Subject: [PATCH 065/425] Fix dependencies of samba-client-libs --- samba.spec | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/samba.spec b/samba.spec index 8e05aee..ec2ba1c 100644 --- a/samba.spec +++ b/samba.spec @@ -1558,21 +1558,22 @@ fi ### CLIENT-LIBS %files client-libs %{_libdir}/libdcerpc-binding.so.* -%{_libdir}/libndr.so.* +%{_libdir}/libdcerpc-server-core.so.* +%{_libdir}/libdcerpc.so.* %{_libdir}/libndr-krb5pac.so.* %{_libdir}/libndr-nbt.so.* %{_libdir}/libndr-standard.so.* +%{_libdir}/libndr.so.* %{_libdir}/libnetapi.so.* %{_libdir}/libsamba-credentials.so.* %{_libdir}/libsamba-errors.so.* +%{_libdir}/libsamba-hostconfig.so.* %{_libdir}/libsamba-passdb.so.* %{_libdir}/libsamba-util.so.* -%{_libdir}/libsamba-hostconfig.so.* %{_libdir}/libsamdb.so.* %{_libdir}/libsmbconf.so.* %{_libdir}/libsmbldap.so.* %{_libdir}/libtevent-util.so.* -%{_libdir}/libdcerpc.so.* %dir %{_libdir}/samba %{_libdir}/samba/libCHARSET3-samba4.so @@ -2028,7 +2029,6 @@ fi ### LIBS %files libs %{_libdir}/libdcerpc-samr.so.* -%{_libdir}/libdcerpc-server-core.so.* %{_libdir}/samba/libLIBWBCLIENT-OLD-samba4.so %{_libdir}/samba/libauth4-samba4.so From 061477b3e7d11a9d00aca5457d8c993dd1023b28 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 20 Nov 2020 15:21:44 +0100 Subject: [PATCH 066/425] Only build vfs_glusterfs on RHGS --- samba.spec | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index ec2ba1c..f45b319 100644 --- a/samba.spec +++ b/samba.spec @@ -58,6 +58,11 @@ %endif # Build vfs_gluster module by default on 64bit Fedora +%global is_rhgs 0 +%if "%{dist}" == ".el8rhgs" || "%{dist}" == ".el9rhgs" +%global is_rhgs 1 +%endif + %if 0%{?fedora} %ifarch aarch64 ppc64le s390x x86_64 @@ -69,13 +74,20 @@ #else rhel %else -# Enable on rhel x86_64 + +%if 0%{?is_rhgs} +# Enable on rhgs x86_64 %ifarch x86_64 %bcond_without vfs_glusterfs %else %bcond_with vfs_glusterfs #endifarch %endif +%else +%bcond_with vfs_glusterfs +#endif is_rhgs +%endif + #endif fedora %endif From 13eed773b0cf83358fa41647c609ff5aa16a45fe Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Wed, 25 Nov 2020 12:41:21 +0200 Subject: [PATCH 067/425] Fix smbclient mget crashes - Upstream bug #14517 - rhbz#1892745, rhbz#1900232 --- samba-smbclient-mget-bug-14517.patch | 430 +++++++++++++++++++++++++++ samba.spec | 8 +- 2 files changed, 436 insertions(+), 2 deletions(-) create mode 100644 samba-smbclient-mget-bug-14517.patch diff --git a/samba-smbclient-mget-bug-14517.patch b/samba-smbclient-mget-bug-14517.patch new file mode 100644 index 0000000..8f21623 --- /dev/null +++ b/samba-smbclient-mget-bug-14517.patch @@ -0,0 +1,430 @@ +From 52ddfacead1ba50da0fc706b54e90e7a0cadb8e9 Mon Sep 17 00:00:00 2001 +From: Volker Lendecke +Date: Mon, 28 Sep 2020 14:11:13 +0200 +Subject: [PATCH 1/4] smbclient: Remove the "abort_mget" variable + +This was never set to true anywhere in the code + +Bug: https://bugzilla.samba.org/show_bug.cgi?id=14517 +Signed-off-by: Volker Lendecke +Reviewed-by: Jeremy Allison +(cherry picked from commit 8fa451d2b052223a11b24ffc2a956b80d03aaa7c) +--- + source3/client/client.c | 9 --------- + 1 file changed, 9 deletions(-) + +diff --git a/source3/client/client.c b/source3/client/client.c +index f65293849d0..5bed37fc2a2 100644 +--- a/source3/client/client.c ++++ b/source3/client/client.c +@@ -87,8 +87,6 @@ static char dest_ss_str[INET6_ADDRSTRLEN]; + + #define SEPARATORS " \t\n\r" + +-static bool abort_mget = true; +- + /* timing globals */ + uint64_t get_total_size = 0; + unsigned int get_total_time_ms = 0; +@@ -1217,11 +1215,6 @@ static NTSTATUS do_mget(struct cli_state *cli_state, struct file_info *finfo, + if (strequal(finfo->name,".") || strequal(finfo->name,"..")) + return NT_STATUS_OK; + +- if (abort_mget) { +- d_printf("mget aborted\n"); +- return NT_STATUS_UNSUCCESSFUL; +- } +- + if (finfo->attr & FILE_ATTRIBUTE_DIRECTORY) { + if (asprintf(&quest, + "Get directory %s? ",finfo->name) < 0) { +@@ -1419,8 +1412,6 @@ static int cmd_mget(void) + attribute |= FILE_ATTRIBUTE_DIRECTORY; + } + +- abort_mget = false; +- + while (next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { + + mget_mask = talloc_strdup(ctx, client_get_cur_dir()); +-- +2.20.1 + + +From 159a03a9067f7aeddb29080dc34e37b567a02479 Mon Sep 17 00:00:00 2001 +From: Volker Lendecke +Date: Mon, 28 Sep 2020 14:21:24 +0200 +Subject: [PATCH 2/4] smbclient: Slightly simplify do_mget() + +Put the prompt query into a separate if-statement, move the "quest" +variable closer to its use + +Bug: https://bugzilla.samba.org/show_bug.cgi?id=14517 +Signed-off-by: Volker Lendecke +Reviewed-by: Jeremy Allison +(cherry picked from commit 71bc4d4b8d94458ac2e40d659f06110d434fd5c9) +--- + source3/client/client.c | 28 ++++++++++++++-------------- + 1 file changed, 14 insertions(+), 14 deletions(-) + +diff --git a/source3/client/client.c b/source3/client/client.c +index 5bed37fc2a2..5901419f427 100644 +--- a/source3/client/client.c ++++ b/source3/client/client.c +@@ -1203,7 +1203,6 @@ static NTSTATUS do_mget(struct cli_state *cli_state, struct file_info *finfo, + TALLOC_CTX *ctx = talloc_tos(); + NTSTATUS status = NT_STATUS_OK; + char *rname = NULL; +- char *quest = NULL; + char *saved_curdir = NULL; + char *mget_mask = NULL; + char *new_cd = NULL; +@@ -1215,23 +1214,24 @@ static NTSTATUS do_mget(struct cli_state *cli_state, struct file_info *finfo, + if (strequal(finfo->name,".") || strequal(finfo->name,"..")) + return NT_STATUS_OK; + +- if (finfo->attr & FILE_ATTRIBUTE_DIRECTORY) { +- if (asprintf(&quest, +- "Get directory %s? ",finfo->name) < 0) { +- return NT_STATUS_NO_MEMORY; +- } +- } else { +- if (asprintf(&quest, +- "Get file %s? ",finfo->name) < 0) { ++ if (prompt) { ++ const char *object = (finfo->attr & FILE_ATTRIBUTE_DIRECTORY) ? ++ "directory" : "file"; ++ char *quest = NULL; ++ bool ok; ++ ++ quest = talloc_asprintf( ++ ctx, "Get %s %s? ", object, finfo->name); ++ if (quest == NULL) { + return NT_STATUS_NO_MEMORY; + } +- } + +- if (prompt && !yesno(quest)) { +- SAFE_FREE(quest); +- return NT_STATUS_OK; ++ ok = yesno(quest); ++ TALLOC_FREE(quest); ++ if (!ok) { ++ return NT_STATUS_OK; ++ } + } +- SAFE_FREE(quest); + + if (!(finfo->attr & FILE_ATTRIBUTE_DIRECTORY)) { + rname = talloc_asprintf(ctx, +-- +2.20.1 + + +From 523ccc98d2c6a9ddc0714084b5e19cee2a80bf27 Mon Sep 17 00:00:00 2001 +From: Volker Lendecke +Date: Mon, 28 Sep 2020 16:29:27 +0200 +Subject: [PATCH 3/4] test3: Add a test showing that smbclient recursive mget + is broken + +Bug: https://bugzilla.samba.org/show_bug.cgi?id=14517 +Signed-off-by: Volker Lendecke +Reviewed-by: Jeremy Allison +(cherry picked from commit 254a5b034e5a081c9d3f28717a4b54d2af0180fc) +--- + selftest/knownfail.d/smbclient_mget | 1 + + source3/script/tests/test_smbclient_mget.sh | 39 +++++++++++++++++++++ + source3/selftest/tests.py | 10 ++++++ + 3 files changed, 50 insertions(+) + create mode 100644 selftest/knownfail.d/smbclient_mget + create mode 100755 source3/script/tests/test_smbclient_mget.sh + +diff --git a/selftest/knownfail.d/smbclient_mget b/selftest/knownfail.d/smbclient_mget +new file mode 100644 +index 00000000000..64407a8c5d4 +--- /dev/null ++++ b/selftest/knownfail.d/smbclient_mget +@@ -0,0 +1 @@ ++^samba3.blackbox.smbclient-mget.smbclient\ mget\(fileserver\) +\ No newline at end of file +diff --git a/source3/script/tests/test_smbclient_mget.sh b/source3/script/tests/test_smbclient_mget.sh +new file mode 100755 +index 00000000000..45f62f15d4d +--- /dev/null ++++ b/source3/script/tests/test_smbclient_mget.sh +@@ -0,0 +1,39 @@ ++#!/bin/sh ++ ++if [ $# -lt 6 ]; then ++cat < +Date: Mon, 28 Sep 2020 15:03:41 +0200 +Subject: [PATCH 4/4] smbclient: Fix recursive mget + +Make do_mget rely on do_list() already doing the recursion in a +breadth-first manner. The previous code called do_list() from within +its callback. Unfortunately the recent simplifications of do_list() +broke this, leading to recursive mget to segfault. Instead of figuring +out how this worked before the simplifications in do_list() (I did +spend a few hours on this) and fixing it, I chose to restructure +do_mget() to not recursively call do_list() anymore but instead rely +on do_list() to do the recursion. Saves quite a few lines of code and +complexity. + +Bug: https://bugzilla.samba.org/show_bug.cgi?id=14517 +Signed-off-by: Volker Lendecke +Reviewed-by: Jeremy Allison + +Autobuild-User(master): Jeremy Allison +Autobuild-Date(master): Wed Sep 30 17:23:45 UTC 2020 on sn-devel-184 + +(cherry picked from commit 9f24b5098f796f364a3f403ad4e9ae28b3c0935a) +--- + selftest/knownfail.d/smbclient_mget | 1 - + source3/client/client.c | 121 ++++++++-------------------- + 2 files changed, 33 insertions(+), 89 deletions(-) + delete mode 100644 selftest/knownfail.d/smbclient_mget + +diff --git a/selftest/knownfail.d/smbclient_mget b/selftest/knownfail.d/smbclient_mget +deleted file mode 100644 +index 64407a8c5d4..00000000000 +--- a/selftest/knownfail.d/smbclient_mget ++++ /dev/null +@@ -1 +0,0 @@ +-^samba3.blackbox.smbclient-mget.smbclient\ mget\(fileserver\) +\ No newline at end of file +diff --git a/source3/client/client.c b/source3/client/client.c +index 5901419f427..8c7ceb644aa 100644 +--- a/source3/client/client.c ++++ b/source3/client/client.c +@@ -1201,11 +1201,10 @@ static NTSTATUS do_mget(struct cli_state *cli_state, struct file_info *finfo, + const char *dir) + { + TALLOC_CTX *ctx = talloc_tos(); +- NTSTATUS status = NT_STATUS_OK; +- char *rname = NULL; +- char *saved_curdir = NULL; +- char *mget_mask = NULL; +- char *new_cd = NULL; ++ const char *client_cwd = NULL; ++ size_t client_cwd_len; ++ char *path = NULL; ++ char *local_path = NULL; + + if (!finfo->name) { + return NT_STATUS_OK; +@@ -1214,6 +1213,10 @@ static NTSTATUS do_mget(struct cli_state *cli_state, struct file_info *finfo, + if (strequal(finfo->name,".") || strequal(finfo->name,"..")) + return NT_STATUS_OK; + ++ if ((finfo->attr & FILE_ATTRIBUTE_DIRECTORY) && !recurse) { ++ return NT_STATUS_OK; ++ } ++ + if (prompt) { + const char *object = (finfo->attr & FILE_ATTRIBUTE_DIRECTORY) ? + "directory" : "file"; +@@ -1233,98 +1236,40 @@ static NTSTATUS do_mget(struct cli_state *cli_state, struct file_info *finfo, + } + } + +- if (!(finfo->attr & FILE_ATTRIBUTE_DIRECTORY)) { +- rname = talloc_asprintf(ctx, +- "%s%s", +- client_get_cur_dir(), +- finfo->name); +- if (!rname) { +- return NT_STATUS_NO_MEMORY; +- } +- rname = client_clean_name(ctx, rname); +- if (rname == NULL) { +- return NT_STATUS_NO_MEMORY; +- } +- do_get(rname, finfo->name, false); +- TALLOC_FREE(rname); +- return NT_STATUS_OK; +- } +- +- /* handle directories */ +- saved_curdir = talloc_strdup(ctx, client_get_cur_dir()); +- if (!saved_curdir) { ++ path = talloc_asprintf( ++ ctx, "%s%c%s", dir, CLI_DIRSEP_CHAR, finfo->name); ++ if (path == NULL) { + return NT_STATUS_NO_MEMORY; + } +- +- new_cd = talloc_asprintf(ctx, +- "%s%s%s", +- client_get_cur_dir(), +- finfo->name, +- CLI_DIRSEP_STR); +- if (!new_cd) { +- return NT_STATUS_NO_MEMORY; +- } +- new_cd = client_clean_name(ctx, new_cd); +- if (new_cd == NULL) { ++ path = client_clean_name(ctx, path); ++ if (path == NULL) { + return NT_STATUS_NO_MEMORY; + } +- client_set_cur_dir(new_cd); +- +- string_replace(finfo->name,'\\','/'); +- if (lowercase) { +- if (!strlower_m(finfo->name)) { +- return NT_STATUS_INVALID_PARAMETER; +- } +- } +- +- if (!directory_exist(finfo->name) && +- mkdir(finfo->name,0777) != 0) { +- d_printf("failed to create directory %s\n",finfo->name); +- client_set_cur_dir(saved_curdir); +- return map_nt_error_from_unix(errno); +- } +- +- if (chdir(finfo->name) != 0) { +- d_printf("failed to chdir to directory %s\n",finfo->name); +- client_set_cur_dir(saved_curdir); +- return map_nt_error_from_unix(errno); +- } + +- mget_mask = talloc_asprintf(ctx, +- "%s*", +- client_get_cur_dir()); ++ /* ++ * Skip the path prefix if we've done a remote "cd" when ++ * creating the local path ++ */ ++ client_cwd = client_get_cur_dir(); ++ client_cwd_len = strlen(client_cwd); + +- if (!mget_mask) { ++ local_path = talloc_strdup(ctx, path + client_cwd_len); ++ if (local_path == NULL) { ++ TALLOC_FREE(path); + return NT_STATUS_NO_MEMORY; + } ++ string_replace(local_path, CLI_DIRSEP_CHAR, '/'); + +- mget_mask = client_clean_name(ctx, mget_mask); +- if (mget_mask == NULL) { +- return NT_STATUS_NO_MEMORY; +- } +- status = do_list(mget_mask, +- (FILE_ATTRIBUTE_SYSTEM +- | FILE_ATTRIBUTE_HIDDEN +- | FILE_ATTRIBUTE_DIRECTORY), +- do_mget, false, true); +- if (!NT_STATUS_IS_OK(status) +- && !NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) { +- /* +- * Ignore access denied errors to ensure all permitted files are +- * pulled down. +- */ +- return status; +- } ++ if (finfo->attr & FILE_ATTRIBUTE_DIRECTORY) { ++ int ret = mkdir(local_path, 0777); + +- if (chdir("..") == -1) { +- d_printf("do_mget: failed to chdir to .. (error %s)\n", +- strerror(errno) ); +- return map_nt_error_from_unix(errno); ++ if ((ret == -1) && (errno != EEXIST)) { ++ return map_nt_error_from_unix(errno); ++ } ++ } else { ++ do_get(path, local_path, false); + } +- client_set_cur_dir(saved_curdir); +- TALLOC_FREE(mget_mask); +- TALLOC_FREE(saved_curdir); +- TALLOC_FREE(new_cd); ++ + return NT_STATUS_OK; + } + +@@ -1431,7 +1376,7 @@ static int cmd_mget(void) + if (mget_mask == NULL) { + return 1; + } +- status = do_list(mget_mask, attribute, do_mget, false, true); ++ status = do_list(mget_mask, attribute, do_mget, recurse, true); + if (!NT_STATUS_IS_OK(status)) { + return 1; + } +@@ -1453,7 +1398,7 @@ static int cmd_mget(void) + if (mget_mask == NULL) { + return 1; + } +- status = do_list(mget_mask, attribute, do_mget, false, true); ++ status = do_list(mget_mask, attribute, do_mget, recurse, true); + if (!NT_STATUS_IS_OK(status)) { + return 1; + } +-- +2.20.1 + diff --git a/samba.spec b/samba.spec index f45b319..a45d6bc 100644 --- a/samba.spec +++ b/samba.spec @@ -108,7 +108,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global main_release 1 +%global main_release 2 %global samba_version 4.13.2 %global talloc_version 2.3.1 @@ -177,7 +177,8 @@ Source14: samba.pamd Source201: README.downgrade Patch1: samba-s4u.patch -Patch2: samba-gc-lookup_unix_user_name-allow-lookup-for-own-realm.patch +Patch2: samba-4.13-redhat.patch +Patch3: samba-smbclient-mget-bug-14517.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -3786,6 +3787,9 @@ fi %endif %changelog +* Wed Nov 25 2020 Alexander Bokovoy - 4.13.2-2 +- rhbz#1892745, rhbz#1900232: smbclient mget crashes (upstream bug 14517) + * Tue Nov 03 2020 Andreas Schneider - 4.13.2-1 - Create a python3-samba-devel package to avoid unnessary dependencies From 1d03aa069e47ad77c517235b810fa0208ee01759 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Wed, 25 Nov 2020 12:49:39 +0200 Subject: [PATCH 068/425] Merge RHEL 8.4 patches These patches are part of the https://gitlab.com/samba-redhat/samba/-/tree/v4-13-redhat [PATCH 001/105] libcli:smb2: Do not leak ptext on error [PATCH 002/105] libcli:smb2: Use talloc NULL context if we don't have [PATCH 003/105] auth:creds: Introduce CRED_SMB_CONF [PATCH 004/105] param: Add 'server smb encrypt' parameter [PATCH 005/105] param: Create and use enum_smb_encryption_vals [PATCH 006/105] s3:smbd: Use 'enum smb_encryption_setting' values [PATCH 007/105] docs-xml: Add 'client smb encrypt' [PATCH 008/105] lib:param: Add lpcfg_parse_enum_vals() [PATCH 009/105] libcli:smb: Add smb_signing_setting_translate() [PATCH 010/105] libcli:smb: Add smb_encryption_setting_translate() [PATCH 011/105] s3:lib: Use smb_signing_setting_translate for cmdline [PATCH 012/105] auth:creds: Remove unused credentials autoproto [PATCH 013/105] auth:creds: Add [PATCH 014/105] auth:creds: Add python bindings for [PATCH 015/105] auth:creds: Add [PATCH 016/105] auth:creds: Add python bindings for [PATCH 017/105] auth:creds: Add [PATCH 018/105] auth:creds: Add python bindings for [PATCH 019/105] auth:creds: Add python bindings for [PATCH 020/105] auth:creds: Bump library version [PATCH 021/105] s3:lib: Use cli_credential_(get|set)_smb_signing() [PATCH 022/105] s3:lib: Set smb encryption also via cli creds API [PATCH 023/105] python: Remove unused sign argument from [PATCH 024/105] python: Set smb signing via the creds API [PATCH 025/105] s3:libsmb: Introduce CLI_FULL_CONNECTION_IPC [PATCH 026/105] s3:pylibsmb: Add ipc=True support for [PATCH 027/105] python:tests: Mark libsmb connection as an IPC [PATCH 028/105] python:tests: Set smb ipc signing via the creds API [PATCH 029/105] s3:libsmb: Use 'enum smb_signing_setting' in [PATCH 030/105] s3:client: Turn off smb signing for message op [PATCH 031/105] s3:libsmb: Remove signing_state from [PATCH 032/105] s3:libsmb: Remove signing_state from [PATCH 033/105] s3:libsmb: Add encryption support to [PATCH 034/105] python: Add a test for SMB encryption [PATCH 035/105] s3:net: Use cli_credentials_set_smb_encryption() [PATCH 036/105] s3:libsmb: Use cli_credentials_set_smb_encryption() [PATCH 037/105] s3:client: Remove unused smb encryption code [PATCH 038/105] s3:utils: Remove obsolete force encryption from [PATCH 039/105] s3:utils: Remove obsolete force encryption from [PATCH 040/105] s3:utils: Remove obsolete force encryption from [PATCH 041/105] s3:rpcclient: Remove obsolete force encryption from [PATCH 042/105] examples: Remove obsolete force encryption from [PATCH 043/105] s3:libsmb: Make cli_cm_force_encryption_creds() [PATCH 044/105] s4:libcli: Return NTSTATUS errors for [PATCH 045/105] s4:libcli: Return if encryption is requested for SMB1 [PATCH 046/105] s3:libcli: Split out smb2_connect_tcon_start() [PATCH 047/105] s4:libcli: Add smb2_connect_enc_start() [PATCH 048/105] s4:libcli: Require signing for SMB encryption [PATCH 049/105] python:tests: Add test for SMB encrypted DCERPC [PATCH 050/105] auth:gensec: Add gensec_security_sasl_names() [PATCH 051/105] s4:ldap_server: Use samba_server_gensec_start() in [PATCH 052/105] auth:gensec: Make gensec_use_kerberos_mechs() a [PATCH 053/105] auth:gensec: Pass use_kerberos and keep_schannel to [PATCH 054/105] auth:gensec: If Kerberos is required, keep schannel [PATCH 055/105] auth:creds: Add cli_credentials_init_server() [PATCH 056/105] s4:rpc_server: Use cli_credentials_init_server() [PATCH 057/105] s4:smb_server: Use cli_credentials_init_server() for [PATCH 058/105] selftest: Rename 'smb encrypt' to 'server smb [PATCH 059/105] selftest: Move enc_desired to provision to have it in [PATCH 060/105] s3:tests: Add smbclient tests for 'client smb [PATCH 061/105] s3:client: Remove global smb_encrypt [PATCH 062/105] s3:libsmb: Remove force_encrypt from cli_cm_open() [PATCH 063/105] s3:libsmb: Remove force_encrypt from cli_cm_connect() [PATCH 064/105] s3:libsmb: Remove force_encrypt from clidfs [PATCH 065/105] s3:libsmb: Remove force_encrypt from [PATCH 066/105] s3:libsmb: Pass cli_credentials to clidfs [PATCH 067/105] s3:libsmb: Pass cli_credentials to cli_cm_connect() [PATCH 068/105] s3:libsmb: Pass cli_credentials to cli_cm_open() [PATCH 069/105] s3:libsmb: Pass cli_credentials to [PATCH 070/105] s3:client: Remove global max_protocol [PATCH 071/105] s3:libsmb: Remove max_protocol from cli_cm_open() [PATCH 072/105] s3:libcmb: Remove max_protocol from cli_cm_connect() [PATCH 073/105] s3:libsmb: Remove max_protocol from clidfs [PATCH 074/105] s3:include: Move loadparm prototypes to own header [PATCH 075/105] s3:lib: Move interface prototypes to own header file [PATCH 076/105] idl: Add SID_SAMBA_SMB3 [PATCH 077/105] s3:smbd: Add SMB3 connection information to session [PATCH 078/105] librpc: Add dcerpc helper [PATCH 079/105] s3:smbd: Use defines to set 'srv_smb_encrypt' [PATCH 080/105] s3:rpc_server: Allow to use RC4 for setting passwords [PATCH 081/105] s4:rpc_server: Allow to use RC4 for setting passwords [PATCH 082/105] lib:crypto: Add py binding for set_relax/strict fips [PATCH 083/105] s4:param: Add 'weak crypto' getter to pyparam [PATCH 084/105] python:tests: Add SAMR password change tests for fips [PATCH 085/105] python:tests: Add SAMR password change tests for fips [PATCH 086/105] auth:creds: Rename CRED_USE_KERBEROS values [PATCH 087/105] auth:creds:tests: Migrate test to a cmocka unit test [PATCH 088/105] s3-vfs_glusterfs: always disable write-behind [PATCH 089/105] Add smb2cli_session_get_encryption_cipher() [PATCH 090/105] Add dcerpc_transport_encrypted() [PATCH 091/105] Add py binding for dcerpc_transport_encrypted [PATCH 092/105] selftest: add a test for py dce transport_encrypted [PATCH 093/105] Add CreateTrustedDomainRelax wrapper for fips mode [PATCH 094/105] Use the new CreateTrustedDomainRelax() [PATCH 095/105] selftest: add a test for the CreateTrustedDomainRelax [PATCH 096/105] Remove source4/scripting/devel/createtrust script [PATCH 097/105] s3:rpc_server: Use gnutls_cipher_decrypt() in [PATCH 098/105] s4:rpc_server: Use gnutls_cipher_decrypt() in [PATCH 099/105] s3:rpc_server: Allow to use RC4 for creating trusts [PATCH 100/105] s4:rpc_server: Allow to use RC4 for creating trusts [PATCH 101/105] sefltest: Enable the dcerpc.createtrustrelax test [PATCH 102/105] s3: spoolss: Make parameters in call to [PATCH 103/105] s3:smbd: Fix possible null pointer dereference in [PATCH 104/105] lookup_name: allow lookup names prefixed with DNS [PATCH 105/105] auth_sam: use pdb_get_domain_info to look up DNS --- samba-4.13-redhat.patch | 12614 ++++++++++++++++ ...user_name-allow-lookup-for-own-realm.patch | 210 - samba.spec | 3 + 3 files changed, 12617 insertions(+), 210 deletions(-) create mode 100644 samba-4.13-redhat.patch delete mode 100644 samba-gc-lookup_unix_user_name-allow-lookup-for-own-realm.patch diff --git a/samba-4.13-redhat.patch b/samba-4.13-redhat.patch new file mode 100644 index 0000000..33b84bd --- /dev/null +++ b/samba-4.13-redhat.patch @@ -0,0 +1,12614 @@ +From 77a771be72a6084216ea848f2d851eb7192ae9b9 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Mon, 13 Jul 2020 16:15:03 +0200 +Subject: [PATCH 001/105] libcli:smb2: Do not leak ptext on error + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + libcli/smb/smb2_signing.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/libcli/smb/smb2_signing.c b/libcli/smb/smb2_signing.c +index 623fc23fb18..bba80817018 100644 +--- a/libcli/smb/smb2_signing.c ++++ b/libcli/smb/smb2_signing.c +@@ -522,6 +522,7 @@ NTSTATUS smb2_signing_encrypt_pdu(struct smb2_signing_key *encryption_key, + + ctext = talloc_size(talloc_tos(), ctext_size); + if (ctext == NULL) { ++ TALLOC_FREE(ptext); + status = NT_STATUS_NO_MEMORY; + goto out; + } +-- +2.28.0 + + +From eb5fbbd3090cbdea95b14e9ac167253fafe633f8 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Mon, 13 Jul 2020 17:23:37 +0200 +Subject: [PATCH 002/105] libcli:smb2: Use talloc NULL context if we don't have + a stackframe + +If we execute this code from python we don't have a talloc stackframe +around and segfault with talloc_tos(). + +To fix the crash we use the NULL context as we take care for freeing the +memory as soon as possible. + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + libcli/smb/smb2_signing.c | 30 ++++++++++++++++++++++++++---- + 1 file changed, 26 insertions(+), 4 deletions(-) + +diff --git a/libcli/smb/smb2_signing.c b/libcli/smb/smb2_signing.c +index bba80817018..7669b219bbe 100644 +--- a/libcli/smb/smb2_signing.c ++++ b/libcli/smb/smb2_signing.c +@@ -513,14 +513,25 @@ NTSTATUS smb2_signing_encrypt_pdu(struct smb2_signing_key *encryption_key, + uint8_t *ctext = NULL; + size_t len = 0; + int i; ++ TALLOC_CTX *tmp_ctx = NULL; + +- ptext = talloc_size(talloc_tos(), ptext_size); ++ /* ++ * If we come from python bindings, we don't have a stackframe ++ * around, so use the NULL context. ++ * ++ * This is fine as we make sure we free the memory. ++ */ ++ if (talloc_stackframe_exists()) { ++ tmp_ctx = talloc_tos(); ++ } ++ ++ ptext = talloc_size(tmp_ctx, ptext_size); + if (ptext == NULL) { + status = NT_STATUS_NO_MEMORY; + goto out; + } + +- ctext = talloc_size(talloc_tos(), ctext_size); ++ ctext = talloc_size(tmp_ctx, ctext_size); + if (ctext == NULL) { + TALLOC_FREE(ptext); + status = NT_STATUS_NO_MEMORY; +@@ -713,16 +724,27 @@ NTSTATUS smb2_signing_decrypt_pdu(struct smb2_signing_key *decryption_key, + uint8_t *ptext = NULL; + size_t len = 0; + int i; ++ TALLOC_CTX *tmp_ctx = NULL; ++ ++ /* ++ * If we come from python bindings, we don't have a stackframe ++ * around, so use the NULL context. ++ * ++ * This is fine as we make sure we free the memory. ++ */ ++ if (talloc_stackframe_exists()) { ++ tmp_ctx = talloc_tos(); ++ } + + /* GnuTLS doesn't have a iovec API for decryption yet */ + +- ptext = talloc_size(talloc_tos(), ptext_size); ++ ptext = talloc_size(tmp_ctx, ptext_size); + if (ptext == NULL) { + status = NT_STATUS_NO_MEMORY; + goto out; + } + +- ctext = talloc_size(talloc_tos(), ctext_size); ++ ctext = talloc_size(tmp_ctx, ctext_size); + if (ctext == NULL) { + TALLOC_FREE(ptext); + status = NT_STATUS_NO_MEMORY; +-- +2.28.0 + + +From 66ee204aee9a4919d94003a9a3263a44c2d5b436 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Wed, 6 Nov 2019 17:37:45 +0100 +Subject: [PATCH 003/105] auth:creds: Introduce CRED_SMB_CONF + +We have several places where we check '> CRED_UNINITIALISED', +so we better don't use CRED_UNINITIALISED for values from +our smb.conf. + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Andreas Schneider +--- + auth/credentials/credentials.c | 6 +++--- + auth/credentials/credentials.h | 1 + + auth/credentials/pycredentials.c | 1 + + python/samba/tests/credentials.py | 4 ++-- + 4 files changed, 7 insertions(+), 5 deletions(-) + +diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c +index 81f9dbb9eb3..80a31b248ae 100644 +--- a/auth/credentials/credentials.c ++++ b/auth/credentials/credentials.c +@@ -902,12 +902,12 @@ _PUBLIC_ void cli_credentials_set_conf(struct cli_credentials *cred, + if (lpcfg_parm_is_cmdline(lp_ctx, "workgroup")) { + cli_credentials_set_domain(cred, lpcfg_workgroup(lp_ctx), CRED_SPECIFIED); + } else { +- cli_credentials_set_domain(cred, lpcfg_workgroup(lp_ctx), CRED_UNINITIALISED); ++ cli_credentials_set_domain(cred, lpcfg_workgroup(lp_ctx), CRED_SMB_CONF); + } + if (lpcfg_parm_is_cmdline(lp_ctx, "netbios name")) { + cli_credentials_set_workstation(cred, lpcfg_netbios_name(lp_ctx), CRED_SPECIFIED); + } else { +- cli_credentials_set_workstation(cred, lpcfg_netbios_name(lp_ctx), CRED_UNINITIALISED); ++ cli_credentials_set_workstation(cred, lpcfg_netbios_name(lp_ctx), CRED_SMB_CONF); + } + if (realm != NULL && strlen(realm) == 0) { + realm = NULL; +@@ -915,7 +915,7 @@ _PUBLIC_ void cli_credentials_set_conf(struct cli_credentials *cred, + if (lpcfg_parm_is_cmdline(lp_ctx, "realm")) { + cli_credentials_set_realm(cred, realm, CRED_SPECIFIED); + } else { +- cli_credentials_set_realm(cred, realm, CRED_UNINITIALISED); ++ cli_credentials_set_realm(cred, realm, CRED_SMB_CONF); + } + + sep = lpcfg_winbind_separator(lp_ctx); +diff --git a/auth/credentials/credentials.h b/auth/credentials/credentials.h +index 9fe6a82b1ea..7154c2a008c 100644 +--- a/auth/credentials/credentials.h ++++ b/auth/credentials/credentials.h +@@ -42,6 +42,7 @@ struct db_context; + /* In order of priority */ + enum credentials_obtained { + CRED_UNINITIALISED = 0, /* We don't even have a guess yet */ ++ CRED_SMB_CONF, /* Current value should be used, which comes from smb.conf */ + CRED_CALLBACK, /* Callback should be used to obtain value */ + CRED_GUESS_ENV, /* Current value should be used, which was guessed */ + CRED_GUESS_FILE, /* A guess from a file (or file pointed at in env variable) */ +diff --git a/auth/credentials/pycredentials.c b/auth/credentials/pycredentials.c +index a5d0f9e051c..68edc282741 100644 +--- a/auth/credentials/pycredentials.c ++++ b/auth/credentials/pycredentials.c +@@ -1275,6 +1275,7 @@ MODULE_INIT_FUNC(credentials) + return NULL; + + PyModule_AddObject(m, "UNINITIALISED", PyLong_FromLong(CRED_UNINITIALISED)); ++ PyModule_AddObject(m, "SMB_CONF", PyLong_FromLong(CRED_SMB_CONF)); + PyModule_AddObject(m, "CALLBACK", PyLong_FromLong(CRED_CALLBACK)); + PyModule_AddObject(m, "GUESS_ENV", PyLong_FromLong(CRED_GUESS_ENV)); + PyModule_AddObject(m, "GUESS_FILE", PyLong_FromLong(CRED_GUESS_FILE)); +diff --git a/python/samba/tests/credentials.py b/python/samba/tests/credentials.py +index d2a81506de3..6454ac9ff7c 100644 +--- a/python/samba/tests/credentials.py ++++ b/python/samba/tests/credentials.py +@@ -332,7 +332,7 @@ class CredentialsTests(samba.tests.TestCaseInTempDir): + os.environ["USER"] = "env_user" + creds.guess(lp) + realm = "realm.example.com" +- creds.set_realm(realm, credentials.UNINITIALISED) ++ creds.set_realm(realm, credentials.SMB_CONF) + creds.parse_string("user") + self.assertEqual(creds.get_username(), "user") + self.assertEqual(creds.get_domain(), lp.get("workgroup").upper()) +@@ -360,7 +360,7 @@ class CredentialsTests(samba.tests.TestCaseInTempDir): + os.environ["USER"] = "env_user" + creds.guess(lp) + realm = "realm.example.com" +- creds.set_realm(realm, credentials.UNINITIALISED) ++ creds.set_realm(realm, credentials.SMB_CONF) + self.assertEqual(creds.get_username(), "env_user") + self.assertEqual(creds.get_domain(), lp.get("workgroup").upper()) + self.assertEqual(creds.get_realm(), realm.upper()) +-- +2.28.0 + + +From 8d2d8cdc90d0455429c9d461ebd65d21a0b29b8d Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 10 Oct 2019 14:18:23 +0200 +Subject: [PATCH 004/105] param: Add 'server smb encrypt' parameter + +And this also makes 'smb encrypt' a synonym of that. + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + .../smbdotconf/security/serversmbencrypt.xml | 241 ++++++++++++++++++ + docs-xml/smbdotconf/security/smbencrypt.xml | 241 +----------------- + source3/param/loadparm.c | 2 +- + source3/smbd/service.c | 4 +- + source3/smbd/smb2_negprot.c | 2 +- + source3/smbd/smb2_sesssetup.c | 4 +- + source3/smbd/smb2_tcon.c | 4 +- + source3/smbd/trans2.c | 2 +- + 8 files changed, 257 insertions(+), 243 deletions(-) + create mode 100644 docs-xml/smbdotconf/security/serversmbencrypt.xml + +diff --git a/docs-xml/smbdotconf/security/serversmbencrypt.xml b/docs-xml/smbdotconf/security/serversmbencrypt.xml +new file mode 100644 +index 00000000000..714aacbf1ca +--- /dev/null ++++ b/docs-xml/smbdotconf/security/serversmbencrypt.xml +@@ -0,0 +1,241 @@ ++ ++ ++ ++ This parameter controls whether a remote client is allowed or required ++ to use SMB encryption. It has different effects depending on whether ++ the connection uses SMB1 or SMB2 and newer: ++ ++ ++ ++ ++ ++ If the connection uses SMB1, then this option controls the use ++ of a Samba-specific extension to the SMB protocol introduced in ++ Samba 3.2 that makes use of the Unix extensions. ++ ++ ++ ++ ++ ++ If the connection uses SMB2 or newer, then this option controls ++ the use of the SMB-level encryption that is supported in SMB ++ version 3.0 and above and available in Windows 8 and newer. ++ ++ ++ ++ ++ ++ This parameter can be set globally and on a per-share bases. ++ Possible values are ++ ++ off, ++ if_required, ++ desired, ++ and ++ required. ++ A special value is default which is ++ the implicit default setting of if_required. ++ ++ ++ ++ ++ Effects for SMB1 ++ ++ ++ The Samba-specific encryption of SMB1 connections is an ++ extension to the SMB protocol negotiated as part of the UNIX ++ extensions. SMB encryption uses the GSSAPI (SSPI on Windows) ++ ability to encrypt and sign every request/response in a SMB ++ protocol stream. When enabled it provides a secure method of ++ SMB/CIFS communication, similar to an ssh protected session, but ++ using SMB/CIFS authentication to negotiate encryption and ++ signing keys. Currently this is only supported smbclient of by ++ Samba 3.2 and newer, and hopefully soon Linux CIFSFS and MacOS/X ++ clients. Windows clients do not support this feature. ++ ++ ++ This may be set on a per-share ++ basis, but clients may chose to encrypt the entire session, not ++ just traffic to a specific share. If this is set to mandatory ++ then all traffic to a share must ++ be encrypted once the connection has been made to the share. ++ The server would return "access denied" to all non-encrypted ++ requests on such a share. Selecting encrypted traffic reduces ++ throughput as smaller packet sizes must be used (no huge UNIX ++ style read/writes allowed) as well as the overhead of encrypting ++ and signing all the data. ++ ++ ++ ++ If SMB encryption is selected, Windows style SMB signing (see ++ the option) is no longer ++ necessary, as the GSSAPI flags use select both signing and ++ sealing of the data. ++ ++ ++ ++ When set to auto or default, SMB encryption is offered, but not ++ enforced. When set to mandatory, SMB encryption is required and ++ if set to disabled, SMB encryption can not be negotiated. ++ ++ ++ ++ ++ ++ Effects for SMB2 and newer ++ ++ ++ Native SMB transport encryption is available in SMB version 3.0 ++ or newer. It is only offered by Samba if ++ server max protocol is set to ++ SMB3 or newer. ++ Clients supporting this type of encryption include ++ Windows 8 and newer, ++ Windows server 2012 and newer, ++ and smbclient of Samba 4.1 and newer. ++ ++ ++ ++ The protocol implementation offers various options: ++ ++ ++ ++ ++ ++ The capability to perform SMB encryption can be ++ negotiated during protocol negotiation. ++ ++ ++ ++ ++ ++ Data encryption can be enabled globally. In that case, ++ an encryption-capable connection will have all traffic ++ in all its sessions encrypted. In particular all share ++ connections will be encrypted. ++ ++ ++ ++ ++ ++ Data encryption can also be enabled per share if not ++ enabled globally. For an encryption-capable connection, ++ all connections to an encryption-enabled share will be ++ encrypted. ++ ++ ++ ++ ++ ++ Encryption can be enforced. This means that session ++ setups will be denied on non-encryption-capable ++ connections if data encryption has been enabled ++ globally. And tree connections will be denied for ++ non-encryption capable connections to shares with data ++ encryption enabled. ++ ++ ++ ++ ++ ++ These features can be controlled with settings of ++ server smb encrypt as follows: ++ ++ ++ ++ ++ ++ Leaving it as default, explicitly setting ++ default, or setting it to ++ if_required globally will enable ++ negotiation of encryption but will not turn on ++ data encryption globally or per share. ++ ++ ++ ++ ++ ++ Setting it to desired globally ++ will enable negotiation and will turn on data encryption ++ on sessions and share connections for those clients ++ that support it. ++ ++ ++ ++ ++ ++ Setting it to required globally ++ will enable negotiation and turn on data encryption ++ on sessions and share connections. Clients that do ++ not support encryption will be denied access to the ++ server. ++ ++ ++ ++ ++ ++ Setting it to off globally will ++ completely disable the encryption feature for all ++ connections. Setting server smb encrypt = ++ required for individual shares (while it's ++ globally off) will deny access to this shares for all ++ clients. ++ ++ ++ ++ ++ ++ Setting it to desired on a share ++ will turn on data encryption for this share for clients ++ that support encryption if negotiation has been ++ enabled globally. ++ ++ ++ ++ ++ ++ Setting it to required on a share ++ will enforce data encryption for this share if ++ negotiation has been enabled globally. I.e. clients that ++ do not support encryption will be denied access to the ++ share. ++ ++ ++ Note that this allows per-share enforcing to be ++ controlled in Samba differently from Windows: ++ In Windows, RejectUnencryptedAccess ++ is a global setting, and if it is set, all shares with ++ data encryption turned on ++ are automatically enforcing encryption. In order to ++ achieve the same effect in Samba, one ++ has to globally set server smb encrypt to ++ if_required, and then set all shares ++ that should be encrypted to ++ required. ++ Additionally, it is possible in Samba to have some ++ shares with encryption required ++ and some other shares with encryption only ++ desired, which is not possible in ++ Windows. ++ ++ ++ ++ ++ ++ Setting it to off or ++ if_required for a share has ++ no effect. ++ ++ ++ ++ ++ ++ ++ ++ ++default ++ +diff --git a/docs-xml/smbdotconf/security/smbencrypt.xml b/docs-xml/smbdotconf/security/smbencrypt.xml +index 32a22cb58f5..798e616b765 100644 +--- a/docs-xml/smbdotconf/security/smbencrypt.xml ++++ b/docs-xml/smbdotconf/security/smbencrypt.xml +@@ -1,241 +1,14 @@ + ++ context="S" ++ type="enum" ++ enumlist="enum_smb_signing_vals" ++ function="server_smb_encrypt" ++ synonym="1" ++ xmlns:samba="http://www.samba.org/samba/DTD/samba-doc"> + + +- This parameter controls whether a remote client is allowed or required +- to use SMB encryption. It has different effects depending on whether +- the connection uses SMB1 or SMB2 and newer: ++ This is a synonym for . + +- +- +- +- +- If the connection uses SMB1, then this option controls the use +- of a Samba-specific extension to the SMB protocol introduced in +- Samba 3.2 that makes use of the Unix extensions. +- +- +- +- +- +- If the connection uses SMB2 or newer, then this option controls +- the use of the SMB-level encryption that is supported in SMB +- version 3.0 and above and available in Windows 8 and newer. +- +- +- +- +- +- This parameter can be set globally and on a per-share bases. +- Possible values are +- off (or disabled), +- enabled (or auto, or +- if_required), +- desired, +- and +- required +- (or mandatory). +- A special value is default which is +- the implicit default setting of enabled. +- +- +- +- +- Effects for SMB1 +- +- +- The Samba-specific encryption of SMB1 connections is an +- extension to the SMB protocol negotiated as part of the UNIX +- extensions. SMB encryption uses the GSSAPI (SSPI on Windows) +- ability to encrypt and sign every request/response in a SMB +- protocol stream. When enabled it provides a secure method of +- SMB/CIFS communication, similar to an ssh protected session, but +- using SMB/CIFS authentication to negotiate encryption and +- signing keys. Currently this is only supported smbclient of by +- Samba 3.2 and newer, and hopefully soon Linux CIFSFS and MacOS/X +- clients. Windows clients do not support this feature. +- +- +- This may be set on a per-share +- basis, but clients may chose to encrypt the entire session, not +- just traffic to a specific share. If this is set to mandatory +- then all traffic to a share must +- be encrypted once the connection has been made to the share. +- The server would return "access denied" to all non-encrypted +- requests on such a share. Selecting encrypted traffic reduces +- throughput as smaller packet sizes must be used (no huge UNIX +- style read/writes allowed) as well as the overhead of encrypting +- and signing all the data. +- +- +- +- If SMB encryption is selected, Windows style SMB signing (see +- the option) is no longer +- necessary, as the GSSAPI flags use select both signing and +- sealing of the data. +- +- +- +- When set to auto or default, SMB encryption is offered, but not +- enforced. When set to mandatory, SMB encryption is required and +- if set to disabled, SMB encryption can not be negotiated. +- +- +- +- +- +- Effects for SMB2 +- +- +- Native SMB transport encryption is available in SMB version 3.0 +- or newer. It is only offered by Samba if +- server max protocol is set to +- SMB3 or newer. +- Clients supporting this type of encryption include +- Windows 8 and newer, +- Windows server 2012 and newer, +- and smbclient of Samba 4.1 and newer. +- +- +- +- The protocol implementation offers various options: +- +- +- +- +- +- The capability to perform SMB encryption can be +- negotiated during protocol negotiation. +- +- +- +- +- +- Data encryption can be enabled globally. In that case, +- an encryption-capable connection will have all traffic +- in all its sessions encrypted. In particular all share +- connections will be encrypted. +- +- +- +- +- +- Data encryption can also be enabled per share if not +- enabled globally. For an encryption-capable connection, +- all connections to an encryption-enabled share will be +- encrypted. +- +- +- +- +- +- Encryption can be enforced. This means that session +- setups will be denied on non-encryption-capable +- connections if data encryption has been enabled +- globally. And tree connections will be denied for +- non-encryption capable connections to shares with data +- encryption enabled. +- +- +- +- +- +- These features can be controlled with settings of +- smb encrypt as follows: +- +- +- +- +- +- Leaving it as default, explicitly setting +- default, or setting it to +- enabled globally will enable +- negotiation of encryption but will not turn on +- data encryption globally or per share. +- +- +- +- +- +- Setting it to desired globally +- will enable negotiation and will turn on data encryption +- on sessions and share connections for those clients +- that support it. +- +- +- +- +- +- Setting it to required globally +- will enable negotiation and turn on data encryption +- on sessions and share connections. Clients that do +- not support encryption will be denied access to the +- server. +- +- +- +- +- +- Setting it to off globally will +- completely disable the encryption feature for all +- connections. Setting smb encrypt = +- required for individual shares (while it's +- globally off) will deny access to this shares for all +- clients. +- +- +- +- +- +- Setting it to desired on a share +- will turn on data encryption for this share for clients +- that support encryption if negotiation has been +- enabled globally. +- +- +- +- +- +- Setting it to required on a share +- will enforce data encryption for this share if +- negotiation has been enabled globally. I.e. clients that +- do not support encryption will be denied access to the +- share. +- +- +- Note that this allows per-share enforcing to be +- controlled in Samba differently from Windows: +- In Windows, RejectUnencryptedAccess +- is a global setting, and if it is set, all shares with +- data encryption turned on +- are automatically enforcing encryption. In order to +- achieve the same effect in Samba, one +- has to globally set smb encrypt to +- enabled, and then set all shares +- that should be encrypted to +- required. +- Additionally, it is possible in Samba to have some +- shares with encryption required +- and some other shares with encryption only +- desired, which is not possible in +- Windows. +- +- +- +- +- +- Setting it to off or +- enabled for a share has +- no effect. +- +- +- +- +- +- + + + default +diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c +index 6674485738a..82be31e8437 100644 +--- a/source3/param/loadparm.c ++++ b/source3/param/loadparm.c +@@ -241,7 +241,7 @@ static const struct loadparm_service _sDefault = + .aio_write_size = 1, + .map_readonly = MAP_READONLY_NO, + .directory_name_cache_size = 100, +- .smb_encrypt = SMB_SIGNING_DEFAULT, ++ .server_smb_encrypt = SMB_SIGNING_DEFAULT, + .kernel_share_modes = true, + .durable_handles = true, + .check_parent_directory_delete_on_close = false, +diff --git a/source3/smbd/service.c b/source3/smbd/service.c +index ed38121f292..a263c33b7e2 100644 +--- a/source3/smbd/service.c ++++ b/source3/smbd/service.c +@@ -567,9 +567,9 @@ static NTSTATUS make_connection_snum(struct smbXsrv_connection *xconn, + conn->case_preserve = lp_preserve_case(snum); + conn->short_case_preserve = lp_short_preserve_case(snum); + +- conn->encrypt_level = lp_smb_encrypt(snum); ++ conn->encrypt_level = lp_server_smb_encrypt(snum); + if (conn->encrypt_level > SMB_SIGNING_OFF) { +- if (lp_smb_encrypt(-1) == SMB_SIGNING_OFF) { ++ if (lp_server_smb_encrypt(-1) == SMB_SIGNING_OFF) { + if (conn->encrypt_level == SMB_SIGNING_REQUIRED) { + DBG_ERR("Service [%s] requires encryption, but " + "it is disabled globally!\n", +diff --git a/source3/smbd/smb2_negprot.c b/source3/smbd/smb2_negprot.c +index 4071f42b5e0..674942b71de 100644 +--- a/source3/smbd/smb2_negprot.c ++++ b/source3/smbd/smb2_negprot.c +@@ -335,7 +335,7 @@ NTSTATUS smbd_smb2_request_process_negprot(struct smbd_smb2_request *req) + } + + if ((protocol >= PROTOCOL_SMB2_24) && +- (lp_smb_encrypt(-1) != SMB_SIGNING_OFF) && ++ (lp_server_smb_encrypt(-1) != SMB_SIGNING_OFF) && + (in_capabilities & SMB2_CAP_ENCRYPTION)) { + capabilities |= SMB2_CAP_ENCRYPTION; + } +diff --git a/source3/smbd/smb2_sesssetup.c b/source3/smbd/smb2_sesssetup.c +index 2b6b3a820d4..8957411e167 100644 +--- a/source3/smbd/smb2_sesssetup.c ++++ b/source3/smbd/smb2_sesssetup.c +@@ -292,12 +292,12 @@ static NTSTATUS smbd_smb2_auth_generic_return(struct smbXsrv_session *session, + x->global->signing_flags = SMBXSRV_SIGNING_REQUIRED; + } + +- if ((lp_smb_encrypt(-1) >= SMB_SIGNING_DESIRED) && ++ if ((lp_server_smb_encrypt(-1) >= SMB_SIGNING_DESIRED) && + (xconn->smb2.client.capabilities & SMB2_CAP_ENCRYPTION)) { + x->global->encryption_flags = SMBXSRV_ENCRYPTION_DESIRED; + } + +- if (lp_smb_encrypt(-1) == SMB_SIGNING_REQUIRED) { ++ if (lp_server_smb_encrypt(-1) == SMB_SIGNING_REQUIRED) { + x->global->encryption_flags = SMBXSRV_ENCRYPTION_REQUIRED | + SMBXSRV_ENCRYPTION_DESIRED; + } +diff --git a/source3/smbd/smb2_tcon.c b/source3/smbd/smb2_tcon.c +index 76112d04889..0dd3c653b4b 100644 +--- a/source3/smbd/smb2_tcon.c ++++ b/source3/smbd/smb2_tcon.c +@@ -302,13 +302,13 @@ static NTSTATUS smbd_smb2_tree_connect(struct smbd_smb2_request *req, + TALLOC_FREE(proxy); + } + +- if ((lp_smb_encrypt(snum) >= SMB_SIGNING_DESIRED) && ++ if ((lp_server_smb_encrypt(snum) >= SMB_SIGNING_DESIRED) && + (conn->smb2.server.cipher != 0)) + { + encryption_desired = true; + } + +- if (lp_smb_encrypt(snum) == SMB_SIGNING_REQUIRED) { ++ if (lp_server_smb_encrypt(snum) == SMB_SIGNING_REQUIRED) { + encryption_desired = true; + encryption_required = true; + } +diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c +index 7acde285a90..b745e0906b1 100644 +--- a/source3/smbd/trans2.c ++++ b/source3/smbd/trans2.c +@@ -4484,7 +4484,7 @@ static void call_trans2setfsinfo(connection_struct *conn, + return; + } + +- if (lp_smb_encrypt(SNUM(conn)) == SMB_SIGNING_OFF) { ++ if (lp_server_smb_encrypt(SNUM(conn)) == SMB_SIGNING_OFF) { + reply_nterror( + req, + NT_STATUS_NOT_SUPPORTED); +-- +2.28.0 + + +From 71b97ba1fd9260efd29e3ab3456b82d2a4f6dcc8 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 28 May 2020 10:04:19 +0200 +Subject: [PATCH 005/105] param: Create and use enum_smb_encryption_vals + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + .../smbdotconf/security/serversmbencrypt.xml | 2 +- + docs-xml/smbdotconf/security/smbencrypt.xml | 2 +- + lib/param/param_table.c | 23 +++++++++++++++++++ + libcli/smb/smb_constants.h | 9 ++++++++ + 4 files changed, 34 insertions(+), 2 deletions(-) + +diff --git a/docs-xml/smbdotconf/security/serversmbencrypt.xml b/docs-xml/smbdotconf/security/serversmbencrypt.xml +index 714aacbf1ca..5f38b46419e 100644 +--- a/docs-xml/smbdotconf/security/serversmbencrypt.xml ++++ b/docs-xml/smbdotconf/security/serversmbencrypt.xml +@@ -1,7 +1,7 @@ + + + +diff --git a/docs-xml/smbdotconf/security/smbencrypt.xml b/docs-xml/smbdotconf/security/smbencrypt.xml +index 798e616b765..60271200c0a 100644 +--- a/docs-xml/smbdotconf/security/smbencrypt.xml ++++ b/docs-xml/smbdotconf/security/smbencrypt.xml +@@ -1,7 +1,7 @@ + +diff --git a/lib/param/param_table.c b/lib/param/param_table.c +index 47b85de1f87..e2f737279dc 100644 +--- a/lib/param/param_table.c ++++ b/lib/param/param_table.c +@@ -138,6 +138,29 @@ static const struct enum_list enum_smb_signing_vals[] = { + {-1, NULL} + }; + ++static const struct enum_list enum_smb_encryption_vals[] = { ++ {SMB_ENCRYPTION_DEFAULT, "default"}, ++ {SMB_ENCRYPTION_OFF, "No"}, ++ {SMB_ENCRYPTION_OFF, "False"}, ++ {SMB_ENCRYPTION_OFF, "0"}, ++ {SMB_ENCRYPTION_OFF, "Off"}, ++ {SMB_ENCRYPTION_OFF, "disabled"}, ++ {SMB_ENCRYPTION_IF_REQUIRED, "if_required"}, ++ {SMB_ENCRYPTION_IF_REQUIRED, "Yes"}, ++ {SMB_ENCRYPTION_IF_REQUIRED, "True"}, ++ {SMB_ENCRYPTION_IF_REQUIRED, "1"}, ++ {SMB_ENCRYPTION_IF_REQUIRED, "On"}, ++ {SMB_ENCRYPTION_IF_REQUIRED, "enabled"}, ++ {SMB_ENCRYPTION_IF_REQUIRED, "auto"}, ++ {SMB_ENCRYPTION_DESIRED, "desired"}, ++ {SMB_ENCRYPTION_REQUIRED, "required"}, ++ {SMB_ENCRYPTION_REQUIRED, "mandatory"}, ++ {SMB_ENCRYPTION_REQUIRED, "force"}, ++ {SMB_ENCRYPTION_REQUIRED, "forced"}, ++ {SMB_ENCRYPTION_REQUIRED, "enforced"}, ++ {-1, NULL} ++}; ++ + static const struct enum_list enum_mdns_name_values[] = { + {MDNS_NAME_NETBIOS, "netbios"}, + {MDNS_NAME_MDNS, "mdns"}, +diff --git a/libcli/smb/smb_constants.h b/libcli/smb/smb_constants.h +index b424b13cde4..2fb1fd7189e 100644 +--- a/libcli/smb/smb_constants.h ++++ b/libcli/smb/smb_constants.h +@@ -106,6 +106,15 @@ enum smb_signing_setting { + SMB_SIGNING_REQUIRED = 3, + }; + ++/* This MUST align with 'enum smb_signing_setting' */ ++enum smb_encryption_setting { ++ SMB_ENCRYPTION_DEFAULT = SMB_SIGNING_DEFAULT, ++ SMB_ENCRYPTION_OFF = SMB_SIGNING_OFF, ++ SMB_ENCRYPTION_IF_REQUIRED = SMB_SIGNING_IF_REQUIRED, ++ SMB_ENCRYPTION_DESIRED = SMB_SIGNING_DESIRED, ++ SMB_ENCRYPTION_REQUIRED = SMB_SIGNING_REQUIRED, ++}; ++ + /* types of buffers in core SMB protocol */ + #define SMB_DATA_BLOCK 0x1 + #define SMB_ASCII4 0x4 +-- +2.28.0 + + +From ca1e10a901af67327d25765bfed404e2d1c756a5 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 26 May 2020 09:34:54 +0200 +Subject: [PATCH 006/105] s3:smbd: Use 'enum smb_encryption_setting' values + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + source3/param/loadparm.c | 2 +- + source3/smbd/service.c | 8 ++++---- + source3/smbd/smb2_negprot.c | 2 +- + source3/smbd/smb2_sesssetup.c | 4 ++-- + source3/smbd/smb2_tcon.c | 4 ++-- + source3/smbd/trans2.c | 3 ++- + 6 files changed, 12 insertions(+), 11 deletions(-) + +diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c +index 82be31e8437..b305e34b252 100644 +--- a/source3/param/loadparm.c ++++ b/source3/param/loadparm.c +@@ -241,7 +241,7 @@ static const struct loadparm_service _sDefault = + .aio_write_size = 1, + .map_readonly = MAP_READONLY_NO, + .directory_name_cache_size = 100, +- .server_smb_encrypt = SMB_SIGNING_DEFAULT, ++ .server_smb_encrypt = SMB_ENCRYPTION_DEFAULT, + .kernel_share_modes = true, + .durable_handles = true, + .check_parent_directory_delete_on_close = false, +diff --git a/source3/smbd/service.c b/source3/smbd/service.c +index a263c33b7e2..43803e721c2 100644 +--- a/source3/smbd/service.c ++++ b/source3/smbd/service.c +@@ -568,16 +568,16 @@ static NTSTATUS make_connection_snum(struct smbXsrv_connection *xconn, + conn->short_case_preserve = lp_short_preserve_case(snum); + + conn->encrypt_level = lp_server_smb_encrypt(snum); +- if (conn->encrypt_level > SMB_SIGNING_OFF) { +- if (lp_server_smb_encrypt(-1) == SMB_SIGNING_OFF) { +- if (conn->encrypt_level == SMB_SIGNING_REQUIRED) { ++ if (conn->encrypt_level > SMB_ENCRYPTION_OFF) { ++ if (lp_server_smb_encrypt(-1) == SMB_ENCRYPTION_OFF) { ++ if (conn->encrypt_level == SMB_ENCRYPTION_REQUIRED) { + DBG_ERR("Service [%s] requires encryption, but " + "it is disabled globally!\n", + lp_const_servicename(snum)); + status = NT_STATUS_ACCESS_DENIED; + goto err_root_exit; + } +- conn->encrypt_level = SMB_SIGNING_OFF; ++ conn->encrypt_level = SMB_ENCRYPTION_OFF; + } + } + +diff --git a/source3/smbd/smb2_negprot.c b/source3/smbd/smb2_negprot.c +index 674942b71de..99303f1b07b 100644 +--- a/source3/smbd/smb2_negprot.c ++++ b/source3/smbd/smb2_negprot.c +@@ -335,7 +335,7 @@ NTSTATUS smbd_smb2_request_process_negprot(struct smbd_smb2_request *req) + } + + if ((protocol >= PROTOCOL_SMB2_24) && +- (lp_server_smb_encrypt(-1) != SMB_SIGNING_OFF) && ++ (lp_server_smb_encrypt(-1) != SMB_ENCRYPTION_OFF) && + (in_capabilities & SMB2_CAP_ENCRYPTION)) { + capabilities |= SMB2_CAP_ENCRYPTION; + } +diff --git a/source3/smbd/smb2_sesssetup.c b/source3/smbd/smb2_sesssetup.c +index 8957411e167..907dd92321e 100644 +--- a/source3/smbd/smb2_sesssetup.c ++++ b/source3/smbd/smb2_sesssetup.c +@@ -292,12 +292,12 @@ static NTSTATUS smbd_smb2_auth_generic_return(struct smbXsrv_session *session, + x->global->signing_flags = SMBXSRV_SIGNING_REQUIRED; + } + +- if ((lp_server_smb_encrypt(-1) >= SMB_SIGNING_DESIRED) && ++ if ((lp_server_smb_encrypt(-1) >= SMB_ENCRYPTION_DESIRED) && + (xconn->smb2.client.capabilities & SMB2_CAP_ENCRYPTION)) { + x->global->encryption_flags = SMBXSRV_ENCRYPTION_DESIRED; + } + +- if (lp_server_smb_encrypt(-1) == SMB_SIGNING_REQUIRED) { ++ if (lp_server_smb_encrypt(-1) == SMB_ENCRYPTION_REQUIRED) { + x->global->encryption_flags = SMBXSRV_ENCRYPTION_REQUIRED | + SMBXSRV_ENCRYPTION_DESIRED; + } +diff --git a/source3/smbd/smb2_tcon.c b/source3/smbd/smb2_tcon.c +index 0dd3c653b4b..d7e0cf90f47 100644 +--- a/source3/smbd/smb2_tcon.c ++++ b/source3/smbd/smb2_tcon.c +@@ -302,13 +302,13 @@ static NTSTATUS smbd_smb2_tree_connect(struct smbd_smb2_request *req, + TALLOC_FREE(proxy); + } + +- if ((lp_server_smb_encrypt(snum) >= SMB_SIGNING_DESIRED) && ++ if ((lp_server_smb_encrypt(snum) >= SMB_ENCRYPTION_DESIRED) && + (conn->smb2.server.cipher != 0)) + { + encryption_desired = true; + } + +- if (lp_server_smb_encrypt(snum) == SMB_SIGNING_REQUIRED) { ++ if (lp_server_smb_encrypt(snum) == SMB_ENCRYPTION_REQUIRED) { + encryption_desired = true; + encryption_required = true; + } +diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c +index b745e0906b1..2f2fdcb7260 100644 +--- a/source3/smbd/trans2.c ++++ b/source3/smbd/trans2.c +@@ -4484,7 +4484,8 @@ static void call_trans2setfsinfo(connection_struct *conn, + return; + } + +- if (lp_server_smb_encrypt(SNUM(conn)) == SMB_SIGNING_OFF) { ++ if (lp_server_smb_encrypt(SNUM(conn)) == ++ SMB_ENCRYPTION_OFF) { + reply_nterror( + req, + NT_STATUS_NOT_SUPPORTED); +-- +2.28.0 + + +From a5630bb933393fe69ff9b7f072221b9085d6277c Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 9 Apr 2020 10:38:41 +0200 +Subject: [PATCH 007/105] docs-xml: Add 'client smb encrypt' + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + .../smbdotconf/security/clientsmbencrypt.xml | 126 ++++++++++++++++++ + lib/param/loadparm.c | 4 + + source3/param/loadparm.c | 2 + + 3 files changed, 132 insertions(+) + create mode 100644 docs-xml/smbdotconf/security/clientsmbencrypt.xml + +diff --git a/docs-xml/smbdotconf/security/clientsmbencrypt.xml b/docs-xml/smbdotconf/security/clientsmbencrypt.xml +new file mode 100644 +index 00000000000..05df152e734 +--- /dev/null ++++ b/docs-xml/smbdotconf/security/clientsmbencrypt.xml +@@ -0,0 +1,126 @@ ++ ++ ++ ++ This parameter controls whether a client should try or is required ++ to use SMB encryption. It has different effects depending on whether ++ the connection uses SMB1 or SMB3: ++ ++ ++ ++ ++ ++ If the connection uses SMB1, then this option controls the use ++ of a Samba-specific extension to the SMB protocol introduced in ++ Samba 3.2 that makes use of the Unix extensions. ++ ++ ++ ++ ++ ++ If the connection uses SMB2 or newer, then this option controls ++ the use of the SMB-level encryption that is supported in SMB ++ version 3.0 and above and available in Windows 8 and newer. ++ ++ ++ ++ ++ ++ This parameter can be set globally. Possible values are ++ ++ off, ++ if_required, ++ desired, ++ and ++ required. ++ A special value is default which is ++ the implicit default setting of if_required. ++ ++ ++ ++ ++ Effects for SMB1 ++ ++ ++ The Samba-specific encryption of SMB1 connections is an ++ extension to the SMB protocol negotiated as part of the UNIX ++ extensions. SMB encryption uses the GSSAPI (SSPI on Windows) ++ ability to encrypt and sign every request/response in a SMB ++ protocol stream. When enabled it provides a secure method of ++ SMB/CIFS communication, similar to an ssh protected session, but ++ using SMB/CIFS authentication to negotiate encryption and ++ signing keys. Currently this is only supported smbclient of by ++ Samba 3.2 and newer. Windows does not support this feature. ++ ++ ++ ++ When set to default, SMB encryption is probed, but not ++ enforced. When set to required, SMB encryption is required and ++ if set to disabled, SMB encryption can not be negotiated. ++ ++ ++ ++ ++ ++ Effects for SMB3 and newer ++ ++ ++ Native SMB transport encryption is available in SMB version 3.0 ++ or newer. It is only used by Samba if ++ client max protocol is set to ++ SMB3 or newer. ++ ++ ++ ++ These features can be controlled with settings of ++ client smb encrypt as follows: ++ ++ ++ ++ ++ ++ Leaving it as default, explicitly setting ++ default, or setting it to ++ if_required globally will enable ++ negotiation of encryption but will not turn on ++ data encryption globally. ++ ++ ++ ++ ++ ++ Setting it to desired globally ++ will enable negotiation and will turn on data encryption ++ on sessions and share connections for those servers ++ that support it. ++ ++ ++ ++ ++ ++ Setting it to required globally ++ will enable negotiation and turn on data encryption ++ on sessions and share connections. Clients that do ++ not support encryption will be denied access to the ++ server. ++ ++ ++ ++ ++ ++ Setting it to off globally will ++ completely disable the encryption feature for all ++ connections. ++ ++ ++ ++ ++ ++ ++ ++ ++default ++ +diff --git a/lib/param/loadparm.c b/lib/param/loadparm.c +index e041f4fb01b..e167903dbd9 100644 +--- a/lib/param/loadparm.c ++++ b/lib/param/loadparm.c +@@ -3079,6 +3079,10 @@ struct loadparm_context *loadparm_init(TALLOC_CTX *mem_ctx) + lpcfg_do_global_parameter( + lp_ctx, "ldap max search request size", "256000"); + ++ lpcfg_do_global_parameter(lp_ctx, ++ "client smb encrypt", ++ "default"); ++ + for (i = 0; parm_table[i].label; i++) { + if (!(lp_ctx->flags[i] & FLAG_CMDLINE)) { + lp_ctx->flags[i] |= FLAG_DEFAULT; +diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c +index b305e34b252..9a2a309b781 100644 +--- a/source3/param/loadparm.c ++++ b/source3/param/loadparm.c +@@ -960,6 +960,8 @@ static void init_globals(struct loadparm_context *lp_ctx, bool reinit_globals) + Globals.ldap_max_authenticated_request_size = 16777216; + Globals.ldap_max_search_request_size = 256000; + ++ Globals.client_smb_encrypt = SMB_ENCRYPTION_DEFAULT; ++ + /* Now put back the settings that were set with lp_set_cmdline() */ + apply_lp_set_cmdline(); + } +-- +2.28.0 + + +From 3d826b1efb4a0e1f77875c7cbad2fcd16c3ac17b Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 22 Jul 2020 17:48:25 +0200 +Subject: [PATCH 008/105] lib:param: Add lpcfg_parse_enum_vals() + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + lib/param/loadparm.c | 30 ++++++++++++++++++++++++++++++ + lib/param/loadparm.h | 2 ++ + 2 files changed, 32 insertions(+) + +diff --git a/lib/param/loadparm.c b/lib/param/loadparm.c +index e167903dbd9..952d2b49811 100644 +--- a/lib/param/loadparm.c ++++ b/lib/param/loadparm.c +@@ -3674,3 +3674,33 @@ char *lpcfg_substituted_string(TALLOC_CTX *mem_ctx, + raw_value, + lp_sub->private_data); + } ++ ++/** ++ * @brief Parse a string value of a given parameter to its integer enum value. ++ * ++ * @param[in] param_name The parameter name (e.g. 'client smb encrypt') ++ * ++ * @param[in] param_value The parameter value (e.g. 'required'). ++ * ++ * @return The integer value of the enum the param_value matches or INT32_MIN ++ * on error. ++ */ ++int32_t lpcfg_parse_enum_vals(const char *param_name, ++ const char *param_value) ++{ ++ struct parm_struct *parm = NULL; ++ int32_t ret = INT32_MIN; ++ bool ok; ++ ++ parm = lpcfg_parm_struct(NULL, param_name); ++ if (parm == NULL) { ++ return INT32_MIN; ++ } ++ ++ ok = lp_set_enum_parm(parm, param_value, &ret); ++ if (!ok) { ++ return INT32_MIN; ++ } ++ ++ return ret; ++} +diff --git a/lib/param/loadparm.h b/lib/param/loadparm.h +index 323fcf84523..e66ce2324b4 100644 +--- a/lib/param/loadparm.h ++++ b/lib/param/loadparm.h +@@ -316,6 +316,8 @@ bool lp_do_section(const char *pszSectionName, void *userdata); + bool store_lp_set_cmdline(const char *pszParmName, const char *pszParmValue); + + int num_parameters(void); ++int32_t lpcfg_parse_enum_vals(const char *param_name, ++ const char *param_value); + + struct loadparm_substitution; + #ifdef LOADPARM_SUBSTITUTION_INTERNALS +-- +2.28.0 + + +From 2f74f9d6a5d38e6eb2ca3d32f61d5d9b1c55f3c1 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 9 Oct 2019 09:38:08 +0200 +Subject: [PATCH 009/105] libcli:smb: Add smb_signing_setting_translate() + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + libcli/smb/smb_util.h | 7 ++++ + libcli/smb/test_util_translate.c | 64 ++++++++++++++++++++++++++++++++ + libcli/smb/util.c | 20 ++++++++++ + libcli/smb/wscript | 5 +++ + selftest/tests.py | 2 + + 5 files changed, 98 insertions(+) + create mode 100644 libcli/smb/test_util_translate.c + +diff --git a/libcli/smb/smb_util.h b/libcli/smb/smb_util.h +index 8861741c92f..15bdbe856d1 100644 +--- a/libcli/smb/smb_util.h ++++ b/libcli/smb/smb_util.h +@@ -24,6 +24,9 @@ + #include "smb_constants.h" + #include + ++#ifndef _SMB_UTIL_H ++#define _SMB_UTIL_H ++ + const char *smb_protocol_types_string(enum protocol_types protocol); + char *attrib_string(TALLOC_CTX *mem_ctx, uint32_t attrib); + uint32_t unix_perms_to_wire(mode_t perms); +@@ -46,3 +49,7 @@ NTSTATUS smb_bytes_pull_str(TALLOC_CTX *mem_ctx, char **_str, bool ucs2, + const uint8_t *buf, size_t buf_len, + const uint8_t *position, + size_t *_consumed); ++ ++enum smb_signing_setting smb_signing_setting_translate(const char *str); ++ ++#endif /* _SMB_UTIL_H */ +diff --git a/libcli/smb/test_util_translate.c b/libcli/smb/test_util_translate.c +new file mode 100644 +index 00000000000..4b81984affa +--- /dev/null ++++ b/libcli/smb/test_util_translate.c +@@ -0,0 +1,64 @@ ++/* ++ * Unix SMB/CIFS implementation. ++ * ++ * Copyright (C) 2020 Andreas Schneider ++ * ++ * This program is free software; you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License as published by ++ * the Free Software Foundation; either version 3 of the License, or ++ * (at your option) any later version. ++ * ++ * This program is distributed in the hope that it will be useful, ++ * but WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++ * GNU General Public License for more details. ++ * ++ * You should have received a copy of the GNU General Public License ++ * along with this program. If not, see . ++ */ ++ ++#include ++#include ++#include ++#include ++#include ++ ++#include "lib/replace/replace.h" ++#include ++ ++#include "libcli/smb/util.c" ++ ++static void test_smb_signing_setting_translate(void **state) ++{ ++ enum smb_signing_setting signing_state; ++ ++ signing_state = smb_signing_setting_translate("wurst"); ++ assert_int_equal(signing_state, SMB_SIGNING_REQUIRED); ++ ++ signing_state = smb_signing_setting_translate("off"); ++ assert_int_equal(signing_state, SMB_SIGNING_OFF); ++ ++ signing_state = smb_signing_setting_translate("if_required"); ++ assert_int_equal(signing_state, SMB_SIGNING_IF_REQUIRED); ++ ++ signing_state = smb_signing_setting_translate("mandatory"); ++ assert_int_equal(signing_state, SMB_SIGNING_REQUIRED); ++ ++} ++ ++int main(int argc, char *argv[]) ++{ ++ int rc; ++ const struct CMUnitTest tests[] = { ++ cmocka_unit_test(test_smb_signing_setting_translate), ++ }; ++ ++ if (argc == 2) { ++ cmocka_set_test_filter(argv[1]); ++ } ++ cmocka_set_message_output(CM_OUTPUT_SUBUNIT); ++ ++ rc = cmocka_run_group_tests(tests, NULL, NULL); ++ ++ return rc; ++} +diff --git a/libcli/smb/util.c b/libcli/smb/util.c +index 6fdf35fbbf3..da0e4db2bf3 100644 +--- a/libcli/smb/util.c ++++ b/libcli/smb/util.c +@@ -22,6 +22,7 @@ + #include "includes.h" + #include "libcli/smb/smb_common.h" + #include "system/filesys.h" ++#include "lib/param/loadparm.h" + + const char *smb_protocol_types_string(enum protocol_types protocol) + { +@@ -428,3 +429,22 @@ NTSTATUS smb_bytes_pull_str(TALLOC_CTX *mem_ctx, char **_str, bool ucs2, + return internal_bytes_pull_str(mem_ctx, _str, ucs2, true, + buf, buf_len, position, _consumed); + } ++ ++/** ++ * @brief Translate SMB signing settings as string to an enum. ++ * ++ * @param[in] str The string to translate. ++ * ++ * @return A corresponding enum @smb_signing_setting tranlated from the string. ++ */ ++enum smb_signing_setting smb_signing_setting_translate(const char *str) ++{ ++ enum smb_signing_setting signing_state = SMB_SIGNING_REQUIRED; ++ int32_t val = lpcfg_parse_enum_vals("client signing", str); ++ ++ if (val != INT32_MIN) { ++ signing_state = val; ++ } ++ ++ return signing_state; ++} +diff --git a/libcli/smb/wscript b/libcli/smb/wscript +index 86e377f570b..c047fd33278 100644 +--- a/libcli/smb/wscript ++++ b/libcli/smb/wscript +@@ -72,3 +72,8 @@ def build(bld): + source='test_smb1cli_session.c', + deps='cmocka cli_smb_common', + for_selftest=True) ++ ++ bld.SAMBA_BINARY('test_util_translate', ++ source='test_util_translate.c', ++ deps='cmocka cli_smb_common', ++ for_selftest=True) +diff --git a/selftest/tests.py b/selftest/tests.py +index 6918e1306c3..20981754db4 100644 +--- a/selftest/tests.py ++++ b/selftest/tests.py +@@ -376,6 +376,8 @@ plantestsuite("samba.unittests.lib_util_modules", "none", + + plantestsuite("samba.unittests.smb1cli_session", "none", + [os.path.join(bindir(), "default/libcli/smb/test_smb1cli_session")]) ++plantestsuite("samba.unittests.smb_util_translate", "none", ++ [os.path.join(bindir(), "default/libcli/smb/test_util_translate")]) + + plantestsuite("samba.unittests.talloc_keep_secret", "none", + [os.path.join(bindir(), "default/lib/util/test_talloc_keep_secret")]) +-- +2.28.0 + + +From 912ec83bf4ec6a965ee10ace1d74036c5c6a4c92 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 26 May 2020 08:39:34 +0200 +Subject: [PATCH 010/105] libcli:smb: Add smb_encryption_setting_translate() + +Add encryption enum and function to avoid confusion when reading the +code. + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + libcli/smb/smb_util.h | 1 + + libcli/smb/test_util_translate.c | 19 +++++++++++++++++++ + libcli/smb/util.c | 20 ++++++++++++++++++++ + 3 files changed, 40 insertions(+) + +diff --git a/libcli/smb/smb_util.h b/libcli/smb/smb_util.h +index 15bdbe856d1..2a727db8b6f 100644 +--- a/libcli/smb/smb_util.h ++++ b/libcli/smb/smb_util.h +@@ -51,5 +51,6 @@ NTSTATUS smb_bytes_pull_str(TALLOC_CTX *mem_ctx, char **_str, bool ucs2, + size_t *_consumed); + + enum smb_signing_setting smb_signing_setting_translate(const char *str); ++enum smb_encryption_setting smb_encryption_setting_translate(const char *str); + + #endif /* _SMB_UTIL_H */ +diff --git a/libcli/smb/test_util_translate.c b/libcli/smb/test_util_translate.c +index 4b81984affa..b300af52c09 100644 +--- a/libcli/smb/test_util_translate.c ++++ b/libcli/smb/test_util_translate.c +@@ -46,11 +46,30 @@ static void test_smb_signing_setting_translate(void **state) + + } + ++static void test_smb_encryption_setting_translate(void **state) ++{ ++ enum smb_encryption_setting encryption_state; ++ ++ encryption_state = smb_encryption_setting_translate("wurst"); ++ assert_int_equal(encryption_state, SMB_ENCRYPTION_REQUIRED); ++ ++ encryption_state = smb_encryption_setting_translate("off"); ++ assert_int_equal(encryption_state, SMB_ENCRYPTION_OFF); ++ ++ encryption_state = smb_encryption_setting_translate("if_required"); ++ assert_int_equal(encryption_state, SMB_ENCRYPTION_IF_REQUIRED); ++ ++ encryption_state = smb_encryption_setting_translate("mandatory"); ++ assert_int_equal(encryption_state, SMB_ENCRYPTION_REQUIRED); ++ ++} ++ + int main(int argc, char *argv[]) + { + int rc; + const struct CMUnitTest tests[] = { + cmocka_unit_test(test_smb_signing_setting_translate), ++ cmocka_unit_test(test_smb_encryption_setting_translate), + }; + + if (argc == 2) { +diff --git a/libcli/smb/util.c b/libcli/smb/util.c +index da0e4db2bf3..ac2887ee5c4 100644 +--- a/libcli/smb/util.c ++++ b/libcli/smb/util.c +@@ -448,3 +448,23 @@ enum smb_signing_setting smb_signing_setting_translate(const char *str) + + return signing_state; + } ++ ++/** ++ * @brief Translate SMB encryption settings as string to an enum. ++ * ++ * @param[in] str The string to translate. ++ * ++ * @return A corresponding enum @smb_encryption_setting tranlated from the ++ * string. ++ */ ++enum smb_encryption_setting smb_encryption_setting_translate(const char *str) ++{ ++ enum smb_encryption_setting encryption_state = SMB_ENCRYPTION_REQUIRED; ++ int32_t val = lpcfg_parse_enum_vals("client smb encrypt", str); ++ ++ if (val != INT32_MIN) { ++ encryption_state = val; ++ } ++ ++ return encryption_state; ++} +-- +2.28.0 + + +From 7d2c3a519805549f577b54cf72a5d95b4ae744f3 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 9 Oct 2019 09:47:59 +0200 +Subject: [PATCH 011/105] s3:lib: Use smb_signing_setting_translate for cmdline + parsing + +The function will be removed soon. + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + source3/lib/util_cmdline.c | 17 +++-------------- + source3/wscript_build | 2 +- + 2 files changed, 4 insertions(+), 15 deletions(-) + +diff --git a/source3/lib/util_cmdline.c b/source3/lib/util_cmdline.c +index 90ee67c4cb7..bc1f1c3ed25 100644 +--- a/source3/lib/util_cmdline.c ++++ b/source3/lib/util_cmdline.c +@@ -28,6 +28,7 @@ + #include "librpc/gen_ndr/samr.h" + #include "auth/credentials/credentials.h" + #include "auth/gensec/gensec.h" ++#include "libcli/smb/smb_util.h" + + /**************************************************************************n + Code to cope with username/password auth options from the commandline. +@@ -240,20 +241,8 @@ void set_cmdline_auth_info_password(struct user_auth_info *auth_info, + bool set_cmdline_auth_info_signing_state(struct user_auth_info *auth_info, + const char *arg) + { +- auth_info->signing_state = SMB_SIGNING_DEFAULT; +- if (strequal(arg, "off") || strequal(arg, "no") || +- strequal(arg, "false")) { +- auth_info->signing_state = SMB_SIGNING_OFF; +- } else if (strequal(arg, "on") || strequal(arg, "yes") || +- strequal(arg, "if_required") || +- strequal(arg, "true") || strequal(arg, "auto")) { +- auth_info->signing_state = SMB_SIGNING_IF_REQUIRED; +- } else if (strequal(arg, "force") || strequal(arg, "required") || +- strequal(arg, "forced")) { +- auth_info->signing_state = SMB_SIGNING_REQUIRED; +- } else { +- return false; +- } ++ auth_info->signing_state = smb_signing_setting_translate(arg); ++ + return true; + } + +diff --git a/source3/wscript_build b/source3/wscript_build +index 5a07eddac44..6a08afe4a25 100644 +--- a/source3/wscript_build ++++ b/source3/wscript_build +@@ -279,7 +279,7 @@ bld.SAMBA3_LIBRARY('popt_samba3_cmdline', + + bld.SAMBA3_LIBRARY('util_cmdline', + source='lib/util_cmdline.c', +- deps='secrets3 samba-credentials', ++ deps='secrets3 samba-credentials cli_smb_common', + private_library=True) + + bld.SAMBA3_LIBRARY('cmdline_contexts', +-- +2.28.0 + + +From d488762aa9468bd54890a2fe3dba3fd52582b556 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 23 Jul 2020 07:47:18 +0200 +Subject: [PATCH 012/105] auth:creds: Remove unused credentials autoproto + header + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + auth/credentials/credentials_krb5.c | 1 - + auth/credentials/credentials_secrets.c | 1 - + auth/credentials/wscript_build | 1 - + source4/auth/kerberos/kerberos_util.c | 1 - + source4/auth/tests/kerberos.c | 1 - + 5 files changed, 5 deletions(-) + +diff --git a/auth/credentials/credentials_krb5.c b/auth/credentials/credentials_krb5.c +index 20e677e521a..259b35b73b0 100644 +--- a/auth/credentials/credentials_krb5.c ++++ b/auth/credentials/credentials_krb5.c +@@ -27,7 +27,6 @@ + #include "auth/kerberos/kerberos.h" + #include "auth/credentials/credentials.h" + #include "auth/credentials/credentials_internal.h" +-#include "auth/credentials/credentials_proto.h" + #include "auth/credentials/credentials_krb5.h" + #include "auth/kerberos/kerberos_credentials.h" + #include "auth/kerberos/kerberos_srv_keytab.h" +diff --git a/auth/credentials/credentials_secrets.c b/auth/credentials/credentials_secrets.c +index 54f3ce2d078..52a89d4d5b4 100644 +--- a/auth/credentials/credentials_secrets.c ++++ b/auth/credentials/credentials_secrets.c +@@ -29,7 +29,6 @@ + #include "system/filesys.h" + #include "auth/credentials/credentials.h" + #include "auth/credentials/credentials_internal.h" +-#include "auth/credentials/credentials_proto.h" + #include "auth/credentials/credentials_krb5.h" + #include "auth/kerberos/kerberos_util.h" + #include "param/param.h" +diff --git a/auth/credentials/wscript_build b/auth/credentials/wscript_build +index f5aba1de248..564a04fe8dd 100644 +--- a/auth/credentials/wscript_build ++++ b/auth/credentials/wscript_build +@@ -2,7 +2,6 @@ + + bld.SAMBA_LIBRARY('samba-credentials', + source='credentials.c', +- autoproto='credentials_proto.h', + public_headers='credentials.h', + pc_files='samba-credentials.pc', + deps='LIBCRYPTO samba-errors events LIBCLI_AUTH samba-security CREDENTIALS_SECRETS CREDENTIALS_KRB5', +diff --git a/source4/auth/kerberos/kerberos_util.c b/source4/auth/kerberos/kerberos_util.c +index ffef24f285c..544d9d853cc 100644 +--- a/source4/auth/kerberos/kerberos_util.c ++++ b/source4/auth/kerberos/kerberos_util.c +@@ -24,7 +24,6 @@ + #include "system/kerberos.h" + #include "auth/kerberos/kerberos.h" + #include "auth/credentials/credentials.h" +-#include "auth/credentials/credentials_proto.h" + #include "auth/credentials/credentials_krb5.h" + #include "auth/kerberos/kerberos_credentials.h" + #include "auth/kerberos/kerberos_util.h" +diff --git a/source4/auth/tests/kerberos.c b/source4/auth/tests/kerberos.c +index 7711eac2afa..d9be3562adb 100644 +--- a/source4/auth/tests/kerberos.c ++++ b/source4/auth/tests/kerberos.c +@@ -10,7 +10,6 @@ + #include "system/kerberos.h" + #include "auth/kerberos/kerberos.h" + #include "auth/credentials/credentials.h" +-#include "auth/credentials/credentials_proto.h" + #include "auth/credentials/credentials_krb5.h" + #include "auth/kerberos/kerberos_credentials.h" + #include "auth/kerberos/kerberos_util.h" +-- +2.28.0 + + +From 696d2230503dada1e4369500c7c632bd7d3e5527 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 26 May 2020 09:32:44 +0200 +Subject: [PATCH 013/105] auth:creds: Add + cli_credentials_(get|set)_smb_signing() + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + auth/credentials/credentials.c | 45 +++++++++++++++++++++++++ + auth/credentials/credentials.h | 7 ++++ + auth/credentials/credentials_internal.h | 4 +++ + 3 files changed, 56 insertions(+) + +diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c +index 80a31b248ae..365a6def7ea 100644 +--- a/auth/credentials/credentials.c ++++ b/auth/credentials/credentials.c +@@ -44,6 +44,8 @@ _PUBLIC_ struct cli_credentials *cli_credentials_init(TALLOC_CTX *mem_ctx) + + cred->winbind_separator = '\\'; + ++ cred->signing_state = SMB_SIGNING_DEFAULT; ++ + return cred; + } + +@@ -922,6 +924,12 @@ _PUBLIC_ void cli_credentials_set_conf(struct cli_credentials *cred, + if (sep != NULL && sep[0] != '\0') { + cred->winbind_separator = *lpcfg_winbind_separator(lp_ctx); + } ++ ++ if (cred->signing_state_obtained <= CRED_SMB_CONF) { ++ /* Will be set to default for invalid smb.conf values */ ++ cred->signing_state = lpcfg_client_signing(lp_ctx); ++ cred->signing_state_obtained = CRED_SMB_CONF; ++ } + } + + /** +@@ -1304,6 +1312,43 @@ _PUBLIC_ bool cli_credentials_parse_password_fd(struct cli_credentials *credenti + return true; + } + ++/** ++ * @brief Set the SMB signing state to request for a SMB connection. ++ * ++ * @param[in] creds The credentials structure to update. ++ * ++ * @param[in] signing_state The signing state to set. ++ * ++ * @param obtained This way the described signing state was specified. ++ * ++ * @return true if we could set the signing state, false otherwise. ++ */ ++_PUBLIC_ bool cli_credentials_set_smb_signing(struct cli_credentials *creds, ++ enum smb_signing_setting signing_state, ++ enum credentials_obtained obtained) ++{ ++ if (obtained >= creds->signing_state_obtained) { ++ creds->signing_state_obtained = obtained; ++ creds->signing_state = signing_state; ++ return true; ++ } ++ ++ return false; ++} ++ ++/** ++ * @brief Obtain the SMB signing state from a credentials structure. ++ * ++ * @param[in] creds The credential structure to obtain the SMB signing state ++ * from. ++ * ++ * @return The SMB singing state. ++ */ ++_PUBLIC_ enum smb_signing_setting ++cli_credentials_get_smb_signing(struct cli_credentials *creds) ++{ ++ return creds->signing_state; ++} + + /** + * Encrypt a data blob using the session key and the negotiated encryption +diff --git a/auth/credentials/credentials.h b/auth/credentials/credentials.h +index 7154c2a008c..422391ad585 100644 +--- a/auth/credentials/credentials.h ++++ b/auth/credentials/credentials.h +@@ -38,6 +38,7 @@ struct gssapi_creds_container; + struct smb_krb5_context; + struct keytab_container; + struct db_context; ++enum smb_signing_setting; + + /* In order of priority */ + enum credentials_obtained { +@@ -290,6 +291,12 @@ void *_cli_credentials_callback_data(struct cli_credentials *cred); + #define cli_credentials_callback_data_void(_cred) \ + _cli_credentials_callback_data(_cred) + ++bool cli_credentials_set_smb_signing(struct cli_credentials *cred, ++ enum smb_signing_setting signing_state, ++ enum credentials_obtained obtained); ++enum smb_signing_setting ++cli_credentials_get_smb_signing(struct cli_credentials *cred); ++ + /** + * Return attached NETLOGON credentials + */ +diff --git a/auth/credentials/credentials_internal.h b/auth/credentials/credentials_internal.h +index 68f1f25dce1..9cde0000b5f 100644 +--- a/auth/credentials/credentials_internal.h ++++ b/auth/credentials/credentials_internal.h +@@ -24,6 +24,7 @@ + + #include "../lib/util/data_blob.h" + #include "librpc/gen_ndr/misc.h" ++#include "libcli/smb/smb_constants.h" + + struct cli_credentials { + enum credentials_obtained workstation_obtained; +@@ -36,6 +37,7 @@ struct cli_credentials { + enum credentials_obtained principal_obtained; + enum credentials_obtained keytab_obtained; + enum credentials_obtained server_gss_creds_obtained; ++ enum credentials_obtained signing_state_obtained; + + /* Threshold values (essentially a MAX() over a number of the + * above) for the ccache and GSS credentials, to ensure we +@@ -117,6 +119,8 @@ struct cli_credentials { + char winbind_separator; + + bool password_will_be_nt_hash; ++ ++ enum smb_signing_setting signing_state; + }; + + #endif /* __CREDENTIALS_INTERNAL_H__ */ +-- +2.28.0 + + +From 0176a9d55aed4bdb49ac6f703dcae778b2f4ac5c Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 3 Jun 2020 11:56:01 +0200 +Subject: [PATCH 014/105] auth:creds: Add python bindings for + (get|set)_smb_signing + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + auth/credentials/pycredentials.c | 63 +++++++++++++++++++++++++++++++ + python/samba/tests/credentials.py | 6 +++ + 2 files changed, 69 insertions(+) + +diff --git a/auth/credentials/pycredentials.c b/auth/credentials/pycredentials.c +index 68edc282741..846c418419f 100644 +--- a/auth/credentials/pycredentials.c ++++ b/auth/credentials/pycredentials.c +@@ -34,6 +34,7 @@ + #include "auth/credentials/credentials_internal.h" + #include "system/kerberos.h" + #include "auth/kerberos/kerberos.h" ++#include "libcli/smb/smb_constants.h" + + void initcredentials(void); + +@@ -929,6 +930,52 @@ static PyObject *py_creds_encrypt_netr_crypt_password(PyObject *self, + Py_RETURN_NONE; + } + ++static PyObject *py_creds_get_smb_signing(PyObject *self, PyObject *unused) ++{ ++ enum smb_signing_setting signing_state; ++ struct cli_credentials *creds = NULL; ++ ++ creds = PyCredentials_AsCliCredentials(self); ++ if (creds == NULL) { ++ PyErr_Format(PyExc_TypeError, "Credentials expected"); ++ return NULL; ++ } ++ ++ signing_state = cli_credentials_get_smb_signing(creds); ++ return PyLong_FromLong(signing_state); ++} ++ ++static PyObject *py_creds_set_smb_signing(PyObject *self, PyObject *args) ++{ ++ enum smb_signing_setting signing_state; ++ struct cli_credentials *creds = NULL; ++ enum credentials_obtained obt = CRED_SPECIFIED; ++ ++ creds = PyCredentials_AsCliCredentials(self); ++ if (creds == NULL) { ++ PyErr_Format(PyExc_TypeError, "Credentials expected"); ++ return NULL; ++ } ++ if (!PyArg_ParseTuple(args, "i|i", &signing_state, &obt)) { ++ return NULL; ++ } ++ ++ switch (signing_state) { ++ case SMB_SIGNING_DEFAULT: ++ case SMB_SIGNING_OFF: ++ case SMB_SIGNING_IF_REQUIRED: ++ case SMB_SIGNING_DESIRED: ++ case SMB_SIGNING_REQUIRED: ++ break; ++ default: ++ PyErr_Format(PyExc_TypeError, "Invalid signing state value"); ++ return NULL; ++ } ++ ++ cli_credentials_set_smb_signing(creds, signing_state, obt); ++ Py_RETURN_NONE; ++} ++ + static PyMethodDef py_creds_methods[] = { + { + .ml_name = "get_username", +@@ -1209,6 +1256,16 @@ static PyMethodDef py_creds_methods[] = { + "Encrypt the supplied password using the session key and\n" + "the negotiated encryption algorithm in place\n" + "i.e. it overwrites the original data"}, ++ { ++ .ml_name = "get_smb_signing", ++ .ml_meth = py_creds_get_smb_signing, ++ .ml_flags = METH_NOARGS, ++ }, ++ { ++ .ml_name = "set_smb_signing", ++ .ml_meth = py_creds_set_smb_signing, ++ .ml_flags = METH_VARARGS, ++ }, + { .ml_name = NULL } + }; + +@@ -1295,6 +1352,12 @@ MODULE_INIT_FUNC(credentials) + PyModule_AddObject(m, "CLI_CRED_NTLM_AUTH", PyLong_FromLong(CLI_CRED_NTLM_AUTH)); + PyModule_AddObject(m, "CLI_CRED_CLEAR_AUTH", PyLong_FromLong(CLI_CRED_CLEAR_AUTH)); + ++ PyModule_AddObject(m, "SMB_SIGNING_DEFAULT", PyLong_FromLong(SMB_SIGNING_DEFAULT)); ++ PyModule_AddObject(m, "SMB_SIGNING_OFF", PyLong_FromLong(SMB_SIGNING_OFF)); ++ PyModule_AddObject(m, "SMB_SIGNING_IF_REQUIRED", PyLong_FromLong(SMB_SIGNING_IF_REQUIRED)); ++ PyModule_AddObject(m, "SMB_SIGNING_DESIRED", PyLong_FromLong(SMB_SIGNING_DESIRED)); ++ PyModule_AddObject(m, "SMB_SIGNING_REQUIRED", PyLong_FromLong(SMB_SIGNING_REQUIRED)); ++ + Py_INCREF(&PyCredentials); + PyModule_AddObject(m, "Credentials", (PyObject *)&PyCredentials); + Py_INCREF(&PyCredentialCacheContainer); +diff --git a/python/samba/tests/credentials.py b/python/samba/tests/credentials.py +index 6454ac9ff7c..e5f8122fa21 100644 +--- a/python/samba/tests/credentials.py ++++ b/python/samba/tests/credentials.py +@@ -456,3 +456,9 @@ class CredentialsTests(samba.tests.TestCaseInTempDir): + self.assertEqual(creds.get_principal(), "user@samba.org") + self.assertEqual(creds.is_anonymous(), False) + self.assertEqual(creds.authentication_requested(), True) ++ ++ def test_smb_signing(self): ++ creds = credentials.Credentials() ++ self.assertEqual(creds.get_smb_signing(), credentials.SMB_SIGNING_DEFAULT) ++ creds.set_smb_signing(credentials.SMB_SIGNING_REQUIRED) ++ self.assertEqual(creds.get_smb_signing(), credentials.SMB_SIGNING_REQUIRED) +-- +2.28.0 + + +From 96c4ce197bb62772778d822f0e5956d5a3ffe28d Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 28 May 2020 16:31:35 +0200 +Subject: [PATCH 015/105] auth:creds: Add + cli_credentials_(get|set)_smb_ipc_signing() + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + auth/credentials/credentials.c | 51 +++++++++++++++++++++++++ + auth/credentials/credentials.h | 6 +++ + auth/credentials/credentials_internal.h | 3 ++ + 3 files changed, 60 insertions(+) + +diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c +index 365a6def7ea..dc5d51f1424 100644 +--- a/auth/credentials/credentials.c ++++ b/auth/credentials/credentials.c +@@ -46,6 +46,12 @@ _PUBLIC_ struct cli_credentials *cli_credentials_init(TALLOC_CTX *mem_ctx) + + cred->signing_state = SMB_SIGNING_DEFAULT; + ++ /* ++ * The default value of lpcfg_client_ipc_signing() is REQUIRED, so use ++ * the same value here. ++ */ ++ cred->ipc_signing_state = SMB_SIGNING_REQUIRED; ++ + return cred; + } + +@@ -930,6 +936,12 @@ _PUBLIC_ void cli_credentials_set_conf(struct cli_credentials *cred, + cred->signing_state = lpcfg_client_signing(lp_ctx); + cred->signing_state_obtained = CRED_SMB_CONF; + } ++ ++ if (cred->ipc_signing_state_obtained <= CRED_SMB_CONF) { ++ /* Will be set to required for invalid smb.conf values */ ++ cred->ipc_signing_state = lpcfg_client_ipc_signing(lp_ctx); ++ cred->ipc_signing_state_obtained = CRED_SMB_CONF; ++ } + } + + /** +@@ -1350,6 +1362,45 @@ cli_credentials_get_smb_signing(struct cli_credentials *creds) + return creds->signing_state; + } + ++/** ++ * @brief Set the SMB IPC signing state to request for a SMB connection. ++ * ++ * @param[in] creds The credentials structure to update. ++ * ++ * @param[in] signing_state The signing state to set. ++ * ++ * @param obtained This way the described signing state was specified. ++ * ++ * @return true if we could set the signing state, false otherwise. ++ */ ++_PUBLIC_ bool ++cli_credentials_set_smb_ipc_signing(struct cli_credentials *creds, ++ enum smb_signing_setting ipc_signing_state, ++ enum credentials_obtained obtained) ++{ ++ if (obtained >= creds->ipc_signing_state_obtained) { ++ creds->ipc_signing_state_obtained = obtained; ++ creds->ipc_signing_state = ipc_signing_state; ++ return true; ++ } ++ ++ return false; ++} ++ ++/** ++ * @brief Obtain the SMB IPC signing state from a credentials structure. ++ * ++ * @param[in] creds The credential structure to obtain the SMB IPC signing ++ * state from. ++ * ++ * @return The SMB singing state. ++ */ ++_PUBLIC_ enum smb_signing_setting ++cli_credentials_get_smb_ipc_signing(struct cli_credentials *creds) ++{ ++ return creds->ipc_signing_state; ++} ++ + /** + * Encrypt a data blob using the session key and the negotiated encryption + * algorithm +diff --git a/auth/credentials/credentials.h b/auth/credentials/credentials.h +index 422391ad585..25bec916278 100644 +--- a/auth/credentials/credentials.h ++++ b/auth/credentials/credentials.h +@@ -297,6 +297,12 @@ bool cli_credentials_set_smb_signing(struct cli_credentials *cred, + enum smb_signing_setting + cli_credentials_get_smb_signing(struct cli_credentials *cred); + ++bool cli_credentials_set_smb_ipc_signing(struct cli_credentials *cred, ++ enum smb_signing_setting ipc_signing_state, ++ enum credentials_obtained obtained); ++enum smb_signing_setting ++cli_credentials_get_smb_ipc_signing(struct cli_credentials *cred); ++ + /** + * Return attached NETLOGON credentials + */ +diff --git a/auth/credentials/credentials_internal.h b/auth/credentials/credentials_internal.h +index 9cde0000b5f..54e8271471f 100644 +--- a/auth/credentials/credentials_internal.h ++++ b/auth/credentials/credentials_internal.h +@@ -38,6 +38,7 @@ struct cli_credentials { + enum credentials_obtained keytab_obtained; + enum credentials_obtained server_gss_creds_obtained; + enum credentials_obtained signing_state_obtained; ++ enum credentials_obtained ipc_signing_state_obtained; + + /* Threshold values (essentially a MAX() over a number of the + * above) for the ccache and GSS credentials, to ensure we +@@ -121,6 +122,8 @@ struct cli_credentials { + bool password_will_be_nt_hash; + + enum smb_signing_setting signing_state; ++ ++ enum smb_signing_setting ipc_signing_state; + }; + + #endif /* __CREDENTIALS_INTERNAL_H__ */ +-- +2.28.0 + + +From 301adf15736a4cb10f9dca267a906efb8f885354 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 3 Jun 2020 12:32:46 +0200 +Subject: [PATCH 016/105] auth:creds: Add python bindings for + (get|set)_smb_ipc_signing + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + auth/credentials/pycredentials.c | 56 +++++++++++++++++++++++++++++++ + python/samba/tests/credentials.py | 6 ++++ + 2 files changed, 62 insertions(+) + +diff --git a/auth/credentials/pycredentials.c b/auth/credentials/pycredentials.c +index 846c418419f..1a83c506088 100644 +--- a/auth/credentials/pycredentials.c ++++ b/auth/credentials/pycredentials.c +@@ -976,6 +976,52 @@ static PyObject *py_creds_set_smb_signing(PyObject *self, PyObject *args) + Py_RETURN_NONE; + } + ++static PyObject *py_creds_get_smb_ipc_signing(PyObject *self, PyObject *unused) ++{ ++ enum smb_signing_setting signing_state; ++ struct cli_credentials *creds = NULL; ++ ++ creds = PyCredentials_AsCliCredentials(self); ++ if (creds == NULL) { ++ PyErr_Format(PyExc_TypeError, "Credentials expected"); ++ return NULL; ++ } ++ ++ signing_state = cli_credentials_get_smb_ipc_signing(creds); ++ return PyLong_FromLong(signing_state); ++} ++ ++static PyObject *py_creds_set_smb_ipc_signing(PyObject *self, PyObject *args) ++{ ++ enum smb_signing_setting signing_state; ++ struct cli_credentials *creds = NULL; ++ enum credentials_obtained obt = CRED_SPECIFIED; ++ ++ creds = PyCredentials_AsCliCredentials(self); ++ if (creds == NULL) { ++ PyErr_Format(PyExc_TypeError, "Credentials expected"); ++ return NULL; ++ } ++ if (!PyArg_ParseTuple(args, "i|i", &signing_state, &obt)) { ++ return NULL; ++ } ++ ++ switch (signing_state) { ++ case SMB_SIGNING_DEFAULT: ++ case SMB_SIGNING_OFF: ++ case SMB_SIGNING_IF_REQUIRED: ++ case SMB_SIGNING_DESIRED: ++ case SMB_SIGNING_REQUIRED: ++ break; ++ default: ++ PyErr_Format(PyExc_TypeError, "Invalid signing state value"); ++ return NULL; ++ } ++ ++ cli_credentials_set_smb_ipc_signing(creds, signing_state, obt); ++ Py_RETURN_NONE; ++} ++ + static PyMethodDef py_creds_methods[] = { + { + .ml_name = "get_username", +@@ -1266,6 +1312,16 @@ static PyMethodDef py_creds_methods[] = { + .ml_meth = py_creds_set_smb_signing, + .ml_flags = METH_VARARGS, + }, ++ { ++ .ml_name = "get_smb_ipc_signing", ++ .ml_meth = py_creds_get_smb_ipc_signing, ++ .ml_flags = METH_NOARGS, ++ }, ++ { ++ .ml_name = "set_smb_ipc_signing", ++ .ml_meth = py_creds_set_smb_ipc_signing, ++ .ml_flags = METH_VARARGS, ++ }, + { .ml_name = NULL } + }; + +diff --git a/python/samba/tests/credentials.py b/python/samba/tests/credentials.py +index e5f8122fa21..8edf13ce6ff 100644 +--- a/python/samba/tests/credentials.py ++++ b/python/samba/tests/credentials.py +@@ -462,3 +462,9 @@ class CredentialsTests(samba.tests.TestCaseInTempDir): + self.assertEqual(creds.get_smb_signing(), credentials.SMB_SIGNING_DEFAULT) + creds.set_smb_signing(credentials.SMB_SIGNING_REQUIRED) + self.assertEqual(creds.get_smb_signing(), credentials.SMB_SIGNING_REQUIRED) ++ ++ def test_smb_ipc_signing(self): ++ creds = credentials.Credentials() ++ self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_REQUIRED) ++ creds.set_smb_ipc_signing(credentials.SMB_SIGNING_OFF) ++ self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_OFF) +-- +2.28.0 + + +From cf2cafb38dd319c01ff539a73d40dac8813f03a0 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 28 May 2020 16:10:52 +0200 +Subject: [PATCH 017/105] auth:creds: Add + cli_credentials_(get|set)_smb_encryption() + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + auth/credentials/credentials.c | 45 +++++++++++++++++++++++++ + auth/credentials/credentials.h | 7 ++++ + auth/credentials/credentials_internal.h | 3 ++ + 3 files changed, 55 insertions(+) + +diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c +index dc5d51f1424..9168b92d3ec 100644 +--- a/auth/credentials/credentials.c ++++ b/auth/credentials/credentials.c +@@ -51,6 +51,7 @@ _PUBLIC_ struct cli_credentials *cli_credentials_init(TALLOC_CTX *mem_ctx) + * the same value here. + */ + cred->ipc_signing_state = SMB_SIGNING_REQUIRED; ++ cred->encryption_state = SMB_ENCRYPTION_DEFAULT; + + return cred; + } +@@ -942,6 +943,12 @@ _PUBLIC_ void cli_credentials_set_conf(struct cli_credentials *cred, + cred->ipc_signing_state = lpcfg_client_ipc_signing(lp_ctx); + cred->ipc_signing_state_obtained = CRED_SMB_CONF; + } ++ ++ if (cred->encryption_state_obtained <= CRED_SMB_CONF) { ++ /* Will be set to default for invalid smb.conf values */ ++ cred->encryption_state = lpcfg_client_smb_encrypt(lp_ctx); ++ cred->encryption_state_obtained = CRED_SMB_CONF; ++ } + } + + /** +@@ -1401,6 +1408,44 @@ cli_credentials_get_smb_ipc_signing(struct cli_credentials *creds) + return creds->ipc_signing_state; + } + ++/** ++ * @brief Set the SMB encryption state to request for a SMB connection. ++ * ++ * @param[in] creds The credentials structure to update. ++ * ++ * @param[in] encryption_state The encryption state to set. ++ * ++ * @param obtained This way the described encryption state was specified. ++ * ++ * @return true if we could set the encryption state, false otherwise. ++ */ ++_PUBLIC_ bool cli_credentials_set_smb_encryption(struct cli_credentials *creds, ++ enum smb_encryption_setting encryption_state, ++ enum credentials_obtained obtained) ++{ ++ if (obtained >= creds->encryption_state_obtained) { ++ creds->encryption_state_obtained = obtained; ++ creds->encryption_state = encryption_state; ++ return true; ++ } ++ ++ return false; ++} ++ ++/** ++ * @brief Obtain the SMB encryption state from a credentials structure. ++ * ++ * @param[in] creds The credential structure to obtain the SMB encryption state ++ * from. ++ * ++ * @return The SMB singing state. ++ */ ++_PUBLIC_ enum smb_encryption_setting ++cli_credentials_get_smb_encryption(struct cli_credentials *creds) ++{ ++ return creds->encryption_state; ++} ++ + /** + * Encrypt a data blob using the session key and the negotiated encryption + * algorithm +diff --git a/auth/credentials/credentials.h b/auth/credentials/credentials.h +index 25bec916278..7d0cf53194b 100644 +--- a/auth/credentials/credentials.h ++++ b/auth/credentials/credentials.h +@@ -39,6 +39,7 @@ struct smb_krb5_context; + struct keytab_container; + struct db_context; + enum smb_signing_setting; ++enum smb_encryption_setting; + + /* In order of priority */ + enum credentials_obtained { +@@ -303,6 +304,12 @@ bool cli_credentials_set_smb_ipc_signing(struct cli_credentials *cred, + enum smb_signing_setting + cli_credentials_get_smb_ipc_signing(struct cli_credentials *cred); + ++bool cli_credentials_set_smb_encryption(struct cli_credentials *cred, ++ enum smb_encryption_setting encryption_state, ++ enum credentials_obtained obtained); ++enum smb_encryption_setting ++cli_credentials_get_smb_encryption(struct cli_credentials *cred); ++ + /** + * Return attached NETLOGON credentials + */ +diff --git a/auth/credentials/credentials_internal.h b/auth/credentials/credentials_internal.h +index 54e8271471f..3b86b742448 100644 +--- a/auth/credentials/credentials_internal.h ++++ b/auth/credentials/credentials_internal.h +@@ -39,6 +39,7 @@ struct cli_credentials { + enum credentials_obtained server_gss_creds_obtained; + enum credentials_obtained signing_state_obtained; + enum credentials_obtained ipc_signing_state_obtained; ++ enum credentials_obtained encryption_state_obtained; + + /* Threshold values (essentially a MAX() over a number of the + * above) for the ccache and GSS credentials, to ensure we +@@ -124,6 +125,8 @@ struct cli_credentials { + enum smb_signing_setting signing_state; + + enum smb_signing_setting ipc_signing_state; ++ ++ enum smb_encryption_setting encryption_state; + }; + + #endif /* __CREDENTIALS_INTERNAL_H__ */ +-- +2.28.0 + + +From a25732f42cf7418789c2102f093dc0b3062543fd Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 3 Jun 2020 12:38:30 +0200 +Subject: [PATCH 018/105] auth:creds: Add python bindings for + (get|set)_smb_encryption + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + auth/credentials/pycredentials.c | 62 +++++++++++++++++++++++++++++++ + python/samba/tests/credentials.py | 6 +++ + 2 files changed, 68 insertions(+) + +diff --git a/auth/credentials/pycredentials.c b/auth/credentials/pycredentials.c +index 1a83c506088..628aae6500b 100644 +--- a/auth/credentials/pycredentials.c ++++ b/auth/credentials/pycredentials.c +@@ -1022,6 +1022,52 @@ static PyObject *py_creds_set_smb_ipc_signing(PyObject *self, PyObject *args) + Py_RETURN_NONE; + } + ++static PyObject *py_creds_get_smb_encryption(PyObject *self, PyObject *unused) ++{ ++ enum smb_encryption_setting encryption_state; ++ struct cli_credentials *creds = NULL; ++ ++ creds = PyCredentials_AsCliCredentials(self); ++ if (creds == NULL) { ++ PyErr_Format(PyExc_TypeError, "Credentials expected"); ++ return NULL; ++ } ++ ++ encryption_state = cli_credentials_get_smb_encryption(creds); ++ return PyLong_FromLong(encryption_state); ++} ++ ++static PyObject *py_creds_set_smb_encryption(PyObject *self, PyObject *args) ++{ ++ enum smb_encryption_setting encryption_state; ++ struct cli_credentials *creds = NULL; ++ enum credentials_obtained obt = CRED_SPECIFIED; ++ ++ creds = PyCredentials_AsCliCredentials(self); ++ if (creds == NULL) { ++ PyErr_Format(PyExc_TypeError, "Credentials expected"); ++ return NULL; ++ } ++ if (!PyArg_ParseTuple(args, "i|i", &encryption_state, &obt)) { ++ return NULL; ++ } ++ ++ switch (encryption_state) { ++ case SMB_ENCRYPTION_DEFAULT: ++ case SMB_ENCRYPTION_OFF: ++ case SMB_ENCRYPTION_IF_REQUIRED: ++ case SMB_ENCRYPTION_DESIRED: ++ case SMB_ENCRYPTION_REQUIRED: ++ break; ++ default: ++ PyErr_Format(PyExc_TypeError, "Invalid encryption state value"); ++ return NULL; ++ } ++ ++ cli_credentials_set_smb_encryption(creds, encryption_state, obt); ++ Py_RETURN_NONE; ++} ++ + static PyMethodDef py_creds_methods[] = { + { + .ml_name = "get_username", +@@ -1322,6 +1368,16 @@ static PyMethodDef py_creds_methods[] = { + .ml_meth = py_creds_set_smb_ipc_signing, + .ml_flags = METH_VARARGS, + }, ++ { ++ .ml_name = "get_smb_encryption", ++ .ml_meth = py_creds_get_smb_encryption, ++ .ml_flags = METH_NOARGS, ++ }, ++ { ++ .ml_name = "set_smb_encryption", ++ .ml_meth = py_creds_set_smb_encryption, ++ .ml_flags = METH_VARARGS, ++ }, + { .ml_name = NULL } + }; + +@@ -1414,6 +1470,12 @@ MODULE_INIT_FUNC(credentials) + PyModule_AddObject(m, "SMB_SIGNING_DESIRED", PyLong_FromLong(SMB_SIGNING_DESIRED)); + PyModule_AddObject(m, "SMB_SIGNING_REQUIRED", PyLong_FromLong(SMB_SIGNING_REQUIRED)); + ++ PyModule_AddObject(m, "SMB_ENCRYPTION_DEFAULT", PyLong_FromLong(SMB_ENCRYPTION_DEFAULT)); ++ PyModule_AddObject(m, "SMB_ENCRYPTION_OFF", PyLong_FromLong(SMB_ENCRYPTION_OFF)); ++ PyModule_AddObject(m, "SMB_ENCRYPTION_IF_REQUIRED", PyLong_FromLong(SMB_ENCRYPTION_IF_REQUIRED)); ++ PyModule_AddObject(m, "SMB_ENCRYPTION_DESIRED", PyLong_FromLong(SMB_ENCRYPTION_DESIRED)); ++ PyModule_AddObject(m, "SMB_ENCRYPTION_REQUIRED", PyLong_FromLong(SMB_ENCRYPTION_REQUIRED)); ++ + Py_INCREF(&PyCredentials); + PyModule_AddObject(m, "Credentials", (PyObject *)&PyCredentials); + Py_INCREF(&PyCredentialCacheContainer); +diff --git a/python/samba/tests/credentials.py b/python/samba/tests/credentials.py +index 8edf13ce6ff..e0a6248d37a 100644 +--- a/python/samba/tests/credentials.py ++++ b/python/samba/tests/credentials.py +@@ -468,3 +468,9 @@ class CredentialsTests(samba.tests.TestCaseInTempDir): + self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_REQUIRED) + creds.set_smb_ipc_signing(credentials.SMB_SIGNING_OFF) + self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_OFF) ++ ++ def test_smb_encryption(self): ++ creds = credentials.Credentials() ++ self.assertEqual(creds.get_smb_encryption(), credentials.SMB_ENCRYPTION_DEFAULT) ++ creds.set_smb_encryption(credentials.SMB_ENCRYPTION_REQUIRED) ++ self.assertEqual(creds.get_smb_encryption(), credentials.SMB_ENCRYPTION_REQUIRED) +-- +2.28.0 + + +From 1a1809bd260ceff97dd4ff697f78b97a63f60b48 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 4 Jun 2020 11:19:53 +0200 +Subject: [PATCH 019/105] auth:creds: Add python bindings for + cli_credentials_set_conf() + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + auth/credentials/pycredentials.c | 41 +++++++++++++++++++++++++++++++ + python/samba/tests/credentials.py | 33 +++++++++++++++++++++++++ + 2 files changed, 74 insertions(+) + +diff --git a/auth/credentials/pycredentials.c b/auth/credentials/pycredentials.c +index 628aae6500b..17c90573f09 100644 +--- a/auth/credentials/pycredentials.c ++++ b/auth/credentials/pycredentials.c +@@ -621,6 +621,42 @@ static PyObject *py_creds_set_forced_sasl_mech(PyObject *self, PyObject *args) + Py_RETURN_NONE; + } + ++static PyObject *py_creds_set_conf(PyObject *self, PyObject *args) ++{ ++ PyObject *py_lp_ctx = Py_None; ++ struct loadparm_context *lp_ctx; ++ TALLOC_CTX *mem_ctx; ++ struct cli_credentials *creds; ++ ++ creds = PyCredentials_AsCliCredentials(self); ++ if (creds == NULL) { ++ PyErr_Format(PyExc_TypeError, "Credentials expected"); ++ return NULL; ++ } ++ ++ if (!PyArg_ParseTuple(args, "|O", &py_lp_ctx)) { ++ return NULL; ++ } ++ ++ mem_ctx = talloc_new(NULL); ++ if (mem_ctx == NULL) { ++ PyErr_NoMemory(); ++ return NULL; ++ } ++ ++ lp_ctx = lpcfg_from_py_object(mem_ctx, py_lp_ctx); ++ if (lp_ctx == NULL) { ++ talloc_free(mem_ctx); ++ return NULL; ++ } ++ ++ cli_credentials_set_conf(creds, lp_ctx); ++ ++ talloc_free(mem_ctx); ++ ++ Py_RETURN_NONE; ++} ++ + static PyObject *py_creds_guess(PyObject *self, PyObject *args) + { + PyObject *py_lp_ctx = Py_None; +@@ -1279,6 +1315,11 @@ static PyMethodDef py_creds_methods[] = { + .ml_meth = py_creds_set_krb_forwardable, + .ml_flags = METH_VARARGS, + }, ++ { ++ .ml_name = "set_conf", ++ .ml_meth = py_creds_set_conf, ++ .ml_flags = METH_VARARGS, ++ }, + { + .ml_name = "guess", + .ml_meth = py_creds_guess, +diff --git a/python/samba/tests/credentials.py b/python/samba/tests/credentials.py +index e0a6248d37a..6187bded0b6 100644 +--- a/python/samba/tests/credentials.py ++++ b/python/samba/tests/credentials.py +@@ -463,14 +463,47 @@ class CredentialsTests(samba.tests.TestCaseInTempDir): + creds.set_smb_signing(credentials.SMB_SIGNING_REQUIRED) + self.assertEqual(creds.get_smb_signing(), credentials.SMB_SIGNING_REQUIRED) + ++ def test_smb_signing_set_conf(self): ++ lp = samba.tests.env_loadparm() ++ ++ creds = credentials.Credentials() ++ creds.set_conf(lp) ++ self.assertEqual(creds.get_smb_signing(), credentials.SMB_SIGNING_DEFAULT) ++ creds.set_smb_signing(credentials.SMB_SIGNING_OFF) ++ self.assertEqual(creds.get_smb_signing(), credentials.SMB_SIGNING_OFF) ++ creds.set_conf(lp) ++ self.assertEqual(creds.get_smb_signing(), credentials.SMB_SIGNING_OFF) ++ + def test_smb_ipc_signing(self): + creds = credentials.Credentials() + self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_REQUIRED) + creds.set_smb_ipc_signing(credentials.SMB_SIGNING_OFF) + self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_OFF) + ++ def test_smb_ipc_signing_set_conf(self): ++ lp = samba.tests.env_loadparm() ++ ++ creds = credentials.Credentials() ++ creds.set_conf(lp) ++ self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_REQUIRED) ++ creds.set_smb_ipc_signing(credentials.SMB_SIGNING_OFF) ++ self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_OFF) ++ creds.set_conf(lp) ++ self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_OFF) ++ + def test_smb_encryption(self): + creds = credentials.Credentials() + self.assertEqual(creds.get_smb_encryption(), credentials.SMB_ENCRYPTION_DEFAULT) + creds.set_smb_encryption(credentials.SMB_ENCRYPTION_REQUIRED) + self.assertEqual(creds.get_smb_encryption(), credentials.SMB_ENCRYPTION_REQUIRED) ++ ++ def test_smb_encryption_set_conf(self): ++ lp = samba.tests.env_loadparm() ++ ++ creds = credentials.Credentials() ++ creds.set_conf(lp) ++ self.assertEqual(creds.get_smb_encryption(), credentials.SMB_ENCRYPTION_DEFAULT) ++ creds.set_smb_encryption(credentials.SMB_ENCRYPTION_OFF) ++ self.assertEqual(creds.get_smb_encryption(), credentials.SMB_ENCRYPTION_OFF) ++ creds.set_conf(lp) ++ self.assertEqual(creds.get_smb_encryption(), credentials.SMB_ENCRYPTION_OFF) +-- +2.28.0 + + +From 72b31403174eb23fe4fdf75ad918e845a740db6f Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 23 Jul 2020 08:14:23 +0200 +Subject: [PATCH 020/105] auth:creds: Bump library version + +We added new functions so bump the version. + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + auth/credentials/wscript_build | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/auth/credentials/wscript_build b/auth/credentials/wscript_build +index 564a04fe8dd..1e3302e3e48 100644 +--- a/auth/credentials/wscript_build ++++ b/auth/credentials/wscript_build +@@ -5,7 +5,7 @@ bld.SAMBA_LIBRARY('samba-credentials', + public_headers='credentials.h', + pc_files='samba-credentials.pc', + deps='LIBCRYPTO samba-errors events LIBCLI_AUTH samba-security CREDENTIALS_SECRETS CREDENTIALS_KRB5', +- vnum='0.0.1' ++ vnum='0.1.0' + ) + + bld.SAMBA_SUBSYSTEM('CREDENTIALS_KRB5', +-- +2.28.0 + + +From 918b87437b9c36981049ca4e3cf0220ad56ec7c2 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 27 May 2020 11:10:30 +0200 +Subject: [PATCH 021/105] s3:lib: Use cli_credential_(get|set)_smb_signing() + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + source3/lib/util_cmdline.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +diff --git a/source3/lib/util_cmdline.c b/source3/lib/util_cmdline.c +index bc1f1c3ed25..6038ec11515 100644 +--- a/source3/lib/util_cmdline.c ++++ b/source3/lib/util_cmdline.c +@@ -40,7 +40,6 @@ struct user_auth_info { + struct loadparm_context *lp_ctx; + bool got_username; + bool got_pass; +- int signing_state; + bool smb_encrypt; + bool use_machine_account; + bool use_pw_nt_hash; +@@ -70,7 +69,6 @@ struct user_auth_info *user_auth_info_init(TALLOC_CTX *mem_ctx) + + cli_credentials_set_conf(result->creds, result->lp_ctx); + +- result->signing_state = SMB_SIGNING_DEFAULT; + return result; + } + +@@ -241,15 +239,23 @@ void set_cmdline_auth_info_password(struct user_auth_info *auth_info, + bool set_cmdline_auth_info_signing_state(struct user_auth_info *auth_info, + const char *arg) + { +- auth_info->signing_state = smb_signing_setting_translate(arg); ++ enum smb_signing_setting signing_state = ++ smb_signing_setting_translate(arg); ++ bool ok; + +- return true; ++ ok = cli_credentials_set_smb_signing(auth_info->creds, ++ signing_state, ++ CRED_SPECIFIED); ++ ++ return ok; + } + + void set_cmdline_auth_info_signing_state_raw(struct user_auth_info *auth_info, + int signing_state) + { +- auth_info->signing_state = signing_state; ++ cli_credentials_set_smb_signing(auth_info->creds, ++ signing_state, ++ CRED_SPECIFIED); + } + + int get_cmdline_auth_info_signing_state(const struct user_auth_info *auth_info) +@@ -257,7 +263,7 @@ int get_cmdline_auth_info_signing_state(const struct user_auth_info *auth_info) + if (auth_info->smb_encrypt) { + return SMB_SIGNING_REQUIRED; + } +- return auth_info->signing_state; ++ return cli_credentials_get_smb_signing(auth_info->creds); + } + + void set_cmdline_auth_info_use_ccache(struct user_auth_info *auth_info, bool b) +-- +2.28.0 + + +From 22efb02d818946e4f03ebfb72ea345e9106deca8 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 10 Jun 2020 12:45:34 +0200 +Subject: [PATCH 022/105] s3:lib: Set smb encryption also via cli creds API + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + source3/lib/util_cmdline.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/source3/lib/util_cmdline.c b/source3/lib/util_cmdline.c +index 6038ec11515..9c9e2f0ac0f 100644 +--- a/source3/lib/util_cmdline.c ++++ b/source3/lib/util_cmdline.c +@@ -377,6 +377,9 @@ void set_cmdline_auth_info_use_krb5_ticket(struct user_auth_info *auth_info) + /* This should only be used by lib/popt_common.c JRA */ + void set_cmdline_auth_info_smb_encrypt(struct user_auth_info *auth_info) + { ++ cli_credentials_set_smb_encryption(auth_info->creds, ++ SMB_ENCRYPTION_REQUIRED, ++ CRED_SPECIFIED); + auth_info->smb_encrypt = true; + } + +-- +2.28.0 + + +From 9abae48706106793f8952524ad2325bdd6a5101c Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 13 Aug 2020 10:40:23 +0200 +Subject: [PATCH 023/105] python: Remove unused sign argument from + smb_connection() + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + python/samba/netcmd/gpo.py | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/python/samba/netcmd/gpo.py b/python/samba/netcmd/gpo.py +index 1e2c2918ebe..ad60cda0690 100644 +--- a/python/samba/netcmd/gpo.py ++++ b/python/samba/netcmd/gpo.py +@@ -382,13 +382,13 @@ def create_directory_hier(conn, remotedir): + if not conn.chkpath(path): + conn.mkdir(path) + +-def smb_connection(dc_hostname, service, lp, creds, sign=False): ++def smb_connection(dc_hostname, service, lp, creds): + # SMB connect to DC + try: + # the SMB bindings rely on having a s3 loadparm + s3_lp = s3param.get_context() + s3_lp.load(lp.configfile) +- conn = libsmb.Conn(dc_hostname, service, lp=s3_lp, creds=creds, sign=sign) ++ conn = libsmb.Conn(dc_hostname, service, lp=s3_lp, creds=creds, sign=True) + except Exception: + raise CommandError("Error connecting to '%s' using SMB" % dc_hostname) + return conn +@@ -998,7 +998,7 @@ class cmd_fetch(GPOCommand): + + # SMB connect to DC + conn = smb_connection(dc_hostname, service, lp=self.lp, +- creds=self.creds, sign=True) ++ creds=self.creds) + + # Copy GPT + tmpdir, gpodir = self.construct_tmpdir(tmpdir, gpo) +@@ -1629,8 +1629,7 @@ class cmd_admxload(Command): + conn = smb_connection(dc_hostname, + 'sysvol', + lp=self.lp, +- creds=self.creds, +- sign=True) ++ creds=self.creds) + + smb_dir = '\\'.join([self.lp.get('realm').lower(), + 'Policies', 'PolicyDefinitions']) +-- +2.28.0 + + +From e2f0f56ea6ec4f9696affdee08de89c0bdffa719 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 3 Jun 2020 14:02:37 +0200 +Subject: [PATCH 024/105] python: Set smb signing via the creds API + +Pair-Programmed-With: Stefan Metzmacher + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + python/samba/gpclass.py | 7 +++++++ + python/samba/netcmd/domain_backup.py | 10 +++++++++- + python/samba/netcmd/gpo.py | 6 ++++++ + 3 files changed, 22 insertions(+), 1 deletion(-) + +diff --git a/python/samba/gpclass.py b/python/samba/gpclass.py +index cc574e12a42..1781a55a618 100644 +--- a/python/samba/gpclass.py ++++ b/python/samba/gpclass.py +@@ -38,6 +38,7 @@ from tempfile import NamedTemporaryFile + from samba.dcerpc import preg + from samba.dcerpc import misc + from samba.ndr import ndr_pack, ndr_unpack ++from samba.credentials import SMB_SIGNING_REQUIRED + + try: + from enum import Enum +@@ -421,7 +422,13 @@ def check_refresh_gpo_list(dc_hostname, lp, creds, gpos): + # the SMB bindings rely on having a s3 loadparm + s3_lp = s3param.get_context() + s3_lp.load(lp.configfile) ++ ++ # Force signing for the connection ++ saved_signing_state = creds.get_smb_signing() ++ creds.set_smb_signing(SMB_SIGNING_REQUIRED) + conn = libsmb.Conn(dc_hostname, 'sysvol', lp=s3_lp, creds=creds, sign=True) ++ # Reset signing state ++ creds.set_smb_signing(saved_signing_state) + cache_path = lp.cache_path('gpo_cache') + for gpo in gpos: + if not gpo.file_sys_path: +diff --git a/python/samba/netcmd/domain_backup.py b/python/samba/netcmd/domain_backup.py +index a3dc7fb454f..a9e0ba5bc67 100644 +--- a/python/samba/netcmd/domain_backup.py ++++ b/python/samba/netcmd/domain_backup.py +@@ -54,6 +54,7 @@ from subprocess import CalledProcessError + from samba import sites + from samba.dsdb import _dsdb_load_udv_v2 + from samba.ndr import ndr_pack ++from samba.credentials import SMB_SIGNING_REQUIRED + + + # work out a SID (based on a free RID) to use when the domain gets restored. +@@ -115,7 +116,14 @@ def smb_sysvol_conn(server, lp, creds): + # the SMB bindings rely on having a s3 loadparm + s3_lp = s3param.get_context() + s3_lp.load(lp.configfile) +- return libsmb.Conn(server, "sysvol", lp=s3_lp, creds=creds, sign=True) ++ ++ # Force signing for the connection ++ saved_signing_state = creds.get_smb_signing() ++ creds.set_smb_signing(SMB_SIGNING_REQUIRED) ++ conn = libsmb.Conn(server, "sysvol", lp=s3_lp, creds=creds, sign=True) ++ # Reset signing state ++ creds.set_smb_signing(saved_signing_state) ++ return conn + + + def get_timestamp(): +diff --git a/python/samba/netcmd/gpo.py b/python/samba/netcmd/gpo.py +index ad60cda0690..0f2f6520fc3 100644 +--- a/python/samba/netcmd/gpo.py ++++ b/python/samba/netcmd/gpo.py +@@ -62,6 +62,7 @@ from samba.gp_parse.gp_csv import GPAuditCsvParser + from samba.gp_parse.gp_inf import GptTmplInfParser + from samba.gp_parse.gp_aas import GPAasParser + from samba import param ++from samba.credentials import SMB_SIGNING_REQUIRED + + + def attr_default(msg, attrname, default): +@@ -384,6 +385,9 @@ def create_directory_hier(conn, remotedir): + + def smb_connection(dc_hostname, service, lp, creds): + # SMB connect to DC ++ # Force signing for the smb connection ++ saved_signing_state = creds.get_smb_signing() ++ creds.set_smb_signing(SMB_SIGNING_REQUIRED) + try: + # the SMB bindings rely on having a s3 loadparm + s3_lp = s3param.get_context() +@@ -391,6 +395,8 @@ def smb_connection(dc_hostname, service, lp, creds): + conn = libsmb.Conn(dc_hostname, service, lp=s3_lp, creds=creds, sign=True) + except Exception: + raise CommandError("Error connecting to '%s' using SMB" % dc_hostname) ++ # Reset signing state ++ creds.set_smb_signing(saved_signing_state) + return conn + + +-- +2.28.0 + + +From 53b2d53349b8f453cd0144f01b833deca52e3626 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 28 May 2020 17:22:12 +0200 +Subject: [PATCH 025/105] s3:libsmb: Introduce CLI_FULL_CONNECTION_IPC + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + examples/winexe/winexe.c | 2 +- + source3/include/client.h | 1 + + source3/libnet/libnet_join.c | 6 +++--- + source3/libsmb/cliconnect.c | 3 ++- + source3/rpc_server/spoolss/srv_spoolss_nt.c | 4 +++- + source3/rpcclient/cmd_spoolss.c | 2 +- + source3/rpcclient/rpcclient.c | 2 +- + source3/utils/mdfind.c | 2 +- + source3/utils/net_ads.c | 3 ++- + source3/utils/net_util.c | 9 +++++++-- + source3/utils/netlookup.c | 4 +++- + 11 files changed, 25 insertions(+), 13 deletions(-) + +diff --git a/examples/winexe/winexe.c b/examples/winexe/winexe.c +index fc6b15f8e52..bb9c27e2e6d 100644 +--- a/examples/winexe/winexe.c ++++ b/examples/winexe/winexe.c +@@ -1919,7 +1919,7 @@ int main(int argc, const char *argv[]) + "IPC$", + "?????", + options.credentials, +- 0, ++ CLI_FULL_CONNECTION_IPC, + 0); + + if (!NT_STATUS_IS_OK(status)) { +diff --git a/source3/include/client.h b/source3/include/client.h +index 6a3b1b02ff3..19a738900b7 100644 +--- a/source3/include/client.h ++++ b/source3/include/client.h +@@ -121,5 +121,6 @@ struct file_info { + #define CLI_FULL_CONNECTION_FORCE_ASCII 0x0100 + #define CLI_FULL_CONNECTION_FORCE_SMB1 0x0400 + #define CLI_FULL_CONNECTION_DISABLE_SMB1 0x0800 ++#define CLI_FULL_CONNECTION_IPC 0x1000 + + #endif /* _CLIENT_H */ +diff --git a/source3/libnet/libnet_join.c b/source3/libnet/libnet_join.c +index 34938603606..392e3eff74f 100644 +--- a/source3/libnet/libnet_join.c ++++ b/source3/libnet/libnet_join.c +@@ -1068,7 +1068,7 @@ static NTSTATUS libnet_join_connect_dc_ipc(const char *dc, + bool use_ccache = false; + bool pw_nt_hash = false; + struct cli_credentials *creds = NULL; +- int flags = 0; ++ int flags = CLI_FULL_CONNECTION_IPC; + NTSTATUS status; + + if (use_kerberos && pass) { +@@ -1684,7 +1684,7 @@ NTSTATUS libnet_join_ok(struct messaging_context *msg_ctx, + struct netlogon_creds_CredentialState *creds = NULL; + uint32_t netlogon_flags = 0; + NTSTATUS status; +- int flags = 0; ++ int flags = CLI_FULL_CONNECTION_IPC; + + if (!dc_name) { + TALLOC_FREE(frame); +@@ -1734,7 +1734,7 @@ NTSTATUS libnet_join_ok(struct messaging_context *msg_ctx, + NULL, 0, + "IPC$", "IPC", + anon_creds, +- 0, ++ flags, + SMB_SIGNING_OFF); + } + +diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c +index 1fb1f0127b9..f20146378e3 100644 +--- a/source3/libsmb/cliconnect.c ++++ b/source3/libsmb/cliconnect.c +@@ -2788,7 +2788,7 @@ static struct tevent_req *cli_start_connection_send( + } + state->ev = ev; + +- if (signing_state == SMB_SIGNING_IPC_DEFAULT) { ++ if (flags & CLI_FULL_CONNECTION_IPC) { + state->min_protocol = lp_client_ipc_min_protocol(); + state->max_protocol = lp_client_ipc_max_protocol(); + } else { +@@ -3673,6 +3673,7 @@ struct cli_state *get_ipc_connect(char *server, + uint32_t flags = CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK; + + flags |= CLI_FULL_CONNECTION_FORCE_SMB1; ++ flags |= CLI_FULL_CONNECTION_IPC; + + nt_status = cli_full_connection_creds(&cli, NULL, server, server_ss, 0, "IPC$", "IPC", + get_cmdline_auth_info_creds(user_info), +diff --git a/source3/rpc_server/spoolss/srv_spoolss_nt.c b/source3/rpc_server/spoolss/srv_spoolss_nt.c +index 8b6a803a910..16e3ee485f0 100644 +--- a/source3/rpc_server/spoolss/srv_spoolss_nt.c ++++ b/source3/rpc_server/spoolss/srv_spoolss_nt.c +@@ -2481,7 +2481,9 @@ static bool spoolss_connect_to_client(struct rpc_pipe_client **pp_pipe, struct c + /* setup the connection */ + ret = cli_full_connection_creds( pp_cli, lp_netbios_name(), remote_machine, + &rm_addr, 0, "IPC$", "IPC", +- anon_creds, 0, SMB_SIGNING_OFF); ++ anon_creds, ++ CLI_FULL_CONNECTION_IPC, ++ SMB_SIGNING_OFF); + TALLOC_FREE(anon_creds); + if ( !NT_STATUS_IS_OK( ret ) ) { + DEBUG(2,("spoolss_connect_to_client: connection to [%s] failed!\n", +diff --git a/source3/rpcclient/cmd_spoolss.c b/source3/rpcclient/cmd_spoolss.c +index a7e0c673a65..7198a451ab7 100644 +--- a/source3/rpcclient/cmd_spoolss.c ++++ b/source3/rpcclient/cmd_spoolss.c +@@ -3537,7 +3537,7 @@ static WERROR cmd_spoolss_printercmp(struct rpc_pipe_client *cli, + "IPC$", "IPC", + get_cmdline_auth_info_creds( + popt_get_cmdline_auth_info()), +- 0, /* flags */ ++ CLI_FULL_CONNECTION_IPC, + get_cmdline_auth_info_signing_state( + popt_get_cmdline_auth_info())); + +diff --git a/source3/rpcclient/rpcclient.c b/source3/rpcclient/rpcclient.c +index 67a1066fc15..c86474d08f1 100644 +--- a/source3/rpcclient/rpcclient.c ++++ b/source3/rpcclient/rpcclient.c +@@ -1019,7 +1019,7 @@ out_free: + static int opt_port = 0; + int result = 0; + TALLOC_CTX *frame = talloc_stackframe(); +- uint32_t flags = 0; ++ uint32_t flags = CLI_FULL_CONNECTION_IPC; + struct dcerpc_binding *binding = NULL; + enum dcerpc_transport_t transport; + uint32_t bflags = 0; +diff --git a/source3/utils/mdfind.c b/source3/utils/mdfind.c +index 2f952c29b4f..a3c879e75fb 100644 +--- a/source3/utils/mdfind.c ++++ b/source3/utils/mdfind.c +@@ -70,7 +70,7 @@ int main(int argc, char **argv) + const char *mds_query = NULL; + struct cli_state *cli = NULL; + char *basepath = NULL; +- uint32_t flags = 0; ++ uint32_t flags = CLI_FULL_CONNECTION_IPC; + int signing_state = SMB_SIGNING_IPC_DEFAULT; + uint64_t *cnids = NULL; + size_t ncnids; +diff --git a/source3/utils/net_ads.c b/source3/utils/net_ads.c +index e5db844c2f2..28ef6dc9974 100644 +--- a/source3/utils/net_ads.c ++++ b/source3/utils/net_ads.c +@@ -2437,7 +2437,8 @@ static int net_ads_printer_publish(struct net_context *c, int argc, const char * + nt_status = cli_full_connection_creds(&cli, lp_netbios_name(), servername, + &server_ss, 0, + "IPC$", "IPC", +- creds, 0, ++ creds, ++ CLI_FULL_CONNECTION_IPC, + SMB_SIGNING_IPC_DEFAULT); + + if (NT_STATUS_IS_ERR(nt_status)) { +diff --git a/source3/utils/net_util.c b/source3/utils/net_util.c +index c566ecc9000..d01b2d8c771 100644 +--- a/source3/utils/net_util.c ++++ b/source3/utils/net_util.c +@@ -110,6 +110,7 @@ NTSTATUS connect_to_service(struct net_context *c, + NTSTATUS nt_status; + enum smb_signing_setting signing_setting = SMB_SIGNING_DEFAULT; + struct cli_credentials *creds = NULL; ++ int flags = 0; + + creds = net_context_creds(c, c); + if (creds == NULL) { +@@ -119,12 +120,14 @@ NTSTATUS connect_to_service(struct net_context *c, + + if (strequal(service_type, "IPC")) { + signing_setting = SMB_SIGNING_IPC_DEFAULT; ++ flags |= CLI_FULL_CONNECTION_IPC; + } + + nt_status = cli_full_connection_creds(cli_ctx, NULL, server_name, + server_ss, c->opt_port, + service_name, service_type, +- creds, 0, ++ creds, ++ flags, + signing_setting); + if (!NT_STATUS_IS_OK(nt_status)) { + d_fprintf(stderr, _("Could not connect to server %s\n"), +@@ -195,7 +198,9 @@ NTSTATUS connect_to_ipc_anonymous(struct net_context *c, + nt_status = cli_full_connection_creds(cli_ctx, c->opt_requester_name, + server_name, server_ss, c->opt_port, + "IPC$", "IPC", +- anon_creds, 0, SMB_SIGNING_OFF); ++ anon_creds, ++ CLI_FULL_CONNECTION_IPC, ++ SMB_SIGNING_OFF); + + if (NT_STATUS_IS_OK(nt_status)) { + return nt_status; +diff --git a/source3/utils/netlookup.c b/source3/utils/netlookup.c +index 6cea2ee306c..2241beb331f 100644 +--- a/source3/utils/netlookup.c ++++ b/source3/utils/netlookup.c +@@ -98,7 +98,9 @@ static struct con_struct *create_cs(struct net_context *c, + nt_status = cli_full_connection_creds(&cs->cli, lp_netbios_name(), lp_netbios_name(), + &loopback_ss, 0, + "IPC$", "IPC", +- anon_creds, 0, SMB_SIGNING_OFF); ++ anon_creds, ++ CLI_FULL_CONNECTION_IPC, ++ SMB_SIGNING_OFF); + + if (!NT_STATUS_IS_OK(nt_status)) { + DEBUG(2,("create_cs: Connect failed. Error was %s\n", nt_errstr(nt_status))); +-- +2.28.0 + + +From 975383e368a3891e92fb071ab20f2b5208167500 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 28 May 2020 17:29:25 +0200 +Subject: [PATCH 026/105] s3:pylibsmb: Add ipc=True support for + CLI_FULL_CONNECTION_IPC + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + source3/libsmb/pylibsmb.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/source3/libsmb/pylibsmb.c b/source3/libsmb/pylibsmb.c +index 3fcc3424a57..3579a040830 100644 +--- a/source3/libsmb/pylibsmb.c ++++ b/source3/libsmb/pylibsmb.c +@@ -445,6 +445,8 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, + int signing_state = SMB_SIGNING_DEFAULT; + PyObject *py_force_smb1 = Py_False; + bool force_smb1 = false; ++ PyObject *py_ipc = Py_False; ++ bool use_ipc = false; + struct tevent_req *req; + bool ret; + int flags = 0; +@@ -452,6 +454,7 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, + static const char *kwlist[] = { + "host", "share", "lp", "creds", + "multi_threaded", "sign", "force_smb1", ++ "ipc", + NULL + }; + +@@ -462,12 +465,13 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, + } + + ret = ParseTupleAndKeywords( +- args, kwds, "ssO|O!OOO", kwlist, ++ args, kwds, "ssO|O!OOOO", kwlist, + &host, &share, &py_lp, + py_type_Credentials, &creds, + &py_multi_threaded, + &py_sign, +- &py_force_smb1); ++ &py_force_smb1, ++ &py_ipc); + + Py_DECREF(py_type_Credentials); + +@@ -493,6 +497,11 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, + flags = CLI_FULL_CONNECTION_FORCE_SMB1; + } + ++ use_ipc = PyObject_IsTrue(py_ipc); ++ if (use_ipc) { ++ flags |= CLI_FULL_CONNECTION_IPC; ++ } ++ + if (multi_threaded) { + #ifdef HAVE_PTHREAD + ret = py_cli_state_setup_mt_ev(self); +-- +2.28.0 + + +From 59831141a17195b9308d75257123134b0217489c Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Fri, 24 Jul 2020 09:47:11 +0200 +Subject: [PATCH 027/105] python:tests: Mark libsmb connection as an IPC + connection + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + python/samba/tests/dcerpc/raw_testcase.py | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/python/samba/tests/dcerpc/raw_testcase.py b/python/samba/tests/dcerpc/raw_testcase.py +index ba7440df13b..2c028d381db 100644 +--- a/python/samba/tests/dcerpc/raw_testcase.py ++++ b/python/samba/tests/dcerpc/raw_testcase.py +@@ -43,7 +43,7 @@ class smb_pipe_socket(object): + lp3 = s3param.get_context() + lp3.load(lp.configfile) + self.smbconn = libsmb.Conn(target_hostname, 'IPC$', lp3, +- creds=creds, sign=True) ++ creds=creds, ipc=True, sign=True) + self.smbfid = self.smbconn.create(pipename, + DesiredAccess=0x12019f, + ShareAccess=0x7, +-- +2.28.0 + + +From b9df53c20a753bf31b8684776f2b6aaaf1583abe Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Mon, 17 Aug 2020 12:52:39 +0200 +Subject: [PATCH 028/105] python:tests: Set smb ipc signing via the creds API + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + python/samba/tests/dcerpc/raw_testcase.py | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/python/samba/tests/dcerpc/raw_testcase.py b/python/samba/tests/dcerpc/raw_testcase.py +index 2c028d381db..d6f5de7440a 100644 +--- a/python/samba/tests/dcerpc/raw_testcase.py ++++ b/python/samba/tests/dcerpc/raw_testcase.py +@@ -36,14 +36,18 @@ from samba.ntstatus import ( + from samba import NTSTATUSError + from samba.samba3 import param as s3param + from samba.samba3 import libsmb_samba_internal as libsmb ++from samba.credentials import SMB_SIGNING_REQUIRED + + class smb_pipe_socket(object): + + def __init__(self, target_hostname, pipename, creds, impersonation_level, lp): + lp3 = s3param.get_context() + lp3.load(lp.configfile) ++ saved_signing_state = creds.get_smb_ipc_signing() ++ creds.set_smb_ipc_signing(SMB_SIGNING_REQUIRED) + self.smbconn = libsmb.Conn(target_hostname, 'IPC$', lp3, + creds=creds, ipc=True, sign=True) ++ creds.set_smb_ipc_signing(saved_signing_state) + self.smbfid = self.smbconn.create(pipename, + DesiredAccess=0x12019f, + ShareAccess=0x7, +-- +2.28.0 + + +From c9e88d833db2b472099e5751b7731e337342d2c4 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 28 May 2020 17:59:19 +0200 +Subject: [PATCH 029/105] s3:libsmb: Use 'enum smb_signing_setting' in + cliconnect.c + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + source3/libsmb/cliconnect.c | 14 +++++++------- + source3/libsmb/proto.h | 10 +++++----- + 2 files changed, 12 insertions(+), 12 deletions(-) + +diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c +index f20146378e3..bb20aa59385 100644 +--- a/source3/libsmb/cliconnect.c ++++ b/source3/libsmb/cliconnect.c +@@ -2631,7 +2631,7 @@ static NTSTATUS cli_connect_sock_recv(struct tevent_req *req, + + struct cli_connect_nb_state { + const char *desthost; +- int signing_state; ++ enum smb_signing_setting signing_state; + int flags; + struct cli_state *cli; + }; +@@ -2642,7 +2642,7 @@ static struct tevent_req *cli_connect_nb_send( + TALLOC_CTX *mem_ctx, struct tevent_context *ev, + const char *host, const struct sockaddr_storage *dest_ss, + uint16_t port, int name_type, const char *myname, +- int signing_state, int flags) ++ enum smb_signing_setting signing_state, int flags) + { + struct tevent_req *req, *subreq; + struct cli_connect_nb_state *state; +@@ -2727,7 +2727,7 @@ static NTSTATUS cli_connect_nb_recv(struct tevent_req *req, + + NTSTATUS cli_connect_nb(const char *host, const struct sockaddr_storage *dest_ss, + uint16_t port, int name_type, const char *myname, +- int signing_state, int flags, struct cli_state **pcli) ++ enum smb_signing_setting signing_state, int flags, struct cli_state **pcli) + { + struct tevent_context *ev; + struct tevent_req *req; +@@ -2776,7 +2776,7 @@ static struct tevent_req *cli_start_connection_send( + TALLOC_CTX *mem_ctx, struct tevent_context *ev, + const char *my_name, const char *dest_host, + const struct sockaddr_storage *dest_ss, int port, +- int signing_state, int flags) ++ enum smb_signing_setting signing_state, int flags) + { + struct tevent_req *req, *subreq; + struct cli_start_connection_state *state; +@@ -2881,7 +2881,7 @@ NTSTATUS cli_start_connection(struct cli_state **output_cli, + const char *my_name, + const char *dest_host, + const struct sockaddr_storage *dest_ss, int port, +- int signing_state, int flags) ++ enum smb_signing_setting signing_state, int flags) + { + struct tevent_context *ev; + struct tevent_req *req; +@@ -3361,7 +3361,7 @@ struct tevent_req *cli_full_connection_creds_send( + const struct sockaddr_storage *dest_ss, int port, + const char *service, const char *service_type, + struct cli_credentials *creds, +- int flags, int signing_state) ++ int flags, enum smb_signing_setting signing_state) + { + struct tevent_req *req, *subreq; + struct cli_full_connection_creds_state *state; +@@ -3520,7 +3520,7 @@ NTSTATUS cli_full_connection_creds(struct cli_state **output_cli, + const char *service, const char *service_type, + struct cli_credentials *creds, + int flags, +- int signing_state) ++ enum smb_signing_setting signing_state) + { + struct tevent_context *ev; + struct tevent_req *req; +diff --git a/source3/libsmb/proto.h b/source3/libsmb/proto.h +index d214cdabca4..995187e21b4 100644 +--- a/source3/libsmb/proto.h ++++ b/source3/libsmb/proto.h +@@ -86,12 +86,12 @@ NTSTATUS cli_tree_connect(struct cli_state *cli, const char *share, + NTSTATUS cli_tdis(struct cli_state *cli); + NTSTATUS cli_connect_nb(const char *host, const struct sockaddr_storage *dest_ss, + uint16_t port, int name_type, const char *myname, +- int signing_state, int flags, struct cli_state **pcli); ++ enum smb_signing_setting signing_state, int flags, struct cli_state **pcli); + NTSTATUS cli_start_connection(struct cli_state **output_cli, + const char *my_name, + const char *dest_host, + const struct sockaddr_storage *dest_ss, int port, +- int signing_state, int flags); ++ enum smb_signing_setting signing_state, int flags); + NTSTATUS cli_smb1_setup_encryption(struct cli_state *cli, + struct cli_credentials *creds); + struct tevent_req *cli_full_connection_creds_send( +@@ -100,7 +100,7 @@ struct tevent_req *cli_full_connection_creds_send( + const struct sockaddr_storage *dest_ss, int port, + const char *service, const char *service_type, + struct cli_credentials *creds, +- int flags, int signing_state); ++ int flags, enum smb_signing_setting signing_state); + NTSTATUS cli_full_connection_creds_recv(struct tevent_req *req, + struct cli_state **output_cli); + NTSTATUS cli_full_connection_creds(struct cli_state **output_cli, +@@ -110,7 +110,7 @@ NTSTATUS cli_full_connection_creds(struct cli_state **output_cli, + const char *service, const char *service_type, + struct cli_credentials *creds, + int flags, +- int signing_state); ++ enum smb_signing_setting signing_state); + NTSTATUS cli_raw_tcon(struct cli_state *cli, + const char *service, const char *pass, const char *dev, + uint16_t *max_xmit, uint16_t *tid); +@@ -177,7 +177,7 @@ extern struct GUID cli_state_client_guid; + struct cli_state *cli_state_create(TALLOC_CTX *mem_ctx, + int fd, + const char *remote_name, +- int signing_state, ++ enum smb_signing_setting signing_state, + int flags); + void cli_nt_pipes_close(struct cli_state *cli); + void cli_shutdown(struct cli_state *cli); +-- +2.28.0 + + +From 40c201c4d1b4621e823485e3082d0ca5799a6237 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 28 May 2020 18:11:31 +0200 +Subject: [PATCH 030/105] s3:client: Turn off smb signing for message op + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + python/samba/gpclass.py | 2 +- + python/samba/netcmd/domain_backup.py | 2 +- + python/samba/netcmd/gpo.py | 2 +- + python/samba/tests/dcerpc/raw_testcase.py | 2 +- + source3/client/client.c | 5 ++++- + source3/libsmb/pylibsmb.c | 20 +++++++++----------- + 6 files changed, 17 insertions(+), 16 deletions(-) + +diff --git a/python/samba/gpclass.py b/python/samba/gpclass.py +index 1781a55a618..2c00f5349a0 100644 +--- a/python/samba/gpclass.py ++++ b/python/samba/gpclass.py +@@ -426,7 +426,7 @@ def check_refresh_gpo_list(dc_hostname, lp, creds, gpos): + # Force signing for the connection + saved_signing_state = creds.get_smb_signing() + creds.set_smb_signing(SMB_SIGNING_REQUIRED) +- conn = libsmb.Conn(dc_hostname, 'sysvol', lp=s3_lp, creds=creds, sign=True) ++ conn = libsmb.Conn(dc_hostname, 'sysvol', lp=s3_lp, creds=creds) + # Reset signing state + creds.set_smb_signing(saved_signing_state) + cache_path = lp.cache_path('gpo_cache') +diff --git a/python/samba/netcmd/domain_backup.py b/python/samba/netcmd/domain_backup.py +index a9e0ba5bc67..2977b071ec3 100644 +--- a/python/samba/netcmd/domain_backup.py ++++ b/python/samba/netcmd/domain_backup.py +@@ -120,7 +120,7 @@ def smb_sysvol_conn(server, lp, creds): + # Force signing for the connection + saved_signing_state = creds.get_smb_signing() + creds.set_smb_signing(SMB_SIGNING_REQUIRED) +- conn = libsmb.Conn(server, "sysvol", lp=s3_lp, creds=creds, sign=True) ++ conn = libsmb.Conn(server, "sysvol", lp=s3_lp, creds=creds) + # Reset signing state + creds.set_smb_signing(saved_signing_state) + return conn +diff --git a/python/samba/netcmd/gpo.py b/python/samba/netcmd/gpo.py +index 0f2f6520fc3..bbaa0c17881 100644 +--- a/python/samba/netcmd/gpo.py ++++ b/python/samba/netcmd/gpo.py +@@ -392,7 +392,7 @@ def smb_connection(dc_hostname, service, lp, creds): + # the SMB bindings rely on having a s3 loadparm + s3_lp = s3param.get_context() + s3_lp.load(lp.configfile) +- conn = libsmb.Conn(dc_hostname, service, lp=s3_lp, creds=creds, sign=True) ++ conn = libsmb.Conn(dc_hostname, service, lp=s3_lp, creds=creds) + except Exception: + raise CommandError("Error connecting to '%s' using SMB" % dc_hostname) + # Reset signing state +diff --git a/python/samba/tests/dcerpc/raw_testcase.py b/python/samba/tests/dcerpc/raw_testcase.py +index d6f5de7440a..34785e2a2a7 100644 +--- a/python/samba/tests/dcerpc/raw_testcase.py ++++ b/python/samba/tests/dcerpc/raw_testcase.py +@@ -46,7 +46,7 @@ class smb_pipe_socket(object): + saved_signing_state = creds.get_smb_ipc_signing() + creds.set_smb_ipc_signing(SMB_SIGNING_REQUIRED) + self.smbconn = libsmb.Conn(target_hostname, 'IPC$', lp3, +- creds=creds, ipc=True, sign=True) ++ creds=creds, ipc=True) + creds.set_smb_ipc_signing(saved_signing_state) + self.smbfid = self.smbconn.create(pipename, + DesiredAccess=0x12019f, +diff --git a/source3/client/client.c b/source3/client/client.c +index f65293849d0..30287ffd253 100644 +--- a/source3/client/client.c ++++ b/source3/client/client.c +@@ -6228,7 +6228,10 @@ static int do_message_op(struct user_auth_info *a_info) + + status = cli_connect_nb(desthost, have_ip ? &dest_ss : NULL, + port ? port : NBT_SMB_PORT, name_type, +- lp_netbios_name(), SMB_SIGNING_DEFAULT, 0, &cli); ++ lp_netbios_name(), ++ SMB_SIGNING_OFF, ++ 0, ++ &cli); + if (!NT_STATUS_IS_OK(status)) { + d_printf("Connection to %s failed. Error %s\n", desthost, nt_errstr(status)); + return 1; +diff --git a/source3/libsmb/pylibsmb.c b/source3/libsmb/pylibsmb.c +index 3579a040830..f8a4d56cf53 100644 +--- a/source3/libsmb/pylibsmb.c ++++ b/source3/libsmb/pylibsmb.c +@@ -440,9 +440,7 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, + PyObject *py_lp = Py_None; + PyObject *py_multi_threaded = Py_False; + bool multi_threaded = false; +- PyObject *py_sign = Py_False; +- bool sign = false; +- int signing_state = SMB_SIGNING_DEFAULT; ++ enum smb_signing_setting signing_state = SMB_SIGNING_DEFAULT; + PyObject *py_force_smb1 = Py_False; + bool force_smb1 = false; + PyObject *py_ipc = Py_False; +@@ -453,7 +451,7 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, + + static const char *kwlist[] = { + "host", "share", "lp", "creds", +- "multi_threaded", "sign", "force_smb1", ++ "multi_threaded", "force_smb1", + "ipc", + NULL + }; +@@ -465,11 +463,10 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, + } + + ret = ParseTupleAndKeywords( +- args, kwds, "ssO|O!OOOO", kwlist, ++ args, kwds, "ssO|O!OOO", kwlist, + &host, &share, &py_lp, + py_type_Credentials, &creds, + &py_multi_threaded, +- &py_sign, + &py_force_smb1, + &py_ipc); + +@@ -480,13 +477,8 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, + } + + multi_threaded = PyObject_IsTrue(py_multi_threaded); +- sign = PyObject_IsTrue(py_sign); + force_smb1 = PyObject_IsTrue(py_force_smb1); + +- if (sign) { +- signing_state = SMB_SIGNING_REQUIRED; +- } +- + if (force_smb1) { + /* + * As most of the cli_*_send() function +@@ -532,6 +524,12 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, + cli_creds = PyCredentials_AsCliCredentials(creds); + } + ++ if (use_ipc) { ++ signing_state = cli_credentials_get_smb_ipc_signing(cli_creds); ++ } else { ++ signing_state = cli_credentials_get_smb_signing(cli_creds); ++ } ++ + req = cli_full_connection_creds_send( + NULL, self->ev, "myname", host, NULL, 0, share, "?????", + cli_creds, flags, signing_state); +-- +2.28.0 + + +From 639de1d5ddf200d03f51b0436789f5dde4cd083b Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 28 May 2020 18:20:02 +0200 +Subject: [PATCH 031/105] s3:libsmb: Remove signing_state from + cli_full_connection_creds_send() + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + source3/libsmb/cliconnect.c | 11 +++++++++-- + source3/libsmb/proto.h | 2 +- + source3/libsmb/pylibsmb.c | 9 +-------- + 3 files changed, 11 insertions(+), 11 deletions(-) + +diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c +index bb20aa59385..0ff9c283e39 100644 +--- a/source3/libsmb/cliconnect.c ++++ b/source3/libsmb/cliconnect.c +@@ -3361,10 +3361,11 @@ struct tevent_req *cli_full_connection_creds_send( + const struct sockaddr_storage *dest_ss, int port, + const char *service, const char *service_type, + struct cli_credentials *creds, +- int flags, enum smb_signing_setting signing_state) ++ int flags) + { + struct tevent_req *req, *subreq; + struct cli_full_connection_creds_state *state; ++ enum smb_signing_setting signing_state; + + req = tevent_req_create(mem_ctx, &state, + struct cli_full_connection_creds_state); +@@ -3379,6 +3380,12 @@ struct tevent_req *cli_full_connection_creds_send( + state->creds = creds; + state->flags = flags; + ++ if (flags & CLI_FULL_CONNECTION_IPC) { ++ signing_state = cli_credentials_get_smb_ipc_signing(creds); ++ } else { ++ signing_state = cli_credentials_get_smb_signing(creds); ++ } ++ + subreq = cli_start_connection_send( + state, ev, my_name, dest_host, dest_ss, port, + signing_state, flags); +@@ -3532,7 +3539,7 @@ NTSTATUS cli_full_connection_creds(struct cli_state **output_cli, + } + req = cli_full_connection_creds_send( + ev, ev, my_name, dest_host, dest_ss, port, service, +- service_type, creds, flags, signing_state); ++ service_type, creds, flags); + if (req == NULL) { + goto fail; + } +diff --git a/source3/libsmb/proto.h b/source3/libsmb/proto.h +index 995187e21b4..bef04d32638 100644 +--- a/source3/libsmb/proto.h ++++ b/source3/libsmb/proto.h +@@ -100,7 +100,7 @@ struct tevent_req *cli_full_connection_creds_send( + const struct sockaddr_storage *dest_ss, int port, + const char *service, const char *service_type, + struct cli_credentials *creds, +- int flags, enum smb_signing_setting signing_state); ++ int flags); + NTSTATUS cli_full_connection_creds_recv(struct tevent_req *req, + struct cli_state **output_cli); + NTSTATUS cli_full_connection_creds(struct cli_state **output_cli, +diff --git a/source3/libsmb/pylibsmb.c b/source3/libsmb/pylibsmb.c +index f8a4d56cf53..c7a2d73afcb 100644 +--- a/source3/libsmb/pylibsmb.c ++++ b/source3/libsmb/pylibsmb.c +@@ -440,7 +440,6 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, + PyObject *py_lp = Py_None; + PyObject *py_multi_threaded = Py_False; + bool multi_threaded = false; +- enum smb_signing_setting signing_state = SMB_SIGNING_DEFAULT; + PyObject *py_force_smb1 = Py_False; + bool force_smb1 = false; + PyObject *py_ipc = Py_False; +@@ -524,15 +523,9 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, + cli_creds = PyCredentials_AsCliCredentials(creds); + } + +- if (use_ipc) { +- signing_state = cli_credentials_get_smb_ipc_signing(cli_creds); +- } else { +- signing_state = cli_credentials_get_smb_signing(cli_creds); +- } +- + req = cli_full_connection_creds_send( + NULL, self->ev, "myname", host, NULL, 0, share, "?????", +- cli_creds, flags, signing_state); ++ cli_creds, flags); + if (!py_tevent_req_wait_exc(self, req)) { + return -1; + } +-- +2.28.0 + + +From 57336e07f2e23dade5fcd0b8f0d002202cda223d Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 4 Jun 2020 14:59:14 +0200 +Subject: [PATCH 032/105] s3:libsmb: Remove signing_state from + cli_full_connection_creds() + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + examples/fuse/smb2mount.c | 3 +-- + examples/winexe/winexe.c | 4 +--- + source3/libnet/libnet_join.c | 9 +++------ + source3/libsmb/cliconnect.c | 6 ++---- + source3/libsmb/libsmb_server.c | 8 +------- + source3/libsmb/proto.h | 3 +-- + source3/rpc_server/spoolss/srv_spoolss_nt.c | 3 +-- + source3/rpcclient/cmd_spoolss.c | 5 +---- + source3/rpcclient/rpcclient.c | 3 +-- + source3/torture/locktest2.c | 11 +++++++++-- + source3/torture/torture.c | 6 ++---- + source3/utils/mdfind.c | 3 +-- + source3/utils/net_ads.c | 3 +-- + source3/utils/net_util.c | 8 ++------ + source3/utils/netlookup.c | 3 +-- + source3/utils/smbcacls.c | 3 +-- + source3/utils/smbcquotas.c | 4 +--- + 17 files changed, 30 insertions(+), 55 deletions(-) + +diff --git a/examples/fuse/smb2mount.c b/examples/fuse/smb2mount.c +index ea1d9a11e0b..6206c3a9701 100644 +--- a/examples/fuse/smb2mount.c ++++ b/examples/fuse/smb2mount.c +@@ -37,8 +37,7 @@ static struct cli_state *connect_one(const struct user_auth_info *auth_info, + NULL, port, + share, "?????", + get_cmdline_auth_info_creds(auth_info), +- flags, +- get_cmdline_auth_info_signing_state(auth_info)); ++ flags); + if (!NT_STATUS_IS_OK(nt_status)) { + DBG_ERR("cli_full_connection failed! (%s)\n", + nt_errstr(nt_status)); +diff --git a/examples/winexe/winexe.c b/examples/winexe/winexe.c +index bb9c27e2e6d..03e7ec85198 100644 +--- a/examples/winexe/winexe.c ++++ b/examples/winexe/winexe.c +@@ -360,7 +360,6 @@ static NTSTATUS winexe_svc_upload( + "ADMIN$", + "?????", + credentials, +- 0, + 0); + if (!NT_STATUS_IS_OK(status)) { + DBG_WARNING("cli_full_connection_creds failed: %s\n", +@@ -1919,8 +1918,7 @@ int main(int argc, const char *argv[]) + "IPC$", + "?????", + options.credentials, +- CLI_FULL_CONNECTION_IPC, +- 0); ++ CLI_FULL_CONNECTION_IPC); + + if (!NT_STATUS_IS_OK(status)) { + DBG_WARNING("cli_full_connection_creds failed: %s\n", +diff --git a/source3/libnet/libnet_join.c b/source3/libnet/libnet_join.c +index 392e3eff74f..f3bf27e6c00 100644 +--- a/source3/libnet/libnet_join.c ++++ b/source3/libnet/libnet_join.c +@@ -1095,8 +1095,7 @@ static NTSTATUS libnet_join_connect_dc_ipc(const char *dc, + NULL, 0, + "IPC$", "IPC", + creds, +- flags, +- SMB_SIGNING_IPC_DEFAULT); ++ flags); + if (!NT_STATUS_IS_OK(status)) { + TALLOC_FREE(frame); + return status; +@@ -1716,8 +1715,7 @@ NTSTATUS libnet_join_ok(struct messaging_context *msg_ctx, + NULL, 0, + "IPC$", "IPC", + cli_creds, +- flags, +- SMB_SIGNING_IPC_DEFAULT); ++ flags); + + if (!NT_STATUS_IS_OK(status)) { + struct cli_credentials *anon_creds = NULL; +@@ -1734,8 +1732,7 @@ NTSTATUS libnet_join_ok(struct messaging_context *msg_ctx, + NULL, 0, + "IPC$", "IPC", + anon_creds, +- flags, +- SMB_SIGNING_OFF); ++ flags); + } + + if (!NT_STATUS_IS_OK(status)) { +diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c +index 0ff9c283e39..b24743d789b 100644 +--- a/source3/libsmb/cliconnect.c ++++ b/source3/libsmb/cliconnect.c +@@ -3526,8 +3526,7 @@ NTSTATUS cli_full_connection_creds(struct cli_state **output_cli, + const struct sockaddr_storage *dest_ss, int port, + const char *service, const char *service_type, + struct cli_credentials *creds, +- int flags, +- enum smb_signing_setting signing_state) ++ int flags) + { + struct tevent_context *ev; + struct tevent_req *req; +@@ -3684,8 +3683,7 @@ struct cli_state *get_ipc_connect(char *server, + + nt_status = cli_full_connection_creds(&cli, NULL, server, server_ss, 0, "IPC$", "IPC", + get_cmdline_auth_info_creds(user_info), +- flags, +- SMB_SIGNING_DEFAULT); ++ flags); + + if (NT_STATUS_IS_OK(nt_status)) { + return cli; +diff --git a/source3/libsmb/libsmb_server.c b/source3/libsmb/libsmb_server.c +index 3d1cd602f6c..33dc8419deb 100644 +--- a/source3/libsmb/libsmb_server.c ++++ b/source3/libsmb/libsmb_server.c +@@ -785,7 +785,6 @@ SMBC_attr_server(TALLOC_CTX *ctx, + pp_workgroup, pp_username, pp_password); + if (!ipc_srv) { + struct cli_credentials *creds = NULL; +- int signing_state = SMB_SIGNING_DEFAULT; + + /* We didn't find a cached connection. Get the password */ + if (!*pp_password || (*pp_password)[0] == '\0') { +@@ -812,16 +811,11 @@ SMBC_attr_server(TALLOC_CTX *ctx, + return NULL; + } + +- if (context->internal->smb_encryption_level != SMBC_ENCRYPTLEVEL_NONE) { +- signing_state = SMB_SIGNING_REQUIRED; +- } +- + nt_status = cli_full_connection_creds(&ipc_cli, + lp_netbios_name(), server, + NULL, 0, "IPC$", "?????", + creds, +- flags, +- signing_state); ++ flags); + if (! NT_STATUS_IS_OK(nt_status)) { + TALLOC_FREE(creds); + DEBUG(1,("cli_full_connection failed! (%s)\n", +diff --git a/source3/libsmb/proto.h b/source3/libsmb/proto.h +index bef04d32638..850cf12c8a6 100644 +--- a/source3/libsmb/proto.h ++++ b/source3/libsmb/proto.h +@@ -109,8 +109,7 @@ NTSTATUS cli_full_connection_creds(struct cli_state **output_cli, + const struct sockaddr_storage *dest_ss, int port, + const char *service, const char *service_type, + struct cli_credentials *creds, +- int flags, +- enum smb_signing_setting signing_state); ++ int flags); + NTSTATUS cli_raw_tcon(struct cli_state *cli, + const char *service, const char *pass, const char *dev, + uint16_t *max_xmit, uint16_t *tid); +diff --git a/source3/rpc_server/spoolss/srv_spoolss_nt.c b/source3/rpc_server/spoolss/srv_spoolss_nt.c +index 16e3ee485f0..e98401a4365 100644 +--- a/source3/rpc_server/spoolss/srv_spoolss_nt.c ++++ b/source3/rpc_server/spoolss/srv_spoolss_nt.c +@@ -2482,8 +2482,7 @@ static bool spoolss_connect_to_client(struct rpc_pipe_client **pp_pipe, struct c + ret = cli_full_connection_creds( pp_cli, lp_netbios_name(), remote_machine, + &rm_addr, 0, "IPC$", "IPC", + anon_creds, +- CLI_FULL_CONNECTION_IPC, +- SMB_SIGNING_OFF); ++ CLI_FULL_CONNECTION_IPC); + TALLOC_FREE(anon_creds); + if ( !NT_STATUS_IS_OK( ret ) ) { + DEBUG(2,("spoolss_connect_to_client: connection to [%s] failed!\n", +diff --git a/source3/rpcclient/cmd_spoolss.c b/source3/rpcclient/cmd_spoolss.c +index 7198a451ab7..02889a0a666 100644 +--- a/source3/rpcclient/cmd_spoolss.c ++++ b/source3/rpcclient/cmd_spoolss.c +@@ -3537,10 +3537,7 @@ static WERROR cmd_spoolss_printercmp(struct rpc_pipe_client *cli, + "IPC$", "IPC", + get_cmdline_auth_info_creds( + popt_get_cmdline_auth_info()), +- CLI_FULL_CONNECTION_IPC, +- get_cmdline_auth_info_signing_state( +- popt_get_cmdline_auth_info())); +- ++ CLI_FULL_CONNECTION_IPC); + if ( !NT_STATUS_IS_OK(nt_status) ) + return WERR_GEN_FAILURE; + +diff --git a/source3/rpcclient/rpcclient.c b/source3/rpcclient/rpcclient.c +index c86474d08f1..2ead6cc7ba5 100644 +--- a/source3/rpcclient/rpcclient.c ++++ b/source3/rpcclient/rpcclient.c +@@ -1206,8 +1206,7 @@ out_free: + "IPC$", "IPC", + get_cmdline_auth_info_creds( + popt_get_cmdline_auth_info()), +- flags, +- SMB_SIGNING_IPC_DEFAULT); ++ flags); + + if (!NT_STATUS_IS_OK(nt_status)) { + DEBUG(0,("Cannot connect to server. Error was %s\n", nt_errstr(nt_status))); +diff --git a/source3/torture/locktest2.c b/source3/torture/locktest2.c +index 84c335f959f..92ddb7629b9 100644 +--- a/source3/torture/locktest2.c ++++ b/source3/torture/locktest2.c +@@ -217,8 +217,15 @@ static struct cli_state *connect_one(char *share) + + slprintf(myname,sizeof(myname), "lock-%lu-%u", (unsigned long)getpid(), count++); + +- nt_status = cli_full_connection_creds(&c, myname, server_n, NULL, 0, share, "?????", +- creds, 0, SMB_SIGNING_DEFAULT); ++ nt_status = cli_full_connection_creds(&c, ++ myname, ++ server_n, ++ NULL, ++ 0, ++ share, ++ "?????", ++ creds, ++ 0); + TALLOC_FREE(creds); + if (!NT_STATUS_IS_OK(nt_status)) { + DEBUG(0, ("cli_full_connection failed with error %s\n", nt_errstr(nt_status))); +diff --git a/source3/torture/torture.c b/source3/torture/torture.c +index 2a3133373e9..a4edeefd628 100644 +--- a/source3/torture/torture.c ++++ b/source3/torture/torture.c +@@ -345,8 +345,7 @@ static bool torture_open_connection_share(struct cli_state **c, + sharename, + "?????", + torture_creds, +- flags, +- signing_state); ++ flags); + if (!NT_STATUS_IS_OK(status)) { + printf("failed to open share connection: //%s/%s port:%d - %s\n", + hostname, sharename, port_to_use, nt_errstr(status)); +@@ -1523,8 +1522,7 @@ static bool run_tcon_devtype_test(int dummy) + NULL, /* service */ + NULL, /* service_type */ + torture_creds, +- flags, +- signing_state); ++ flags); + + if (!NT_STATUS_IS_OK(status)) { + printf("could not open connection\n"); +diff --git a/source3/utils/mdfind.c b/source3/utils/mdfind.c +index a3c879e75fb..2ac4fde7daf 100644 +--- a/source3/utils/mdfind.c ++++ b/source3/utils/mdfind.c +@@ -153,8 +153,7 @@ int main(int argc, char **argv) + "IPC$", + "IPC", + creds, +- flags, +- SMB_SIGNING_IPC_DEFAULT); ++ flags); + if (!NT_STATUS_IS_OK(status)) { + DBG_ERR("Cannot connect to server: %s\n", nt_errstr(status)); + goto fail; +diff --git a/source3/utils/net_ads.c b/source3/utils/net_ads.c +index 28ef6dc9974..7f5b9c3a440 100644 +--- a/source3/utils/net_ads.c ++++ b/source3/utils/net_ads.c +@@ -2438,8 +2438,7 @@ static int net_ads_printer_publish(struct net_context *c, int argc, const char * + &server_ss, 0, + "IPC$", "IPC", + creds, +- CLI_FULL_CONNECTION_IPC, +- SMB_SIGNING_IPC_DEFAULT); ++ CLI_FULL_CONNECTION_IPC); + + if (NT_STATUS_IS_ERR(nt_status)) { + d_fprintf(stderr, _("Unable to open a connection to %s to " +diff --git a/source3/utils/net_util.c b/source3/utils/net_util.c +index d01b2d8c771..b139fb2d0da 100644 +--- a/source3/utils/net_util.c ++++ b/source3/utils/net_util.c +@@ -108,7 +108,6 @@ NTSTATUS connect_to_service(struct net_context *c, + const char *service_type) + { + NTSTATUS nt_status; +- enum smb_signing_setting signing_setting = SMB_SIGNING_DEFAULT; + struct cli_credentials *creds = NULL; + int flags = 0; + +@@ -119,7 +118,6 @@ NTSTATUS connect_to_service(struct net_context *c, + } + + if (strequal(service_type, "IPC")) { +- signing_setting = SMB_SIGNING_IPC_DEFAULT; + flags |= CLI_FULL_CONNECTION_IPC; + } + +@@ -127,8 +125,7 @@ NTSTATUS connect_to_service(struct net_context *c, + server_ss, c->opt_port, + service_name, service_type, + creds, +- flags, +- signing_setting); ++ flags); + if (!NT_STATUS_IS_OK(nt_status)) { + d_fprintf(stderr, _("Could not connect to server %s\n"), + server_name); +@@ -199,8 +196,7 @@ NTSTATUS connect_to_ipc_anonymous(struct net_context *c, + server_name, server_ss, c->opt_port, + "IPC$", "IPC", + anon_creds, +- CLI_FULL_CONNECTION_IPC, +- SMB_SIGNING_OFF); ++ CLI_FULL_CONNECTION_IPC); + + if (NT_STATUS_IS_OK(nt_status)) { + return nt_status; +diff --git a/source3/utils/netlookup.c b/source3/utils/netlookup.c +index 2241beb331f..aaf78b0977a 100644 +--- a/source3/utils/netlookup.c ++++ b/source3/utils/netlookup.c +@@ -99,8 +99,7 @@ static struct con_struct *create_cs(struct net_context *c, + &loopback_ss, 0, + "IPC$", "IPC", + anon_creds, +- CLI_FULL_CONNECTION_IPC, +- SMB_SIGNING_OFF); ++ CLI_FULL_CONNECTION_IPC); + + if (!NT_STATUS_IS_OK(nt_status)) { + DEBUG(2,("create_cs: Connect failed. Error was %s\n", nt_errstr(nt_status))); +diff --git a/source3/utils/smbcacls.c b/source3/utils/smbcacls.c +index f3209c31877..5983ebbd0a5 100644 +--- a/source3/utils/smbcacls.c ++++ b/source3/utils/smbcacls.c +@@ -778,8 +778,7 @@ static struct cli_state *connect_one(const struct user_auth_info *auth_info, + NULL, 0, + share, "?????", + get_cmdline_auth_info_creds(auth_info), +- flags, +- get_cmdline_auth_info_signing_state(auth_info)); ++ flags); + if (!NT_STATUS_IS_OK(nt_status)) { + DEBUG(0,("cli_full_connection failed! (%s)\n", nt_errstr(nt_status))); + return NULL; +diff --git a/source3/utils/smbcquotas.c b/source3/utils/smbcquotas.c +index 954d6eba804..fea066ce468 100644 +--- a/source3/utils/smbcquotas.c ++++ b/source3/utils/smbcquotas.c +@@ -527,9 +527,7 @@ static struct cli_state *connect_one(const char *share) + share, "?????", + get_cmdline_auth_info_creds( + popt_get_cmdline_auth_info()), +- flags, +- get_cmdline_auth_info_signing_state( +- popt_get_cmdline_auth_info())); ++ flags); + if (!NT_STATUS_IS_OK(nt_status)) { + DEBUG(0,("cli_full_connection failed! (%s)\n", nt_errstr(nt_status))); + return NULL; +-- +2.28.0 + + +From 6752c123f20d46aa68725971e09548a47b7c7457 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Mon, 8 Jun 2020 08:04:24 +0200 +Subject: [PATCH 033/105] s3:libsmb: Add encryption support to + cli_full_connection_creds*() + +Pair-Programmed-With: Andreas Schneider + +Signed-off-by: Andreas Schneider +Signed-off-by: Stefan Metzmacher +Reviewed-by: Andreas Schneider +--- + source3/libsmb/cliconnect.c | 166 ++++++++++++++++++++++++++++++++++++ + 1 file changed, 166 insertions(+) + +diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c +index b24743d789b..abfd18bfaf1 100644 +--- a/source3/libsmb/cliconnect.c ++++ b/source3/libsmb/cliconnect.c +@@ -3352,6 +3352,10 @@ static int cli_full_connection_creds_state_destructor( + static void cli_full_connection_creds_conn_done(struct tevent_req *subreq); + static void cli_full_connection_creds_sess_start(struct tevent_req *req); + static void cli_full_connection_creds_sess_done(struct tevent_req *subreq); ++static void cli_full_connection_creds_enc_start(struct tevent_req *req); ++static void cli_full_connection_creds_enc_tcon(struct tevent_req *subreq); ++static void cli_full_connection_creds_enc_ver(struct tevent_req *subreq); ++static void cli_full_connection_creds_enc_done(struct tevent_req *subreq); + static void cli_full_connection_creds_tcon_start(struct tevent_req *req); + static void cli_full_connection_creds_tcon_done(struct tevent_req *subreq); + +@@ -3366,6 +3370,8 @@ struct tevent_req *cli_full_connection_creds_send( + struct tevent_req *req, *subreq; + struct cli_full_connection_creds_state *state; + enum smb_signing_setting signing_state; ++ enum smb_encryption_setting encryption_state = ++ cli_credentials_get_smb_encryption(creds); + + req = tevent_req_create(mem_ctx, &state, + struct cli_full_connection_creds_state); +@@ -3386,6 +3392,16 @@ struct tevent_req *cli_full_connection_creds_send( + signing_state = cli_credentials_get_smb_signing(creds); + } + ++ if (encryption_state == SMB_ENCRYPTION_REQUIRED) { ++ if (flags & CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK) { ++ encryption_state = SMB_ENCRYPTION_DESIRED; ++ } ++ } ++ ++ if (encryption_state >= SMB_ENCRYPTION_DESIRED) { ++ signing_state = SMB_SIGNING_REQUIRED; ++ } ++ + subreq = cli_start_connection_send( + state, ev, my_name, dest_host, dest_ss, port, + signing_state, flags); +@@ -3460,6 +3476,156 @@ static void cli_full_connection_creds_sess_done(struct tevent_req *subreq) + return; + } + ++ cli_full_connection_creds_enc_start(req); ++} ++ ++static void cli_full_connection_creds_enc_start(struct tevent_req *req) ++{ ++ struct cli_full_connection_creds_state *state = tevent_req_data( ++ req, struct cli_full_connection_creds_state); ++ enum smb_encryption_setting encryption_state = ++ cli_credentials_get_smb_encryption(state->creds); ++ struct tevent_req *subreq = NULL; ++ NTSTATUS status; ++ ++ if (encryption_state < SMB_ENCRYPTION_DESIRED) { ++ cli_full_connection_creds_tcon_start(req); ++ return; ++ } ++ ++ if (smbXcli_conn_protocol(state->cli->conn) >= PROTOCOL_SMB2_02) { ++ status = smb2cli_session_encryption_on(state->cli->smb2.session); ++ if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) { ++ if (encryption_state < SMB_ENCRYPTION_REQUIRED) { ++ cli_full_connection_creds_tcon_start(req); ++ return; ++ } ++ d_printf("Encryption required and " ++ "server doesn't support " ++ "SMB3 encryption - failing connect\n"); ++ tevent_req_nterror(req, status); ++ return; ++ } else if (!NT_STATUS_IS_OK(status)) { ++ d_printf("Encryption required and " ++ "setup failed with error %s.\n", ++ nt_errstr(status)); ++ tevent_req_nterror(req, status); ++ return; ++ } ++ ++ cli_full_connection_creds_tcon_start(req); ++ return; ++ } ++ ++ if (!SERVER_HAS_UNIX_CIFS(state->cli)) { ++ if (encryption_state < SMB_ENCRYPTION_REQUIRED) { ++ cli_full_connection_creds_tcon_start(req); ++ return; ++ } ++ ++ status = NT_STATUS_NOT_SUPPORTED; ++ d_printf("Encryption required and " ++ "server doesn't support " ++ "SMB1 Unix Extensions - failing connect\n"); ++ tevent_req_nterror(req, status); ++ return; ++ } ++ ++ /* ++ * We do a tcon on IPC$ just to setup the encryption, ++ * the real tcon will be encrypted then. ++ */ ++ subreq = cli_tree_connect_send(state, state->ev, state->cli, ++ "IPC$", "IPC", NULL); ++ if (tevent_req_nomem(subreq, req)) { ++ return; ++ } ++ tevent_req_set_callback(subreq, cli_full_connection_creds_enc_tcon, req); ++} ++ ++static void cli_full_connection_creds_enc_tcon(struct tevent_req *subreq) ++{ ++ struct tevent_req *req = tevent_req_callback_data( ++ subreq, struct tevent_req); ++ struct cli_full_connection_creds_state *state = tevent_req_data( ++ req, struct cli_full_connection_creds_state); ++ NTSTATUS status; ++ ++ status = cli_tree_connect_recv(subreq); ++ TALLOC_FREE(subreq); ++ if (tevent_req_nterror(req, status)) { ++ return; ++ } ++ ++ subreq = cli_unix_extensions_version_send(state, state->ev, state->cli); ++ if (tevent_req_nomem(subreq, req)) { ++ return; ++ } ++ tevent_req_set_callback(subreq, cli_full_connection_creds_enc_ver, req); ++} ++ ++static void cli_full_connection_creds_enc_ver(struct tevent_req *subreq) ++{ ++ struct tevent_req *req = tevent_req_callback_data( ++ subreq, struct tevent_req); ++ struct cli_full_connection_creds_state *state = tevent_req_data( ++ req, struct cli_full_connection_creds_state); ++ enum smb_encryption_setting encryption_state = ++ cli_credentials_get_smb_encryption(state->creds); ++ uint16_t major, minor; ++ uint32_t caplow, caphigh; ++ NTSTATUS status; ++ ++ status = cli_unix_extensions_version_recv(subreq, ++ &major, &minor, ++ &caplow, ++ &caphigh); ++ TALLOC_FREE(subreq); ++ if (!NT_STATUS_IS_OK(status)) { ++ if (encryption_state < SMB_ENCRYPTION_REQUIRED) { ++ cli_full_connection_creds_tcon_start(req); ++ return; ++ } ++ DEBUG(10, ("%s: cli_unix_extensions_version " ++ "returned %s\n", __func__, nt_errstr(status))); ++ tevent_req_nterror(req, NT_STATUS_UNKNOWN_REVISION); ++ return; ++ } ++ ++ if (!(caplow & CIFS_UNIX_TRANSPORT_ENCRYPTION_CAP)) { ++ if (encryption_state < SMB_ENCRYPTION_REQUIRED) { ++ cli_full_connection_creds_tcon_start(req); ++ return; ++ } ++ DEBUG(10, ("%s: CIFS_UNIX_TRANSPORT_ENCRYPTION_CAP " ++ "not supported\n", __func__)); ++ tevent_req_nterror(req, NT_STATUS_UNSUPPORTED_COMPRESSION); ++ return; ++ } ++ ++ subreq = cli_smb1_setup_encryption_send(state, state->ev, ++ state->cli, ++ state->creds); ++ if (tevent_req_nomem(subreq, req)) { ++ return; ++ } ++ tevent_req_set_callback(subreq, ++ cli_full_connection_creds_enc_done, ++ req); ++} ++ ++static void cli_full_connection_creds_enc_done(struct tevent_req *subreq) ++{ ++ struct tevent_req *req = tevent_req_callback_data( ++ subreq, struct tevent_req); ++ NTSTATUS status; ++ ++ status = cli_smb1_setup_encryption_recv(subreq); ++ TALLOC_FREE(subreq); ++ if (tevent_req_nterror(req, status)) { ++ return; ++ } ++ + cli_full_connection_creds_tcon_start(req); + } + +-- +2.28.0 + + +From bdb894ebb29820b97dba3721a517a61d96fac152 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 10 Jun 2020 11:26:00 +0200 +Subject: [PATCH 034/105] python: Add a test for SMB encryption + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + python/samba/tests/libsmb.py | 37 ++++++++++++++++++++++++++++++++++++ + 1 file changed, 37 insertions(+) + +diff --git a/python/samba/tests/libsmb.py b/python/samba/tests/libsmb.py +index e8f8e7fe94d..81d4e482644 100644 +--- a/python/samba/tests/libsmb.py ++++ b/python/samba/tests/libsmb.py +@@ -21,10 +21,12 @@ from samba.samba3 import libsmb_samba_internal as libsmb + from samba.dcerpc import security + from samba.samba3 import param as s3param + from samba import credentials ++from samba.credentials import SMB_ENCRYPTION_REQUIRED + import samba.tests + import threading + import sys + import os ++import random + + + class LibsmbTestCase(samba.tests.TestCase): +@@ -77,6 +79,41 @@ class LibsmbTestCase(samba.tests.TestCase): + if t.exc: + raise t.exc[0](t.exc[1]) + ++ def test_SMB3EncryptionRequired(self): ++ test_dir = 'testing_%d' % random.randint(0, 0xFFFF) ++ ++ lp = s3param.get_context() ++ lp.load(os.getenv("SMB_CONF_PATH")) ++ ++ creds = credentials.Credentials() ++ creds.guess(lp) ++ creds.set_username(os.getenv("USERNAME")) ++ creds.set_password(os.getenv("PASSWORD")) ++ creds.set_smb_encryption(SMB_ENCRYPTION_REQUIRED) ++ ++ c = libsmb.Conn(os.getenv("SERVER_IP"), "tmp", ++ lp, creds) ++ ++ c.mkdir(test_dir) ++ c.rmdir(test_dir) ++ ++ def test_SMB1EncryptionRequired(self): ++ test_dir = 'testing_%d' % random.randint(0, 0xFFFF) ++ ++ lp = s3param.get_context() ++ lp.load(os.getenv("SMB_CONF_PATH")) ++ ++ creds = credentials.Credentials() ++ creds.guess(lp) ++ creds.set_username(os.getenv("USERNAME")) ++ creds.set_password(os.getenv("PASSWORD")) ++ creds.set_smb_encryption(SMB_ENCRYPTION_REQUIRED) ++ ++ c = libsmb.Conn(os.getenv("SERVER_IP"), "tmp", ++ lp, creds, force_smb1=True) ++ ++ c.mkdir(test_dir) ++ c.rmdir(test_dir) + + if __name__ == "__main__": + import unittest +-- +2.28.0 + + +From d26afd8352435db71c542388220e951184adcdde Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 10 Jun 2020 12:31:02 +0200 +Subject: [PATCH 035/105] s3:net: Use cli_credentials_set_smb_encryption() + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + source3/utils/net_util.c | 16 ++++++---------- + 1 file changed, 6 insertions(+), 10 deletions(-) + +diff --git a/source3/utils/net_util.c b/source3/utils/net_util.c +index b139fb2d0da..5829d891075 100644 +--- a/source3/utils/net_util.c ++++ b/source3/utils/net_util.c +@@ -148,16 +148,6 @@ NTSTATUS connect_to_service(struct net_context *c, + return nt_status; + } + +- if (c->smb_encrypt) { +- nt_status = cli_cm_force_encryption_creds(*cli_ctx, +- creds, +- service_name); +- if (!NT_STATUS_IS_OK(nt_status)) { +- cli_shutdown(*cli_ctx); +- *cli_ctx = NULL; +- } +- } +- + return nt_status; + } + +@@ -577,6 +567,12 @@ struct cli_credentials *net_context_creds(struct net_context *c, + CRED_SPECIFIED); + } + ++ if (c->smb_encrypt) { ++ cli_credentials_set_smb_encryption(creds, ++ SMB_ENCRYPTION_REQUIRED, ++ CRED_SPECIFIED); ++ } ++ + return creds; + } + +-- +2.28.0 + + +From c228933e88c6b615fa49402d2e826a5ec14b9f85 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 10 Jun 2020 12:40:13 +0200 +Subject: [PATCH 036/105] s3:libsmb: Use cli_credentials_set_smb_encryption() + +This also adds a SMBC_ENCRYPTLEVEL_DEFAULT to 'enum +smbc_smb_encrypt_level' in order to use the smb.conf default value. + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + source3/include/libsmbclient.h | 1 + + source3/libsmb/ABI/smbclient-0.7.0.sigs | 188 ++++++++++++++++++++++++ + source3/libsmb/libsmb_context.c | 4 +- + source3/libsmb/libsmb_server.c | 72 +++------ + source3/libsmb/wscript | 2 +- + 5 files changed, 216 insertions(+), 51 deletions(-) + create mode 100644 source3/libsmb/ABI/smbclient-0.7.0.sigs + +diff --git a/source3/include/libsmbclient.h b/source3/include/libsmbclient.h +index c47e7c2a872..84c98089251 100644 +--- a/source3/include/libsmbclient.h ++++ b/source3/include/libsmbclient.h +@@ -225,6 +225,7 @@ typedef enum smbc_share_mode + */ + typedef enum smbc_smb_encrypt_level + { ++ SMBC_ENCRYPTLEVEL_DEFAULT = -1, + SMBC_ENCRYPTLEVEL_NONE = 0, + SMBC_ENCRYPTLEVEL_REQUEST = 1, + SMBC_ENCRYPTLEVEL_REQUIRE = 2 +diff --git a/source3/libsmb/ABI/smbclient-0.7.0.sigs b/source3/libsmb/ABI/smbclient-0.7.0.sigs +new file mode 100644 +index 00000000000..ee758e21b50 +--- /dev/null ++++ b/source3/libsmb/ABI/smbclient-0.7.0.sigs +@@ -0,0 +1,188 @@ ++smbc_chmod: int (const char *, mode_t) ++smbc_close: int (int) ++smbc_closedir: int (int) ++smbc_creat: int (const char *, mode_t) ++smbc_fgetxattr: int (int, const char *, const void *, size_t) ++smbc_flistxattr: int (int, char *, size_t) ++smbc_free_context: int (SMBCCTX *, int) ++smbc_fremovexattr: int (int, const char *) ++smbc_fsetxattr: int (int, const char *, const void *, size_t, int) ++smbc_fstat: int (int, struct stat *) ++smbc_fstatvfs: int (int, struct statvfs *) ++smbc_ftruncate: int (int, off_t) ++smbc_getDebug: int (SMBCCTX *) ++smbc_getFunctionAddCachedServer: smbc_add_cached_srv_fn (SMBCCTX *) ++smbc_getFunctionAuthData: smbc_get_auth_data_fn (SMBCCTX *) ++smbc_getFunctionAuthDataWithContext: smbc_get_auth_data_with_context_fn (SMBCCTX *) ++smbc_getFunctionCheckServer: smbc_check_server_fn (SMBCCTX *) ++smbc_getFunctionChmod: smbc_chmod_fn (SMBCCTX *) ++smbc_getFunctionClose: smbc_close_fn (SMBCCTX *) ++smbc_getFunctionClosedir: smbc_closedir_fn (SMBCCTX *) ++smbc_getFunctionCreat: smbc_creat_fn (SMBCCTX *) ++smbc_getFunctionFstat: smbc_fstat_fn (SMBCCTX *) ++smbc_getFunctionFstatVFS: smbc_fstatvfs_fn (SMBCCTX *) ++smbc_getFunctionFstatdir: smbc_fstatdir_fn (SMBCCTX *) ++smbc_getFunctionFtruncate: smbc_ftruncate_fn (SMBCCTX *) ++smbc_getFunctionGetCachedServer: smbc_get_cached_srv_fn (SMBCCTX *) ++smbc_getFunctionGetdents: smbc_getdents_fn (SMBCCTX *) ++smbc_getFunctionGetxattr: smbc_getxattr_fn (SMBCCTX *) ++smbc_getFunctionListPrintJobs: smbc_list_print_jobs_fn (SMBCCTX *) ++smbc_getFunctionListxattr: smbc_listxattr_fn (SMBCCTX *) ++smbc_getFunctionLseek: smbc_lseek_fn (SMBCCTX *) ++smbc_getFunctionLseekdir: smbc_lseekdir_fn (SMBCCTX *) ++smbc_getFunctionMkdir: smbc_mkdir_fn (SMBCCTX *) ++smbc_getFunctionNotify: smbc_notify_fn (SMBCCTX *) ++smbc_getFunctionOpen: smbc_open_fn (SMBCCTX *) ++smbc_getFunctionOpenPrintJob: smbc_open_print_job_fn (SMBCCTX *) ++smbc_getFunctionOpendir: smbc_opendir_fn (SMBCCTX *) ++smbc_getFunctionPrintFile: smbc_print_file_fn (SMBCCTX *) ++smbc_getFunctionPurgeCachedServers: smbc_purge_cached_fn (SMBCCTX *) ++smbc_getFunctionRead: smbc_read_fn (SMBCCTX *) ++smbc_getFunctionReaddir: smbc_readdir_fn (SMBCCTX *) ++smbc_getFunctionReaddirPlus: smbc_readdirplus_fn (SMBCCTX *) ++smbc_getFunctionReaddirPlus2: smbc_readdirplus2_fn (SMBCCTX *) ++smbc_getFunctionRemoveCachedServer: smbc_remove_cached_srv_fn (SMBCCTX *) ++smbc_getFunctionRemoveUnusedServer: smbc_remove_unused_server_fn (SMBCCTX *) ++smbc_getFunctionRemovexattr: smbc_removexattr_fn (SMBCCTX *) ++smbc_getFunctionRename: smbc_rename_fn (SMBCCTX *) ++smbc_getFunctionRmdir: smbc_rmdir_fn (SMBCCTX *) ++smbc_getFunctionSetxattr: smbc_setxattr_fn (SMBCCTX *) ++smbc_getFunctionSplice: smbc_splice_fn (SMBCCTX *) ++smbc_getFunctionStat: smbc_stat_fn (SMBCCTX *) ++smbc_getFunctionStatVFS: smbc_statvfs_fn (SMBCCTX *) ++smbc_getFunctionTelldir: smbc_telldir_fn (SMBCCTX *) ++smbc_getFunctionUnlink: smbc_unlink_fn (SMBCCTX *) ++smbc_getFunctionUnlinkPrintJob: smbc_unlink_print_job_fn (SMBCCTX *) ++smbc_getFunctionUtimes: smbc_utimes_fn (SMBCCTX *) ++smbc_getFunctionWrite: smbc_write_fn (SMBCCTX *) ++smbc_getNetbiosName: const char *(SMBCCTX *) ++smbc_getOptionBrowseMaxLmbCount: int (SMBCCTX *) ++smbc_getOptionCaseSensitive: smbc_bool (SMBCCTX *) ++smbc_getOptionDebugToStderr: smbc_bool (SMBCCTX *) ++smbc_getOptionFallbackAfterKerberos: smbc_bool (SMBCCTX *) ++smbc_getOptionFullTimeNames: smbc_bool (SMBCCTX *) ++smbc_getOptionNoAutoAnonymousLogin: smbc_bool (SMBCCTX *) ++smbc_getOptionOneSharePerServer: smbc_bool (SMBCCTX *) ++smbc_getOptionOpenShareMode: smbc_share_mode (SMBCCTX *) ++smbc_getOptionSmbEncryptionLevel: smbc_smb_encrypt_level (SMBCCTX *) ++smbc_getOptionUrlEncodeReaddirEntries: smbc_bool (SMBCCTX *) ++smbc_getOptionUseCCache: smbc_bool (SMBCCTX *) ++smbc_getOptionUseKerberos: smbc_bool (SMBCCTX *) ++smbc_getOptionUseNTHash: smbc_bool (SMBCCTX *) ++smbc_getOptionUserData: void *(SMBCCTX *) ++smbc_getPort: uint16_t (SMBCCTX *) ++smbc_getServerCacheData: struct smbc_server_cache *(SMBCCTX *) ++smbc_getTimeout: int (SMBCCTX *) ++smbc_getUser: const char *(SMBCCTX *) ++smbc_getWorkgroup: const char *(SMBCCTX *) ++smbc_getdents: int (unsigned int, struct smbc_dirent *, int) ++smbc_getxattr: int (const char *, const char *, const void *, size_t) ++smbc_init: int (smbc_get_auth_data_fn, int) ++smbc_init_context: SMBCCTX *(SMBCCTX *) ++smbc_lgetxattr: int (const char *, const char *, const void *, size_t) ++smbc_list_print_jobs: int (const char *, smbc_list_print_job_fn) ++smbc_listxattr: int (const char *, char *, size_t) ++smbc_llistxattr: int (const char *, char *, size_t) ++smbc_lremovexattr: int (const char *, const char *) ++smbc_lseek: off_t (int, off_t, int) ++smbc_lseekdir: int (int, off_t) ++smbc_lsetxattr: int (const char *, const char *, const void *, size_t, int) ++smbc_mkdir: int (const char *, mode_t) ++smbc_new_context: SMBCCTX *(void) ++smbc_notify: int (int, smbc_bool, uint32_t, unsigned int, smbc_notify_callback_fn, void *) ++smbc_open: int (const char *, int, mode_t) ++smbc_open_print_job: int (const char *) ++smbc_opendir: int (const char *) ++smbc_option_get: void *(SMBCCTX *, char *) ++smbc_option_set: void (SMBCCTX *, char *, ...) ++smbc_print_file: int (const char *, const char *) ++smbc_read: ssize_t (int, void *, size_t) ++smbc_readdir: struct smbc_dirent *(unsigned int) ++smbc_readdirplus: const struct libsmb_file_info *(unsigned int) ++smbc_readdirplus2: const struct libsmb_file_info *(unsigned int, struct stat *) ++smbc_removexattr: int (const char *, const char *) ++smbc_rename: int (const char *, const char *) ++smbc_rmdir: int (const char *) ++smbc_setConfiguration: int (SMBCCTX *, const char *) ++smbc_setDebug: void (SMBCCTX *, int) ++smbc_setFunctionAddCachedServer: void (SMBCCTX *, smbc_add_cached_srv_fn) ++smbc_setFunctionAuthData: void (SMBCCTX *, smbc_get_auth_data_fn) ++smbc_setFunctionAuthDataWithContext: void (SMBCCTX *, smbc_get_auth_data_with_context_fn) ++smbc_setFunctionCheckServer: void (SMBCCTX *, smbc_check_server_fn) ++smbc_setFunctionChmod: void (SMBCCTX *, smbc_chmod_fn) ++smbc_setFunctionClose: void (SMBCCTX *, smbc_close_fn) ++smbc_setFunctionClosedir: void (SMBCCTX *, smbc_closedir_fn) ++smbc_setFunctionCreat: void (SMBCCTX *, smbc_creat_fn) ++smbc_setFunctionFstat: void (SMBCCTX *, smbc_fstat_fn) ++smbc_setFunctionFstatVFS: void (SMBCCTX *, smbc_fstatvfs_fn) ++smbc_setFunctionFstatdir: void (SMBCCTX *, smbc_fstatdir_fn) ++smbc_setFunctionFtruncate: void (SMBCCTX *, smbc_ftruncate_fn) ++smbc_setFunctionGetCachedServer: void (SMBCCTX *, smbc_get_cached_srv_fn) ++smbc_setFunctionGetdents: void (SMBCCTX *, smbc_getdents_fn) ++smbc_setFunctionGetxattr: void (SMBCCTX *, smbc_getxattr_fn) ++smbc_setFunctionListPrintJobs: void (SMBCCTX *, smbc_list_print_jobs_fn) ++smbc_setFunctionListxattr: void (SMBCCTX *, smbc_listxattr_fn) ++smbc_setFunctionLseek: void (SMBCCTX *, smbc_lseek_fn) ++smbc_setFunctionLseekdir: void (SMBCCTX *, smbc_lseekdir_fn) ++smbc_setFunctionMkdir: void (SMBCCTX *, smbc_mkdir_fn) ++smbc_setFunctionNotify: void (SMBCCTX *, smbc_notify_fn) ++smbc_setFunctionOpen: void (SMBCCTX *, smbc_open_fn) ++smbc_setFunctionOpenPrintJob: void (SMBCCTX *, smbc_open_print_job_fn) ++smbc_setFunctionOpendir: void (SMBCCTX *, smbc_opendir_fn) ++smbc_setFunctionPrintFile: void (SMBCCTX *, smbc_print_file_fn) ++smbc_setFunctionPurgeCachedServers: void (SMBCCTX *, smbc_purge_cached_fn) ++smbc_setFunctionRead: void (SMBCCTX *, smbc_read_fn) ++smbc_setFunctionReaddir: void (SMBCCTX *, smbc_readdir_fn) ++smbc_setFunctionReaddirPlus: void (SMBCCTX *, smbc_readdirplus_fn) ++smbc_setFunctionReaddirPlus2: void (SMBCCTX *, smbc_readdirplus2_fn) ++smbc_setFunctionRemoveCachedServer: void (SMBCCTX *, smbc_remove_cached_srv_fn) ++smbc_setFunctionRemoveUnusedServer: void (SMBCCTX *, smbc_remove_unused_server_fn) ++smbc_setFunctionRemovexattr: void (SMBCCTX *, smbc_removexattr_fn) ++smbc_setFunctionRename: void (SMBCCTX *, smbc_rename_fn) ++smbc_setFunctionRmdir: void (SMBCCTX *, smbc_rmdir_fn) ++smbc_setFunctionSetxattr: void (SMBCCTX *, smbc_setxattr_fn) ++smbc_setFunctionSplice: void (SMBCCTX *, smbc_splice_fn) ++smbc_setFunctionStat: void (SMBCCTX *, smbc_stat_fn) ++smbc_setFunctionStatVFS: void (SMBCCTX *, smbc_statvfs_fn) ++smbc_setFunctionTelldir: void (SMBCCTX *, smbc_telldir_fn) ++smbc_setFunctionUnlink: void (SMBCCTX *, smbc_unlink_fn) ++smbc_setFunctionUnlinkPrintJob: void (SMBCCTX *, smbc_unlink_print_job_fn) ++smbc_setFunctionUtimes: void (SMBCCTX *, smbc_utimes_fn) ++smbc_setFunctionWrite: void (SMBCCTX *, smbc_write_fn) ++smbc_setLogCallback: void (SMBCCTX *, void *, smbc_debug_callback_fn) ++smbc_setNetbiosName: void (SMBCCTX *, const char *) ++smbc_setOptionBrowseMaxLmbCount: void (SMBCCTX *, int) ++smbc_setOptionCaseSensitive: void (SMBCCTX *, smbc_bool) ++smbc_setOptionDebugToStderr: void (SMBCCTX *, smbc_bool) ++smbc_setOptionFallbackAfterKerberos: void (SMBCCTX *, smbc_bool) ++smbc_setOptionFullTimeNames: void (SMBCCTX *, smbc_bool) ++smbc_setOptionNoAutoAnonymousLogin: void (SMBCCTX *, smbc_bool) ++smbc_setOptionOneSharePerServer: void (SMBCCTX *, smbc_bool) ++smbc_setOptionOpenShareMode: void (SMBCCTX *, smbc_share_mode) ++smbc_setOptionProtocols: smbc_bool (SMBCCTX *, const char *, const char *) ++smbc_setOptionSmbEncryptionLevel: void (SMBCCTX *, smbc_smb_encrypt_level) ++smbc_setOptionUrlEncodeReaddirEntries: void (SMBCCTX *, smbc_bool) ++smbc_setOptionUseCCache: void (SMBCCTX *, smbc_bool) ++smbc_setOptionUseKerberos: void (SMBCCTX *, smbc_bool) ++smbc_setOptionUseNTHash: void (SMBCCTX *, smbc_bool) ++smbc_setOptionUserData: void (SMBCCTX *, void *) ++smbc_setPort: void (SMBCCTX *, uint16_t) ++smbc_setServerCacheData: void (SMBCCTX *, struct smbc_server_cache *) ++smbc_setTimeout: void (SMBCCTX *, int) ++smbc_setUser: void (SMBCCTX *, const char *) ++smbc_setWorkgroup: void (SMBCCTX *, const char *) ++smbc_set_context: SMBCCTX *(SMBCCTX *) ++smbc_set_credentials: void (const char *, const char *, const char *, smbc_bool, const char *) ++smbc_set_credentials_with_fallback: void (SMBCCTX *, const char *, const char *, const char *) ++smbc_setxattr: int (const char *, const char *, const void *, size_t, int) ++smbc_stat: int (const char *, struct stat *) ++smbc_statvfs: int (char *, struct statvfs *) ++smbc_telldir: off_t (int) ++smbc_unlink: int (const char *) ++smbc_unlink_print_job: int (const char *, int) ++smbc_urldecode: int (char *, char *, size_t) ++smbc_urlencode: int (char *, char *, int) ++smbc_utime: int (const char *, struct utimbuf *) ++smbc_utimes: int (const char *, struct timeval *) ++smbc_version: const char *(void) ++smbc_write: ssize_t (int, const void *, size_t) +diff --git a/source3/libsmb/libsmb_context.c b/source3/libsmb/libsmb_context.c +index eaa0cdeca93..ea741f41c7d 100644 +--- a/source3/libsmb/libsmb_context.c ++++ b/source3/libsmb/libsmb_context.c +@@ -171,7 +171,7 @@ smbc_new_context(void) + + smbc_setOptionFullTimeNames(context, False); + smbc_setOptionOpenShareMode(context, SMBC_SHAREMODE_DENY_NONE); +- smbc_setOptionSmbEncryptionLevel(context, SMBC_ENCRYPTLEVEL_NONE); ++ smbc_setOptionSmbEncryptionLevel(context, SMBC_ENCRYPTLEVEL_DEFAULT); + smbc_setOptionUseCCache(context, True); + smbc_setOptionCaseSensitive(context, False); + smbc_setOptionBrowseMaxLmbCount(context, 3); /* # LMBs to query */ +@@ -474,6 +474,8 @@ smbc_option_get(SMBCCTX *context, + } else if (strcmp(option_name, "smb_encrypt_level") == 0) { + switch(smbc_getOptionSmbEncryptionLevel(context)) + { ++ case SMBC_ENCRYPTLEVEL_DEFAULT: ++ return discard_const_p(void, "default"); + case 0: + return discard_const_p(void, "none"); + case 1: +diff --git a/source3/libsmb/libsmb_server.c b/source3/libsmb/libsmb_server.c +index 33dc8419deb..eb58d7c6ac9 100644 +--- a/source3/libsmb/libsmb_server.c ++++ b/source3/libsmb/libsmb_server.c +@@ -284,6 +284,29 @@ static struct cli_credentials *SMBC_auth_credentials(TALLOC_CTX *mem_ctx, + return NULL; + } + ++ switch (context->internal->smb_encryption_level) { ++ case SMBC_ENCRYPTLEVEL_DEFAULT: ++ /* Use the config option */ ++ break; ++ case SMBC_ENCRYPTLEVEL_NONE: ++ cli_credentials_set_smb_encryption(creds, ++ SMB_ENCRYPTION_OFF, ++ CRED_SPECIFIED); ++ break; ++ case SMBC_ENCRYPTLEVEL_REQUEST: ++ cli_credentials_set_smb_encryption(creds, ++ SMB_ENCRYPTION_DESIRED, ++ CRED_SPECIFIED); ++ break; ++ case SMBC_ENCRYPTLEVEL_REQUIRE: ++ default: ++ cli_credentials_set_smb_encryption(creds, ++ SMB_ENCRYPTION_REQUIRED, ++ CRED_SPECIFIED); ++ break; ++ } ++ ++ + return creds; + } + +@@ -625,30 +648,6 @@ SMBC_server_internal(TALLOC_CTX *ctx, + smbXcli_tcon_set_fs_attributes(tcon, fs_attrs); + } + +- if (context->internal->smb_encryption_level) { +- /* Attempt encryption. */ +- status = cli_cm_force_encryption_creds(c, +- creds, +- share); +- if (!NT_STATUS_IS_OK(status)) { +- +- /* +- * context->smb_encryption_level == 1 +- * means don't fail if encryption can't be negotiated, +- * == 2 means fail if encryption can't be negotiated. +- */ +- +- DEBUG(4,(" SMB encrypt failed\n")); +- +- if (context->internal->smb_encryption_level == 2) { +- cli_shutdown(c); +- errno = EPERM; +- return NULL; +- } +- } +- DEBUG(4,(" SMB encrypt ok\n")); +- } +- + /* + * Ok, we have got a nice connection + * Let's allocate a server structure. +@@ -825,31 +824,6 @@ SMBC_attr_server(TALLOC_CTX *ctx, + } + talloc_steal(ipc_cli, creds); + +- if (context->internal->smb_encryption_level) { +- /* Attempt encryption. */ +- nt_status = cli_cm_force_encryption_creds(ipc_cli, +- creds, +- "IPC$"); +- if (!NT_STATUS_IS_OK(nt_status)) { +- +- /* +- * context->smb_encryption_level == +- * 1 means don't fail if encryption can't be +- * negotiated, == 2 means fail if encryption +- * can't be negotiated. +- */ +- +- DEBUG(4,(" SMB encrypt failed on IPC$\n")); +- +- if (context->internal->smb_encryption_level == 2) { +- cli_shutdown(ipc_cli); +- errno = EPERM; +- return NULL; +- } +- } +- DEBUG(4,(" SMB encrypt ok on IPC$\n")); +- } +- + ipc_srv = SMB_MALLOC_P(SMBCSRV); + if (!ipc_srv) { + errno = ENOMEM; +diff --git a/source3/libsmb/wscript b/source3/libsmb/wscript +index ec4a516b2ee..61503d0a98b 100644 +--- a/source3/libsmb/wscript ++++ b/source3/libsmb/wscript +@@ -26,5 +26,5 @@ def build(bld): + public_headers='../include/libsmbclient.h', + abi_directory='ABI', + abi_match='smbc_*', +- vnum='0.6.0', ++ vnum='0.7.0', + pc_files='smbclient.pc') +-- +2.28.0 + + +From 76dc706e6449161c27a5f117bc45922ab467dbfc Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 10 Jun 2020 12:43:33 +0200 +Subject: [PATCH 037/105] s3:client: Remove unused smb encryption code + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + source3/client/smbspool.c | 10 ---------- + 1 file changed, 10 deletions(-) + +diff --git a/source3/client/smbspool.c b/source3/client/smbspool.c +index f56dc323b6e..16a8d44c069 100644 +--- a/source3/client/smbspool.c ++++ b/source3/client/smbspool.c +@@ -584,16 +584,6 @@ smb_complete_connection(struct cli_state **output_cli, + + return nt_status; + } +-#if 0 +- /* Need to work out how to specify this on the URL. */ +- if (smb_encrypt) { +- if (!cli_cm_force_encryption_creds(cli, creds, share)) { +- fprintf(stderr, "ERROR: encryption setup failed\n"); +- cli_shutdown(cli); +- return NULL; +- } +- } +-#endif + + *output_cli = cli; + return NT_STATUS_OK; +-- +2.28.0 + + +From a444688a6ed50c8443a778fbddb4dbd8a39d49d4 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 10 Jun 2020 12:47:05 +0200 +Subject: [PATCH 038/105] s3:utils: Remove obsolete force encryption from + smbacls + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + source3/utils/smbcacls.c | 10 ---------- + 1 file changed, 10 deletions(-) + +diff --git a/source3/utils/smbcacls.c b/source3/utils/smbcacls.c +index 5983ebbd0a5..8fd9fcc5780 100644 +--- a/source3/utils/smbcacls.c ++++ b/source3/utils/smbcacls.c +@@ -784,16 +784,6 @@ static struct cli_state *connect_one(const struct user_auth_info *auth_info, + return NULL; + } + +- if (get_cmdline_auth_info_smb_encrypt(auth_info)) { +- nt_status = cli_cm_force_encryption_creds(c, +- get_cmdline_auth_info_creds(auth_info), +- share); +- if (!NT_STATUS_IS_OK(nt_status)) { +- cli_shutdown(c); +- c = NULL; +- } +- } +- + return c; + } + +-- +2.28.0 + + +From 21b72b6107cd849b9da77e17520e658745fb897a Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 10 Jun 2020 12:48:18 +0200 +Subject: [PATCH 039/105] s3:utils: Remove obsolete force encryption from + mdfind + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + source3/utils/mdfind.c | 7 ------- + 1 file changed, 7 deletions(-) + +diff --git a/source3/utils/mdfind.c b/source3/utils/mdfind.c +index 2ac4fde7daf..ef2657e4fa5 100644 +--- a/source3/utils/mdfind.c ++++ b/source3/utils/mdfind.c +@@ -159,13 +159,6 @@ int main(int argc, char **argv) + goto fail; + } + +- if (get_cmdline_auth_info_smb_encrypt(auth)) { +- status = cli_cm_force_encryption_creds(cli, creds, "IPC$"); +- if (!NT_STATUS_IS_OK(status)) { +- goto fail; +- } +- } +- + status = cli_rpc_pipe_open_noauth_transport(cli, + NCACN_NP, + &ndr_table_mdssvc, +-- +2.28.0 + + +From 842c3c1346cba54c92d6ba2d462818875403a394 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 10 Jun 2020 12:49:28 +0200 +Subject: [PATCH 040/105] s3:utils: Remove obsolete force encryption from + smbcquotas + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + source3/utils/smbcquotas.c | 11 ----------- + 1 file changed, 11 deletions(-) + +diff --git a/source3/utils/smbcquotas.c b/source3/utils/smbcquotas.c +index fea066ce468..4ceac7b3ab0 100644 +--- a/source3/utils/smbcquotas.c ++++ b/source3/utils/smbcquotas.c +@@ -533,17 +533,6 @@ static struct cli_state *connect_one(const char *share) + return NULL; + } + +- if (get_cmdline_auth_info_smb_encrypt(popt_get_cmdline_auth_info())) { +- nt_status = cli_cm_force_encryption_creds(c, +- get_cmdline_auth_info_creds( +- popt_get_cmdline_auth_info()), +- share); +- if (!NT_STATUS_IS_OK(nt_status)) { +- cli_shutdown(c); +- return NULL; +- } +- } +- + return c; + } + +-- +2.28.0 + + +From be36aec550d817bbcfdea88b433e31b44886ba19 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 10 Jun 2020 12:51:18 +0200 +Subject: [PATCH 041/105] s3:rpcclient: Remove obsolete force encryption from + rpcclient + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + source3/rpcclient/rpcclient.c | 11 ----------- + 1 file changed, 11 deletions(-) + +diff --git a/source3/rpcclient/rpcclient.c b/source3/rpcclient/rpcclient.c +index 2ead6cc7ba5..575a42ebf70 100644 +--- a/source3/rpcclient/rpcclient.c ++++ b/source3/rpcclient/rpcclient.c +@@ -1214,17 +1214,6 @@ out_free: + goto done; + } + +- if (get_cmdline_auth_info_smb_encrypt(popt_get_cmdline_auth_info())) { +- nt_status = cli_cm_force_encryption_creds(cli, +- get_cmdline_auth_info_creds( +- popt_get_cmdline_auth_info()), +- "IPC$"); +- if (!NT_STATUS_IS_OK(nt_status)) { +- result = 1; +- goto done; +- } +- } +- + #if 0 /* COMMENT OUT FOR TESTING */ + memset(cmdline_auth_info.password,'X',sizeof(cmdline_auth_info.password)); + #endif +-- +2.28.0 + + +From 8e2de7801238eb7f1090a9307dc4b05885b3dda2 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Mon, 6 Jul 2020 10:58:36 +0200 +Subject: [PATCH 042/105] examples: Remove obsolete force encryption from + smb2mount + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + examples/fuse/smb2mount.c | 11 ----------- + 1 file changed, 11 deletions(-) + +diff --git a/examples/fuse/smb2mount.c b/examples/fuse/smb2mount.c +index 6206c3a9701..c64be573462 100644 +--- a/examples/fuse/smb2mount.c ++++ b/examples/fuse/smb2mount.c +@@ -44,17 +44,6 @@ static struct cli_state *connect_one(const struct user_auth_info *auth_info, + return NULL; + } + +- if (get_cmdline_auth_info_smb_encrypt(auth_info)) { +- nt_status = cli_cm_force_encryption_creds( +- c, +- get_cmdline_auth_info_creds(auth_info), +- share); +- if (!NT_STATUS_IS_OK(nt_status)) { +- cli_shutdown(c); +- c = NULL; +- } +- } +- + return c; + } + +-- +2.28.0 + + +From 8c9a31cc180c674925919771ccdce1bb6895c1a3 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Mon, 6 Jul 2020 11:05:59 +0200 +Subject: [PATCH 043/105] s3:libsmb: Make cli_cm_force_encryption_creds() + static + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + source3/libsmb/clidfs.c | 6 +++--- + source3/libsmb/proto.h | 3 --- + 2 files changed, 3 insertions(+), 6 deletions(-) + +diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c +index 4495a027830..aff998f6187 100644 +--- a/source3/libsmb/clidfs.c ++++ b/source3/libsmb/clidfs.c +@@ -43,9 +43,9 @@ + Ensure a connection is encrypted. + ********************************************************************/ + +-NTSTATUS cli_cm_force_encryption_creds(struct cli_state *c, +- struct cli_credentials *creds, +- const char *sharename) ++static NTSTATUS cli_cm_force_encryption_creds(struct cli_state *c, ++ struct cli_credentials *creds, ++ const char *sharename) + { + uint16_t major, minor; + uint32_t caplow, caphigh; +diff --git a/source3/libsmb/proto.h b/source3/libsmb/proto.h +index 850cf12c8a6..eeabcaa7463 100644 +--- a/source3/libsmb/proto.h ++++ b/source3/libsmb/proto.h +@@ -123,9 +123,6 @@ struct cli_state *get_ipc_connect_master_ip(TALLOC_CTX *ctx, + + /* The following definitions come from libsmb/clidfs.c */ + +-NTSTATUS cli_cm_force_encryption_creds(struct cli_state *c, +- struct cli_credentials *creds, +- const char *sharename); + NTSTATUS cli_cm_open(TALLOC_CTX *ctx, + struct cli_state *referring_cli, + const char *server, +-- +2.28.0 + + +From 6e2a7196c424edd2c447cfd4377e38e5b51ee675 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 13 Aug 2020 16:16:55 +0200 +Subject: [PATCH 044/105] s4:libcli: Return NTSTATUS errors for + smb_composite_connect_send() + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + source4/libcli/smb_composite/connect.c | 40 +++++++++++++++++++------- + 1 file changed, 29 insertions(+), 11 deletions(-) + +diff --git a/source4/libcli/smb_composite/connect.c b/source4/libcli/smb_composite/connect.c +index 582d43ef173..ad50ae0ac81 100644 +--- a/source4/libcli/smb_composite/connect.c ++++ b/source4/libcli/smb_composite/connect.c +@@ -420,15 +420,25 @@ struct composite_context *smb_composite_connect_send(struct smb_composite_connec + struct connect_state *state; + + c = talloc_zero(mem_ctx, struct composite_context); +- if (c == NULL) goto failed; +- +- c->event_ctx = event_ctx; +- if (c->event_ctx == NULL) goto failed; ++ if (c == NULL) { ++ goto nomem; ++ } + + state = talloc_zero(c, struct connect_state); +- if (state == NULL) goto failed; ++ if (state == NULL) { ++ goto nomem; ++ } ++ ++ c->event_ctx = event_ctx; ++ if (c->event_ctx == NULL) { ++ composite_error(c, NT_STATUS_INVALID_PARAMETER_MIX); ++ return c; ++ } + +- if (io->in.gensec_settings == NULL) goto failed; ++ if (io->in.gensec_settings == NULL) { ++ composite_error(c, NT_STATUS_INVALID_PARAMETER_MIX); ++ return c; ++ } + state->io = io; + + c->state = COMPOSITE_STATE_IN_PROGRESS; +@@ -449,12 +459,14 @@ struct composite_context *smb_composite_connect_send(struct smb_composite_connec + &io->in.options, + &state->transport); + if (!NT_STATUS_IS_OK(status)) { +- goto failed; ++ composite_error(c, status); ++ return c; + } + + status = connect_send_session(c, io); + if (!NT_STATUS_IS_OK(status)) { +- goto failed; ++ composite_error(c, status); ++ return c; + } + + return c; +@@ -468,15 +480,18 @@ struct composite_context *smb_composite_connect_send(struct smb_composite_connec + io->in.socket_options, + &state->calling, + &state->called); +- if (state->creq == NULL) goto failed; ++ if (state->creq == NULL) { ++ composite_error(c, NT_STATUS_NO_MEMORY); ++ return c; ++ } + + state->stage = CONNECT_SOCKET; + state->creq->async.private_data = c; + state->creq->async.fn = composite_handler; + + return c; +-failed: +- talloc_free(c); ++nomem: ++ TALLOC_FREE(c); + return NULL; + } + +@@ -506,5 +521,8 @@ NTSTATUS smb_composite_connect(struct smb_composite_connect *io, TALLOC_CTX *mem + struct tevent_context *ev) + { + struct composite_context *c = smb_composite_connect_send(io, mem_ctx, resolve_ctx, ev); ++ if (c == NULL) { ++ return NT_STATUS_NO_MEMORY; ++ } + return smb_composite_connect_recv(c, mem_ctx); + } +-- +2.28.0 + + +From cf89573a78556993d7ecb43257d347edc6c61151 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 7 Jul 2020 12:54:26 +0200 +Subject: [PATCH 045/105] s4:libcli: Return if encryption is requested for SMB1 + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + source4/libcli/smb_composite/sesssetup.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/source4/libcli/smb_composite/sesssetup.c b/source4/libcli/smb_composite/sesssetup.c +index 6ee4929e8d7..51e121bdce6 100644 +--- a/source4/libcli/smb_composite/sesssetup.c ++++ b/source4/libcli/smb_composite/sesssetup.c +@@ -620,10 +620,17 @@ struct composite_context *smb_composite_sesssetup_send(struct smbcli_session *se + struct composite_context *c; + struct sesssetup_state *state; + NTSTATUS status; ++ enum smb_encryption_setting encryption_state = ++ cli_credentials_get_smb_encryption(io->in.credentials); + + c = composite_create(session, session->transport->ev); + if (c == NULL) return NULL; + ++ if (encryption_state > SMB_ENCRYPTION_DESIRED) { ++ composite_error(c, NT_STATUS_PROTOCOL_NOT_SUPPORTED); ++ return c; ++ } ++ + state = talloc_zero(c, struct sesssetup_state); + if (composite_nomem(state, c)) return c; + c->private_data = state; +-- +2.28.0 + + +From 05914c4f85f71c7d1df884e33b8c0b8f5062ee3b Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 7 Jul 2020 12:29:39 +0200 +Subject: [PATCH 046/105] s3:libcli: Split out smb2_connect_tcon_start() + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + source4/libcli/smb2/connect.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/source4/libcli/smb2/connect.c b/source4/libcli/smb2/connect.c +index 6fc3993a4e8..95ff05eac8f 100644 +--- a/source4/libcli/smb2/connect.c ++++ b/source4/libcli/smb2/connect.c +@@ -237,6 +237,7 @@ static void smb2_connect_session_start(struct tevent_req *req) + tevent_req_set_callback(subreq, smb2_connect_session_done, req); + } + ++static void smb2_connect_tcon_start(struct tevent_req *req); + static void smb2_connect_tcon_done(struct tevent_req *subreq); + + static void smb2_connect_session_done(struct tevent_req *subreq) +@@ -248,7 +249,6 @@ static void smb2_connect_session_done(struct tevent_req *subreq) + tevent_req_data(req, + struct smb2_connect_state); + NTSTATUS status; +- uint32_t timeout_msec; + + status = smb2_session_setup_spnego_recv(subreq); + TALLOC_FREE(subreq); +@@ -289,6 +289,17 @@ static void smb2_connect_session_done(struct tevent_req *subreq) + return; + } + ++ smb2_connect_tcon_start(req); ++} ++ ++static void smb2_connect_tcon_start(struct tevent_req *req) ++{ ++ struct smb2_connect_state *state = ++ tevent_req_data(req, ++ struct smb2_connect_state); ++ struct tevent_req *subreq = NULL; ++ uint32_t timeout_msec; ++ + timeout_msec = state->transport->options.request_timeout * 1000; + + subreq = smb2cli_tcon_send(state, state->ev, +-- +2.28.0 + + +From 63b0086d8ffdfca44134c09ff0db76d7a9ae8f6c Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 7 Jul 2020 12:44:26 +0200 +Subject: [PATCH 047/105] s4:libcli: Add smb2_connect_enc_start() + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + source4/libcli/smb2/connect.c | 38 +++++++++++++++++++++++++++++++++++ + 1 file changed, 38 insertions(+) + +diff --git a/source4/libcli/smb2/connect.c b/source4/libcli/smb2/connect.c +index 95ff05eac8f..3a3ecdf20e8 100644 +--- a/source4/libcli/smb2/connect.c ++++ b/source4/libcli/smb2/connect.c +@@ -237,6 +237,7 @@ static void smb2_connect_session_start(struct tevent_req *req) + tevent_req_set_callback(subreq, smb2_connect_session_done, req); + } + ++static void smb2_connect_enc_start(struct tevent_req *req); + static void smb2_connect_tcon_start(struct tevent_req *req); + static void smb2_connect_tcon_done(struct tevent_req *subreq); + +@@ -289,6 +290,43 @@ static void smb2_connect_session_done(struct tevent_req *subreq) + return; + } + ++ smb2_connect_enc_start(req); ++} ++ ++static void smb2_connect_enc_start(struct tevent_req *req) ++{ ++ struct smb2_connect_state *state = ++ tevent_req_data(req, ++ struct smb2_connect_state); ++ enum smb_encryption_setting encryption_state = ++ cli_credentials_get_smb_encryption(state->credentials); ++ NTSTATUS status; ++ ++ if (encryption_state < SMB_ENCRYPTION_DESIRED) { ++ smb2_connect_tcon_start(req); ++ return; ++ } ++ ++ status = smb2cli_session_encryption_on(state->session->smbXcli); ++ if (!NT_STATUS_IS_OK(status)) { ++ if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) { ++ if (encryption_state < SMB_ENCRYPTION_REQUIRED) { ++ smb2_connect_tcon_start(req); ++ return; ++ } ++ ++ DBG_ERR("Encryption required and server doesn't support " ++ "SMB3 encryption - failing connect\n"); ++ tevent_req_nterror(req, status); ++ return; ++ } ++ ++ DBG_ERR("Encryption required and setup failed with error %s.\n", ++ nt_errstr(status)); ++ tevent_req_nterror(req, NT_STATUS_PROTOCOL_NOT_SUPPORTED); ++ return; ++ } ++ + smb2_connect_tcon_start(req); + } + +-- +2.28.0 + + +From 8bc1b5f884d1e6a88e1ac403d9bc64c3b77e9428 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Fri, 24 Jul 2020 10:18:52 +0200 +Subject: [PATCH 048/105] s4:libcli: Require signing for SMB encryption + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +--- + source4/libcli/smb2/connect.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/source4/libcli/smb2/connect.c b/source4/libcli/smb2/connect.c +index 3a3ecdf20e8..9540704491e 100644 +--- a/source4/libcli/smb2/connect.c ++++ b/source4/libcli/smb2/connect.c +@@ -31,6 +31,7 @@ + #include "param/param.h" + #include "auth/credentials/credentials.h" + #include "../libcli/smb/smbXcli_base.h" ++#include "smb2_constants.h" + + struct smb2_connect_state { + struct tevent_context *ev; +@@ -76,6 +77,8 @@ struct tevent_req *smb2_connect_send(TALLOC_CTX *mem_ctx, + struct smb2_connect_state *state; + struct composite_context *creq; + static const char *default_ports[] = { "445", "139", NULL }; ++ enum smb_encryption_setting encryption_state = ++ cli_credentials_get_smb_encryption(credentials); + + req = tevent_req_create(mem_ctx, &state, + struct smb2_connect_state); +@@ -99,6 +102,10 @@ struct tevent_req *smb2_connect_send(TALLOC_CTX *mem_ctx, + state->ports = default_ports; + } + ++ if (encryption_state >= SMB_ENCRYPTION_DESIRED) { ++ state->options.signing = SMB_SIGNING_REQUIRED; ++ } ++ + make_nbt_name_client(&state->calling, + cli_credentials_get_workstation(credentials)); + +@@ -116,7 +123,7 @@ struct tevent_req *smb2_connect_send(TALLOC_CTX *mem_ctx, + + status = smb2_transport_raw_init(state, ev, + existing_conn, +- options, ++ &state->options, + &state->transport); + if (tevent_req_nterror(req, status)) { + return tevent_req_post(req, ev); +-- +2.28.0 + + +From 5cc8a0bc7381444804cde992afdc7aa0c0b70074 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 7 Jul 2020 14:27:07 +0200 +Subject: [PATCH 049/105] python:tests: Add test for SMB encrypted DCERPC + connection + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher + +Autobuild-User(master): Andreas Schneider +Autobuild-Date(master): Wed Aug 19 17:46:28 UTC 2020 on sn-devel-184 +--- + python/samba/tests/dcerpc/binding.py | 82 ++++++++++++++++++++++++++++ + selftest/tests.py | 1 + + 2 files changed, 83 insertions(+) + create mode 100644 python/samba/tests/dcerpc/binding.py + +diff --git a/python/samba/tests/dcerpc/binding.py b/python/samba/tests/dcerpc/binding.py +new file mode 100644 +index 00000000000..8e0d6a5ef0a +--- /dev/null ++++ b/python/samba/tests/dcerpc/binding.py +@@ -0,0 +1,82 @@ ++# ++# Unix SMB/CIFS implementation. ++# Copyright (c) 2020 Andreas Schneider ++# ++# This program is free software; you can redistribute it and/or modify ++# it under the terms of the GNU General Public License as published by ++# the Free Software Foundation; either version 3 of the License, or ++# (at your option) any later version. ++# ++# This program is distributed in the hope that it will be useful, ++# but WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++# GNU General Public License for more details. ++# ++# You should have received a copy of the GNU General Public License ++# along with this program. If not, see . ++# ++ ++"""Tests for samba.dcerpc., credentials and binding strings""" ++ ++import samba.tests ++from samba.tests import RpcInterfaceTestCase, TestCase ++from samba.dcerpc import lsa ++import samba.dcerpc.security as security ++from samba.credentials import Credentials, SMB_ENCRYPTION_REQUIRED ++from samba import NTSTATUSError ++ ++class RpcBindingTests(RpcInterfaceTestCase): ++ def setUp(self): ++ super(RpcBindingTests, self).setUp() ++ ++ def get_user_creds(self): ++ c = Credentials() ++ c.guess() ++ domain = samba.tests.env_get_var_value('DOMAIN') ++ username = samba.tests.env_get_var_value('USERNAME') ++ password = samba.tests.env_get_var_value('PASSWORD') ++ c.set_domain(domain) ++ c.set_username(username) ++ c.set_password(password) ++ return c ++ ++ def test_smb3_dcerpc_encryption(self): ++ creds = self.get_user_creds() ++ creds.set_smb_encryption(SMB_ENCRYPTION_REQUIRED) ++ ++ lp = self.get_loadparm() ++ lp.set('client ipc max protocol', 'SMB3') ++ lp.set('client ipc min protocol', 'SMB3') ++ ++ binding_string = ("ncacn_np:%s" % (samba.tests.env_get_var_value('SERVER'))) ++ lsa_conn = lsa.lsarpc(binding_string, lp, creds) ++ ++ objectAttr = lsa.ObjectAttribute() ++ objectAttr.sec_qos = lsa.QosInfo() ++ ++ pol_handle = lsa_conn.OpenPolicy2('', ++ objectAttr, ++ security.SEC_FLAG_MAXIMUM_ALLOWED) ++ self.assertIsNotNone(pol_handle) ++ ++ def test_smb2_dcerpc_encryption(self): ++ creds = self.get_user_creds() ++ creds.set_smb_encryption(SMB_ENCRYPTION_REQUIRED) ++ ++ lp = self.get_loadparm() ++ lp.set('client ipc max protocol', 'SMB2') ++ lp.set('client ipc min protocol', 'SMB2') ++ ++ binding_string = ("ncacn_np:%s" % (samba.tests.env_get_var_value('SERVER'))) ++ self.assertRaises(NTSTATUSError, lsa.lsarpc, binding_string, lp, creds) ++ ++ def test_smb1_dcerpc_encryption(self): ++ creds = self.get_user_creds() ++ creds.set_smb_encryption(SMB_ENCRYPTION_REQUIRED) ++ ++ lp = self.get_loadparm() ++ lp.set('client ipc max protocol', 'NT1') ++ lp.set('client ipc min protocol', 'NT1') ++ ++ binding_string = ("ncacn_np:%s" % (samba.tests.env_get_var_value('SERVER'))) ++ self.assertRaises(NTSTATUSError, lsa.lsarpc, binding_string, lp, creds) +diff --git a/selftest/tests.py b/selftest/tests.py +index 20981754db4..adcb5b53189 100644 +--- a/selftest/tests.py ++++ b/selftest/tests.py +@@ -92,6 +92,7 @@ planpythontestsuite( + extra_path=[os.path.join(samba4srcdir, "..", "buildtools"), + os.path.join(samba4srcdir, "..", "third_party", "waf")]) + planpythontestsuite("fileserver", "samba.tests.smbd_fuzztest") ++planpythontestsuite("nt4_dc_smb1", "samba.tests.dcerpc.binding") + + + def cmdline(script, *args): +-- +2.28.0 + + +From 546ecfae4f11e0625de86e47e90a98a7aafa0453 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Fri, 4 Sep 2020 10:47:54 +0200 +Subject: [PATCH 050/105] auth:gensec: Add gensec_security_sasl_names() + +Pair-Programmed-With: Andreas Schneider + +Signed-off-by: Andreas Schneider +Signed-off-by: Stefan Metzmacher +(cherry picked from commit b34e8dc8982b625d946e2ac8794ee41311bc41c2) +--- + auth/gensec/gensec.h | 2 + + auth/gensec/gensec_start.c | 87 ++++++++++++++++++++++++++++++++++++++ + 2 files changed, 89 insertions(+) + +diff --git a/auth/gensec/gensec.h b/auth/gensec/gensec.h +index d424067d02c..fe26fff171a 100644 +--- a/auth/gensec/gensec.h ++++ b/auth/gensec/gensec.h +@@ -308,6 +308,8 @@ const struct gensec_security_ops **gensec_use_kerberos_mechs(TALLOC_CTX *mem_ctx + + NTSTATUS gensec_start_mech_by_sasl_name(struct gensec_security *gensec_security, + const char *sasl_name); ++const char **gensec_security_sasl_names(struct gensec_security *gensec_security, ++ TALLOC_CTX *mem_ctx); + + int gensec_setting_int(struct gensec_settings *settings, const char *mechanism, const char *name, int default_value); + bool gensec_setting_bool(struct gensec_settings *settings, const char *mechanism, const char *name, bool default_value); +diff --git a/auth/gensec/gensec_start.c b/auth/gensec/gensec_start.c +index d2d62d6652e..4eb45643714 100644 +--- a/auth/gensec/gensec_start.c ++++ b/auth/gensec/gensec_start.c +@@ -299,6 +299,93 @@ const struct gensec_security_ops *gensec_security_by_name(struct gensec_security + return NULL; + } + ++static const char **gensec_security_sasl_names_from_ops( ++ struct gensec_security *gensec_security, ++ TALLOC_CTX *mem_ctx, ++ const struct gensec_security_ops * const *ops) ++{ ++ const char **sasl_names = NULL; ++ size_t i, sasl_names_count = 0; ++ ++ if (ops == NULL) { ++ return NULL; ++ } ++ ++ sasl_names = talloc_array(mem_ctx, const char *, 1); ++ if (sasl_names == NULL) { ++ return NULL; ++ } ++ ++ for (i = 0; ops[i] != NULL; i++) { ++ enum gensec_role role = GENSEC_SERVER; ++ const char **tmp = NULL; ++ ++ if (ops[i]->sasl_name == NULL) { ++ continue; ++ } ++ ++ if (gensec_security != NULL) { ++ if (!gensec_security_ops_enabled(ops[i], ++ gensec_security)) { ++ continue; ++ } ++ ++ role = gensec_security->gensec_role; ++ } ++ ++ switch (role) { ++ case GENSEC_CLIENT: ++ if (ops[i]->client_start == NULL) { ++ continue; ++ } ++ break; ++ case GENSEC_SERVER: ++ if (ops[i]->server_start == NULL) { ++ continue; ++ } ++ break; ++ } ++ ++ tmp = talloc_realloc(mem_ctx, ++ sasl_names, ++ const char *, ++ sasl_names_count + 2); ++ if (tmp == NULL) { ++ TALLOC_FREE(sasl_names); ++ return NULL; ++ } ++ sasl_names = tmp; ++ ++ sasl_names[sasl_names_count] = ops[i]->sasl_name; ++ sasl_names_count++; ++ } ++ sasl_names[sasl_names_count] = NULL; ++ ++ return sasl_names; ++} ++ ++/** ++ * @brief Get the sasl names from the gensec security context. ++ * ++ * @param[in] gensec_security The gensec security context. ++ * ++ * @param[in] mem_ctx The memory context to allocate memory on. ++ * ++ * @return An allocated array with sasl names, NULL on error. ++ */ ++_PUBLIC_ ++const char **gensec_security_sasl_names(struct gensec_security *gensec_security, ++ TALLOC_CTX *mem_ctx) ++{ ++ const struct gensec_security_ops **ops = NULL; ++ ++ ops = gensec_security_mechs(gensec_security, mem_ctx); ++ ++ return gensec_security_sasl_names_from_ops(gensec_security, ++ mem_ctx, ++ ops); ++} ++ + /** + * Return a unique list of security subsystems from those specified in + * the list of SASL names. +-- +2.28.0 + + +From ec079d88720a99a5bc5e6b5efd03f87342364f15 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Fri, 4 Sep 2020 10:48:27 +0200 +Subject: [PATCH 051/105] s4:ldap_server: Use samba_server_gensec_start() in + ldapsrv_backend_Init() + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Andreas Schneider +(cherry picked from commit 5e3363e0b82193700f91a9bae5080aae0b744e5c) +--- + source4/dsdb/samdb/ldb_modules/rootdse.c | 4 +- + source4/ldap_server/ldap_backend.c | 49 +++++++++++------------- + 2 files changed, 25 insertions(+), 28 deletions(-) + +diff --git a/source4/dsdb/samdb/ldb_modules/rootdse.c b/source4/dsdb/samdb/ldb_modules/rootdse.c +index 55340fa4f1e..4be9550747c 100644 +--- a/source4/dsdb/samdb/ldb_modules/rootdse.c ++++ b/source4/dsdb/samdb/ldb_modules/rootdse.c +@@ -230,7 +230,7 @@ static int rootdse_add_dynamic(struct rootdse_context *ac, struct ldb_message *m + struct ldb_context *ldb; + struct rootdse_private_data *priv = talloc_get_type(ldb_module_get_private(ac->module), struct rootdse_private_data); + const char * const *attrs = ac->req->op.search.attrs; +- char **server_sasl; ++ const char **server_sasl = NULL; + const struct dsdb_schema *schema; + int *val; + struct ldb_control *edn_control; +@@ -341,7 +341,7 @@ static int rootdse_add_dynamic(struct rootdse_context *ac, struct ldb_message *m + } + + server_sasl = talloc_get_type(ldb_get_opaque(ldb, "supportedSASLMechanisms"), +- char *); ++ const char *); + if (server_sasl && do_attribute(attrs, "supportedSASLMechanisms")) { + for (i = 0; server_sasl && server_sasl[i]; i++) { + char *sasl_name = talloc_strdup(msg, server_sasl[i]); +diff --git a/source4/ldap_server/ldap_backend.c b/source4/ldap_server/ldap_backend.c +index 2839082daef..915d9b94f9b 100644 +--- a/source4/ldap_server/ldap_backend.c ++++ b/source4/ldap_server/ldap_backend.c +@@ -33,6 +33,7 @@ + #include "ldb_wrap.h" + #include "lib/tsocket/tsocket.h" + #include "libcli/ldap/ldap_proto.h" ++#include "source4/auth/auth.h" + + static int map_ldb_error(TALLOC_CTX *mem_ctx, int ldb_err, + const char *add_err_string, const char **errstring) +@@ -199,37 +200,33 @@ int ldapsrv_backend_Init(struct ldapsrv_connection *conn, + } + + if (conn->server_credentials) { +- char **sasl_mechs = NULL; +- const struct gensec_security_ops * const *backends = gensec_security_all(); +- const struct gensec_security_ops **ops +- = gensec_use_kerberos_mechs(conn, backends, conn->server_credentials); +- unsigned int i, j = 0; +- for (i = 0; ops && ops[i]; i++) { +- if (!lpcfg_parm_bool(conn->lp_ctx, NULL, "gensec", ops[i]->name, ops[i]->enabled)) +- continue; +- +- if (ops[i]->sasl_name && ops[i]->server_start) { +- char *sasl_name = talloc_strdup(conn, ops[i]->sasl_name); +- +- if (!sasl_name) { +- return LDB_ERR_OPERATIONS_ERROR; +- } +- sasl_mechs = talloc_realloc(conn, sasl_mechs, char *, j + 2); +- if (!sasl_mechs) { +- return LDB_ERR_OPERATIONS_ERROR; +- } +- sasl_mechs[j] = sasl_name; +- talloc_steal(sasl_mechs, sasl_name); +- sasl_mechs[j+1] = NULL; +- j++; +- } ++ struct gensec_security *gensec_security = NULL; ++ const char **sasl_mechs = NULL; ++ NTSTATUS status; ++ ++ status = samba_server_gensec_start(conn, ++ conn->connection->event.ctx, ++ conn->connection->msg_ctx, ++ conn->lp_ctx, ++ conn->server_credentials, ++ "ldap", ++ &gensec_security); ++ if (!NT_STATUS_IS_OK(status)) { ++ DBG_ERR("samba_server_gensec_start failed: %s\n", ++ nt_errstr(status)); ++ return LDB_ERR_OPERATIONS_ERROR; + } +- talloc_unlink(conn, ops); + + /* ldb can have a different lifetime to conn, so we + need to ensure that sasl_mechs lives as long as the + ldb does */ +- talloc_steal(conn->ldb, sasl_mechs); ++ sasl_mechs = gensec_security_sasl_names(gensec_security, ++ conn->ldb); ++ TALLOC_FREE(gensec_security); ++ if (sasl_mechs == NULL) { ++ DBG_ERR("Failed to get sasl mechs!\n"); ++ return LDB_ERR_OPERATIONS_ERROR; ++ } + + ldb_set_opaque(conn->ldb, "supportedSASLMechanisms", sasl_mechs); + } +-- +2.28.0 + + +From bc128ea1ea455a3a63e0ce3dc8777a7482c356f8 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Fri, 4 Sep 2020 14:39:15 +0200 +Subject: [PATCH 052/105] auth:gensec: Make gensec_use_kerberos_mechs() a + static function + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Andreas Schneider +(cherry picked from commit 2186d4131ad4c7961d0c830bf9d48f3d06d27924) +--- + auth/gensec/gensec.h | 3 --- + auth/gensec/gensec_start.c | 7 ++++--- + 2 files changed, 4 insertions(+), 6 deletions(-) + +diff --git a/auth/gensec/gensec.h b/auth/gensec/gensec.h +index fe26fff171a..8bece3c3458 100644 +--- a/auth/gensec/gensec.h ++++ b/auth/gensec/gensec.h +@@ -302,9 +302,6 @@ NTSTATUS gensec_wrap(struct gensec_security *gensec_security, + + const struct gensec_security_ops * const *gensec_security_all(void); + bool gensec_security_ops_enabled(const struct gensec_security_ops *ops, struct gensec_security *security); +-const struct gensec_security_ops **gensec_use_kerberos_mechs(TALLOC_CTX *mem_ctx, +- const struct gensec_security_ops * const *old_gensec_list, +- struct cli_credentials *creds); + + NTSTATUS gensec_start_mech_by_sasl_name(struct gensec_security *gensec_security, + const char *sasl_name); +diff --git a/auth/gensec/gensec_start.c b/auth/gensec/gensec_start.c +index 4eb45643714..ebcab76999a 100644 +--- a/auth/gensec/gensec_start.c ++++ b/auth/gensec/gensec_start.c +@@ -83,9 +83,10 @@ bool gensec_security_ops_enabled(const struct gensec_security_ops *ops, struct g + * more compplex. + */ + +-_PUBLIC_ const struct gensec_security_ops **gensec_use_kerberos_mechs(TALLOC_CTX *mem_ctx, +- const struct gensec_security_ops * const *old_gensec_list, +- struct cli_credentials *creds) ++static const struct gensec_security_ops **gensec_use_kerberos_mechs( ++ TALLOC_CTX *mem_ctx, ++ const struct gensec_security_ops * const *old_gensec_list, ++ struct cli_credentials *creds) + { + const struct gensec_security_ops **new_gensec_list; + int i, j, num_mechs_in; +-- +2.28.0 + + +From 37b7016fba1eae75fc4a87c9c5aebbbb47b7ff39 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Fri, 4 Sep 2020 14:41:43 +0200 +Subject: [PATCH 053/105] auth:gensec: Pass use_kerberos and keep_schannel to + gensec_use_kerberos_mechs() + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Andreas Schneider +(cherry picked from commit a33a40bbc848e5691869cf264009d23a03128f31) +--- + auth/gensec/gensec_start.c | 26 ++++++++++++++------------ + 1 file changed, 14 insertions(+), 12 deletions(-) + +diff --git a/auth/gensec/gensec_start.c b/auth/gensec/gensec_start.c +index ebcab76999a..8d1b41fec74 100644 +--- a/auth/gensec/gensec_start.c ++++ b/auth/gensec/gensec_start.c +@@ -86,19 +86,11 @@ bool gensec_security_ops_enabled(const struct gensec_security_ops *ops, struct g + static const struct gensec_security_ops **gensec_use_kerberos_mechs( + TALLOC_CTX *mem_ctx, + const struct gensec_security_ops * const *old_gensec_list, +- struct cli_credentials *creds) ++ enum credentials_use_kerberos use_kerberos, ++ bool keep_schannel) + { + const struct gensec_security_ops **new_gensec_list; + int i, j, num_mechs_in; +- enum credentials_use_kerberos use_kerberos = CRED_AUTO_USE_KERBEROS; +- bool keep_schannel = false; +- +- if (creds) { +- use_kerberos = cli_credentials_get_kerberos_state(creds); +- if (cli_credentials_get_netlogon_creds(creds) != NULL) { +- keep_schannel = true; +- } +- } + + for (num_mechs_in=0; old_gensec_list && old_gensec_list[num_mechs_in]; num_mechs_in++) { + /* noop */ +@@ -163,18 +155,28 @@ _PUBLIC_ const struct gensec_security_ops **gensec_security_mechs( + struct gensec_security *gensec_security, + TALLOC_CTX *mem_ctx) + { +- struct cli_credentials *creds = NULL; + const struct gensec_security_ops * const *backends = gensec_security_all(); ++ enum credentials_use_kerberos use_kerberos = CRED_AUTO_USE_KERBEROS; ++ bool keep_schannel = false; + + if (gensec_security != NULL) { ++ struct cli_credentials *creds = NULL; ++ + creds = gensec_get_credentials(gensec_security); ++ if (creds != NULL) { ++ use_kerberos = cli_credentials_get_kerberos_state(creds); ++ if (cli_credentials_get_netlogon_creds(creds) != NULL) { ++ keep_schannel = true; ++ } ++ } + + if (gensec_security->settings->backends) { + backends = gensec_security->settings->backends; + } + } + +- return gensec_use_kerberos_mechs(mem_ctx, backends, creds); ++ return gensec_use_kerberos_mechs(mem_ctx, backends, ++ use_kerberos, keep_schannel); + + } + +-- +2.28.0 + + +From 0579dbd6faa5a828cff42cd797f78c51316324b0 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Fri, 4 Sep 2020 17:00:45 +0200 +Subject: [PATCH 054/105] auth:gensec: If Kerberos is required, keep schannel + for machine account auth + +Signed-off-by: Stefan Metzmacher +Signed-off-by: Andreas Schneider +(cherry picked from commit 515cffb1f20eacb041ff7b3d43f8a122a82ddfbd) +--- + auth/gensec/gensec_start.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/auth/gensec/gensec_start.c b/auth/gensec/gensec_start.c +index 8d1b41fec74..3f42d611140 100644 +--- a/auth/gensec/gensec_start.c ++++ b/auth/gensec/gensec_start.c +@@ -168,6 +168,15 @@ _PUBLIC_ const struct gensec_security_ops **gensec_security_mechs( + if (cli_credentials_get_netlogon_creds(creds) != NULL) { + keep_schannel = true; + } ++ ++ /* ++ * Even if Kerberos is set to REQUIRED, keep the ++ * schannel auth mechanism that machine accounts are ++ * able to authenticate via netlogon. ++ */ ++ if (gensec_security->gensec_role == GENSEC_SERVER) { ++ keep_schannel = true; ++ } + } + + if (gensec_security->settings->backends) { +-- +2.28.0 + + +From 0f3676f4f84184b5bf83101e0b1eca0bb05a5079 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Fri, 4 Sep 2020 12:21:21 +0200 +Subject: [PATCH 055/105] auth:creds: Add cli_credentials_init_server() + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +(cherry picked from commit 2c00bea2aefdcc69608dffdafa7ce581d31f9354) +--- + auth/credentials/credentials.c | 25 +++++++++++++++++++++++++ + auth/credentials/credentials.h | 2 ++ + 2 files changed, 27 insertions(+) + +diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c +index 9168b92d3ec..77c35dd104b 100644 +--- a/auth/credentials/credentials.c ++++ b/auth/credentials/credentials.c +@@ -56,6 +56,31 @@ _PUBLIC_ struct cli_credentials *cli_credentials_init(TALLOC_CTX *mem_ctx) + return cred; + } + ++_PUBLIC_ ++struct cli_credentials *cli_credentials_init_server(TALLOC_CTX *mem_ctx, ++ struct loadparm_context *lp_ctx) ++{ ++ struct cli_credentials *server_creds = NULL; ++ NTSTATUS status; ++ ++ server_creds = cli_credentials_init(mem_ctx); ++ if (server_creds == NULL) { ++ return NULL; ++ } ++ ++ cli_credentials_set_conf(server_creds, lp_ctx); ++ ++ status = cli_credentials_set_machine_account(server_creds, lp_ctx); ++ if (!NT_STATUS_IS_OK(status)) { ++ DEBUG(1, ("Failed to obtain server credentials: %s\n", ++ nt_errstr(status))); ++ TALLOC_FREE(server_creds); ++ return NULL; ++ } ++ ++ return server_creds; ++} ++ + _PUBLIC_ void cli_credentials_set_callback_data(struct cli_credentials *cred, + void *callback_data) + { +diff --git a/auth/credentials/credentials.h b/auth/credentials/credentials.h +index 7d0cf53194b..438bcdce232 100644 +--- a/auth/credentials/credentials.h ++++ b/auth/credentials/credentials.h +@@ -76,6 +76,8 @@ bool cli_credentials_set_workstation(struct cli_credentials *cred, + enum credentials_obtained obtained); + bool cli_credentials_is_anonymous(struct cli_credentials *cred); + struct cli_credentials *cli_credentials_init(TALLOC_CTX *mem_ctx); ++struct cli_credentials *cli_credentials_init_server(TALLOC_CTX *mem_ctx, ++ struct loadparm_context *lp_ctx); + void cli_credentials_set_anonymous(struct cli_credentials *cred); + bool cli_credentials_wrong_password(struct cli_credentials *cred); + const char *cli_credentials_get_password(struct cli_credentials *cred); +-- +2.28.0 + + +From e1d566c2962ebd5596638df6f81fd120aaf32fcd Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Fri, 4 Sep 2020 12:21:36 +0200 +Subject: [PATCH 056/105] s4:rpc_server: Use cli_credentials_init_server() + +Signed-off-by: Andreas Schneider +(cherry picked from commit 6c94ebf77fdb7383be2042f5e20ba2ef598cd4a4) +--- + source4/rpc_server/dcerpc_server.c | 17 +++-------------- + 1 file changed, 3 insertions(+), 14 deletions(-) + +diff --git a/source4/rpc_server/dcerpc_server.c b/source4/rpc_server/dcerpc_server.c +index 084857a44bf..e64148ef788 100644 +--- a/source4/rpc_server/dcerpc_server.c ++++ b/source4/rpc_server/dcerpc_server.c +@@ -673,25 +673,14 @@ NTSTATUS dcesrv_gensec_prepare(TALLOC_CTX *mem_ctx, + struct cli_credentials *server_creds = NULL; + struct imessaging_context *imsg_ctx = + dcesrv_imessaging_context(call->conn); +- NTSTATUS status; + +- server_creds = cli_credentials_init(call->auth_state); +- if (!server_creds) { ++ server_creds = cli_credentials_init_server(call->auth_state, ++ call->conn->dce_ctx->lp_ctx); ++ if (server_creds == NULL) { + DEBUG(1, ("Failed to init server credentials\n")); + return NT_STATUS_NO_MEMORY; + } + +- cli_credentials_set_conf(server_creds, call->conn->dce_ctx->lp_ctx); +- +- status = cli_credentials_set_machine_account(server_creds, +- call->conn->dce_ctx->lp_ctx); +- if (!NT_STATUS_IS_OK(status)) { +- DEBUG(1, ("Failed to obtain server credentials: %s\n", +- nt_errstr(status))); +- talloc_free(server_creds); +- return status; +- } +- + return samba_server_gensec_start(mem_ctx, + call->event_ctx, + imsg_ctx, +-- +2.28.0 + + +From 694e1d1ca62372baba69818acf25a2eec8847115 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Mon, 7 Sep 2020 09:19:43 +0200 +Subject: [PATCH 057/105] s4:smb_server: Use cli_credentials_init_server() for + negprot + +Signed-off-by: Andreas Schneider + +Autobuild-User(master): Stefan Metzmacher +Autobuild-Date(master): Mon Sep 7 13:22:26 UTC 2020 on sn-devel-184 + +(cherry picked from commit 0b742ec6a0558397d5cf01b99a401f8e2bc0e2e0) +--- + source4/smb_server/smb/negprot.c | 28 ++++++++++++++-------------- + source4/smb_server/smb2/negprot.c | 25 +++++++++++++------------ + 2 files changed, 27 insertions(+), 26 deletions(-) + +diff --git a/source4/smb_server/smb/negprot.c b/source4/smb_server/smb/negprot.c +index a6177a72019..04b69dd9883 100644 +--- a/source4/smb_server/smb/negprot.c ++++ b/source4/smb_server/smb/negprot.c +@@ -374,22 +374,22 @@ static void reply_nt1(struct smbsrv_request *req, uint16_t choice) + DATA_BLOB blob = data_blob_null; + const char *oid; + NTSTATUS nt_status; +- +- server_credentials +- = cli_credentials_init(req); +- if (!server_credentials) { +- smbsrv_terminate_connection(req->smb_conn, "Failed to init server credentials\n"); +- return; +- } +- +- cli_credentials_set_conf(server_credentials, req->smb_conn->lp_ctx); +- nt_status = cli_credentials_set_machine_account(server_credentials, req->smb_conn->lp_ctx); +- if (!NT_STATUS_IS_OK(nt_status)) { +- DEBUG(10, ("Failed to obtain server credentials, perhaps a standalone server?: %s\n", nt_errstr(nt_status))); ++ ++ server_credentials = ++ cli_credentials_init_server(req, req->smb_conn->lp_ctx); ++ if (server_credentials == NULL) { ++ DBG_DEBUG("Failed to obtain server credentials, " ++ "perhaps a standalone server?\n"); + /* +- * We keep the server_credentials as anonymous +- * this is required for the spoolss.notify test ++ * Create anon server credentials for for the ++ * spoolss.notify test. + */ ++ server_credentials = cli_credentials_init_anon(req); ++ if (server_credentials == NULL) { ++ smbsrv_terminate_connection(req->smb_conn, ++ "Failed to init server credentials\n"); ++ return; ++ } + } + + nt_status = samba_server_gensec_start(req, +diff --git a/source4/smb_server/smb2/negprot.c b/source4/smb_server/smb2/negprot.c +index 4aaaf46793b..c433eb194bd 100644 +--- a/source4/smb_server/smb2/negprot.c ++++ b/source4/smb_server/smb2/negprot.c +@@ -39,20 +39,21 @@ static NTSTATUS smb2srv_negprot_secblob(struct smb2srv_request *req, DATA_BLOB * + NTSTATUS nt_status; + struct cli_credentials *server_credentials; + +- server_credentials = cli_credentials_init(req); +- if (!server_credentials) { +- smbsrv_terminate_connection(req->smb_conn, "Failed to init server credentials\n"); +- return NT_STATUS_NO_MEMORY; +- } +- +- cli_credentials_set_conf(server_credentials, req->smb_conn->lp_ctx); +- nt_status = cli_credentials_set_machine_account(server_credentials, req->smb_conn->lp_ctx); +- if (!NT_STATUS_IS_OK(nt_status)) { +- DEBUG(10, ("Failed to obtain server credentials, perhaps a standalone server?: %s\n", nt_errstr(nt_status))); ++ server_credentials = ++ cli_credentials_init_server(req, req->smb_conn->lp_ctx); ++ if (server_credentials == NULL) { ++ DBG_DEBUG("Failed to obtain server credentials, " ++ "perhaps a standalone server?\n"); + /* +- * We keep the server_credentials as anonymous +- * this is required for the spoolss.notify test ++ * Create anon server credentials for for the ++ * spoolss.notify test. + */ ++ server_credentials = cli_credentials_init_anon(req); ++ if (server_credentials == NULL) { ++ smbsrv_terminate_connection(req->smb_conn, ++ "Failed to init server credentials\n"); ++ return NT_STATUS_NO_MEMORY; ++ } + } + + req->smb_conn->negotiate.server_credentials = talloc_steal(req->smb_conn, server_credentials); +-- +2.28.0 + + +From c3b277172554d1d3155c3a1b4ad76685985273df Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 8 Sep 2020 10:15:22 +0200 +Subject: [PATCH 058/105] selftest: Rename 'smb encrypt' to 'server smb + encrypt' + +This makes it more clear what we want. 'smb encrypt' is a synonym for +'server smb encrypt'. + +Signed-off-by: Andreas Schneider +Reviewed-by: Jeremy Allison +(cherry picked from commit c75e8ff47b4d79b37240f9461ddae10a4f03c892) +--- + selftest/target/Samba3.pm | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm +index 0a8cefa811d..a31165b372d 100755 +--- a/selftest/target/Samba3.pm ++++ b/selftest/target/Samba3.pm +@@ -1178,7 +1178,7 @@ sub setup_simpleserver + ntlm auth = yes + vfs objects = xattr_tdb streams_depot + change notify = no +- smb encrypt = off ++ server smb encrypt = off + + [vfs_aio_pthread] + path = $prefix_abs/share +@@ -1245,7 +1245,7 @@ sub setup_simpleserver + [enc_desired] + path = $prefix_abs/share + vfs objects = +- smb encrypt = desired ++ server smb encrypt = desired + + [hidenewfiles] + path = $prefix_abs/share +@@ -2340,7 +2340,7 @@ sub provision($$) + [tmpenc] + path = $shrdir + comment = encrypt smb username is [%U] +- smb encrypt = required ++ server smb encrypt = required + vfs objects = dirsort + [tmpguest] + path = $shrdir +-- +2.28.0 + + +From 355afa22953cf8838dc83210315bc2557e764082 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 8 Sep 2020 12:30:08 +0200 +Subject: [PATCH 059/105] selftest: Move enc_desired to provision to have it in + 'fileserver' too + +Signed-off-by: Andreas Schneider +Reviewed-by: Jeremy Allison +(cherry picked from commit 1b67943f938ae774360dc3db73db940f9982243b) +--- + selftest/target/Samba3.pm | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm +index a31165b372d..eda2c428793 100755 +--- a/selftest/target/Samba3.pm ++++ b/selftest/target/Samba3.pm +@@ -1242,11 +1242,6 @@ sub setup_simpleserver + hide files = /hidefile/ + hide dot files = yes + +-[enc_desired] +- path = $prefix_abs/share +- vfs objects = +- server smb encrypt = desired +- + [hidenewfiles] + path = $prefix_abs/share + hide new files timeout = 5 +@@ -2822,7 +2817,13 @@ sub provision($$) + [delete_readonly] + path = $prefix_abs/share + delete readonly = yes ++ ++[enc_desired] ++ path = $prefix_abs/share ++ vfs objects = ++ server smb encrypt = desired + "; ++ + close(CONF); + + my $net = Samba::bindir_path($self, "net"); +-- +2.28.0 + + +From 2a8b98850f61219a1c97da9151e55d0e21a4265b Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 8 Sep 2020 10:15:20 +0200 +Subject: [PATCH 060/105] s3:tests: Add smbclient tests for 'client smb + encrypt' + +Signed-off-by: Andreas Schneider +Reviewed-by: Jeremy Allison +(cherry picked from commit e7577ab6cbc83b496ac091c3e425c7c7fea29cdb) +--- + selftest/knownfail.d/smbclient-encryption | 2 + + selftest/target/Samba3.pm | 5 ++ + .../script/tests/test_smbclient_encryption.sh | 72 +++++++++++++++++++ + source3/selftest/tests.py | 6 ++ + 4 files changed, 85 insertions(+) + create mode 100644 selftest/knownfail.d/smbclient-encryption + create mode 100755 source3/script/tests/test_smbclient_encryption.sh + +diff --git a/selftest/knownfail.d/smbclient-encryption b/selftest/knownfail.d/smbclient-encryption +new file mode 100644 +index 00000000000..972096bdc8b +--- /dev/null ++++ b/selftest/knownfail.d/smbclient-encryption +@@ -0,0 +1,2 @@ ++^samba3.blackbox.smbclient.encryption.smbclient.smb3.client.encrypt.required...LOCALSHARE4.enc_desired..simpleserver ++^samba3.blackbox.smbclient.encryption.smbclient.smb3.client.encrypt.required...LOCALSHARE4.tmp..simpleserver +diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm +index eda2c428793..9f86f2b59cf 100755 +--- a/selftest/target/Samba3.pm ++++ b/selftest/target/Samba3.pm +@@ -2822,6 +2822,11 @@ sub provision($$) + path = $prefix_abs/share + vfs objects = + server smb encrypt = desired ++ ++[enc_off] ++ path = $prefix_abs/share ++ vfs objects = ++ server smb encrypt = off + "; + + close(CONF); +diff --git a/source3/script/tests/test_smbclient_encryption.sh b/source3/script/tests/test_smbclient_encryption.sh +new file mode 100755 +index 00000000000..9a717cdac4f +--- /dev/null ++++ b/source3/script/tests/test_smbclient_encryption.sh +@@ -0,0 +1,72 @@ ++#!/bin/sh ++ ++if [ $# -lt 5 ]; then ++cat < +Date: Thu, 27 Aug 2020 15:19:27 +0200 +Subject: [PATCH 061/105] s3:client: Remove global smb_encrypt + +Signed-off-by: Andreas Schneider +Reviewed-by: Jeremy Allison +(cherry picked from commit 1189b20cb7ea09cfed5c246cf977442a51ef72cb) +--- + source3/client/client.c | 25 ++++++++++++++++--------- + 1 file changed, 16 insertions(+), 9 deletions(-) + +diff --git a/source3/client/client.c b/source3/client/client.c +index 30287ffd253..e1128bf4a8c 100644 +--- a/source3/client/client.c ++++ b/source3/client/client.c +@@ -98,9 +98,6 @@ static unsigned int put_total_time_ms = 0; + /* totals globals */ + static double dir_total; + +-/* encrypted state. */ +-static bool smb_encrypt; +- + /* root cli_state connection */ + + struct cli_state *cli; +@@ -2822,7 +2819,7 @@ static int cmd_posix_encrypt(void) + d_printf("posix_encrypt failed with error %s\n", nt_errstr(status)); + } else { + d_printf("encryption on\n"); +- smb_encrypt = true; ++ set_cmdline_auth_info_smb_encrypt(popt_get_cmdline_auth_info()); + } + + return 0; +@@ -5347,6 +5344,9 @@ int cmd_iosize(void) + TALLOC_CTX *ctx = talloc_tos(); + char *buf; + int iosize; ++ bool smb_encrypt = ++ get_cmdline_auth_info_smb_encrypt( ++ popt_get_cmdline_auth_info()); + + if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { + if (smbXcli_conn_protocol(cli->conn) < PROTOCOL_SMB2_02) { +@@ -5610,6 +5610,9 @@ static int process_command_string(const char *cmd_in) + TALLOC_CTX *ctx = talloc_tos(); + char *cmd = talloc_strdup(ctx, cmd_in); + int rc = 0; ++ bool smb_encrypt = ++ get_cmdline_auth_info_smb_encrypt( ++ popt_get_cmdline_auth_info()); + + if (!cmd) { + return 1; +@@ -6063,6 +6066,9 @@ static int process(const char *base_directory) + { + int rc = 0; + NTSTATUS status; ++ bool smb_encrypt = ++ get_cmdline_auth_info_smb_encrypt( ++ popt_get_cmdline_auth_info()); + + status = cli_cm_open(talloc_tos(), NULL, + desthost, +@@ -6101,6 +6107,9 @@ static int process(const char *base_directory) + static int do_host_query(const char *query_host) + { + NTSTATUS status; ++ bool smb_encrypt = ++ get_cmdline_auth_info_smb_encrypt( ++ popt_get_cmdline_auth_info()); + + status = cli_cm_open(talloc_tos(), NULL, + query_host, +@@ -6178,6 +6187,9 @@ static int do_tar_op(const char *base_directory) + { + struct tar *tar_ctx = tar_get_ctx(); + int ret = 0; ++ bool smb_encrypt = ++ get_cmdline_auth_info_smb_encrypt( ++ popt_get_cmdline_auth_info()); + + /* do we already have a connection? */ + if (!cli) { +@@ -6523,9 +6535,6 @@ int main(int argc,char *argv[]) + case 'q': + quiet=true; + break; +- case 'e': +- smb_encrypt=true; +- break; + case 'B': + return(do_smb_browse()); + +@@ -6595,8 +6604,6 @@ int main(int argc,char *argv[]) + + /* Ensure we have a password (or equivalent). */ + popt_common_credentials_post(); +- smb_encrypt = get_cmdline_auth_info_smb_encrypt( +- popt_get_cmdline_auth_info()); + + max_protocol = lp_client_max_protocol(); + +-- +2.28.0 + + +From 088473e47bcb30fe3b179133265da9ea6b8ec684 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 27 Aug 2020 15:24:27 +0200 +Subject: [PATCH 062/105] s3:libsmb: Remove force_encrypt from cli_cm_open() + +Signed-off-by: Andreas Schneider +Reviewed-by: Jeremy Allison +(cherry picked from commit a9fbc8dae878ddfa54153e91cc1128c307816b76) +--- + source3/client/client.c | 21 ++++----------------- + source3/lib/netapi/cm.c | 1 - + source3/libsmb/clidfs.c | 4 ++-- + source3/libsmb/proto.h | 1 - + 4 files changed, 6 insertions(+), 21 deletions(-) + +diff --git a/source3/client/client.c b/source3/client/client.c +index e1128bf4a8c..1f18024b798 100644 +--- a/source3/client/client.c ++++ b/source3/client/client.c +@@ -5610,9 +5610,6 @@ static int process_command_string(const char *cmd_in) + TALLOC_CTX *ctx = talloc_tos(); + char *cmd = talloc_strdup(ctx, cmd_in); + int rc = 0; +- bool smb_encrypt = +- get_cmdline_auth_info_smb_encrypt( +- popt_get_cmdline_auth_info()); + + if (!cmd) { + return 1; +@@ -5625,7 +5622,6 @@ static int process_command_string(const char *cmd_in) + status = cli_cm_open(talloc_tos(), NULL, + desthost, + service, popt_get_cmdline_auth_info(), +- smb_encrypt, + max_protocol, + have_ip ? &dest_ss : NULL, port, + name_type, +@@ -6066,14 +6062,11 @@ static int process(const char *base_directory) + { + int rc = 0; + NTSTATUS status; +- bool smb_encrypt = +- get_cmdline_auth_info_smb_encrypt( +- popt_get_cmdline_auth_info()); + + status = cli_cm_open(talloc_tos(), NULL, + desthost, + service, popt_get_cmdline_auth_info(), +- smb_encrypt, max_protocol, ++ max_protocol, + have_ip ? &dest_ss : NULL, port, + name_type, &cli); + if (!NT_STATUS_IS_OK(status)) { +@@ -6107,14 +6100,11 @@ static int process(const char *base_directory) + static int do_host_query(const char *query_host) + { + NTSTATUS status; +- bool smb_encrypt = +- get_cmdline_auth_info_smb_encrypt( +- popt_get_cmdline_auth_info()); + + status = cli_cm_open(talloc_tos(), NULL, + query_host, + "IPC$", popt_get_cmdline_auth_info(), +- smb_encrypt, max_protocol, ++ max_protocol, + have_ip ? &dest_ss : NULL, port, + name_type, &cli); + if (!NT_STATUS_IS_OK(status)) { +@@ -6161,7 +6151,7 @@ static int do_host_query(const char *query_host) + status = cli_cm_open(talloc_tos(), NULL, + query_host, + "IPC$", popt_get_cmdline_auth_info(), +- smb_encrypt, max_proto, ++ max_proto, + have_ip ? &dest_ss : NULL, NBT_SMB_PORT, + name_type, &cli); + if (!NT_STATUS_IS_OK(status)) { +@@ -6187,9 +6177,6 @@ static int do_tar_op(const char *base_directory) + { + struct tar *tar_ctx = tar_get_ctx(); + int ret = 0; +- bool smb_encrypt = +- get_cmdline_auth_info_smb_encrypt( +- popt_get_cmdline_auth_info()); + + /* do we already have a connection? */ + if (!cli) { +@@ -6198,7 +6185,7 @@ static int do_tar_op(const char *base_directory) + status = cli_cm_open(talloc_tos(), NULL, + desthost, + service, popt_get_cmdline_auth_info(), +- smb_encrypt, max_protocol, ++ max_protocol, + have_ip ? &dest_ss : NULL, port, + name_type, &cli); + if (!NT_STATUS_IS_OK(status)) { +diff --git a/source3/lib/netapi/cm.c b/source3/lib/netapi/cm.c +index 1b8f2a4e97a..0fd31ef3d5a 100644 +--- a/source3/lib/netapi/cm.c ++++ b/source3/lib/netapi/cm.c +@@ -110,7 +110,6 @@ static WERROR libnetapi_open_ipc_connection(struct libnetapi_ctx *ctx, + status = cli_cm_open(ctx, NULL, + server_name, "IPC$", + auth_info, +- false, + lp_client_ipc_max_protocol(), + NULL, 0, 0x20, &cli_ipc); + if (!NT_STATUS_IS_OK(status)) { +diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c +index aff998f6187..4825b8f3fae 100644 +--- a/source3/libsmb/clidfs.c ++++ b/source3/libsmb/clidfs.c +@@ -383,7 +383,6 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, + const char *server, + const char *share, + const struct user_auth_info *auth_info, +- bool force_encrypt, + int max_protocol, + const struct sockaddr_storage *dest_ss, + int port, +@@ -393,6 +392,8 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, + /* Try to reuse an existing connection in this list. */ + struct cli_state *c = cli_cm_find(referring_cli, server, share); + NTSTATUS status; ++ bool force_encrypt = ++ get_cmdline_auth_info_smb_encrypt(auth_info); + + if (c) { + *pcli = c; +@@ -962,7 +963,6 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, + smbXcli_conn_remote_name(rootcli->conn), + "IPC$", + dfs_auth_info, +- cli_state_is_encryption_on(rootcli), + smbXcli_conn_protocol(rootcli->conn), + NULL, /* dest_ss not needed, we reuse the transport */ + 0, +diff --git a/source3/libsmb/proto.h b/source3/libsmb/proto.h +index eeabcaa7463..bb3e9e6874e 100644 +--- a/source3/libsmb/proto.h ++++ b/source3/libsmb/proto.h +@@ -128,7 +128,6 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, + const char *server, + const char *share, + const struct user_auth_info *auth_info, +- bool force_encrypt, + int max_protocol, + const struct sockaddr_storage *dest_ss, + int port, +-- +2.28.0 + + +From 0291ff12056c914b3f9429a5bba48190897fe6c1 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 27 Aug 2020 15:26:39 +0200 +Subject: [PATCH 063/105] s3:libsmb: Remove force_encrypt from cli_cm_connect() + +Signed-off-by: Andreas Schneider +Reviewed-by: Jeremy Allison +(cherry picked from commit d27e237cf37fb254646d94827935d9c302c379ff) +--- + source3/libsmb/clidfs.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c +index 4825b8f3fae..b0032005398 100644 +--- a/source3/libsmb/clidfs.c ++++ b/source3/libsmb/clidfs.c +@@ -287,7 +287,6 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, + const char *server, + const char *share, + const struct user_auth_info *auth_info, +- bool force_encrypt, + int max_protocol, + const struct sockaddr_storage *dest_ss, + int port, +@@ -296,6 +295,8 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, + { + struct cli_state *cli = NULL; + NTSTATUS status; ++ bool force_encrypt = ++ get_cmdline_auth_info_smb_encrypt(auth_info); + + status = do_connect(ctx, server, share, + auth_info, +@@ -392,8 +393,6 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, + /* Try to reuse an existing connection in this list. */ + struct cli_state *c = cli_cm_find(referring_cli, server, share); + NTSTATUS status; +- bool force_encrypt = +- get_cmdline_auth_info_smb_encrypt(auth_info); + + if (c) { + *pcli = c; +@@ -414,7 +413,6 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, + server, + share, + auth_info, +- force_encrypt, + max_protocol, + dest_ss, + port, +@@ -1020,7 +1018,6 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, + dfs_refs[count].server, + dfs_refs[count].share, + dfs_auth_info, +- cli_state_is_encryption_on(rootcli), + smbXcli_conn_protocol(rootcli->conn), + NULL, /* dest_ss */ + 0, /* port */ +-- +2.28.0 + + +From 32f7fd016ecbeb3b24ad93d593ba06e8292dd02f Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 27 Aug 2020 15:28:28 +0200 +Subject: [PATCH 064/105] s3:libsmb: Remove force_encrypt from clidfs + do_connect() + +Signed-off-by: Andreas Schneider +Reviewed-by: Jeremy Allison +(cherry picked from commit 615a9a68166bdeb0ab7dbacf395c6125ec70f288) +--- + source3/libsmb/clidfs.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c +index b0032005398..5503506de97 100644 +--- a/source3/libsmb/clidfs.c ++++ b/source3/libsmb/clidfs.c +@@ -107,7 +107,6 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, + const char *server, + const char *share, + const struct user_auth_info *auth_info, +- bool force_encrypt, + int max_protocol, + const struct sockaddr_storage *dest_ss, + int port, +@@ -123,6 +122,8 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, + enum protocol_types protocol = PROTOCOL_NONE; + int signing_state = get_cmdline_auth_info_signing_state(auth_info); + struct cli_credentials *creds = NULL; ++ bool force_encrypt = ++ get_cmdline_auth_info_smb_encrypt(auth_info); + + if (force_encrypt) { + signing_state = SMB_SIGNING_REQUIRED; +@@ -233,7 +234,7 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, + cli_shutdown(c); + return do_connect(ctx, newserver, + newshare, auth_info, +- force_encrypt, max_protocol, ++ max_protocol, + NULL, port, name_type, pcli); + } + +@@ -295,12 +296,10 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, + { + struct cli_state *cli = NULL; + NTSTATUS status; +- bool force_encrypt = +- get_cmdline_auth_info_smb_encrypt(auth_info); + + status = do_connect(ctx, server, share, + auth_info, +- force_encrypt, max_protocol, ++ max_protocol, + dest_ss, port, name_type, &cli); + + if (!NT_STATUS_IS_OK(status)) { +-- +2.28.0 + + +From 4afc92a55aa63557db2b4e2a9b0bbe5bc7d12c55 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 27 Aug 2020 15:52:11 +0200 +Subject: [PATCH 065/105] s3:libsmb: Remove force_encrypt from + cli_check_msdfs_proxy() + +Signed-off-by: Andreas Schneider +Reviewed-by: Jeremy Allison +(cherry picked from commit 4ddec1ca257fff418847c5d1e83a3fb7cb5ade1a) +--- + source3/libsmb/clidfs.c | 17 ++++++++++++----- + source3/libsmb/libsmb_server.c | 4 ---- + source3/libsmb/proto.h | 1 - + 3 files changed, 12 insertions(+), 10 deletions(-) + +diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c +index 5503506de97..736c565a7a8 100644 +--- a/source3/libsmb/clidfs.c ++++ b/source3/libsmb/clidfs.c +@@ -230,7 +230,7 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, + if (smbXcli_conn_dfs_supported(c->conn) && + cli_check_msdfs_proxy(ctx, c, sharename, + &newserver, &newshare, +- force_encrypt, creds)) { ++ creds)) { + cli_shutdown(c); + return do_connect(ctx, newserver, + newshare, auth_info, +@@ -1176,7 +1176,6 @@ bool cli_check_msdfs_proxy(TALLOC_CTX *ctx, + const char *sharename, + char **pp_newserver, + char **pp_newshare, +- bool force_encrypt, + struct cli_credentials *creds) + { + struct client_dfs_referral *refs = NULL; +@@ -1188,6 +1187,8 @@ bool cli_check_msdfs_proxy(TALLOC_CTX *ctx, + char *newextrapath = NULL; + NTSTATUS status; + const char *remote_name; ++ enum smb_encryption_setting encryption_state = ++ cli_credentials_get_smb_encryption(creds); + + if (!cli || !sharename) { + return false; +@@ -1223,11 +1224,17 @@ bool cli_check_msdfs_proxy(TALLOC_CTX *ctx, + return false; + } + +- if (force_encrypt) { ++ if (encryption_state >= SMB_ENCRYPTION_DESIRED) { + status = cli_cm_force_encryption_creds(cli, creds, "IPC$"); + if (!NT_STATUS_IS_OK(status)) { +- cli_state_restore_tcon(cli, orig_tcon); +- return false; ++ switch (encryption_state) { ++ case SMB_ENCRYPTION_DESIRED: ++ break; ++ case SMB_ENCRYPTION_REQUIRED: ++ default: ++ cli_state_restore_tcon(cli, orig_tcon); ++ return false; ++ } + } + } + +diff --git a/source3/libsmb/libsmb_server.c b/source3/libsmb/libsmb_server.c +index eb58d7c6ac9..5a1055ba773 100644 +--- a/source3/libsmb/libsmb_server.c ++++ b/source3/libsmb/libsmb_server.c +@@ -587,10 +587,6 @@ SMBC_server_internal(TALLOC_CTX *ctx, + if (smbXcli_conn_dfs_supported(c->conn) && + cli_check_msdfs_proxy(ctx, c, share, + &newserver, &newshare, +- /* FIXME: cli_check_msdfs_proxy() does +- not support smbc_smb_encrypt_level type */ +- context->internal->smb_encryption_level ? +- true : false, + creds)) { + cli_shutdown(c); + srv = SMBC_server_internal(ctx, context, connect_if_not_found, +diff --git a/source3/libsmb/proto.h b/source3/libsmb/proto.h +index bb3e9e6874e..f2b0a8c5ff8 100644 +--- a/source3/libsmb/proto.h ++++ b/source3/libsmb/proto.h +@@ -161,7 +161,6 @@ bool cli_check_msdfs_proxy(TALLOC_CTX *ctx, + const char *sharename, + char **pp_newserver, + char **pp_newshare, +- bool force_encrypt, + struct cli_credentials *creds); + + /* The following definitions come from libsmb/clientgen.c */ +-- +2.28.0 + + +From 2c50d0ba7eec6d37943b7afdf426b114c9e1f292 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 18 Aug 2020 17:15:09 +0200 +Subject: [PATCH 066/105] s3:libsmb: Pass cli_credentials to clidfs + do_connect() + +Signed-off-by: Andreas Schneider +Reviewed-by: Jeremy Allison +(cherry picked from commit 276563de06f2071ec2ed9a8b73f92215ab621bba) +--- + selftest/knownfail.d/smbclient-encryption | 2 -- + source3/libsmb/clidfs.c | 34 +++++++++++++---------- + 2 files changed, 20 insertions(+), 16 deletions(-) + delete mode 100644 selftest/knownfail.d/smbclient-encryption + +diff --git a/selftest/knownfail.d/smbclient-encryption b/selftest/knownfail.d/smbclient-encryption +deleted file mode 100644 +index 972096bdc8b..00000000000 +--- a/selftest/knownfail.d/smbclient-encryption ++++ /dev/null +@@ -1,2 +0,0 @@ +-^samba3.blackbox.smbclient.encryption.smbclient.smb3.client.encrypt.required...LOCALSHARE4.enc_desired..simpleserver +-^samba3.blackbox.smbclient.encryption.smbclient.smb3.client.encrypt.required...LOCALSHARE4.tmp..simpleserver +diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c +index 736c565a7a8..d536e0597af 100644 +--- a/source3/libsmb/clidfs.c ++++ b/source3/libsmb/clidfs.c +@@ -106,7 +106,7 @@ static NTSTATUS cli_cm_force_encryption_creds(struct cli_state *c, + static NTSTATUS do_connect(TALLOC_CTX *ctx, + const char *server, + const char *share, +- const struct user_auth_info *auth_info, ++ struct cli_credentials *creds, + int max_protocol, + const struct sockaddr_storage *dest_ss, + int port, +@@ -120,12 +120,12 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, + NTSTATUS status; + int flags = 0; + enum protocol_types protocol = PROTOCOL_NONE; +- int signing_state = get_cmdline_auth_info_signing_state(auth_info); +- struct cli_credentials *creds = NULL; +- bool force_encrypt = +- get_cmdline_auth_info_smb_encrypt(auth_info); ++ enum smb_signing_setting signing_state = ++ cli_credentials_get_smb_signing(creds); ++ enum smb_encryption_setting encryption_state = ++ cli_credentials_get_smb_encryption(creds); + +- if (force_encrypt) { ++ if (encryption_state >= SMB_ENCRYPTION_DESIRED) { + signing_state = SMB_SIGNING_REQUIRED; + } + +@@ -192,13 +192,12 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, + smb2cli_conn_set_max_credits(c->conn, DEFAULT_SMB2_MAX_CREDITS); + } + +- creds = get_cmdline_auth_info_creds(auth_info); +- + status = cli_session_setup_creds(c, creds); + if (!NT_STATUS_IS_OK(status)) { + /* If a password was not supplied then + * try again with a null username. */ +- if (force_encrypt || smbXcli_conn_signing_mandatory(c->conn) || ++ if (encryption_state == SMB_ENCRYPTION_REQUIRED || ++ smbXcli_conn_signing_mandatory(c->conn) || + cli_credentials_authentication_requested(creds) || + cli_credentials_is_anonymous(creds) || + !NT_STATUS_IS_OK(status = cli_session_setup_anon(c))) +@@ -233,7 +232,7 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, + creds)) { + cli_shutdown(c); + return do_connect(ctx, newserver, +- newshare, auth_info, ++ newshare, creds, + max_protocol, + NULL, port, name_type, pcli); + } +@@ -247,13 +246,19 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, + return status; + } + +- if (force_encrypt) { ++ if (encryption_state >= SMB_ENCRYPTION_DESIRED) { + status = cli_cm_force_encryption_creds(c, + creds, + sharename); + if (!NT_STATUS_IS_OK(status)) { +- cli_shutdown(c); +- return status; ++ switch (encryption_state) { ++ case SMB_ENCRYPTION_DESIRED: ++ break; ++ case SMB_ENCRYPTION_REQUIRED: ++ default: ++ cli_shutdown(c); ++ return status; ++ } + } + } + +@@ -295,10 +300,11 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, + struct cli_state **pcli) + { + struct cli_state *cli = NULL; ++ struct cli_credentials *creds = get_cmdline_auth_info_creds(auth_info); + NTSTATUS status; + + status = do_connect(ctx, server, share, +- auth_info, ++ creds, + max_protocol, + dest_ss, port, name_type, &cli); + +-- +2.28.0 + + +From 608c0b87761f75e539b2e1e7599ceb981770b647 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 18 Aug 2020 17:18:16 +0200 +Subject: [PATCH 067/105] s3:libsmb: Pass cli_credentials to cli_cm_connect() + +Signed-off-by: Andreas Schneider +Reviewed-by: Jeremy Allison +(cherry picked from commit c8349111243fec81a2b95484e56a6d6bebaba80e) +--- + source3/libsmb/clidfs.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c +index d536e0597af..a2c6f5fe5ec 100644 +--- a/source3/libsmb/clidfs.c ++++ b/source3/libsmb/clidfs.c +@@ -292,7 +292,7 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, + struct cli_state *referring_cli, + const char *server, + const char *share, +- const struct user_auth_info *auth_info, ++ struct cli_credentials *creds, + int max_protocol, + const struct sockaddr_storage *dest_ss, + int port, +@@ -300,7 +300,6 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, + struct cli_state **pcli) + { + struct cli_state *cli = NULL; +- struct cli_credentials *creds = get_cmdline_auth_info_creds(auth_info); + NTSTATUS status; + + status = do_connect(ctx, server, share, +@@ -397,6 +396,7 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, + { + /* Try to reuse an existing connection in this list. */ + struct cli_state *c = cli_cm_find(referring_cli, server, share); ++ struct cli_credentials *creds = get_cmdline_auth_info_creds(auth_info); + NTSTATUS status; + + if (c) { +@@ -417,7 +417,7 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, + referring_cli, + server, + share, +- auth_info, ++ creds, + max_protocol, + dest_ss, + port, +@@ -886,6 +886,7 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, + struct smbXcli_tcon *root_tcon = NULL; + struct smbXcli_tcon *target_tcon = NULL; + struct cli_dfs_path_split *dfs_refs = NULL; ++ struct cli_credentials *creds = get_cmdline_auth_info_creds(dfs_auth_info); + + if ( !rootcli || !path || !targetcli ) { + return NT_STATUS_INVALID_PARAMETER; +@@ -1022,7 +1023,7 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, + status = cli_cm_connect(ctx, rootcli, + dfs_refs[count].server, + dfs_refs[count].share, +- dfs_auth_info, ++ creds, + smbXcli_conn_protocol(rootcli->conn), + NULL, /* dest_ss */ + 0, /* port */ +-- +2.28.0 + + +From d6d5da0e28c3879280e1139f51bfe2ef03bc450e Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 18 Aug 2020 17:26:54 +0200 +Subject: [PATCH 068/105] s3:libsmb: Pass cli_credentials to cli_cm_open() + +Signed-off-by: Andreas Schneider +Reviewed-by: Jeremy Allison +(cherry picked from commit df1623abd7267916696e2e60c146ef8fa6c9dfc9) +--- + source3/client/client.c | 23 ++++++++++++++++++----- + source3/lib/netapi/cm.c | 4 +++- + source3/libsmb/clidfs.c | 25 ++++++++++++------------- + source3/libsmb/proto.h | 18 +++++++++--------- + 4 files changed, 42 insertions(+), 28 deletions(-) + +diff --git a/source3/client/client.c b/source3/client/client.c +index 1f18024b798..35bc3a7c5c3 100644 +--- a/source3/client/client.c ++++ b/source3/client/client.c +@@ -5610,6 +5610,8 @@ static int process_command_string(const char *cmd_in) + TALLOC_CTX *ctx = talloc_tos(); + char *cmd = talloc_strdup(ctx, cmd_in); + int rc = 0; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + + if (!cmd) { + return 1; +@@ -5621,7 +5623,8 @@ static int process_command_string(const char *cmd_in) + + status = cli_cm_open(talloc_tos(), NULL, + desthost, +- service, popt_get_cmdline_auth_info(), ++ service, ++ creds, + max_protocol, + have_ip ? &dest_ss : NULL, port, + name_type, +@@ -6062,10 +6065,13 @@ static int process(const char *base_directory) + { + int rc = 0; + NTSTATUS status; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + + status = cli_cm_open(talloc_tos(), NULL, + desthost, +- service, popt_get_cmdline_auth_info(), ++ service, ++ creds, + max_protocol, + have_ip ? &dest_ss : NULL, port, + name_type, &cli); +@@ -6100,10 +6106,13 @@ static int process(const char *base_directory) + static int do_host_query(const char *query_host) + { + NTSTATUS status; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + + status = cli_cm_open(talloc_tos(), NULL, + query_host, +- "IPC$", popt_get_cmdline_auth_info(), ++ "IPC$", ++ creds, + max_protocol, + have_ip ? &dest_ss : NULL, port, + name_type, &cli); +@@ -6150,7 +6159,8 @@ static int do_host_query(const char *query_host) + d_printf("Reconnecting with SMB1 for workgroup listing.\n"); + status = cli_cm_open(talloc_tos(), NULL, + query_host, +- "IPC$", popt_get_cmdline_auth_info(), ++ "IPC$", ++ creds, + max_proto, + have_ip ? &dest_ss : NULL, NBT_SMB_PORT, + name_type, &cli); +@@ -6177,6 +6187,8 @@ static int do_tar_op(const char *base_directory) + { + struct tar *tar_ctx = tar_get_ctx(); + int ret = 0; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + + /* do we already have a connection? */ + if (!cli) { +@@ -6184,7 +6196,8 @@ static int do_tar_op(const char *base_directory) + + status = cli_cm_open(talloc_tos(), NULL, + desthost, +- service, popt_get_cmdline_auth_info(), ++ service, ++ creds, + max_protocol, + have_ip ? &dest_ss : NULL, port, + name_type, &cli); +diff --git a/source3/lib/netapi/cm.c b/source3/lib/netapi/cm.c +index 0fd31ef3d5a..943f7498e8c 100644 +--- a/source3/lib/netapi/cm.c ++++ b/source3/lib/netapi/cm.c +@@ -71,6 +71,7 @@ static WERROR libnetapi_open_ipc_connection(struct libnetapi_ctx *ctx, + struct cli_state *cli_ipc = NULL; + struct client_ipc_connection *p; + NTSTATUS status; ++ struct cli_credentials *creds = NULL; + + if (!ctx || !pp || !server_name) { + return WERR_INVALID_PARAMETER; +@@ -106,10 +107,11 @@ static WERROR libnetapi_open_ipc_connection(struct libnetapi_ctx *ctx, + if (ctx->use_ccache) { + set_cmdline_auth_info_use_ccache(auth_info, true); + } ++ creds = get_cmdline_auth_info_creds(auth_info); + + status = cli_cm_open(ctx, NULL, + server_name, "IPC$", +- auth_info, ++ creds, + lp_client_ipc_max_protocol(), + NULL, 0, 0x20, &cli_ipc); + if (!NT_STATUS_IS_OK(status)) { +diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c +index a2c6f5fe5ec..ef75fb36a45 100644 +--- a/source3/libsmb/clidfs.c ++++ b/source3/libsmb/clidfs.c +@@ -384,19 +384,18 @@ static struct cli_state *cli_cm_find(struct cli_state *cli, + ****************************************************************************/ + + NTSTATUS cli_cm_open(TALLOC_CTX *ctx, +- struct cli_state *referring_cli, +- const char *server, +- const char *share, +- const struct user_auth_info *auth_info, +- int max_protocol, +- const struct sockaddr_storage *dest_ss, +- int port, +- int name_type, +- struct cli_state **pcli) ++ struct cli_state *referring_cli, ++ const char *server, ++ const char *share, ++ struct cli_credentials *creds, ++ int max_protocol, ++ const struct sockaddr_storage *dest_ss, ++ int port, ++ int name_type, ++ struct cli_state **pcli) + { + /* Try to reuse an existing connection in this list. */ + struct cli_state *c = cli_cm_find(referring_cli, server, share); +- struct cli_credentials *creds = get_cmdline_auth_info_creds(auth_info); + NTSTATUS status; + + if (c) { +@@ -404,11 +403,11 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, + return NT_STATUS_OK; + } + +- if (auth_info == NULL) { ++ if (creds == NULL) { + /* Can't do a new connection + * without auth info. */ + d_printf("cli_cm_open() Unable to open connection [\\%s\\%s] " +- "without auth info\n", ++ "without client credentials\n", + server, share ); + return NT_STATUS_INVALID_PARAMETER; + } +@@ -966,7 +965,7 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, + rootcli, + smbXcli_conn_remote_name(rootcli->conn), + "IPC$", +- dfs_auth_info, ++ creds, + smbXcli_conn_protocol(rootcli->conn), + NULL, /* dest_ss not needed, we reuse the transport */ + 0, +diff --git a/source3/libsmb/proto.h b/source3/libsmb/proto.h +index f2b0a8c5ff8..0b8cf2a6036 100644 +--- a/source3/libsmb/proto.h ++++ b/source3/libsmb/proto.h +@@ -124,15 +124,15 @@ struct cli_state *get_ipc_connect_master_ip(TALLOC_CTX *ctx, + /* The following definitions come from libsmb/clidfs.c */ + + NTSTATUS cli_cm_open(TALLOC_CTX *ctx, +- struct cli_state *referring_cli, +- const char *server, +- const char *share, +- const struct user_auth_info *auth_info, +- int max_protocol, +- const struct sockaddr_storage *dest_ss, +- int port, +- int name_type, +- struct cli_state **pcli); ++ struct cli_state *referring_cli, ++ const char *server, ++ const char *share, ++ struct cli_credentials *creds, ++ int max_protocol, ++ const struct sockaddr_storage *dest_ss, ++ int port, ++ int name_type, ++ struct cli_state **pcli); + void cli_cm_display(struct cli_state *c); + struct client_dfs_referral; + NTSTATUS cli_dfs_get_referral_ex(TALLOC_CTX *ctx, +-- +2.28.0 + + +From 1c07abb4b9690b62b2ae7841134d7a71e4771bb9 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 18 Aug 2020 17:42:25 +0200 +Subject: [PATCH 069/105] s3:libsmb: Pass cli_credentials to + cli_resolve_path(), using helper variables. + +Signed-off-by: Andreas Schneider +Signed-off-by: Jeremy Allison +(cherry picked from commit 5245ab3c4dacc88d5cbe3bb1e3e339e4fb77a4db) +--- + source3/client/client.c | 148 +++++++++++++++++++++++++++------- + source3/libsmb/clidfs.c | 5 +- + source3/libsmb/libsmb_dir.c | 43 ++++++++-- + source3/libsmb/libsmb_file.c | 13 ++- + source3/libsmb/libsmb_stat.c | 6 +- + source3/libsmb/libsmb_xattr.c | 13 ++- + source3/libsmb/proto.h | 2 +- + source3/utils/smbcacls.c | 5 +- + 8 files changed, 188 insertions(+), 47 deletions(-) + +diff --git a/source3/client/client.c b/source3/client/client.c +index 35bc3a7c5c3..23de5befee3 100644 +--- a/source3/client/client.c ++++ b/source3/client/client.c +@@ -300,9 +300,14 @@ static int do_dskattr(void) + struct cli_state *targetcli = NULL; + char *targetpath = NULL; + TALLOC_CTX *ctx = talloc_tos(); ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), cli, ++ status = cli_resolve_path(ctx, ++ "", ++ creds, ++ cli, + client_get_cur_dir(), &targetcli, + &targetpath); + if (!NT_STATUS_IS_OK(status)) { +@@ -392,6 +397,8 @@ static int do_cd(const char *new_dir) + uint32_t attributes; + int ret = 1; + TALLOC_CTX *ctx = talloc_stackframe(); ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + + newdir = talloc_strdup(ctx, new_dir); +@@ -434,7 +441,8 @@ static int do_cd(const char *new_dir) + new_cd = client_clean_name(ctx, new_cd); + client_set_cur_dir(new_cd); + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, new_cd, &targetcli, &targetpath); + if (!NT_STATUS_IS_OK(status)) { + d_printf("cd %s: %s\n", new_cd, nt_errstr(status)); +@@ -811,6 +819,8 @@ NTSTATUS do_list(const char *mask, + TALLOC_CTX *ctx = talloc_tos(); + struct cli_state *targetcli = NULL; + char *targetpath = NULL; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS ret_status = NT_STATUS_OK; + NTSTATUS status = NT_STATUS_OK; + +@@ -834,7 +844,7 @@ NTSTATUS do_list(const char *mask, + /* check for dfs */ + + status = cli_resolve_path(ctx, "", +- popt_get_cmdline_auth_info(), ++ creds, + cli, head, &targetcli, &targetpath); + if (!NT_STATUS_IS_OK(status)) { + d_printf("do_list: [%s] %s\n", head, +@@ -1044,6 +1054,8 @@ static int do_get(const char *rname, const char *lname_in, bool reget) + struct cli_state *targetcli = NULL; + char *targetname = NULL; + char *lname = NULL; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + + lname = talloc_strdup(ctx, lname_in); +@@ -1058,7 +1070,8 @@ static int do_get(const char *rname, const char *lname_in, bool reget) + } + } + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, rname, &targetcli, &targetname); + if (!NT_STATUS_IS_OK(status)) { + d_printf("Failed to open %s: %s\n", rname, nt_errstr(status)); +@@ -1477,9 +1490,12 @@ static bool do_mkdir(const char *name) + TALLOC_CTX *ctx = talloc_tos(); + struct cli_state *targetcli; + char *targetname = NULL; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, name, &targetcli, &targetname); + if (!NT_STATUS_IS_OK(status)) { + d_printf("mkdir %s: %s\n", name, nt_errstr(status)); +@@ -1538,6 +1554,8 @@ static int cmd_mkdir(void) + TALLOC_CTX *ctx = talloc_tos(); + char *mask = NULL; + char *buf = NULL; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + + mask = talloc_strdup(ctx, client_get_cur_dir()); +@@ -1574,7 +1592,8 @@ static int cmd_mkdir(void) + } + + status = cli_resolve_path(ctx, "", +- popt_get_cmdline_auth_info(), cli, mask, ++ creds, ++ cli, mask, + &targetcli, &targetname); + if (!NT_STATUS_IS_OK(status)) { + return 1; +@@ -1888,9 +1907,12 @@ static int do_put(const char *rname, const char *lname, bool reput) + struct cli_state *targetcli; + char *targetname = NULL; + struct push_state state; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, rname, &targetcli, &targetname); + if (!NT_STATUS_IS_OK(status)) { + d_printf("Failed to open %s: %s\n", rname, nt_errstr(status)); +@@ -2665,6 +2687,8 @@ static int cmd_wdel(void) + uint32_t attribute; + struct cli_state *targetcli; + char *targetname = NULL; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + + if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { +@@ -2690,7 +2714,8 @@ static int cmd_wdel(void) + return 1; + } + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, mask, &targetcli, &targetname); + if (!NT_STATUS_IS_OK(status)) { + d_printf("cmd_wdel %s: %s\n", mask, nt_errstr(status)); +@@ -2716,6 +2741,8 @@ static int cmd_open(void) + char *targetname = NULL; + struct cli_state *targetcli; + uint16_t fnum = (uint16_t)-1; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + + if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { +@@ -2735,7 +2762,8 @@ static int cmd_open(void) + return 1; + } + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, mask, &targetcli, &targetname); + if (!NT_STATUS_IS_OK(status)) { + d_printf("open %s: %s\n", mask, nt_errstr(status)); +@@ -2837,6 +2865,8 @@ static int cmd_posix_open(void) + struct cli_state *targetcli; + mode_t mode; + uint16_t fnum; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + + if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { +@@ -2861,7 +2891,8 @@ static int cmd_posix_open(void) + } + mode = (mode_t)strtol(buf, (char **)NULL, 8); + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, mask, &targetcli, &targetname); + if (!NT_STATUS_IS_OK(status)) { + d_printf("posix_open %s: %s\n", mask, nt_errstr(status)); +@@ -2896,6 +2927,8 @@ static int cmd_posix_mkdir(void) + char *targetname = NULL; + struct cli_state *targetcli; + mode_t mode; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + + if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { +@@ -2920,7 +2953,8 @@ static int cmd_posix_mkdir(void) + } + mode = (mode_t)strtol(buf, (char **)NULL, 8); + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, mask, &targetcli, &targetname); + if (!NT_STATUS_IS_OK(status)) { + d_printf("posix_mkdir %s: %s\n", mask, nt_errstr(status)); +@@ -2944,6 +2978,8 @@ static int cmd_posix_unlink(void) + char *buf = NULL; + char *targetname = NULL; + struct cli_state *targetcli; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + + if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { +@@ -2962,7 +2998,8 @@ static int cmd_posix_unlink(void) + return 1; + } + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, mask, &targetcli, &targetname); + if (!NT_STATUS_IS_OK(status)) { + d_printf("posix_unlink %s: %s\n", mask, nt_errstr(status)); +@@ -2987,6 +3024,8 @@ static int cmd_posix_rmdir(void) + char *buf = NULL; + char *targetname = NULL; + struct cli_state *targetcli; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + + if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { +@@ -3005,7 +3044,8 @@ static int cmd_posix_rmdir(void) + return 1; + } + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, mask, &targetcli, &targetname); + if (!NT_STATUS_IS_OK(status)) { + d_printf("posix_rmdir %s: %s\n", mask, nt_errstr(status)); +@@ -3294,6 +3334,8 @@ static int cmd_rmdir(void) + char *buf = NULL; + char *targetname = NULL; + struct cli_state *targetcli; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + + if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { +@@ -3312,7 +3354,8 @@ static int cmd_rmdir(void) + return 1; + } + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, mask, &targetcli, &targetname); + if (!NT_STATUS_IS_OK(status)) { + d_printf("rmdir %s: %s\n", mask, nt_errstr(status)); +@@ -3341,6 +3384,8 @@ static int cmd_link(void) + char *buf2 = NULL; + char *targetname = NULL; + struct cli_state *targetcli; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + + if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL) || +@@ -3371,7 +3416,8 @@ static int cmd_link(void) + return 1; + } + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, oldname, &targetcli, &targetname); + if (!NT_STATUS_IS_OK(status)) { + d_printf("link %s: %s\n", oldname, nt_errstr(status)); +@@ -3404,6 +3450,8 @@ static int cmd_readlink(void) + char *targetname = NULL; + char *linkname = NULL; + struct cli_state *targetcli; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + + if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { +@@ -3422,7 +3470,8 @@ static int cmd_readlink(void) + return 1; + } + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, name, &targetcli, &targetname); + if (!NT_STATUS_IS_OK(status)) { + d_printf("readlink %s: %s\n", name, nt_errstr(status)); +@@ -3461,6 +3510,8 @@ static int cmd_symlink(void) + char *buf = NULL; + char *buf2 = NULL; + struct cli_state *newcli; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + + if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL) || +@@ -3483,7 +3534,8 @@ static int cmd_symlink(void) + } + /* New name must be present in share namespace. */ + status = cli_resolve_path(ctx, "", +- popt_get_cmdline_auth_info(), cli, newname, ++ creds, ++ cli, newname, + &newcli, &newname); + if (!NT_STATUS_IS_OK(status)) { + d_printf("link %s: %s\n", newname, +@@ -3519,6 +3571,8 @@ static int cmd_chmod(void) + char *targetname = NULL; + struct cli_state *targetcli; + mode_t mode; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + + if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL) || +@@ -3540,7 +3594,8 @@ static int cmd_chmod(void) + + mode = (mode_t)strtol(buf, NULL, 8); + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, src, &targetcli, &targetname); + if (!NT_STATUS_IS_OK(status)) { + d_printf("chmod %s: %s\n", src, nt_errstr(status)); +@@ -3684,6 +3739,8 @@ static int cmd_getfacl(void) + size_t num_dir_acls = 0; + size_t expected_buflen; + uint16_t i; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + + if (!next_token_talloc(ctx, &cmd_ptr,&name,NULL)) { +@@ -3702,7 +3759,8 @@ static int cmd_getfacl(void) + return 1; + } + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, src, &targetcli, &targetname); + if (!NT_STATUS_IS_OK(status)) { + d_printf("stat %s: %s\n", src, nt_errstr(status)); +@@ -3867,6 +3925,8 @@ static int cmd_geteas(void) + NTSTATUS status; + size_t i, num_eas; + struct ea_struct *eas; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + + if (!next_token_talloc(ctx, &cmd_ptr,&name,NULL)) { + d_printf("geteas filename\n"); +@@ -3884,7 +3944,8 @@ static int cmd_geteas(void) + return 1; + } + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, src, &targetcli, &targetname); + if (!NT_STATUS_IS_OK(status)) { + d_printf("stat %s: %s\n", src, nt_errstr(status)); +@@ -3923,6 +3984,8 @@ static int cmd_setea(void) + char *eavalue = NULL; + char *targetname = NULL; + struct cli_state *targetcli; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + + if (!next_token_talloc(ctx, &cmd_ptr, &name, NULL) +@@ -3945,7 +4008,8 @@ static int cmd_setea(void) + return 1; + } + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, src, &targetcli, &targetname); + if (!NT_STATUS_IS_OK(status)) { + d_printf("stat %s: %s\n", src, nt_errstr(status)); +@@ -3977,6 +4041,8 @@ static int cmd_stat(void) + SMB_STRUCT_STAT sbuf; + struct tm *lt; + time_t tmp_time; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + + if (!next_token_talloc(ctx, &cmd_ptr,&name,NULL)) { +@@ -3995,7 +4061,8 @@ static int cmd_stat(void) + return 1; + } + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, src, &targetcli, &targetname); + if (!NT_STATUS_IS_OK(status)) { + d_printf("stat %s: %s\n", src, nt_errstr(status)); +@@ -4084,6 +4151,8 @@ static int cmd_chown(void) + char *buf, *buf2, *buf3; + struct cli_state *targetcli; + char *targetname = NULL; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + + if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL) || +@@ -4107,7 +4176,8 @@ static int cmd_chown(void) + if (src == NULL) { + return 1; + } +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, src, &targetcli, &targetname); + if (!NT_STATUS_IS_OK(status)) { + d_printf("chown %s: %s\n", src, nt_errstr(status)); +@@ -4141,6 +4211,8 @@ static int cmd_rename(void) + struct cli_state *targetcli; + char *targetsrc; + char *targetdest; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + bool replace = false; + +@@ -4179,14 +4251,16 @@ static int cmd_rename(void) + replace = true; + } + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, src, &targetcli, &targetsrc); + if (!NT_STATUS_IS_OK(status)) { + d_printf("rename %s: %s\n", src, nt_errstr(status)); + return 1; + } + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, dest, &targetcli, &targetdest); + if (!NT_STATUS_IS_OK(status)) { + d_printf("rename %s: %s\n", dest, nt_errstr(status)); +@@ -4243,6 +4317,8 @@ static int cmd_scopy(void) + off_t written = 0; + struct scopy_timing st; + int rc = 0; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + + if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL) || +@@ -4275,14 +4351,16 @@ static int cmd_scopy(void) + return 1; + } + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, src, &targetcli, &targetsrc); + if (!NT_STATUS_IS_OK(status)) { + d_printf("scopy %s: %s\n", src, nt_errstr(status)); + return 1; + } + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, dest, &targetcli, &targetdest); + if (!NT_STATUS_IS_OK(status)) { + d_printf("scopy %s: %s\n", dest, nt_errstr(status)); +@@ -4381,6 +4459,8 @@ static int cmd_hardlink(void) + char *buf, *buf2; + struct cli_state *targetcli; + char *targetname; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + + if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL) || +@@ -4413,7 +4493,8 @@ static int cmd_hardlink(void) + return 1; + } + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, src, &targetcli, &targetname); + if (!NT_STATUS_IS_OK(status)) { + d_printf("hardlink %s: %s\n", src, nt_errstr(status)); +@@ -5087,9 +5168,13 @@ static int cmd_show_connect( void ) + TALLOC_CTX *ctx = talloc_tos(); + struct cli_state *targetcli; + char *targetpath; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), cli, ++ status = cli_resolve_path(ctx, "", ++ creds, ++ cli, + client_get_cur_dir(), &targetcli, + &targetpath); + if (!NT_STATUS_IS_OK(status)) { +@@ -5749,6 +5834,8 @@ static char **remote_completion(const char *text, int len) + struct cli_state *targetcli = NULL; + int i; + struct completion_remote info = { NULL, NULL, 1, 0, NULL, 0 }; ++ struct cli_credentials *creds = ++ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); + NTSTATUS status; + + /* can't have non-static initialisation on Sun CC, so do it +@@ -5809,7 +5896,8 @@ static char **remote_completion(const char *text, int len) + goto cleanup; + } + +- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, dirmask, &targetcli, &targetpath); + if (!NT_STATUS_IS_OK(status)) { + goto cleanup; +diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c +index ef75fb36a45..e6695159a96 100644 +--- a/source3/libsmb/clidfs.c ++++ b/source3/libsmb/clidfs.c +@@ -859,7 +859,7 @@ struct cli_dfs_path_split { + + NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, + const char *mountpt, +- const struct user_auth_info *dfs_auth_info, ++ struct cli_credentials *creds, + struct cli_state *rootcli, + const char *path, + struct cli_state **targetcli, +@@ -885,7 +885,6 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, + struct smbXcli_tcon *root_tcon = NULL; + struct smbXcli_tcon *target_tcon = NULL; + struct cli_dfs_path_split *dfs_refs = NULL; +- struct cli_credentials *creds = get_cmdline_auth_info_creds(dfs_auth_info); + + if ( !rootcli || !path || !targetcli ) { + return NT_STATUS_INVALID_PARAMETER; +@@ -1130,7 +1129,7 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, + if (!strequal(*pp_targetpath, "\\") && !strequal(*pp_targetpath, "/")) { + status = cli_resolve_path(ctx, + newmount, +- dfs_auth_info, ++ creds, + *targetcli, + *pp_targetpath, + &newcli, +diff --git a/source3/libsmb/libsmb_dir.c b/source3/libsmb/libsmb_dir.c +index 12abb734c2d..0326f27125b 100644 +--- a/source3/libsmb/libsmb_dir.c ++++ b/source3/libsmb/libsmb_dir.c +@@ -911,6 +911,7 @@ SMBC_opendir_ctx(SMBCCTX *context, + */ + char *targetpath; + struct cli_state *targetcli; ++ struct cli_credentials *creds = NULL; + NTSTATUS status; + + /* We connect to the server and list the directory */ +@@ -943,8 +944,12 @@ SMBC_opendir_ctx(SMBCCTX *context, + return NULL; + } + ++ creds = get_cmdline_auth_info_creds( ++ context->internal->auth_info); ++ + status = cli_resolve_path( +- frame, "", context->internal->auth_info, ++ frame, "", ++ creds, + srv->cli, path, &targetcli, &targetpath); + if (!NT_STATUS_IS_OK(status)) { + d_printf("Could not resolve %s\n", path); +@@ -1543,6 +1548,7 @@ SMBC_mkdir_ctx(SMBCCTX *context, + char *targetpath = NULL; + uint16_t port = 0; + struct cli_state *targetcli = NULL; ++ struct cli_credentials *creds = NULL; + TALLOC_CTX *frame = talloc_stackframe(); + NTSTATUS status; + +@@ -1595,8 +1601,11 @@ SMBC_mkdir_ctx(SMBCCTX *context, + + } + ++ creds = get_cmdline_auth_info_creds(context->internal->auth_info); ++ + /*d_printf(">>>mkdir: resolving %s\n", path);*/ +- status = cli_resolve_path(frame, "", context->internal->auth_info, ++ status = cli_resolve_path(frame, "", ++ creds, + srv->cli, path, &targetcli, &targetpath); + if (!NT_STATUS_IS_OK(status)) { + d_printf("Could not resolve %s\n", path); +@@ -1654,6 +1663,7 @@ SMBC_rmdir_ctx(SMBCCTX *context, + char *targetpath = NULL; + uint16_t port = 0; + struct cli_state *targetcli = NULL; ++ struct cli_credentials *creds = NULL; + TALLOC_CTX *frame = talloc_stackframe(); + NTSTATUS status; + +@@ -1706,8 +1716,11 @@ SMBC_rmdir_ctx(SMBCCTX *context, + + } + ++ creds = get_cmdline_auth_info_creds(context->internal->auth_info), ++ + /*d_printf(">>>rmdir: resolving %s\n", path);*/ +- status = cli_resolve_path(frame, "", context->internal->auth_info, ++ status = cli_resolve_path(frame, "", ++ creds, + srv->cli, path, &targetcli, &targetpath); + if (!NT_STATUS_IS_OK(status)) { + d_printf("Could not resolve %s\n", path); +@@ -1959,6 +1972,7 @@ SMBC_chmod_ctx(SMBCCTX *context, + char *path = NULL; + uint32_t attr; + uint16_t port = 0; ++ struct cli_credentials *creds = NULL; + TALLOC_CTX *frame = talloc_stackframe(); + NTSTATUS status; + +@@ -2010,8 +2024,11 @@ SMBC_chmod_ctx(SMBCCTX *context, + return -1; /* errno set by SMBC_server */ + } + ++ creds = get_cmdline_auth_info_creds(context->internal->auth_info); ++ + /*d_printf(">>>unlink: resolving %s\n", path);*/ +- status = cli_resolve_path(frame, "", context->internal->auth_info, ++ status = cli_resolve_path(frame, "", ++ creds, + srv->cli, path, &targetcli, &targetpath); + if (!NT_STATUS_IS_OK(status)) { + d_printf("Could not resolve %s\n", path); +@@ -2152,6 +2169,7 @@ SMBC_unlink_ctx(SMBCCTX *context, + uint16_t port = 0; + struct cli_state *targetcli = NULL; + SMBCSRV *srv = NULL; ++ struct cli_credentials *creds = NULL; + TALLOC_CTX *frame = talloc_stackframe(); + NTSTATUS status; + +@@ -2204,8 +2222,11 @@ SMBC_unlink_ctx(SMBCCTX *context, + + } + ++ creds = get_cmdline_auth_info_creds(context->internal->auth_info); ++ + /*d_printf(">>>unlink: resolving %s\n", path);*/ +- status = cli_resolve_path(frame, "", context->internal->auth_info, ++ status = cli_resolve_path(frame, "", ++ creds, + srv->cli, path, &targetcli, &targetpath); + if (!NT_STATUS_IS_OK(status)) { + d_printf("Could not resolve %s\n", path); +@@ -2282,6 +2303,8 @@ SMBC_rename_ctx(SMBCCTX *ocontext, + SMBCSRV *srv = NULL; + uint16_t port1 = 0; + uint16_t port2 = 0; ++ struct cli_credentials *ocreds = NULL; ++ struct cli_credentials *ncreds = NULL; + TALLOC_CTX *frame = talloc_stackframe(); + NTSTATUS status; + +@@ -2375,7 +2398,10 @@ SMBC_rename_ctx(SMBCCTX *ocontext, + password1); + + /*d_printf(">>>rename: resolving %s\n", path1);*/ +- status = cli_resolve_path(frame, "", ocontext->internal->auth_info, ++ ocreds = get_cmdline_auth_info_creds(ocontext->internal->auth_info); ++ ++ status = cli_resolve_path(frame, "", ++ ocreds, + srv->cli, path1, &targetcli1, &targetpath1); + if (!NT_STATUS_IS_OK(status)) { + d_printf("Could not resolve %s\n", path1); +@@ -2392,7 +2418,10 @@ SMBC_rename_ctx(SMBCCTX *ocontext, + + /*d_printf(">>>rename: resolved path as %s\n", targetpath1);*/ + /*d_printf(">>>rename: resolving %s\n", path2);*/ +- status = cli_resolve_path(frame, "", ncontext->internal->auth_info, ++ ncreds = get_cmdline_auth_info_creds(ncontext->internal->auth_info); ++ ++ status = cli_resolve_path(frame, "", ++ ncreds, + srv->cli, path2, &targetcli2, &targetpath2); + if (!NT_STATUS_IS_OK(status)) { + d_printf("Could not resolve %s\n", path2); +diff --git a/source3/libsmb/libsmb_file.c b/source3/libsmb/libsmb_file.c +index 0791df36690..a44925e0e0e 100644 +--- a/source3/libsmb/libsmb_file.c ++++ b/source3/libsmb/libsmb_file.c +@@ -103,6 +103,8 @@ SMBC_open_ctx(SMBCCTX *context, + if (strlen(path) > 0 && path[strlen(path) - 1] == '\\') { + status = NT_STATUS_OBJECT_PATH_INVALID; + } else { ++ struct cli_credentials *creds = NULL; ++ + file = SMB_MALLOC_P(SMBCFILE); + if (!file) { + errno = ENOMEM; +@@ -112,9 +114,12 @@ SMBC_open_ctx(SMBCCTX *context, + + ZERO_STRUCTP(file); + ++ creds = get_cmdline_auth_info_creds( ++ context->internal->auth_info); + /*d_printf(">>>open: resolving %s\n", path);*/ + status = cli_resolve_path( +- frame, "", context->internal->auth_info, ++ frame, "", ++ creds, + srv->cli, path, &targetcli, &targetpath); + if (!NT_STATUS_IS_OK(status)) { + d_printf("Could not resolve %s\n", path); +@@ -461,6 +466,7 @@ SMBC_getatr(SMBCCTX * context, + struct timespec change_time_ts = {0}; + time_t write_time = 0; + SMB_INO_T ino = 0; ++ struct cli_credentials *creds = NULL; + TALLOC_CTX *frame = talloc_stackframe(); + NTSTATUS status; + +@@ -490,7 +496,10 @@ SMBC_getatr(SMBCCTX * context, + } + DEBUG(4,("SMBC_getatr: sending qpathinfo\n")); + +- status = cli_resolve_path(frame, "", context->internal->auth_info, ++ creds = get_cmdline_auth_info_creds(context->internal->auth_info); ++ ++ status = cli_resolve_path(frame, "", ++ creds, + srv->cli, fixedpath, + &targetcli, &targetpath); + if (!NT_STATUS_IS_OK(status)) { +diff --git a/source3/libsmb/libsmb_stat.c b/source3/libsmb/libsmb_stat.c +index 790934bd565..1260928d0ff 100644 +--- a/source3/libsmb/libsmb_stat.c ++++ b/source3/libsmb/libsmb_stat.c +@@ -242,6 +242,7 @@ SMBC_fstat_ctx(SMBCCTX *context, + struct cli_state *targetcli = NULL; + SMB_INO_T ino = 0; + uint16_t port = 0; ++ struct cli_credentials *creds = NULL; + TALLOC_CTX *frame = talloc_stackframe(); + NTSTATUS status; + +@@ -279,8 +280,11 @@ SMBC_fstat_ctx(SMBCCTX *context, + return -1; + } + ++ creds = get_cmdline_auth_info_creds(context->internal->auth_info); ++ + /*d_printf(">>>fstat: resolving %s\n", path);*/ +- status = cli_resolve_path(frame, "", context->internal->auth_info, ++ status = cli_resolve_path(frame, "", ++ creds, + file->srv->cli, path, + &targetcli, &targetpath); + if (!NT_STATUS_IS_OK(status)) { +diff --git a/source3/libsmb/libsmb_xattr.c b/source3/libsmb/libsmb_xattr.c +index d1b6548eb90..8b74d0a39e3 100644 +--- a/source3/libsmb/libsmb_xattr.c ++++ b/source3/libsmb/libsmb_xattr.c +@@ -860,13 +860,18 @@ cacl_get(SMBCCTX *context, + if (ipc_cli && (all || some_nt || all_nt_acls)) { + char *targetpath = NULL; + struct cli_state *targetcli = NULL; ++ struct cli_credentials *creds = NULL; + NTSTATUS status; + + /* Point to the portion after "system.nt_sec_desc." */ + name += 19; /* if (all) this will be invalid but unused */ + ++ creds = get_cmdline_auth_info_creds( ++ context->internal->auth_info); ++ + status = cli_resolve_path( +- ctx, "", context->internal->auth_info, ++ ctx, "", ++ creds, + cli, filename, &targetcli, &targetpath); + if (!NT_STATUS_IS_OK(status)) { + DEBUG(5, ("cacl_get Could not resolve %s\n", +@@ -1511,6 +1516,7 @@ cacl_set(SMBCCTX *context, + bool numeric = True; + char *targetpath = NULL; + struct cli_state *targetcli = NULL; ++ struct cli_credentials *creds = NULL; + NTSTATUS status; + + /* the_acl will be null for REMOVE_ALL operations */ +@@ -1540,7 +1546,10 @@ cacl_set(SMBCCTX *context, + return -1; + } + +- status = cli_resolve_path(ctx, "", context->internal->auth_info, ++ creds = get_cmdline_auth_info_creds(context->internal->auth_info); ++ ++ status = cli_resolve_path(ctx, "", ++ creds, + cli, filename, &targetcli, &targetpath); + if (!NT_STATUS_IS_OK(status)) { + DEBUG(5,("cacl_set: Could not resolve %s\n", filename)); +diff --git a/source3/libsmb/proto.h b/source3/libsmb/proto.h +index 0b8cf2a6036..517738dbcd7 100644 +--- a/source3/libsmb/proto.h ++++ b/source3/libsmb/proto.h +@@ -150,7 +150,7 @@ NTSTATUS cli_dfs_get_referral(TALLOC_CTX *ctx, + size_t *consumed); + NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, + const char *mountpt, +- const struct user_auth_info *dfs_auth_info, ++ struct cli_credentials *creds, + struct cli_state *rootcli, + const char *path, + struct cli_state **targetcli, +diff --git a/source3/utils/smbcacls.c b/source3/utils/smbcacls.c +index 8fd9fcc5780..4989ec633c3 100644 +--- a/source3/utils/smbcacls.c ++++ b/source3/utils/smbcacls.c +@@ -806,6 +806,7 @@ int main(int argc, char *argv[]) + than going via LSA calls to resolve them */ + int numeric = 0; + struct cli_state *targetcli = NULL; ++ struct cli_credentials *creds = NULL; + char *targetfile = NULL; + NTSTATUS status; + +@@ -1069,9 +1070,11 @@ int main(int argc, char *argv[]) + } + } + ++ creds = get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()), ++ + status = cli_resolve_path(frame, + "", +- popt_get_cmdline_auth_info(), ++ creds, + cli, + filename, + &targetcli, +-- +2.28.0 + + +From 100dad122572d927889f4c03b19f169a3bf61df4 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 27 Aug 2020 16:40:49 +0200 +Subject: [PATCH 070/105] s3:client: Remove global max_protocol + +Signed-off-by: Andreas Schneider +Reviewed-by: Jeremy Allison +(cherry picked from commit d07f28645f37c1f976017d5b89864791a18d1943) +--- + source3/client/client.c | 13 +++++-------- + 1 file changed, 5 insertions(+), 8 deletions(-) + +diff --git a/source3/client/client.c b/source3/client/client.c +index 23de5befee3..329463795e0 100644 +--- a/source3/client/client.c ++++ b/source3/client/client.c +@@ -61,7 +61,6 @@ static int io_bufsize = 0; /* we use the default size */ + static int io_timeout = (CLIENT_TIMEOUT/1000); /* Per operation timeout (in seconds). */ + + static int name_type = 0x20; +-static int max_protocol = -1; + + static int process_tok(char *tok); + static int cmd_help(void); +@@ -5710,7 +5709,7 @@ static int process_command_string(const char *cmd_in) + desthost, + service, + creds, +- max_protocol, ++ lp_client_max_protocol(), + have_ip ? &dest_ss : NULL, port, + name_type, + &cli); +@@ -6160,7 +6159,7 @@ static int process(const char *base_directory) + desthost, + service, + creds, +- max_protocol, ++ lp_client_max_protocol(), + have_ip ? &dest_ss : NULL, port, + name_type, &cli); + if (!NT_STATUS_IS_OK(status)) { +@@ -6201,7 +6200,7 @@ static int do_host_query(const char *query_host) + query_host, + "IPC$", + creds, +- max_protocol, ++ lp_client_max_protocol(), + have_ip ? &dest_ss : NULL, port, + name_type, &cli); + if (!NT_STATUS_IS_OK(status)) { +@@ -6236,7 +6235,7 @@ static int do_host_query(const char *query_host) + if (port != NBT_SMB_PORT || + smbXcli_conn_protocol(cli->conn) > PROTOCOL_NT1) + { +- int max_proto = MIN(max_protocol, PROTOCOL_NT1); ++ int max_proto = MIN(lp_client_max_protocol(), PROTOCOL_NT1); + + /* + * Workgroups simply don't make sense over anything +@@ -6286,7 +6285,7 @@ static int do_tar_op(const char *base_directory) + desthost, + service, + creds, +- max_protocol, ++ lp_client_max_protocol(), + have_ip ? &dest_ss : NULL, port, + name_type, &cli); + if (!NT_STATUS_IS_OK(status)) { +@@ -6693,8 +6692,6 @@ int main(int argc,char *argv[]) + /* Ensure we have a password (or equivalent). */ + popt_common_credentials_post(); + +- max_protocol = lp_client_max_protocol(); +- + if (tar_to_process(tar_ctx)) { + if (cmdstr) + process_command_string(cmdstr); +-- +2.28.0 + + +From fecf06bd00bc8ff23634bded86d649e432431957 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 27 Aug 2020 16:43:46 +0200 +Subject: [PATCH 071/105] s3:libsmb: Remove max_protocol from cli_cm_open() + +Signed-off-by: Andreas Schneider +Reviewed-by: Jeremy Allison +(cherry picked from commit 4aac9daf095e7c2de6a27697a13385ee87a4b634) +--- + source3/client/client.c | 7 ------- + source3/lib/netapi/cm.c | 1 - + source3/libsmb/clidfs.c | 4 +--- + source3/libsmb/proto.h | 1 - + 4 files changed, 1 insertion(+), 12 deletions(-) + +diff --git a/source3/client/client.c b/source3/client/client.c +index 329463795e0..e9e6cb1ac2c 100644 +--- a/source3/client/client.c ++++ b/source3/client/client.c +@@ -5709,7 +5709,6 @@ static int process_command_string(const char *cmd_in) + desthost, + service, + creds, +- lp_client_max_protocol(), + have_ip ? &dest_ss : NULL, port, + name_type, + &cli); +@@ -6159,7 +6158,6 @@ static int process(const char *base_directory) + desthost, + service, + creds, +- lp_client_max_protocol(), + have_ip ? &dest_ss : NULL, port, + name_type, &cli); + if (!NT_STATUS_IS_OK(status)) { +@@ -6200,7 +6198,6 @@ static int do_host_query(const char *query_host) + query_host, + "IPC$", + creds, +- lp_client_max_protocol(), + have_ip ? &dest_ss : NULL, port, + name_type, &cli); + if (!NT_STATUS_IS_OK(status)) { +@@ -6235,8 +6232,6 @@ static int do_host_query(const char *query_host) + if (port != NBT_SMB_PORT || + smbXcli_conn_protocol(cli->conn) > PROTOCOL_NT1) + { +- int max_proto = MIN(lp_client_max_protocol(), PROTOCOL_NT1); +- + /* + * Workgroups simply don't make sense over anything + * else but port 139 and SMB1. +@@ -6248,7 +6243,6 @@ static int do_host_query(const char *query_host) + query_host, + "IPC$", + creds, +- max_proto, + have_ip ? &dest_ss : NULL, NBT_SMB_PORT, + name_type, &cli); + if (!NT_STATUS_IS_OK(status)) { +@@ -6285,7 +6279,6 @@ static int do_tar_op(const char *base_directory) + desthost, + service, + creds, +- lp_client_max_protocol(), + have_ip ? &dest_ss : NULL, port, + name_type, &cli); + if (!NT_STATUS_IS_OK(status)) { +diff --git a/source3/lib/netapi/cm.c b/source3/lib/netapi/cm.c +index 943f7498e8c..3f4e188b396 100644 +--- a/source3/lib/netapi/cm.c ++++ b/source3/lib/netapi/cm.c +@@ -112,7 +112,6 @@ static WERROR libnetapi_open_ipc_connection(struct libnetapi_ctx *ctx, + status = cli_cm_open(ctx, NULL, + server_name, "IPC$", + creds, +- lp_client_ipc_max_protocol(), + NULL, 0, 0x20, &cli_ipc); + if (!NT_STATUS_IS_OK(status)) { + cli_ipc = NULL; +diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c +index e6695159a96..fb1a0c72e6d 100644 +--- a/source3/libsmb/clidfs.c ++++ b/source3/libsmb/clidfs.c +@@ -388,7 +388,6 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, + const char *server, + const char *share, + struct cli_credentials *creds, +- int max_protocol, + const struct sockaddr_storage *dest_ss, + int port, + int name_type, +@@ -417,7 +416,7 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, + server, + share, + creds, +- max_protocol, ++ lp_client_max_protocol(), + dest_ss, + port, + name_type, +@@ -965,7 +964,6 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, + smbXcli_conn_remote_name(rootcli->conn), + "IPC$", + creds, +- smbXcli_conn_protocol(rootcli->conn), + NULL, /* dest_ss not needed, we reuse the transport */ + 0, + 0x20, +diff --git a/source3/libsmb/proto.h b/source3/libsmb/proto.h +index 517738dbcd7..8aaaff2cb1e 100644 +--- a/source3/libsmb/proto.h ++++ b/source3/libsmb/proto.h +@@ -128,7 +128,6 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, + const char *server, + const char *share, + struct cli_credentials *creds, +- int max_protocol, + const struct sockaddr_storage *dest_ss, + int port, + int name_type, +-- +2.28.0 + + +From 2af136fd7c1ecae9cc06bc2cf26a7feac16cb279 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 27 Aug 2020 16:45:12 +0200 +Subject: [PATCH 072/105] s3:libcmb: Remove max_protocol from cli_cm_connect() + +Signed-off-by: Andreas Schneider +Reviewed-by: Jeremy Allison +(cherry picked from commit 2159582610ecc932047b85a77ec321b3d3ac806f) +--- + source3/libsmb/clidfs.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c +index fb1a0c72e6d..023dd4d2757 100644 +--- a/source3/libsmb/clidfs.c ++++ b/source3/libsmb/clidfs.c +@@ -293,7 +293,6 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, + const char *server, + const char *share, + struct cli_credentials *creds, +- int max_protocol, + const struct sockaddr_storage *dest_ss, + int port, + int name_type, +@@ -304,7 +303,7 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, + + status = do_connect(ctx, server, share, + creds, +- max_protocol, ++ lp_client_max_protocol(), + dest_ss, port, name_type, &cli); + + if (!NT_STATUS_IS_OK(status)) { +@@ -416,7 +415,6 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, + server, + share, + creds, +- lp_client_max_protocol(), + dest_ss, + port, + name_type, +@@ -1020,7 +1018,6 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, + dfs_refs[count].server, + dfs_refs[count].share, + creds, +- smbXcli_conn_protocol(rootcli->conn), + NULL, /* dest_ss */ + 0, /* port */ + 0x20, +-- +2.28.0 + + +From dc8cfd9551afa10b0610c6663cb28bfb1ec5888a Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 27 Aug 2020 16:46:29 +0200 +Subject: [PATCH 073/105] s3:libsmb: Remove max_protocol from clidfs + do_connect() + +The if check for max_protocol == 0 is part of lp_client_max_protocol(). + +Signed-off-by: Andreas Schneider +Reviewed-by: Jeremy Allison +(cherry picked from commit 50b59b4c28bc816094a4ca97f64450860e2495b2) +--- + source3/libsmb/clidfs.c | 8 +------- + 1 file changed, 1 insertion(+), 7 deletions(-) + +diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c +index 023dd4d2757..ee5becf76a6 100644 +--- a/source3/libsmb/clidfs.c ++++ b/source3/libsmb/clidfs.c +@@ -107,7 +107,6 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, + const char *server, + const char *share, + struct cli_credentials *creds, +- int max_protocol, + const struct sockaddr_storage *dest_ss, + int port, + int name_type, +@@ -167,14 +166,11 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, + return status; + } + +- if (max_protocol == 0) { +- max_protocol = PROTOCOL_LATEST; +- } + DEBUG(4,(" session request ok\n")); + + status = smbXcli_negprot(c->conn, c->timeout, + lp_client_min_protocol(), +- max_protocol); ++ lp_client_max_protocol()); + + if (!NT_STATUS_IS_OK(status)) { + d_printf("protocol negotiation failed: %s\n", +@@ -233,7 +229,6 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, + cli_shutdown(c); + return do_connect(ctx, newserver, + newshare, creds, +- max_protocol, + NULL, port, name_type, pcli); + } + +@@ -303,7 +298,6 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, + + status = do_connect(ctx, server, share, + creds, +- lp_client_max_protocol(), + dest_ss, port, name_type, &cli); + + if (!NT_STATUS_IS_OK(status)) { +-- +2.28.0 + + +From 3a99225868e079e108968552f43b937b5b9b702f Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Mon, 10 Aug 2020 15:47:35 +0200 +Subject: [PATCH 074/105] s3:include: Move loadparm prototypes to own header + file + +Signed-off-by: Andreas Schneider +Reviewed-by: Jeremy Allison +(cherry picked from commit d4d8218b9618dd289f54b41f13d7015f1b3994fd) +--- + source3/include/includes.h | 3 + + source3/include/proto.h | 167 ------------------------------- + source3/param/loadparm.h | 200 +++++++++++++++++++++++++++++++++++++ + 3 files changed, 203 insertions(+), 167 deletions(-) + create mode 100644 source3/param/loadparm.h + +diff --git a/source3/include/includes.h b/source3/include/includes.h +index 8fa65cc3122..c94f919ed59 100644 +--- a/source3/include/includes.h ++++ b/source3/include/includes.h +@@ -293,6 +293,9 @@ typedef char fstring[FSTRING_LEN]; + #endif + + #include "lib/param/loadparm.h" ++#include "source3/param/loadparm.h" ++/* Automatically generated by generate_param.py. */ ++#include "source3/param/param_proto.h" + + /* String routines */ + +diff --git a/source3/include/proto.h b/source3/include/proto.h +index 12aa392abae..b9a6cb7f116 100644 +--- a/source3/include/proto.h ++++ b/source3/include/proto.h +@@ -739,173 +739,6 @@ NTSTATUS trust_pw_change(struct netlogon_creds_cli_context *context, + const char *dcname, + bool force); + +-/* The following definitions come from param/loadparm.c */ +- +-const struct loadparm_substitution *loadparm_s3_global_substitution(void); +- +-char *lp_parm_substituted_string(TALLOC_CTX *mem_ctx, +- const struct loadparm_substitution *lp_sub, +- int snum, +- const char *type, +- const char *option, +- const char *def); +- +-#include "source3/param/param_proto.h" +- +-char *lp_servicename(TALLOC_CTX *ctx, const struct loadparm_substitution *, int); +-const char *lp_const_servicename(int); +-bool lp_autoloaded(int); +-const char *lp_dnsdomain(void); +-int lp_winbind_max_domain_connections(void); +-bool lp_idmap_range(const char *domain_name, uint32_t *low, uint32_t *high); +-bool lp_idmap_default_range(uint32_t *low, uint32_t *high); +-const char *lp_idmap_backend(const char *domain_name); +-const char *lp_idmap_default_backend (void); +-int lp_security(void); +-int lp_client_max_protocol(void); +-int lp_client_ipc_min_protocol(void); +-int lp_client_ipc_max_protocol(void); +-int lp_client_ipc_signing(void); +-int lp_smb2_max_credits(void); +-int lp_cups_encrypt(void); +-bool lp_widelinks(int ); +-int lp_rpc_low_port(void); +-int lp_rpc_high_port(void); +-bool lp_lanman_auth(void); +-enum samba_weak_crypto lp_weak_crypto(void); +- +-int lp_wi_scan_global_parametrics( +- const char *regex, size_t max_matches, +- bool (*cb)(const char *string, regmatch_t matches[], +- void *private_data), +- void *private_data); +- +-const char *lp_parm_const_string(int snum, const char *type, const char *option, const char *def); +-struct loadparm_service; +-const char *lp_parm_const_string_service(struct loadparm_service *service, const char *type, +- const char *option, const char *def); +-const char **lp_parm_string_list(int snum, const char *type, const char *option, const char **def); +-int lp_parm_int(int snum, const char *type, const char *option, int def); +-unsigned long lp_parm_ulong(int snum, const char *type, const char *option, unsigned long def); +-unsigned long long lp_parm_ulonglong(int snum, const char *type, +- const char *option, +- unsigned long long def); +-bool lp_parm_bool(int snum, const char *type, const char *option, bool def); +-struct enum_list; +-int lp_parm_enum(int snum, const char *type, const char *option, +- const struct enum_list *_enum, int def); +-char *canonicalize_servicename(TALLOC_CTX *ctx, const char *src); +-bool lp_add_home(const char *pszHomename, int iDefaultService, +- const char *user, const char *pszHomedir); +-int lp_add_service(const char *pszService, int iDefaultService); +-bool lp_add_printer(const char *pszPrintername, int iDefaultService); +-bool lp_parameter_is_valid(const char *pszParmName); +-bool lp_parameter_is_global(const char *pszParmName); +-bool lp_canonicalize_parameter(const char *parm_name, const char **canon_parm, +- bool *inverse); +-bool lp_canonicalize_parameter_with_value(const char *parm_name, +- const char *val, +- const char **canon_parm, +- const char **canon_val); +-void show_parameter_list(void); +-bool lp_invert_boolean(const char *str, const char **inverse_str); +-bool lp_canonicalize_boolean(const char *str, const char**canon_str); +-bool process_registry_service(const char *service_name); +-bool process_registry_shares(void); +-bool lp_config_backend_is_registry(void); +-bool lp_config_backend_is_file(void); +-bool lp_file_list_changed(void); +-const char *lp_ldap_machine_suffix(TALLOC_CTX *ctx); +-const char *lp_ldap_user_suffix(TALLOC_CTX *ctx); +-const char *lp_ldap_group_suffix(TALLOC_CTX *ctx); +-const char *lp_ldap_idmap_suffix(TALLOC_CTX *ctx); +-struct parm_struct; +-/* Return a pointer to a service by name. */ +-struct loadparm_service *lp_service(const char *pszServiceName); +-struct loadparm_service *lp_servicebynum(int snum); +-struct loadparm_service *lp_default_loadparm_service(void); +-void *lp_parm_ptr(struct loadparm_service *service, struct parm_struct *parm); +-void *lp_local_ptr_by_snum(int snum, struct parm_struct *parm); +-bool lp_do_parameter(int snum, const char *pszParmName, const char *pszParmValue); +-bool lp_set_cmdline(const char *pszParmName, const char *pszParmValue); +-bool dump_a_parameter(int snum, char *parm_name, FILE * f, bool isGlobal); +-bool lp_snum_ok(int iService); +-void lp_add_one_printer(const char *name, const char *comment, +- const char *location, void *pdata); +-bool lp_loaded(void); +-void lp_killunused(struct smbd_server_connection *sconn, +- bool (*snumused) (struct smbd_server_connection *, int)); +-void lp_kill_all_services(void); +-void lp_killservice(int iServiceIn); +-const char* server_role_str(uint32_t role); +-enum usershare_err parse_usershare_file(TALLOC_CTX *ctx, +- SMB_STRUCT_STAT *psbuf, +- const char *servicename, +- int snum, +- char **lines, +- int numlines, +- char **pp_sharepath, +- char **pp_comment, +- char **pp_cp_share_name, +- struct security_descriptor **ppsd, +- bool *pallow_guest); +-int load_usershare_service(const char *servicename); +-int load_usershare_shares(struct smbd_server_connection *sconn, +- bool (*snumused) (struct smbd_server_connection *, int)); +-void gfree_loadparm(void); +-bool lp_load_initial_only(const char *pszFname); +-bool lp_load_global(const char *file_name); +-bool lp_load_with_shares(const char *file_name); +-bool lp_load_client(const char *file_name); +-bool lp_load_global_no_reinit(const char *file_name); +-bool lp_load_no_reinit(const char *file_name); +-bool lp_load_client_no_reinit(const char *file_name); +-bool lp_load_with_registry_shares(const char *pszFname); +-int lp_numservices(void); +-void lp_dump(FILE *f, bool show_defaults, int maxtoprint); +-void lp_dump_one(FILE * f, bool show_defaults, int snum); +-int lp_servicenumber(const char *pszServiceName); +-const char *volume_label(TALLOC_CTX *ctx, int snum); +-bool lp_domain_master(void); +-bool lp_preferred_master(void); +-void lp_remove_service(int snum); +-void lp_copy_service(int snum, const char *new_name); +-int lp_default_server_announce(void); +-const char *lp_printername(TALLOC_CTX *ctx, +- const struct loadparm_substitution *lp_sub, +- int snum); +-void lp_set_logfile(const char *name); +-int lp_maxprintjobs(int snum); +-const char *lp_printcapname(void); +-bool lp_disable_spoolss( void ); +-void lp_set_spoolss_state( uint32_t state ); +-uint32_t lp_get_spoolss_state( void ); +-struct smb_signing_state; +-void set_use_sendfile(int snum, bool val); +-void lp_set_mangling_method(const char *new_method); +-bool lp_posix_pathnames(void); +-void lp_set_posix_pathnames(void); +-enum brl_flavour lp_posix_cifsu_locktype(files_struct *fsp); +-void lp_set_posix_default_cifsx_readwrite_locktype(enum brl_flavour val); +-int lp_min_receive_file_size(void); +-void widelinks_warning(int snum); +-const char *lp_ncalrpc_dir(void); +-void _lp_set_server_role(int server_role); +- +-/* The following definitions come from param/loadparm_ctx.c */ +- +-const struct loadparm_s3_helpers *loadparm_s3_helpers(void); +- +-/* The following definitions come from param/loadparm_server_role.c */ +- +-int lp_server_role(void); +-void set_server_role(void); +- +-/* The following definitions come from param/util.c */ +- +-uint32_t get_int_param( const char* param ); +-char* get_string_param( const char* param ); +- + /* The following definitions come from lib/server_contexts.c */ + struct tevent_context *global_event_context(void); + void global_event_context_free(void); +diff --git a/source3/param/loadparm.h b/source3/param/loadparm.h +new file mode 100644 +index 00000000000..7686877ccf1 +--- /dev/null ++++ b/source3/param/loadparm.h +@@ -0,0 +1,200 @@ ++/* ++ * ++ * Unix SMB/CIFS implementation. ++ * ++ * Type definitions for loadparm ++ * ++ * Copyright (c) 2020 Andreas Schneider ++ * This program is free software: you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License as published by ++ * the Free Software Foundation, either version 3 of the License, or ++ * (at your option) any later version. ++ * ++ * This program is distributed in the hope that it will be useful, ++ * but WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++ * GNU General Public License for more details. ++ * ++ * You should have received a copy of the GNU General Public License ++ * along with this program. If not, see . ++ */ ++ ++#ifndef _S3_LOADPARM_H ++#define _S3_LOADPARM_H ++ ++#include ++#include ++ ++/* Forward declarations */ ++typedef struct stat_ex SMB_STRUCT_STAT; ++typedef struct files_struct files_struct; ++struct smbd_server_connection; ++struct security_descriptor; ++ ++/* The following definitions come from param/loadparm.c */ ++ ++const struct loadparm_substitution *loadparm_s3_global_substitution(void); ++ ++char *lp_parm_substituted_string(TALLOC_CTX *mem_ctx, ++ const struct loadparm_substitution *lp_sub, ++ int snum, ++ const char *type, ++ const char *option, ++ const char *def); ++ ++char *lp_servicename(TALLOC_CTX *ctx, const struct loadparm_substitution *, int); ++const char *lp_const_servicename(int); ++bool lp_autoloaded(int); ++const char *lp_dnsdomain(void); ++int lp_winbind_max_domain_connections(void); ++bool lp_idmap_range(const char *domain_name, uint32_t *low, uint32_t *high); ++bool lp_idmap_default_range(uint32_t *low, uint32_t *high); ++const char *lp_idmap_backend(const char *domain_name); ++const char *lp_idmap_default_backend (void); ++int lp_security(void); ++int lp_client_max_protocol(void); ++int lp_client_ipc_min_protocol(void); ++int lp_client_ipc_max_protocol(void); ++int lp_client_ipc_signing(void); ++int lp_smb2_max_credits(void); ++int lp_cups_encrypt(void); ++bool lp_widelinks(int ); ++int lp_rpc_low_port(void); ++int lp_rpc_high_port(void); ++bool lp_lanman_auth(void); ++enum samba_weak_crypto lp_weak_crypto(void); ++ ++int lp_wi_scan_global_parametrics( ++ const char *regex, size_t max_matches, ++ bool (*cb)(const char *string, regmatch_t matches[], ++ void *private_data), ++ void *private_data); ++ ++const char *lp_parm_const_string(int snum, const char *type, const char *option, const char *def); ++struct loadparm_service; ++const char *lp_parm_const_string_service(struct loadparm_service *service, const char *type, ++ const char *option, const char *def); ++const char **lp_parm_string_list(int snum, const char *type, const char *option, const char **def); ++int lp_parm_int(int snum, const char *type, const char *option, int def); ++unsigned long lp_parm_ulong(int snum, const char *type, const char *option, unsigned long def); ++unsigned long long lp_parm_ulonglong(int snum, const char *type, ++ const char *option, ++ unsigned long long def); ++bool lp_parm_bool(int snum, const char *type, const char *option, bool def); ++struct enum_list; ++int lp_parm_enum(int snum, const char *type, const char *option, ++ const struct enum_list *_enum, int def); ++char *canonicalize_servicename(TALLOC_CTX *ctx, const char *src); ++bool lp_add_home(const char *pszHomename, int iDefaultService, ++ const char *user, const char *pszHomedir); ++int lp_add_service(const char *pszService, int iDefaultService); ++bool lp_add_printer(const char *pszPrintername, int iDefaultService); ++bool lp_parameter_is_valid(const char *pszParmName); ++bool lp_parameter_is_global(const char *pszParmName); ++bool lp_canonicalize_parameter(const char *parm_name, const char **canon_parm, ++ bool *inverse); ++bool lp_canonicalize_parameter_with_value(const char *parm_name, ++ const char *val, ++ const char **canon_parm, ++ const char **canon_val); ++void show_parameter_list(void); ++bool lp_invert_boolean(const char *str, const char **inverse_str); ++bool lp_canonicalize_boolean(const char *str, const char**canon_str); ++bool process_registry_service(const char *service_name); ++bool process_registry_shares(void); ++bool lp_config_backend_is_registry(void); ++bool lp_config_backend_is_file(void); ++bool lp_file_list_changed(void); ++const char *lp_ldap_machine_suffix(TALLOC_CTX *ctx); ++const char *lp_ldap_user_suffix(TALLOC_CTX *ctx); ++const char *lp_ldap_group_suffix(TALLOC_CTX *ctx); ++const char *lp_ldap_idmap_suffix(TALLOC_CTX *ctx); ++struct parm_struct; ++/* Return a pointer to a service by name. */ ++struct loadparm_service *lp_service(const char *pszServiceName); ++struct loadparm_service *lp_servicebynum(int snum); ++struct loadparm_service *lp_default_loadparm_service(void); ++void *lp_parm_ptr(struct loadparm_service *service, struct parm_struct *parm); ++void *lp_local_ptr_by_snum(int snum, struct parm_struct *parm); ++bool lp_do_parameter(int snum, const char *pszParmName, const char *pszParmValue); ++bool lp_set_cmdline(const char *pszParmName, const char *pszParmValue); ++bool dump_a_parameter(int snum, char *parm_name, FILE * f, bool isGlobal); ++bool lp_snum_ok(int iService); ++void lp_add_one_printer(const char *name, const char *comment, ++ const char *location, void *pdata); ++bool lp_loaded(void); ++void lp_killunused(struct smbd_server_connection *sconn, ++ bool (*snumused) (struct smbd_server_connection *, int)); ++void lp_kill_all_services(void); ++void lp_killservice(int iServiceIn); ++const char* server_role_str(uint32_t role); ++enum usershare_err parse_usershare_file(TALLOC_CTX *ctx, ++ SMB_STRUCT_STAT *psbuf, ++ const char *servicename, ++ int snum, ++ char **lines, ++ int numlines, ++ char **pp_sharepath, ++ char **pp_comment, ++ char **pp_cp_share_name, ++ struct security_descriptor **ppsd, ++ bool *pallow_guest); ++int load_usershare_service(const char *servicename); ++int load_usershare_shares(struct smbd_server_connection *sconn, ++ bool (*snumused) (struct smbd_server_connection *, int)); ++void gfree_loadparm(void); ++bool lp_load_initial_only(const char *pszFname); ++bool lp_load_global(const char *file_name); ++bool lp_load_with_shares(const char *file_name); ++bool lp_load_client(const char *file_name); ++bool lp_load_global_no_reinit(const char *file_name); ++bool lp_load_no_reinit(const char *file_name); ++bool lp_load_client_no_reinit(const char *file_name); ++bool lp_load_with_registry_shares(const char *pszFname); ++int lp_numservices(void); ++void lp_dump(FILE *f, bool show_defaults, int maxtoprint); ++void lp_dump_one(FILE * f, bool show_defaults, int snum); ++int lp_servicenumber(const char *pszServiceName); ++const char *volume_label(TALLOC_CTX *ctx, int snum); ++bool lp_domain_master(void); ++bool lp_preferred_master(void); ++void lp_remove_service(int snum); ++void lp_copy_service(int snum, const char *new_name); ++int lp_default_server_announce(void); ++const char *lp_printername(TALLOC_CTX *ctx, ++ const struct loadparm_substitution *lp_sub, ++ int snum); ++void lp_set_logfile(const char *name); ++int lp_maxprintjobs(int snum); ++const char *lp_printcapname(void); ++bool lp_disable_spoolss( void ); ++void lp_set_spoolss_state( uint32_t state ); ++uint32_t lp_get_spoolss_state( void ); ++struct smb_signing_state; ++void set_use_sendfile(int snum, bool val); ++void lp_set_mangling_method(const char *new_method); ++bool lp_posix_pathnames(void); ++void lp_set_posix_pathnames(void); ++enum brl_flavour lp_posix_cifsu_locktype(files_struct *fsp); ++void lp_set_posix_default_cifsx_readwrite_locktype(enum brl_flavour val); ++int lp_min_receive_file_size(void); ++void widelinks_warning(int snum); ++const char *lp_ncalrpc_dir(void); ++void _lp_set_server_role(int server_role); ++uint32_t lp_get_async_dns_timeout(void); ++ ++/* The following definitions come from param/loadparm_ctx.c */ ++ ++const struct loadparm_s3_helpers *loadparm_s3_helpers(void); ++ ++/* The following definitions come from param/loadparm_server_role.c */ ++ ++int lp_server_role(void); ++void set_server_role(void); ++ ++/* The following definitions come from param/util.c */ ++ ++uint32_t get_int_param( const char* param ); ++char *get_string_param( const char* param ); ++ ++#endif /* _S3_LOADPARM_H */ +-- +2.28.0 + + +From 076e6929c3c8d1dc161e7dacfc7fb7aeceb588bd Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 11 Aug 2020 10:41:07 +0200 +Subject: [PATCH 075/105] s3:lib: Move interface prototypes to own header file + +Signed-off-by: Andreas Schneider +Reviewed-by: Jeremy Allison + +Autobuild-User(master): Jeremy Allison +Autobuild-Date(master): Fri Oct 9 20:36:13 UTC 2020 on sn-devel-184 + +(cherry picked from commit 925cc9aafbe17cb2cbd89f468fac70f96ae89475) +--- + source3/include/proto.h | 21 +------------------ + source3/lib/interface.h | 46 +++++++++++++++++++++++++++++++++++++++++ + 2 files changed, 47 insertions(+), 20 deletions(-) + create mode 100644 source3/lib/interface.h + +diff --git a/source3/include/proto.h b/source3/include/proto.h +index b9a6cb7f116..1bbd8e9d526 100644 +--- a/source3/include/proto.h ++++ b/source3/include/proto.h +@@ -84,26 +84,7 @@ NTSTATUS vfs_at_fspcwd(TALLOC_CTX *mem_ctx, + struct connection_struct *conn, + struct files_struct **_fsp); + +-/* The following definitions come from lib/interface.c */ +- +-bool ismyaddr(const struct sockaddr *ip); +-bool ismyip_v4(struct in_addr ip); +-bool is_local_net(const struct sockaddr *from); +-void setup_linklocal_scope_id(struct sockaddr *pss); +-bool is_local_net_v4(struct in_addr from); +-int iface_count(void); +-int iface_count_v4_nl(void); +-const struct in_addr *first_ipv4_iface(void); +-struct interface *get_interface(int n); +-const struct sockaddr_storage *iface_n_sockaddr_storage(int n); +-const struct in_addr *iface_n_ip_v4(int n); +-const struct in_addr *iface_n_bcast_v4(int n); +-const struct sockaddr_storage *iface_n_bcast(int n); +-const struct sockaddr_storage *iface_ip(const struct sockaddr *ip); +-bool iface_local(const struct sockaddr *ip); +-void load_interfaces(void); +-void gfree_interfaces(void); +-bool interfaces_changed(void); ++#include "source3/lib/interface.h" + + /* The following definitions come from lib/ldap_debug_handler.c */ + +diff --git a/source3/lib/interface.h b/source3/lib/interface.h +new file mode 100644 +index 00000000000..f45435b4a81 +--- /dev/null ++++ b/source3/lib/interface.h +@@ -0,0 +1,46 @@ ++/* ++ * ++ * Unix SMB/CIFS implementation. ++ * ++ * Type definitions for interfaces ++ * ++ * Copyright (c) 2020 Andreas Schneider ++ * This program is free software: you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License as published by ++ * the Free Software Foundation, either version 3 of the License, or ++ * (at your option) any later version. ++ * ++ * This program is distributed in the hope that it will be useful, ++ * but WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++ * GNU General Public License for more details. ++ * ++ * You should have received a copy of the GNU General Public License ++ * along with this program. If not, see . ++ */ ++ ++#ifndef _INTERFACE_H ++#define _INTERFACE_H ++ ++#include ++ ++bool ismyaddr(const struct sockaddr *ip); ++bool ismyip_v4(struct in_addr ip); ++bool is_local_net(const struct sockaddr *from); ++void setup_linklocal_scope_id(struct sockaddr *pss); ++bool is_local_net_v4(struct in_addr from); ++int iface_count(void); ++int iface_count_v4_nl(void); ++const struct in_addr *first_ipv4_iface(void); ++struct interface *get_interface(int n); ++const struct sockaddr_storage *iface_n_sockaddr_storage(int n); ++const struct in_addr *iface_n_ip_v4(int n); ++const struct in_addr *iface_n_bcast_v4(int n); ++const struct sockaddr_storage *iface_n_bcast(int n); ++const struct sockaddr_storage *iface_ip(const struct sockaddr *ip); ++bool iface_local(const struct sockaddr *ip); ++void load_interfaces(void); ++void gfree_interfaces(void); ++bool interfaces_changed(void); ++ ++#endif /* _INTERFACE_H */ +-- +2.28.0 + + +From b6d36e462fe41f7b88bbf120831c3765c40ef326 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Fri, 7 Feb 2020 16:48:16 +0100 +Subject: [PATCH 076/105] idl: Add SID_SAMBA_SMB3 + +Signed-off-by: Andreas Schneider +Reviewed-by: Alexander Bokovoy +(cherry picked from commit 56879ec5876625346df89110f62d52e3fd5b8934) +--- + librpc/idl/security.idl | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/librpc/idl/security.idl b/librpc/idl/security.idl +index a92e8f1518e..06bf7449a70 100644 +--- a/librpc/idl/security.idl ++++ b/librpc/idl/security.idl +@@ -282,6 +282,9 @@ interface security + const string SID_SAMBA_UNIX_USER_OWNER = "S-1-22-1"; + const string SID_SAMBA_UNIX_GROUP_OWNER = "S-1-22-2"; + ++ /* Information passing via security token */ ++ const string SID_SAMBA_SMB3 = "S-1-22-1397571891"; ++ + /* SECURITY_NT_SERVICE */ + const string NAME_NT_SERVICE = "NT SERVICE"; + +-- +2.28.0 + + +From 3128ed8c26c13ccc068b5e50ae52604f5ffc9241 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Fri, 7 Feb 2020 16:48:29 +0100 +Subject: [PATCH 077/105] s3:smbd: Add SMB3 connection information to session + info + +Signed-off-by: Andreas Schneider +Reviewed-by: Alexander Bokovoy +(cherry picked from commit 905c2b9722a64ee57f3fbcff51e6bb591c6e3edc) +--- + source3/include/vfs.h | 1 + + source3/smbd/pipes.c | 82 +++++++++++++++++++++++++++++++++++++- + source3/smbd/smb2_server.c | 5 +++ + 3 files changed, 87 insertions(+), 1 deletion(-) + +diff --git a/source3/include/vfs.h b/source3/include/vfs.h +index d527f850628..c0d60636c31 100644 +--- a/source3/include/vfs.h ++++ b/source3/include/vfs.h +@@ -411,6 +411,7 @@ typedef struct files_struct { + bool use_ofd_locks : 1; + bool closing : 1; + bool lock_failure_seen : 1; ++ bool encryption_required : 1; + } fsp_flags; + + struct tevent_timer *update_write_time_event; +diff --git a/source3/smbd/pipes.c b/source3/smbd/pipes.c +index 2dd38bb7ab3..d51a3de9497 100644 +--- a/source3/smbd/pipes.c ++++ b/source3/smbd/pipes.c +@@ -30,13 +30,16 @@ + #include "smbd/globals.h" + #include "libcli/security/security.h" + #include "rpc_server/srv_pipe_hnd.h" ++#include "auth/auth_util.h" + + NTSTATUS open_np_file(struct smb_request *smb_req, const char *name, + struct files_struct **pfsp) + { ++ struct smbXsrv_connection *xconn = smb_req->xconn; + struct connection_struct *conn = smb_req->conn; + struct files_struct *fsp; + struct smb_filename *smb_fname = NULL; ++ struct auth_session_info *session_info = conn->session_info; + NTSTATUS status; + + status = file_new(smb_req, conn, &fsp); +@@ -68,10 +71,87 @@ NTSTATUS open_np_file(struct smb_request *smb_req, const char *name, + return status; + } + ++ if (smb_req->smb2req != NULL && smb_req->smb2req->was_encrypted) { ++ struct security_token *security_token = NULL; ++ uint16_t dialect = xconn->smb2.server.dialect; ++ uint16_t srv_smb_encrypt = 0x0002; ++ uint16_t cipher = xconn->smb2.server.cipher; ++ char smb3_sid_str[SID_MAX_SIZE]; ++ struct dom_sid smb3_dom_sid; ++ struct dom_sid smb3_sid; ++ uint32_t i; ++ bool ok; ++ int rc; ++ ++ session_info = copy_session_info(fsp, conn->session_info); ++ if (session_info == NULL) { ++ DBG_ERR("Failed to copy session info\n"); ++ file_free(smb_req, fsp); ++ return NT_STATUS_NO_MEMORY; ++ } ++ security_token = session_info->security_token; ++ ++ ok = dom_sid_parse(SID_SAMBA_SMB3, &smb3_dom_sid); ++ if (!ok) { ++ file_free(smb_req, fsp); ++ return NT_STATUS_BUFFER_TOO_SMALL; ++ } ++ ++ /* ++ * Security check: ++ * ++ * Make sure we don't have a SMB3 SID in the security token! ++ */ ++ for (i = 0; i < security_token->num_sids; i++) { ++ int cmp; ++ ++ cmp = dom_sid_compare_domain(&security_token->sids[i], ++ &smb3_dom_sid); ++ if (cmp == 0) { ++ DBG_ERR("ERROR: An SMB3 SID has already been " ++ "detected in the security token!\n"); ++ file_free(smb_req, fsp); ++ return NT_STATUS_ACCESS_DENIED; ++ } ++ } ++ ++ rc = snprintf(smb3_sid_str, ++ sizeof(smb3_sid_str), ++ "%s-%u-%u-%u", ++ SID_SAMBA_SMB3, ++ dialect, ++ srv_smb_encrypt, ++ cipher); ++ if (rc < 0) { ++ DBG_ERR("Buffer too small\n"); ++ file_free(smb_req, fsp); ++ return NT_STATUS_BUFFER_TOO_SMALL; ++ } ++ ++ ok = dom_sid_parse(smb3_sid_str, &smb3_sid); ++ if (!ok) { ++ DBG_ERR("Failed to parse SMB3 SID\n"); ++ file_free(smb_req, fsp); ++ return NT_STATUS_INVALID_PARAMETER; ++ } ++ ++ status = add_sid_to_array_unique(security_token, ++ &smb3_sid, ++ &security_token->sids, ++ &security_token->num_sids); ++ if (!NT_STATUS_IS_OK(status)) { ++ DBG_ERR("Failed to add SMB3 SID to security token\n"); ++ file_free(smb_req, fsp); ++ return status; ++ } ++ ++ fsp->fsp_flags.encryption_required = true; ++ } ++ + status = np_open(fsp, name, + conn->sconn->remote_address, + conn->sconn->local_address, +- conn->session_info, ++ session_info, + conn->sconn->ev_ctx, + conn->sconn->msg_ctx, + conn->sconn->dce_ctx, +diff --git a/source3/smbd/smb2_server.c b/source3/smbd/smb2_server.c +index cf9de185c1f..cd24b7d2ed5 100644 +--- a/source3/smbd/smb2_server.c ++++ b/source3/smbd/smb2_server.c +@@ -3232,6 +3232,11 @@ NTSTATUS smbd_smb2_request_dispatch(struct smbd_smb2_request *req) + return smbd_smb2_request_error(req, + NT_STATUS_FILE_CLOSED); + } ++ } else { ++ if (fsp->fsp_flags.encryption_required && !req->was_encrypted) { ++ return smbd_smb2_request_error(req, ++ NT_STATUS_ACCESS_DENIED); ++ } + } + } + +-- +2.28.0 + + +From 333ae30e7f8238c684d2a1aec2b0516369068a7e Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 12 Mar 2020 14:11:56 +0100 +Subject: [PATCH 078/105] librpc: Add dcerpc helper + dcerpc_is_transport_encrypted() + +Signed-off-by: Andreas Schneider +Reviewed-by: Alexander Bokovoy +(cherry picked from commit 8bbe5c8c94aaf75d715f558c363e5b2de49f7bf9) +--- + librpc/rpc/dcerpc_helper.c | 137 +++++++++++++++++++++++++++++++++++++ + librpc/rpc/dcerpc_helper.h | 26 +++++++ + librpc/wscript_build | 9 +++ + 3 files changed, 172 insertions(+) + create mode 100644 librpc/rpc/dcerpc_helper.c + create mode 100644 librpc/rpc/dcerpc_helper.h + +diff --git a/librpc/rpc/dcerpc_helper.c b/librpc/rpc/dcerpc_helper.c +new file mode 100644 +index 00000000000..c5443764628 +--- /dev/null ++++ b/librpc/rpc/dcerpc_helper.c +@@ -0,0 +1,137 @@ ++/* ++ * Copyright (c) 2020 Andreas Schneider ++ * ++ * This program is free software: you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License as published by ++ * the Free Software Foundation, either version 3 of the License, or ++ * (at your option) any later version. ++ * ++ * This program is distributed in the hope that it will be useful, ++ * but WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++ * GNU General Public License for more details. ++ * ++ * You should have received a copy of the GNU General Public License ++ * along with this program. If not, see . ++ */ ++ ++#include "includes.h" ++#include "librpc/gen_ndr/security.h" ++#include "librpc/gen_ndr/auth.h" ++#include "lib/crypto/gnutls_helpers.h" ++#include "libcli/security/dom_sid.h" ++#include "libcli/smb/smb2_constants.h" ++ ++#include "dcerpc_helper.h" ++ ++static bool smb3_sid_parse(const struct dom_sid *sid, ++ uint16_t *pdialect, ++ uint16_t *pencrypt, ++ uint16_t *pcipher) ++{ ++ uint16_t dialect; ++ uint16_t encrypt; ++ uint16_t cipher; ++ ++ if (sid->sub_auths[0] != 1397571891) { ++ return false; ++ } ++ ++ dialect = sid->sub_auths[1]; ++ if (dialect > 0x03ff) { ++ return false; ++ } ++ ++ encrypt = sid->sub_auths[2]; ++ if (encrypt > 0x0002) { ++ return false; ++ } ++ ++ cipher = sid->sub_auths[3]; ++ if (cipher > SMB2_ENCRYPTION_AES128_GCM) { ++ return false; ++ } ++ ++ if (pdialect != NULL) { ++ *pdialect = dialect; ++ } ++ ++ if (pencrypt != NULL) { ++ *pencrypt = encrypt; ++ } ++ ++ if (pcipher != NULL) { ++ *pcipher = cipher; ++ } ++ ++ return true; ++} ++ ++bool dcerpc_is_transport_encrypted(struct auth_session_info *session_info) ++{ ++ struct security_token *token = session_info->security_token; ++ struct dom_sid smb3_dom_sid; ++ const struct dom_sid *smb3_sid = NULL; ++ uint16_t dialect = 0; ++ uint16_t encrypt = 0; ++ uint16_t cipher = 0; ++ uint32_t i; ++ bool ok; ++ ++ ok = dom_sid_parse(SID_SAMBA_SMB3, &smb3_dom_sid); ++ if (!ok) { ++ return false; ++ } ++ ++ for (i = 0; i < token->num_sids; i++) { ++ int cmp; ++ ++ /* There is only one SMB3 SID allowed! */ ++ cmp = dom_sid_compare_domain(&token->sids[i], &smb3_dom_sid); ++ if (cmp == 0) { ++ if (smb3_sid == NULL) { ++ smb3_sid = &token->sids[i]; ++ } else { ++ DBG_ERR("ERROR: The SMB3 SID has been detected " ++ "multiple times\n"); ++ return false; ++ } ++ } ++ } ++ ++ if (smb3_sid == NULL) { ++ return false; ++ } ++ ++ ok = smb3_sid_parse(smb3_sid, &dialect, &encrypt, &cipher); ++ if (!ok) { ++ DBG_ERR("Failed to parse SMB3 SID!\n"); ++ return false; ++ } ++ ++ DBG_DEBUG("SMB SID - dialect: %#04x, encrypt: %#04x, cipher: %#04x\n", ++ dialect, ++ encrypt, ++ cipher); ++ ++ if (dialect < SMB3_DIALECT_REVISION_300) { ++ DBG_DEBUG("Invalid SMB3 dialect!\n"); ++ return false; ++ } ++ ++ if (encrypt != DCERPC_SMB_ENCRYPTION_REQUIRED) { ++ DBG_DEBUG("Invalid SMB3 encryption!\n"); ++ return false; ++ } ++ ++ switch (cipher) { ++ case SMB2_ENCRYPTION_AES128_CCM: ++ case SMB2_ENCRYPTION_AES128_GCM: ++ break; ++ default: ++ DBG_DEBUG("Invalid SMB3 cipher!\n"); ++ return false; ++ } ++ ++ return true; ++} +diff --git a/librpc/rpc/dcerpc_helper.h b/librpc/rpc/dcerpc_helper.h +new file mode 100644 +index 00000000000..c0f09ee494e +--- /dev/null ++++ b/librpc/rpc/dcerpc_helper.h +@@ -0,0 +1,26 @@ ++/* ++ * Copyright (c) 2020 Andreas Schneider ++ * ++ * This program is free software: you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License as published by ++ * the Free Software Foundation, either version 3 of the License, or ++ * (at your option) any later version. ++ * ++ * This program is distributed in the hope that it will be useful, ++ * but WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++ * GNU General Public License for more details. ++ * ++ * You should have received a copy of the GNU General Public License ++ * along with this program. If not, see . ++ */ ++ ++#ifndef _DCERPC_HELPER_H ++#define _DCERPC_HELPER_H ++ ++#define DCERPC_SMB_ENCRYPTION_OFF 0x0000 ++#define DCERPC_SMB_ENCRYPTION_REQUIRED 0x0002 ++ ++bool dcerpc_is_transport_encrypted(struct auth_session_info *session_info); ++ ++#endif /* _DCERPC_HELPER_H */ +diff --git a/librpc/wscript_build b/librpc/wscript_build +index 27b180fa63d..109a1834841 100644 +--- a/librpc/wscript_build ++++ b/librpc/wscript_build +@@ -669,6 +669,15 @@ bld.SAMBA_LIBRARY('dcerpc-server-core', + autoproto='rpc/dcesrv_core_proto.h', + vnum='0.0.1') + ++bld.SAMBA_SUBSYSTEM('DCERPC_HELPER', ++ source='rpc/dcerpc_helper.c', ++ public_deps=''' ++ samba-hostconfig ++ samba-security ++ gnutls ++ GNUTLS_HELPERS ++ ''') ++ + bld.SAMBA_SUBSYSTEM('NDR_WINBIND', + source='gen_ndr/ndr_winbind.c', + public_deps='ndr NDR_LSA' +-- +2.28.0 + + +From 4a2e7909f3a40c6ab82c045a5a54f8604a6f1dd2 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Fri, 28 Aug 2020 16:31:17 +0200 +Subject: [PATCH 079/105] s3:smbd: Use defines to set 'srv_smb_encrypt' + +Signed-off-by: Andreas Schneider +Reviewed-by: Alexander Bokovoy +(cherry picked from commit 5f1a73be6311c68a21a550c0de5078baeb78f4ee) +--- + source3/smbd/pipes.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/source3/smbd/pipes.c b/source3/smbd/pipes.c +index d51a3de9497..785cbb23b5f 100644 +--- a/source3/smbd/pipes.c ++++ b/source3/smbd/pipes.c +@@ -31,6 +31,7 @@ + #include "libcli/security/security.h" + #include "rpc_server/srv_pipe_hnd.h" + #include "auth/auth_util.h" ++#include "librpc/rpc/dcerpc_helper.h" + + NTSTATUS open_np_file(struct smb_request *smb_req, const char *name, + struct files_struct **pfsp) +@@ -74,7 +75,7 @@ NTSTATUS open_np_file(struct smb_request *smb_req, const char *name, + if (smb_req->smb2req != NULL && smb_req->smb2req->was_encrypted) { + struct security_token *security_token = NULL; + uint16_t dialect = xconn->smb2.server.dialect; +- uint16_t srv_smb_encrypt = 0x0002; ++ uint16_t srv_smb_encrypt = DCERPC_SMB_ENCRYPTION_REQUIRED; + uint16_t cipher = xconn->smb2.server.cipher; + char smb3_sid_str[SID_MAX_SIZE]; + struct dom_sid smb3_dom_sid; +-- +2.28.0 + + +From 69b9e46fa29adcf5a478a240ea6980bf7d97ae4b Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 12 Nov 2019 16:56:45 +0100 +Subject: [PATCH 080/105] s3:rpc_server: Allow to use RC4 for setting passwords + +Signed-off-by: Andreas Schneider +Reviewed-by: Alexander Bokovoy +(cherry picked from commit c6a21e1897985f267bcfc681179cea95165c3c57) +--- + source3/rpc_server/samr/srv_samr_chgpasswd.c | 3 + + source3/rpc_server/samr/srv_samr_nt.c | 78 +++++++++++++++++++- + source3/rpc_server/wscript_build | 2 +- + 3 files changed, 81 insertions(+), 2 deletions(-) + +diff --git a/source3/rpc_server/samr/srv_samr_chgpasswd.c b/source3/rpc_server/samr/srv_samr_chgpasswd.c +index cb9837ecf01..e326745169e 100644 +--- a/source3/rpc_server/samr/srv_samr_chgpasswd.c ++++ b/source3/rpc_server/samr/srv_samr_chgpasswd.c +@@ -769,11 +769,13 @@ static NTSTATUS check_oem_password(const char *user, + .size = 16, + }; + ++ GNUTLS_FIPS140_SET_LAX_MODE(); + rc = gnutls_cipher_init(&cipher_hnd, + GNUTLS_CIPHER_ARCFOUR_128, + &enc_key, + NULL); + if (rc < 0) { ++ GNUTLS_FIPS140_SET_STRICT_MODE(); + return gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); + } + +@@ -781,6 +783,7 @@ static NTSTATUS check_oem_password(const char *user, + password_encrypted, + 516); + gnutls_cipher_deinit(cipher_hnd); ++ GNUTLS_FIPS140_SET_STRICT_MODE(); + if (rc < 0) { + return gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); + } +diff --git a/source3/rpc_server/samr/srv_samr_nt.c b/source3/rpc_server/samr/srv_samr_nt.c +index 5ffc3331185..77cb18b6a88 100644 +--- a/source3/rpc_server/samr/srv_samr_nt.c ++++ b/source3/rpc_server/samr/srv_samr_nt.c +@@ -46,6 +46,8 @@ + #include "rpc_server/srv_access_check.h" + #include "../lib/tsocket/tsocket.h" + #include "lib/util/base64.h" ++#include "param/param.h" ++#include "librpc/rpc/dcerpc_helper.h" + + #include "lib/crypto/gnutls_helpers.h" + #include +@@ -1887,6 +1889,7 @@ NTSTATUS _samr_ChangePasswordUser2(struct pipes_struct *p, + char *user_name = NULL; + char *rhost; + const char *wks = NULL; ++ bool encrypted; + + DEBUG(5,("_samr_ChangePasswordUser2: %d\n", __LINE__)); + +@@ -1915,6 +1918,12 @@ NTSTATUS _samr_ChangePasswordUser2(struct pipes_struct *p, + return NT_STATUS_NO_MEMORY; + } + ++ encrypted = dcerpc_is_transport_encrypted(p->session_info); ++ if (lp_weak_crypto() == SAMBA_WEAK_CRYPTO_DISALLOWED && ++ !encrypted) { ++ return NT_STATUS_ACCESS_DENIED; ++ } ++ + /* + * UNIX username case mangling not required, pass_oem_change + * is case insensitive. +@@ -1948,6 +1957,7 @@ NTSTATUS _samr_OemChangePasswordUser2(struct pipes_struct *p, + char *user_name = NULL; + const char *wks = NULL; + char *rhost; ++ bool encrypted; + + DEBUG(5,("_samr_OemChangePasswordUser2: %d\n", __LINE__)); + +@@ -1985,6 +1995,12 @@ NTSTATUS _samr_OemChangePasswordUser2(struct pipes_struct *p, + return NT_STATUS_NO_MEMORY; + } + ++ encrypted = dcerpc_is_transport_encrypted(p->session_info); ++ if (lp_weak_crypto() == SAMBA_WEAK_CRYPTO_DISALLOWED && ++ !encrypted) { ++ return NT_STATUS_ACCESS_DENIED; ++ } ++ + status = pass_oem_change(user_name, + rhost, + r->in.password->data, +@@ -5200,8 +5216,13 @@ NTSTATUS _samr_SetUserInfo(struct pipes_struct *p, + char *rhost; + DATA_BLOB session_key; + struct dom_sid_buf buf; ++ struct loadparm_context *lp_ctx = NULL; ++ bool encrypted; + +- DEBUG(5,("_samr_SetUserInfo: %d\n", __LINE__)); ++ lp_ctx = loadparm_init_s3(p->mem_ctx, loadparm_s3_helpers()); ++ if (lp_ctx == NULL) { ++ return NT_STATUS_NO_MEMORY; ++ } + + /* This is tricky. A WinXP domain join sets + (SAMR_USER_ACCESS_SET_PASSWORD|SAMR_USER_ACCESS_SET_ATTRIBUTES|SAMR_USER_ACCESS_GET_ATTRIBUTES) +@@ -5390,13 +5411,27 @@ NTSTATUS _samr_SetUserInfo(struct pipes_struct *p, + break; + + case 23: ++ encrypted = ++ dcerpc_is_transport_encrypted(p->session_info); ++ if (lp_weak_crypto() == SAMBA_WEAK_CRYPTO_DISALLOWED && ++ !encrypted) { ++ status = NT_STATUS_ACCESS_DENIED; ++ break; ++ } ++ + status = session_extract_session_key(p->session_info, &session_key, KEY_USE_16BYTES); + if(!NT_STATUS_IS_OK(status)) { + break; + } ++ /* ++ * This can be allowed as it requires a session key ++ * which we only have if we have a SMB session. ++ */ ++ GNUTLS_FIPS140_SET_LAX_MODE(); + status = arc4_decrypt_data(session_key, + info->info23.password.data, + 516); ++ GNUTLS_FIPS140_SET_STRICT_MODE(); + if(!NT_STATUS_IS_OK(status)) { + break; + } +@@ -5412,14 +5447,27 @@ NTSTATUS _samr_SetUserInfo(struct pipes_struct *p, + break; + + case 24: ++ encrypted = ++ dcerpc_is_transport_encrypted(p->session_info); ++ if (lp_weak_crypto() == SAMBA_WEAK_CRYPTO_DISALLOWED && ++ !encrypted) { ++ status = NT_STATUS_ACCESS_DENIED; ++ break; ++ } + + status = session_extract_session_key(p->session_info, &session_key, KEY_USE_16BYTES); + if(!NT_STATUS_IS_OK(status)) { + break; + } ++ /* ++ * This can be allowed as it requires a session key ++ * which we only have if we have a SMB session. ++ */ ++ GNUTLS_FIPS140_SET_LAX_MODE(); + status = arc4_decrypt_data(session_key, + info->info24.password.data, + 516); ++ GNUTLS_FIPS140_SET_STRICT_MODE(); + if(!NT_STATUS_IS_OK(status)) { + break; + } +@@ -5434,12 +5482,26 @@ NTSTATUS _samr_SetUserInfo(struct pipes_struct *p, + break; + + case 25: ++ encrypted = ++ dcerpc_is_transport_encrypted(p->session_info); ++ if (lp_weak_crypto() == SAMBA_WEAK_CRYPTO_DISALLOWED && ++ !encrypted) { ++ status = NT_STATUS_ACCESS_DENIED; ++ break; ++ } ++ + status = session_extract_session_key(p->session_info, &session_key, KEY_USE_16BYTES); + if(!NT_STATUS_IS_OK(status)) { + break; + } ++ /* ++ * This can be allowed as it requires a session key ++ * which we only have if we have a SMB session. ++ */ ++ GNUTLS_FIPS140_SET_LAX_MODE(); + status = decode_rc4_passwd_buffer(&session_key, + &info->info25.password); ++ GNUTLS_FIPS140_SET_STRICT_MODE(); + if (!NT_STATUS_IS_OK(status)) { + break; + } +@@ -5454,12 +5516,26 @@ NTSTATUS _samr_SetUserInfo(struct pipes_struct *p, + break; + + case 26: ++ encrypted = ++ dcerpc_is_transport_encrypted(p->session_info); ++ if (lp_weak_crypto() == SAMBA_WEAK_CRYPTO_DISALLOWED && ++ !encrypted) { ++ status = NT_STATUS_ACCESS_DENIED; ++ break; ++ } ++ + status = session_extract_session_key(p->session_info, &session_key, KEY_USE_16BYTES); + if(!NT_STATUS_IS_OK(status)) { + break; + } ++ /* ++ * This can be allowed as it requires a session key ++ * which we only have if we have a SMB session. ++ */ ++ GNUTLS_FIPS140_SET_LAX_MODE(); + status = decode_rc4_passwd_buffer(&session_key, + &info->info26.password); ++ GNUTLS_FIPS140_SET_STRICT_MODE(); + if (!NT_STATUS_IS_OK(status)) { + break; + } +diff --git a/source3/rpc_server/wscript_build b/source3/rpc_server/wscript_build +index 2af02ad6fa8..eb91ac09384 100644 +--- a/source3/rpc_server/wscript_build ++++ b/source3/rpc_server/wscript_build +@@ -85,7 +85,7 @@ bld.SAMBA3_SUBSYSTEM('RPC_SAMR', + source='''samr/srv_samr_nt.c + samr/srv_samr_util.c + samr/srv_samr_chgpasswd.c''', +- deps='PLAINTEXT_AUTH SRV_ACCESS_CHECK') ++ deps='PLAINTEXT_AUTH SRV_ACCESS_CHECK DCERPC_HELPER') + + bld.SAMBA3_SUBSYSTEM('RPC_SPOOLSS', + source='''spoolss/srv_spoolss_nt.c +-- +2.28.0 + + +From 110323b646715aabd4468d70773c2d94968f2e99 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Fri, 15 Nov 2019 13:49:40 +0100 +Subject: [PATCH 081/105] s4:rpc_server: Allow to use RC4 for setting passwords + +Signed-off-by: Andreas Schneider +Reviewed-by: Alexander Bokovoy +(cherry picked from commit a9c532c6d3e85fbe49b7040254cfc66ab54074bc) +--- + source4/rpc_server/samr/samr_password.c | 30 +++++++++++++++++++++++++ + source4/rpc_server/wscript_build | 2 +- + 2 files changed, 31 insertions(+), 1 deletion(-) + +diff --git a/source4/rpc_server/samr/samr_password.c b/source4/rpc_server/samr/samr_password.c +index 52a644176e2..83b104fbd0e 100644 +--- a/source4/rpc_server/samr/samr_password.c ++++ b/source4/rpc_server/samr/samr_password.c +@@ -31,6 +31,8 @@ + #include "../lib/util/util_ldb.h" + #include "rpc_server/samr/proto.h" + #include "auth/auth_sam.h" ++#include "lib/param/loadparm.h" ++#include "librpc/rpc/dcerpc_helper.h" + + #include "lib/crypto/gnutls_helpers.h" + #include +@@ -129,6 +131,8 @@ NTSTATUS dcesrv_samr_OemChangePasswordUser2(struct dcesrv_call_state *dce_call, + struct dom_sid *user_objectSid = NULL; + gnutls_cipher_hd_t cipher_hnd = NULL; + gnutls_datum_t lm_session_key; ++ struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx; ++ bool encrypted; + int rc; + + if (pwbuf == NULL) { +@@ -144,6 +148,12 @@ NTSTATUS dcesrv_samr_OemChangePasswordUser2(struct dcesrv_call_state *dce_call, + return NT_STATUS_ACCESS_DISABLED_BY_POLICY_OTHER; + } + ++ encrypted = dcerpc_is_transport_encrypted(session_info); ++ if (lpcfg_weak_crypto(lp_ctx) == SAMBA_WEAK_CRYPTO_DISALLOWED && ++ !encrypted) { ++ return NT_STATUS_ACCESS_DENIED; ++ } ++ + /* Connect to a SAMDB with system privileges for fetching the old pw + * hashes. */ + sam_ctx = samdb_connect(mem_ctx, +@@ -188,11 +198,13 @@ NTSTATUS dcesrv_samr_OemChangePasswordUser2(struct dcesrv_call_state *dce_call, + .size = sizeof(lm_pwd->hash), + }; + ++ GNUTLS_FIPS140_SET_LAX_MODE(); + rc = gnutls_cipher_init(&cipher_hnd, + GNUTLS_CIPHER_ARCFOUR_128, + &lm_session_key, + NULL); + if (rc < 0) { ++ GNUTLS_FIPS140_SET_STRICT_MODE(); + status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); + goto failed; + } +@@ -201,6 +213,7 @@ NTSTATUS dcesrv_samr_OemChangePasswordUser2(struct dcesrv_call_state *dce_call, + pwbuf->data, + 516); + gnutls_cipher_deinit(cipher_hnd); ++ GNUTLS_FIPS140_SET_STRICT_MODE(); + if (rc < 0) { + status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); + goto failed; +@@ -607,7 +620,17 @@ NTSTATUS samr_set_password(struct dcesrv_call_state *dce_call, + DATA_BLOB session_key = data_blob(NULL, 0); + gnutls_cipher_hd_t cipher_hnd = NULL; + gnutls_datum_t _session_key; ++ struct auth_session_info *session_info = ++ dcesrv_call_session_info(dce_call); ++ struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx; + int rc; ++ bool encrypted; ++ ++ encrypted = dcerpc_is_transport_encrypted(session_info); ++ if (lpcfg_weak_crypto(lp_ctx) == SAMBA_WEAK_CRYPTO_DISALLOWED && ++ !encrypted) { ++ return NT_STATUS_ACCESS_DENIED; ++ } + + nt_status = dcesrv_transport_session_key(dce_call, &session_key); + if (!NT_STATUS_IS_OK(nt_status)) { +@@ -621,11 +644,17 @@ NTSTATUS samr_set_password(struct dcesrv_call_state *dce_call, + .size = session_key.length, + }; + ++ /* ++ * This is safe to support as we only have a session key ++ * over a SMB connection which we force to be encrypted. ++ */ ++ GNUTLS_FIPS140_SET_LAX_MODE(); + rc = gnutls_cipher_init(&cipher_hnd, + GNUTLS_CIPHER_ARCFOUR_128, + &_session_key, + NULL); + if (rc < 0) { ++ GNUTLS_FIPS140_SET_STRICT_MODE(); + nt_status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); + goto out; + } +@@ -634,6 +663,7 @@ NTSTATUS samr_set_password(struct dcesrv_call_state *dce_call, + pwbuf->data, + 516); + gnutls_cipher_deinit(cipher_hnd); ++ GNUTLS_FIPS140_SET_STRICT_MODE(); + if (rc < 0) { + nt_status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); + goto out; +diff --git a/source4/rpc_server/wscript_build b/source4/rpc_server/wscript_build +index de55ad6239a..c9c1978f223 100644 +--- a/source4/rpc_server/wscript_build ++++ b/source4/rpc_server/wscript_build +@@ -87,7 +87,7 @@ bld.SAMBA_MODULE('dcesrv_samr', + autoproto='samr/proto.h', + subsystem='dcerpc_server', + init_function='dcerpc_server_samr_init', +- deps='samdb DCERPC_COMMON ndr-standard auth4_sam GNUTLS_HELPERS' ++ deps='samdb DCERPC_COMMON ndr-standard auth4_sam GNUTLS_HELPERS DCERPC_HELPER' + ) + + +-- +2.28.0 + + +From 6353a991bc6d35b9468867c0e809e752b060da9b Mon Sep 17 00:00:00 2001 +From: Isaac Boukris +Date: Thu, 20 Aug 2020 12:45:49 +0200 +Subject: [PATCH 082/105] lib:crypto: Add py binding for set_relax/strict fips + mode + +Signed-off-by: Isaac Boukris +Reviewed-by: Andreas Schneider +Reviewed-by: Alexander Bokovoy +(cherry picked from commit 32d4c75d6cbf9153068a0487347097707afb356a) +--- + lib/crypto/py_crypto.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/lib/crypto/py_crypto.c b/lib/crypto/py_crypto.c +index 32b946eee8f..ad18d3ada0f 100644 +--- a/lib/crypto/py_crypto.c ++++ b/lib/crypto/py_crypto.c +@@ -24,6 +24,7 @@ + + #include + #include ++#include "lib/crypto/gnutls_helpers.h" + + static PyObject *py_crypto_arcfour_crypt_blob(PyObject *module, PyObject *args) + { +@@ -85,12 +86,27 @@ static PyObject *py_crypto_arcfour_crypt_blob(PyObject *module, PyObject *args) + return result; + } + ++static PyObject *py_crypto_set_relax_mode(PyObject *module) ++{ ++ GNUTLS_FIPS140_SET_LAX_MODE(); ++ ++ Py_RETURN_NONE; ++} ++ ++static PyObject *py_crypto_set_strict_mode(PyObject *module) ++{ ++ GNUTLS_FIPS140_SET_STRICT_MODE(); ++ ++ Py_RETURN_NONE; ++} + + static const char py_crypto_arcfour_crypt_blob_doc[] = "arcfour_crypt_blob(data, key)\n" + "Encrypt the data with RC4 algorithm using the key"; + + static PyMethodDef py_crypto_methods[] = { + { "arcfour_crypt_blob", (PyCFunction)py_crypto_arcfour_crypt_blob, METH_VARARGS, py_crypto_arcfour_crypt_blob_doc }, ++ { "set_relax_mode", (PyCFunction)py_crypto_set_relax_mode, METH_NOARGS, "Set fips to relax mode" }, ++ { "set_strict_mode", (PyCFunction)py_crypto_set_strict_mode, METH_NOARGS, "Set fips to strict mode" }, + {0}, + }; + +-- +2.28.0 + + +From 525072939b9292a1744f929803a9597b5f725f9a Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 28 Oct 2020 17:05:36 +0100 +Subject: [PATCH 083/105] s4:param: Add 'weak crypto' getter to pyparam + +Signed-off-by: Andreas Schneider +Reviewed-by: Alexander Bokovoy +(cherry picked from commit 7d54e4b49c235dc571f47d15e6b0a6fa63340773) +--- + source4/param/pyparam.c | 22 ++++++++++++++++++++++ + 1 file changed, 22 insertions(+) + +diff --git a/source4/param/pyparam.c b/source4/param/pyparam.c +index 4023fac4dd6..e15592b5743 100644 +--- a/source4/param/pyparam.c ++++ b/source4/param/pyparam.c +@@ -463,6 +463,23 @@ static PyObject *py_lp_ctx_config_file(PyObject *self, void *closure) + return PyUnicode_FromString(configfile); + } + ++static PyObject *py_lp_ctx_weak_crypto(PyObject *self, void *closure) ++{ ++ enum samba_weak_crypto weak_crypto = ++ lpcfg_weak_crypto(PyLoadparmContext_AsLoadparmContext(self)); ++ ++ switch(weak_crypto) { ++ case SAMBA_WEAK_CRYPTO_UNKNOWN: ++ Py_RETURN_NONE; ++ case SAMBA_WEAK_CRYPTO_ALLOWED: ++ return PyUnicode_FromString("allowed"); ++ case SAMBA_WEAK_CRYPTO_DISALLOWED: ++ return PyUnicode_FromString("disallowed"); ++ } ++ ++ Py_RETURN_NONE; ++} ++ + static PyGetSetDef py_lp_ctx_getset[] = { + { + .name = discard_const_p(char, "default_service"), +@@ -473,6 +490,11 @@ static PyGetSetDef py_lp_ctx_getset[] = { + .get = (getter)py_lp_ctx_config_file, + .doc = discard_const_p(char, "Name of last config file that was loaded.") + }, ++ { ++ .name = discard_const_p(char, "weak_crypto"), ++ .get = (getter)py_lp_ctx_weak_crypto, ++ .doc = discard_const_p(char, "If weak crypto is allowed.") ++ }, + { .name = NULL } + }; + +-- +2.28.0 + + +From c7dfaf75a8f8bdb18c42325c470bdee8e600d930 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 21 Oct 2020 10:09:22 +0200 +Subject: [PATCH 084/105] python:tests: Add SAMR password change tests for fips + +Signed-off-by: Andreas Schneider +Reviewed-by: Alexander Bokovoy +(cherry picked from commit 9a3ba502d8193b25799ef92917efafd52de2e8c2) +--- + .../tests/dcerpc/samr_change_password.py | 188 ++++++++++++++++++ + selftest/tests.py | 2 + + 2 files changed, 190 insertions(+) + create mode 100644 python/samba/tests/dcerpc/samr_change_password.py + +diff --git a/python/samba/tests/dcerpc/samr_change_password.py b/python/samba/tests/dcerpc/samr_change_password.py +new file mode 100644 +index 00000000000..109eeea98cc +--- /dev/null ++++ b/python/samba/tests/dcerpc/samr_change_password.py +@@ -0,0 +1,188 @@ ++# Unix SMB/CIFS implementation. ++# ++# Copyright © 2020 Andreas Schneider ++# ++# This program is free software; you can redistribute it and/or modify ++# it under the terms of the GNU General Public License as published by ++# the Free Software Foundation; either version 3 of the License, or ++# (at your option) any later version. ++# ++# This program is distributed in the hope that it will be useful, ++# but WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++# GNU General Public License for more details. ++# ++# You should have received a copy of the GNU General Public License ++# along with this program. If not, see . ++# ++ ++"""Tests for samba.dcerpc.samr.password""" ++ ++import os ++import ctypes ++import samba.tests ++ ++from samba import crypto, generate_random_password, generate_random_bytes, ntstatus ++from samba.auth import system_session ++from samba.credentials import Credentials ++from samba.credentials import SMB_ENCRYPTION_REQUIRED ++from samba.dcerpc import samr, security, lsa ++from samba.samdb import SamDB ++from samba.tests import RpcInterfaceTestCase ++ ++ ++class SamrPasswordTests(RpcInterfaceTestCase): ++ def setUp(self): ++ super(SamrPasswordTests, self).setUp() ++ self.open_samdb() ++ ++ self.create_user_account(10000) ++ ++ self.remote_server = samba.tests.env_get_var_value('SERVER') ++ self.remote_domain = samba.tests.env_get_var_value('DOMAIN') ++ self.remote_user = samba.tests.env_get_var_value('USERNAME') ++ self.remote_password = samba.tests.env_get_var_value('PASSWORD') ++ self.remote_binding_string = "ncacn_np:%s[krb5]" % (self.remote_server) ++ ++ self.remote_creds = Credentials() ++ self.remote_creds.guess(self.lp) ++ self.remote_creds.set_username(self.remote_user) ++ self.remote_creds.set_password(self.remote_password) ++ ++ def tearDown(self): ++ super(SamrPasswordTests, self).tearDown() ++ ++ samr.Close(self.user_handle) ++ samr.Close(self.domain_handle) ++ samr.Close(self.handle) ++ ++ samba.tests.delete_force(self.samdb, self.user_dn) ++ ++ # ++ # Open the samba database ++ # ++ def open_samdb(self): ++ self.lp = samba.tests.env_loadparm() ++ ++ self.local_creds = Credentials() ++ self.local_creds.guess(self.lp) ++ self.session = system_session() ++ self.samdb = SamDB(session_info=self.session, ++ credentials=self.local_creds, ++ lp=self.lp) ++ ++ # ++ # Open a SAMR Domain handle ++ # ++ def open_domain_handle(self): ++ self.handle = self.conn.Connect2(None, ++ security.SEC_FLAG_MAXIMUM_ALLOWED) ++ ++ self.domain_sid = self.conn.LookupDomain(self.handle, ++ lsa.String(self.remote_domain)) ++ ++ self.domain_handle = self.conn.OpenDomain(self.handle, ++ security.SEC_FLAG_MAXIMUM_ALLOWED, ++ self.domain_sid) ++ ++ def open_user_handle(self): ++ name = lsa.String(self.user_name) ++ ++ rids = self.conn.LookupNames(self.domain_handle, [name]) ++ ++ self.user_handle = self.conn.OpenUser(self.domain_handle, ++ security.SEC_FLAG_MAXIMUM_ALLOWED, ++ rids[0].ids[0]) ++ # ++ # Create a test user account ++ # ++ def create_user_account(self, user_id): ++ self.user_name = ("SAMR_USER_%d" % user_id) ++ self.user_pass = generate_random_password(32, 32) ++ self.user_dn = "cn=%s,cn=users,%s" % (self.user_name, self.samdb.domain_dn()) ++ ++ samba.tests.delete_force(self.samdb, self.user_dn) ++ ++ self.samdb.newuser(self.user_name, ++ self.user_pass, ++ description="Password for " + self.user_name + " is " + self.user_pass, ++ givenname=self.user_name, ++ surname=self.user_name) ++ ++ ++ def init_samr_CryptPassword(self, password, session_key): ++ ++ def encode_pw_buffer(password): ++ data = bytearray([0] * 516) ++ ++ p = samba.string_to_byte_array(password.encode('utf-16-le')) ++ plen = len(p) ++ ++ b = generate_random_bytes(512 - plen) ++ ++ i = 512 - plen ++ data[0:i] = b ++ data[i:i+plen] = p ++ data[512:516] = plen.to_bytes(4, byteorder='little') ++ ++ return bytes(data) ++ ++ # This is a test, so always allow to encrypt using RC4 ++ try: ++ crypto.set_relax_mode() ++ encrypted_blob = samba.arcfour_encrypt(session_key, encode_pw_buffer(password)) ++ finally: ++ crypto.set_strict_mode() ++ ++ out_blob = samr.CryptPassword() ++ out_blob.data = list(encrypted_blob) ++ ++ return out_blob ++ ++ ++ def test_setUserInfo2_Password(self, password='P@ssw0rd'): ++ self.conn = samr.samr(self.remote_binding_string, ++ self.get_loadparm(), ++ self.remote_creds) ++ self.open_domain_handle() ++ self.open_user_handle() ++ ++ password='P@ssw0rd' ++ ++ level = 24 ++ info = samr.UserInfo24() ++ ++ info.password_expired = 0 ++ info.password = self.init_samr_CryptPassword(password, self.conn.session_key) ++ ++ # If the server is in FIPS mode, it should reject the password change! ++ try: ++ self.conn.SetUserInfo2(self.user_handle, level, info) ++ except samba.NTSTATUSError as e: ++ code = ctypes.c_uint32(e.args[0]).value ++ print(code) ++ if ((code == ntstatus.NT_STATUS_ACCESS_DENIED) and ++ (self.lp.weak_crypto == 'disallowed')): ++ pass ++ else: ++ raise ++ ++ ++ def test_setUserInfo2_Password_Encrypted(self, password='P@ssw0rd'): ++ self.remote_creds.set_smb_encryption(SMB_ENCRYPTION_REQUIRED) ++ ++ self.conn = samr.samr(self.remote_binding_string, ++ self.get_loadparm(), ++ self.remote_creds) ++ self.open_domain_handle() ++ self.open_user_handle() ++ ++ password='P@ssw0rd' ++ ++ level = 24 ++ info = samr.UserInfo24() ++ ++ info.password_expired = 0 ++ info.password = self.init_samr_CryptPassword(password, self.conn.session_key) ++ ++ self.conn.SetUserInfo2(self.user_handle, level, info) +diff --git a/selftest/tests.py b/selftest/tests.py +index adcb5b53189..86cab3f8046 100644 +--- a/selftest/tests.py ++++ b/selftest/tests.py +@@ -93,6 +93,8 @@ planpythontestsuite( + os.path.join(samba4srcdir, "..", "third_party", "waf")]) + planpythontestsuite("fileserver", "samba.tests.smbd_fuzztest") + planpythontestsuite("nt4_dc_smb1", "samba.tests.dcerpc.binding") ++for env in [ 'ad_dc:local', 'ad_dc_fips:local' ]: ++ planpythontestsuite(env, "samba.tests.dcerpc.samr_change_password") + + + def cmdline(script, *args): +-- +2.28.0 + + +From 9dfef9d7129babedfdc0fddd60f76859f44fe7c1 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 21 Oct 2020 10:09:22 +0200 +Subject: [PATCH 085/105] python:tests: Add SAMR password change tests for fips + +Signed-off-by: Andreas Schneider +Reviewed-by: Alexander Bokovoy + +Autobuild-User(master): Andreas Schneider +Autobuild-Date(master): Thu Oct 29 15:41:37 UTC 2020 on sn-devel-184 + +(cherry picked from commit ebd687335b9accfdbae7dbc65c9882ab4d5c0986) +--- + selftest/target/Samba4.pm | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/selftest/target/Samba4.pm b/selftest/target/Samba4.pm +index 649e923ff9a..1ebdf2a5484 100755 +--- a/selftest/target/Samba4.pm ++++ b/selftest/target/Samba4.pm +@@ -1040,7 +1040,7 @@ servicePrincipalName: http/testupnspn.$ctx->{dnsname} + $samba_tool_cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" "; + $samba_tool_cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" "; + $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool") +- . " group addmembers --configfile=$ctx->{smb_conf} 'Allowed RODC Password Replication Group' '$testallowed_account'"; ++ . " group addmembers --configfile=$ctx->{smb_conf} 'Allowed RODC Password Replication Group' '$testallowed_account' -d10"; + unless (system($samba_tool_cmd) == 0) { + warn("Unable to add '$testallowed_account' user to 'Allowed RODC Password Replication Group': \n$samba_tool_cmd\n"); + return undef; +-- +2.28.0 + + +From 8e8b9d33f25c7ef89fdf4af90821ea4de77525e1 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 20 Aug 2020 09:40:41 +0200 +Subject: [PATCH 086/105] auth:creds: Rename CRED_USE_KERBEROS values + +Signed-off-by: Andreas Schneider +Reviewed-by: Alexander Bokovoy +(cherry picked from commit 1298280a22ef7494fb85a6a5953bae15d22fa204) +--- + auth/credentials/credentials.c | 8 +++++--- + auth/credentials/credentials.h | 9 ++++++--- + auth/credentials/credentials_krb5.c | 4 ++-- + auth/credentials/credentials_ntlm.c | 2 +- + auth/credentials/credentials_secrets.c | 5 +++-- + auth/credentials/pycredentials.c | 6 +++--- + auth/credentials/tests/simple.c | 2 +- + auth/credentials/wscript_build | 2 +- + auth/gensec/gensec_start.c | 8 ++++---- + examples/winexe/winexe.c | 4 ++-- + source3/auth/auth_generic.c | 4 ++-- + source3/lib/util_cmdline.c | 18 +++++++++--------- + source3/libads/sasl.c | 8 ++++---- + source3/libnet/libnet_join.c | 2 +- + source3/libsmb/cliconnect.c | 16 ++++++++-------- + source3/passdb/passdb.c | 6 +++--- + source3/passdb/pdb_samba_dsdb.c | 4 ++-- + source3/rpc_client/cli_pipe.c | 2 +- + source3/rpcclient/rpcclient.c | 8 ++++---- + source3/utils/net_ads.c | 2 +- + source3/utils/net_util.c | 6 +++--- + source3/utils/ntlm_auth.c | 4 ++-- + source3/winbindd/winbindd_cm.c | 2 +- + source4/auth/gensec/gensec_gssapi.c | 2 +- + source4/auth/session.c | 2 +- + source4/lib/cmdline/popt_credentials.c | 4 ++-- + source4/torture/ldap/session_expiry.c | 2 +- + source4/torture/raw/session.c | 4 ++-- + source4/torture/rpc/schannel.c | 4 ++-- + source4/torture/smb2/session.c | 12 ++++++------ + 30 files changed, 84 insertions(+), 78 deletions(-) + +diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c +index 77c35dd104b..1bdd6f15a09 100644 +--- a/auth/credentials/credentials.c ++++ b/auth/credentials/credentials.c +@@ -44,6 +44,8 @@ _PUBLIC_ struct cli_credentials *cli_credentials_init(TALLOC_CTX *mem_ctx) + + cred->winbind_separator = '\\'; + ++ cred->use_kerberos = CRED_USE_KERBEROS_DESIRED; ++ + cred->signing_state = SMB_SIGNING_DEFAULT; + + /* +@@ -360,7 +362,7 @@ _PUBLIC_ bool cli_credentials_authentication_requested(struct cli_credentials *c + return true; + } + +- if (cli_credentials_get_kerberos_state(cred) == CRED_MUST_USE_KERBEROS) { ++ if (cli_credentials_get_kerberos_state(cred) == CRED_USE_KERBEROS_REQUIRED) { + return true; + } + +@@ -1018,7 +1020,7 @@ _PUBLIC_ void cli_credentials_guess(struct cli_credentials *cred, + } + + if (lp_ctx != NULL && +- cli_credentials_get_kerberos_state(cred) != CRED_DONT_USE_KERBEROS) { ++ cli_credentials_get_kerberos_state(cred) != CRED_USE_KERBEROS_DISABLED) { + cli_credentials_set_ccache(cred, lp_ctx, NULL, CRED_GUESS_FILE, + &error_string); + } +@@ -1097,7 +1099,7 @@ _PUBLIC_ void cli_credentials_set_anonymous(struct cli_credentials *cred) + cli_credentials_set_principal(cred, NULL, CRED_SPECIFIED); + cli_credentials_set_realm(cred, NULL, CRED_SPECIFIED); + cli_credentials_set_workstation(cred, "", CRED_UNINITIALISED); +- cli_credentials_set_kerberos_state(cred, CRED_DONT_USE_KERBEROS); ++ cli_credentials_set_kerberos_state(cred, CRED_USE_KERBEROS_DISABLED); + } + + /** +diff --git a/auth/credentials/credentials.h b/auth/credentials/credentials.h +index 438bcdce232..f468b8558dd 100644 +--- a/auth/credentials/credentials.h ++++ b/auth/credentials/credentials.h +@@ -53,9 +53,12 @@ enum credentials_obtained { + }; + + enum credentials_use_kerberos { +- CRED_AUTO_USE_KERBEROS = 0, /* Default, we try kerberos if available */ +- CRED_DONT_USE_KERBEROS, /* Sometimes trying kerberos just does 'bad things', so don't */ +- CRED_MUST_USE_KERBEROS /* Sometimes administrators are parinoid, so always do kerberos */ ++ /** Sometimes trying kerberos just does 'bad things', so don't */ ++ CRED_USE_KERBEROS_DISABLED = 0, ++ /** Default, we try kerberos if available */ ++ CRED_USE_KERBEROS_DESIRED, ++ /** Sometimes administrators are paranoid, so always do kerberos */ ++ CRED_USE_KERBEROS_REQUIRED, + }; + + enum credentials_krb_forwardable { +diff --git a/auth/credentials/credentials_krb5.c b/auth/credentials/credentials_krb5.c +index 259b35b73b0..36f6b59a72b 100644 +--- a/auth/credentials/credentials_krb5.c ++++ b/auth/credentials/credentials_krb5.c +@@ -871,7 +871,7 @@ _PUBLIC_ int cli_credentials_get_client_gss_creds(struct cli_credentials *cred, + ret = cli_credentials_get_ccache(cred, event_ctx, lp_ctx, + &ccache, error_string); + if (ret) { +- if (cli_credentials_get_kerberos_state(cred) == CRED_MUST_USE_KERBEROS) { ++ if (cli_credentials_get_kerberos_state(cred) == CRED_USE_KERBEROS_REQUIRED) { + DEBUG(1, ("Failed to get kerberos credentials (kerberos required): %s\n", *error_string)); + } else { + DEBUG(4, ("Failed to get kerberos credentials: %s\n", *error_string)); +@@ -1431,7 +1431,7 @@ _PUBLIC_ void cli_credentials_set_impersonate_principal(struct cli_credentials * + cred->impersonate_principal = talloc_strdup(cred, principal); + talloc_free(cred->self_service); + cred->self_service = talloc_strdup(cred, self_service); +- cli_credentials_set_kerberos_state(cred, CRED_MUST_USE_KERBEROS); ++ cli_credentials_set_kerberos_state(cred, CRED_USE_KERBEROS_REQUIRED); + } + + /* +diff --git a/auth/credentials/credentials_ntlm.c b/auth/credentials/credentials_ntlm.c +index f1b22a6c9e2..1bec60e5dce 100644 +--- a/auth/credentials/credentials_ntlm.c ++++ b/auth/credentials/credentials_ntlm.c +@@ -53,7 +53,7 @@ _PUBLIC_ NTSTATUS cli_credentials_get_ntlm_response(struct cli_credentials *cred + const struct samr_Password *nt_hash = NULL; + int rc; + +- if (cred->use_kerberos == CRED_MUST_USE_KERBEROS) { ++ if (cred->use_kerberos == CRED_USE_KERBEROS_REQUIRED) { + TALLOC_FREE(frame); + return NT_STATUS_INVALID_PARAMETER_MIX; + } +diff --git a/auth/credentials/credentials_secrets.c b/auth/credentials/credentials_secrets.c +index 52a89d4d5b4..58067a5bece 100644 +--- a/auth/credentials/credentials_secrets.c ++++ b/auth/credentials/credentials_secrets.c +@@ -370,7 +370,8 @@ _PUBLIC_ NTSTATUS cli_credentials_set_machine_account_db_ctx(struct cli_credenti + } + + if (secrets_tdb_password_more_recent) { +- enum credentials_use_kerberos use_kerberos = CRED_DONT_USE_KERBEROS; ++ enum credentials_use_kerberos use_kerberos = ++ CRED_USE_KERBEROS_DISABLED; + char *machine_account = talloc_asprintf(tmp_ctx, "%s$", lpcfg_netbios_name(lp_ctx)); + cli_credentials_set_password(cred, secrets_tdb_password, CRED_SPECIFIED); + cli_credentials_set_old_password(cred, secrets_tdb_old_password, CRED_SPECIFIED); +@@ -386,7 +387,7 @@ _PUBLIC_ NTSTATUS cli_credentials_set_machine_account_db_ctx(struct cli_credenti + + FALL_THROUGH; + case ROLE_ACTIVE_DIRECTORY_DC: +- use_kerberos = CRED_AUTO_USE_KERBEROS; ++ use_kerberos = CRED_USE_KERBEROS_DESIRED; + break; + } + } +diff --git a/auth/credentials/pycredentials.c b/auth/credentials/pycredentials.c +index 17c90573f09..95dde276ef7 100644 +--- a/auth/credentials/pycredentials.c ++++ b/auth/credentials/pycredentials.c +@@ -1492,9 +1492,9 @@ MODULE_INIT_FUNC(credentials) + PyModule_AddObject(m, "CALLBACK_RESULT", PyLong_FromLong(CRED_CALLBACK_RESULT)); + PyModule_AddObject(m, "SPECIFIED", PyLong_FromLong(CRED_SPECIFIED)); + +- PyModule_AddObject(m, "AUTO_USE_KERBEROS", PyLong_FromLong(CRED_AUTO_USE_KERBEROS)); +- PyModule_AddObject(m, "DONT_USE_KERBEROS", PyLong_FromLong(CRED_DONT_USE_KERBEROS)); +- PyModule_AddObject(m, "MUST_USE_KERBEROS", PyLong_FromLong(CRED_MUST_USE_KERBEROS)); ++ PyModule_AddObject(m, "AUTO_USE_KERBEROS", PyLong_FromLong(CRED_USE_KERBEROS_DESIRED)); ++ PyModule_AddObject(m, "DONT_USE_KERBEROS", PyLong_FromLong(CRED_USE_KERBEROS_DISABLED)); ++ PyModule_AddObject(m, "MUST_USE_KERBEROS", PyLong_FromLong(CRED_USE_KERBEROS_REQUIRED)); + + PyModule_AddObject(m, "AUTO_KRB_FORWARDABLE", PyLong_FromLong(CRED_AUTO_KRB_FORWARDABLE)); + PyModule_AddObject(m, "NO_KRB_FORWARDABLE", PyLong_FromLong(CRED_NO_KRB_FORWARDABLE)); +diff --git a/auth/credentials/tests/simple.c b/auth/credentials/tests/simple.c +index 7f122bed3bc..b39d7a2251b 100644 +--- a/auth/credentials/tests/simple.c ++++ b/auth/credentials/tests/simple.c +@@ -73,7 +73,7 @@ static bool test_guess(struct torture_context *tctx) + const char *passwd_fd = getenv("PASSWD_FD"); + const char *passwd_file = getenv("PASSWD_FILE"); + +- cli_credentials_set_kerberos_state(creds, CRED_MUST_USE_KERBEROS); ++ cli_credentials_set_kerberos_state(creds, CRED_USE_KERBEROS_REQUIRED); + + unsetenv("USER"); + unsetenv("PASSWD_FD"); +diff --git a/auth/credentials/wscript_build b/auth/credentials/wscript_build +index 1e3302e3e48..ad16b7d8008 100644 +--- a/auth/credentials/wscript_build ++++ b/auth/credentials/wscript_build +@@ -5,7 +5,7 @@ bld.SAMBA_LIBRARY('samba-credentials', + public_headers='credentials.h', + pc_files='samba-credentials.pc', + deps='LIBCRYPTO samba-errors events LIBCLI_AUTH samba-security CREDENTIALS_SECRETS CREDENTIALS_KRB5', +- vnum='0.1.0' ++ vnum='1.0.0' + ) + + bld.SAMBA_SUBSYSTEM('CREDENTIALS_KRB5', +diff --git a/auth/gensec/gensec_start.c b/auth/gensec/gensec_start.c +index 3f42d611140..56306efed13 100644 +--- a/auth/gensec/gensec_start.c ++++ b/auth/gensec/gensec_start.c +@@ -117,18 +117,18 @@ static const struct gensec_security_ops **gensec_use_kerberos_mechs( + } + + switch (use_kerberos) { +- case CRED_AUTO_USE_KERBEROS: ++ case CRED_USE_KERBEROS_DESIRED: + keep = true; + break; + +- case CRED_DONT_USE_KERBEROS: ++ case CRED_USE_KERBEROS_DISABLED: + if (old_gensec_list[i]->kerberos == false) { + keep = true; + } + + break; + +- case CRED_MUST_USE_KERBEROS: ++ case CRED_USE_KERBEROS_REQUIRED: + if (old_gensec_list[i]->kerberos == true) { + keep = true; + } +@@ -156,7 +156,7 @@ _PUBLIC_ const struct gensec_security_ops **gensec_security_mechs( + TALLOC_CTX *mem_ctx) + { + const struct gensec_security_ops * const *backends = gensec_security_all(); +- enum credentials_use_kerberos use_kerberos = CRED_AUTO_USE_KERBEROS; ++ enum credentials_use_kerberos use_kerberos = CRED_USE_KERBEROS_DESIRED; + bool keep_schannel = false; + + if (gensec_security != NULL) { +diff --git a/examples/winexe/winexe.c b/examples/winexe/winexe.c +index 03e7ec85198..95386211c0a 100644 +--- a/examples/winexe/winexe.c ++++ b/examples/winexe/winexe.c +@@ -283,8 +283,8 @@ static void parse_args(int argc, const char *argv[], + if (opt_kerberos) { + cli_credentials_set_kerberos_state(cred, + strcmp(opt_kerberos, "yes") +- ? CRED_MUST_USE_KERBEROS +- : CRED_DONT_USE_KERBEROS); ++ ? CRED_USE_KERBEROS_REQUIRED ++ : CRED_USE_KERBEROS_DISABLED); + } + + if (options->runas == NULL && options->runas_file != NULL) { +diff --git a/source3/auth/auth_generic.c b/source3/auth/auth_generic.c +index 0e9500ac08d..f314acd9559 100644 +--- a/source3/auth/auth_generic.c ++++ b/source3/auth/auth_generic.c +@@ -356,9 +356,9 @@ NTSTATUS auth_generic_prepare(TALLOC_CTX *mem_ctx, + cli_credentials_set_conf(server_credentials, lp_ctx); + + if (lp_security() == SEC_ADS || USE_KERBEROS_KEYTAB) { +- cli_credentials_set_kerberos_state(server_credentials, CRED_AUTO_USE_KERBEROS); ++ cli_credentials_set_kerberos_state(server_credentials, CRED_USE_KERBEROS_DESIRED); + } else { +- cli_credentials_set_kerberos_state(server_credentials, CRED_DONT_USE_KERBEROS); ++ cli_credentials_set_kerberos_state(server_credentials, CRED_USE_KERBEROS_DISABLED); + } + + nt_status = gensec_server_start(tmp_ctx, gensec_settings, +diff --git a/source3/lib/util_cmdline.c b/source3/lib/util_cmdline.c +index 9c9e2f0ac0f..d2af34ee19b 100644 +--- a/source3/lib/util_cmdline.c ++++ b/source3/lib/util_cmdline.c +@@ -307,9 +307,9 @@ void set_cmdline_auth_info_use_kerberos(struct user_auth_info *auth_info, + enum credentials_use_kerberos krb5_state; + + if (b) { +- krb5_state = CRED_MUST_USE_KERBEROS; ++ krb5_state = CRED_USE_KERBEROS_REQUIRED; + } else { +- krb5_state = CRED_DONT_USE_KERBEROS; ++ krb5_state = CRED_USE_KERBEROS_DISABLED; + } + + cli_credentials_set_kerberos_state(auth_info->creds, krb5_state); +@@ -321,7 +321,7 @@ bool get_cmdline_auth_info_use_kerberos(const struct user_auth_info *auth_info) + + krb5_state = cli_credentials_get_kerberos_state(auth_info->creds); + +- if (krb5_state == CRED_MUST_USE_KERBEROS) { ++ if (krb5_state == CRED_USE_KERBEROS_REQUIRED) { + return true; + } + +@@ -336,17 +336,17 @@ void set_cmdline_auth_info_fallback_after_kerberos(struct user_auth_info *auth_i + krb5_state = cli_credentials_get_kerberos_state(auth_info->creds); + + switch (krb5_state) { +- case CRED_MUST_USE_KERBEROS: ++ case CRED_USE_KERBEROS_REQUIRED: + if (b) { +- krb5_state = CRED_AUTO_USE_KERBEROS; ++ krb5_state = CRED_USE_KERBEROS_DESIRED; + } + break; +- case CRED_AUTO_USE_KERBEROS: ++ case CRED_USE_KERBEROS_DESIRED: + if (!b) { +- krb5_state = CRED_MUST_USE_KERBEROS; ++ krb5_state = CRED_USE_KERBEROS_REQUIRED; + } + break; +- case CRED_DONT_USE_KERBEROS: ++ case CRED_USE_KERBEROS_DISABLED: + /* nothing to do */ + break; + } +@@ -360,7 +360,7 @@ bool get_cmdline_auth_info_fallback_after_kerberos(const struct user_auth_info * + + krb5_state = cli_credentials_get_kerberos_state(auth_info->creds); + +- if (krb5_state == CRED_AUTO_USE_KERBEROS) { ++ if (krb5_state == CRED_USE_KERBEROS_DESIRED) { + return true; + } + +diff --git a/source3/libads/sasl.c b/source3/libads/sasl.c +index 87beeafe3ed..90ffa040ec0 100644 +--- a/source3/libads/sasl.c ++++ b/source3/libads/sasl.c +@@ -158,7 +158,7 @@ static ADS_STATUS ads_sasl_spnego_gensec_bind(ADS_STRUCT *ads, + use_spnego_principal = false; + } + +- if (krb5_state == CRED_DONT_USE_KERBEROS) { ++ if (krb5_state == CRED_USE_KERBEROS_DISABLED) { + use_spnego_principal = false; + } + +@@ -565,7 +565,7 @@ static ADS_STATUS ads_sasl_spnego_bind(ADS_STRUCT *ads) + { + + status = ads_sasl_spnego_gensec_bind(ads, "GSS-SPNEGO", +- CRED_MUST_USE_KERBEROS, ++ CRED_USE_KERBEROS_REQUIRED, + p.service, p.hostname, + blob); + if (ADS_ERR_OK(status)) { +@@ -581,7 +581,7 @@ static ADS_STATUS ads_sasl_spnego_bind(ADS_STRUCT *ads) + + if (ADS_ERR_OK(status)) { + status = ads_sasl_spnego_gensec_bind(ads, "GSS-SPNEGO", +- CRED_MUST_USE_KERBEROS, ++ CRED_USE_KERBEROS_REQUIRED, + p.service, p.hostname, + blob); + if (!ADS_ERR_OK(status)) { +@@ -616,7 +616,7 @@ static ADS_STATUS ads_sasl_spnego_bind(ADS_STRUCT *ads) + library for HMAC_MD4 encryption */ + mech = "NTLMSSP"; + status = ads_sasl_spnego_gensec_bind(ads, "GSS-SPNEGO", +- CRED_DONT_USE_KERBEROS, ++ CRED_USE_KERBEROS_DISABLED, + p.service, p.hostname, + data_blob_null); + done: +diff --git a/source3/libnet/libnet_join.c b/source3/libnet/libnet_join.c +index f3bf27e6c00..bd3aeec9434 100644 +--- a/source3/libnet/libnet_join.c ++++ b/source3/libnet/libnet_join.c +@@ -1707,7 +1707,7 @@ NTSTATUS libnet_join_ok(struct messaging_context *msg_ctx, + + if (use_kerberos) { + cli_credentials_set_kerberos_state(cli_creds, +- CRED_MUST_USE_KERBEROS); ++ CRED_USE_KERBEROS_REQUIRED); + } + + status = cli_full_connection_creds(&cli, NULL, +diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c +index abfd18bfaf1..f7b4741de89 100644 +--- a/source3/libsmb/cliconnect.c ++++ b/source3/libsmb/cliconnect.c +@@ -124,13 +124,13 @@ struct cli_credentials *cli_session_creds_init(TALLOC_CTX *mem_ctx, + + if (use_kerberos && fallback_after_kerberos) { + cli_credentials_set_kerberos_state(creds, +- CRED_AUTO_USE_KERBEROS); ++ CRED_USE_KERBEROS_DESIRED); + } else if (use_kerberos) { + cli_credentials_set_kerberos_state(creds, +- CRED_MUST_USE_KERBEROS); ++ CRED_USE_KERBEROS_REQUIRED); + } else { + cli_credentials_set_kerberos_state(creds, +- CRED_DONT_USE_KERBEROS); ++ CRED_USE_KERBEROS_DISABLED); + } + + if (use_ccache) { +@@ -255,7 +255,7 @@ NTSTATUS cli_session_creds_prepare_krb5(struct cli_state *cli, + + krb5_state = cli_credentials_get_kerberos_state(creds); + +- if (krb5_state != CRED_DONT_USE_KERBEROS) { ++ if (krb5_state != CRED_USE_KERBEROS_DISABLED) { + try_kerberos = true; + } + +@@ -275,7 +275,7 @@ NTSTATUS cli_session_creds_prepare_krb5(struct cli_state *cli, + try_kerberos = false; + } + +- if (krb5_state == CRED_MUST_USE_KERBEROS && !try_kerberos) { ++ if (krb5_state == CRED_USE_KERBEROS_REQUIRED && !try_kerberos) { + DEBUG(0, ("Kerberos auth with '%s' (%s\\%s) to access " + "'%s' not possible\n", + user_principal, user_domain, user_account, +@@ -286,7 +286,7 @@ NTSTATUS cli_session_creds_prepare_krb5(struct cli_state *cli, + + if (pass == NULL || strlen(pass) == 0) { + need_kinit = false; +- } else if (krb5_state == CRED_MUST_USE_KERBEROS) { ++ } else if (krb5_state == CRED_USE_KERBEROS_REQUIRED) { + need_kinit = try_kerberos; + } else { + need_kinit = try_kerberos; +@@ -321,14 +321,14 @@ NTSTATUS cli_session_creds_prepare_krb5(struct cli_state *cli, + if (ret != 0) { + int dbglvl = DBGLVL_NOTICE; + +- if (krb5_state == CRED_MUST_USE_KERBEROS) { ++ if (krb5_state == CRED_USE_KERBEROS_REQUIRED) { + dbglvl = DBGLVL_ERR; + } + + DEBUG(dbglvl, ("Kinit for %s to access %s failed: %s\n", + user_principal, target_hostname, + error_message(ret))); +- if (krb5_state == CRED_MUST_USE_KERBEROS) { ++ if (krb5_state == CRED_USE_KERBEROS_REQUIRED) { + TALLOC_FREE(frame); + return krb5_to_nt_status(ret); + } +diff --git a/source3/passdb/passdb.c b/source3/passdb/passdb.c +index 8ed1bafcea3..b12c845d9d2 100644 +--- a/source3/passdb/passdb.c ++++ b/source3/passdb/passdb.c +@@ -2630,7 +2630,7 @@ NTSTATUS pdb_get_trust_credentials(const char *netbios_domain, + /* + * It's not possible to use NTLMSSP with a domain trust account. + */ +- cli_credentials_set_kerberos_state(creds, CRED_MUST_USE_KERBEROS); ++ cli_credentials_set_kerberos_state(creds, CRED_USE_KERBEROS_REQUIRED); + } else { + /* + * We can't use kerberos against an NT4 domain. +@@ -2638,7 +2638,7 @@ NTSTATUS pdb_get_trust_credentials(const char *netbios_domain, + * We should have a mode that also disallows NTLMSSP here, + * as only NETLOGON SCHANNEL is possible. + */ +- cli_credentials_set_kerberos_state(creds, CRED_DONT_USE_KERBEROS); ++ cli_credentials_set_kerberos_state(creds, CRED_USE_KERBEROS_DISABLED); + } + + ok = cli_credentials_set_username(creds, account_name, CRED_SPECIFIED); +@@ -2656,7 +2656,7 @@ NTSTATUS pdb_get_trust_credentials(const char *netbios_domain, + /* + * We currently can't do kerberos just with an NTHASH. + */ +- cli_credentials_set_kerberos_state(creds, CRED_DONT_USE_KERBEROS); ++ cli_credentials_set_kerberos_state(creds, CRED_USE_KERBEROS_DISABLED); + goto done; + } + +diff --git a/source3/passdb/pdb_samba_dsdb.c b/source3/passdb/pdb_samba_dsdb.c +index 276bda88efc..93e8f5bebe6 100644 +--- a/source3/passdb/pdb_samba_dsdb.c ++++ b/source3/passdb/pdb_samba_dsdb.c +@@ -2599,13 +2599,13 @@ static NTSTATUS pdb_samba_dsdb_get_trusteddom_creds(struct pdb_methods *m, + * Force kerberos if this is an active directory domain + */ + cli_credentials_set_kerberos_state(creds, +- CRED_MUST_USE_KERBEROS); ++ CRED_USE_KERBEROS_REQUIRED); + } else { + /* + * TODO: we should allow krb5 with the raw nt hash. + */ + cli_credentials_set_kerberos_state(creds, +- CRED_DONT_USE_KERBEROS); ++ CRED_USE_KERBEROS_DISABLED); + } + + *_creds = talloc_move(mem_ctx, &creds); +diff --git a/source3/rpc_client/cli_pipe.c b/source3/rpc_client/cli_pipe.c +index 8227ef0b0bd..ba6c86cc227 100644 +--- a/source3/rpc_client/cli_pipe.c ++++ b/source3/rpc_client/cli_pipe.c +@@ -2637,7 +2637,7 @@ NTSTATUS rpccli_ncalrpc_bind_data(TALLOC_CTX *mem_ctx, + NAME_NT_AUTHORITY, /* domain */ + "SYSTEM", + NULL, /* password */ +- CRED_DONT_USE_KERBEROS, ++ CRED_USE_KERBEROS_DISABLED, + NULL, /* netlogon_creds_CredentialState */ + presult); + } +diff --git a/source3/rpcclient/rpcclient.c b/source3/rpcclient/rpcclient.c +index 575a42ebf70..a38f69f5592 100644 +--- a/source3/rpcclient/rpcclient.c ++++ b/source3/rpcclient/rpcclient.c +@@ -810,19 +810,19 @@ static NTSTATUS do_cmd(struct cli_state *cli, + case DCERPC_AUTH_TYPE_SPNEGO: + switch (pipe_default_auth_spnego_type) { + case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP: +- krb5_state = CRED_DONT_USE_KERBEROS; ++ krb5_state = CRED_USE_KERBEROS_DISABLED; + break; + case PIPE_AUTH_TYPE_SPNEGO_KRB5: +- krb5_state = CRED_MUST_USE_KERBEROS; ++ krb5_state = CRED_USE_KERBEROS_REQUIRED; + break; + case PIPE_AUTH_TYPE_SPNEGO_NONE: +- krb5_state = CRED_AUTO_USE_KERBEROS; ++ krb5_state = CRED_USE_KERBEROS_DESIRED; + break; + } + FALL_THROUGH; + case DCERPC_AUTH_TYPE_NTLMSSP: + case DCERPC_AUTH_TYPE_KRB5: +- if (krb5_state != CRED_AUTO_USE_KERBEROS) { ++ if (krb5_state != CRED_USE_KERBEROS_DESIRED) { + cli_credentials_set_kerberos_state(creds, + krb5_state); + } +diff --git a/source3/utils/net_ads.c b/source3/utils/net_ads.c +index 7f5b9c3a440..1a0e8a5c9dd 100644 +--- a/source3/utils/net_ads.c ++++ b/source3/utils/net_ads.c +@@ -2432,7 +2432,7 @@ static int net_ads_printer_publish(struct net_context *c, int argc, const char * + talloc_destroy(mem_ctx); + return -1; + } +- cli_credentials_set_kerberos_state(creds, CRED_MUST_USE_KERBEROS); ++ cli_credentials_set_kerberos_state(creds, CRED_USE_KERBEROS_REQUIRED); + + nt_status = cli_full_connection_creds(&cli, lp_netbios_name(), servername, + &server_ss, 0, +diff --git a/source3/utils/net_util.c b/source3/utils/net_util.c +index 5829d891075..6c5321db0fd 100644 +--- a/source3/utils/net_util.c ++++ b/source3/utils/net_util.c +@@ -493,13 +493,13 @@ struct cli_credentials *net_context_creds(struct net_context *c, + + if (c->opt_kerberos && c->opt_user_specified) { + cli_credentials_set_kerberos_state(creds, +- CRED_AUTO_USE_KERBEROS); ++ CRED_USE_KERBEROS_DESIRED); + } else if (c->opt_kerberos) { + cli_credentials_set_kerberos_state(creds, +- CRED_MUST_USE_KERBEROS); ++ CRED_USE_KERBEROS_REQUIRED); + } else { + cli_credentials_set_kerberos_state(creds, +- CRED_DONT_USE_KERBEROS); ++ CRED_USE_KERBEROS_DISABLED); + } + + if (c->opt_ccache) { +diff --git a/source3/utils/ntlm_auth.c b/source3/utils/ntlm_auth.c +index 7f8d2688978..bfaeff5188d 100644 +--- a/source3/utils/ntlm_auth.c ++++ b/source3/utils/ntlm_auth.c +@@ -1364,9 +1364,9 @@ static NTSTATUS ntlm_auth_prepare_gensec_server(TALLOC_CTX *mem_ctx, + cli_credentials_set_conf(server_credentials, lp_ctx); + + if (lp_server_role() == ROLE_ACTIVE_DIRECTORY_DC || lp_security() == SEC_ADS || USE_KERBEROS_KEYTAB) { +- cli_credentials_set_kerberos_state(server_credentials, CRED_AUTO_USE_KERBEROS); ++ cli_credentials_set_kerberos_state(server_credentials, CRED_USE_KERBEROS_DESIRED); + } else { +- cli_credentials_set_kerberos_state(server_credentials, CRED_DONT_USE_KERBEROS); ++ cli_credentials_set_kerberos_state(server_credentials, CRED_USE_KERBEROS_DISABLED); + } + + nt_status = gensec_server_start(tmp_ctx, gensec_settings, +diff --git a/source3/winbindd/winbindd_cm.c b/source3/winbindd/winbindd_cm.c +index 5fb22d7e9c8..466a0095ef2 100644 +--- a/source3/winbindd/winbindd_cm.c ++++ b/source3/winbindd/winbindd_cm.c +@@ -706,7 +706,7 @@ static NTSTATUS cm_get_ipc_credentials(TALLOC_CTX *mem_ctx, + } + + cli_credentials_set_conf(creds, lp_ctx); +- cli_credentials_set_kerberos_state(creds, CRED_DONT_USE_KERBEROS); ++ cli_credentials_set_kerberos_state(creds, CRED_USE_KERBEROS_DISABLED); + + ok = cli_credentials_set_domain(creds, netbios_domain, CRED_SPECIFIED); + if (!ok) { +diff --git a/source4/auth/gensec/gensec_gssapi.c b/source4/auth/gensec/gensec_gssapi.c +index d66abf32a7f..b668d4ed258 100644 +--- a/source4/auth/gensec/gensec_gssapi.c ++++ b/source4/auth/gensec/gensec_gssapi.c +@@ -1556,7 +1556,7 @@ static NTSTATUS gensec_gssapi_session_info(struct gensec_security *gensec_securi + } + + /* This credential handle isn't useful for password authentication, so ensure nobody tries to do that */ +- cli_credentials_set_kerberos_state(session_info->credentials, CRED_MUST_USE_KERBEROS); ++ cli_credentials_set_kerberos_state(session_info->credentials, CRED_USE_KERBEROS_REQUIRED); + + /* It has been taken from this place... */ + gensec_gssapi_state->delegated_cred_handle = GSS_C_NO_CREDENTIAL; +diff --git a/source4/auth/session.c b/source4/auth/session.c +index c5fc226a7d7..8e44dcd24f1 100644 +--- a/source4/auth/session.c ++++ b/source4/auth/session.c +@@ -295,7 +295,7 @@ struct auth_session_info *auth_session_info_from_transport(TALLOC_CTX *mem_ctx, + /* This credential handle isn't useful for password + * authentication, so ensure nobody tries to do that */ + cli_credentials_set_kerberos_state(creds, +- CRED_MUST_USE_KERBEROS); ++ CRED_USE_KERBEROS_REQUIRED); + + } + #endif +diff --git a/source4/lib/cmdline/popt_credentials.c b/source4/lib/cmdline/popt_credentials.c +index 5dd61f6339c..7d8963da99e 100644 +--- a/source4/lib/cmdline/popt_credentials.c ++++ b/source4/lib/cmdline/popt_credentials.c +@@ -120,8 +120,8 @@ static void popt_common_credentials_callback(poptContext con, + cli_credentials_set_kerberos_state( + popt_get_cmdline_credentials(), + use_kerberos +- ? CRED_MUST_USE_KERBEROS +- : CRED_DONT_USE_KERBEROS); ++ ? CRED_USE_KERBEROS_REQUIRED ++ : CRED_USE_KERBEROS_DISABLED); + break; + } + +diff --git a/source4/torture/ldap/session_expiry.c b/source4/torture/ldap/session_expiry.c +index 35dda439b17..e5e38450745 100644 +--- a/source4/torture/ldap/session_expiry.c ++++ b/source4/torture/ldap/session_expiry.c +@@ -55,7 +55,7 @@ bool torture_ldap_session_expiry(struct torture_context *torture) + torture, url!=NULL, ret, fail, "talloc_asprintf failed"); + + cli_credentials_set_kerberos_state( +- credentials, CRED_MUST_USE_KERBEROS); ++ credentials, CRED_USE_KERBEROS_REQUIRED); + + ok = lpcfg_set_option( + torture->lp_ctx, "gensec_gssapi:requested_life_time=4"); +diff --git a/source4/torture/raw/session.c b/source4/torture/raw/session.c +index 0c460ae3069..e246d25e9fb 100644 +--- a/source4/torture/raw/session.c ++++ b/source4/torture/raw/session.c +@@ -245,12 +245,12 @@ static bool test_session_expire1(struct torture_context *tctx) + + use_kerberos = cli_credentials_get_kerberos_state( + popt_get_cmdline_credentials()); +- if (use_kerberos != CRED_MUST_USE_KERBEROS) { ++ if (use_kerberos != CRED_USE_KERBEROS_REQUIRED) { + torture_warning(tctx, "smb2.session.expire1 requires -k yes!"); + torture_skip(tctx, "smb2.session.expire1 requires -k yes!"); + } + +- torture_assert_int_equal(tctx, use_kerberos, CRED_MUST_USE_KERBEROS, ++ torture_assert_int_equal(tctx, use_kerberos, CRED_USE_KERBEROS_REQUIRED, + "please use -k yes"); + + lpcfg_set_option(tctx->lp_ctx, "gensec_gssapi:requested_life_time=4"); +diff --git a/source4/torture/rpc/schannel.c b/source4/torture/rpc/schannel.c +index fff0b1aacbd..a5755041040 100644 +--- a/source4/torture/rpc/schannel.c ++++ b/source4/torture/rpc/schannel.c +@@ -965,8 +965,8 @@ bool torture_rpc_schannel_bench1(struct torture_context *torture) + torture_assert(torture, s->join_ctx2 != NULL, + "Failed to join domain with acct_flags=ACB_WSTRUST"); + +- cli_credentials_set_kerberos_state(s->wks_creds1, CRED_DONT_USE_KERBEROS); +- cli_credentials_set_kerberos_state(s->wks_creds2, CRED_DONT_USE_KERBEROS); ++ cli_credentials_set_kerberos_state(s->wks_creds1, CRED_USE_KERBEROS_DISABLED); ++ cli_credentials_set_kerberos_state(s->wks_creds2, CRED_USE_KERBEROS_DISABLED); + + for (i=0; i < s->nprocs; i++) { + struct cli_credentials *wks = s->wks_creds1; +diff --git a/source4/torture/smb2/session.c b/source4/torture/smb2/session.c +index 07c6faebb15..701dfc10a07 100644 +--- a/source4/torture/smb2/session.c ++++ b/source4/torture/smb2/session.c +@@ -956,7 +956,7 @@ bool test_session_reauth6(struct torture_context *tctx, struct smb2_tree *tree) + + krb_state = cli_credentials_get_kerberos_state( + popt_get_cmdline_credentials()); +- if (krb_state == CRED_MUST_USE_KERBEROS) { ++ if (krb_state == CRED_USE_KERBEROS_REQUIRED) { + torture_skip(tctx, + "Can't test failing session setup with kerberos."); + } +@@ -1064,12 +1064,12 @@ static bool test_session_expire1i(struct torture_context *tctx, + size_t i; + + use_kerberos = cli_credentials_get_kerberos_state(credentials); +- if (use_kerberos != CRED_MUST_USE_KERBEROS) { ++ if (use_kerberos != CRED_USE_KERBEROS_REQUIRED) { + torture_warning(tctx, "smb2.session.expire1 requires -k yes!"); + torture_skip(tctx, "smb2.session.expire1 requires -k yes!"); + } + +- torture_assert_int_equal(tctx, use_kerberos, CRED_MUST_USE_KERBEROS, ++ torture_assert_int_equal(tctx, use_kerberos, CRED_USE_KERBEROS_REQUIRED, + "please use -k yes"); + + cli_credentials_invalidate_ccache(credentials, CRED_SPECIFIED); +@@ -1250,12 +1250,12 @@ static bool test_session_expire2i(struct torture_context *tctx, + struct smb2_notify ntf2; + + use_kerberos = cli_credentials_get_kerberos_state(credentials); +- if (use_kerberos != CRED_MUST_USE_KERBEROS) { ++ if (use_kerberos != CRED_USE_KERBEROS_REQUIRED) { + torture_warning(tctx, "smb2.session.expire2 requires -k yes!"); + torture_skip(tctx, "smb2.session.expire2 requires -k yes!"); + } + +- torture_assert_int_equal(tctx, use_kerberos, CRED_MUST_USE_KERBEROS, ++ torture_assert_int_equal(tctx, use_kerberos, CRED_USE_KERBEROS_REQUIRED, + "please use -k yes"); + + cli_credentials_invalidate_ccache(credentials, CRED_SPECIFIED); +@@ -1612,7 +1612,7 @@ static bool test_session_expire_disconnect(struct torture_context *tctx) + bool connected; + + use_kerberos = cli_credentials_get_kerberos_state(credentials); +- if (use_kerberos != CRED_MUST_USE_KERBEROS) { ++ if (use_kerberos != CRED_USE_KERBEROS_REQUIRED) { + torture_warning(tctx, "smb2.session.expire1 requires -k yes!"); + torture_skip(tctx, "smb2.session.expire1 requires -k yes!"); + } +-- +2.28.0 + + +From 6a356a6e79fa76de18a4ca0760ac4f053d70137f Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 1 Sep 2020 12:32:28 +0200 +Subject: [PATCH 087/105] auth:creds:tests: Migrate test to a cmocka unit test + +Signed-off-by: Andreas Schneider +Reviewed-by: Alexander Bokovoy +(cherry picked from commit 1a92994a9513f5e73d30604a1dc217ddeb1ac8d5) +--- + auth/credentials/tests/test_creds.c | 221 ++++++++++++++++++++++++++++ + auth/credentials/wscript_build | 6 + + selftest/tests.py | 2 + + source4/torture/local/local.c | 1 - + source4/torture/local/wscript_build | 2 +- + 5 files changed, 230 insertions(+), 2 deletions(-) + create mode 100644 auth/credentials/tests/test_creds.c + +diff --git a/auth/credentials/tests/test_creds.c b/auth/credentials/tests/test_creds.c +new file mode 100644 +index 00000000000..d2d3d30d73d +--- /dev/null ++++ b/auth/credentials/tests/test_creds.c +@@ -0,0 +1,221 @@ ++/* ++ * Unix SMB/CIFS implementation. ++ * ++ * Copyright (C) 2018-2019 Andreas Schneider ++ * ++ * This program is free software; you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License as published by ++ * the Free Software Foundation; either version 3 of the License, or ++ * (at your option) any later version. ++ * ++ * This program is distributed in the hope that it will be useful, ++ * but WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++ * GNU General Public License for more details. ++ * ++ * You should have received a copy of the GNU General Public License ++ * along with this program. If not, see . ++ */ ++ ++#include ++#include ++#include ++#include ++#include ++ ++#include "lib/replace/replace.h" ++#include "auth/credentials/credentials.c" ++ ++static int setup_talloc_context(void **state) ++{ ++ TALLOC_CTX *frame = talloc_stackframe(); ++ ++ *state = frame; ++ return 0; ++} ++ ++static int teardown_talloc_context(void **state) ++{ ++ TALLOC_CTX *frame = *state; ++ TALLOC_FREE(frame); ++ return 0; ++} ++ ++static void torture_creds_init(void **state) ++{ ++ TALLOC_CTX *mem_ctx = *state; ++ struct cli_credentials *creds = NULL; ++ const char *username = NULL; ++ const char *domain = NULL; ++ const char *password = NULL; ++ bool ok; ++ ++ creds = cli_credentials_init(mem_ctx); ++ assert_non_null(creds); ++ assert_null(creds->username); ++ assert_int_equal(creds->username_obtained, CRED_UNINITIALISED); ++ ++ domain = cli_credentials_get_domain(creds); ++ assert_null(domain); ++ ok = cli_credentials_set_domain(creds, "WURST", CRED_SPECIFIED); ++ assert_true(ok); ++ assert_int_equal(creds->domain_obtained, CRED_SPECIFIED); ++ domain = cli_credentials_get_domain(creds); ++ assert_string_equal(domain, "WURST"); ++ ++ username = cli_credentials_get_username(creds); ++ assert_null(username); ++ ok = cli_credentials_set_username(creds, "brot", CRED_SPECIFIED); ++ assert_true(ok); ++ assert_int_equal(creds->username_obtained, CRED_SPECIFIED); ++ username = cli_credentials_get_username(creds); ++ assert_string_equal(username, "brot"); ++ ++ password = cli_credentials_get_password(creds); ++ assert_null(password); ++ ok = cli_credentials_set_password(creds, "SECRET", CRED_SPECIFIED); ++ assert_true(ok); ++ assert_int_equal(creds->password_obtained, CRED_SPECIFIED); ++ password = cli_credentials_get_password(creds); ++ assert_string_equal(password, "SECRET"); ++} ++ ++static void torture_creds_init_anonymous(void **state) ++{ ++ TALLOC_CTX *mem_ctx = *state; ++ struct cli_credentials *creds = NULL; ++ ++ creds = cli_credentials_init_anon(mem_ctx); ++ assert_non_null(creds); ++ ++ assert_string_equal(creds->domain, ""); ++ assert_int_equal(creds->domain_obtained, CRED_SPECIFIED); ++ ++ assert_string_equal(creds->username, ""); ++ assert_int_equal(creds->username_obtained, CRED_SPECIFIED); ++ ++ assert_null(creds->password); ++ assert_int_equal(creds->password_obtained, CRED_SPECIFIED); ++} ++ ++static void torture_creds_guess(void **state) ++{ ++ TALLOC_CTX *mem_ctx = *state; ++ struct cli_credentials *creds = NULL; ++ const char *env_user = getenv("USER"); ++ ++ creds = cli_credentials_init(mem_ctx); ++ assert_non_null(creds); ++ ++ setenv("PASSWD", "SECRET", 1); ++ cli_credentials_guess(creds, NULL); ++ ++ assert_string_equal(creds->username, env_user); ++ assert_int_equal(creds->username_obtained, CRED_GUESS_ENV); ++ ++ assert_string_equal(creds->password, "SECRET"); ++ assert_int_equal(creds->password_obtained, CRED_GUESS_ENV); ++ unsetenv("PASSWD"); ++} ++ ++static void torture_creds_anon_guess(void **state) ++{ ++ TALLOC_CTX *mem_ctx = *state; ++ struct cli_credentials *creds = NULL; ++ ++ creds = cli_credentials_init_anon(mem_ctx); ++ assert_non_null(creds); ++ ++ setenv("PASSWD", "SECRET", 1); ++ cli_credentials_guess(creds, NULL); ++ ++ assert_string_equal(creds->username, ""); ++ assert_int_equal(creds->username_obtained, CRED_SPECIFIED); ++ ++ assert_null(creds->password); ++ assert_int_equal(creds->password_obtained, CRED_SPECIFIED); ++ unsetenv("PASSWD"); ++} ++ ++static void torture_creds_parse_string(void **state) ++{ ++ TALLOC_CTX *mem_ctx = *state; ++ struct cli_credentials *creds = NULL; ++ ++ creds = cli_credentials_init(mem_ctx); ++ assert_non_null(creds); ++ ++ /* Anonymous */ ++ cli_credentials_parse_string(creds, "%", CRED_SPECIFIED); ++ ++ assert_string_equal(creds->domain, ""); ++ assert_int_equal(creds->domain_obtained, CRED_SPECIFIED); ++ ++ assert_string_equal(creds->username, ""); ++ assert_int_equal(creds->username_obtained, CRED_SPECIFIED); ++ ++ assert_null(creds->password); ++ assert_int_equal(creds->password_obtained, CRED_SPECIFIED); ++ ++ /* Username + password */ ++ cli_credentials_parse_string(creds, "wurst%BROT", CRED_SPECIFIED); ++ ++ assert_string_equal(creds->domain, ""); ++ assert_int_equal(creds->domain_obtained, CRED_SPECIFIED); ++ ++ assert_string_equal(creds->username, "wurst"); ++ assert_int_equal(creds->username_obtained, CRED_SPECIFIED); ++ ++ assert_string_equal(creds->password, "BROT"); ++ assert_int_equal(creds->password_obtained, CRED_SPECIFIED); ++ ++ /* Domain + username + password */ ++ cli_credentials_parse_string(creds, "XXL\\wurst%BROT", CRED_SPECIFIED); ++ ++ assert_string_equal(creds->domain, "XXL"); ++ assert_int_equal(creds->domain_obtained, CRED_SPECIFIED); ++ ++ assert_string_equal(creds->username, "wurst"); ++ assert_int_equal(creds->username_obtained, CRED_SPECIFIED); ++ ++ assert_string_equal(creds->password, "BROT"); ++ assert_int_equal(creds->password_obtained, CRED_SPECIFIED); ++ ++ /* Principal */ ++ cli_credentials_parse_string(creds, "wurst@brot.realm", CRED_SPECIFIED); ++ ++ assert_string_equal(creds->domain, ""); ++ assert_int_equal(creds->domain_obtained, CRED_SPECIFIED); ++ ++ assert_string_equal(creds->username, "wurst@brot.realm"); ++ assert_int_equal(creds->username_obtained, CRED_SPECIFIED); ++ ++ assert_string_equal(creds->principal, "wurst@brot.realm"); ++ assert_int_equal(creds->principal_obtained, CRED_SPECIFIED); ++ ++ assert_string_equal(creds->password, "BROT"); ++ assert_int_equal(creds->password_obtained, CRED_SPECIFIED); ++} ++ ++int main(int argc, char *argv[]) ++{ ++ int rc; ++ const struct CMUnitTest tests[] = { ++ cmocka_unit_test(torture_creds_init), ++ cmocka_unit_test(torture_creds_init_anonymous), ++ cmocka_unit_test(torture_creds_guess), ++ cmocka_unit_test(torture_creds_anon_guess), ++ cmocka_unit_test(torture_creds_parse_string), ++ }; ++ ++ if (argc == 2) { ++ cmocka_set_test_filter(argv[1]); ++ } ++ cmocka_set_message_output(CM_OUTPUT_SUBUNIT); ++ ++ rc = cmocka_run_group_tests(tests, ++ setup_talloc_context, ++ teardown_talloc_context); ++ ++ return rc; ++} +diff --git a/auth/credentials/wscript_build b/auth/credentials/wscript_build +index ad16b7d8008..46111164b36 100644 +--- a/auth/credentials/wscript_build ++++ b/auth/credentials/wscript_build +@@ -31,3 +31,9 @@ bld.SAMBA_PYTHON('pycredentials', + public_deps='samba-credentials cmdline-credentials %s %s CREDENTIALS_KRB5 CREDENTIALS_SECRETS' % (pytalloc_util, pyparam_util), + realname='samba/credentials.so' + ) ++ ++bld.SAMBA_BINARY('test_creds', ++ source='tests/test_creds.c', ++ deps='cmocka samba-credentials', ++ local_include=False, ++ for_selftest=True) +diff --git a/selftest/tests.py b/selftest/tests.py +index 86cab3f8046..4a968cdbe8a 100644 +--- a/selftest/tests.py ++++ b/selftest/tests.py +@@ -418,3 +418,5 @@ plantestsuite("samba.unittests.test_oLschema2ldif", "none", + if with_elasticsearch_backend: + plantestsuite("samba.unittests.mdsparser_es", "none", + [os.path.join(bindir(), "default/source3/test_mdsparser_es")] + [configuration]) ++plantestsuite("samba.unittests.credentials", "none", ++ [os.path.join(bindir(), "default/auth/credentials/test_creds")]) +diff --git a/source4/torture/local/local.c b/source4/torture/local/local.c +index a3186788524..d19b55e9502 100644 +--- a/source4/torture/local/local.c ++++ b/source4/torture/local/local.c +@@ -70,7 +70,6 @@ + torture_local_tevent_req, + torture_local_torture, + torture_local_dbspeed, +- torture_local_credentials, + torture_ldb, + torture_dsdb_dn, + torture_dsdb_syntax, +diff --git a/source4/torture/local/wscript_build b/source4/torture/local/wscript_build +index 38b6c8f4b6e..f0ab0357986 100644 +--- a/source4/torture/local/wscript_build ++++ b/source4/torture/local/wscript_build +@@ -16,7 +16,7 @@ TORTURE_LOCAL_SOURCE = '''../../../lib/util/charset/tests/iconv.c + ../../libcli/security/tests/sddl.c ../../../lib/tdr/testsuite.c + ../../../lib/tevent/testsuite.c ../../param/tests/share.c + ../../../lib/tevent/test_req.c +- ../../param/tests/loadparm.c ../../../auth/credentials/tests/simple.c local.c ++ ../../param/tests/loadparm.c local.c + dbspeed.c torture.c ../ldb/ldb.c ../../dsdb/common/tests/dsdb_dn.c + ../../dsdb/schema/tests/schema_syntax.c + ../../../lib/util/tests/anonymous_shared.c +-- +2.28.0 + + +From f6a4f70007e5c5ad1df3ddb018bde8568fc63f57 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?G=C3=BCnther=20Deschner?= +Date: Mon, 2 Nov 2020 16:10:44 +0100 +Subject: [PATCH 088/105] s3-vfs_glusterfs: always disable write-behind + translator + +The "pass-through" option has now been merged upstream as of: +https://github.com/gluster/glusterfs/pull/1640 + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14486 + +Guenther + +Signed-off-by: Guenther Deschner +Pair-Programmed-With: Anoop C S +Pair-Programmed-With: Sachin Prabhu +Reviewed-by: Jeremy Allison + +Autobuild-User(master): Jeremy Allison +Autobuild-Date(master): Wed Nov 4 22:53:49 UTC 2020 on sn-devel-184 + +(cherry picked from commit a51cda69ec6a017ad04b5690a3ae67a5478deee9) + +Autobuild-User(v4-13-test): Karolin Seeger +Autobuild-Date(v4-13-test): Thu Nov 5 13:54:25 UTC 2020 on sn-devel-184 +--- + source3/modules/vfs_glusterfs.c | 20 +++++++++++++++++--- + source3/wscript | 3 +++ + 2 files changed, 20 insertions(+), 3 deletions(-) + +diff --git a/source3/modules/vfs_glusterfs.c b/source3/modules/vfs_glusterfs.c +index 3cbb1ab6cb6..bdfe35ced82 100644 +--- a/source3/modules/vfs_glusterfs.c ++++ b/source3/modules/vfs_glusterfs.c +@@ -363,6 +363,7 @@ static int vfs_gluster_connect(struct vfs_handle_struct *handle, + glfs_t *fs = NULL; + TALLOC_CTX *tmp_ctx; + int ret = 0; ++ bool write_behind_pass_through_set = false; + + tmp_ctx = talloc_new(NULL); + if (tmp_ctx == NULL) { +@@ -435,6 +436,17 @@ static int vfs_gluster_connect(struct vfs_handle_struct *handle, + goto done; + } + ++#ifdef HAVE_GFAPI_VER_7_9 ++ ret = glfs_set_xlator_option(fs, "*-write-behind", "pass-through", ++ "true"); ++ if (ret < 0) { ++ DBG_ERR("%s: Failed to set xlator option: pass-through\n", ++ volume); ++ goto done; ++ } ++ write_behind_pass_through_set = true; ++#endif ++ + ret = glfs_set_logging(fs, logfile, loglevel); + if (ret < 0) { + DEBUG(0, ("%s: Failed to set logfile %s loglevel %d\n", +@@ -449,9 +461,11 @@ static int vfs_gluster_connect(struct vfs_handle_struct *handle, + goto done; + } + +- ret = check_for_write_behind_translator(tmp_ctx, fs, volume); +- if (ret < 0) { +- goto done; ++ if (!write_behind_pass_through_set) { ++ ret = check_for_write_behind_translator(tmp_ctx, fs, volume); ++ if (ret < 0) { ++ goto done; ++ } + } + + ret = glfs_set_preopened(volume, handle->conn->connectpath, fs); +diff --git a/source3/wscript b/source3/wscript +index 335cfd797f1..9920432a360 100644 +--- a/source3/wscript ++++ b/source3/wscript +@@ -1766,6 +1766,9 @@ main() { + conf.CHECK_CFG(package='glusterfs-api', args='"glusterfs-api >= 7.6" --cflags --libs', + msg='Checking for glusterfs-api >= 7.6', + uselib_store="GFAPI_VER_7_6") ++ conf.CHECK_CFG(package='glusterfs-api', args='"glusterfs-api >= 7.9" --cflags --libs', ++ msg='Checking for glusterfs-api >= 7.9', ++ uselib_store="GFAPI_VER_7_9") + else: + conf.SET_TARGET_TYPE('gfapi', 'EMPTY') + conf.undefine('HAVE_GLUSTERFS') +-- +2.28.0 + + +From 0d6268ff0a055e8fb418da761eeb820a8e11e2ad Mon Sep 17 00:00:00 2001 +From: Isaac Boukris +Date: Thu, 20 Aug 2020 12:09:05 +0200 +Subject: [PATCH 089/105] Add smb2cli_session_get_encryption_cipher() + +When 'session->smb2->should_encrypt' is true, the client MUST encrypt +all transport messages (see also MS-SMB2 3.2.4.1.8). + +Signed-off-by: Isaac Boukris +Reviewed-by: Stefan Metzmacher +Reviewed-by: Alexander Bokovoy +(cherry picked from commit f0f8de9d4a4e05445e427f00bb10eb34e1110a97) +--- + libcli/smb/smbXcli_base.c | 13 +++++++++++++ + libcli/smb/smbXcli_base.h | 1 + + 2 files changed, 14 insertions(+) + +diff --git a/libcli/smb/smbXcli_base.c b/libcli/smb/smbXcli_base.c +index 7d2da4b9ebc..471319a32f1 100644 +--- a/libcli/smb/smbXcli_base.c ++++ b/libcli/smb/smbXcli_base.c +@@ -6436,6 +6436,19 @@ NTSTATUS smb2cli_session_encryption_on(struct smbXcli_session *session) + return NT_STATUS_OK; + } + ++uint16_t smb2cli_session_get_encryption_cipher(struct smbXcli_session *session) ++{ ++ if (session->conn->protocol < PROTOCOL_SMB2_24) { ++ return 0; ++ } ++ ++ if (!session->smb2->should_encrypt) { ++ return 0; ++ } ++ ++ return session->conn->smb2.server.cipher; ++} ++ + struct smbXcli_tcon *smbXcli_tcon_create(TALLOC_CTX *mem_ctx) + { + struct smbXcli_tcon *tcon; +diff --git a/libcli/smb/smbXcli_base.h b/libcli/smb/smbXcli_base.h +index 2afc7165cd9..db5f5d58799 100644 +--- a/libcli/smb/smbXcli_base.h ++++ b/libcli/smb/smbXcli_base.h +@@ -518,6 +518,7 @@ NTSTATUS smb2cli_session_set_channel_key(struct smbXcli_session *session, + const DATA_BLOB channel_key, + const struct iovec *recv_iov); + NTSTATUS smb2cli_session_encryption_on(struct smbXcli_session *session); ++uint16_t smb2cli_session_get_encryption_cipher(struct smbXcli_session *session); + + struct smbXcli_tcon *smbXcli_tcon_create(TALLOC_CTX *mem_ctx); + struct smbXcli_tcon *smbXcli_tcon_copy(TALLOC_CTX *mem_ctx, +-- +2.28.0 + + +From 3f77e6cb6220d50b75ceb197e26813e9e5244cc0 Mon Sep 17 00:00:00 2001 +From: Isaac Boukris +Date: Thu, 20 Aug 2020 12:18:21 +0200 +Subject: [PATCH 090/105] Add dcerpc_transport_encrypted() + +Signed-off-by: Isaac Boukris +Reviewed-by: Stefan Metzmacher +Reviewed-by: Alexander Bokovoy +(cherry picked from commit 339bfcd67af2675d10287946d8f5dabba1022d57) +--- + source4/librpc/rpc/dcerpc.h | 2 ++ + source4/librpc/rpc/dcerpc_smb.c | 11 +++++++++++ + source4/librpc/rpc/dcerpc_util.c | 13 +++++++++++++ + 3 files changed, 26 insertions(+) + +diff --git a/source4/librpc/rpc/dcerpc.h b/source4/librpc/rpc/dcerpc.h +index 6b0b841d64d..57124f10778 100644 +--- a/source4/librpc/rpc/dcerpc.h ++++ b/source4/librpc/rpc/dcerpc.h +@@ -87,6 +87,7 @@ struct dcecli_connection { + struct dcerpc_transport { + enum dcerpc_transport_t transport; + void *private_data; ++ bool encrypted; + + struct tstream_context *stream; + /** to serialize write events */ +@@ -181,6 +182,7 @@ NTSTATUS dcerpc_bind_auth_none(struct dcerpc_pipe *p, + const struct ndr_interface_table *table); + NTSTATUS dcerpc_fetch_session_key(struct dcerpc_pipe *p, + DATA_BLOB *session_key); ++bool dcerpc_transport_encrypted(struct dcerpc_pipe *p); + struct composite_context; + NTSTATUS dcerpc_secondary_connection_recv(struct composite_context *c, + struct dcerpc_pipe **p2); +diff --git a/source4/librpc/rpc/dcerpc_smb.c b/source4/librpc/rpc/dcerpc_smb.c +index b20b154a1cb..101ed64f0cd 100644 +--- a/source4/librpc/rpc/dcerpc_smb.c ++++ b/source4/librpc/rpc/dcerpc_smb.c +@@ -145,6 +145,7 @@ static void dcerpc_pipe_open_smb_done(struct tevent_req *subreq) + struct dcerpc_pipe_open_smb_state); + struct composite_context *ctx = state->ctx; + struct dcecli_connection *c = state->c; ++ uint16_t enc_cipher; + + ctx->status = tstream_smbXcli_np_open_recv(subreq, + state->smb, +@@ -173,6 +174,16 @@ static void dcerpc_pipe_open_smb_done(struct tevent_req *subreq) + /* Over-ride the default session key with the SMB session key */ + c->security_state.session_key = smb_session_key; + ++ enc_cipher = smb2cli_session_get_encryption_cipher(state->smb->session); ++ switch (enc_cipher) { ++ case SMB2_ENCRYPTION_AES128_CCM: ++ case SMB2_ENCRYPTION_AES128_GCM: ++ c->transport.encrypted = true; ++ break; ++ default: ++ c->transport.encrypted = false; ++ } ++ + c->transport.private_data = talloc_move(c, &state->smb); + + composite_done(ctx); +diff --git a/source4/librpc/rpc/dcerpc_util.c b/source4/librpc/rpc/dcerpc_util.c +index bd79a072bc8..6ea27a8d9a3 100644 +--- a/source4/librpc/rpc/dcerpc_util.c ++++ b/source4/librpc/rpc/dcerpc_util.c +@@ -743,6 +743,19 @@ _PUBLIC_ NTSTATUS dcerpc_fetch_session_key(struct dcerpc_pipe *p, + return NT_STATUS_OK; + } + ++_PUBLIC_ bool dcerpc_transport_encrypted(struct dcerpc_pipe *p) ++{ ++ if (p == NULL) { ++ return false; ++ } ++ ++ if (p->conn == NULL) { ++ return false; ++ } ++ ++ return p->conn->transport.encrypted; ++} ++ + /* + create a secondary context from a primary connection + +-- +2.28.0 + + +From 4045c677a3ea3c44e5509025c1c7d03936ba9d82 Mon Sep 17 00:00:00 2001 +From: Isaac Boukris +Date: Thu, 20 Aug 2020 12:35:01 +0200 +Subject: [PATCH 091/105] Add py binding for dcerpc_transport_encrypted + +Signed-off-by: Isaac Boukris +Reviewed-by: Stefan Metzmacher +Reviewed-by: Alexander Bokovoy +(cherry picked from commit eba91f0dfa8e3267689b4076302e257f4cecd63b) +--- + source4/librpc/rpc/pyrpc.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/source4/librpc/rpc/pyrpc.c b/source4/librpc/rpc/pyrpc.c +index be914ed5f14..309a6d72e26 100644 +--- a/source4/librpc/rpc/pyrpc.c ++++ b/source4/librpc/rpc/pyrpc.c +@@ -293,11 +293,25 @@ static PyObject *py_iface_request(PyObject *self, PyObject *args, PyObject *kwar + return ret; + } + ++static PyObject *py_iface_transport_encrypted(PyObject *self) ++{ ++ dcerpc_InterfaceObject *iface = (dcerpc_InterfaceObject *)self; ++ ++ if (dcerpc_transport_encrypted(iface->pipe)) { ++ Py_RETURN_TRUE; ++ } ++ ++ Py_RETURN_FALSE; ++} ++ + static PyMethodDef dcerpc_interface_methods[] = { + { "request", PY_DISCARD_FUNC_SIG(PyCFunction, py_iface_request), + METH_VARARGS|METH_KEYWORDS, + "S.request(opnum, data, object=None) -> data\n" + "Make a raw request" }, ++ { "transport_encrypted", PY_DISCARD_FUNC_SIG(PyCFunction, py_iface_transport_encrypted), ++ METH_NOARGS, ++ "Check if the DCE transport is encrypted" }, + { NULL, NULL, 0, NULL }, + }; + +-- +2.28.0 + + +From 07a87eaff7e2e18c2d462f4caff95cace92a0130 Mon Sep 17 00:00:00 2001 +From: Isaac Boukris +Date: Thu, 20 Aug 2020 12:44:08 +0200 +Subject: [PATCH 092/105] selftest: add a test for py dce transport_encrypted + +Signed-off-by: Isaac Boukris +Reviewed-by: Stefan Metzmacher +Reviewed-by: Alexander Bokovoy +(cherry picked from commit a77551bea969ce73a3dc27384d94b4126bef04f7) +--- + python/samba/tests/dcerpc/binding.py | 23 ++++++++++++++++++++++- + 1 file changed, 22 insertions(+), 1 deletion(-) + +diff --git a/python/samba/tests/dcerpc/binding.py b/python/samba/tests/dcerpc/binding.py +index 8e0d6a5ef0a..24e4ac77d89 100644 +--- a/python/samba/tests/dcerpc/binding.py ++++ b/python/samba/tests/dcerpc/binding.py +@@ -22,7 +22,7 @@ import samba.tests + from samba.tests import RpcInterfaceTestCase, TestCase + from samba.dcerpc import lsa + import samba.dcerpc.security as security +-from samba.credentials import Credentials, SMB_ENCRYPTION_REQUIRED ++from samba.credentials import Credentials, SMB_ENCRYPTION_REQUIRED, SMB_ENCRYPTION_OFF + from samba import NTSTATUSError + + class RpcBindingTests(RpcInterfaceTestCase): +@@ -40,6 +40,26 @@ class RpcBindingTests(RpcInterfaceTestCase): + c.set_password(password) + return c + ++ def test_smb3_dcerpc_no_encryption(self): ++ creds = self.get_user_creds() ++ creds.set_smb_encryption(SMB_ENCRYPTION_OFF) ++ ++ lp = self.get_loadparm() ++ lp.set('client ipc max protocol', 'SMB3') ++ lp.set('client ipc min protocol', 'SMB3') ++ ++ binding_string = ("ncacn_np:%s" % (samba.tests.env_get_var_value('SERVER'))) ++ lsa_conn = lsa.lsarpc(binding_string, lp, creds) ++ self.assertFalse(lsa_conn.transport_encrypted()) ++ ++ objectAttr = lsa.ObjectAttribute() ++ objectAttr.sec_qos = lsa.QosInfo() ++ ++ pol_handle = lsa_conn.OpenPolicy2('', ++ objectAttr, ++ security.SEC_FLAG_MAXIMUM_ALLOWED) ++ self.assertIsNotNone(pol_handle) ++ + def test_smb3_dcerpc_encryption(self): + creds = self.get_user_creds() + creds.set_smb_encryption(SMB_ENCRYPTION_REQUIRED) +@@ -50,6 +70,7 @@ class RpcBindingTests(RpcInterfaceTestCase): + + binding_string = ("ncacn_np:%s" % (samba.tests.env_get_var_value('SERVER'))) + lsa_conn = lsa.lsarpc(binding_string, lp, creds) ++ self.assertTrue(lsa_conn.transport_encrypted()) + + objectAttr = lsa.ObjectAttribute() + objectAttr.sec_qos = lsa.QosInfo() +-- +2.28.0 + + +From 1c74d87e4dfe78d6e884c9bb4e57ec383d632a88 Mon Sep 17 00:00:00 2001 +From: Isaac Boukris +Date: Thu, 20 Aug 2020 12:47:12 +0200 +Subject: [PATCH 093/105] Add CreateTrustedDomainRelax wrapper for fips mode + +Signed-off-by: Isaac Boukris +Reviewed-by: Stefan Metzmacher +Reviewed-by: Alexander Bokovoy +(cherry picked from commit c2644032b49b4160517a7c73634cebc54a76f827) +--- + python/samba/trust_utils.py | 62 +++++++++++++++++++++++++++++++++++++ + 1 file changed, 62 insertions(+) + create mode 100644 python/samba/trust_utils.py + +diff --git a/python/samba/trust_utils.py b/python/samba/trust_utils.py +new file mode 100644 +index 00000000000..b4df0fa5bb8 +--- /dev/null ++++ b/python/samba/trust_utils.py +@@ -0,0 +1,62 @@ ++# trust utils ++# ++# Copyright Isaac Boukris 2020 ++# ++# This program is free software; you can redistribute it and/or modify ++# it under the terms of the GNU General Public License as published by ++# the Free Software Foundation; either version 3 of the License, or ++# (at your option) any later version. ++# ++# This program is distributed in the hope that it will be useful, ++# but WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++# GNU General Public License for more details. ++# ++# You should have received a copy of the GNU General Public License ++# along with this program. If not, see . ++ ++ ++from samba.dcerpc import lsa, drsblobs ++from samba.ndr import ndr_pack ++from samba import arcfour_encrypt, string_to_byte_array ++import random ++from samba import crypto ++ ++def CreateTrustedDomainRelax(lsaconn, policy, trust_info, mask, in_blob, out_blob): ++ ++ def generate_AuthInfoInternal(session_key, incoming=None, outgoing=None): ++ confounder = [0] * 512 ++ for i in range(len(confounder)): ++ confounder[i] = random.randint(0, 255) ++ ++ trustpass = drsblobs.trustDomainPasswords() ++ ++ trustpass.confounder = confounder ++ trustpass.outgoing = outgoing ++ trustpass.incoming = incoming ++ ++ trustpass_blob = ndr_pack(trustpass) ++ ++ encrypted_trustpass = arcfour_encrypt(session_key, trustpass_blob) ++ ++ auth_blob = lsa.DATA_BUF2() ++ auth_blob.size = len(encrypted_trustpass) ++ auth_blob.data = string_to_byte_array(encrypted_trustpass) ++ ++ auth_info = lsa.TrustDomainInfoAuthInfoInternal() ++ auth_info.auth_blob = auth_blob ++ ++ return auth_info ++ ++ session_key = lsaconn.session_key ++ ++ try: ++ if lsaconn.transport_encrypted(): ++ crypto.set_relax_mode() ++ auth_info = generate_AuthInfoInternal(session_key, ++ incoming=in_blob, ++ outgoing=out_blob) ++ finally: ++ crypto.set_strict_mode() ++ ++ return lsaconn.CreateTrustedDomainEx2(policy, trust_info, auth_info, mask) +-- +2.28.0 + + +From 067c8d73800b928b02bcb1095c13083d9e0e368d Mon Sep 17 00:00:00 2001 +From: Isaac Boukris +Date: Thu, 20 Aug 2020 12:49:17 +0200 +Subject: [PATCH 094/105] Use the new CreateTrustedDomainRelax() + +Signed-off-by: Isaac Boukris +Reviewed-by: Stefan Metzmacher +Reviewed-by: Alexander Bokovoy +(cherry picked from commit baf4e2930ee13b47c23c63c7e945fdc4444f0c69) +--- + python/samba/netcmd/domain.py | 57 ++++++++--------------------------- + 1 file changed, 13 insertions(+), 44 deletions(-) + +diff --git a/python/samba/netcmd/domain.py b/python/samba/netcmd/domain.py +index 1d12c362911..93a3258d28d 100644 +--- a/python/samba/netcmd/domain.py ++++ b/python/samba/netcmd/domain.py +@@ -102,6 +102,7 @@ from samba.netcmd.domain_backup import cmd_domain_backup + + from samba.compat import binary_type + from samba.compat import get_string ++from samba.trust_utils import CreateTrustedDomainRelax + + string_version_to_constant = { + "2008_R2": DS_DOMAIN_FUNCTION_2008_R2, +@@ -2528,54 +2529,20 @@ class cmd_domain_trust_create(DomainTrustCommand): + + return blob + +- def generate_AuthInfoInternal(session_key, incoming=None, outgoing=None): +- confounder = [0] * 512 +- for i in range(len(confounder)): +- confounder[i] = random.randint(0, 255) +- +- trustpass = drsblobs.trustDomainPasswords() +- +- trustpass.confounder = confounder +- trustpass.outgoing = outgoing +- trustpass.incoming = incoming +- +- trustpass_blob = ndr_pack(trustpass) +- +- encrypted_trustpass = arcfour_encrypt(session_key, trustpass_blob) +- +- auth_blob = lsa.DATA_BUF2() +- auth_blob.size = len(encrypted_trustpass) +- auth_blob.data = string_to_byte_array(encrypted_trustpass) +- +- auth_info = lsa.TrustDomainInfoAuthInfoInternal() +- auth_info.auth_blob = auth_blob +- +- return auth_info +- + update_time = samba.current_unix_time() + incoming_blob = generate_AuthInOutBlob(incoming_secret, update_time) + outgoing_blob = generate_AuthInOutBlob(outgoing_secret, update_time) + +- local_tdo_handle = None +- remote_tdo_handle = None +- +- local_auth_info = generate_AuthInfoInternal(local_lsa.session_key, +- incoming=incoming_blob, +- outgoing=outgoing_blob) +- if remote_trust_info: +- remote_auth_info = generate_AuthInfoInternal(remote_lsa.session_key, +- incoming=outgoing_blob, +- outgoing=incoming_blob) +- + try: + if remote_trust_info: + self.outf.write("Creating remote TDO.\n") + current_request = {"location": "remote", "name": "CreateTrustedDomainEx2"} +- remote_tdo_handle = \ +- remote_lsa.CreateTrustedDomainEx2(remote_policy, +- remote_trust_info, +- remote_auth_info, +- lsa.LSA_TRUSTED_DOMAIN_ALL_ACCESS) ++ remote_tdo_handle = CreateTrustedDomainRelax(remote_lsa, ++ remote_policy, ++ remote_trust_info, ++ lsa.LSA_TRUSTED_DOMAIN_ALL_ACCESS, ++ outgoing_blob, ++ incoming_blob) + self.outf.write("Remote TDO created.\n") + if enc_types: + self.outf.write("Setting supported encryption types on remote TDO.\n") +@@ -2586,10 +2553,12 @@ class cmd_domain_trust_create(DomainTrustCommand): + + self.outf.write("Creating local TDO.\n") + current_request = {"location": "local", "name": "CreateTrustedDomainEx2"} +- local_tdo_handle = local_lsa.CreateTrustedDomainEx2(local_policy, +- local_trust_info, +- local_auth_info, +- lsa.LSA_TRUSTED_DOMAIN_ALL_ACCESS) ++ local_tdo_handle = CreateTrustedDomainRelax(local_lsa, ++ local_policy, ++ local_trust_info, ++ lsa.LSA_TRUSTED_DOMAIN_ALL_ACCESS, ++ incoming_blob, ++ outgoing_blob) + self.outf.write("Local TDO created\n") + if enc_types: + self.outf.write("Setting supported encryption types on local TDO.\n") +-- +2.28.0 + + +From 72dfcc923d0cf8054cb0f011e8405fa96b9ec6e0 Mon Sep 17 00:00:00 2001 +From: Isaac Boukris +Date: Tue, 1 Sep 2020 20:14:29 +0300 +Subject: [PATCH 095/105] selftest: add a test for the CreateTrustedDomainRelax + wrapper + +Originally copied from 'source4/scripting/devel/createtrust' +(had to drop the TRUST_AUTH_TYPE_VERSION part though, as it +fails against samba DC). + +Signed-off-by: Isaac Boukris +Reviewed-by: Stefan Metzmacher +Reviewed-by: Alexander Bokovoy +(cherry picked from commit cfaad16ff632df83a881fe5d8ec498bab102c9c9) +--- + python/samba/tests/dcerpc/createtrustrelax.py | 131 ++++++++++++++++++ + selftest/knownfail.d/createtrustrelax_server | 1 + + source4/selftest/tests.py | 4 + + 3 files changed, 136 insertions(+) + create mode 100644 python/samba/tests/dcerpc/createtrustrelax.py + create mode 100644 selftest/knownfail.d/createtrustrelax_server + +diff --git a/python/samba/tests/dcerpc/createtrustrelax.py b/python/samba/tests/dcerpc/createtrustrelax.py +new file mode 100644 +index 00000000000..48beb0f9680 +--- /dev/null ++++ b/python/samba/tests/dcerpc/createtrustrelax.py +@@ -0,0 +1,131 @@ ++# Unix SMB/CIFS implementation. ++# ++# Copyright (C) Andrew Bartlett 2011 ++# Copyright (C) Isaac Boukris 2020 ++# ++# This program is free software; you can redistribute it and/or modify ++# it under the terms of the GNU General Public License as published by ++# the Free Software Foundation; either version 3 of the License, or ++# (at your option) any later version. ++# ++# This program is distributed in the hope that it will be useful, ++# but WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++# GNU General Public License for more details. ++# ++# You should have received a copy of the GNU General Public License ++# along with this program. If not, see . ++# ++ ++"""Tests for the CreateTrustedDomainRelax wrapper""" ++ ++import os ++import samba ++from samba.tests import TestCase ++from samba.dcerpc import lsa, security, drsblobs ++from samba.credentials import Credentials, SMB_ENCRYPTION_REQUIRED, SMB_ENCRYPTION_OFF ++from samba.trust_utils import CreateTrustedDomainRelax ++ ++class CreateTrustedDomainRelaxTest(TestCase): ++ def setUp(self): ++ super(CreateTrustedDomainRelaxTest, self).setUp() ++ ++ def get_user_creds(self): ++ c = Credentials() ++ c.guess() ++ domain = samba.tests.env_get_var_value('DOMAIN') ++ username = samba.tests.env_get_var_value('USERNAME') ++ password = samba.tests.env_get_var_value('PASSWORD') ++ c.set_domain(domain) ++ c.set_username(username) ++ c.set_password(password) ++ return c ++ ++ def _create_trust_relax(self, smbencrypt=True): ++ creds = self.get_user_creds() ++ ++ if smbencrypt: ++ creds.set_smb_encryption(SMB_ENCRYPTION_REQUIRED) ++ else: ++ creds.set_smb_encryption(SMB_ENCRYPTION_OFF) ++ ++ lp = self.get_loadparm() ++ ++ binding_string = ("ncacn_np:%s" % (samba.tests.env_get_var_value('SERVER'))) ++ lsa_conn = lsa.lsarpc(binding_string, lp, creds) ++ ++ if smbencrypt: ++ self.assertTrue(lsa_conn.transport_encrypted()) ++ else: ++ self.assertFalse(lsa_conn.transport_encrypted()) ++ ++ objectAttr = lsa.ObjectAttribute() ++ objectAttr.sec_qos = lsa.QosInfo() ++ ++ pol_handle = lsa_conn.OpenPolicy2('', ++ objectAttr, ++ security.SEC_FLAG_MAXIMUM_ALLOWED) ++ self.assertIsNotNone(pol_handle) ++ ++ name = lsa.String() ++ name.string = "tests.samba.example.com" ++ try: ++ info = lsa_conn.QueryTrustedDomainInfoByName(pol_handle, name, ++ lsa.LSA_TRUSTED_DOMAIN_INFO_FULL_INFO) ++ ++ lsa_conn.DeleteTrustedDomain(pol_handle, info.info_ex.sid) ++ except RuntimeError: ++ pass ++ ++ info = lsa.TrustDomainInfoInfoEx() ++ info.domain_name.string = name.string ++ info.netbios_name.string = "createtrustrelax" ++ info.sid = security.dom_sid("S-1-5-21-538490383-3740119673-95748416") ++ info.trust_direction = lsa.LSA_TRUST_DIRECTION_INBOUND | lsa.LSA_TRUST_DIRECTION_OUTBOUND ++ info.trust_type = lsa.LSA_TRUST_TYPE_UPLEVEL ++ info.trust_attributes = lsa.LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE ++ ++ password_blob = samba.string_to_byte_array("password".encode('utf-16-le')) ++ ++ clear_value = drsblobs.AuthInfoClear() ++ clear_value.size = len(password_blob) ++ clear_value.password = password_blob ++ ++ clear_authentication_information = drsblobs.AuthenticationInformation() ++ clear_authentication_information.LastUpdateTime = 0 ++ clear_authentication_information.AuthType = lsa.TRUST_AUTH_TYPE_CLEAR ++ clear_authentication_information.AuthInfo = clear_value ++ ++ authentication_information_array = drsblobs.AuthenticationInformationArray() ++ authentication_information_array.count = 1 ++ authentication_information_array.array = [clear_authentication_information] ++ ++ outgoing = drsblobs.trustAuthInOutBlob() ++ outgoing.count = 1 ++ outgoing.current = authentication_information_array ++ ++ trustdom_handle = None ++ try: ++ trustdom_handle = CreateTrustedDomainRelax(lsa_conn, ++ pol_handle, ++ info, ++ security.SEC_STD_DELETE, ++ outgoing, ++ outgoing) ++ except samba.NTSTATUSError as nt: ++ raise AssertionError(nt) ++ except OSError as e: ++ if smbencrypt: ++ raise AssertionError(e) ++ ++ if smbencrypt: ++ self.assertIsNotNone(trustdom_handle) ++ lsa_conn.DeleteTrustedDomain(pol_handle, info.sid) ++ else: ++ self.assertIsNone(trustdom_handle) ++ ++ def test_create_trust_relax_encrypt(self): ++ self._create_trust_relax(True) ++ ++ def test_create_trust_relax_no_enc(self): ++ self._create_trust_relax(False) +diff --git a/selftest/knownfail.d/createtrustrelax_server b/selftest/knownfail.d/createtrustrelax_server +new file mode 100644 +index 00000000000..80effda8343 +--- /dev/null ++++ b/selftest/knownfail.d/createtrustrelax_server +@@ -0,0 +1 @@ ++^samba.tests.dcerpc.createtrustrelax.samba.tests.dcerpc.createtrustrelax.CreateTrustedDomainRelaxTest.test_create_trust_relax_encrypt\(ad_dc_fips\) +diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py +index 3a903a7eee0..96f51b68cfc 100755 +--- a/source4/selftest/tests.py ++++ b/source4/selftest/tests.py +@@ -704,6 +704,10 @@ def planoldpythontestsuite(env, module, name=None, extra_path=[], environ={}, ex + name = module + plantestsuite_loadlist(name, env, args) + ++if have_gnutls_crypto_policies: ++ planoldpythontestsuite("ad_dc", "samba.tests.dcerpc.createtrustrelax", environ={'GNUTLS_FORCE_FIPS_MODE':'1'}) ++ planoldpythontestsuite("ad_dc_fips", "samba.tests.dcerpc.createtrustrelax", environ={'GNUTLS_FORCE_FIPS_MODE':'1'}) ++ + # Run complex search expressions test once for each database backend. + # Right now ad_dc has mdb and ad_dc_ntvfs has tdb + mdb_testenv = "ad_dc" +-- +2.28.0 + + +From 341cc046bf816ad5818932c6c5d170a2a9a38783 Mon Sep 17 00:00:00 2001 +From: Isaac Boukris +Date: Thu, 5 Nov 2020 15:38:19 +0200 +Subject: [PATCH 096/105] Remove source4/scripting/devel/createtrust script + +We now have the 'samba-tool domain trust' command. + +Signed-off-by: Isaac Boukris +Reviewed-by: Stefan Metzmacher +Reviewed-by: Alexander Bokovoy + +Autobuild-User(master): Isaac Boukris +Autobuild-Date(master): Fri Nov 6 11:25:02 UTC 2020 on sn-devel-184 + +(cherry picked from commit 604153525afc892f57a1df710c41ffca275b0dd3) +--- + source4/scripting/devel/createtrust | 125 ---------------------------- + 1 file changed, 125 deletions(-) + delete mode 100755 source4/scripting/devel/createtrust + +diff --git a/source4/scripting/devel/createtrust b/source4/scripting/devel/createtrust +deleted file mode 100755 +index 26b0d0dcb68..00000000000 +--- a/source4/scripting/devel/createtrust ++++ /dev/null +@@ -1,125 +0,0 @@ +-#!/usr/bin/env python3 +- +-# create a domain trust +- +-import sys +-from optparse import OptionParser +- +-sys.path.insert(0, "bin/python") +- +-import samba +-import samba.getopt as options +-from samba.dcerpc import lsa, security, drsblobs +-from samba.ndr import ndr_pack +-from samba import arcfour_encrypt, string_to_byte_array +-import random +- +-########### main code ########### +-if __name__ == "__main__": +- parser = OptionParser("createtrust [options] server") +- sambaopts = options.SambaOptions(parser) +- credopts = options.CredentialsOptionsDouble(parser) +- parser.add_option_group(credopts) +- +- (opts, args) = parser.parse_args() +- +- lp = sambaopts.get_loadparm() +- creds = credopts.get_credentials(lp) +- +- if len(args) != 1: +- parser.error("You must supply a server") +- +- if not creds.authentication_requested(): +- parser.error("You must supply credentials") +- +- server = args[0] +- +- binding_str = "ncacn_np:%s[print]" % server +- +- lsaconn = lsa.lsarpc(binding_str, lp, creds) +- +- objectAttr = lsa.ObjectAttribute() +- objectAttr.sec_qos = lsa.QosInfo() +- +- pol_handle = lsaconn.OpenPolicy2(''.decode('utf-8'), +- objectAttr, security.SEC_FLAG_MAXIMUM_ALLOWED) +- +- name = lsa.String() +- name.string = "sub2.win2k3.obed.home.abartlet.net" +- try: +- info = lsaconn.QueryTrustedDomainInfoByName(pol_handle, name, lsa.LSA_TRUSTED_DOMAIN_INFO_FULL_INFO) +- +- lsaconn.DeleteTrustedDomain(pol_handle, info.info_ex.sid) +- except RuntimeError: +- pass +- +- info = lsa.TrustDomainInfoInfoEx() +- info.domain_name.string = "sub2.win2k3.obed.home.abartlet.net" +- info.netbios_name.string = "sub2" +- info.sid = security.dom_sid("S-1-5-21-538090388-3760119675-95745416") +- info.trust_direction = lsa.LSA_TRUST_DIRECTION_INBOUND | lsa.LSA_TRUST_DIRECTION_OUTBOUND +- info.trust_type = lsa.LSA_TRUST_TYPE_UPLEVEL +- info.trust_attributes = lsa.LSA_TRUST_ATTRIBUTE_WITHIN_FOREST +- +- password_blob = string_to_byte_array("password".encode('utf-16-le')) +- +- clear_value = drsblobs.AuthInfoClear() +- clear_value.size = len(password_blob) +- clear_value.password = password_blob +- +- clear_authentication_information = drsblobs.AuthenticationInformation() +- clear_authentication_information.LastUpdateTime = 0 +- clear_authentication_information.AuthType = lsa.TRUST_AUTH_TYPE_CLEAR +- clear_authentication_information.AuthInfo = clear_value +- +- version_value = drsblobs.AuthInfoVersion() +- version_value.version = 1 +- +- version = drsblobs.AuthenticationInformation() +- version.LastUpdateTime = 0 +- version.AuthType = lsa.TRUST_AUTH_TYPE_VERSION +- version.AuthInfo = version_value +- +- authentication_information_array = drsblobs.AuthenticationInformationArray() +- authentication_information_array.count = 2 +- authentication_information_array.array = [clear_authentication_information, version] +- +- outgoing = drsblobs.trustAuthInOutBlob() +- outgoing.count = 1 +- outgoing.current = authentication_information_array +- +- trustpass = drsblobs.trustDomainPasswords() +- confounder = [3] * 512 +- +- for i in range(512): +- confounder[i] = random.randint(0, 255) +- +- trustpass.confounder = confounder +- +-# print "confounder: ", trustpass.confounder +- +- trustpass.outgoing = outgoing +- trustpass.incoming = outgoing +- +- trustpass_blob = ndr_pack(trustpass) +- +-# print "trustpass_blob: ", list(trustpass_blob) +- +- encrypted_trustpass = arcfour_encrypt(lsaconn.session_key, trustpass_blob) +- +-# print "encrypted_trustpass: ", list(encrypted_trustpass) +- +- auth_blob = lsa.DATA_BUF2() +- auth_blob.size = len(encrypted_trustpass) +- auth_blob.data = string_to_byte_array(encrypted_trustpass) +- +- auth_info = lsa.TrustDomainInfoAuthInfoInternal() +- auth_info.auth_blob = auth_blob +- +- +-# print "auth_info.auth_blob.data: ", auth_info.auth_blob.data +- +- trustdom_handle = lsaconn.CreateTrustedDomainEx2(pol_handle, +- info, +- auth_info, +- security.SEC_STD_DELETE) +-- +2.28.0 + + +From f51b23a9b8ad22d4cd4d7dea3ed8f0150974a209 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Fri, 6 Nov 2020 14:30:26 +0100 +Subject: [PATCH 097/105] s3:rpc_server: Use gnutls_cipher_decrypt() in + get_trustdom_auth_blob() + +It doesn't matter for RC4, but just to be correct. + +Signed-off-by: Andreas Schneider +Reviewed-by: Alexander Bokovoy +(cherry picked from commit 6c11e5f42ba3248c97d85c989d422b256d2465a9) +--- + source3/rpc_server/lsa/srv_lsa_nt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/source3/rpc_server/lsa/srv_lsa_nt.c b/source3/rpc_server/lsa/srv_lsa_nt.c +index 198387424e6..e749caf2551 100644 +--- a/source3/rpc_server/lsa/srv_lsa_nt.c ++++ b/source3/rpc_server/lsa/srv_lsa_nt.c +@@ -1726,7 +1726,7 @@ static NTSTATUS get_trustdom_auth_blob(struct pipes_struct *p, + goto out; + } + +- rc = gnutls_cipher_encrypt(cipher_hnd, ++ rc = gnutls_cipher_decrypt(cipher_hnd, + auth_blob->data, + auth_blob->length); + gnutls_cipher_deinit(cipher_hnd); +-- +2.28.0 + + +From 7b24fdcb4a797b1daa97750f8a2c4f2c603115f3 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Fri, 6 Nov 2020 14:33:38 +0100 +Subject: [PATCH 098/105] s4:rpc_server: Use gnutls_cipher_decrypt() in + get_trustdom_auth_blob() + +It doesn't matter for RC4, but just to be correct. + +Signed-off-by: Andreas Schneider +Reviewed-by: Alexander Bokovoy +(cherry picked from commit c93ccebdfedd60c1d19f1b1436ac30062259952a) +--- + source4/rpc_server/lsa/dcesrv_lsa.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/source4/rpc_server/lsa/dcesrv_lsa.c b/source4/rpc_server/lsa/dcesrv_lsa.c +index 8333cb149b6..4bb8aaa9592 100644 +--- a/source4/rpc_server/lsa/dcesrv_lsa.c ++++ b/source4/rpc_server/lsa/dcesrv_lsa.c +@@ -889,7 +889,7 @@ static NTSTATUS get_trustdom_auth_blob(struct dcesrv_call_state *dce_call, + goto out; + } + +- rc = gnutls_cipher_encrypt(cipher_hnd, ++ rc = gnutls_cipher_decrypt(cipher_hnd, + auth_blob->data, + auth_blob->length); + gnutls_cipher_deinit(cipher_hnd); +-- +2.28.0 + + +From acbb59f45cb2b4c35df678ba774425180e9cf8c6 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 20 Aug 2020 13:40:21 +0200 +Subject: [PATCH 099/105] s3:rpc_server: Allow to use RC4 for creating trusts + +Signed-off-by: Andreas Schneider +Reviewed-by: Alexander Bokovoy +Reviewed-by: Stefan Metzmacher +(cherry picked from commit 4425f2c113a4dc33a8dc609d84a92018d61b4d2e) +--- + source3/rpc_server/lsa/srv_lsa_nt.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/source3/rpc_server/lsa/srv_lsa_nt.c b/source3/rpc_server/lsa/srv_lsa_nt.c +index e749caf2551..d6d606ddeca 100644 +--- a/source3/rpc_server/lsa/srv_lsa_nt.c ++++ b/source3/rpc_server/lsa/srv_lsa_nt.c +@@ -51,6 +51,8 @@ + #include "../libcli/lsarpc/util_lsarpc.h" + #include "lsa.h" + #include "librpc/rpc/dcesrv_core.h" ++#include "librpc/rpc/dcerpc_helper.h" ++#include "lib/param/loadparm.h" + + #include "lib/crypto/gnutls_helpers.h" + #include +@@ -1706,6 +1708,14 @@ static NTSTATUS get_trustdom_auth_blob(struct pipes_struct *p, + gnutls_datum_t my_session_key; + NTSTATUS status; + int rc; ++ bool encrypted; ++ ++ encrypted = ++ dcerpc_is_transport_encrypted(p->session_info); ++ if (lp_weak_crypto() == SAMBA_WEAK_CRYPTO_DISALLOWED && ++ !encrypted) { ++ return NT_STATUS_ACCESS_DENIED; ++ } + + status = session_extract_session_key(p->session_info, &lsession_key, KEY_USE_16BYTES); + if (!NT_STATUS_IS_OK(status)) { +@@ -1717,11 +1727,13 @@ static NTSTATUS get_trustdom_auth_blob(struct pipes_struct *p, + .size = lsession_key.length, + }; + ++ GNUTLS_FIPS140_SET_LAX_MODE(); + rc = gnutls_cipher_init(&cipher_hnd, + GNUTLS_CIPHER_ARCFOUR_128, + &my_session_key, + NULL); + if (rc < 0) { ++ GNUTLS_FIPS140_SET_STRICT_MODE(); + status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); + goto out; + } +@@ -1730,6 +1742,7 @@ static NTSTATUS get_trustdom_auth_blob(struct pipes_struct *p, + auth_blob->data, + auth_blob->length); + gnutls_cipher_deinit(cipher_hnd); ++ GNUTLS_FIPS140_SET_STRICT_MODE(); + if (rc < 0) { + status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); + goto out; +-- +2.28.0 + + +From a4d0e69eb7a429a13e456cff7f96870e87791694 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 20 Aug 2020 13:51:39 +0200 +Subject: [PATCH 100/105] s4:rpc_server: Allow to use RC4 for creating trusts + +Signed-off-by: Andreas Schneider +Reviewed-by: Alexander Bokovoy +Reviewed-by: Stefan Metzmacher +(cherry picked from commit c75dd1ea178325b8f65343cb5c35bb93f43a49a3) +--- + source4/rpc_server/lsa/dcesrv_lsa.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/source4/rpc_server/lsa/dcesrv_lsa.c b/source4/rpc_server/lsa/dcesrv_lsa.c +index 4bb8aaa9592..5b3ef71d458 100644 +--- a/source4/rpc_server/lsa/dcesrv_lsa.c ++++ b/source4/rpc_server/lsa/dcesrv_lsa.c +@@ -33,6 +33,8 @@ + #include "libcli/lsarpc/util_lsarpc.h" + #include "lib/messaging/irpc.h" + #include "libds/common/roles.h" ++#include "lib/param/loadparm.h" ++#include "librpc/rpc/dcerpc_helper.h" + + #include "lib/crypto/gnutls_helpers.h" + #include +@@ -869,6 +871,19 @@ static NTSTATUS get_trustdom_auth_blob(struct dcesrv_call_state *dce_call, + gnutls_cipher_hd_t cipher_hnd = NULL; + gnutls_datum_t _session_key; + int rc; ++ struct auth_session_info *session_info = ++ dcesrv_call_session_info(dce_call); ++ struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx; ++ bool encrypted; ++ ++ encrypted = ++ dcerpc_is_transport_encrypted(session_info); ++ if (lpcfg_weak_crypto(lp_ctx) == SAMBA_WEAK_CRYPTO_DISALLOWED && ++ !encrypted) { ++ DBG_ERR("Transport isn't encrypted and weak crypto disallowed!\n"); ++ return NT_STATUS_ACCESS_DENIED; ++ } ++ + + nt_status = dcesrv_transport_session_key(dce_call, &session_key); + if (!NT_STATUS_IS_OK(nt_status)) { +@@ -880,11 +895,13 @@ static NTSTATUS get_trustdom_auth_blob(struct dcesrv_call_state *dce_call, + .size = session_key.length, + }; + ++ GNUTLS_FIPS140_SET_LAX_MODE(); + rc = gnutls_cipher_init(&cipher_hnd, + GNUTLS_CIPHER_ARCFOUR_128, + &_session_key, + NULL); + if (rc < 0) { ++ GNUTLS_FIPS140_SET_STRICT_MODE(); + nt_status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); + goto out; + } +@@ -893,6 +910,7 @@ static NTSTATUS get_trustdom_auth_blob(struct dcesrv_call_state *dce_call, + auth_blob->data, + auth_blob->length); + gnutls_cipher_deinit(cipher_hnd); ++ GNUTLS_FIPS140_SET_STRICT_MODE(); + if (rc < 0) { + nt_status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); + goto out; +-- +2.28.0 + + +From f327133ced90a52d1ff9e104b1722876b21b7a78 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Fri, 6 Nov 2020 10:13:48 +0100 +Subject: [PATCH 101/105] sefltest: Enable the dcerpc.createtrustrelax test + against ad_dc_fips + +Signed-off-by: Andreas Schneider +Reviewed-by: Alexander Bokovoy +Reviewed-by: Stefan Metzmacher + +Autobuild-User(master): Andreas Schneider +Autobuild-Date(master): Mon Nov 9 10:22:51 UTC 2020 on sn-devel-184 + +(cherry picked from commit b89134013041e772418c2c8bcfffe8a9ade6db91) +--- + selftest/knownfail.d/createtrustrelax_server | 1 - + 1 file changed, 1 deletion(-) + delete mode 100644 selftest/knownfail.d/createtrustrelax_server + +diff --git a/selftest/knownfail.d/createtrustrelax_server b/selftest/knownfail.d/createtrustrelax_server +deleted file mode 100644 +index 80effda8343..00000000000 +--- a/selftest/knownfail.d/createtrustrelax_server ++++ /dev/null +@@ -1 +0,0 @@ +-^samba.tests.dcerpc.createtrustrelax.samba.tests.dcerpc.createtrustrelax.CreateTrustedDomainRelaxTest.test_create_trust_relax_encrypt\(ad_dc_fips\) +-- +2.28.0 + + +From 721f97817de2d1e14d99459f9e6af9fccf11b621 Mon Sep 17 00:00:00 2001 +From: Jeremy Allison +Date: Thu, 5 Nov 2020 15:48:08 -0800 +Subject: [PATCH 102/105] s3: spoolss: Make parameters in call to + user_ok_token() match all other uses. + +We already have p->session_info->unix_info->unix_name, we don't +need to go through a legacy call to uidtoname(p->session_info->unix_token->uid). + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14568 + +Signed-off-by: Jeremy Allison +Reviewed-by: Andrew Bartlett + +Autobuild-User(master): Andrew Bartlett +Autobuild-Date(master): Mon Nov 9 04:10:45 UTC 2020 on sn-devel-184 + +(cherry picked from commit e5e1759057a767f517bf480a2172a36623df2799) +--- + source3/rpc_server/spoolss/srv_spoolss_nt.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/source3/rpc_server/spoolss/srv_spoolss_nt.c b/source3/rpc_server/spoolss/srv_spoolss_nt.c +index e98401a4365..906fab2adb5 100644 +--- a/source3/rpc_server/spoolss/srv_spoolss_nt.c ++++ b/source3/rpc_server/spoolss/srv_spoolss_nt.c +@@ -1880,7 +1880,8 @@ WERROR _spoolss_OpenPrinterEx(struct pipes_struct *p, + return WERR_ACCESS_DENIED; + } + +- if (!user_ok_token(uidtoname(p->session_info->unix_token->uid), NULL, ++ if (!user_ok_token(p->session_info->unix_info->unix_name, ++ p->session_info->info->domain_name, + p->session_info->security_token, snum) || + !W_ERROR_IS_OK(print_access_check(p->session_info, + p->msg_ctx, +-- +2.28.0 + + +From a078205ce3816c175cd16dc22875dc147a5da645 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 11 Nov 2020 13:42:06 +0100 +Subject: [PATCH 103/105] s3:smbd: Fix possible null pointer dereference in + token_contains_name() + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14572 + +Signed-off-by: Andreas Schneider +Reviewed-by: Alexander Bokovoy + +Autobuild-User(master): Alexander Bokovoy +Autobuild-Date(master): Thu Nov 12 15:13:47 UTC 2020 on sn-devel-184 + +(cherry picked from commit 8036bf9717f83e83c3e4a9cf00fded42e9a5de15) +--- + source3/smbd/share_access.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/source3/smbd/share_access.c b/source3/smbd/share_access.c +index 57754a0f766..694c0c290e8 100644 +--- a/source3/smbd/share_access.c ++++ b/source3/smbd/share_access.c +@@ -79,7 +79,7 @@ static bool token_contains_name(TALLOC_CTX *mem_ctx, + enum lsa_SidType type; + + if (username != NULL) { +- size_t domain_len = strlen(domain); ++ size_t domain_len = domain != NULL ? strlen(domain) : 0; + + /* Check if username starts with domain name */ + if (domain_len > 0) { +-- +2.28.0 + + +From 5654101584b7742e684d12e6aea43e5004142dcb Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Tue, 10 Nov 2020 17:35:24 +0200 +Subject: [PATCH 104/105] lookup_name: allow lookup names prefixed with DNS + forest root for FreeIPA DC + +In FreeIPA deployment with active Global Catalog service, when a two-way +trust to Active Directory forest is established, Windows systems can +look up FreeIPA users and groups. When using a security tab in Windows +Explorer on AD side, a lookup over a trusted forest might come as +realm\name instead of NetBIOS domain name: + +-------------------------------------------------------------------- +[2020/01/13 11:12:39.859134, 1, pid=33253, effective(1732401004, 1732401004), real(1732401004, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:471(ndr_print_function_debug) + lsa_LookupNames3: struct lsa_LookupNames3 + in: struct lsa_LookupNames3 + handle : * + handle: struct policy_handle + handle_type : 0x00000000 (0) + uuid : 0000000e-0000-0000-1c5e-a750e5810000 + num_names : 0x00000001 (1) + names: ARRAY(1) + names: struct lsa_String + length : 0x001e (30) + size : 0x0020 (32) + string : * + string : 'ipa.test\admins' + sids : * + sids: struct lsa_TransSidArray3 + count : 0x00000000 (0) + sids : NULL + level : LSA_LOOKUP_NAMES_UPLEVEL_TRUSTS_ONLY2 (6) + count : * + count : 0x00000000 (0) + lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) + client_revision : LSA_CLIENT_REVISION_2 (2) +-------------------------------------------------------------------- + +If we are running as a DC and PASSDB supports returning domain info +(pdb_get_domain_info() returns a valid structure), check domain of the +name in lookup_name() against DNS forest name and allow the request to +be done against the primary domain. This corresponds to FreeIPA's use of +Samba as a DC. For normal domain members a realm-based lookup falls back +to a lookup over to its own domain controller with the help of winbindd. + +Signed-off-by: Alexander Bokovoy +Reviewed-by: Stefan Metzmacher + +Autobuild-User(master): Alexander Bokovoy +Autobuild-Date(master): Wed Nov 11 10:59:01 UTC 2020 on sn-devel-184 + +(cherry picked from commit 31c703766fd2b89737826fb7e9a707f0622bb8cd) +--- + source3/passdb/lookup_sid.c | 37 ++++++++++++++++++++++++++++--------- + 1 file changed, 28 insertions(+), 9 deletions(-) + +diff --git a/source3/passdb/lookup_sid.c b/source3/passdb/lookup_sid.c +index 82c47b3145b..864246da56e 100644 +--- a/source3/passdb/lookup_sid.c ++++ b/source3/passdb/lookup_sid.c +@@ -113,17 +113,36 @@ bool lookup_name(TALLOC_CTX *mem_ctx, + full_name, domain, name)); + DEBUG(10, ("lookup_name: flags = 0x0%x\n", flags)); + +- if (((flags & LOOKUP_NAME_DOMAIN) || (flags == 0)) && +- strequal(domain, get_global_sam_name())) +- { ++ if ((flags & LOOKUP_NAME_DOMAIN) || (flags == 0)) { ++ bool check_global_sam = false; ++ ++ check_global_sam = strequal(domain, get_global_sam_name()); ++ ++ /* If we are running on a DC that has PASSDB module with domain ++ * information, check if DNS forest name is matching the domain ++ * name. This is the case of FreeIPA domain controller when ++ * trusted AD DC looks up users found in a Global Catalog of ++ * the forest root domain. */ ++ if (!check_global_sam && (IS_DC)) { ++ struct pdb_domain_info *dom_info = NULL; ++ dom_info = pdb_get_domain_info(tmp_ctx); ++ ++ if ((dom_info != NULL) && (dom_info->dns_forest != NULL)) { ++ check_global_sam = strequal(domain, dom_info->dns_forest); ++ } + +- /* It's our own domain, lookup the name in passdb */ +- if (lookup_global_sam_name(name, flags, &rid, &type)) { +- sid_compose(&sid, get_global_sam_sid(), rid); +- goto ok; ++ TALLOC_FREE(dom_info); ++ } ++ ++ if (check_global_sam) { ++ /* It's our own domain, lookup the name in passdb */ ++ if (lookup_global_sam_name(name, flags, &rid, &type)) { ++ sid_compose(&sid, get_global_sam_sid(), rid); ++ goto ok; ++ } ++ TALLOC_FREE(tmp_ctx); ++ return false; + } +- TALLOC_FREE(tmp_ctx); +- return false; + } + + if ((flags & LOOKUP_NAME_BUILTIN) && +-- +2.28.0 + + +From efa59aa4b2455ea3bc4d0fd0358b160858626585 Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Wed, 11 Nov 2020 14:42:55 +0200 +Subject: [PATCH 105/105] auth_sam: use pdb_get_domain_info to look up DNS + forest information + +When Samba is used as a part of FreeIPA domain controller, Windows +clients for a trusted AD forest may try to authenticate (perform logon +operation) as a REALM\name user account. + +Fix auth_sam plugins to accept DNS forest name if we are running on a DC +with PASSDB module providing domain information (e.g. pdb_get_domain_info() +returning non-NULL structure). Right now, only FreeIPA or Samba AD DC +PASSDB backends return this information but Samba AD DC configuration is +explicitly ignored by the two auth_sam (strict and netlogon3) modules. + +Detailed logs below: + +[2020/11/11 09:23:53.281296, 1, pid=42677, effective(65534, 65534), real(65534, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:482(ndr_print_function_debug) + netr_LogonSamLogonWithFlags: struct netr_LogonSamLogonWithFlags + in: struct netr_LogonSamLogonWithFlags + server_name : * + server_name : '\\master.ipa.test' + computer_name : * + computer_name : 'AD1' + credential : * + credential: struct netr_Authenticator + cred: struct netr_Credential + data : 529f4b087c5f6546 + timestamp : Wed Nov 11 09:23:55 AM 2020 UTC + return_authenticator : * + return_authenticator: struct netr_Authenticator + cred: struct netr_Credential + data : 204f28f622010000 + timestamp : Fri May 2 06:37:50 AM 1986 UTC + logon_level : NetlogonNetworkTransitiveInformation (6) + logon : * + logon : union netr_LogonLevel(case 6) + network : * + network: struct netr_NetworkInfo + identity_info: struct netr_IdentityInfo + domain_name: struct lsa_String + length : 0x0010 (16) + size : 0x01fe (510) + string : * + string : 'IPA.TEST' + parameter_control : 0x00002ae0 (10976) + 0: MSV1_0_CLEARTEXT_PASSWORD_ALLOWED + 0: MSV1_0_UPDATE_LOGON_STATISTICS + 0: MSV1_0_RETURN_USER_PARAMETERS + 0: MSV1_0_DONT_TRY_GUEST_ACCOUNT + 1: MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT + 1: MSV1_0_RETURN_PASSWORD_EXPIRY + 1: MSV1_0_USE_CLIENT_CHALLENGE + 0: MSV1_0_TRY_GUEST_ACCOUNT_ONLY + 1: MSV1_0_RETURN_PROFILE_PATH + 0: MSV1_0_TRY_SPECIFIED_DOMAIN_ONLY + 1: MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT + 0: MSV1_0_DISABLE_PERSONAL_FALLBACK + 1: MSV1_0_ALLOW_FORCE_GUEST + 0: MSV1_0_CLEARTEXT_PASSWORD_SUPPLIED + 0: MSV1_0_USE_DOMAIN_FOR_ROUTING_ONLY + 0: MSV1_0_ALLOW_MSVCHAPV2 + 0: MSV1_0_S4U2SELF + 0: MSV1_0_CHECK_LOGONHOURS_FOR_S4U + 0: MSV1_0_SUBAUTHENTICATION_DLL_EX + logon_id : 0x0000000000884ef2 (8933106) + account_name: struct lsa_String + length : 0x000e (14) + size : 0x000e (14) + string : * + string : 'idmuser' + workstation: struct lsa_String + length : 0x0000 (0) + size : 0x0000 (0) + string : * + string : '' + challenge : 417207867bd33c74 + nt: struct netr_ChallengeResponse + length : 0x00c0 (192) + size : 0x00c0 (192) + data : * + data: ARRAY(192) + [0000] A5 24 62 6E 31 DF 69 66 9E DC 54 D6 63 4C D6 2F .$bn1.if ..T.cL./ + [0010] 01 01 00 00 00 00 00 00 50 37 D7 60 0C B8 D6 01 ........ P7.`.... + [0020] 15 1B 38 4F 47 95 4D 62 00 00 00 00 02 00 0E 00 ..8OG.Mb ........ + [0030] 57 00 49 00 4E 00 32 00 30 00 31 00 36 00 01 00 W.I.N.2. 0.1.6... + [0040] 06 00 41 00 44 00 31 00 04 00 18 00 77 00 69 00 ..A.D.1. ....w.i. + [0050] 6E 00 32 00 30 00 31 00 36 00 2E 00 74 00 65 00 n.2.0.1. 6...t.e. + [0060] 73 00 74 00 03 00 20 00 61 00 64 00 31 00 2E 00 s.t... . a.d.1... + [0070] 77 00 69 00 6E 00 32 00 30 00 31 00 36 00 2E 00 w.i.n.2. 0.1.6... + [0080] 74 00 65 00 73 00 74 00 05 00 18 00 77 00 69 00 t.e.s.t. ....w.i. + [0090] 6E 00 32 00 30 00 31 00 36 00 2E 00 74 00 65 00 n.2.0.1. 6...t.e. + [00A0] 73 00 74 00 07 00 08 00 50 37 D7 60 0C B8 D6 01 s.t..... P7.`.... + [00B0] 06 00 04 00 02 00 00 00 00 00 00 00 00 00 00 00 ........ ........ + lm: struct netr_ChallengeResponse + length : 0x0018 (24) + size : 0x0018 (24) + data : * + data : 000000000000000000000000000000000000000000000000 + validation_level : 0x0006 (6) + flags : * + flags : 0x00000000 (0) + 0: NETLOGON_SAMLOGON_FLAG_PASS_TO_FOREST_ROOT + 0: NETLOGON_SAMLOGON_FLAG_PASS_CROSS_FOREST_HOP + 0: NETLOGON_SAMLOGON_FLAG_RODC_TO_OTHER_DOMAIN + 0: NETLOGON_SAMLOGON_FLAG_RODC_NTLM_REQUEST + +In such case checks for a workgroup name will not match the DNS forest +name used in the username specification: + +[2020/11/11 09:23:53.283055, 3, pid=42677, effective(65534, 65534), real(65534, 0), class=auth] ../../source3/auth/auth.c:200(auth_check_ntlm_password) + check_ntlm_password: Checking password for unmapped user [IPA.TEST]\[idmuser]@[] with the new password interface +[2020/11/11 09:23:53.283073, 3, pid=42677, effective(65534, 65534), real(65534, 0), class=auth] ../../source3/auth/auth.c:203(auth_check_ntlm_password) + check_ntlm_password: mapped user is: [IPA.TEST]\[idmuser]@[] +[2020/11/11 09:23:53.283082, 10, pid=42677, effective(65534, 65534), real(65534, 0), class=auth] ../../source3/auth/auth.c:213(auth_check_ntlm_password) + check_ntlm_password: auth_context challenge created by fixed +[2020/11/11 09:23:53.283091, 10, pid=42677, effective(65534, 65534), real(65534, 0), class=auth] ../../source3/auth/auth.c:216(auth_check_ntlm_password) + challenge is: +[2020/11/11 09:23:53.283099, 5, pid=42677, effective(65534, 65534), real(65534, 0)] ../../lib/util/util.c:678(dump_data) + [0000] 41 72 07 86 7B D3 3C 74 Ar..{. +Reviewed-by: Andreas Schneider +(cherry picked from commit 2a8b672652dcbcf55ec59be537773d76f0f14d0a) +--- + source3/auth/auth_sam.c | 45 +++++++++++++++++++++++++++++++++++++---- + 1 file changed, 41 insertions(+), 4 deletions(-) + +diff --git a/source3/auth/auth_sam.c b/source3/auth/auth_sam.c +index 3c12f959faf..e8e0d543f8c 100644 +--- a/source3/auth/auth_sam.c ++++ b/source3/auth/auth_sam.c +@@ -22,6 +22,7 @@ + + #include "includes.h" + #include "auth.h" ++#include "passdb.h" + + #undef DBGC_CLASS + #define DBGC_CLASS DBGC_AUTH +@@ -142,10 +143,28 @@ static NTSTATUS auth_samstrict_auth(const struct auth_context *auth_context, + break; + case ROLE_DOMAIN_PDC: + case ROLE_DOMAIN_BDC: +- if ( !is_local_name && !is_my_domain ) { +- DEBUG(6,("check_samstrict_security: %s is not one of my local names or domain name (DC)\n", +- effective_domain)); +- return NT_STATUS_NOT_IMPLEMENTED; ++ if (!is_local_name && !is_my_domain) { ++ /* If we are running on a DC that has PASSDB module with domain ++ * information, check if DNS forest name is matching the domain ++ * name. This is the case of FreeIPA domain controller when ++ * trusted AD DCs attempt to authenticate FreeIPA users using ++ * the forest root domain (which is the only domain in FreeIPA). ++ */ ++ struct pdb_domain_info *dom_info = NULL; ++ ++ dom_info = pdb_get_domain_info(mem_ctx); ++ if ((dom_info != NULL) && (dom_info->dns_forest != NULL)) { ++ is_my_domain = strequal(user_info->mapped.domain_name, ++ dom_info->dns_forest); ++ } ++ ++ TALLOC_FREE(dom_info); ++ if (!is_my_domain) { ++ DEBUG(6,("check_samstrict_security: %s is not one " ++ "of my local names or domain name (DC)\n", ++ effective_domain)); ++ return NT_STATUS_NOT_IMPLEMENTED; ++ } + } + + break; +@@ -230,6 +249,24 @@ static NTSTATUS auth_sam_netlogon3_auth(const struct auth_context *auth_context, + } + + is_my_domain = strequal(user_info->mapped.domain_name, lp_workgroup()); ++ if (!is_my_domain) { ++ /* If we are running on a DC that has PASSDB module with domain ++ * information, check if DNS forest name is matching the domain ++ * name. This is the case of FreeIPA domain controller when ++ * trusted AD DCs attempt to authenticate FreeIPA users using ++ * the forest root domain (which is the only domain in FreeIPA). ++ */ ++ struct pdb_domain_info *dom_info = NULL; ++ dom_info = pdb_get_domain_info(mem_ctx); ++ ++ if ((dom_info != NULL) && (dom_info->dns_forest != NULL)) { ++ is_my_domain = strequal(user_info->mapped.domain_name, ++ dom_info->dns_forest); ++ } ++ ++ TALLOC_FREE(dom_info); ++ } ++ + if (!is_my_domain) { + DBG_INFO("%s is not our domain name (DC for %s)\n", + effective_domain, lp_workgroup()); +-- +2.28.0 + diff --git a/samba-gc-lookup_unix_user_name-allow-lookup-for-own-realm.patch b/samba-gc-lookup_unix_user_name-allow-lookup-for-own-realm.patch deleted file mode 100644 index e0ed8ae..0000000 --- a/samba-gc-lookup_unix_user_name-allow-lookup-for-own-realm.patch +++ /dev/null @@ -1,210 +0,0 @@ -From 81d6949acdad70ecfb130d3286eeab1b3a51937f Mon Sep 17 00:00:00 2001 -From: Alexander Bokovoy -Date: Wed, 7 Oct 2020 19:25:24 +0300 -Subject: [PATCH 1/2] cli_credentials_parse_string: fix parsing of principals - -When parsing a principal-like name, user name was left with full -principal instead of taking only the left part before '@' sign. - ->>> from samba import credentials ->>> t = credentials.Credentials() ->>> t.parse_string('admin@realm.test', credentials.SPECIFIED) ->>> t.get_username() -'admin@realm.test' - -The issue is that cli_credentials_set_username() does a talloc_strdup() -of the argument, so we need to change order of assignment to allow -talloc_strdup() to copy the right part of the string. - -Signed-off-by: Alexander Bokovoy ---- - auth/credentials/credentials.c | 5 ++--- - 1 file changed, 2 insertions(+), 3 deletions(-) - -diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c -index 77c35dd104b..06ac79058f9 100644 ---- a/auth/credentials/credentials.c -+++ b/auth/credentials/credentials.c -@@ -840,11 +840,10 @@ _PUBLIC_ void cli_credentials_parse_string(struct cli_credentials *credentials, - * in order to undo the effect of - * cli_credentials_guess(). - */ -- cli_credentials_set_username(credentials, uname, obtained); -- cli_credentials_set_domain(credentials, "", obtained); -- - cli_credentials_set_principal(credentials, uname, obtained); - *p = 0; -+ cli_credentials_set_username(credentials, uname, obtained); -+ cli_credentials_set_domain(credentials, "", obtained); - cli_credentials_set_realm(credentials, p+1, obtained); - return; - } else if ((p = strchr_m(uname,'\\')) --- -2.28.0 - - -From fa38bebb993011428612d51819530218d8358f5e Mon Sep 17 00:00:00 2001 -From: Alexander Bokovoy -Date: Mon, 13 Jan 2020 16:04:20 +0200 -Subject: [PATCH 2/2] lookup_name: allow lookup for own realm - -When using security tab in Windows Explorer, a lookup over a trusted -forest might come as realm\name instead of NetBIOS domain name: - --------------------------------------------------------------------- -[2020/01/13 11:12:39.859134, 1, pid=33253, effective(1732401004, 1732401004), real(1732401004, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:471(ndr_print_function_debug) - lsa_LookupNames3: struct lsa_LookupNames3 - in: struct lsa_LookupNames3 - handle : * - handle: struct policy_handle - handle_type : 0x00000000 (0) - uuid : 0000000e-0000-0000-1c5e-a750e5810000 - num_names : 0x00000001 (1) - names: ARRAY(1) - names: struct lsa_String - length : 0x001e (30) - size : 0x0020 (32) - string : * - string : 'ipa.test\admins' - sids : * - sids: struct lsa_TransSidArray3 - count : 0x00000000 (0) - sids : NULL - level : LSA_LOOKUP_NAMES_UPLEVEL_TRUSTS_ONLY2 (6) - count : * - count : 0x00000000 (0) - lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) - client_revision : LSA_CLIENT_REVISION_2 (2) --------------------------------------------------------------------- - -Allow this lookup using realm to be done against primary domain. - -Refactor user name parsing code to reuse cli_credentials_* API to be -consistent with other places. cli_credentials_parse_string() handles -both domain and realm-based user name variants. - -Signed-off-by: Alexander Bokovoy ---- - source3/passdb/lookup_sid.c | 75 ++++++++++++++++++++++++++----------- - 1 file changed, 53 insertions(+), 22 deletions(-) - -diff --git a/source3/passdb/lookup_sid.c b/source3/passdb/lookup_sid.c -index 82c47b3145b..39d599fed27 100644 ---- a/source3/passdb/lookup_sid.c -+++ b/source3/passdb/lookup_sid.c -@@ -29,6 +29,7 @@ - #include "../libcli/security/security.h" - #include "lib/winbind_util.h" - #include "../librpc/gen_ndr/idmap.h" -+#include "auth/credentials/credentials.h" - - static bool lookup_unix_user_name(const char *name, struct dom_sid *sid) - { -@@ -78,52 +79,82 @@ bool lookup_name(TALLOC_CTX *mem_ctx, - const char **ret_domain, const char **ret_name, - struct dom_sid *ret_sid, enum lsa_SidType *ret_type) - { -- char *p; - const char *tmp; - const char *domain = NULL; - const char *name = NULL; -+ const char *realm = NULL; - uint32_t rid; - struct dom_sid sid; - enum lsa_SidType type; - TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx); -+ struct cli_credentials *creds = NULL; - - if (tmp_ctx == NULL) { - DEBUG(0, ("talloc_new failed\n")); - return false; - } - -- p = strchr_m(full_name, '\\'); -- -- if (p != NULL) { -- domain = talloc_strndup(tmp_ctx, full_name, -- PTR_DIFF(p, full_name)); -- name = talloc_strdup(tmp_ctx, p+1); -- } else { -- domain = talloc_strdup(tmp_ctx, ""); -- name = talloc_strdup(tmp_ctx, full_name); -+ creds = cli_credentials_init(tmp_ctx); -+ if (creds == NULL) { -+ DEBUG(0, ("cli_credentials_init failed\n")); -+ return false; - } - -- if ((domain == NULL) || (name == NULL)) { -- DEBUG(0, ("talloc failed\n")); -- TALLOC_FREE(tmp_ctx); -+ cli_credentials_parse_string(creds, full_name, CRED_SPECIFIED); -+ name = cli_credentials_get_username(creds); -+ domain = cli_credentials_get_domain(creds); -+ realm = cli_credentials_get_realm(creds); -+ -+ /* At this point we have: -+ * - name -- normal name or empty string -+ * - domain -- either NULL or domain name -+ * - realm -- either NULL or realm name -+ * -+ * domain and realm are exclusive to each other -+ * the code below in lookup_name assumes domain -+ * to be at least empty string, not NULL -+ */ -+ -+ if ((name == NULL) || (name[0] == '\0')) { -+ DEBUG(0, ("lookup_name with empty name, exit\n")); - return false; - } - -+ if ((domain == NULL) && (realm == NULL)) { -+ domain = talloc_strdup(creds, ""); -+ } -+ - DEBUG(10,("lookup_name: %s => domain=[%s], name=[%s]\n", - full_name, domain, name)); - DEBUG(10, ("lookup_name: flags = 0x0%x\n", flags)); - -- if (((flags & LOOKUP_NAME_DOMAIN) || (flags == 0)) && -- strequal(domain, get_global_sam_name())) -- { -+ /* Windows clients may send a LookupNames request with both NetBIOS -+ * domain name- and realm-qualified user names. Thus, we need to check -+ * both against both of the SAM domain name and realm, if set. Since -+ * domain name and realm in the request are exclusive, test the one -+ * that is specified. cli_credentials_parse_string() will either set -+ * realm or wouldn't so we can use it to detect if realm was specified. -+ */ -+ if ((flags & LOOKUP_NAME_DOMAIN) || (flags == 0)) { -+ const char *domain_name = realm ? realm : domain; -+ bool check_global_sam = false; -+ -+ if (domain_name[0] != '\0') { -+ check_global_sam = strequal(domain_name, get_global_sam_name()); -+ if (!check_global_sam && lp_realm() != NULL) { -+ check_global_sam = strequal(domain_name, lp_realm()); -+ } -+ } - -- /* It's our own domain, lookup the name in passdb */ -- if (lookup_global_sam_name(name, flags, &rid, &type)) { -- sid_compose(&sid, get_global_sam_sid(), rid); -- goto ok; -+ if (check_global_sam) { -+ /* It's our own domain, lookup the name in passdb */ -+ if (lookup_global_sam_name(name, flags, &rid, &type)) { -+ sid_compose(&sid, get_global_sam_sid(), rid); -+ goto ok; -+ } -+ TALLOC_FREE(tmp_ctx); -+ return false; - } -- TALLOC_FREE(tmp_ctx); -- return false; - } - - if ((flags & LOOKUP_NAME_BUILTIN) && --- -2.28.0 - diff --git a/samba.spec b/samba.spec index a45d6bc..551e102 100644 --- a/samba.spec +++ b/samba.spec @@ -3789,6 +3789,9 @@ fi %changelog * Wed Nov 25 2020 Alexander Bokovoy - 4.13.2-2 - rhbz#1892745, rhbz#1900232: smbclient mget crashes (upstream bug 14517) +- Merge RHEL 8.4 patches: + - FIPS-related enhancements + - FreeIPA Global Catalog patches * Tue Nov 03 2020 Andreas Schneider - 4.13.2-1 - Create a python3-samba-devel package to avoid unnessary dependencies From bcc551eafa2f98c0bd653e9a8baad62c757b1e27 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Wed, 25 Nov 2020 13:52:50 +0200 Subject: [PATCH 069/425] Add new unpackaged Python modules --- samba.spec | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/samba.spec b/samba.spec index 551e102..315f2f0 100644 --- a/samba.spec +++ b/samba.spec @@ -177,6 +177,10 @@ Source14: samba.pamd Source201: README.downgrade Patch1: samba-s4u.patch +# Backport bug fixes to https://gitlab.com/samba-redhat/samba/-/tree/v4-13-redhat +# This will give us CI and makes it easy to generate patchsets. +# +# Generate the patchset using: git format-patch -l1 --stdout -N > samba-4.13-redhat.patch Patch2: samba-4.13-redhat.patch Patch3: samba-smbclient-mget-bug-14517.patch @@ -2599,6 +2603,7 @@ fi %{python3_sitearch}/samba/tests/dcerpc/__pycache__/__init__.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/array.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/bare.*.pyc +%{python3_sitearch}/samba/tests/dcerpc/__pycache__/binding.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/dnsserver.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/integer.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/mdssvc.*.pyc @@ -2609,12 +2614,14 @@ fi %{python3_sitearch}/samba/tests/dcerpc/__pycache__/rpc_talloc.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/rpcecho.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/sam.*.pyc +%{python3_sitearch}/samba/tests/dcerpc/__pycache__/samr_change_password.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/srvsvc.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/string_tests.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/testrpc.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/unix.*.pyc %{python3_sitearch}/samba/tests/dcerpc/array.py %{python3_sitearch}/samba/tests/dcerpc/bare.py +%{python3_sitearch}/samba/tests/dcerpc/binding.py %{python3_sitearch}/samba/tests/dcerpc/dnsserver.py %{python3_sitearch}/samba/tests/dcerpc/integer.py %{python3_sitearch}/samba/tests/dcerpc/mdssvc.py @@ -2625,6 +2632,7 @@ fi %{python3_sitearch}/samba/tests/dcerpc/rpc_talloc.py %{python3_sitearch}/samba/tests/dcerpc/rpcecho.py %{python3_sitearch}/samba/tests/dcerpc/sam.py +%{python3_sitearch}/samba/tests/dcerpc/samr_change_password.py %{python3_sitearch}/samba/tests/dcerpc/srvsvc.py %{python3_sitearch}/samba/tests/dcerpc/string_tests.py %{python3_sitearch}/samba/tests/dcerpc/testrpc.py From 0526d5b25f17f163e1b04896b1a03c98c2a77acf Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Wed, 25 Nov 2020 17:05:49 +0200 Subject: [PATCH 070/425] More missing Python modules --- samba.spec | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/samba.spec b/samba.spec index 315f2f0..a885bc3 100644 --- a/samba.spec +++ b/samba.spec @@ -2162,6 +2162,7 @@ fi %{python3_sitearch}/samba/__pycache__/sites.*.pyc %{python3_sitearch}/samba/__pycache__/subnets.*.pyc %{python3_sitearch}/samba/__pycache__/tdb_util.*.pyc +%{python3_sitearch}/samba/__pycache__/trust_utils.*.pyc %{python3_sitearch}/samba/__pycache__/upgrade.*.pyc %{python3_sitearch}/samba/__pycache__/upgradehelpers.*.pyc %{python3_sitearch}/samba/__pycache__/xattr.*.pyc @@ -2352,6 +2353,7 @@ fi %{python3_sitearch}/samba/third_party/__init__.py %dir %{python3_sitearch}/samba/third_party/__pycache__ %{python3_sitearch}/samba/third_party/__pycache__/__init__.*.pyc +%{python3_sitearch}/samba/trust_utils.py %{python3_sitearch}/samba/upgrade.py %{python3_sitearch}/samba/upgradehelpers.py %{python3_sitearch}/samba/werror.*.so @@ -2603,6 +2605,7 @@ fi %{python3_sitearch}/samba/tests/dcerpc/__pycache__/__init__.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/array.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/bare.*.pyc +%{python3_sitearch}/samba/tests/dcerpc/__pycache__/createtrustrelax.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/binding.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/dnsserver.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/integer.*.pyc @@ -2622,6 +2625,7 @@ fi %{python3_sitearch}/samba/tests/dcerpc/array.py %{python3_sitearch}/samba/tests/dcerpc/bare.py %{python3_sitearch}/samba/tests/dcerpc/binding.py +%{python3_sitearch}/samba/tests/dcerpc/createtrustrelax.py %{python3_sitearch}/samba/tests/dcerpc/dnsserver.py %{python3_sitearch}/samba/tests/dcerpc/integer.py %{python3_sitearch}/samba/tests/dcerpc/mdssvc.py From ee8f8c2cd1b0c34e0c3c18d4bf5ad52552f101b0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 15 Dec 2020 12:06:05 +0100 Subject: [PATCH 071/425] Update to Samba 4.13.3 Guenther --- .gitignore | 2 + samba-4.13-redhat.patch | 1028 ++++++++++++-------------- samba-smbclient-mget-bug-14517.patch | 430 ----------- samba.spec | 8 +- sources | 4 +- 5 files changed, 478 insertions(+), 994 deletions(-) delete mode 100644 samba-smbclient-mget-bug-14517.patch diff --git a/.gitignore b/.gitignore index 6578c2a..9170f96 100644 --- a/.gitignore +++ b/.gitignore @@ -227,3 +227,5 @@ samba-3.6.0pre1.tar.gz /samba-4.13.1.tar.asc /samba-4.13.2.tar.xz /samba-4.13.2.tar.asc +/samba-4.13.3.tar.xz +/samba-4.13.3.tar.asc diff --git a/samba-4.13-redhat.patch b/samba-4.13-redhat.patch index 33b84bd..e085e74 100644 --- a/samba-4.13-redhat.patch +++ b/samba-4.13-redhat.patch @@ -1,7 +1,7 @@ -From 77a771be72a6084216ea848f2d851eb7192ae9b9 Mon Sep 17 00:00:00 2001 +From 4e5d178f9367f4e51b387b7d4df1e8407b15fafc Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 13 Jul 2020 16:15:03 +0200 -Subject: [PATCH 001/105] libcli:smb2: Do not leak ptext on error +Subject: [PATCH 001/104] libcli:smb2: Do not leak ptext on error Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -10,10 +10,10 @@ Reviewed-by: Stefan Metzmacher 1 file changed, 1 insertion(+) diff --git a/libcli/smb/smb2_signing.c b/libcli/smb/smb2_signing.c -index 623fc23fb18..bba80817018 100644 +index cc03607d789..4d430f56df5 100644 --- a/libcli/smb/smb2_signing.c +++ b/libcli/smb/smb2_signing.c -@@ -522,6 +522,7 @@ NTSTATUS smb2_signing_encrypt_pdu(struct smb2_signing_key *encryption_key, +@@ -520,6 +520,7 @@ NTSTATUS smb2_signing_encrypt_pdu(struct smb2_signing_key *encryption_key, ctext = talloc_size(talloc_tos(), ctext_size); if (ctext == NULL) { @@ -22,13 +22,13 @@ index 623fc23fb18..bba80817018 100644 goto out; } -- -2.28.0 +2.29.2 -From eb5fbbd3090cbdea95b14e9ac167253fafe633f8 Mon Sep 17 00:00:00 2001 +From 1310c58c3b8b9c7fcb0c811a9ef24b3bbe8c16f1 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 13 Jul 2020 17:23:37 +0200 -Subject: [PATCH 002/105] libcli:smb2: Use talloc NULL context if we don't have +Subject: [PATCH 002/104] libcli:smb2: Use talloc NULL context if we don't have a stackframe If we execute this code from python we don't have a talloc stackframe @@ -44,10 +44,10 @@ Reviewed-by: Stefan Metzmacher 1 file changed, 26 insertions(+), 4 deletions(-) diff --git a/libcli/smb/smb2_signing.c b/libcli/smb/smb2_signing.c -index bba80817018..7669b219bbe 100644 +index 4d430f56df5..6ece5f2e4d3 100644 --- a/libcli/smb/smb2_signing.c +++ b/libcli/smb/smb2_signing.c -@@ -513,14 +513,25 @@ NTSTATUS smb2_signing_encrypt_pdu(struct smb2_signing_key *encryption_key, +@@ -511,14 +511,25 @@ NTSTATUS smb2_signing_encrypt_pdu(struct smb2_signing_key *encryption_key, uint8_t *ctext = NULL; size_t len = 0; int i; @@ -75,7 +75,7 @@ index bba80817018..7669b219bbe 100644 if (ctext == NULL) { TALLOC_FREE(ptext); status = NT_STATUS_NO_MEMORY; -@@ -713,16 +724,27 @@ NTSTATUS smb2_signing_decrypt_pdu(struct smb2_signing_key *decryption_key, +@@ -710,16 +721,27 @@ NTSTATUS smb2_signing_decrypt_pdu(struct smb2_signing_key *decryption_key, uint8_t *ptext = NULL; size_t len = 0; int i; @@ -106,13 +106,13 @@ index bba80817018..7669b219bbe 100644 TALLOC_FREE(ptext); status = NT_STATUS_NO_MEMORY; -- -2.28.0 +2.29.2 -From 66ee204aee9a4919d94003a9a3263a44c2d5b436 Mon Sep 17 00:00:00 2001 +From ff15d93d1009a23428b9c11090836624255924cd Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Wed, 6 Nov 2019 17:37:45 +0100 -Subject: [PATCH 003/105] auth:creds: Introduce CRED_SMB_CONF +Subject: [PATCH 003/104] auth:creds: Introduce CRED_SMB_CONF We have several places where we check '> CRED_UNINITIALISED', so we better don't use CRED_UNINITIALISED for values from @@ -202,13 +202,13 @@ index d2a81506de3..6454ac9ff7c 100644 self.assertEqual(creds.get_domain(), lp.get("workgroup").upper()) self.assertEqual(creds.get_realm(), realm.upper()) -- -2.28.0 +2.29.2 -From 8d2d8cdc90d0455429c9d461ebd65d21a0b29b8d Mon Sep 17 00:00:00 2001 +From cc5e70efc8b9f45054d7e57002f59ac38c4c687f Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 10 Oct 2019 14:18:23 +0200 -Subject: [PATCH 004/105] param: Add 'server smb encrypt' parameter +Subject: [PATCH 004/104] param: Add 'server smb encrypt' parameter And this also makes 'smb encrypt' a synonym of that. @@ -727,7 +727,7 @@ index 32a22cb58f5..798e616b765 100644 default diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c -index 6674485738a..82be31e8437 100644 +index a3abaa2ec67..c0070b716a5 100644 --- a/source3/param/loadparm.c +++ b/source3/param/loadparm.c @@ -241,7 +241,7 @@ static const struct loadparm_service _sDefault = @@ -821,13 +821,13 @@ index 7acde285a90..b745e0906b1 100644 req, NT_STATUS_NOT_SUPPORTED); -- -2.28.0 +2.29.2 -From 71b97ba1fd9260efd29e3ab3456b82d2a4f6dcc8 Mon Sep 17 00:00:00 2001 +From d78374a9e26428a48b3c6a2aa1d4280751620fb9 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 10:04:19 +0200 -Subject: [PATCH 005/105] param: Create and use enum_smb_encryption_vals +Subject: [PATCH 005/104] param: Create and use enum_smb_encryption_vals Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -919,13 +919,13 @@ index b424b13cde4..2fb1fd7189e 100644 #define SMB_DATA_BLOCK 0x1 #define SMB_ASCII4 0x4 -- -2.28.0 +2.29.2 -From ca1e10a901af67327d25765bfed404e2d1c756a5 Mon Sep 17 00:00:00 2001 +From e2e0decfb117a8d6bb1428509f770315849e972b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 26 May 2020 09:34:54 +0200 -Subject: [PATCH 006/105] s3:smbd: Use 'enum smb_encryption_setting' values +Subject: [PATCH 006/104] s3:smbd: Use 'enum smb_encryption_setting' values Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -939,7 +939,7 @@ Reviewed-by: Stefan Metzmacher 6 files changed, 12 insertions(+), 11 deletions(-) diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c -index 82be31e8437..b305e34b252 100644 +index c0070b716a5..4ad541301b3 100644 --- a/source3/param/loadparm.c +++ b/source3/param/loadparm.c @@ -241,7 +241,7 @@ static const struct loadparm_service _sDefault = @@ -1043,13 +1043,13 @@ index b745e0906b1..2f2fdcb7260 100644 req, NT_STATUS_NOT_SUPPORTED); -- -2.28.0 +2.29.2 -From a5630bb933393fe69ff9b7f072221b9085d6277c Mon Sep 17 00:00:00 2001 +From a461b9e0348f2f082cc59b601271ca5b3283df09 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 9 Apr 2020 10:38:41 +0200 -Subject: [PATCH 007/105] docs-xml: Add 'client smb encrypt' +Subject: [PATCH 007/104] docs-xml: Add 'client smb encrypt' Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -1193,7 +1193,7 @@ index 00000000000..05df152e734 +default + diff --git a/lib/param/loadparm.c b/lib/param/loadparm.c -index e041f4fb01b..e167903dbd9 100644 +index 006caabc092..67f5709b213 100644 --- a/lib/param/loadparm.c +++ b/lib/param/loadparm.c @@ -3079,6 +3079,10 @@ struct loadparm_context *loadparm_init(TALLOC_CTX *mem_ctx) @@ -1208,7 +1208,7 @@ index e041f4fb01b..e167903dbd9 100644 if (!(lp_ctx->flags[i] & FLAG_CMDLINE)) { lp_ctx->flags[i] |= FLAG_DEFAULT; diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c -index b305e34b252..9a2a309b781 100644 +index 4ad541301b3..6418a42b6eb 100644 --- a/source3/param/loadparm.c +++ b/source3/param/loadparm.c @@ -960,6 +960,8 @@ static void init_globals(struct loadparm_context *lp_ctx, bool reinit_globals) @@ -1221,13 +1221,13 @@ index b305e34b252..9a2a309b781 100644 apply_lp_set_cmdline(); } -- -2.28.0 +2.29.2 -From 3d826b1efb4a0e1f77875c7cbad2fcd16c3ac17b Mon Sep 17 00:00:00 2001 +From d55143fc3090b43390fdf14ff45d9c2971fc43d2 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 22 Jul 2020 17:48:25 +0200 -Subject: [PATCH 008/105] lib:param: Add lpcfg_parse_enum_vals() +Subject: [PATCH 008/104] lib:param: Add lpcfg_parse_enum_vals() Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -1237,10 +1237,10 @@ Reviewed-by: Stefan Metzmacher 2 files changed, 32 insertions(+) diff --git a/lib/param/loadparm.c b/lib/param/loadparm.c -index e167903dbd9..952d2b49811 100644 +index 67f5709b213..b1410791c60 100644 --- a/lib/param/loadparm.c +++ b/lib/param/loadparm.c -@@ -3674,3 +3674,33 @@ char *lpcfg_substituted_string(TALLOC_CTX *mem_ctx, +@@ -3675,3 +3675,33 @@ char *lpcfg_substituted_string(TALLOC_CTX *mem_ctx, raw_value, lp_sub->private_data); } @@ -1288,13 +1288,13 @@ index 323fcf84523..e66ce2324b4 100644 struct loadparm_substitution; #ifdef LOADPARM_SUBSTITUTION_INTERNALS -- -2.28.0 +2.29.2 -From 2f74f9d6a5d38e6eb2ca3d32f61d5d9b1c55f3c1 Mon Sep 17 00:00:00 2001 +From d01ae8111553a71b80988eeb737e8b80bc765b20 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 9 Oct 2019 09:38:08 +0200 -Subject: [PATCH 009/105] libcli:smb: Add smb_signing_setting_translate() +Subject: [PATCH 009/104] libcli:smb: Add smb_signing_setting_translate() Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -1461,13 +1461,13 @@ index 6918e1306c3..20981754db4 100644 plantestsuite("samba.unittests.talloc_keep_secret", "none", [os.path.join(bindir(), "default/lib/util/test_talloc_keep_secret")]) -- -2.28.0 +2.29.2 -From 912ec83bf4ec6a965ee10ace1d74036c5c6a4c92 Mon Sep 17 00:00:00 2001 +From 4cef2825a3363a38fbfbff5f172053145f62f100 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 26 May 2020 08:39:34 +0200 -Subject: [PATCH 010/105] libcli:smb: Add smb_encryption_setting_translate() +Subject: [PATCH 010/104] libcli:smb: Add smb_encryption_setting_translate() Add encryption enum and function to avoid confusion when reading the code. @@ -1555,13 +1555,13 @@ index da0e4db2bf3..ac2887ee5c4 100644 + return encryption_state; +} -- -2.28.0 +2.29.2 -From 7d2c3a519805549f577b54cf72a5d95b4ae744f3 Mon Sep 17 00:00:00 2001 +From a0cb6b810b655298ce5b87d8e36d1089460feca7 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 9 Oct 2019 09:47:59 +0200 -Subject: [PATCH 011/105] s3:lib: Use smb_signing_setting_translate for cmdline +Subject: [PATCH 011/104] s3:lib: Use smb_signing_setting_translate for cmdline parsing The function will be removed soon. @@ -1622,13 +1622,13 @@ index 5a07eddac44..6a08afe4a25 100644 bld.SAMBA3_LIBRARY('cmdline_contexts', -- -2.28.0 +2.29.2 -From d488762aa9468bd54890a2fe3dba3fd52582b556 Mon Sep 17 00:00:00 2001 +From ef521e6b44710fb3ed567d36fa56687b677fe58a Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 23 Jul 2020 07:47:18 +0200 -Subject: [PATCH 012/105] auth:creds: Remove unused credentials autoproto +Subject: [PATCH 012/104] auth:creds: Remove unused credentials autoproto header Signed-off-by: Andreas Schneider @@ -1702,13 +1702,13 @@ index 7711eac2afa..d9be3562adb 100644 #include "auth/kerberos/kerberos_credentials.h" #include "auth/kerberos/kerberos_util.h" -- -2.28.0 +2.29.2 -From 696d2230503dada1e4369500c7c632bd7d3e5527 Mon Sep 17 00:00:00 2001 +From 6fafcebb8bd6311a736d995af6641e68e43e03a1 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 26 May 2020 09:32:44 +0200 -Subject: [PATCH 013/105] auth:creds: Add +Subject: [PATCH 013/104] auth:creds: Add cli_credentials_(get|set)_smb_signing() Signed-off-by: Andreas Schneider @@ -1844,13 +1844,13 @@ index 68f1f25dce1..9cde0000b5f 100644 #endif /* __CREDENTIALS_INTERNAL_H__ */ -- -2.28.0 +2.29.2 -From 0176a9d55aed4bdb49ac6f703dcae778b2f4ac5c Mon Sep 17 00:00:00 2001 +From 64e2c99501677bfe52212c9ea99ec3512cf62f6e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 3 Jun 2020 11:56:01 +0200 -Subject: [PATCH 014/105] auth:creds: Add python bindings for +Subject: [PATCH 014/104] auth:creds: Add python bindings for (get|set)_smb_signing Signed-off-by: Andreas Schneider @@ -1970,13 +1970,13 @@ index 6454ac9ff7c..e5f8122fa21 100644 + creds.set_smb_signing(credentials.SMB_SIGNING_REQUIRED) + self.assertEqual(creds.get_smb_signing(), credentials.SMB_SIGNING_REQUIRED) -- -2.28.0 +2.29.2 -From 96c4ce197bb62772778d822f0e5956d5a3ffe28d Mon Sep 17 00:00:00 2001 +From 1280505f1396925851db5a29f2465d9c31d45f88 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 16:31:35 +0200 -Subject: [PATCH 015/105] auth:creds: Add +Subject: [PATCH 015/104] auth:creds: Add cli_credentials_(get|set)_smb_ipc_signing() Signed-off-by: Andreas Schneider @@ -2102,13 +2102,13 @@ index 9cde0000b5f..54e8271471f 100644 #endif /* __CREDENTIALS_INTERNAL_H__ */ -- -2.28.0 +2.29.2 -From 301adf15736a4cb10f9dca267a906efb8f885354 Mon Sep 17 00:00:00 2001 +From 32209d254bb7bd3bd6ad3af14f219cee306a19a3 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 3 Jun 2020 12:32:46 +0200 -Subject: [PATCH 016/105] auth:creds: Add python bindings for +Subject: [PATCH 016/104] auth:creds: Add python bindings for (get|set)_smb_ipc_signing Signed-off-by: Andreas Schneider @@ -2207,13 +2207,13 @@ index e5f8122fa21..8edf13ce6ff 100644 + creds.set_smb_ipc_signing(credentials.SMB_SIGNING_OFF) + self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_OFF) -- -2.28.0 +2.29.2 -From cf2cafb38dd319c01ff539a73d40dac8813f03a0 Mon Sep 17 00:00:00 2001 +From d0a1bf1a75426c1d334349a6a4f8e44c80c1915b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 16:10:52 +0200 -Subject: [PATCH 017/105] auth:creds: Add +Subject: [PATCH 017/104] auth:creds: Add cli_credentials_(get|set)_smb_encryption() Signed-off-by: Andreas Schneider @@ -2341,13 +2341,13 @@ index 54e8271471f..3b86b742448 100644 #endif /* __CREDENTIALS_INTERNAL_H__ */ -- -2.28.0 +2.29.2 -From a25732f42cf7418789c2102f093dc0b3062543fd Mon Sep 17 00:00:00 2001 +From 36ab2aa54102aa9cce92ac8ebf250db4d460324e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 3 Jun 2020 12:38:30 +0200 -Subject: [PATCH 018/105] auth:creds: Add python bindings for +Subject: [PATCH 018/104] auth:creds: Add python bindings for (get|set)_smb_encryption Signed-off-by: Andreas Schneider @@ -2459,13 +2459,13 @@ index 8edf13ce6ff..e0a6248d37a 100644 + creds.set_smb_encryption(credentials.SMB_ENCRYPTION_REQUIRED) + self.assertEqual(creds.get_smb_encryption(), credentials.SMB_ENCRYPTION_REQUIRED) -- -2.28.0 +2.29.2 -From 1a1809bd260ceff97dd4ff697f78b97a63f60b48 Mon Sep 17 00:00:00 2001 +From f866d9e80964e16307a8376ed448d0ca3a987538 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 4 Jun 2020 11:19:53 +0200 -Subject: [PATCH 019/105] auth:creds: Add python bindings for +Subject: [PATCH 019/104] auth:creds: Add python bindings for cli_credentials_set_conf() Signed-off-by: Andreas Schneider @@ -2587,13 +2587,13 @@ index e0a6248d37a..6187bded0b6 100644 + creds.set_conf(lp) + self.assertEqual(creds.get_smb_encryption(), credentials.SMB_ENCRYPTION_OFF) -- -2.28.0 +2.29.2 -From 72b31403174eb23fe4fdf75ad918e845a740db6f Mon Sep 17 00:00:00 2001 +From 3f55ee05f024eacdd43fbbfb941703f8555df7c7 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 23 Jul 2020 08:14:23 +0200 -Subject: [PATCH 020/105] auth:creds: Bump library version +Subject: [PATCH 020/104] auth:creds: Bump library version We added new functions so bump the version. @@ -2617,13 +2617,13 @@ index 564a04fe8dd..1e3302e3e48 100644 bld.SAMBA_SUBSYSTEM('CREDENTIALS_KRB5', -- -2.28.0 +2.29.2 -From 918b87437b9c36981049ca4e3cf0220ad56ec7c2 Mon Sep 17 00:00:00 2001 +From 492030e0e6179bdc0311e8d03b89b1cb01de1a3e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 27 May 2020 11:10:30 +0200 -Subject: [PATCH 021/105] s3:lib: Use cli_credential_(get|set)_smb_signing() +Subject: [PATCH 021/104] s3:lib: Use cli_credential_(get|set)_smb_signing() Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -2688,13 +2688,13 @@ index bc1f1c3ed25..6038ec11515 100644 void set_cmdline_auth_info_use_ccache(struct user_auth_info *auth_info, bool b) -- -2.28.0 +2.29.2 -From 22efb02d818946e4f03ebfb72ea345e9106deca8 Mon Sep 17 00:00:00 2001 +From 6164c45feff5daf0e751526d1f7bd599c61b2a0e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:45:34 +0200 -Subject: [PATCH 022/105] s3:lib: Set smb encryption also via cli creds API +Subject: [PATCH 022/104] s3:lib: Set smb encryption also via cli creds API Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -2717,13 +2717,13 @@ index 6038ec11515..9c9e2f0ac0f 100644 } -- -2.28.0 +2.29.2 -From 9abae48706106793f8952524ad2325bdd6a5101c Mon Sep 17 00:00:00 2001 +From ddb7926bba603afbc1a588d1b6da9f9a625881ac Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 13 Aug 2020 10:40:23 +0200 -Subject: [PATCH 023/105] python: Remove unused sign argument from +Subject: [PATCH 023/104] python: Remove unused sign argument from smb_connection() Signed-off-by: Andreas Schneider @@ -2772,13 +2772,13 @@ index 1e2c2918ebe..ad60cda0690 100644 smb_dir = '\\'.join([self.lp.get('realm').lower(), 'Policies', 'PolicyDefinitions']) -- -2.28.0 +2.29.2 -From e2f0f56ea6ec4f9696affdee08de89c0bdffa719 Mon Sep 17 00:00:00 2001 +From 8683eacfb9c053115a84be025bbd64471c55d1c8 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 3 Jun 2020 14:02:37 +0200 -Subject: [PATCH 024/105] python: Set smb signing via the creds API +Subject: [PATCH 024/104] python: Set smb signing via the creds API Pair-Programmed-With: Stefan Metzmacher @@ -2876,13 +2876,13 @@ index ad60cda0690..0f2f6520fc3 100644 -- -2.28.0 +2.29.2 -From 53b2d53349b8f453cd0144f01b833deca52e3626 Mon Sep 17 00:00:00 2001 +From 86212ac5fb8d5f0710f23dde362dc35d908e3047 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 17:22:12 +0200 -Subject: [PATCH 025/105] s3:libsmb: Introduce CLI_FULL_CONNECTION_IPC +Subject: [PATCH 025/104] s3:libsmb: Introduce CLI_FULL_CONNECTION_IPC Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -2977,10 +2977,10 @@ index 1fb1f0127b9..f20146378e3 100644 nt_status = cli_full_connection_creds(&cli, NULL, server, server_ss, 0, "IPC$", "IPC", get_cmdline_auth_info_creds(user_info), diff --git a/source3/rpc_server/spoolss/srv_spoolss_nt.c b/source3/rpc_server/spoolss/srv_spoolss_nt.c -index 8b6a803a910..16e3ee485f0 100644 +index 10c1b1d54f2..f578f1c4131 100644 --- a/source3/rpc_server/spoolss/srv_spoolss_nt.c +++ b/source3/rpc_server/spoolss/srv_spoolss_nt.c -@@ -2481,7 +2481,9 @@ static bool spoolss_connect_to_client(struct rpc_pipe_client **pp_pipe, struct c +@@ -2482,7 +2482,9 @@ static bool spoolss_connect_to_client(struct rpc_pipe_client **pp_pipe, struct c /* setup the connection */ ret = cli_full_connection_creds( pp_cli, lp_netbios_name(), remote_machine, &rm_addr, 0, "IPC$", "IPC", @@ -3099,13 +3099,13 @@ index 6cea2ee306c..2241beb331f 100644 if (!NT_STATUS_IS_OK(nt_status)) { DEBUG(2,("create_cs: Connect failed. Error was %s\n", nt_errstr(nt_status))); -- -2.28.0 +2.29.2 -From 975383e368a3891e92fb071ab20f2b5208167500 Mon Sep 17 00:00:00 2001 +From 834dae6a34aaef7dccfb84821ec3fa7013b07d15 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 17:29:25 +0200 -Subject: [PATCH 026/105] s3:pylibsmb: Add ipc=True support for +Subject: [PATCH 026/104] s3:pylibsmb: Add ipc=True support for CLI_FULL_CONNECTION_IPC Signed-off-by: Andreas Schneider @@ -3164,13 +3164,13 @@ index 3fcc3424a57..3579a040830 100644 #ifdef HAVE_PTHREAD ret = py_cli_state_setup_mt_ev(self); -- -2.28.0 +2.29.2 -From 59831141a17195b9308d75257123134b0217489c Mon Sep 17 00:00:00 2001 +From 072dfd83ee6513658e0ec818fb548f70648d6a41 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 24 Jul 2020 09:47:11 +0200 -Subject: [PATCH 027/105] python:tests: Mark libsmb connection as an IPC +Subject: [PATCH 027/104] python:tests: Mark libsmb connection as an IPC connection Signed-off-by: Andreas Schneider @@ -3193,13 +3193,13 @@ index ba7440df13b..2c028d381db 100644 DesiredAccess=0x12019f, ShareAccess=0x7, -- -2.28.0 +2.29.2 -From b9df53c20a753bf31b8684776f2b6aaaf1583abe Mon Sep 17 00:00:00 2001 +From ceb25f6cb4fd07cd736085030a02aefbcb012e34 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 17 Aug 2020 12:52:39 +0200 -Subject: [PATCH 028/105] python:tests: Set smb ipc signing via the creds API +Subject: [PATCH 028/104] python:tests: Set smb ipc signing via the creds API Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -3231,13 +3231,13 @@ index 2c028d381db..d6f5de7440a 100644 DesiredAccess=0x12019f, ShareAccess=0x7, -- -2.28.0 +2.29.2 -From c9e88d833db2b472099e5751b7731e337342d2c4 Mon Sep 17 00:00:00 2001 +From d3fe919fa5b952d075353f0d5c5366cabd5ef976 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 17:59:19 +0200 -Subject: [PATCH 029/105] s3:libsmb: Use 'enum smb_signing_setting' in +Subject: [PATCH 029/104] s3:libsmb: Use 'enum smb_signing_setting' in cliconnect.c Signed-off-by: Andreas Schneider @@ -3361,13 +3361,13 @@ index d214cdabca4..995187e21b4 100644 void cli_nt_pipes_close(struct cli_state *cli); void cli_shutdown(struct cli_state *cli); -- -2.28.0 +2.29.2 -From 40c201c4d1b4621e823485e3082d0ca5799a6237 Mon Sep 17 00:00:00 2001 +From 0ec1b432bf807efe37fdedf346724e787742e3aa Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 18:11:31 +0200 -Subject: [PATCH 030/105] s3:client: Turn off smb signing for message op +Subject: [PATCH 030/104] s3:client: Turn off smb signing for message op Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -3433,10 +3433,10 @@ index d6f5de7440a..34785e2a2a7 100644 self.smbfid = self.smbconn.create(pipename, DesiredAccess=0x12019f, diff --git a/source3/client/client.c b/source3/client/client.c -index f65293849d0..30287ffd253 100644 +index 8c7ceb644aa..56309efcea7 100644 --- a/source3/client/client.c +++ b/source3/client/client.c -@@ -6228,7 +6228,10 @@ static int do_message_op(struct user_auth_info *a_info) +@@ -6164,7 +6164,10 @@ static int do_message_op(struct user_auth_info *a_info) status = cli_connect_nb(desthost, have_ip ? &dest_ss : NULL, port ? port : NBT_SMB_PORT, name_type, @@ -3513,13 +3513,13 @@ index 3579a040830..f8a4d56cf53 100644 NULL, self->ev, "myname", host, NULL, 0, share, "?????", cli_creds, flags, signing_state); -- -2.28.0 +2.29.2 -From 639de1d5ddf200d03f51b0436789f5dde4cd083b Mon Sep 17 00:00:00 2001 +From dd6a89dd02e675e1b836042e4a4dec31667ac58c Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 18:20:02 +0200 -Subject: [PATCH 031/105] s3:libsmb: Remove signing_state from +Subject: [PATCH 031/104] s3:libsmb: Remove signing_state from cli_full_connection_creds_send() Signed-off-by: Andreas Schneider @@ -3612,13 +3612,13 @@ index f8a4d56cf53..c7a2d73afcb 100644 return -1; } -- -2.28.0 +2.29.2 -From 57336e07f2e23dade5fcd0b8f0d002202cda223d Mon Sep 17 00:00:00 2001 +From b31e224159fe25e8cf84e7d2ef8bc53934ddd209 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 4 Jun 2020 14:59:14 +0200 -Subject: [PATCH 032/105] s3:libsmb: Remove signing_state from +Subject: [PATCH 032/104] s3:libsmb: Remove signing_state from cli_full_connection_creds() Signed-off-by: Andreas Schneider @@ -3782,10 +3782,10 @@ index bef04d32638..850cf12c8a6 100644 const char *service, const char *pass, const char *dev, uint16_t *max_xmit, uint16_t *tid); diff --git a/source3/rpc_server/spoolss/srv_spoolss_nt.c b/source3/rpc_server/spoolss/srv_spoolss_nt.c -index 16e3ee485f0..e98401a4365 100644 +index f578f1c4131..906fab2adb5 100644 --- a/source3/rpc_server/spoolss/srv_spoolss_nt.c +++ b/source3/rpc_server/spoolss/srv_spoolss_nt.c -@@ -2482,8 +2482,7 @@ static bool spoolss_connect_to_client(struct rpc_pipe_client **pp_pipe, struct c +@@ -2483,8 +2483,7 @@ static bool spoolss_connect_to_client(struct rpc_pipe_client **pp_pipe, struct c ret = cli_full_connection_creds( pp_cli, lp_netbios_name(), remote_machine, &rm_addr, 0, "IPC$", "IPC", anon_creds, @@ -3983,13 +3983,13 @@ index 954d6eba804..fea066ce468 100644 DEBUG(0,("cli_full_connection failed! (%s)\n", nt_errstr(nt_status))); return NULL; -- -2.28.0 +2.29.2 -From 6752c123f20d46aa68725971e09548a47b7c7457 Mon Sep 17 00:00:00 2001 +From 49430d65ac0e11cdfec07c55b72f030c959f576f Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Mon, 8 Jun 2020 08:04:24 +0200 -Subject: [PATCH 033/105] s3:libsmb: Add encryption support to +Subject: [PATCH 033/104] s3:libsmb: Add encryption support to cli_full_connection_creds*() Pair-Programmed-With: Andreas Schneider @@ -4200,13 +4200,13 @@ index b24743d789b..abfd18bfaf1 100644 } -- -2.28.0 +2.29.2 -From bdb894ebb29820b97dba3721a517a61d96fac152 Mon Sep 17 00:00:00 2001 +From cc6eca3fe233c16d879f9a76aae022320e7044d7 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 11:26:00 +0200 -Subject: [PATCH 034/105] python: Add a test for SMB encryption +Subject: [PATCH 034/104] python: Add a test for SMB encryption Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -4274,13 +4274,13 @@ index e8f8e7fe94d..81d4e482644 100644 if __name__ == "__main__": import unittest -- -2.28.0 +2.29.2 -From d26afd8352435db71c542388220e951184adcdde Mon Sep 17 00:00:00 2001 +From 3bb0f6be56244767f78e8d0e085f2f7555585225 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:31:02 +0200 -Subject: [PATCH 035/105] s3:net: Use cli_credentials_set_smb_encryption() +Subject: [PATCH 035/104] s3:net: Use cli_credentials_set_smb_encryption() Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -4323,13 +4323,13 @@ index b139fb2d0da..5829d891075 100644 } -- -2.28.0 +2.29.2 -From c228933e88c6b615fa49402d2e826a5ec14b9f85 Mon Sep 17 00:00:00 2001 +From 16aaa2f7395d235f72582a5190c9bf5d90578b9d Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:40:13 +0200 -Subject: [PATCH 036/105] s3:libsmb: Use cli_credentials_set_smb_encryption() +Subject: [PATCH 036/104] s3:libsmb: Use cli_credentials_set_smb_encryption() This also adds a SMBC_ENCRYPTLEVEL_DEFAULT to 'enum smbc_smb_encrypt_level' in order to use the smb.conf default value. @@ -4682,13 +4682,13 @@ index ec4a516b2ee..61503d0a98b 100644 + vnum='0.7.0', pc_files='smbclient.pc') -- -2.28.0 +2.29.2 -From 76dc706e6449161c27a5f117bc45922ab467dbfc Mon Sep 17 00:00:00 2001 +From eaa0bdc5931b82f9adbb65070252208be26a9d28 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:43:33 +0200 -Subject: [PATCH 037/105] s3:client: Remove unused smb encryption code +Subject: [PATCH 037/104] s3:client: Remove unused smb encryption code Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -4718,13 +4718,13 @@ index f56dc323b6e..16a8d44c069 100644 *output_cli = cli; return NT_STATUS_OK; -- -2.28.0 +2.29.2 -From a444688a6ed50c8443a778fbddb4dbd8a39d49d4 Mon Sep 17 00:00:00 2001 +From 63179da4a51fefc5d938339360d579f725875389 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:47:05 +0200 -Subject: [PATCH 038/105] s3:utils: Remove obsolete force encryption from +Subject: [PATCH 038/104] s3:utils: Remove obsolete force encryption from smbacls Signed-off-by: Andreas Schneider @@ -4755,13 +4755,13 @@ index 5983ebbd0a5..8fd9fcc5780 100644 } -- -2.28.0 +2.29.2 -From 21b72b6107cd849b9da77e17520e658745fb897a Mon Sep 17 00:00:00 2001 +From f113666b62c0fbe960f9ac22aea63241b56ffc61 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:48:18 +0200 -Subject: [PATCH 039/105] s3:utils: Remove obsolete force encryption from +Subject: [PATCH 039/104] s3:utils: Remove obsolete force encryption from mdfind Signed-off-by: Andreas Schneider @@ -4789,13 +4789,13 @@ index 2ac4fde7daf..ef2657e4fa5 100644 NCACN_NP, &ndr_table_mdssvc, -- -2.28.0 +2.29.2 -From 842c3c1346cba54c92d6ba2d462818875403a394 Mon Sep 17 00:00:00 2001 +From 4f3770237e1a3d41c725560d9e5c14786b98d2f9 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:49:28 +0200 -Subject: [PATCH 040/105] s3:utils: Remove obsolete force encryption from +Subject: [PATCH 040/104] s3:utils: Remove obsolete force encryption from smbcquotas Signed-off-by: Andreas Schneider @@ -4827,13 +4827,13 @@ index fea066ce468..4ceac7b3ab0 100644 } -- -2.28.0 +2.29.2 -From be36aec550d817bbcfdea88b433e31b44886ba19 Mon Sep 17 00:00:00 2001 +From b897f3360dae5737d646dbce9f7571b1cfb070b0 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:51:18 +0200 -Subject: [PATCH 041/105] s3:rpcclient: Remove obsolete force encryption from +Subject: [PATCH 041/104] s3:rpcclient: Remove obsolete force encryption from rpcclient Signed-off-by: Andreas Schneider @@ -4865,13 +4865,13 @@ index 2ead6cc7ba5..575a42ebf70 100644 memset(cmdline_auth_info.password,'X',sizeof(cmdline_auth_info.password)); #endif -- -2.28.0 +2.29.2 -From 8e2de7801238eb7f1090a9307dc4b05885b3dda2 Mon Sep 17 00:00:00 2001 +From b01458095b5e815c09eb71fb597598e9f34ee342 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 6 Jul 2020 10:58:36 +0200 -Subject: [PATCH 042/105] examples: Remove obsolete force encryption from +Subject: [PATCH 042/104] examples: Remove obsolete force encryption from smb2mount Signed-off-by: Andreas Schneider @@ -4903,13 +4903,13 @@ index 6206c3a9701..c64be573462 100644 } -- -2.28.0 +2.29.2 -From 8c9a31cc180c674925919771ccdce1bb6895c1a3 Mon Sep 17 00:00:00 2001 +From 66eb5d32234f2e7700a43504158507a6f828c50b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 6 Jul 2020 11:05:59 +0200 -Subject: [PATCH 043/105] s3:libsmb: Make cli_cm_force_encryption_creds() +Subject: [PATCH 043/104] s3:libsmb: Make cli_cm_force_encryption_creds() static Signed-off-by: Andreas Schneider @@ -4951,13 +4951,13 @@ index 850cf12c8a6..eeabcaa7463 100644 struct cli_state *referring_cli, const char *server, -- -2.28.0 +2.29.2 -From 6e2a7196c424edd2c447cfd4377e38e5b51ee675 Mon Sep 17 00:00:00 2001 +From 3b8e9646f0a79e2cbb977b8c1d0fc5f28a9b7490 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 13 Aug 2020 16:16:55 +0200 -Subject: [PATCH 044/105] s4:libcli: Return NTSTATUS errors for +Subject: [PATCH 044/104] s4:libcli: Return NTSTATUS errors for smb_composite_connect_send() Signed-off-by: Andreas Schneider @@ -5051,13 +5051,13 @@ index 582d43ef173..ad50ae0ac81 100644 return smb_composite_connect_recv(c, mem_ctx); } -- -2.28.0 +2.29.2 -From cf89573a78556993d7ecb43257d347edc6c61151 Mon Sep 17 00:00:00 2001 +From cecd31a2451e20046c0202837269fb533e3118a7 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 7 Jul 2020 12:54:26 +0200 -Subject: [PATCH 045/105] s4:libcli: Return if encryption is requested for SMB1 +Subject: [PATCH 045/104] s4:libcli: Return if encryption is requested for SMB1 Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -5088,13 +5088,13 @@ index 6ee4929e8d7..51e121bdce6 100644 if (composite_nomem(state, c)) return c; c->private_data = state; -- -2.28.0 +2.29.2 -From 05914c4f85f71c7d1df884e33b8c0b8f5062ee3b Mon Sep 17 00:00:00 2001 +From ed5b2f36fec30ae7b277620cb82f01a07f027e0e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 7 Jul 2020 12:29:39 +0200 -Subject: [PATCH 046/105] s3:libcli: Split out smb2_connect_tcon_start() +Subject: [PATCH 046/104] s3:libcli: Split out smb2_connect_tcon_start() Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -5141,13 +5141,13 @@ index 6fc3993a4e8..95ff05eac8f 100644 subreq = smb2cli_tcon_send(state, state->ev, -- -2.28.0 +2.29.2 -From 63b0086d8ffdfca44134c09ff0db76d7a9ae8f6c Mon Sep 17 00:00:00 2001 +From 7eb81b6448064d8beee3972471723b90ea9307ec Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 7 Jul 2020 12:44:26 +0200 -Subject: [PATCH 047/105] s4:libcli: Add smb2_connect_enc_start() +Subject: [PATCH 047/104] s4:libcli: Add smb2_connect_enc_start() Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -5212,13 +5212,13 @@ index 95ff05eac8f..3a3ecdf20e8 100644 } -- -2.28.0 +2.29.2 -From 8bc1b5f884d1e6a88e1ac403d9bc64c3b77e9428 Mon Sep 17 00:00:00 2001 +From b5b0c28d597d8ef98b632e4616d2d2cdaaad37a9 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 24 Jul 2020 10:18:52 +0200 -Subject: [PATCH 048/105] s4:libcli: Require signing for SMB encryption +Subject: [PATCH 048/104] s4:libcli: Require signing for SMB encryption Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -5268,13 +5268,13 @@ index 3a3ecdf20e8..9540704491e 100644 if (tevent_req_nterror(req, status)) { return tevent_req_post(req, ev); -- -2.28.0 +2.29.2 -From 5cc8a0bc7381444804cde992afdc7aa0c0b70074 Mon Sep 17 00:00:00 2001 +From ee95e01cdc3917fc371b3145dcbe6d23ffc054b1 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 7 Jul 2020 14:27:07 +0200 -Subject: [PATCH 049/105] python:tests: Add test for SMB encrypted DCERPC +Subject: [PATCH 049/104] python:tests: Add test for SMB encrypted DCERPC connection Signed-off-by: Andreas Schneider @@ -5389,13 +5389,13 @@ index 20981754db4..adcb5b53189 100644 def cmdline(script, *args): -- -2.28.0 +2.29.2 -From 546ecfae4f11e0625de86e47e90a98a7aafa0453 Mon Sep 17 00:00:00 2001 +From fefa1d0236c67b2a93328eb9e0eac21da22235b2 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Fri, 4 Sep 2020 10:47:54 +0200 -Subject: [PATCH 050/105] auth:gensec: Add gensec_security_sasl_names() +Subject: [PATCH 050/104] auth:gensec: Add gensec_security_sasl_names() Pair-Programmed-With: Andreas Schneider @@ -5519,13 +5519,13 @@ index d2d62d6652e..4eb45643714 100644 * Return a unique list of security subsystems from those specified in * the list of SASL names. -- -2.28.0 +2.29.2 -From ec079d88720a99a5bc5e6b5efd03f87342364f15 Mon Sep 17 00:00:00 2001 +From adf58a175cea99c0b0147d3b3275563c7155edfa Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Fri, 4 Sep 2020 10:48:27 +0200 -Subject: [PATCH 051/105] s4:ldap_server: Use samba_server_gensec_start() in +Subject: [PATCH 051/104] s4:ldap_server: Use samba_server_gensec_start() in ldapsrv_backend_Init() Signed-off-by: Stefan Metzmacher @@ -5631,13 +5631,13 @@ index 2839082daef..915d9b94f9b 100644 ldb_set_opaque(conn->ldb, "supportedSASLMechanisms", sasl_mechs); } -- -2.28.0 +2.29.2 -From bc128ea1ea455a3a63e0ce3dc8777a7482c356f8 Mon Sep 17 00:00:00 2001 +From e887d94b47aca3609fd158efe0f4654101c5e02b Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Fri, 4 Sep 2020 14:39:15 +0200 -Subject: [PATCH 052/105] auth:gensec: Make gensec_use_kerberos_mechs() a +Subject: [PATCH 052/104] auth:gensec: Make gensec_use_kerberos_mechs() a static function Signed-off-by: Stefan Metzmacher @@ -5681,13 +5681,13 @@ index 4eb45643714..ebcab76999a 100644 const struct gensec_security_ops **new_gensec_list; int i, j, num_mechs_in; -- -2.28.0 +2.29.2 -From 37b7016fba1eae75fc4a87c9c5aebbbb47b7ff39 Mon Sep 17 00:00:00 2001 +From 08dc4775dbf72a1e8068d392360be158d8305bfa Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Fri, 4 Sep 2020 14:41:43 +0200 -Subject: [PATCH 053/105] auth:gensec: Pass use_kerberos and keep_schannel to +Subject: [PATCH 053/104] auth:gensec: Pass use_kerberos and keep_schannel to gensec_use_kerberos_mechs() Signed-off-by: Stefan Metzmacher @@ -5755,13 +5755,13 @@ index ebcab76999a..8d1b41fec74 100644 } -- -2.28.0 +2.29.2 -From 0579dbd6faa5a828cff42cd797f78c51316324b0 Mon Sep 17 00:00:00 2001 +From bc505a449449267085778ec51c5362e256837edb Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Fri, 4 Sep 2020 17:00:45 +0200 -Subject: [PATCH 054/105] auth:gensec: If Kerberos is required, keep schannel +Subject: [PATCH 054/104] auth:gensec: If Kerberos is required, keep schannel for machine account auth Signed-off-by: Stefan Metzmacher @@ -5792,13 +5792,13 @@ index 8d1b41fec74..3f42d611140 100644 if (gensec_security->settings->backends) { -- -2.28.0 +2.29.2 -From 0f3676f4f84184b5bf83101e0b1eca0bb05a5079 Mon Sep 17 00:00:00 2001 +From 9b7a189e038e3f783a2b23302f0ee4657ef18057 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 4 Sep 2020 12:21:21 +0200 -Subject: [PATCH 055/105] auth:creds: Add cli_credentials_init_server() +Subject: [PATCH 055/104] auth:creds: Add cli_credentials_init_server() Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher @@ -5858,13 +5858,13 @@ index 7d0cf53194b..438bcdce232 100644 bool cli_credentials_wrong_password(struct cli_credentials *cred); const char *cli_credentials_get_password(struct cli_credentials *cred); -- -2.28.0 +2.29.2 -From e1d566c2962ebd5596638df6f81fd120aaf32fcd Mon Sep 17 00:00:00 2001 +From 013d5eb87f3ddcda6df5c76796bede7a85c42207 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 4 Sep 2020 12:21:36 +0200 -Subject: [PATCH 056/105] s4:rpc_server: Use cli_credentials_init_server() +Subject: [PATCH 056/104] s4:rpc_server: Use cli_credentials_init_server() Signed-off-by: Andreas Schneider (cherry picked from commit 6c94ebf77fdb7383be2042f5e20ba2ef598cd4a4) @@ -5906,13 +5906,13 @@ index 084857a44bf..e64148ef788 100644 call->event_ctx, imsg_ctx, -- -2.28.0 +2.29.2 -From 694e1d1ca62372baba69818acf25a2eec8847115 Mon Sep 17 00:00:00 2001 +From 6e6030dca006e829150e6b64db0485e3c9895485 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 7 Sep 2020 09:19:43 +0200 -Subject: [PATCH 057/105] s4:smb_server: Use cli_credentials_init_server() for +Subject: [PATCH 057/104] s4:smb_server: Use cli_credentials_init_server() for negprot Signed-off-by: Andreas Schneider @@ -6006,13 +6006,13 @@ index 4aaaf46793b..c433eb194bd 100644 req->smb_conn->negotiate.server_credentials = talloc_steal(req->smb_conn, server_credentials); -- -2.28.0 +2.29.2 -From c3b277172554d1d3155c3a1b4ad76685985273df Mon Sep 17 00:00:00 2001 +From f9f25b7690c2e234ea2e631f05c1fb0180776842 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 8 Sep 2020 10:15:22 +0200 -Subject: [PATCH 058/105] selftest: Rename 'smb encrypt' to 'server smb +Subject: [PATCH 058/104] selftest: Rename 'smb encrypt' to 'server smb encrypt' This makes it more clear what we want. 'smb encrypt' is a synonym for @@ -6026,7 +6026,7 @@ Reviewed-by: Jeremy Allison 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm -index 0a8cefa811d..a31165b372d 100755 +index e141f102ef1..c070086ca49 100755 --- a/selftest/target/Samba3.pm +++ b/selftest/target/Samba3.pm @@ -1178,7 +1178,7 @@ sub setup_simpleserver @@ -6047,7 +6047,7 @@ index 0a8cefa811d..a31165b372d 100755 [hidenewfiles] path = $prefix_abs/share -@@ -2340,7 +2340,7 @@ sub provision($$) +@@ -2351,7 +2351,7 @@ sub provision($$) [tmpenc] path = $shrdir comment = encrypt smb username is [%U] @@ -6057,13 +6057,13 @@ index 0a8cefa811d..a31165b372d 100755 [tmpguest] path = $shrdir -- -2.28.0 +2.29.2 -From 355afa22953cf8838dc83210315bc2557e764082 Mon Sep 17 00:00:00 2001 +From 2fc16a8d11f48424fc2fff0380fb623f552ece5f Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 8 Sep 2020 12:30:08 +0200 -Subject: [PATCH 059/105] selftest: Move enc_desired to provision to have it in +Subject: [PATCH 059/104] selftest: Move enc_desired to provision to have it in 'fileserver' too Signed-off-by: Andreas Schneider @@ -6074,7 +6074,7 @@ Reviewed-by: Jeremy Allison 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm -index a31165b372d..eda2c428793 100755 +index c070086ca49..fa3ca8962a5 100755 --- a/selftest/target/Samba3.pm +++ b/selftest/target/Samba3.pm @@ -1242,11 +1242,6 @@ sub setup_simpleserver @@ -6089,7 +6089,7 @@ index a31165b372d..eda2c428793 100755 [hidenewfiles] path = $prefix_abs/share hide new files timeout = 5 -@@ -2822,7 +2817,13 @@ sub provision($$) +@@ -2833,7 +2828,13 @@ sub provision($$) [delete_readonly] path = $prefix_abs/share delete readonly = yes @@ -6104,13 +6104,13 @@ index a31165b372d..eda2c428793 100755 my $net = Samba::bindir_path($self, "net"); -- -2.28.0 +2.29.2 -From 2a8b98850f61219a1c97da9151e55d0e21a4265b Mon Sep 17 00:00:00 2001 +From 299d7d6868e9590693e465cbc0c10abe8b7fc5a0 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 8 Sep 2020 10:15:20 +0200 -Subject: [PATCH 060/105] s3:tests: Add smbclient tests for 'client smb +Subject: [PATCH 060/104] s3:tests: Add smbclient tests for 'client smb encrypt' Signed-off-by: Andreas Schneider @@ -6134,10 +6134,10 @@ index 00000000000..972096bdc8b +^samba3.blackbox.smbclient.encryption.smbclient.smb3.client.encrypt.required...LOCALSHARE4.enc_desired..simpleserver +^samba3.blackbox.smbclient.encryption.smbclient.smb3.client.encrypt.required...LOCALSHARE4.tmp..simpleserver diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm -index eda2c428793..9f86f2b59cf 100755 +index fa3ca8962a5..ffc19c7d5a2 100755 --- a/selftest/target/Samba3.pm +++ b/selftest/target/Samba3.pm -@@ -2822,6 +2822,11 @@ sub provision($$) +@@ -2833,6 +2833,11 @@ sub provision($$) path = $prefix_abs/share vfs objects = server smb encrypt = desired @@ -6228,7 +6228,7 @@ index 00000000000..9a717cdac4f + +testok $0 $failed diff --git a/source3/selftest/tests.py b/source3/selftest/tests.py -index d05de6bd08c..ec967caea2e 100755 +index 27dc7587b17..46bf274227c 100755 --- a/source3/selftest/tests.py +++ b/source3/selftest/tests.py @@ -1040,6 +1040,12 @@ plantestsuite("samba3.blackbox.smbclient.encryption_off", "simpleserver", @@ -6245,13 +6245,13 @@ index d05de6bd08c..ec967caea2e 100755 [os.path.join(samba3srcdir, "script/tests/test_rpcclient_netsessenum.sh"), -- -2.28.0 +2.29.2 -From 45ebf91c66a23488c0835ba038eca345db984106 Mon Sep 17 00:00:00 2001 +From d996ccf7dc53046f92827ddab72aac6e92dd3a77 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 15:19:27 +0200 -Subject: [PATCH 061/105] s3:client: Remove global smb_encrypt +Subject: [PATCH 061/104] s3:client: Remove global smb_encrypt Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison @@ -6261,10 +6261,10 @@ Reviewed-by: Jeremy Allison 1 file changed, 16 insertions(+), 9 deletions(-) diff --git a/source3/client/client.c b/source3/client/client.c -index 30287ffd253..e1128bf4a8c 100644 +index 56309efcea7..60d4fb3c5ee 100644 --- a/source3/client/client.c +++ b/source3/client/client.c -@@ -98,9 +98,6 @@ static unsigned int put_total_time_ms = 0; +@@ -96,9 +96,6 @@ static unsigned int put_total_time_ms = 0; /* totals globals */ static double dir_total; @@ -6274,7 +6274,7 @@ index 30287ffd253..e1128bf4a8c 100644 /* root cli_state connection */ struct cli_state *cli; -@@ -2822,7 +2819,7 @@ static int cmd_posix_encrypt(void) +@@ -2758,7 +2755,7 @@ static int cmd_posix_encrypt(void) d_printf("posix_encrypt failed with error %s\n", nt_errstr(status)); } else { d_printf("encryption on\n"); @@ -6283,7 +6283,7 @@ index 30287ffd253..e1128bf4a8c 100644 } return 0; -@@ -5347,6 +5344,9 @@ int cmd_iosize(void) +@@ -5283,6 +5280,9 @@ int cmd_iosize(void) TALLOC_CTX *ctx = talloc_tos(); char *buf; int iosize; @@ -6293,7 +6293,7 @@ index 30287ffd253..e1128bf4a8c 100644 if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { if (smbXcli_conn_protocol(cli->conn) < PROTOCOL_SMB2_02) { -@@ -5610,6 +5610,9 @@ static int process_command_string(const char *cmd_in) +@@ -5546,6 +5546,9 @@ static int process_command_string(const char *cmd_in) TALLOC_CTX *ctx = talloc_tos(); char *cmd = talloc_strdup(ctx, cmd_in); int rc = 0; @@ -6303,7 +6303,7 @@ index 30287ffd253..e1128bf4a8c 100644 if (!cmd) { return 1; -@@ -6063,6 +6066,9 @@ static int process(const char *base_directory) +@@ -5999,6 +6002,9 @@ static int process(const char *base_directory) { int rc = 0; NTSTATUS status; @@ -6313,7 +6313,7 @@ index 30287ffd253..e1128bf4a8c 100644 status = cli_cm_open(talloc_tos(), NULL, desthost, -@@ -6101,6 +6107,9 @@ static int process(const char *base_directory) +@@ -6037,6 +6043,9 @@ static int process(const char *base_directory) static int do_host_query(const char *query_host) { NTSTATUS status; @@ -6323,7 +6323,7 @@ index 30287ffd253..e1128bf4a8c 100644 status = cli_cm_open(talloc_tos(), NULL, query_host, -@@ -6178,6 +6187,9 @@ static int do_tar_op(const char *base_directory) +@@ -6114,6 +6123,9 @@ static int do_tar_op(const char *base_directory) { struct tar *tar_ctx = tar_get_ctx(); int ret = 0; @@ -6333,7 +6333,7 @@ index 30287ffd253..e1128bf4a8c 100644 /* do we already have a connection? */ if (!cli) { -@@ -6523,9 +6535,6 @@ int main(int argc,char *argv[]) +@@ -6459,9 +6471,6 @@ int main(int argc,char *argv[]) case 'q': quiet=true; break; @@ -6343,7 +6343,7 @@ index 30287ffd253..e1128bf4a8c 100644 case 'B': return(do_smb_browse()); -@@ -6595,8 +6604,6 @@ int main(int argc,char *argv[]) +@@ -6531,8 +6540,6 @@ int main(int argc,char *argv[]) /* Ensure we have a password (or equivalent). */ popt_common_credentials_post(); @@ -6353,13 +6353,13 @@ index 30287ffd253..e1128bf4a8c 100644 max_protocol = lp_client_max_protocol(); -- -2.28.0 +2.29.2 -From 088473e47bcb30fe3b179133265da9ea6b8ec684 Mon Sep 17 00:00:00 2001 +From b923ea7625de03e23a999a3cb844d81dcd25316f Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 15:24:27 +0200 -Subject: [PATCH 062/105] s3:libsmb: Remove force_encrypt from cli_cm_open() +Subject: [PATCH 062/104] s3:libsmb: Remove force_encrypt from cli_cm_open() Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison @@ -6372,10 +6372,10 @@ Reviewed-by: Jeremy Allison 4 files changed, 6 insertions(+), 21 deletions(-) diff --git a/source3/client/client.c b/source3/client/client.c -index e1128bf4a8c..1f18024b798 100644 +index 60d4fb3c5ee..3a610086511 100644 --- a/source3/client/client.c +++ b/source3/client/client.c -@@ -5610,9 +5610,6 @@ static int process_command_string(const char *cmd_in) +@@ -5546,9 +5546,6 @@ static int process_command_string(const char *cmd_in) TALLOC_CTX *ctx = talloc_tos(); char *cmd = talloc_strdup(ctx, cmd_in); int rc = 0; @@ -6385,7 +6385,7 @@ index e1128bf4a8c..1f18024b798 100644 if (!cmd) { return 1; -@@ -5625,7 +5622,6 @@ static int process_command_string(const char *cmd_in) +@@ -5561,7 +5558,6 @@ static int process_command_string(const char *cmd_in) status = cli_cm_open(talloc_tos(), NULL, desthost, service, popt_get_cmdline_auth_info(), @@ -6393,7 +6393,7 @@ index e1128bf4a8c..1f18024b798 100644 max_protocol, have_ip ? &dest_ss : NULL, port, name_type, -@@ -6066,14 +6062,11 @@ static int process(const char *base_directory) +@@ -6002,14 +5998,11 @@ static int process(const char *base_directory) { int rc = 0; NTSTATUS status; @@ -6409,7 +6409,7 @@ index e1128bf4a8c..1f18024b798 100644 have_ip ? &dest_ss : NULL, port, name_type, &cli); if (!NT_STATUS_IS_OK(status)) { -@@ -6107,14 +6100,11 @@ static int process(const char *base_directory) +@@ -6043,14 +6036,11 @@ static int process(const char *base_directory) static int do_host_query(const char *query_host) { NTSTATUS status; @@ -6425,7 +6425,7 @@ index e1128bf4a8c..1f18024b798 100644 have_ip ? &dest_ss : NULL, port, name_type, &cli); if (!NT_STATUS_IS_OK(status)) { -@@ -6161,7 +6151,7 @@ static int do_host_query(const char *query_host) +@@ -6097,7 +6087,7 @@ static int do_host_query(const char *query_host) status = cli_cm_open(talloc_tos(), NULL, query_host, "IPC$", popt_get_cmdline_auth_info(), @@ -6434,7 +6434,7 @@ index e1128bf4a8c..1f18024b798 100644 have_ip ? &dest_ss : NULL, NBT_SMB_PORT, name_type, &cli); if (!NT_STATUS_IS_OK(status)) { -@@ -6187,9 +6177,6 @@ static int do_tar_op(const char *base_directory) +@@ -6123,9 +6113,6 @@ static int do_tar_op(const char *base_directory) { struct tar *tar_ctx = tar_get_ctx(); int ret = 0; @@ -6444,7 +6444,7 @@ index e1128bf4a8c..1f18024b798 100644 /* do we already have a connection? */ if (!cli) { -@@ -6198,7 +6185,7 @@ static int do_tar_op(const char *base_directory) +@@ -6134,7 +6121,7 @@ static int do_tar_op(const char *base_directory) status = cli_cm_open(talloc_tos(), NULL, desthost, service, popt_get_cmdline_auth_info(), @@ -6507,13 +6507,13 @@ index eeabcaa7463..bb3e9e6874e 100644 const struct sockaddr_storage *dest_ss, int port, -- -2.28.0 +2.29.2 -From 0291ff12056c914b3f9429a5bba48190897fe6c1 Mon Sep 17 00:00:00 2001 +From 2fd26f4c208556cd2f28f0c54fe11cea044c7881 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 15:26:39 +0200 -Subject: [PATCH 063/105] s3:libsmb: Remove force_encrypt from cli_cm_connect() +Subject: [PATCH 063/104] s3:libsmb: Remove force_encrypt from cli_cm_connect() Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison @@ -6569,13 +6569,13 @@ index 4825b8f3fae..b0032005398 100644 NULL, /* dest_ss */ 0, /* port */ -- -2.28.0 +2.29.2 -From 32f7fd016ecbeb3b24ad93d593ba06e8292dd02f Mon Sep 17 00:00:00 2001 +From 3db1056dc42765aa3043b6ea0fd0389a34a41145 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 15:28:28 +0200 -Subject: [PATCH 064/105] s3:libsmb: Remove force_encrypt from clidfs +Subject: [PATCH 064/104] s3:libsmb: Remove force_encrypt from clidfs do_connect() Signed-off-by: Andreas Schneider @@ -6630,13 +6630,13 @@ index b0032005398..5503506de97 100644 if (!NT_STATUS_IS_OK(status)) { -- -2.28.0 +2.29.2 -From 4afc92a55aa63557db2b4e2a9b0bbe5bc7d12c55 Mon Sep 17 00:00:00 2001 +From 8b234932ec76052258078d08071c33fefd5f3a0e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 15:52:11 +0200 -Subject: [PATCH 065/105] s3:libsmb: Remove force_encrypt from +Subject: [PATCH 065/104] s3:libsmb: Remove force_encrypt from cli_check_msdfs_proxy() Signed-off-by: Andreas Schneider @@ -6727,13 +6727,13 @@ index bb3e9e6874e..f2b0a8c5ff8 100644 /* The following definitions come from libsmb/clientgen.c */ -- -2.28.0 +2.29.2 -From 2c50d0ba7eec6d37943b7afdf426b114c9e1f292 Mon Sep 17 00:00:00 2001 +From b1324ba3361e66ca4bdf5b0cb0e1d8c8084955d4 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 18 Aug 2020 17:15:09 +0200 -Subject: [PATCH 066/105] s3:libsmb: Pass cli_credentials to clidfs +Subject: [PATCH 066/104] s3:libsmb: Pass cli_credentials to clidfs do_connect() Signed-off-by: Andreas Schneider @@ -6846,13 +6846,13 @@ index 736c565a7a8..d536e0597af 100644 dest_ss, port, name_type, &cli); -- -2.28.0 +2.29.2 -From 608c0b87761f75e539b2e1e7599ceb981770b647 Mon Sep 17 00:00:00 2001 +From 5997be2fc0d9b25c7a81d1d21e3cc1cd3f55e66f Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 18 Aug 2020 17:18:16 +0200 -Subject: [PATCH 067/105] s3:libsmb: Pass cli_credentials to cli_cm_connect() +Subject: [PATCH 067/104] s3:libsmb: Pass cli_credentials to cli_cm_connect() Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison @@ -6917,13 +6917,13 @@ index d536e0597af..a2c6f5fe5ec 100644 NULL, /* dest_ss */ 0, /* port */ -- -2.28.0 +2.29.2 -From d6d5da0e28c3879280e1139f51bfe2ef03bc450e Mon Sep 17 00:00:00 2001 +From 62109132050092a5b4ac81d80cb358e563da605c Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 18 Aug 2020 17:26:54 +0200 -Subject: [PATCH 068/105] s3:libsmb: Pass cli_credentials to cli_cm_open() +Subject: [PATCH 068/104] s3:libsmb: Pass cli_credentials to cli_cm_open() Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison @@ -6936,10 +6936,10 @@ Reviewed-by: Jeremy Allison 4 files changed, 42 insertions(+), 28 deletions(-) diff --git a/source3/client/client.c b/source3/client/client.c -index 1f18024b798..35bc3a7c5c3 100644 +index 3a610086511..c54b5065b44 100644 --- a/source3/client/client.c +++ b/source3/client/client.c -@@ -5610,6 +5610,8 @@ static int process_command_string(const char *cmd_in) +@@ -5546,6 +5546,8 @@ static int process_command_string(const char *cmd_in) TALLOC_CTX *ctx = talloc_tos(); char *cmd = talloc_strdup(ctx, cmd_in); int rc = 0; @@ -6948,7 +6948,7 @@ index 1f18024b798..35bc3a7c5c3 100644 if (!cmd) { return 1; -@@ -5621,7 +5623,8 @@ static int process_command_string(const char *cmd_in) +@@ -5557,7 +5559,8 @@ static int process_command_string(const char *cmd_in) status = cli_cm_open(talloc_tos(), NULL, desthost, @@ -6958,7 +6958,7 @@ index 1f18024b798..35bc3a7c5c3 100644 max_protocol, have_ip ? &dest_ss : NULL, port, name_type, -@@ -6062,10 +6065,13 @@ static int process(const char *base_directory) +@@ -5998,10 +6001,13 @@ static int process(const char *base_directory) { int rc = 0; NTSTATUS status; @@ -6973,7 +6973,7 @@ index 1f18024b798..35bc3a7c5c3 100644 max_protocol, have_ip ? &dest_ss : NULL, port, name_type, &cli); -@@ -6100,10 +6106,13 @@ static int process(const char *base_directory) +@@ -6036,10 +6042,13 @@ static int process(const char *base_directory) static int do_host_query(const char *query_host) { NTSTATUS status; @@ -6988,7 +6988,7 @@ index 1f18024b798..35bc3a7c5c3 100644 max_protocol, have_ip ? &dest_ss : NULL, port, name_type, &cli); -@@ -6150,7 +6159,8 @@ static int do_host_query(const char *query_host) +@@ -6086,7 +6095,8 @@ static int do_host_query(const char *query_host) d_printf("Reconnecting with SMB1 for workgroup listing.\n"); status = cli_cm_open(talloc_tos(), NULL, query_host, @@ -6998,7 +6998,7 @@ index 1f18024b798..35bc3a7c5c3 100644 max_proto, have_ip ? &dest_ss : NULL, NBT_SMB_PORT, name_type, &cli); -@@ -6177,6 +6187,8 @@ static int do_tar_op(const char *base_directory) +@@ -6113,6 +6123,8 @@ static int do_tar_op(const char *base_directory) { struct tar *tar_ctx = tar_get_ctx(); int ret = 0; @@ -7007,7 +7007,7 @@ index 1f18024b798..35bc3a7c5c3 100644 /* do we already have a connection? */ if (!cli) { -@@ -6184,7 +6196,8 @@ static int do_tar_op(const char *base_directory) +@@ -6120,7 +6132,8 @@ static int do_tar_op(const char *base_directory) status = cli_cm_open(talloc_tos(), NULL, desthost, @@ -7128,13 +7128,13 @@ index f2b0a8c5ff8..0b8cf2a6036 100644 struct client_dfs_referral; NTSTATUS cli_dfs_get_referral_ex(TALLOC_CTX *ctx, -- -2.28.0 +2.29.2 -From 1c07abb4b9690b62b2ae7841134d7a71e4771bb9 Mon Sep 17 00:00:00 2001 +From 9500031d977b874b32085df3ff7f5b0ae28514c6 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 18 Aug 2020 17:42:25 +0200 -Subject: [PATCH 069/105] s3:libsmb: Pass cli_credentials to +Subject: [PATCH 069/104] s3:libsmb: Pass cli_credentials to cli_resolve_path(), using helper variables. Signed-off-by: Andreas Schneider @@ -7152,10 +7152,10 @@ Signed-off-by: Jeremy Allison 8 files changed, 188 insertions(+), 47 deletions(-) diff --git a/source3/client/client.c b/source3/client/client.c -index 35bc3a7c5c3..23de5befee3 100644 +index c54b5065b44..13e48f80a01 100644 --- a/source3/client/client.c +++ b/source3/client/client.c -@@ -300,9 +300,14 @@ static int do_dskattr(void) +@@ -298,9 +298,14 @@ static int do_dskattr(void) struct cli_state *targetcli = NULL; char *targetpath = NULL; TALLOC_CTX *ctx = talloc_tos(); @@ -7171,7 +7171,7 @@ index 35bc3a7c5c3..23de5befee3 100644 client_get_cur_dir(), &targetcli, &targetpath); if (!NT_STATUS_IS_OK(status)) { -@@ -392,6 +397,8 @@ static int do_cd(const char *new_dir) +@@ -390,6 +395,8 @@ static int do_cd(const char *new_dir) uint32_t attributes; int ret = 1; TALLOC_CTX *ctx = talloc_stackframe(); @@ -7180,7 +7180,7 @@ index 35bc3a7c5c3..23de5befee3 100644 NTSTATUS status; newdir = talloc_strdup(ctx, new_dir); -@@ -434,7 +441,8 @@ static int do_cd(const char *new_dir) +@@ -432,7 +439,8 @@ static int do_cd(const char *new_dir) new_cd = client_clean_name(ctx, new_cd); client_set_cur_dir(new_cd); @@ -7190,7 +7190,7 @@ index 35bc3a7c5c3..23de5befee3 100644 cli, new_cd, &targetcli, &targetpath); if (!NT_STATUS_IS_OK(status)) { d_printf("cd %s: %s\n", new_cd, nt_errstr(status)); -@@ -811,6 +819,8 @@ NTSTATUS do_list(const char *mask, +@@ -809,6 +817,8 @@ NTSTATUS do_list(const char *mask, TALLOC_CTX *ctx = talloc_tos(); struct cli_state *targetcli = NULL; char *targetpath = NULL; @@ -7199,7 +7199,7 @@ index 35bc3a7c5c3..23de5befee3 100644 NTSTATUS ret_status = NT_STATUS_OK; NTSTATUS status = NT_STATUS_OK; -@@ -834,7 +844,7 @@ NTSTATUS do_list(const char *mask, +@@ -832,7 +842,7 @@ NTSTATUS do_list(const char *mask, /* check for dfs */ status = cli_resolve_path(ctx, "", @@ -7208,7 +7208,7 @@ index 35bc3a7c5c3..23de5befee3 100644 cli, head, &targetcli, &targetpath); if (!NT_STATUS_IS_OK(status)) { d_printf("do_list: [%s] %s\n", head, -@@ -1044,6 +1054,8 @@ static int do_get(const char *rname, const char *lname_in, bool reget) +@@ -1042,6 +1052,8 @@ static int do_get(const char *rname, const char *lname_in, bool reget) struct cli_state *targetcli = NULL; char *targetname = NULL; char *lname = NULL; @@ -7217,7 +7217,7 @@ index 35bc3a7c5c3..23de5befee3 100644 NTSTATUS status; lname = talloc_strdup(ctx, lname_in); -@@ -1058,7 +1070,8 @@ static int do_get(const char *rname, const char *lname_in, bool reget) +@@ -1056,7 +1068,8 @@ static int do_get(const char *rname, const char *lname_in, bool reget) } } @@ -7227,7 +7227,7 @@ index 35bc3a7c5c3..23de5befee3 100644 cli, rname, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("Failed to open %s: %s\n", rname, nt_errstr(status)); -@@ -1477,9 +1490,12 @@ static bool do_mkdir(const char *name) +@@ -1413,9 +1426,12 @@ static bool do_mkdir(const char *name) TALLOC_CTX *ctx = talloc_tos(); struct cli_state *targetcli; char *targetname = NULL; @@ -7241,7 +7241,7 @@ index 35bc3a7c5c3..23de5befee3 100644 cli, name, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("mkdir %s: %s\n", name, nt_errstr(status)); -@@ -1538,6 +1554,8 @@ static int cmd_mkdir(void) +@@ -1474,6 +1490,8 @@ static int cmd_mkdir(void) TALLOC_CTX *ctx = talloc_tos(); char *mask = NULL; char *buf = NULL; @@ -7250,7 +7250,7 @@ index 35bc3a7c5c3..23de5befee3 100644 NTSTATUS status; mask = talloc_strdup(ctx, client_get_cur_dir()); -@@ -1574,7 +1592,8 @@ static int cmd_mkdir(void) +@@ -1510,7 +1528,8 @@ static int cmd_mkdir(void) } status = cli_resolve_path(ctx, "", @@ -7260,7 +7260,7 @@ index 35bc3a7c5c3..23de5befee3 100644 &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { return 1; -@@ -1888,9 +1907,12 @@ static int do_put(const char *rname, const char *lname, bool reput) +@@ -1824,9 +1843,12 @@ static int do_put(const char *rname, const char *lname, bool reput) struct cli_state *targetcli; char *targetname = NULL; struct push_state state; @@ -7274,7 +7274,7 @@ index 35bc3a7c5c3..23de5befee3 100644 cli, rname, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("Failed to open %s: %s\n", rname, nt_errstr(status)); -@@ -2665,6 +2687,8 @@ static int cmd_wdel(void) +@@ -2601,6 +2623,8 @@ static int cmd_wdel(void) uint32_t attribute; struct cli_state *targetcli; char *targetname = NULL; @@ -7283,7 +7283,7 @@ index 35bc3a7c5c3..23de5befee3 100644 NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { -@@ -2690,7 +2714,8 @@ static int cmd_wdel(void) +@@ -2626,7 +2650,8 @@ static int cmd_wdel(void) return 1; } @@ -7293,7 +7293,7 @@ index 35bc3a7c5c3..23de5befee3 100644 cli, mask, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("cmd_wdel %s: %s\n", mask, nt_errstr(status)); -@@ -2716,6 +2741,8 @@ static int cmd_open(void) +@@ -2652,6 +2677,8 @@ static int cmd_open(void) char *targetname = NULL; struct cli_state *targetcli; uint16_t fnum = (uint16_t)-1; @@ -7302,7 +7302,7 @@ index 35bc3a7c5c3..23de5befee3 100644 NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { -@@ -2735,7 +2762,8 @@ static int cmd_open(void) +@@ -2671,7 +2698,8 @@ static int cmd_open(void) return 1; } @@ -7312,7 +7312,7 @@ index 35bc3a7c5c3..23de5befee3 100644 cli, mask, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("open %s: %s\n", mask, nt_errstr(status)); -@@ -2837,6 +2865,8 @@ static int cmd_posix_open(void) +@@ -2773,6 +2801,8 @@ static int cmd_posix_open(void) struct cli_state *targetcli; mode_t mode; uint16_t fnum; @@ -7321,7 +7321,7 @@ index 35bc3a7c5c3..23de5befee3 100644 NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { -@@ -2861,7 +2891,8 @@ static int cmd_posix_open(void) +@@ -2797,7 +2827,8 @@ static int cmd_posix_open(void) } mode = (mode_t)strtol(buf, (char **)NULL, 8); @@ -7331,7 +7331,7 @@ index 35bc3a7c5c3..23de5befee3 100644 cli, mask, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("posix_open %s: %s\n", mask, nt_errstr(status)); -@@ -2896,6 +2927,8 @@ static int cmd_posix_mkdir(void) +@@ -2832,6 +2863,8 @@ static int cmd_posix_mkdir(void) char *targetname = NULL; struct cli_state *targetcli; mode_t mode; @@ -7340,7 +7340,7 @@ index 35bc3a7c5c3..23de5befee3 100644 NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { -@@ -2920,7 +2953,8 @@ static int cmd_posix_mkdir(void) +@@ -2856,7 +2889,8 @@ static int cmd_posix_mkdir(void) } mode = (mode_t)strtol(buf, (char **)NULL, 8); @@ -7350,7 +7350,7 @@ index 35bc3a7c5c3..23de5befee3 100644 cli, mask, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("posix_mkdir %s: %s\n", mask, nt_errstr(status)); -@@ -2944,6 +2978,8 @@ static int cmd_posix_unlink(void) +@@ -2880,6 +2914,8 @@ static int cmd_posix_unlink(void) char *buf = NULL; char *targetname = NULL; struct cli_state *targetcli; @@ -7359,7 +7359,7 @@ index 35bc3a7c5c3..23de5befee3 100644 NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { -@@ -2962,7 +2998,8 @@ static int cmd_posix_unlink(void) +@@ -2898,7 +2934,8 @@ static int cmd_posix_unlink(void) return 1; } @@ -7369,7 +7369,7 @@ index 35bc3a7c5c3..23de5befee3 100644 cli, mask, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("posix_unlink %s: %s\n", mask, nt_errstr(status)); -@@ -2987,6 +3024,8 @@ static int cmd_posix_rmdir(void) +@@ -2923,6 +2960,8 @@ static int cmd_posix_rmdir(void) char *buf = NULL; char *targetname = NULL; struct cli_state *targetcli; @@ -7378,7 +7378,7 @@ index 35bc3a7c5c3..23de5befee3 100644 NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { -@@ -3005,7 +3044,8 @@ static int cmd_posix_rmdir(void) +@@ -2941,7 +2980,8 @@ static int cmd_posix_rmdir(void) return 1; } @@ -7388,7 +7388,7 @@ index 35bc3a7c5c3..23de5befee3 100644 cli, mask, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("posix_rmdir %s: %s\n", mask, nt_errstr(status)); -@@ -3294,6 +3334,8 @@ static int cmd_rmdir(void) +@@ -3230,6 +3270,8 @@ static int cmd_rmdir(void) char *buf = NULL; char *targetname = NULL; struct cli_state *targetcli; @@ -7397,7 +7397,7 @@ index 35bc3a7c5c3..23de5befee3 100644 NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { -@@ -3312,7 +3354,8 @@ static int cmd_rmdir(void) +@@ -3248,7 +3290,8 @@ static int cmd_rmdir(void) return 1; } @@ -7407,7 +7407,7 @@ index 35bc3a7c5c3..23de5befee3 100644 cli, mask, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("rmdir %s: %s\n", mask, nt_errstr(status)); -@@ -3341,6 +3384,8 @@ static int cmd_link(void) +@@ -3277,6 +3320,8 @@ static int cmd_link(void) char *buf2 = NULL; char *targetname = NULL; struct cli_state *targetcli; @@ -7416,7 +7416,7 @@ index 35bc3a7c5c3..23de5befee3 100644 NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL) || -@@ -3371,7 +3416,8 @@ static int cmd_link(void) +@@ -3307,7 +3352,8 @@ static int cmd_link(void) return 1; } @@ -7426,7 +7426,7 @@ index 35bc3a7c5c3..23de5befee3 100644 cli, oldname, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("link %s: %s\n", oldname, nt_errstr(status)); -@@ -3404,6 +3450,8 @@ static int cmd_readlink(void) +@@ -3340,6 +3386,8 @@ static int cmd_readlink(void) char *targetname = NULL; char *linkname = NULL; struct cli_state *targetcli; @@ -7435,7 +7435,7 @@ index 35bc3a7c5c3..23de5befee3 100644 NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { -@@ -3422,7 +3470,8 @@ static int cmd_readlink(void) +@@ -3358,7 +3406,8 @@ static int cmd_readlink(void) return 1; } @@ -7445,7 +7445,7 @@ index 35bc3a7c5c3..23de5befee3 100644 cli, name, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("readlink %s: %s\n", name, nt_errstr(status)); -@@ -3461,6 +3510,8 @@ static int cmd_symlink(void) +@@ -3397,6 +3446,8 @@ static int cmd_symlink(void) char *buf = NULL; char *buf2 = NULL; struct cli_state *newcli; @@ -7454,7 +7454,7 @@ index 35bc3a7c5c3..23de5befee3 100644 NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL) || -@@ -3483,7 +3534,8 @@ static int cmd_symlink(void) +@@ -3419,7 +3470,8 @@ static int cmd_symlink(void) } /* New name must be present in share namespace. */ status = cli_resolve_path(ctx, "", @@ -7464,7 +7464,7 @@ index 35bc3a7c5c3..23de5befee3 100644 &newcli, &newname); if (!NT_STATUS_IS_OK(status)) { d_printf("link %s: %s\n", newname, -@@ -3519,6 +3571,8 @@ static int cmd_chmod(void) +@@ -3455,6 +3507,8 @@ static int cmd_chmod(void) char *targetname = NULL; struct cli_state *targetcli; mode_t mode; @@ -7473,7 +7473,7 @@ index 35bc3a7c5c3..23de5befee3 100644 NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL) || -@@ -3540,7 +3594,8 @@ static int cmd_chmod(void) +@@ -3476,7 +3530,8 @@ static int cmd_chmod(void) mode = (mode_t)strtol(buf, NULL, 8); @@ -7483,7 +7483,7 @@ index 35bc3a7c5c3..23de5befee3 100644 cli, src, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("chmod %s: %s\n", src, nt_errstr(status)); -@@ -3684,6 +3739,8 @@ static int cmd_getfacl(void) +@@ -3620,6 +3675,8 @@ static int cmd_getfacl(void) size_t num_dir_acls = 0; size_t expected_buflen; uint16_t i; @@ -7492,7 +7492,7 @@ index 35bc3a7c5c3..23de5befee3 100644 NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr,&name,NULL)) { -@@ -3702,7 +3759,8 @@ static int cmd_getfacl(void) +@@ -3638,7 +3695,8 @@ static int cmd_getfacl(void) return 1; } @@ -7502,7 +7502,7 @@ index 35bc3a7c5c3..23de5befee3 100644 cli, src, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("stat %s: %s\n", src, nt_errstr(status)); -@@ -3867,6 +3925,8 @@ static int cmd_geteas(void) +@@ -3803,6 +3861,8 @@ static int cmd_geteas(void) NTSTATUS status; size_t i, num_eas; struct ea_struct *eas; @@ -7511,7 +7511,7 @@ index 35bc3a7c5c3..23de5befee3 100644 if (!next_token_talloc(ctx, &cmd_ptr,&name,NULL)) { d_printf("geteas filename\n"); -@@ -3884,7 +3944,8 @@ static int cmd_geteas(void) +@@ -3820,7 +3880,8 @@ static int cmd_geteas(void) return 1; } @@ -7521,7 +7521,7 @@ index 35bc3a7c5c3..23de5befee3 100644 cli, src, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("stat %s: %s\n", src, nt_errstr(status)); -@@ -3923,6 +3984,8 @@ static int cmd_setea(void) +@@ -3859,6 +3920,8 @@ static int cmd_setea(void) char *eavalue = NULL; char *targetname = NULL; struct cli_state *targetcli; @@ -7530,7 +7530,7 @@ index 35bc3a7c5c3..23de5befee3 100644 NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr, &name, NULL) -@@ -3945,7 +4008,8 @@ static int cmd_setea(void) +@@ -3881,7 +3944,8 @@ static int cmd_setea(void) return 1; } @@ -7540,7 +7540,7 @@ index 35bc3a7c5c3..23de5befee3 100644 cli, src, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("stat %s: %s\n", src, nt_errstr(status)); -@@ -3977,6 +4041,8 @@ static int cmd_stat(void) +@@ -3913,6 +3977,8 @@ static int cmd_stat(void) SMB_STRUCT_STAT sbuf; struct tm *lt; time_t tmp_time; @@ -7549,7 +7549,7 @@ index 35bc3a7c5c3..23de5befee3 100644 NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr,&name,NULL)) { -@@ -3995,7 +4061,8 @@ static int cmd_stat(void) +@@ -3931,7 +3997,8 @@ static int cmd_stat(void) return 1; } @@ -7559,7 +7559,7 @@ index 35bc3a7c5c3..23de5befee3 100644 cli, src, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("stat %s: %s\n", src, nt_errstr(status)); -@@ -4084,6 +4151,8 @@ static int cmd_chown(void) +@@ -4020,6 +4087,8 @@ static int cmd_chown(void) char *buf, *buf2, *buf3; struct cli_state *targetcli; char *targetname = NULL; @@ -7568,7 +7568,7 @@ index 35bc3a7c5c3..23de5befee3 100644 NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL) || -@@ -4107,7 +4176,8 @@ static int cmd_chown(void) +@@ -4043,7 +4112,8 @@ static int cmd_chown(void) if (src == NULL) { return 1; } @@ -7578,7 +7578,7 @@ index 35bc3a7c5c3..23de5befee3 100644 cli, src, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("chown %s: %s\n", src, nt_errstr(status)); -@@ -4141,6 +4211,8 @@ static int cmd_rename(void) +@@ -4077,6 +4147,8 @@ static int cmd_rename(void) struct cli_state *targetcli; char *targetsrc; char *targetdest; @@ -7587,7 +7587,7 @@ index 35bc3a7c5c3..23de5befee3 100644 NTSTATUS status; bool replace = false; -@@ -4179,14 +4251,16 @@ static int cmd_rename(void) +@@ -4115,14 +4187,16 @@ static int cmd_rename(void) replace = true; } @@ -7606,7 +7606,7 @@ index 35bc3a7c5c3..23de5befee3 100644 cli, dest, &targetcli, &targetdest); if (!NT_STATUS_IS_OK(status)) { d_printf("rename %s: %s\n", dest, nt_errstr(status)); -@@ -4243,6 +4317,8 @@ static int cmd_scopy(void) +@@ -4179,6 +4253,8 @@ static int cmd_scopy(void) off_t written = 0; struct scopy_timing st; int rc = 0; @@ -7615,7 +7615,7 @@ index 35bc3a7c5c3..23de5befee3 100644 NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL) || -@@ -4275,14 +4351,16 @@ static int cmd_scopy(void) +@@ -4211,14 +4287,16 @@ static int cmd_scopy(void) return 1; } @@ -7634,7 +7634,7 @@ index 35bc3a7c5c3..23de5befee3 100644 cli, dest, &targetcli, &targetdest); if (!NT_STATUS_IS_OK(status)) { d_printf("scopy %s: %s\n", dest, nt_errstr(status)); -@@ -4381,6 +4459,8 @@ static int cmd_hardlink(void) +@@ -4317,6 +4395,8 @@ static int cmd_hardlink(void) char *buf, *buf2; struct cli_state *targetcli; char *targetname; @@ -7643,7 +7643,7 @@ index 35bc3a7c5c3..23de5befee3 100644 NTSTATUS status; if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL) || -@@ -4413,7 +4493,8 @@ static int cmd_hardlink(void) +@@ -4349,7 +4429,8 @@ static int cmd_hardlink(void) return 1; } @@ -7653,7 +7653,7 @@ index 35bc3a7c5c3..23de5befee3 100644 cli, src, &targetcli, &targetname); if (!NT_STATUS_IS_OK(status)) { d_printf("hardlink %s: %s\n", src, nt_errstr(status)); -@@ -5087,9 +5168,13 @@ static int cmd_show_connect( void ) +@@ -5023,9 +5104,13 @@ static int cmd_show_connect( void ) TALLOC_CTX *ctx = talloc_tos(); struct cli_state *targetcli; char *targetpath; @@ -7668,7 +7668,7 @@ index 35bc3a7c5c3..23de5befee3 100644 client_get_cur_dir(), &targetcli, &targetpath); if (!NT_STATUS_IS_OK(status)) { -@@ -5749,6 +5834,8 @@ static char **remote_completion(const char *text, int len) +@@ -5685,6 +5770,8 @@ static char **remote_completion(const char *text, int len) struct cli_state *targetcli = NULL; int i; struct completion_remote info = { NULL, NULL, 1, 0, NULL, 0 }; @@ -7677,7 +7677,7 @@ index 35bc3a7c5c3..23de5befee3 100644 NTSTATUS status; /* can't have non-static initialisation on Sun CC, so do it -@@ -5809,7 +5896,8 @@ static char **remote_completion(const char *text, int len) +@@ -5745,7 +5832,8 @@ static char **remote_completion(const char *text, int len) goto cleanup; } @@ -8015,13 +8015,13 @@ index 8fd9fcc5780..4989ec633c3 100644 filename, &targetcli, -- -2.28.0 +2.29.2 -From 100dad122572d927889f4c03b19f169a3bf61df4 Mon Sep 17 00:00:00 2001 +From e3ce5ba85266a08bd201c851e8fd59b71322d03e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 16:40:49 +0200 -Subject: [PATCH 070/105] s3:client: Remove global max_protocol +Subject: [PATCH 070/104] s3:client: Remove global max_protocol Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison @@ -8031,7 +8031,7 @@ Reviewed-by: Jeremy Allison 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/source3/client/client.c b/source3/client/client.c -index 23de5befee3..329463795e0 100644 +index 13e48f80a01..902cdec8b64 100644 --- a/source3/client/client.c +++ b/source3/client/client.c @@ -61,7 +61,6 @@ static int io_bufsize = 0; /* we use the default size */ @@ -8042,7 +8042,7 @@ index 23de5befee3..329463795e0 100644 static int process_tok(char *tok); static int cmd_help(void); -@@ -5710,7 +5709,7 @@ static int process_command_string(const char *cmd_in) +@@ -5646,7 +5645,7 @@ static int process_command_string(const char *cmd_in) desthost, service, creds, @@ -8051,7 +8051,7 @@ index 23de5befee3..329463795e0 100644 have_ip ? &dest_ss : NULL, port, name_type, &cli); -@@ -6160,7 +6159,7 @@ static int process(const char *base_directory) +@@ -6096,7 +6095,7 @@ static int process(const char *base_directory) desthost, service, creds, @@ -8060,7 +8060,7 @@ index 23de5befee3..329463795e0 100644 have_ip ? &dest_ss : NULL, port, name_type, &cli); if (!NT_STATUS_IS_OK(status)) { -@@ -6201,7 +6200,7 @@ static int do_host_query(const char *query_host) +@@ -6137,7 +6136,7 @@ static int do_host_query(const char *query_host) query_host, "IPC$", creds, @@ -8069,7 +8069,7 @@ index 23de5befee3..329463795e0 100644 have_ip ? &dest_ss : NULL, port, name_type, &cli); if (!NT_STATUS_IS_OK(status)) { -@@ -6236,7 +6235,7 @@ static int do_host_query(const char *query_host) +@@ -6172,7 +6171,7 @@ static int do_host_query(const char *query_host) if (port != NBT_SMB_PORT || smbXcli_conn_protocol(cli->conn) > PROTOCOL_NT1) { @@ -8078,7 +8078,7 @@ index 23de5befee3..329463795e0 100644 /* * Workgroups simply don't make sense over anything -@@ -6286,7 +6285,7 @@ static int do_tar_op(const char *base_directory) +@@ -6222,7 +6221,7 @@ static int do_tar_op(const char *base_directory) desthost, service, creds, @@ -8087,7 +8087,7 @@ index 23de5befee3..329463795e0 100644 have_ip ? &dest_ss : NULL, port, name_type, &cli); if (!NT_STATUS_IS_OK(status)) { -@@ -6693,8 +6692,6 @@ int main(int argc,char *argv[]) +@@ -6629,8 +6628,6 @@ int main(int argc,char *argv[]) /* Ensure we have a password (or equivalent). */ popt_common_credentials_post(); @@ -8097,13 +8097,13 @@ index 23de5befee3..329463795e0 100644 if (cmdstr) process_command_string(cmdstr); -- -2.28.0 +2.29.2 -From fecf06bd00bc8ff23634bded86d649e432431957 Mon Sep 17 00:00:00 2001 +From 156a763a247480a88ab79f8822a2f34670a0c63b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 16:43:46 +0200 -Subject: [PATCH 071/105] s3:libsmb: Remove max_protocol from cli_cm_open() +Subject: [PATCH 071/104] s3:libsmb: Remove max_protocol from cli_cm_open() Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison @@ -8116,10 +8116,10 @@ Reviewed-by: Jeremy Allison 4 files changed, 1 insertion(+), 12 deletions(-) diff --git a/source3/client/client.c b/source3/client/client.c -index 329463795e0..e9e6cb1ac2c 100644 +index 902cdec8b64..82764c5ca16 100644 --- a/source3/client/client.c +++ b/source3/client/client.c -@@ -5709,7 +5709,6 @@ static int process_command_string(const char *cmd_in) +@@ -5645,7 +5645,6 @@ static int process_command_string(const char *cmd_in) desthost, service, creds, @@ -8127,7 +8127,7 @@ index 329463795e0..e9e6cb1ac2c 100644 have_ip ? &dest_ss : NULL, port, name_type, &cli); -@@ -6159,7 +6158,6 @@ static int process(const char *base_directory) +@@ -6095,7 +6094,6 @@ static int process(const char *base_directory) desthost, service, creds, @@ -8135,7 +8135,7 @@ index 329463795e0..e9e6cb1ac2c 100644 have_ip ? &dest_ss : NULL, port, name_type, &cli); if (!NT_STATUS_IS_OK(status)) { -@@ -6200,7 +6198,6 @@ static int do_host_query(const char *query_host) +@@ -6136,7 +6134,6 @@ static int do_host_query(const char *query_host) query_host, "IPC$", creds, @@ -8143,7 +8143,7 @@ index 329463795e0..e9e6cb1ac2c 100644 have_ip ? &dest_ss : NULL, port, name_type, &cli); if (!NT_STATUS_IS_OK(status)) { -@@ -6235,8 +6232,6 @@ static int do_host_query(const char *query_host) +@@ -6171,8 +6168,6 @@ static int do_host_query(const char *query_host) if (port != NBT_SMB_PORT || smbXcli_conn_protocol(cli->conn) > PROTOCOL_NT1) { @@ -8152,7 +8152,7 @@ index 329463795e0..e9e6cb1ac2c 100644 /* * Workgroups simply don't make sense over anything * else but port 139 and SMB1. -@@ -6248,7 +6243,6 @@ static int do_host_query(const char *query_host) +@@ -6184,7 +6179,6 @@ static int do_host_query(const char *query_host) query_host, "IPC$", creds, @@ -8160,7 +8160,7 @@ index 329463795e0..e9e6cb1ac2c 100644 have_ip ? &dest_ss : NULL, NBT_SMB_PORT, name_type, &cli); if (!NT_STATUS_IS_OK(status)) { -@@ -6285,7 +6279,6 @@ static int do_tar_op(const char *base_directory) +@@ -6221,7 +6215,6 @@ static int do_tar_op(const char *base_directory) desthost, service, creds, @@ -8222,13 +8222,13 @@ index 517738dbcd7..8aaaff2cb1e 100644 int port, int name_type, -- -2.28.0 +2.29.2 -From 2af136fd7c1ecae9cc06bc2cf26a7feac16cb279 Mon Sep 17 00:00:00 2001 +From 2ad30b082df42e010ca88e7a84471629476e00b9 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 16:45:12 +0200 -Subject: [PATCH 072/105] s3:libcmb: Remove max_protocol from cli_cm_connect() +Subject: [PATCH 072/104] s3:libcmb: Remove max_protocol from cli_cm_connect() Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison @@ -8275,13 +8275,13 @@ index fb1a0c72e6d..023dd4d2757 100644 0, /* port */ 0x20, -- -2.28.0 +2.29.2 -From dc8cfd9551afa10b0610c6663cb28bfb1ec5888a Mon Sep 17 00:00:00 2001 +From 4cc3243a8cf7c18129ad41ea52abc325aef55f06 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 16:46:29 +0200 -Subject: [PATCH 073/105] s3:libsmb: Remove max_protocol from clidfs +Subject: [PATCH 073/104] s3:libsmb: Remove max_protocol from clidfs do_connect() The if check for max_protocol == 0 is part of lp_client_max_protocol(). @@ -8338,13 +8338,13 @@ index 023dd4d2757..ee5becf76a6 100644 if (!NT_STATUS_IS_OK(status)) { -- -2.28.0 +2.29.2 -From 3a99225868e079e108968552f43b937b5b9b702f Mon Sep 17 00:00:00 2001 +From bfd80fa8f7a476b2fb37bd435697700ad032cc70 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 10 Aug 2020 15:47:35 +0200 -Subject: [PATCH 074/105] s3:include: Move loadparm prototypes to own header +Subject: [PATCH 074/104] s3:include: Move loadparm prototypes to own header file Signed-off-by: Andreas Schneider @@ -8756,13 +8756,13 @@ index 00000000000..7686877ccf1 + +#endif /* _S3_LOADPARM_H */ -- -2.28.0 +2.29.2 -From 076e6929c3c8d1dc161e7dacfc7fb7aeceb588bd Mon Sep 17 00:00:00 2001 +From ad73140f7e08472179ac7598cfea780a207f0570 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 11 Aug 2020 10:41:07 +0200 -Subject: [PATCH 075/105] s3:lib: Move interface prototypes to own header file +Subject: [PATCH 075/104] s3:lib: Move interface prototypes to own header file Signed-off-by: Andreas Schneider Reviewed-by: Jeremy Allison @@ -8862,13 +8862,13 @@ index 00000000000..f45435b4a81 + +#endif /* _INTERFACE_H */ -- -2.28.0 +2.29.2 -From b6d36e462fe41f7b88bbf120831c3765c40ef326 Mon Sep 17 00:00:00 2001 +From bd958477d69c820766a30f818163cda9f9d171a3 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 7 Feb 2020 16:48:16 +0100 -Subject: [PATCH 076/105] idl: Add SID_SAMBA_SMB3 +Subject: [PATCH 076/104] idl: Add SID_SAMBA_SMB3 Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy @@ -8892,13 +8892,13 @@ index a92e8f1518e..06bf7449a70 100644 const string NAME_NT_SERVICE = "NT SERVICE"; -- -2.28.0 +2.29.2 -From 3128ed8c26c13ccc068b5e50ae52604f5ffc9241 Mon Sep 17 00:00:00 2001 +From 6b4e237ea0900e2ac7f46b889fd95d1d04db5bff Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 7 Feb 2020 16:48:29 +0100 -Subject: [PATCH 077/105] s3:smbd: Add SMB3 connection information to session +Subject: [PATCH 077/104] s3:smbd: Add SMB3 connection information to session info Signed-off-by: Andreas Schneider @@ -9049,13 +9049,13 @@ index cf9de185c1f..cd24b7d2ed5 100644 } -- -2.28.0 +2.29.2 -From 333ae30e7f8238c684d2a1aec2b0516369068a7e Mon Sep 17 00:00:00 2001 +From 466c2d98005e1e0a3c3aa7b17779031b426b5da6 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 12 Mar 2020 14:11:56 +0100 -Subject: [PATCH 078/105] librpc: Add dcerpc helper +Subject: [PATCH 078/104] librpc: Add dcerpc helper dcerpc_is_transport_encrypted() Signed-off-by: Andreas Schneider @@ -9265,13 +9265,13 @@ index 27b180fa63d..109a1834841 100644 source='gen_ndr/ndr_winbind.c', public_deps='ndr NDR_LSA' -- -2.28.0 +2.29.2 -From 4a2e7909f3a40c6ab82c045a5a54f8604a6f1dd2 Mon Sep 17 00:00:00 2001 +From cc8a5479152c6131362e9ca9cfe6e5bab2a71af3 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 28 Aug 2020 16:31:17 +0200 -Subject: [PATCH 079/105] s3:smbd: Use defines to set 'srv_smb_encrypt' +Subject: [PATCH 079/104] s3:smbd: Use defines to set 'srv_smb_encrypt' Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy @@ -9302,13 +9302,13 @@ index d51a3de9497..785cbb23b5f 100644 char smb3_sid_str[SID_MAX_SIZE]; struct dom_sid smb3_dom_sid; -- -2.28.0 +2.29.2 -From 69b9e46fa29adcf5a478a240ea6980bf7d97ae4b Mon Sep 17 00:00:00 2001 +From dad6dc0e5a202d48a930504768394343823d5c42 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 12 Nov 2019 16:56:45 +0100 -Subject: [PATCH 080/105] s3:rpc_server: Allow to use RC4 for setting passwords +Subject: [PATCH 080/104] s3:rpc_server: Allow to use RC4 for setting passwords Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy @@ -9539,13 +9539,13 @@ index 2af02ad6fa8..eb91ac09384 100644 bld.SAMBA3_SUBSYSTEM('RPC_SPOOLSS', source='''spoolss/srv_spoolss_nt.c -- -2.28.0 +2.29.2 -From 110323b646715aabd4468d70773c2d94968f2e99 Mon Sep 17 00:00:00 2001 +From 2932bdeff6ad18a36b2b64ab59d72ff1040acd09 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 15 Nov 2019 13:49:40 +0100 -Subject: [PATCH 081/105] s4:rpc_server: Allow to use RC4 for setting passwords +Subject: [PATCH 081/104] s4:rpc_server: Allow to use RC4 for setting passwords Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy @@ -9670,13 +9670,13 @@ index de55ad6239a..c9c1978f223 100644 -- -2.28.0 +2.29.2 -From 6353a991bc6d35b9468867c0e809e752b060da9b Mon Sep 17 00:00:00 2001 +From 959978865400d20fe1b2f9b5343fbec7c0b1109a Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:45:49 +0200 -Subject: [PATCH 082/105] lib:crypto: Add py binding for set_relax/strict fips +Subject: [PATCH 082/104] lib:crypto: Add py binding for set_relax/strict fips mode Signed-off-by: Isaac Boukris @@ -9728,13 +9728,13 @@ index 32b946eee8f..ad18d3ada0f 100644 }; -- -2.28.0 +2.29.2 -From 525072939b9292a1744f929803a9597b5f725f9a Mon Sep 17 00:00:00 2001 +From e3059d24a83175efb4f9eb3844c2e02d2af7775a Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 28 Oct 2020 17:05:36 +0100 -Subject: [PATCH 083/105] s4:param: Add 'weak crypto' getter to pyparam +Subject: [PATCH 083/104] s4:param: Add 'weak crypto' getter to pyparam Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy @@ -9784,13 +9784,13 @@ index 4023fac4dd6..e15592b5743 100644 }; -- -2.28.0 +2.29.2 -From c7dfaf75a8f8bdb18c42325c470bdee8e600d930 Mon Sep 17 00:00:00 2001 +From 2c10e3c1bbd7527f8563dca42700310c86ec04d4 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 21 Oct 2020 10:09:22 +0200 -Subject: [PATCH 084/105] python:tests: Add SAMR password change tests for fips +Subject: [PATCH 084/104] python:tests: Add SAMR password change tests for fips Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy @@ -10009,13 +10009,13 @@ index adcb5b53189..86cab3f8046 100644 def cmdline(script, *args): -- -2.28.0 +2.29.2 -From 9dfef9d7129babedfdc0fddd60f76859f44fe7c1 Mon Sep 17 00:00:00 2001 +From 65f6aef76ebc4b432f2743fb36cec64d7e06e71d Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 21 Oct 2020 10:09:22 +0200 -Subject: [PATCH 085/105] python:tests: Add SAMR password change tests for fips +Subject: [PATCH 085/104] python:tests: Add SAMR password change tests for fips Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy @@ -10042,13 +10042,13 @@ index 649e923ff9a..1ebdf2a5484 100755 warn("Unable to add '$testallowed_account' user to 'Allowed RODC Password Replication Group': \n$samba_tool_cmd\n"); return undef; -- -2.28.0 +2.29.2 -From 8e8b9d33f25c7ef89fdf4af90821ea4de77525e1 Mon Sep 17 00:00:00 2001 +From 114ce58de5ac14035c095e12aeb31931c7859d89 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 20 Aug 2020 09:40:41 +0200 -Subject: [PATCH 086/105] auth:creds: Rename CRED_USE_KERBEROS values +Subject: [PATCH 086/104] auth:creds: Rename CRED_USE_KERBEROS values Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy @@ -10784,13 +10784,13 @@ index 07c6faebb15..701dfc10a07 100644 torture_skip(tctx, "smb2.session.expire1 requires -k yes!"); } -- -2.28.0 +2.29.2 -From 6a356a6e79fa76de18a4ca0760ac4f053d70137f Mon Sep 17 00:00:00 2001 +From dd116a6a1b334431981b786c103503d9e2998247 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 1 Sep 2020 12:32:28 +0200 -Subject: [PATCH 087/105] auth:creds:tests: Migrate test to a cmocka unit test +Subject: [PATCH 087/104] auth:creds:tests: Migrate test to a cmocka unit test Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy @@ -11081,106 +11081,13 @@ index 38b6c8f4b6e..f0ab0357986 100644 ../../dsdb/schema/tests/schema_syntax.c ../../../lib/util/tests/anonymous_shared.c -- -2.28.0 +2.29.2 -From f6a4f70007e5c5ad1df3ddb018bde8568fc63f57 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?G=C3=BCnther=20Deschner?= -Date: Mon, 2 Nov 2020 16:10:44 +0100 -Subject: [PATCH 088/105] s3-vfs_glusterfs: always disable write-behind - translator - -The "pass-through" option has now been merged upstream as of: -https://github.com/gluster/glusterfs/pull/1640 - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14486 - -Guenther - -Signed-off-by: Guenther Deschner -Pair-Programmed-With: Anoop C S -Pair-Programmed-With: Sachin Prabhu -Reviewed-by: Jeremy Allison - -Autobuild-User(master): Jeremy Allison -Autobuild-Date(master): Wed Nov 4 22:53:49 UTC 2020 on sn-devel-184 - -(cherry picked from commit a51cda69ec6a017ad04b5690a3ae67a5478deee9) - -Autobuild-User(v4-13-test): Karolin Seeger -Autobuild-Date(v4-13-test): Thu Nov 5 13:54:25 UTC 2020 on sn-devel-184 ---- - source3/modules/vfs_glusterfs.c | 20 +++++++++++++++++--- - source3/wscript | 3 +++ - 2 files changed, 20 insertions(+), 3 deletions(-) - -diff --git a/source3/modules/vfs_glusterfs.c b/source3/modules/vfs_glusterfs.c -index 3cbb1ab6cb6..bdfe35ced82 100644 ---- a/source3/modules/vfs_glusterfs.c -+++ b/source3/modules/vfs_glusterfs.c -@@ -363,6 +363,7 @@ static int vfs_gluster_connect(struct vfs_handle_struct *handle, - glfs_t *fs = NULL; - TALLOC_CTX *tmp_ctx; - int ret = 0; -+ bool write_behind_pass_through_set = false; - - tmp_ctx = talloc_new(NULL); - if (tmp_ctx == NULL) { -@@ -435,6 +436,17 @@ static int vfs_gluster_connect(struct vfs_handle_struct *handle, - goto done; - } - -+#ifdef HAVE_GFAPI_VER_7_9 -+ ret = glfs_set_xlator_option(fs, "*-write-behind", "pass-through", -+ "true"); -+ if (ret < 0) { -+ DBG_ERR("%s: Failed to set xlator option: pass-through\n", -+ volume); -+ goto done; -+ } -+ write_behind_pass_through_set = true; -+#endif -+ - ret = glfs_set_logging(fs, logfile, loglevel); - if (ret < 0) { - DEBUG(0, ("%s: Failed to set logfile %s loglevel %d\n", -@@ -449,9 +461,11 @@ static int vfs_gluster_connect(struct vfs_handle_struct *handle, - goto done; - } - -- ret = check_for_write_behind_translator(tmp_ctx, fs, volume); -- if (ret < 0) { -- goto done; -+ if (!write_behind_pass_through_set) { -+ ret = check_for_write_behind_translator(tmp_ctx, fs, volume); -+ if (ret < 0) { -+ goto done; -+ } - } - - ret = glfs_set_preopened(volume, handle->conn->connectpath, fs); -diff --git a/source3/wscript b/source3/wscript -index 335cfd797f1..9920432a360 100644 ---- a/source3/wscript -+++ b/source3/wscript -@@ -1766,6 +1766,9 @@ main() { - conf.CHECK_CFG(package='glusterfs-api', args='"glusterfs-api >= 7.6" --cflags --libs', - msg='Checking for glusterfs-api >= 7.6', - uselib_store="GFAPI_VER_7_6") -+ conf.CHECK_CFG(package='glusterfs-api', args='"glusterfs-api >= 7.9" --cflags --libs', -+ msg='Checking for glusterfs-api >= 7.9', -+ uselib_store="GFAPI_VER_7_9") - else: - conf.SET_TARGET_TYPE('gfapi', 'EMPTY') - conf.undefine('HAVE_GLUSTERFS') --- -2.28.0 - - -From 0d6268ff0a055e8fb418da761eeb820a8e11e2ad Mon Sep 17 00:00:00 2001 +From 48c31546ad4c2a072497e3ce9eff37ef37bc81c8 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:09:05 +0200 -Subject: [PATCH 089/105] Add smb2cli_session_get_encryption_cipher() +Subject: [PATCH 088/104] Add smb2cli_session_get_encryption_cipher() When 'session->smb2->should_encrypt' is true, the client MUST encrypt all transport messages (see also MS-SMB2 3.2.4.1.8). @@ -11231,13 +11138,13 @@ index 2afc7165cd9..db5f5d58799 100644 struct smbXcli_tcon *smbXcli_tcon_create(TALLOC_CTX *mem_ctx); struct smbXcli_tcon *smbXcli_tcon_copy(TALLOC_CTX *mem_ctx, -- -2.28.0 +2.29.2 -From 3f77e6cb6220d50b75ceb197e26813e9e5244cc0 Mon Sep 17 00:00:00 2001 +From 25a7d3534f7e3798cdf2432de62ed62f9e11547b Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:18:21 +0200 -Subject: [PATCH 090/105] Add dcerpc_transport_encrypted() +Subject: [PATCH 089/104] Add dcerpc_transport_encrypted() Signed-off-by: Isaac Boukris Reviewed-by: Stefan Metzmacher @@ -11323,13 +11230,13 @@ index bd79a072bc8..6ea27a8d9a3 100644 create a secondary context from a primary connection -- -2.28.0 +2.29.2 -From 4045c677a3ea3c44e5509025c1c7d03936ba9d82 Mon Sep 17 00:00:00 2001 +From a0b8ea04d7030d2cb97d6ccea9d28072d6e3dbda Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:35:01 +0200 -Subject: [PATCH 091/105] Add py binding for dcerpc_transport_encrypted +Subject: [PATCH 090/104] Add py binding for dcerpc_transport_encrypted Signed-off-by: Isaac Boukris Reviewed-by: Stefan Metzmacher @@ -11370,13 +11277,13 @@ index be914ed5f14..309a6d72e26 100644 }; -- -2.28.0 +2.29.2 -From 07a87eaff7e2e18c2d462f4caff95cace92a0130 Mon Sep 17 00:00:00 2001 +From ff38da1d43f7ec3312a90fb8c53f977c9466e199 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:44:08 +0200 -Subject: [PATCH 092/105] selftest: add a test for py dce transport_encrypted +Subject: [PATCH 091/104] selftest: add a test for py dce transport_encrypted Signed-off-by: Isaac Boukris Reviewed-by: Stefan Metzmacher @@ -11435,13 +11342,13 @@ index 8e0d6a5ef0a..24e4ac77d89 100644 objectAttr = lsa.ObjectAttribute() objectAttr.sec_qos = lsa.QosInfo() -- -2.28.0 +2.29.2 -From 1c74d87e4dfe78d6e884c9bb4e57ec383d632a88 Mon Sep 17 00:00:00 2001 +From 5ffb0a0d9093bba2c4630d89512f623a35122f8e Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:47:12 +0200 -Subject: [PATCH 093/105] Add CreateTrustedDomainRelax wrapper for fips mode +Subject: [PATCH 092/104] Add CreateTrustedDomainRelax wrapper for fips mode Signed-off-by: Isaac Boukris Reviewed-by: Stefan Metzmacher @@ -11521,13 +11428,13 @@ index 00000000000..b4df0fa5bb8 + + return lsaconn.CreateTrustedDomainEx2(policy, trust_info, auth_info, mask) -- -2.28.0 +2.29.2 -From 067c8d73800b928b02bcb1095c13083d9e0e368d Mon Sep 17 00:00:00 2001 +From d980bb1444e318825457ead9bdbce1c9353ccc66 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:49:17 +0200 -Subject: [PATCH 094/105] Use the new CreateTrustedDomainRelax() +Subject: [PATCH 093/104] Use the new CreateTrustedDomainRelax() Signed-off-by: Isaac Boukris Reviewed-by: Stefan Metzmacher @@ -11628,13 +11535,13 @@ index 1d12c362911..93a3258d28d 100644 if enc_types: self.outf.write("Setting supported encryption types on local TDO.\n") -- -2.28.0 +2.29.2 -From 72dfcc923d0cf8054cb0f011e8405fa96b9ec6e0 Mon Sep 17 00:00:00 2001 +From e06d01fe3370501ab45d01c5511aa0b5de9d854e Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Tue, 1 Sep 2020 20:14:29 +0300 -Subject: [PATCH 095/105] selftest: add a test for the CreateTrustedDomainRelax +Subject: [PATCH 094/104] selftest: add a test for the CreateTrustedDomainRelax wrapper Originally copied from 'source4/scripting/devel/createtrust' @@ -11813,13 +11720,13 @@ index 3a903a7eee0..96f51b68cfc 100755 # Right now ad_dc has mdb and ad_dc_ntvfs has tdb mdb_testenv = "ad_dc" -- -2.28.0 +2.29.2 -From 341cc046bf816ad5818932c6c5d170a2a9a38783 Mon Sep 17 00:00:00 2001 +From 93b792d5d0dcf96833e32958aeb3877f74125f07 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 5 Nov 2020 15:38:19 +0200 -Subject: [PATCH 096/105] Remove source4/scripting/devel/createtrust script +Subject: [PATCH 095/104] Remove source4/scripting/devel/createtrust script We now have the 'samba-tool domain trust' command. @@ -11968,13 +11875,13 @@ index 26b0d0dcb68..00000000000 - auth_info, - security.SEC_STD_DELETE) -- -2.28.0 +2.29.2 -From f51b23a9b8ad22d4cd4d7dea3ed8f0150974a209 Mon Sep 17 00:00:00 2001 +From 4577786be36993e958b745e4953f582e3de301a1 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 6 Nov 2020 14:30:26 +0100 -Subject: [PATCH 097/105] s3:rpc_server: Use gnutls_cipher_decrypt() in +Subject: [PATCH 096/104] s3:rpc_server: Use gnutls_cipher_decrypt() in get_trustdom_auth_blob() It doesn't matter for RC4, but just to be correct. @@ -12000,13 +11907,13 @@ index 198387424e6..e749caf2551 100644 auth_blob->length); gnutls_cipher_deinit(cipher_hnd); -- -2.28.0 +2.29.2 -From 7b24fdcb4a797b1daa97750f8a2c4f2c603115f3 Mon Sep 17 00:00:00 2001 +From ad9c90d18c2efdee16535ade97d4b151e4a64c5e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 6 Nov 2020 14:33:38 +0100 -Subject: [PATCH 098/105] s4:rpc_server: Use gnutls_cipher_decrypt() in +Subject: [PATCH 097/104] s4:rpc_server: Use gnutls_cipher_decrypt() in get_trustdom_auth_blob() It doesn't matter for RC4, but just to be correct. @@ -12032,13 +11939,13 @@ index 8333cb149b6..4bb8aaa9592 100644 auth_blob->length); gnutls_cipher_deinit(cipher_hnd); -- -2.28.0 +2.29.2 -From acbb59f45cb2b4c35df678ba774425180e9cf8c6 Mon Sep 17 00:00:00 2001 +From 6c73bf8553c48e28abd09ff225cbfb8278528d0d Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 20 Aug 2020 13:40:21 +0200 -Subject: [PATCH 099/105] s3:rpc_server: Allow to use RC4 for creating trusts +Subject: [PATCH 098/104] s3:rpc_server: Allow to use RC4 for creating trusts Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy @@ -12099,13 +12006,13 @@ index e749caf2551..d6d606ddeca 100644 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); goto out; -- -2.28.0 +2.29.2 -From a4d0e69eb7a429a13e456cff7f96870e87791694 Mon Sep 17 00:00:00 2001 +From 20f0e078f2dd5681513253788216313851df428d Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 20 Aug 2020 13:51:39 +0200 -Subject: [PATCH 100/105] s4:rpc_server: Allow to use RC4 for creating trusts +Subject: [PATCH 099/104] s4:rpc_server: Allow to use RC4 for creating trusts Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy @@ -12171,13 +12078,13 @@ index 4bb8aaa9592..5b3ef71d458 100644 nt_status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); goto out; -- -2.28.0 +2.29.2 -From f327133ced90a52d1ff9e104b1722876b21b7a78 Mon Sep 17 00:00:00 2001 +From 8c7a60700f7c7925749ccfd0f3ccb17ca47df7da Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 6 Nov 2020 10:13:48 +0100 -Subject: [PATCH 101/105] sefltest: Enable the dcerpc.createtrustrelax test +Subject: [PATCH 100/104] sefltest: Enable the dcerpc.createtrustrelax test against ad_dc_fips Signed-off-by: Andreas Schneider @@ -12201,53 +12108,13 @@ index 80effda8343..00000000000 @@ -1 +0,0 @@ -^samba.tests.dcerpc.createtrustrelax.samba.tests.dcerpc.createtrustrelax.CreateTrustedDomainRelaxTest.test_create_trust_relax_encrypt\(ad_dc_fips\) -- -2.28.0 +2.29.2 -From 721f97817de2d1e14d99459f9e6af9fccf11b621 Mon Sep 17 00:00:00 2001 -From: Jeremy Allison -Date: Thu, 5 Nov 2020 15:48:08 -0800 -Subject: [PATCH 102/105] s3: spoolss: Make parameters in call to - user_ok_token() match all other uses. - -We already have p->session_info->unix_info->unix_name, we don't -need to go through a legacy call to uidtoname(p->session_info->unix_token->uid). - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14568 - -Signed-off-by: Jeremy Allison -Reviewed-by: Andrew Bartlett - -Autobuild-User(master): Andrew Bartlett -Autobuild-Date(master): Mon Nov 9 04:10:45 UTC 2020 on sn-devel-184 - -(cherry picked from commit e5e1759057a767f517bf480a2172a36623df2799) ---- - source3/rpc_server/spoolss/srv_spoolss_nt.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/source3/rpc_server/spoolss/srv_spoolss_nt.c b/source3/rpc_server/spoolss/srv_spoolss_nt.c -index e98401a4365..906fab2adb5 100644 ---- a/source3/rpc_server/spoolss/srv_spoolss_nt.c -+++ b/source3/rpc_server/spoolss/srv_spoolss_nt.c -@@ -1880,7 +1880,8 @@ WERROR _spoolss_OpenPrinterEx(struct pipes_struct *p, - return WERR_ACCESS_DENIED; - } - -- if (!user_ok_token(uidtoname(p->session_info->unix_token->uid), NULL, -+ if (!user_ok_token(p->session_info->unix_info->unix_name, -+ p->session_info->info->domain_name, - p->session_info->security_token, snum) || - !W_ERROR_IS_OK(print_access_check(p->session_info, - p->msg_ctx, --- -2.28.0 - - -From a078205ce3816c175cd16dc22875dc147a5da645 Mon Sep 17 00:00:00 2001 +From 9db0e9602ea96849a6f854415f4cd988576cccf2 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 11 Nov 2020 13:42:06 +0100 -Subject: [PATCH 103/105] s3:smbd: Fix possible null pointer dereference in +Subject: [PATCH 101/104] s3:smbd: Fix possible null pointer dereference in token_contains_name() BUG: https://bugzilla.samba.org/show_bug.cgi?id=14572 @@ -12277,13 +12144,13 @@ index 57754a0f766..694c0c290e8 100644 /* Check if username starts with domain name */ if (domain_len > 0) { -- -2.28.0 +2.29.2 -From 5654101584b7742e684d12e6aea43e5004142dcb Mon Sep 17 00:00:00 2001 +From b92cbd97865ea6ef49892df75c59f37e9917ddb3 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Tue, 10 Nov 2020 17:35:24 +0200 -Subject: [PATCH 104/105] lookup_name: allow lookup names prefixed with DNS +Subject: [PATCH 102/104] lookup_name: allow lookup names prefixed with DNS forest root for FreeIPA DC In FreeIPA deployment with active Global Catalog service, when a two-way @@ -12387,13 +12254,13 @@ index 82c47b3145b..864246da56e 100644 if ((flags & LOOKUP_NAME_BUILTIN) && -- -2.28.0 +2.29.2 -From efa59aa4b2455ea3bc4d0fd0358b160858626585 Mon Sep 17 00:00:00 2001 +From 5bf01d45325bcc6819f807620267e35841f826a3 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Wed, 11 Nov 2020 14:42:55 +0200 -Subject: [PATCH 105/105] auth_sam: use pdb_get_domain_info to look up DNS +Subject: [PATCH 103/104] auth_sam: use pdb_get_domain_info to look up DNS forest information When Samba is used as a part of FreeIPA domain controller, Windows @@ -12610,5 +12477,48 @@ index 3c12f959faf..e8e0d543f8c 100644 DBG_INFO("%s is not our domain name (DC for %s)\n", effective_domain, lp_workgroup()); -- -2.28.0 +2.29.2 + + +From edd405a3918b5d52e7eeff2f8425478a0a1867ed Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Fri, 27 Nov 2020 11:22:15 +0100 +Subject: [PATCH 104/104] docs-xml: Add a section about weak crypto in testparm + manpage + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14583 + +Signed-off-by: Andreas Schneider +Reviewed-by: Alexander Bokovoy + +Autobuild-User(master): Andreas Schneider +Autobuild-Date(master): Fri Nov 27 13:48:20 UTC 2020 on sn-devel-184 + +(cherry picked from commit 5c27740aeff273bcd5f027d36874e56170234146) +--- + docs-xml/manpages/testparm.1.xml | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/docs-xml/manpages/testparm.1.xml b/docs-xml/manpages/testparm.1.xml +index 9099cda010f..7c7abf50e8b 100644 +--- a/docs-xml/manpages/testparm.1.xml ++++ b/docs-xml/manpages/testparm.1.xml +@@ -171,6 +171,15 @@ + errors and warnings if the file did not load. If the file was + loaded OK, the program then dumps all known service details + to stdout. ++ ++ For certain use cases, SMB protocol requires use of ++ cryptographic algorithms which are known to be weak and already ++ broken. DES and ARCFOUR (RC4) ciphers and the SHA1 and MD5 hash ++ algorithms are considered weak but they are required for backward ++ compatibility. The testparm utility shows whether the Samba tools ++ will fall back to these weak crypto algorithms if it is not possible ++ to use strong cryptography by default. ++ In FIPS mode weak crypto cannot be enabled. + + + +-- +2.29.2 diff --git a/samba-smbclient-mget-bug-14517.patch b/samba-smbclient-mget-bug-14517.patch deleted file mode 100644 index 8f21623..0000000 --- a/samba-smbclient-mget-bug-14517.patch +++ /dev/null @@ -1,430 +0,0 @@ -From 52ddfacead1ba50da0fc706b54e90e7a0cadb8e9 Mon Sep 17 00:00:00 2001 -From: Volker Lendecke -Date: Mon, 28 Sep 2020 14:11:13 +0200 -Subject: [PATCH 1/4] smbclient: Remove the "abort_mget" variable - -This was never set to true anywhere in the code - -Bug: https://bugzilla.samba.org/show_bug.cgi?id=14517 -Signed-off-by: Volker Lendecke -Reviewed-by: Jeremy Allison -(cherry picked from commit 8fa451d2b052223a11b24ffc2a956b80d03aaa7c) ---- - source3/client/client.c | 9 --------- - 1 file changed, 9 deletions(-) - -diff --git a/source3/client/client.c b/source3/client/client.c -index f65293849d0..5bed37fc2a2 100644 ---- a/source3/client/client.c -+++ b/source3/client/client.c -@@ -87,8 +87,6 @@ static char dest_ss_str[INET6_ADDRSTRLEN]; - - #define SEPARATORS " \t\n\r" - --static bool abort_mget = true; -- - /* timing globals */ - uint64_t get_total_size = 0; - unsigned int get_total_time_ms = 0; -@@ -1217,11 +1215,6 @@ static NTSTATUS do_mget(struct cli_state *cli_state, struct file_info *finfo, - if (strequal(finfo->name,".") || strequal(finfo->name,"..")) - return NT_STATUS_OK; - -- if (abort_mget) { -- d_printf("mget aborted\n"); -- return NT_STATUS_UNSUCCESSFUL; -- } -- - if (finfo->attr & FILE_ATTRIBUTE_DIRECTORY) { - if (asprintf(&quest, - "Get directory %s? ",finfo->name) < 0) { -@@ -1419,8 +1412,6 @@ static int cmd_mget(void) - attribute |= FILE_ATTRIBUTE_DIRECTORY; - } - -- abort_mget = false; -- - while (next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { - - mget_mask = talloc_strdup(ctx, client_get_cur_dir()); --- -2.20.1 - - -From 159a03a9067f7aeddb29080dc34e37b567a02479 Mon Sep 17 00:00:00 2001 -From: Volker Lendecke -Date: Mon, 28 Sep 2020 14:21:24 +0200 -Subject: [PATCH 2/4] smbclient: Slightly simplify do_mget() - -Put the prompt query into a separate if-statement, move the "quest" -variable closer to its use - -Bug: https://bugzilla.samba.org/show_bug.cgi?id=14517 -Signed-off-by: Volker Lendecke -Reviewed-by: Jeremy Allison -(cherry picked from commit 71bc4d4b8d94458ac2e40d659f06110d434fd5c9) ---- - source3/client/client.c | 28 ++++++++++++++-------------- - 1 file changed, 14 insertions(+), 14 deletions(-) - -diff --git a/source3/client/client.c b/source3/client/client.c -index 5bed37fc2a2..5901419f427 100644 ---- a/source3/client/client.c -+++ b/source3/client/client.c -@@ -1203,7 +1203,6 @@ static NTSTATUS do_mget(struct cli_state *cli_state, struct file_info *finfo, - TALLOC_CTX *ctx = talloc_tos(); - NTSTATUS status = NT_STATUS_OK; - char *rname = NULL; -- char *quest = NULL; - char *saved_curdir = NULL; - char *mget_mask = NULL; - char *new_cd = NULL; -@@ -1215,23 +1214,24 @@ static NTSTATUS do_mget(struct cli_state *cli_state, struct file_info *finfo, - if (strequal(finfo->name,".") || strequal(finfo->name,"..")) - return NT_STATUS_OK; - -- if (finfo->attr & FILE_ATTRIBUTE_DIRECTORY) { -- if (asprintf(&quest, -- "Get directory %s? ",finfo->name) < 0) { -- return NT_STATUS_NO_MEMORY; -- } -- } else { -- if (asprintf(&quest, -- "Get file %s? ",finfo->name) < 0) { -+ if (prompt) { -+ const char *object = (finfo->attr & FILE_ATTRIBUTE_DIRECTORY) ? -+ "directory" : "file"; -+ char *quest = NULL; -+ bool ok; -+ -+ quest = talloc_asprintf( -+ ctx, "Get %s %s? ", object, finfo->name); -+ if (quest == NULL) { - return NT_STATUS_NO_MEMORY; - } -- } - -- if (prompt && !yesno(quest)) { -- SAFE_FREE(quest); -- return NT_STATUS_OK; -+ ok = yesno(quest); -+ TALLOC_FREE(quest); -+ if (!ok) { -+ return NT_STATUS_OK; -+ } - } -- SAFE_FREE(quest); - - if (!(finfo->attr & FILE_ATTRIBUTE_DIRECTORY)) { - rname = talloc_asprintf(ctx, --- -2.20.1 - - -From 523ccc98d2c6a9ddc0714084b5e19cee2a80bf27 Mon Sep 17 00:00:00 2001 -From: Volker Lendecke -Date: Mon, 28 Sep 2020 16:29:27 +0200 -Subject: [PATCH 3/4] test3: Add a test showing that smbclient recursive mget - is broken - -Bug: https://bugzilla.samba.org/show_bug.cgi?id=14517 -Signed-off-by: Volker Lendecke -Reviewed-by: Jeremy Allison -(cherry picked from commit 254a5b034e5a081c9d3f28717a4b54d2af0180fc) ---- - selftest/knownfail.d/smbclient_mget | 1 + - source3/script/tests/test_smbclient_mget.sh | 39 +++++++++++++++++++++ - source3/selftest/tests.py | 10 ++++++ - 3 files changed, 50 insertions(+) - create mode 100644 selftest/knownfail.d/smbclient_mget - create mode 100755 source3/script/tests/test_smbclient_mget.sh - -diff --git a/selftest/knownfail.d/smbclient_mget b/selftest/knownfail.d/smbclient_mget -new file mode 100644 -index 00000000000..64407a8c5d4 ---- /dev/null -+++ b/selftest/knownfail.d/smbclient_mget -@@ -0,0 +1 @@ -+^samba3.blackbox.smbclient-mget.smbclient\ mget\(fileserver\) -\ No newline at end of file -diff --git a/source3/script/tests/test_smbclient_mget.sh b/source3/script/tests/test_smbclient_mget.sh -new file mode 100755 -index 00000000000..45f62f15d4d ---- /dev/null -+++ b/source3/script/tests/test_smbclient_mget.sh -@@ -0,0 +1,39 @@ -+#!/bin/sh -+ -+if [ $# -lt 6 ]; then -+cat < -Date: Mon, 28 Sep 2020 15:03:41 +0200 -Subject: [PATCH 4/4] smbclient: Fix recursive mget - -Make do_mget rely on do_list() already doing the recursion in a -breadth-first manner. The previous code called do_list() from within -its callback. Unfortunately the recent simplifications of do_list() -broke this, leading to recursive mget to segfault. Instead of figuring -out how this worked before the simplifications in do_list() (I did -spend a few hours on this) and fixing it, I chose to restructure -do_mget() to not recursively call do_list() anymore but instead rely -on do_list() to do the recursion. Saves quite a few lines of code and -complexity. - -Bug: https://bugzilla.samba.org/show_bug.cgi?id=14517 -Signed-off-by: Volker Lendecke -Reviewed-by: Jeremy Allison - -Autobuild-User(master): Jeremy Allison -Autobuild-Date(master): Wed Sep 30 17:23:45 UTC 2020 on sn-devel-184 - -(cherry picked from commit 9f24b5098f796f364a3f403ad4e9ae28b3c0935a) ---- - selftest/knownfail.d/smbclient_mget | 1 - - source3/client/client.c | 121 ++++++++-------------------- - 2 files changed, 33 insertions(+), 89 deletions(-) - delete mode 100644 selftest/knownfail.d/smbclient_mget - -diff --git a/selftest/knownfail.d/smbclient_mget b/selftest/knownfail.d/smbclient_mget -deleted file mode 100644 -index 64407a8c5d4..00000000000 ---- a/selftest/knownfail.d/smbclient_mget -+++ /dev/null -@@ -1 +0,0 @@ --^samba3.blackbox.smbclient-mget.smbclient\ mget\(fileserver\) -\ No newline at end of file -diff --git a/source3/client/client.c b/source3/client/client.c -index 5901419f427..8c7ceb644aa 100644 ---- a/source3/client/client.c -+++ b/source3/client/client.c -@@ -1201,11 +1201,10 @@ static NTSTATUS do_mget(struct cli_state *cli_state, struct file_info *finfo, - const char *dir) - { - TALLOC_CTX *ctx = talloc_tos(); -- NTSTATUS status = NT_STATUS_OK; -- char *rname = NULL; -- char *saved_curdir = NULL; -- char *mget_mask = NULL; -- char *new_cd = NULL; -+ const char *client_cwd = NULL; -+ size_t client_cwd_len; -+ char *path = NULL; -+ char *local_path = NULL; - - if (!finfo->name) { - return NT_STATUS_OK; -@@ -1214,6 +1213,10 @@ static NTSTATUS do_mget(struct cli_state *cli_state, struct file_info *finfo, - if (strequal(finfo->name,".") || strequal(finfo->name,"..")) - return NT_STATUS_OK; - -+ if ((finfo->attr & FILE_ATTRIBUTE_DIRECTORY) && !recurse) { -+ return NT_STATUS_OK; -+ } -+ - if (prompt) { - const char *object = (finfo->attr & FILE_ATTRIBUTE_DIRECTORY) ? - "directory" : "file"; -@@ -1233,98 +1236,40 @@ static NTSTATUS do_mget(struct cli_state *cli_state, struct file_info *finfo, - } - } - -- if (!(finfo->attr & FILE_ATTRIBUTE_DIRECTORY)) { -- rname = talloc_asprintf(ctx, -- "%s%s", -- client_get_cur_dir(), -- finfo->name); -- if (!rname) { -- return NT_STATUS_NO_MEMORY; -- } -- rname = client_clean_name(ctx, rname); -- if (rname == NULL) { -- return NT_STATUS_NO_MEMORY; -- } -- do_get(rname, finfo->name, false); -- TALLOC_FREE(rname); -- return NT_STATUS_OK; -- } -- -- /* handle directories */ -- saved_curdir = talloc_strdup(ctx, client_get_cur_dir()); -- if (!saved_curdir) { -+ path = talloc_asprintf( -+ ctx, "%s%c%s", dir, CLI_DIRSEP_CHAR, finfo->name); -+ if (path == NULL) { - return NT_STATUS_NO_MEMORY; - } -- -- new_cd = talloc_asprintf(ctx, -- "%s%s%s", -- client_get_cur_dir(), -- finfo->name, -- CLI_DIRSEP_STR); -- if (!new_cd) { -- return NT_STATUS_NO_MEMORY; -- } -- new_cd = client_clean_name(ctx, new_cd); -- if (new_cd == NULL) { -+ path = client_clean_name(ctx, path); -+ if (path == NULL) { - return NT_STATUS_NO_MEMORY; - } -- client_set_cur_dir(new_cd); -- -- string_replace(finfo->name,'\\','/'); -- if (lowercase) { -- if (!strlower_m(finfo->name)) { -- return NT_STATUS_INVALID_PARAMETER; -- } -- } -- -- if (!directory_exist(finfo->name) && -- mkdir(finfo->name,0777) != 0) { -- d_printf("failed to create directory %s\n",finfo->name); -- client_set_cur_dir(saved_curdir); -- return map_nt_error_from_unix(errno); -- } -- -- if (chdir(finfo->name) != 0) { -- d_printf("failed to chdir to directory %s\n",finfo->name); -- client_set_cur_dir(saved_curdir); -- return map_nt_error_from_unix(errno); -- } - -- mget_mask = talloc_asprintf(ctx, -- "%s*", -- client_get_cur_dir()); -+ /* -+ * Skip the path prefix if we've done a remote "cd" when -+ * creating the local path -+ */ -+ client_cwd = client_get_cur_dir(); -+ client_cwd_len = strlen(client_cwd); - -- if (!mget_mask) { -+ local_path = talloc_strdup(ctx, path + client_cwd_len); -+ if (local_path == NULL) { -+ TALLOC_FREE(path); - return NT_STATUS_NO_MEMORY; - } -+ string_replace(local_path, CLI_DIRSEP_CHAR, '/'); - -- mget_mask = client_clean_name(ctx, mget_mask); -- if (mget_mask == NULL) { -- return NT_STATUS_NO_MEMORY; -- } -- status = do_list(mget_mask, -- (FILE_ATTRIBUTE_SYSTEM -- | FILE_ATTRIBUTE_HIDDEN -- | FILE_ATTRIBUTE_DIRECTORY), -- do_mget, false, true); -- if (!NT_STATUS_IS_OK(status) -- && !NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) { -- /* -- * Ignore access denied errors to ensure all permitted files are -- * pulled down. -- */ -- return status; -- } -+ if (finfo->attr & FILE_ATTRIBUTE_DIRECTORY) { -+ int ret = mkdir(local_path, 0777); - -- if (chdir("..") == -1) { -- d_printf("do_mget: failed to chdir to .. (error %s)\n", -- strerror(errno) ); -- return map_nt_error_from_unix(errno); -+ if ((ret == -1) && (errno != EEXIST)) { -+ return map_nt_error_from_unix(errno); -+ } -+ } else { -+ do_get(path, local_path, false); - } -- client_set_cur_dir(saved_curdir); -- TALLOC_FREE(mget_mask); -- TALLOC_FREE(saved_curdir); -- TALLOC_FREE(new_cd); -+ - return NT_STATUS_OK; - } - -@@ -1431,7 +1376,7 @@ static int cmd_mget(void) - if (mget_mask == NULL) { - return 1; - } -- status = do_list(mget_mask, attribute, do_mget, false, true); -+ status = do_list(mget_mask, attribute, do_mget, recurse, true); - if (!NT_STATUS_IS_OK(status)) { - return 1; - } -@@ -1453,7 +1398,7 @@ static int cmd_mget(void) - if (mget_mask == NULL) { - return 1; - } -- status = do_list(mget_mask, attribute, do_mget, false, true); -+ status = do_list(mget_mask, attribute, do_mget, recurse, true); - if (!NT_STATUS_IS_OK(status)) { - return 1; - } --- -2.20.1 - diff --git a/samba.spec b/samba.spec index a885bc3..69e8554 100644 --- a/samba.spec +++ b/samba.spec @@ -108,9 +108,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global main_release 2 +%global main_release 0 -%global samba_version 4.13.2 +%global samba_version 4.13.3 %global talloc_version 2.3.1 %global tdb_version 1.4.3 %global tevent_version 0.10.2 @@ -182,7 +182,6 @@ Patch1: samba-s4u.patch # # Generate the patchset using: git format-patch -l1 --stdout -N > samba-4.13-redhat.patch Patch2: samba-4.13-redhat.patch -Patch3: samba-smbclient-mget-bug-14517.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -3799,6 +3798,9 @@ fi %endif %changelog +* Tue Dec 15 2020 Guenther Deschner - 4.13.3-0 +- Update to Samba 4.13.3 + * Wed Nov 25 2020 Alexander Bokovoy - 4.13.2-2 - rhbz#1892745, rhbz#1900232: smbclient mget crashes (upstream bug 14517) - Merge RHEL 8.4 patches: diff --git a/sources b/sources index b1e4a0b..0e51188 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.13.2.tar.xz) = c5d1c4b74b458ab6da9314540043edb8129a17870a9a335fb26bbdaf194aeae647aa3d6cdc00fd4487fd459c123cc8feecb58d02633515c62f00287b652a502b -SHA512 (samba-4.13.2.tar.asc) = 07cce2f4f5130c56548ea14193b3d829dac7926141da56f7e1624fd48f73afcd875af6eaae0ce56396d5b23837b3bc7e3518f569d581afd6c5ee1dc7d49a8eb7 +SHA512 (samba-4.13.3.tar.xz) = 8dbd8a18ff8566f778b17c9a5306a0d3f45a79fc8d1ce7c2ea63f941eb1b310462f97f2bdd40c4e09c69e2aae3f5144e488cb20e1b6686695306b521d609b6dc +SHA512 (samba-4.13.3.tar.asc) = f5ef09ae3fa434b7c37564407ad3b62542d9abc7ca0e2a1e58ebb987307a5269c123b1af3755582edff7fdcfe2930a151d6256b97ab8dcd296492038a96a160a From 8fff4f7c11021b12346bd8fd607b0152864c2e52 Mon Sep 17 00:00:00 2001 From: Tom Stellard Date: Fri, 8 Jan 2021 21:05:04 +0000 Subject: [PATCH 072/425] Add BuildRequires: make https://fedoraproject.org/wiki/Changes/Remove_make_from_BuildRoot --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index 69e8554..54a55b0 100644 --- a/samba.spec +++ b/samba.spec @@ -218,6 +218,7 @@ Obsoletes: samba-swat < %{samba_depver} Provides: samba4-swat = %{samba_depver} Obsoletes: samba4-swat < %{samba_depver} +BuildRequires: make BuildRequires: gcc BuildRequires: avahi-devel BuildRequires: bison From 254400b4594ba0e5971f3fe90fa5bb1f89f94dc1 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Wed, 13 Jan 2021 20:51:46 +0200 Subject: [PATCH 073/425] Rebuild against krb5 1.19 Resolves: rhbz#1915928 --- samba.spec | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index 54a55b0..4e13a4d 100644 --- a/samba.spec +++ b/samba.spec @@ -108,7 +108,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global main_release 0 +%global main_release 1 %global samba_version 4.13.3 %global talloc_version 2.3.1 @@ -139,7 +139,7 @@ %global libwbc_alternatives_suffix -64 %endif -%global required_mit_krb5 1.18 +%global required_mit_krb5 1.19 %global _systemd_extra "Environment=KRB5CCNAME=FILE:/run/samba/krb5cc_samba" @@ -3799,6 +3799,10 @@ fi %endif %changelog +* Wed Dec 16 2020 Guenther Deschner - 4.13.3-1 +- Rebuild against krb5-1.19 +- Resolves: rhbz#1915928 + * Tue Dec 15 2020 Guenther Deschner - 4.13.3-0 - Update to Samba 4.13.3 From 12217d454ee0d4fd0dd3ac28741bf66f69b0f5bb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 26 Jan 2021 15:04:19 +0100 Subject: [PATCH 074/425] Update to Samba 4.13.4 Guenther --- .gitignore | 2 + ...FBC0B86D954B0843324CDC6F33915B6568B7EA.gpg | Bin 1275 -> 0 bytes samba-4.13-redhat.patch | 240 +++++++++--------- samba-pubkey_AA99442FB680B620.gpg | Bin 0 -> 2290 bytes samba.spec | 10 +- sources | 4 +- 6 files changed, 130 insertions(+), 126 deletions(-) delete mode 100644 gpgkey-52FBC0B86D954B0843324CDC6F33915B6568B7EA.gpg create mode 100644 samba-pubkey_AA99442FB680B620.gpg diff --git a/.gitignore b/.gitignore index 9170f96..669acc7 100644 --- a/.gitignore +++ b/.gitignore @@ -229,3 +229,5 @@ samba-3.6.0pre1.tar.gz /samba-4.13.2.tar.asc /samba-4.13.3.tar.xz /samba-4.13.3.tar.asc +/samba-4.13.4.tar.xz +/samba-4.13.4.tar.asc diff --git a/gpgkey-52FBC0B86D954B0843324CDC6F33915B6568B7EA.gpg b/gpgkey-52FBC0B86D954B0843324CDC6F33915B6568B7EA.gpg deleted file mode 100644 index a61ebc450995a418da1144e95cbfb66bc1edcd0b..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 1275 zcmVW;H$ADVghZ2A8yO#p&`LaP9v$kcn*MvBhO zXtSVV1{<`oJX4V01OSk=yI-^RYHqjk7NgeC^OBK0^w(V+Z_~KS`{p0C@r-)1Ma9}( zRF97Mv;p*<%jsnY7sT_J!3G?3t&Vb{WF5~4HvnRke5Fu#)6QRfN=4sjobF^ZE8@OC zLV!i5a>0E`ErggqW)RdDn6==$g-dDuO(N0Fb|f*l256-u#y|uBqO+N-dX?&qw9dlbo*hlQ0(DCgAaI6|J zY8UK)DNW$72QJpZ%TuxTMrZmO^~lj0J=rMvZd(i9mZM~9og?)2qIv$>daZTBEQkgF zH76JnS0v-VZ z7k~u9mb&d^hg2gzhs(tRS{#34s2%P|* zf4YbL#idQe@gIs;4J;N^Jsq0TxdIIYMaDT{5C{OsIbIW`QM$A>)a`)vRx)?@7jB|x zmQD|Nbc2I~R@of8@KLTv)qeA`HYS1=c|oq0#Mvip9I#q;kI?gsT_Y@|Ri~&F6J|;A zbP7yt!~~L!DLj;m!PLXw?K0*YczM_K@v9bfAXDcn?&RjA;P29FbNQ6g9`Oy*jrx&d zB$wA~mV&3D`(kWBE_5!xYo9+rGBT=UOm@Gu%A6@Np`misd=8}e$+U})6{Lvd>!&u$ zp0ar7;UF)rPeW(VTf!%4S}`4Y=_Zl|T#V#~m%^-Js~@a*qj z{^c!?PL*}(;rT-}8ItmUJ$WQWbTuMcFOvIttf-zGEO?)!8E>0i^b3G_7HRL57ZDS? zrE-SdkV-&6_;`B{q7v}k(+Uk?x`eb};ADKi>`E+Huc>Bu%jkM#yS)^ z1DnZ&#fVP?7!d*h4+0wu1p-#6p34OZ62q9^0162ZZ!?iwWoWnRP&)vipS-vOdP4v< l{ Date: Mon, 13 Jul 2020 16:15:03 +0200 Subject: [PATCH 001/104] libcli:smb2: Do not leak ptext on error @@ -10,10 +10,10 @@ Reviewed-by: Stefan Metzmacher 1 file changed, 1 insertion(+) diff --git a/libcli/smb/smb2_signing.c b/libcli/smb/smb2_signing.c -index cc03607d789..4d430f56df5 100644 +index 230475480c2..cfb3b613f9d 100644 --- a/libcli/smb/smb2_signing.c +++ b/libcli/smb/smb2_signing.c -@@ -520,6 +520,7 @@ NTSTATUS smb2_signing_encrypt_pdu(struct smb2_signing_key *encryption_key, +@@ -515,6 +515,7 @@ NTSTATUS smb2_signing_encrypt_pdu(struct smb2_signing_key *encryption_key, ctext = talloc_size(talloc_tos(), ctext_size); if (ctext == NULL) { @@ -25,7 +25,7 @@ index cc03607d789..4d430f56df5 100644 2.29.2 -From 1310c58c3b8b9c7fcb0c811a9ef24b3bbe8c16f1 Mon Sep 17 00:00:00 2001 +From 630c6314778894a668c20fe2aa7d04627ed517a7 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 13 Jul 2020 17:23:37 +0200 Subject: [PATCH 002/104] libcli:smb2: Use talloc NULL context if we don't have @@ -44,10 +44,10 @@ Reviewed-by: Stefan Metzmacher 1 file changed, 26 insertions(+), 4 deletions(-) diff --git a/libcli/smb/smb2_signing.c b/libcli/smb/smb2_signing.c -index 4d430f56df5..6ece5f2e4d3 100644 +index cfb3b613f9d..b1e0253948f 100644 --- a/libcli/smb/smb2_signing.c +++ b/libcli/smb/smb2_signing.c -@@ -511,14 +511,25 @@ NTSTATUS smb2_signing_encrypt_pdu(struct smb2_signing_key *encryption_key, +@@ -506,14 +506,25 @@ NTSTATUS smb2_signing_encrypt_pdu(struct smb2_signing_key *encryption_key, uint8_t *ctext = NULL; size_t len = 0; int i; @@ -75,7 +75,7 @@ index 4d430f56df5..6ece5f2e4d3 100644 if (ctext == NULL) { TALLOC_FREE(ptext); status = NT_STATUS_NO_MEMORY; -@@ -710,16 +721,27 @@ NTSTATUS smb2_signing_decrypt_pdu(struct smb2_signing_key *decryption_key, +@@ -705,16 +716,27 @@ NTSTATUS smb2_signing_decrypt_pdu(struct smb2_signing_key *decryption_key, uint8_t *ptext = NULL; size_t len = 0; int i; @@ -109,7 +109,7 @@ index 4d430f56df5..6ece5f2e4d3 100644 2.29.2 -From ff15d93d1009a23428b9c11090836624255924cd Mon Sep 17 00:00:00 2001 +From 63cefdebe5c0e435b6174ff6bc72b48d12cec312 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Wed, 6 Nov 2019 17:37:45 +0100 Subject: [PATCH 003/104] auth:creds: Introduce CRED_SMB_CONF @@ -205,7 +205,7 @@ index d2a81506de3..6454ac9ff7c 100644 2.29.2 -From cc5e70efc8b9f45054d7e57002f59ac38c4c687f Mon Sep 17 00:00:00 2001 +From 0120aad504663c5e75054c2e322f1277acae63dd Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 10 Oct 2019 14:18:23 +0200 Subject: [PATCH 004/104] param: Add 'server smb encrypt' parameter @@ -740,12 +740,12 @@ index a3abaa2ec67..c0070b716a5 100644 .durable_handles = true, .check_parent_directory_delete_on_close = false, diff --git a/source3/smbd/service.c b/source3/smbd/service.c -index ed38121f292..a263c33b7e2 100644 +index 3802d16179b..9aa89e3eb02 100644 --- a/source3/smbd/service.c +++ b/source3/smbd/service.c -@@ -567,9 +567,9 @@ static NTSTATUS make_connection_snum(struct smbXsrv_connection *xconn, - conn->case_preserve = lp_preserve_case(snum); - conn->short_case_preserve = lp_short_preserve_case(snum); +@@ -558,9 +558,9 @@ static NTSTATUS make_connection_snum(struct smbXsrv_connection *xconn, + /* Case options for the share. */ + conn_setup_case_options(conn); - conn->encrypt_level = lp_smb_encrypt(snum); + conn->encrypt_level = lp_server_smb_encrypt(snum); @@ -824,7 +824,7 @@ index 7acde285a90..b745e0906b1 100644 2.29.2 -From d78374a9e26428a48b3c6a2aa1d4280751620fb9 Mon Sep 17 00:00:00 2001 +From a351d15240e7c8638883155404fe2f3d70029e7e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 10:04:19 +0200 Subject: [PATCH 005/104] param: Create and use enum_smb_encryption_vals @@ -899,7 +899,7 @@ index 47b85de1f87..e2f737279dc 100644 {MDNS_NAME_NETBIOS, "netbios"}, {MDNS_NAME_MDNS, "mdns"}, diff --git a/libcli/smb/smb_constants.h b/libcli/smb/smb_constants.h -index b424b13cde4..2fb1fd7189e 100644 +index d2345f094e1..8ee99e25566 100644 --- a/libcli/smb/smb_constants.h +++ b/libcli/smb/smb_constants.h @@ -106,6 +106,15 @@ enum smb_signing_setting { @@ -922,7 +922,7 @@ index b424b13cde4..2fb1fd7189e 100644 2.29.2 -From e2e0decfb117a8d6bb1428509f770315849e972b Mon Sep 17 00:00:00 2001 +From 021975ea03413244d02d35940973f67956adec2b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 26 May 2020 09:34:54 +0200 Subject: [PATCH 006/104] s3:smbd: Use 'enum smb_encryption_setting' values @@ -952,11 +952,11 @@ index c0070b716a5..4ad541301b3 100644 .durable_handles = true, .check_parent_directory_delete_on_close = false, diff --git a/source3/smbd/service.c b/source3/smbd/service.c -index a263c33b7e2..43803e721c2 100644 +index 9aa89e3eb02..d7d17d3dee1 100644 --- a/source3/smbd/service.c +++ b/source3/smbd/service.c -@@ -568,16 +568,16 @@ static NTSTATUS make_connection_snum(struct smbXsrv_connection *xconn, - conn->short_case_preserve = lp_short_preserve_case(snum); +@@ -559,16 +559,16 @@ static NTSTATUS make_connection_snum(struct smbXsrv_connection *xconn, + conn_setup_case_options(conn); conn->encrypt_level = lp_server_smb_encrypt(snum); - if (conn->encrypt_level > SMB_SIGNING_OFF) { @@ -1046,7 +1046,7 @@ index b745e0906b1..2f2fdcb7260 100644 2.29.2 -From a461b9e0348f2f082cc59b601271ca5b3283df09 Mon Sep 17 00:00:00 2001 +From 7153b9b229a2feea129f1bb1cd423dd4e79d5a05 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 9 Apr 2020 10:38:41 +0200 Subject: [PATCH 007/104] docs-xml: Add 'client smb encrypt' @@ -1224,7 +1224,7 @@ index 4ad541301b3..6418a42b6eb 100644 2.29.2 -From d55143fc3090b43390fdf14ff45d9c2971fc43d2 Mon Sep 17 00:00:00 2001 +From f151e19473330373801c4d85ef3d5ce0918ac17d Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 22 Jul 2020 17:48:25 +0200 Subject: [PATCH 008/104] lib:param: Add lpcfg_parse_enum_vals() @@ -1291,7 +1291,7 @@ index 323fcf84523..e66ce2324b4 100644 2.29.2 -From d01ae8111553a71b80988eeb737e8b80bc765b20 Mon Sep 17 00:00:00 2001 +From 6364c5bcde41ed5bdb478747511003796a601e74 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 9 Oct 2019 09:38:08 +0200 Subject: [PATCH 009/104] libcli:smb: Add smb_signing_setting_translate() @@ -1464,7 +1464,7 @@ index 6918e1306c3..20981754db4 100644 2.29.2 -From 4cef2825a3363a38fbfbff5f172053145f62f100 Mon Sep 17 00:00:00 2001 +From 8ceec22ead224c3581b18b0fc95cb7f7f9c061a8 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 26 May 2020 08:39:34 +0200 Subject: [PATCH 010/104] libcli:smb: Add smb_encryption_setting_translate() @@ -1558,7 +1558,7 @@ index da0e4db2bf3..ac2887ee5c4 100644 2.29.2 -From a0cb6b810b655298ce5b87d8e36d1089460feca7 Mon Sep 17 00:00:00 2001 +From dc53c158acdeffc6e53436359a56bcf7071b3d83 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 9 Oct 2019 09:47:59 +0200 Subject: [PATCH 011/104] s3:lib: Use smb_signing_setting_translate for cmdline @@ -1609,7 +1609,7 @@ index 90ee67c4cb7..bc1f1c3ed25 100644 } diff --git a/source3/wscript_build b/source3/wscript_build -index 5a07eddac44..6a08afe4a25 100644 +index d86a9fcadbf..c1051c62393 100644 --- a/source3/wscript_build +++ b/source3/wscript_build @@ -279,7 +279,7 @@ bld.SAMBA3_LIBRARY('popt_samba3_cmdline', @@ -1625,7 +1625,7 @@ index 5a07eddac44..6a08afe4a25 100644 2.29.2 -From ef521e6b44710fb3ed567d36fa56687b677fe58a Mon Sep 17 00:00:00 2001 +From c6f52fc629ca09e450b3bd0c1bdc56fdabeae141 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 23 Jul 2020 07:47:18 +0200 Subject: [PATCH 012/104] auth:creds: Remove unused credentials autoproto @@ -1705,7 +1705,7 @@ index 7711eac2afa..d9be3562adb 100644 2.29.2 -From 6fafcebb8bd6311a736d995af6641e68e43e03a1 Mon Sep 17 00:00:00 2001 +From 62bca83b540c9402d86f0668839150d2abf3adec Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 26 May 2020 09:32:44 +0200 Subject: [PATCH 013/104] auth:creds: Add @@ -1847,7 +1847,7 @@ index 68f1f25dce1..9cde0000b5f 100644 2.29.2 -From 64e2c99501677bfe52212c9ea99ec3512cf62f6e Mon Sep 17 00:00:00 2001 +From a14f3c5f3f39173650bd56ee034bd35ea111ee07 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 3 Jun 2020 11:56:01 +0200 Subject: [PATCH 014/104] auth:creds: Add python bindings for @@ -1973,7 +1973,7 @@ index 6454ac9ff7c..e5f8122fa21 100644 2.29.2 -From 1280505f1396925851db5a29f2465d9c31d45f88 Mon Sep 17 00:00:00 2001 +From 9fdc98da5c625acd11205b2bb28deb780ef905ec Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 16:31:35 +0200 Subject: [PATCH 015/104] auth:creds: Add @@ -2105,7 +2105,7 @@ index 9cde0000b5f..54e8271471f 100644 2.29.2 -From 32209d254bb7bd3bd6ad3af14f219cee306a19a3 Mon Sep 17 00:00:00 2001 +From d8e43a7c8058a6a395493360cf2faae24f64e2e2 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 3 Jun 2020 12:32:46 +0200 Subject: [PATCH 016/104] auth:creds: Add python bindings for @@ -2210,7 +2210,7 @@ index e5f8122fa21..8edf13ce6ff 100644 2.29.2 -From d0a1bf1a75426c1d334349a6a4f8e44c80c1915b Mon Sep 17 00:00:00 2001 +From 767d356f718965b4595b8322729556b63e66425d Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 16:10:52 +0200 Subject: [PATCH 017/104] auth:creds: Add @@ -2344,7 +2344,7 @@ index 54e8271471f..3b86b742448 100644 2.29.2 -From 36ab2aa54102aa9cce92ac8ebf250db4d460324e Mon Sep 17 00:00:00 2001 +From 88dd0d8871ae2a54bc089f1e761ded6940b270b0 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 3 Jun 2020 12:38:30 +0200 Subject: [PATCH 018/104] auth:creds: Add python bindings for @@ -2462,7 +2462,7 @@ index 8edf13ce6ff..e0a6248d37a 100644 2.29.2 -From f866d9e80964e16307a8376ed448d0ca3a987538 Mon Sep 17 00:00:00 2001 +From 41df2d5330c051066691576af9ccf505cb0573e3 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 4 Jun 2020 11:19:53 +0200 Subject: [PATCH 019/104] auth:creds: Add python bindings for @@ -2590,7 +2590,7 @@ index e0a6248d37a..6187bded0b6 100644 2.29.2 -From 3f55ee05f024eacdd43fbbfb941703f8555df7c7 Mon Sep 17 00:00:00 2001 +From cdb470d7c408baa07eabf83ec566baecc8e5138c Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 23 Jul 2020 08:14:23 +0200 Subject: [PATCH 020/104] auth:creds: Bump library version @@ -2620,7 +2620,7 @@ index 564a04fe8dd..1e3302e3e48 100644 2.29.2 -From 492030e0e6179bdc0311e8d03b89b1cb01de1a3e Mon Sep 17 00:00:00 2001 +From a11a02e0802dbb3300d9b3232b936b74b1f89a32 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 27 May 2020 11:10:30 +0200 Subject: [PATCH 021/104] s3:lib: Use cli_credential_(get|set)_smb_signing() @@ -2691,7 +2691,7 @@ index bc1f1c3ed25..6038ec11515 100644 2.29.2 -From 6164c45feff5daf0e751526d1f7bd599c61b2a0e Mon Sep 17 00:00:00 2001 +From 6e5fba172b910545f722d33aa3fb185f48492c18 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:45:34 +0200 Subject: [PATCH 022/104] s3:lib: Set smb encryption also via cli creds API @@ -2720,7 +2720,7 @@ index 6038ec11515..9c9e2f0ac0f 100644 2.29.2 -From ddb7926bba603afbc1a588d1b6da9f9a625881ac Mon Sep 17 00:00:00 2001 +From 01eb7d2f16a4f16931a0adffc395ec0b5946ef56 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 13 Aug 2020 10:40:23 +0200 Subject: [PATCH 023/104] python: Remove unused sign argument from @@ -2775,7 +2775,7 @@ index 1e2c2918ebe..ad60cda0690 100644 2.29.2 -From 8683eacfb9c053115a84be025bbd64471c55d1c8 Mon Sep 17 00:00:00 2001 +From 7ad70308d9f5b5d892e507a58eb946839be33374 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 3 Jun 2020 14:02:37 +0200 Subject: [PATCH 024/104] python: Set smb signing via the creds API @@ -2879,7 +2879,7 @@ index ad60cda0690..0f2f6520fc3 100644 2.29.2 -From 86212ac5fb8d5f0710f23dde362dc35d908e3047 Mon Sep 17 00:00:00 2001 +From 70b7a6d80c3699727f7bf36a4a9255bb90c67cec Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 17:22:12 +0200 Subject: [PATCH 025/104] s3:libsmb: Introduce CLI_FULL_CONNECTION_IPC @@ -3102,7 +3102,7 @@ index 6cea2ee306c..2241beb331f 100644 2.29.2 -From 834dae6a34aaef7dccfb84821ec3fa7013b07d15 Mon Sep 17 00:00:00 2001 +From 19ac5889da3b5bec1fddba0e08daed7cbe24f604 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 17:29:25 +0200 Subject: [PATCH 026/104] s3:pylibsmb: Add ipc=True support for @@ -3167,7 +3167,7 @@ index 3fcc3424a57..3579a040830 100644 2.29.2 -From 072dfd83ee6513658e0ec818fb548f70648d6a41 Mon Sep 17 00:00:00 2001 +From ff93a26bdd480edb3e488b207b1fb6529cd52a38 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 24 Jul 2020 09:47:11 +0200 Subject: [PATCH 027/104] python:tests: Mark libsmb connection as an IPC @@ -3196,7 +3196,7 @@ index ba7440df13b..2c028d381db 100644 2.29.2 -From ceb25f6cb4fd07cd736085030a02aefbcb012e34 Mon Sep 17 00:00:00 2001 +From b904f4bf9279264438e7b50ba90930562f4146fa Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 17 Aug 2020 12:52:39 +0200 Subject: [PATCH 028/104] python:tests: Set smb ipc signing via the creds API @@ -3234,7 +3234,7 @@ index 2c028d381db..d6f5de7440a 100644 2.29.2 -From d3fe919fa5b952d075353f0d5c5366cabd5ef976 Mon Sep 17 00:00:00 2001 +From 19c1b06e7ca4ae26f36207b7dd070b33a853ff29 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 17:59:19 +0200 Subject: [PATCH 029/104] s3:libsmb: Use 'enum smb_signing_setting' in @@ -3364,7 +3364,7 @@ index d214cdabca4..995187e21b4 100644 2.29.2 -From 0ec1b432bf807efe37fdedf346724e787742e3aa Mon Sep 17 00:00:00 2001 +From 8ecad37d1fcc8d6fe07560df1bab35f2f70595f7 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 18:11:31 +0200 Subject: [PATCH 030/104] s3:client: Turn off smb signing for message op @@ -3516,7 +3516,7 @@ index 3579a040830..f8a4d56cf53 100644 2.29.2 -From dd6a89dd02e675e1b836042e4a4dec31667ac58c Mon Sep 17 00:00:00 2001 +From 5325ea198e03bf4a51b101c74788df548eeedbac Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 28 May 2020 18:20:02 +0200 Subject: [PATCH 031/104] s3:libsmb: Remove signing_state from @@ -3615,7 +3615,7 @@ index f8a4d56cf53..c7a2d73afcb 100644 2.29.2 -From b31e224159fe25e8cf84e7d2ef8bc53934ddd209 Mon Sep 17 00:00:00 2001 +From 1517d0eb1036056851871e994849c647217ef36d Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 4 Jun 2020 14:59:14 +0200 Subject: [PATCH 032/104] s3:libsmb: Remove signing_state from @@ -3986,7 +3986,7 @@ index 954d6eba804..fea066ce468 100644 2.29.2 -From 49430d65ac0e11cdfec07c55b72f030c959f576f Mon Sep 17 00:00:00 2001 +From 07ccfed08ceadd0b7497e7259e855b1937522129 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Mon, 8 Jun 2020 08:04:24 +0200 Subject: [PATCH 033/104] s3:libsmb: Add encryption support to @@ -4203,7 +4203,7 @@ index b24743d789b..abfd18bfaf1 100644 2.29.2 -From cc6eca3fe233c16d879f9a76aae022320e7044d7 Mon Sep 17 00:00:00 2001 +From bf05adca0d32212d4eead676ef89d4a96d3949a0 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 11:26:00 +0200 Subject: [PATCH 034/104] python: Add a test for SMB encryption @@ -4277,7 +4277,7 @@ index e8f8e7fe94d..81d4e482644 100644 2.29.2 -From 3bb0f6be56244767f78e8d0e085f2f7555585225 Mon Sep 17 00:00:00 2001 +From 86954cbf471bf391f50866d5d983c57cf8a4f064 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:31:02 +0200 Subject: [PATCH 035/104] s3:net: Use cli_credentials_set_smb_encryption() @@ -4326,7 +4326,7 @@ index b139fb2d0da..5829d891075 100644 2.29.2 -From 16aaa2f7395d235f72582a5190c9bf5d90578b9d Mon Sep 17 00:00:00 2001 +From 1d065c5960ea2bce6bab5420476a0c21ba40d26e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:40:13 +0200 Subject: [PATCH 036/104] s3:libsmb: Use cli_credentials_set_smb_encryption() @@ -4685,7 +4685,7 @@ index ec4a516b2ee..61503d0a98b 100644 2.29.2 -From eaa0bdc5931b82f9adbb65070252208be26a9d28 Mon Sep 17 00:00:00 2001 +From a35be10e055edb18b961c30c106fbefd08cd8c42 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:43:33 +0200 Subject: [PATCH 037/104] s3:client: Remove unused smb encryption code @@ -4721,7 +4721,7 @@ index f56dc323b6e..16a8d44c069 100644 2.29.2 -From 63179da4a51fefc5d938339360d579f725875389 Mon Sep 17 00:00:00 2001 +From 59362e873109a541d5381fe9a302a9464b83b549 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:47:05 +0200 Subject: [PATCH 038/104] s3:utils: Remove obsolete force encryption from @@ -4758,7 +4758,7 @@ index 5983ebbd0a5..8fd9fcc5780 100644 2.29.2 -From f113666b62c0fbe960f9ac22aea63241b56ffc61 Mon Sep 17 00:00:00 2001 +From d642ed3f0e60699c5650eb80ba02f9552b8f7bd9 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:48:18 +0200 Subject: [PATCH 039/104] s3:utils: Remove obsolete force encryption from @@ -4792,7 +4792,7 @@ index 2ac4fde7daf..ef2657e4fa5 100644 2.29.2 -From 4f3770237e1a3d41c725560d9e5c14786b98d2f9 Mon Sep 17 00:00:00 2001 +From 4588a03309c7ce7404f54e010f4a93656bf9ff47 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:49:28 +0200 Subject: [PATCH 040/104] s3:utils: Remove obsolete force encryption from @@ -4830,7 +4830,7 @@ index fea066ce468..4ceac7b3ab0 100644 2.29.2 -From b897f3360dae5737d646dbce9f7571b1cfb070b0 Mon Sep 17 00:00:00 2001 +From 23b759045448c9072f8342778ea36b721c481bfd Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jun 2020 12:51:18 +0200 Subject: [PATCH 041/104] s3:rpcclient: Remove obsolete force encryption from @@ -4868,7 +4868,7 @@ index 2ead6cc7ba5..575a42ebf70 100644 2.29.2 -From b01458095b5e815c09eb71fb597598e9f34ee342 Mon Sep 17 00:00:00 2001 +From b42861ddc3b16cdda39c86d0549ed3af8e22cf7b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 6 Jul 2020 10:58:36 +0200 Subject: [PATCH 042/104] examples: Remove obsolete force encryption from @@ -4906,7 +4906,7 @@ index 6206c3a9701..c64be573462 100644 2.29.2 -From 66eb5d32234f2e7700a43504158507a6f828c50b Mon Sep 17 00:00:00 2001 +From 9718e834445fa9fb77a947aee35ff49f9ce98572 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 6 Jul 2020 11:05:59 +0200 Subject: [PATCH 043/104] s3:libsmb: Make cli_cm_force_encryption_creds() @@ -4954,7 +4954,7 @@ index 850cf12c8a6..eeabcaa7463 100644 2.29.2 -From 3b8e9646f0a79e2cbb977b8c1d0fc5f28a9b7490 Mon Sep 17 00:00:00 2001 +From 7e0b354aca307a2eaf45dcf0ca2e1203e7784fd3 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 13 Aug 2020 16:16:55 +0200 Subject: [PATCH 044/104] s4:libcli: Return NTSTATUS errors for @@ -5054,7 +5054,7 @@ index 582d43ef173..ad50ae0ac81 100644 2.29.2 -From cecd31a2451e20046c0202837269fb533e3118a7 Mon Sep 17 00:00:00 2001 +From 667f1730533b589820c2c7c492000fb86445797a Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 7 Jul 2020 12:54:26 +0200 Subject: [PATCH 045/104] s4:libcli: Return if encryption is requested for SMB1 @@ -5091,7 +5091,7 @@ index 6ee4929e8d7..51e121bdce6 100644 2.29.2 -From ed5b2f36fec30ae7b277620cb82f01a07f027e0e Mon Sep 17 00:00:00 2001 +From 97ce0f36abf29c234fbc4d8846ce0b68b2e4a6ab Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 7 Jul 2020 12:29:39 +0200 Subject: [PATCH 046/104] s3:libcli: Split out smb2_connect_tcon_start() @@ -5144,7 +5144,7 @@ index 6fc3993a4e8..95ff05eac8f 100644 2.29.2 -From 7eb81b6448064d8beee3972471723b90ea9307ec Mon Sep 17 00:00:00 2001 +From bf357c3c06df5ac5aeea7851a7e285d68f3ab974 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 7 Jul 2020 12:44:26 +0200 Subject: [PATCH 047/104] s4:libcli: Add smb2_connect_enc_start() @@ -5215,7 +5215,7 @@ index 95ff05eac8f..3a3ecdf20e8 100644 2.29.2 -From b5b0c28d597d8ef98b632e4616d2d2cdaaad37a9 Mon Sep 17 00:00:00 2001 +From 5a984891f73b07211d64e5a2f262915386aea7f4 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 24 Jul 2020 10:18:52 +0200 Subject: [PATCH 048/104] s4:libcli: Require signing for SMB encryption @@ -5271,7 +5271,7 @@ index 3a3ecdf20e8..9540704491e 100644 2.29.2 -From ee95e01cdc3917fc371b3145dcbe6d23ffc054b1 Mon Sep 17 00:00:00 2001 +From b733749b324891e6352fbb9ef51fa0452baa313e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 7 Jul 2020 14:27:07 +0200 Subject: [PATCH 049/104] python:tests: Add test for SMB encrypted DCERPC @@ -5392,7 +5392,7 @@ index 20981754db4..adcb5b53189 100644 2.29.2 -From fefa1d0236c67b2a93328eb9e0eac21da22235b2 Mon Sep 17 00:00:00 2001 +From 141c2ebfb18be8ca2b313e900539cfa6b5927ded Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Fri, 4 Sep 2020 10:47:54 +0200 Subject: [PATCH 050/104] auth:gensec: Add gensec_security_sasl_names() @@ -5522,7 +5522,7 @@ index d2d62d6652e..4eb45643714 100644 2.29.2 -From adf58a175cea99c0b0147d3b3275563c7155edfa Mon Sep 17 00:00:00 2001 +From b68a26966dddb4ec8a7bc7ec3441dbf03efd6af9 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Fri, 4 Sep 2020 10:48:27 +0200 Subject: [PATCH 051/104] s4:ldap_server: Use samba_server_gensec_start() in @@ -5634,7 +5634,7 @@ index 2839082daef..915d9b94f9b 100644 2.29.2 -From e887d94b47aca3609fd158efe0f4654101c5e02b Mon Sep 17 00:00:00 2001 +From fa5761777851f6d2ecdaa88fdea3260e42dc634c Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Fri, 4 Sep 2020 14:39:15 +0200 Subject: [PATCH 052/104] auth:gensec: Make gensec_use_kerberos_mechs() a @@ -5684,7 +5684,7 @@ index 4eb45643714..ebcab76999a 100644 2.29.2 -From 08dc4775dbf72a1e8068d392360be158d8305bfa Mon Sep 17 00:00:00 2001 +From 3c052ba053b6fee6c97f13aca8eafe680321ded8 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Fri, 4 Sep 2020 14:41:43 +0200 Subject: [PATCH 053/104] auth:gensec: Pass use_kerberos and keep_schannel to @@ -5758,7 +5758,7 @@ index ebcab76999a..8d1b41fec74 100644 2.29.2 -From bc505a449449267085778ec51c5362e256837edb Mon Sep 17 00:00:00 2001 +From ec9c5e93a31763c48d5c2d0e8859d9750aa36ed1 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Fri, 4 Sep 2020 17:00:45 +0200 Subject: [PATCH 054/104] auth:gensec: If Kerberos is required, keep schannel @@ -5795,7 +5795,7 @@ index 8d1b41fec74..3f42d611140 100644 2.29.2 -From 9b7a189e038e3f783a2b23302f0ee4657ef18057 Mon Sep 17 00:00:00 2001 +From d3f6c14e95159b4fed2034d563479607b48ee9ea Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 4 Sep 2020 12:21:21 +0200 Subject: [PATCH 055/104] auth:creds: Add cli_credentials_init_server() @@ -5861,7 +5861,7 @@ index 7d0cf53194b..438bcdce232 100644 2.29.2 -From 013d5eb87f3ddcda6df5c76796bede7a85c42207 Mon Sep 17 00:00:00 2001 +From b6249e4af652be9f02741ed0de59889734bff13f Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 4 Sep 2020 12:21:36 +0200 Subject: [PATCH 056/104] s4:rpc_server: Use cli_credentials_init_server() @@ -5909,7 +5909,7 @@ index 084857a44bf..e64148ef788 100644 2.29.2 -From 6e6030dca006e829150e6b64db0485e3c9895485 Mon Sep 17 00:00:00 2001 +From b0db24f086aad67ca9e536c6c94ef413983b5586 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 7 Sep 2020 09:19:43 +0200 Subject: [PATCH 057/104] s4:smb_server: Use cli_credentials_init_server() for @@ -6009,7 +6009,7 @@ index 4aaaf46793b..c433eb194bd 100644 2.29.2 -From f9f25b7690c2e234ea2e631f05c1fb0180776842 Mon Sep 17 00:00:00 2001 +From 96aae2c7cf11aeaadc98e0e18f88d1c9387019a7 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 8 Sep 2020 10:15:22 +0200 Subject: [PATCH 058/104] selftest: Rename 'smb encrypt' to 'server smb @@ -6060,7 +6060,7 @@ index e141f102ef1..c070086ca49 100755 2.29.2 -From 2fc16a8d11f48424fc2fff0380fb623f552ece5f Mon Sep 17 00:00:00 2001 +From f4d1c495b4eb8a3125812e1d1d81639afdd15c06 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 8 Sep 2020 12:30:08 +0200 Subject: [PATCH 059/104] selftest: Move enc_desired to provision to have it in @@ -6107,7 +6107,7 @@ index c070086ca49..fa3ca8962a5 100755 2.29.2 -From 299d7d6868e9590693e465cbc0c10abe8b7fc5a0 Mon Sep 17 00:00:00 2001 +From c69630ece0849fdca724003600f1b39d6411e194 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 8 Sep 2020 10:15:20 +0200 Subject: [PATCH 060/104] s3:tests: Add smbclient tests for 'client smb @@ -6248,7 +6248,7 @@ index 27dc7587b17..46bf274227c 100755 2.29.2 -From d996ccf7dc53046f92827ddab72aac6e92dd3a77 Mon Sep 17 00:00:00 2001 +From 5b15d0dd8783b8431e3d3913ee129b6e0f111de7 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 15:19:27 +0200 Subject: [PATCH 061/104] s3:client: Remove global smb_encrypt @@ -6356,7 +6356,7 @@ index 56309efcea7..60d4fb3c5ee 100644 2.29.2 -From b923ea7625de03e23a999a3cb844d81dcd25316f Mon Sep 17 00:00:00 2001 +From 1c461fb323ba59539c8dab2547032bdb48c60178 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 15:24:27 +0200 Subject: [PATCH 062/104] s3:libsmb: Remove force_encrypt from cli_cm_open() @@ -6510,7 +6510,7 @@ index eeabcaa7463..bb3e9e6874e 100644 2.29.2 -From 2fd26f4c208556cd2f28f0c54fe11cea044c7881 Mon Sep 17 00:00:00 2001 +From 411587b7301ec115398e430bcac16c5a22bdfe41 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 15:26:39 +0200 Subject: [PATCH 063/104] s3:libsmb: Remove force_encrypt from cli_cm_connect() @@ -6572,7 +6572,7 @@ index 4825b8f3fae..b0032005398 100644 2.29.2 -From 3db1056dc42765aa3043b6ea0fd0389a34a41145 Mon Sep 17 00:00:00 2001 +From af532caa1ba9727663abf17465b04768c6f7173e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 15:28:28 +0200 Subject: [PATCH 064/104] s3:libsmb: Remove force_encrypt from clidfs @@ -6633,7 +6633,7 @@ index b0032005398..5503506de97 100644 2.29.2 -From 8b234932ec76052258078d08071c33fefd5f3a0e Mon Sep 17 00:00:00 2001 +From 918aa81d36bcd8b28fa98deadd811b8602fb3f6d Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 15:52:11 +0200 Subject: [PATCH 065/104] s3:libsmb: Remove force_encrypt from @@ -6730,7 +6730,7 @@ index bb3e9e6874e..f2b0a8c5ff8 100644 2.29.2 -From b1324ba3361e66ca4bdf5b0cb0e1d8c8084955d4 Mon Sep 17 00:00:00 2001 +From 00bba24fda3f117eced7f306d5d4019f14595d38 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 18 Aug 2020 17:15:09 +0200 Subject: [PATCH 066/104] s3:libsmb: Pass cli_credentials to clidfs @@ -6849,7 +6849,7 @@ index 736c565a7a8..d536e0597af 100644 2.29.2 -From 5997be2fc0d9b25c7a81d1d21e3cc1cd3f55e66f Mon Sep 17 00:00:00 2001 +From 0dfe1d347c131b66172d324a5a16336875b24d50 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 18 Aug 2020 17:18:16 +0200 Subject: [PATCH 067/104] s3:libsmb: Pass cli_credentials to cli_cm_connect() @@ -6920,7 +6920,7 @@ index d536e0597af..a2c6f5fe5ec 100644 2.29.2 -From 62109132050092a5b4ac81d80cb358e563da605c Mon Sep 17 00:00:00 2001 +From baf5499376658651aa03ba864e6541e2daf06b3a Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 18 Aug 2020 17:26:54 +0200 Subject: [PATCH 068/104] s3:libsmb: Pass cli_credentials to cli_cm_open() @@ -7131,7 +7131,7 @@ index f2b0a8c5ff8..0b8cf2a6036 100644 2.29.2 -From 9500031d977b874b32085df3ff7f5b0ae28514c6 Mon Sep 17 00:00:00 2001 +From ee496daf60a5340ab9e4f16430e2d93fd121659b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 18 Aug 2020 17:42:25 +0200 Subject: [PATCH 069/104] s3:libsmb: Pass cli_credentials to @@ -8018,7 +8018,7 @@ index 8fd9fcc5780..4989ec633c3 100644 2.29.2 -From e3ce5ba85266a08bd201c851e8fd59b71322d03e Mon Sep 17 00:00:00 2001 +From aa21292bdc66f8f26244da5f1422bc41afafa6f7 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 16:40:49 +0200 Subject: [PATCH 070/104] s3:client: Remove global max_protocol @@ -8100,7 +8100,7 @@ index 13e48f80a01..902cdec8b64 100644 2.29.2 -From 156a763a247480a88ab79f8822a2f34670a0c63b Mon Sep 17 00:00:00 2001 +From 517baf60c6597388cfd1a17bf998272586d3bfc9 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 16:43:46 +0200 Subject: [PATCH 071/104] s3:libsmb: Remove max_protocol from cli_cm_open() @@ -8225,7 +8225,7 @@ index 517738dbcd7..8aaaff2cb1e 100644 2.29.2 -From 2ad30b082df42e010ca88e7a84471629476e00b9 Mon Sep 17 00:00:00 2001 +From b35001a76bc0ff7fc10bd319abfda481b8a81c9b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 16:45:12 +0200 Subject: [PATCH 072/104] s3:libcmb: Remove max_protocol from cli_cm_connect() @@ -8278,7 +8278,7 @@ index fb1a0c72e6d..023dd4d2757 100644 2.29.2 -From 4cc3243a8cf7c18129ad41ea52abc325aef55f06 Mon Sep 17 00:00:00 2001 +From 4e405a5acc748c07f74a27ed57deeffc4e2c20d7 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 27 Aug 2020 16:46:29 +0200 Subject: [PATCH 073/104] s3:libsmb: Remove max_protocol from clidfs @@ -8341,7 +8341,7 @@ index 023dd4d2757..ee5becf76a6 100644 2.29.2 -From bfd80fa8f7a476b2fb37bd435697700ad032cc70 Mon Sep 17 00:00:00 2001 +From c710bcf3600beb7f9a08c56108c0c93f32a9139b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 10 Aug 2020 15:47:35 +0200 Subject: [PATCH 074/104] s3:include: Move loadparm prototypes to own header @@ -8759,7 +8759,7 @@ index 00000000000..7686877ccf1 2.29.2 -From ad73140f7e08472179ac7598cfea780a207f0570 Mon Sep 17 00:00:00 2001 +From 62a13e686241e752ba927da046dda68324f3a550 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 11 Aug 2020 10:41:07 +0200 Subject: [PATCH 075/104] s3:lib: Move interface prototypes to own header file @@ -8865,7 +8865,7 @@ index 00000000000..f45435b4a81 2.29.2 -From bd958477d69c820766a30f818163cda9f9d171a3 Mon Sep 17 00:00:00 2001 +From 2b704c32b55432d08eae3cae2267a4b6319c6c6c Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 7 Feb 2020 16:48:16 +0100 Subject: [PATCH 076/104] idl: Add SID_SAMBA_SMB3 @@ -8895,7 +8895,7 @@ index a92e8f1518e..06bf7449a70 100644 2.29.2 -From 6b4e237ea0900e2ac7f46b889fd95d1d04db5bff Mon Sep 17 00:00:00 2001 +From ae4b1eccc9ef043a753126f942345a57a92004ed Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 7 Feb 2020 16:48:29 +0100 Subject: [PATCH 077/104] s3:smbd: Add SMB3 connection information to session @@ -9052,7 +9052,7 @@ index cf9de185c1f..cd24b7d2ed5 100644 2.29.2 -From 466c2d98005e1e0a3c3aa7b17779031b426b5da6 Mon Sep 17 00:00:00 2001 +From 49853bdabadcde29032b0ae09f015a0adf3cd22c Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 12 Mar 2020 14:11:56 +0100 Subject: [PATCH 078/104] librpc: Add dcerpc helper @@ -9268,7 +9268,7 @@ index 27b180fa63d..109a1834841 100644 2.29.2 -From cc8a5479152c6131362e9ca9cfe6e5bab2a71af3 Mon Sep 17 00:00:00 2001 +From 0490f135fdcc293561b0af98b4ce0f4d56eb14a6 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 28 Aug 2020 16:31:17 +0200 Subject: [PATCH 079/104] s3:smbd: Use defines to set 'srv_smb_encrypt' @@ -9305,7 +9305,7 @@ index d51a3de9497..785cbb23b5f 100644 2.29.2 -From dad6dc0e5a202d48a930504768394343823d5c42 Mon Sep 17 00:00:00 2001 +From bbbb58dd5f37f82b46872d4a9eb3c6f6c1939a26 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 12 Nov 2019 16:56:45 +0100 Subject: [PATCH 080/104] s3:rpc_server: Allow to use RC4 for setting passwords @@ -9542,7 +9542,7 @@ index 2af02ad6fa8..eb91ac09384 100644 2.29.2 -From 2932bdeff6ad18a36b2b64ab59d72ff1040acd09 Mon Sep 17 00:00:00 2001 +From c3ffe2ce09c761a69ba83ae55beb4af4e53095d7 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 15 Nov 2019 13:49:40 +0100 Subject: [PATCH 081/104] s4:rpc_server: Allow to use RC4 for setting passwords @@ -9673,7 +9673,7 @@ index de55ad6239a..c9c1978f223 100644 2.29.2 -From 959978865400d20fe1b2f9b5343fbec7c0b1109a Mon Sep 17 00:00:00 2001 +From 6163af4d52811d487fa3568d0588e6afd7f43167 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:45:49 +0200 Subject: [PATCH 082/104] lib:crypto: Add py binding for set_relax/strict fips @@ -9731,7 +9731,7 @@ index 32b946eee8f..ad18d3ada0f 100644 2.29.2 -From e3059d24a83175efb4f9eb3844c2e02d2af7775a Mon Sep 17 00:00:00 2001 +From 0dbd9d87a529585cabd793ae4c2bc1d94044c619 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 28 Oct 2020 17:05:36 +0100 Subject: [PATCH 083/104] s4:param: Add 'weak crypto' getter to pyparam @@ -9787,7 +9787,7 @@ index 4023fac4dd6..e15592b5743 100644 2.29.2 -From 2c10e3c1bbd7527f8563dca42700310c86ec04d4 Mon Sep 17 00:00:00 2001 +From 29e334546e28b10ff31f0de453951648c4e51296 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 21 Oct 2020 10:09:22 +0200 Subject: [PATCH 084/104] python:tests: Add SAMR password change tests for fips @@ -10012,7 +10012,7 @@ index adcb5b53189..86cab3f8046 100644 2.29.2 -From 65f6aef76ebc4b432f2743fb36cec64d7e06e71d Mon Sep 17 00:00:00 2001 +From de2b1caebf0183bd24d06969ebf7d03223f7d9fc Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 21 Oct 2020 10:09:22 +0200 Subject: [PATCH 085/104] python:tests: Add SAMR password change tests for fips @@ -10045,7 +10045,7 @@ index 649e923ff9a..1ebdf2a5484 100755 2.29.2 -From 114ce58de5ac14035c095e12aeb31931c7859d89 Mon Sep 17 00:00:00 2001 +From 5f240ac738df737712cbc2cdd40c8a56ab9e165b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 20 Aug 2020 09:40:41 +0200 Subject: [PATCH 086/104] auth:creds: Rename CRED_USE_KERBEROS values @@ -10787,7 +10787,7 @@ index 07c6faebb15..701dfc10a07 100644 2.29.2 -From dd116a6a1b334431981b786c103503d9e2998247 Mon Sep 17 00:00:00 2001 +From 03fb4e57548098264386dfd056f37ad2c86a937a Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 1 Sep 2020 12:32:28 +0200 Subject: [PATCH 087/104] auth:creds:tests: Migrate test to a cmocka unit test @@ -11084,7 +11084,7 @@ index 38b6c8f4b6e..f0ab0357986 100644 2.29.2 -From 48c31546ad4c2a072497e3ce9eff37ef37bc81c8 Mon Sep 17 00:00:00 2001 +From 82565bd73ee76d51b6569743644be1b916461acd Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:09:05 +0200 Subject: [PATCH 088/104] Add smb2cli_session_get_encryption_cipher() @@ -11102,10 +11102,10 @@ Reviewed-by: Alexander Bokovoy 2 files changed, 14 insertions(+) diff --git a/libcli/smb/smbXcli_base.c b/libcli/smb/smbXcli_base.c -index 7d2da4b9ebc..471319a32f1 100644 +index 4909797543c..1be3a5506a0 100644 --- a/libcli/smb/smbXcli_base.c +++ b/libcli/smb/smbXcli_base.c -@@ -6436,6 +6436,19 @@ NTSTATUS smb2cli_session_encryption_on(struct smbXcli_session *session) +@@ -6461,6 +6461,19 @@ NTSTATUS smb2cli_session_encryption_on(struct smbXcli_session *session) return NT_STATUS_OK; } @@ -11141,7 +11141,7 @@ index 2afc7165cd9..db5f5d58799 100644 2.29.2 -From 25a7d3534f7e3798cdf2432de62ed62f9e11547b Mon Sep 17 00:00:00 2001 +From f74c5cc57398ee42fecdfda17f4d442ca1abd9a5 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:18:21 +0200 Subject: [PATCH 089/104] Add dcerpc_transport_encrypted() @@ -11233,7 +11233,7 @@ index bd79a072bc8..6ea27a8d9a3 100644 2.29.2 -From a0b8ea04d7030d2cb97d6ccea9d28072d6e3dbda Mon Sep 17 00:00:00 2001 +From 89a12dbf4a5b819dbd136e743c59025298009049 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:35:01 +0200 Subject: [PATCH 090/104] Add py binding for dcerpc_transport_encrypted @@ -11280,7 +11280,7 @@ index be914ed5f14..309a6d72e26 100644 2.29.2 -From ff38da1d43f7ec3312a90fb8c53f977c9466e199 Mon Sep 17 00:00:00 2001 +From a08aab47494ab4f2972de3ebe4b022a1d23216a5 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:44:08 +0200 Subject: [PATCH 091/104] selftest: add a test for py dce transport_encrypted @@ -11345,7 +11345,7 @@ index 8e0d6a5ef0a..24e4ac77d89 100644 2.29.2 -From 5ffb0a0d9093bba2c4630d89512f623a35122f8e Mon Sep 17 00:00:00 2001 +From 4e8f7954ceed5a14987eb56197f265618fd77acc Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:47:12 +0200 Subject: [PATCH 092/104] Add CreateTrustedDomainRelax wrapper for fips mode @@ -11431,7 +11431,7 @@ index 00000000000..b4df0fa5bb8 2.29.2 -From d980bb1444e318825457ead9bdbce1c9353ccc66 Mon Sep 17 00:00:00 2001 +From 2e16b3d7d5419e76d33b2c3a794a043be5c0a4a5 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 20 Aug 2020 12:49:17 +0200 Subject: [PATCH 093/104] Use the new CreateTrustedDomainRelax() @@ -11538,7 +11538,7 @@ index 1d12c362911..93a3258d28d 100644 2.29.2 -From e06d01fe3370501ab45d01c5511aa0b5de9d854e Mon Sep 17 00:00:00 2001 +From 2661a29e81b6b33dce6ca1e39c9e4eeaab53fef7 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Tue, 1 Sep 2020 20:14:29 +0300 Subject: [PATCH 094/104] selftest: add a test for the CreateTrustedDomainRelax @@ -11723,7 +11723,7 @@ index 3a903a7eee0..96f51b68cfc 100755 2.29.2 -From 93b792d5d0dcf96833e32958aeb3877f74125f07 Mon Sep 17 00:00:00 2001 +From 3d3a03764d56b58a81ef99123720bd5555eaf040 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Thu, 5 Nov 2020 15:38:19 +0200 Subject: [PATCH 095/104] Remove source4/scripting/devel/createtrust script @@ -11878,7 +11878,7 @@ index 26b0d0dcb68..00000000000 2.29.2 -From 4577786be36993e958b745e4953f582e3de301a1 Mon Sep 17 00:00:00 2001 +From 8bdfdf2b2489393586dbc99b1d2282c61acdce09 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 6 Nov 2020 14:30:26 +0100 Subject: [PATCH 096/104] s3:rpc_server: Use gnutls_cipher_decrypt() in @@ -11910,7 +11910,7 @@ index 198387424e6..e749caf2551 100644 2.29.2 -From ad9c90d18c2efdee16535ade97d4b151e4a64c5e Mon Sep 17 00:00:00 2001 +From 37fce305caff75a8ee1ab185f37e984809225239 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 6 Nov 2020 14:33:38 +0100 Subject: [PATCH 097/104] s4:rpc_server: Use gnutls_cipher_decrypt() in @@ -11942,7 +11942,7 @@ index 8333cb149b6..4bb8aaa9592 100644 2.29.2 -From 6c73bf8553c48e28abd09ff225cbfb8278528d0d Mon Sep 17 00:00:00 2001 +From caf59e243ed0f99056176ef81fe617b170ec6cfd Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 20 Aug 2020 13:40:21 +0200 Subject: [PATCH 098/104] s3:rpc_server: Allow to use RC4 for creating trusts @@ -12009,7 +12009,7 @@ index e749caf2551..d6d606ddeca 100644 2.29.2 -From 20f0e078f2dd5681513253788216313851df428d Mon Sep 17 00:00:00 2001 +From 14b972e7f4224ccf87b1d08824194a4d7d37aef0 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 20 Aug 2020 13:51:39 +0200 Subject: [PATCH 099/104] s4:rpc_server: Allow to use RC4 for creating trusts @@ -12081,7 +12081,7 @@ index 4bb8aaa9592..5b3ef71d458 100644 2.29.2 -From 8c7a60700f7c7925749ccfd0f3ccb17ca47df7da Mon Sep 17 00:00:00 2001 +From 5fdca81ab920d021e5f1c81a05cf3a91244ef405 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 6 Nov 2020 10:13:48 +0100 Subject: [PATCH 100/104] sefltest: Enable the dcerpc.createtrustrelax test @@ -12111,7 +12111,7 @@ index 80effda8343..00000000000 2.29.2 -From 9db0e9602ea96849a6f854415f4cd988576cccf2 Mon Sep 17 00:00:00 2001 +From 2547b1d495afa0f7235064f4949a297e46338287 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 11 Nov 2020 13:42:06 +0100 Subject: [PATCH 101/104] s3:smbd: Fix possible null pointer dereference in @@ -12147,7 +12147,7 @@ index 57754a0f766..694c0c290e8 100644 2.29.2 -From b92cbd97865ea6ef49892df75c59f37e9917ddb3 Mon Sep 17 00:00:00 2001 +From 14cba0db4c3e8a20923491f01cd6eb658c8d76ae Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Tue, 10 Nov 2020 17:35:24 +0200 Subject: [PATCH 102/104] lookup_name: allow lookup names prefixed with DNS @@ -12257,7 +12257,7 @@ index 82c47b3145b..864246da56e 100644 2.29.2 -From 5bf01d45325bcc6819f807620267e35841f826a3 Mon Sep 17 00:00:00 2001 +From 35297bdac5cf9699234ec45ae97e54ceec75ebe9 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Wed, 11 Nov 2020 14:42:55 +0200 Subject: [PATCH 103/104] auth_sam: use pdb_get_domain_info to look up DNS @@ -12480,7 +12480,7 @@ index 3c12f959faf..e8e0d543f8c 100644 2.29.2 -From edd405a3918b5d52e7eeff2f8425478a0a1867ed Mon Sep 17 00:00:00 2001 +From 173cabf40d71470a233b7648b1bf8795f8bda091 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 27 Nov 2020 11:22:15 +0100 Subject: [PATCH 104/104] docs-xml: Add a section about weak crypto in testparm diff --git a/samba-pubkey_AA99442FB680B620.gpg b/samba-pubkey_AA99442FB680B620.gpg new file mode 100644 index 0000000000000000000000000000000000000000..c901409c92a9ccaa3f29dca796283d35ba462c4c GIT binary patch literal 2290 zcmajfS5OlQ8U^4qdXZ|Ba_IshB^RYeAxJZT^b$ZiLO?(uAktfqVju}i2Px7bL3$w4 zL_k4B3|=}Yp(;(PbiH%k+1Y*DxBtxi=k3gw2jYM@&*A?9asfKH<7)kPQmzuWsfi2u zLI?!5F)xxa87n$=!Jmo%9)YS<7;&9{>B}if@Dw z(oCC>JU&|4`so(*Jy(Bh>uh}Oq48D|OHlJE`)&?bj5M6%ar~{y?*;|d@0u7enGOL} z#+bE<^m(nlQiVi|@^q+t;%4c+>oehWTJAi{lvV3&l6u13$LfL+>9uZ(=lXRIn8wzi zWmzzD4gD{M1b|uA^~b;F7>ealR~$qV9J8uOTAx2e&yS0%Jlz#QEX7A!K5BCLwQz7C zca;xtH6(j@F!(#l%FU<2B1H6*ad2dvD77pTymf47>s`=m7TWA7t(1crE#zTG8cY&j z{frRKJd<+uop~v4z=LItsNoN2(##3{Q=M!oZi+a>wePCEPi_NBv?FH)ygMCol`f!c zjYLPN4ZDOVyJ01imns{Ds!W%i04Q{-nC{5xmXU&rwZ+5P5*N6uCe=@1L%h;a9U4N{ zJ#xSDgI^o|E+@2jdZv6mN8yv^u!`T4yu)8|1+R~i*$MI0Nn3JP!-N zb+KtX$*!827uW1OE3$xNSNCs4q>07KO4Kp}5g;P~HxK}9*06N-b8{8dMF(So&~70Z zbb!C8jb{-0F52DocQEpNC<+h$=Skiz#4A|)_o)yNjVbrHC?s{#hDG5X`^=e&q#VU}Irs0x|NlvM{rOAm>3~Am|Su2pS7u zW#RfyX{45t2!nTU|cnp9INM-Nj! z8xHj3uA7J~7Zujt1Xq9ypN%FNSyJIQzIY|cH%k0;45r|fnfTJ0D?Z>(SBD)uc+;Ip zx~R%g)o?<7txDiFNs&D9_;iyQ()?uz_R)-kEQHMI?wI|&WPZ9$fRJ#M#u%R);#4)qBEq{e`A_BtO&Y4EeY+oOV z#D%je2l^5E_lAzWE_0Qh>XbkJPQm3|Xg)6dm<-B#tDedmWGZYYL;+V#M;RAfWbWyo z^w0I4Gik9sS>Wy+_gNVqtv%kvAI!ogeN~qgbVHW-5h}F`^_|13XW2;^VdMQ`8yAoC zir=+%&Uu(0xrE<1Pd?e$NyCJrh*l1M$%1=*79NN=^aHF%i>pgkh@5FN3Bnqkj zCF;Wl|3q~if`QnrL-X5(`Y*`kmtfR_w-+1obXc@5)-ZWqjBF74;7RYH3{^VX7eZ8d zYZ}Sj=Ds7wuU%tPR*6>W6@FMPLBv`Mky!I`I6c$tNKKvEgaE4cf~pr~h1Xyugr@$0 zqc_lRH4~^2i(J;rGK)Goos*%5Nt0zY3LZ4}l;MF*x@4G4^k#^E$&tpzQwN!a&jP&z z91%)5<*rG&7osofsS@@pKV-& z^p(a(hBm|vI*WT*E-L2YgIpo@*k~1>PkjN)Ff|eD|V=Q%_fq2^(ca zVax~`-ma|ba%-7ASP)yh#(*5M5DCTf)gOQ;;hYuy1y#20c+B>GgNp_q-h@;FtWzMb z0^+MY3^B|~MGW+)I$byqtIO+sLa~=C_-jTm?5sF{DJ0+A4yR5E`w?rN)2+1B7-eok z*}ueDo{ZstWBSnjwN2(gBUa~Z;DbMH{5x;y7WtSmVquZ??p-c=4zf(~6DBi8gC*Z61USMLAb9X77Tp>G*|f z=?!J{9#yKm+&ITGHmJ8hJpwZuU-!S?KJ}zhB^~eRskw84*EWXNxcuuoLQ^k=Yz>vF z&Nkwf>@HLIKpU`G&y6`Z_wxh`HpKEf?R@mP=S!1)aHo(JTF@~gm&SI9Lsj!dZ`)V5 zB!)9Ubu1wjAhmWuIQYHkM!g2Vd< z&UBb`f|^wUjG&EblJar+p^8ci+pwfE|B7r1Zf#5L`v4by3zn|g#;E2 zQ#K3y^ZrAda{TQ1-{QM;Ipp>k;kd~v(ig?>T(?V^3 zC}bM7h=M~_evuqB;_(yK7S|0@ac`*srrj{PzMEdBU23s(I&5Kb21wg|es`W(*T?IL F^WPx2REz)s literal 0 HcmV?d00001 diff --git a/samba.spec b/samba.spec index 4e13a4d..babc903 100644 --- a/samba.spec +++ b/samba.spec @@ -108,9 +108,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global main_release 1 +%global main_release 0 -%global samba_version 4.13.3 +%global samba_version 4.13.4 %global talloc_version 2.3.1 %global tdb_version 1.4.3 %global tevent_version 0.10.2 @@ -166,7 +166,7 @@ URL: https://www.samba.org # This is a xz recompressed file of https://ftp.samba.org/pub/samba/samba-%%{version}%%{pre_release}.tar.gz Source0: https://ftp.samba.org/pub/samba/samba-%{version}%{pre_release}.tar.gz#/samba-%{version}%{pre_release}.tar.xz Source1: https://ftp.samba.org/pub/samba/samba-%{version}%{pre_release}.tar.asc -Source2: gpgkey-52FBC0B86D954B0843324CDC6F33915B6568B7EA.gpg +Source2: samba-pubkey_AA99442FB680B620.gpg # Red Hat specific replacement-files Source10: samba.logrotate @@ -1659,7 +1659,6 @@ fi %{_libdir}/samba/libsmb-transport-samba4.so %{_libdir}/samba/libsmbclient-raw-samba4.so %{_libdir}/samba/libsmbd-base-samba4.so -%{_libdir}/samba/libsmbd-conn-samba4.so %{_libdir}/samba/libsmbd-shim-samba4.so %{_libdir}/samba/libsmbldaphelper-samba4.so %{_libdir}/samba/libsys-rw-samba4.so @@ -3799,6 +3798,9 @@ fi %endif %changelog +* Tue Jan 26 2021 Guenther Deschner - 4.13.4-0 +- Update to Samba 4.13.4 + * Wed Dec 16 2020 Guenther Deschner - 4.13.3-1 - Rebuild against krb5-1.19 - Resolves: rhbz#1915928 diff --git a/sources b/sources index 0e51188..2d17de0 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.13.3.tar.xz) = 8dbd8a18ff8566f778b17c9a5306a0d3f45a79fc8d1ce7c2ea63f941eb1b310462f97f2bdd40c4e09c69e2aae3f5144e488cb20e1b6686695306b521d609b6dc -SHA512 (samba-4.13.3.tar.asc) = f5ef09ae3fa434b7c37564407ad3b62542d9abc7ca0e2a1e58ebb987307a5269c123b1af3755582edff7fdcfe2930a151d6256b97ab8dcd296492038a96a160a +SHA512 (samba-4.13.4.tar.xz) = c6fb8b4186da25c69d1bc662780a12c6fa6fa70fc65fa487dba2d547c96e8f7f8f8736b8edc2564b599be875b00d891631fa37838632efac593bf83eb33392f9 +SHA512 (samba-4.13.4.tar.asc) = b8c0ccd7e716d2de6e9da2a53577bc31983eaec4ed4583bb88b52b2ca8b80045c8c0349a97a12e796df84a5942293f5a40e74eff8c003b3062f8f6454dc2a631 From 95450ee5f88855bdf2ea1fa038839b60c94caf95 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 25 Jan 2021 16:43:30 +0100 Subject: [PATCH 075/425] Update to Samba 4.14.0rc1 Guenther --- .gitignore | 2 + samba-4.13-redhat.patch | 12524 -------------------------------------- samba.spec | 72 +- sources | 4 +- 4 files changed, 56 insertions(+), 12546 deletions(-) delete mode 100644 samba-4.13-redhat.patch diff --git a/.gitignore b/.gitignore index 669acc7..3e7538e 100644 --- a/.gitignore +++ b/.gitignore @@ -231,3 +231,5 @@ samba-3.6.0pre1.tar.gz /samba-4.13.3.tar.asc /samba-4.13.4.tar.xz /samba-4.13.4.tar.asc +/samba-4.14.0rc1.tar.xz +/samba-4.14.0rc1.tar.asc diff --git a/samba-4.13-redhat.patch b/samba-4.13-redhat.patch deleted file mode 100644 index 1b8484b..0000000 --- a/samba-4.13-redhat.patch +++ /dev/null @@ -1,12524 +0,0 @@ -From 2d3ad48f0c7337cda08a6588b06183120fc0731a Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Mon, 13 Jul 2020 16:15:03 +0200 -Subject: [PATCH 001/104] libcli:smb2: Do not leak ptext on error - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher ---- - libcli/smb/smb2_signing.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/libcli/smb/smb2_signing.c b/libcli/smb/smb2_signing.c -index 230475480c2..cfb3b613f9d 100644 ---- a/libcli/smb/smb2_signing.c -+++ b/libcli/smb/smb2_signing.c -@@ -515,6 +515,7 @@ NTSTATUS smb2_signing_encrypt_pdu(struct smb2_signing_key *encryption_key, - - ctext = talloc_size(talloc_tos(), ctext_size); - if (ctext == NULL) { -+ TALLOC_FREE(ptext); - status = NT_STATUS_NO_MEMORY; - goto out; - } --- -2.29.2 - - -From 630c6314778894a668c20fe2aa7d04627ed517a7 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Mon, 13 Jul 2020 17:23:37 +0200 -Subject: [PATCH 002/104] libcli:smb2: Use talloc NULL context if we don't have - a stackframe - -If we execute this code from python we don't have a talloc stackframe -around and segfault with talloc_tos(). - -To fix the crash we use the NULL context as we take care for freeing the -memory as soon as possible. - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher ---- - libcli/smb/smb2_signing.c | 30 ++++++++++++++++++++++++++---- - 1 file changed, 26 insertions(+), 4 deletions(-) - -diff --git a/libcli/smb/smb2_signing.c b/libcli/smb/smb2_signing.c -index cfb3b613f9d..b1e0253948f 100644 ---- a/libcli/smb/smb2_signing.c -+++ b/libcli/smb/smb2_signing.c -@@ -506,14 +506,25 @@ NTSTATUS smb2_signing_encrypt_pdu(struct smb2_signing_key *encryption_key, - uint8_t *ctext = NULL; - size_t len = 0; - int i; -+ TALLOC_CTX *tmp_ctx = NULL; - -- ptext = talloc_size(talloc_tos(), ptext_size); -+ /* -+ * If we come from python bindings, we don't have a stackframe -+ * around, so use the NULL context. -+ * -+ * This is fine as we make sure we free the memory. -+ */ -+ if (talloc_stackframe_exists()) { -+ tmp_ctx = talloc_tos(); -+ } -+ -+ ptext = talloc_size(tmp_ctx, ptext_size); - if (ptext == NULL) { - status = NT_STATUS_NO_MEMORY; - goto out; - } - -- ctext = talloc_size(talloc_tos(), ctext_size); -+ ctext = talloc_size(tmp_ctx, ctext_size); - if (ctext == NULL) { - TALLOC_FREE(ptext); - status = NT_STATUS_NO_MEMORY; -@@ -705,16 +716,27 @@ NTSTATUS smb2_signing_decrypt_pdu(struct smb2_signing_key *decryption_key, - uint8_t *ptext = NULL; - size_t len = 0; - int i; -+ TALLOC_CTX *tmp_ctx = NULL; -+ -+ /* -+ * If we come from python bindings, we don't have a stackframe -+ * around, so use the NULL context. -+ * -+ * This is fine as we make sure we free the memory. -+ */ -+ if (talloc_stackframe_exists()) { -+ tmp_ctx = talloc_tos(); -+ } - - /* GnuTLS doesn't have a iovec API for decryption yet */ - -- ptext = talloc_size(talloc_tos(), ptext_size); -+ ptext = talloc_size(tmp_ctx, ptext_size); - if (ptext == NULL) { - status = NT_STATUS_NO_MEMORY; - goto out; - } - -- ctext = talloc_size(talloc_tos(), ctext_size); -+ ctext = talloc_size(tmp_ctx, ctext_size); - if (ctext == NULL) { - TALLOC_FREE(ptext); - status = NT_STATUS_NO_MEMORY; --- -2.29.2 - - -From 63cefdebe5c0e435b6174ff6bc72b48d12cec312 Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Wed, 6 Nov 2019 17:37:45 +0100 -Subject: [PATCH 003/104] auth:creds: Introduce CRED_SMB_CONF - -We have several places where we check '> CRED_UNINITIALISED', -so we better don't use CRED_UNINITIALISED for values from -our smb.conf. - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Andreas Schneider ---- - auth/credentials/credentials.c | 6 +++--- - auth/credentials/credentials.h | 1 + - auth/credentials/pycredentials.c | 1 + - python/samba/tests/credentials.py | 4 ++-- - 4 files changed, 7 insertions(+), 5 deletions(-) - -diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c -index 81f9dbb9eb3..80a31b248ae 100644 ---- a/auth/credentials/credentials.c -+++ b/auth/credentials/credentials.c -@@ -902,12 +902,12 @@ _PUBLIC_ void cli_credentials_set_conf(struct cli_credentials *cred, - if (lpcfg_parm_is_cmdline(lp_ctx, "workgroup")) { - cli_credentials_set_domain(cred, lpcfg_workgroup(lp_ctx), CRED_SPECIFIED); - } else { -- cli_credentials_set_domain(cred, lpcfg_workgroup(lp_ctx), CRED_UNINITIALISED); -+ cli_credentials_set_domain(cred, lpcfg_workgroup(lp_ctx), CRED_SMB_CONF); - } - if (lpcfg_parm_is_cmdline(lp_ctx, "netbios name")) { - cli_credentials_set_workstation(cred, lpcfg_netbios_name(lp_ctx), CRED_SPECIFIED); - } else { -- cli_credentials_set_workstation(cred, lpcfg_netbios_name(lp_ctx), CRED_UNINITIALISED); -+ cli_credentials_set_workstation(cred, lpcfg_netbios_name(lp_ctx), CRED_SMB_CONF); - } - if (realm != NULL && strlen(realm) == 0) { - realm = NULL; -@@ -915,7 +915,7 @@ _PUBLIC_ void cli_credentials_set_conf(struct cli_credentials *cred, - if (lpcfg_parm_is_cmdline(lp_ctx, "realm")) { - cli_credentials_set_realm(cred, realm, CRED_SPECIFIED); - } else { -- cli_credentials_set_realm(cred, realm, CRED_UNINITIALISED); -+ cli_credentials_set_realm(cred, realm, CRED_SMB_CONF); - } - - sep = lpcfg_winbind_separator(lp_ctx); -diff --git a/auth/credentials/credentials.h b/auth/credentials/credentials.h -index 9fe6a82b1ea..7154c2a008c 100644 ---- a/auth/credentials/credentials.h -+++ b/auth/credentials/credentials.h -@@ -42,6 +42,7 @@ struct db_context; - /* In order of priority */ - enum credentials_obtained { - CRED_UNINITIALISED = 0, /* We don't even have a guess yet */ -+ CRED_SMB_CONF, /* Current value should be used, which comes from smb.conf */ - CRED_CALLBACK, /* Callback should be used to obtain value */ - CRED_GUESS_ENV, /* Current value should be used, which was guessed */ - CRED_GUESS_FILE, /* A guess from a file (or file pointed at in env variable) */ -diff --git a/auth/credentials/pycredentials.c b/auth/credentials/pycredentials.c -index a5d0f9e051c..68edc282741 100644 ---- a/auth/credentials/pycredentials.c -+++ b/auth/credentials/pycredentials.c -@@ -1275,6 +1275,7 @@ MODULE_INIT_FUNC(credentials) - return NULL; - - PyModule_AddObject(m, "UNINITIALISED", PyLong_FromLong(CRED_UNINITIALISED)); -+ PyModule_AddObject(m, "SMB_CONF", PyLong_FromLong(CRED_SMB_CONF)); - PyModule_AddObject(m, "CALLBACK", PyLong_FromLong(CRED_CALLBACK)); - PyModule_AddObject(m, "GUESS_ENV", PyLong_FromLong(CRED_GUESS_ENV)); - PyModule_AddObject(m, "GUESS_FILE", PyLong_FromLong(CRED_GUESS_FILE)); -diff --git a/python/samba/tests/credentials.py b/python/samba/tests/credentials.py -index d2a81506de3..6454ac9ff7c 100644 ---- a/python/samba/tests/credentials.py -+++ b/python/samba/tests/credentials.py -@@ -332,7 +332,7 @@ class CredentialsTests(samba.tests.TestCaseInTempDir): - os.environ["USER"] = "env_user" - creds.guess(lp) - realm = "realm.example.com" -- creds.set_realm(realm, credentials.UNINITIALISED) -+ creds.set_realm(realm, credentials.SMB_CONF) - creds.parse_string("user") - self.assertEqual(creds.get_username(), "user") - self.assertEqual(creds.get_domain(), lp.get("workgroup").upper()) -@@ -360,7 +360,7 @@ class CredentialsTests(samba.tests.TestCaseInTempDir): - os.environ["USER"] = "env_user" - creds.guess(lp) - realm = "realm.example.com" -- creds.set_realm(realm, credentials.UNINITIALISED) -+ creds.set_realm(realm, credentials.SMB_CONF) - self.assertEqual(creds.get_username(), "env_user") - self.assertEqual(creds.get_domain(), lp.get("workgroup").upper()) - self.assertEqual(creds.get_realm(), realm.upper()) --- -2.29.2 - - -From 0120aad504663c5e75054c2e322f1277acae63dd Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Thu, 10 Oct 2019 14:18:23 +0200 -Subject: [PATCH 004/104] param: Add 'server smb encrypt' parameter - -And this also makes 'smb encrypt' a synonym of that. - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher ---- - .../smbdotconf/security/serversmbencrypt.xml | 241 ++++++++++++++++++ - docs-xml/smbdotconf/security/smbencrypt.xml | 241 +----------------- - source3/param/loadparm.c | 2 +- - source3/smbd/service.c | 4 +- - source3/smbd/smb2_negprot.c | 2 +- - source3/smbd/smb2_sesssetup.c | 4 +- - source3/smbd/smb2_tcon.c | 4 +- - source3/smbd/trans2.c | 2 +- - 8 files changed, 257 insertions(+), 243 deletions(-) - create mode 100644 docs-xml/smbdotconf/security/serversmbencrypt.xml - -diff --git a/docs-xml/smbdotconf/security/serversmbencrypt.xml b/docs-xml/smbdotconf/security/serversmbencrypt.xml -new file mode 100644 -index 00000000000..714aacbf1ca ---- /dev/null -+++ b/docs-xml/smbdotconf/security/serversmbencrypt.xml -@@ -0,0 +1,241 @@ -+ -+ -+ -+ This parameter controls whether a remote client is allowed or required -+ to use SMB encryption. It has different effects depending on whether -+ the connection uses SMB1 or SMB2 and newer: -+ -+ -+ -+ -+ -+ If the connection uses SMB1, then this option controls the use -+ of a Samba-specific extension to the SMB protocol introduced in -+ Samba 3.2 that makes use of the Unix extensions. -+ -+ -+ -+ -+ -+ If the connection uses SMB2 or newer, then this option controls -+ the use of the SMB-level encryption that is supported in SMB -+ version 3.0 and above and available in Windows 8 and newer. -+ -+ -+ -+ -+ -+ This parameter can be set globally and on a per-share bases. -+ Possible values are -+ -+ off, -+ if_required, -+ desired, -+ and -+ required. -+ A special value is default which is -+ the implicit default setting of if_required. -+ -+ -+ -+ -+ Effects for SMB1 -+ -+ -+ The Samba-specific encryption of SMB1 connections is an -+ extension to the SMB protocol negotiated as part of the UNIX -+ extensions. SMB encryption uses the GSSAPI (SSPI on Windows) -+ ability to encrypt and sign every request/response in a SMB -+ protocol stream. When enabled it provides a secure method of -+ SMB/CIFS communication, similar to an ssh protected session, but -+ using SMB/CIFS authentication to negotiate encryption and -+ signing keys. Currently this is only supported smbclient of by -+ Samba 3.2 and newer, and hopefully soon Linux CIFSFS and MacOS/X -+ clients. Windows clients do not support this feature. -+ -+ -+ This may be set on a per-share -+ basis, but clients may chose to encrypt the entire session, not -+ just traffic to a specific share. If this is set to mandatory -+ then all traffic to a share must -+ be encrypted once the connection has been made to the share. -+ The server would return "access denied" to all non-encrypted -+ requests on such a share. Selecting encrypted traffic reduces -+ throughput as smaller packet sizes must be used (no huge UNIX -+ style read/writes allowed) as well as the overhead of encrypting -+ and signing all the data. -+ -+ -+ -+ If SMB encryption is selected, Windows style SMB signing (see -+ the option) is no longer -+ necessary, as the GSSAPI flags use select both signing and -+ sealing of the data. -+ -+ -+ -+ When set to auto or default, SMB encryption is offered, but not -+ enforced. When set to mandatory, SMB encryption is required and -+ if set to disabled, SMB encryption can not be negotiated. -+ -+ -+ -+ -+ -+ Effects for SMB2 and newer -+ -+ -+ Native SMB transport encryption is available in SMB version 3.0 -+ or newer. It is only offered by Samba if -+ server max protocol is set to -+ SMB3 or newer. -+ Clients supporting this type of encryption include -+ Windows 8 and newer, -+ Windows server 2012 and newer, -+ and smbclient of Samba 4.1 and newer. -+ -+ -+ -+ The protocol implementation offers various options: -+ -+ -+ -+ -+ -+ The capability to perform SMB encryption can be -+ negotiated during protocol negotiation. -+ -+ -+ -+ -+ -+ Data encryption can be enabled globally. In that case, -+ an encryption-capable connection will have all traffic -+ in all its sessions encrypted. In particular all share -+ connections will be encrypted. -+ -+ -+ -+ -+ -+ Data encryption can also be enabled per share if not -+ enabled globally. For an encryption-capable connection, -+ all connections to an encryption-enabled share will be -+ encrypted. -+ -+ -+ -+ -+ -+ Encryption can be enforced. This means that session -+ setups will be denied on non-encryption-capable -+ connections if data encryption has been enabled -+ globally. And tree connections will be denied for -+ non-encryption capable connections to shares with data -+ encryption enabled. -+ -+ -+ -+ -+ -+ These features can be controlled with settings of -+ server smb encrypt as follows: -+ -+ -+ -+ -+ -+ Leaving it as default, explicitly setting -+ default, or setting it to -+ if_required globally will enable -+ negotiation of encryption but will not turn on -+ data encryption globally or per share. -+ -+ -+ -+ -+ -+ Setting it to desired globally -+ will enable negotiation and will turn on data encryption -+ on sessions and share connections for those clients -+ that support it. -+ -+ -+ -+ -+ -+ Setting it to required globally -+ will enable negotiation and turn on data encryption -+ on sessions and share connections. Clients that do -+ not support encryption will be denied access to the -+ server. -+ -+ -+ -+ -+ -+ Setting it to off globally will -+ completely disable the encryption feature for all -+ connections. Setting server smb encrypt = -+ required for individual shares (while it's -+ globally off) will deny access to this shares for all -+ clients. -+ -+ -+ -+ -+ -+ Setting it to desired on a share -+ will turn on data encryption for this share for clients -+ that support encryption if negotiation has been -+ enabled globally. -+ -+ -+ -+ -+ -+ Setting it to required on a share -+ will enforce data encryption for this share if -+ negotiation has been enabled globally. I.e. clients that -+ do not support encryption will be denied access to the -+ share. -+ -+ -+ Note that this allows per-share enforcing to be -+ controlled in Samba differently from Windows: -+ In Windows, RejectUnencryptedAccess -+ is a global setting, and if it is set, all shares with -+ data encryption turned on -+ are automatically enforcing encryption. In order to -+ achieve the same effect in Samba, one -+ has to globally set server smb encrypt to -+ if_required, and then set all shares -+ that should be encrypted to -+ required. -+ Additionally, it is possible in Samba to have some -+ shares with encryption required -+ and some other shares with encryption only -+ desired, which is not possible in -+ Windows. -+ -+ -+ -+ -+ -+ Setting it to off or -+ if_required for a share has -+ no effect. -+ -+ -+ -+ -+ -+ -+ -+ -+default -+ -diff --git a/docs-xml/smbdotconf/security/smbencrypt.xml b/docs-xml/smbdotconf/security/smbencrypt.xml -index 32a22cb58f5..798e616b765 100644 ---- a/docs-xml/smbdotconf/security/smbencrypt.xml -+++ b/docs-xml/smbdotconf/security/smbencrypt.xml -@@ -1,241 +1,14 @@ - -+ context="S" -+ type="enum" -+ enumlist="enum_smb_signing_vals" -+ function="server_smb_encrypt" -+ synonym="1" -+ xmlns:samba="http://www.samba.org/samba/DTD/samba-doc"> - - -- This parameter controls whether a remote client is allowed or required -- to use SMB encryption. It has different effects depending on whether -- the connection uses SMB1 or SMB2 and newer: -+ This is a synonym for . - -- -- -- -- -- If the connection uses SMB1, then this option controls the use -- of a Samba-specific extension to the SMB protocol introduced in -- Samba 3.2 that makes use of the Unix extensions. -- -- -- -- -- -- If the connection uses SMB2 or newer, then this option controls -- the use of the SMB-level encryption that is supported in SMB -- version 3.0 and above and available in Windows 8 and newer. -- -- -- -- -- -- This parameter can be set globally and on a per-share bases. -- Possible values are -- off (or disabled), -- enabled (or auto, or -- if_required), -- desired, -- and -- required -- (or mandatory). -- A special value is default which is -- the implicit default setting of enabled. -- -- -- -- -- Effects for SMB1 -- -- -- The Samba-specific encryption of SMB1 connections is an -- extension to the SMB protocol negotiated as part of the UNIX -- extensions. SMB encryption uses the GSSAPI (SSPI on Windows) -- ability to encrypt and sign every request/response in a SMB -- protocol stream. When enabled it provides a secure method of -- SMB/CIFS communication, similar to an ssh protected session, but -- using SMB/CIFS authentication to negotiate encryption and -- signing keys. Currently this is only supported smbclient of by -- Samba 3.2 and newer, and hopefully soon Linux CIFSFS and MacOS/X -- clients. Windows clients do not support this feature. -- -- -- This may be set on a per-share -- basis, but clients may chose to encrypt the entire session, not -- just traffic to a specific share. If this is set to mandatory -- then all traffic to a share must -- be encrypted once the connection has been made to the share. -- The server would return "access denied" to all non-encrypted -- requests on such a share. Selecting encrypted traffic reduces -- throughput as smaller packet sizes must be used (no huge UNIX -- style read/writes allowed) as well as the overhead of encrypting -- and signing all the data. -- -- -- -- If SMB encryption is selected, Windows style SMB signing (see -- the option) is no longer -- necessary, as the GSSAPI flags use select both signing and -- sealing of the data. -- -- -- -- When set to auto or default, SMB encryption is offered, but not -- enforced. When set to mandatory, SMB encryption is required and -- if set to disabled, SMB encryption can not be negotiated. -- -- -- -- -- -- Effects for SMB2 -- -- -- Native SMB transport encryption is available in SMB version 3.0 -- or newer. It is only offered by Samba if -- server max protocol is set to -- SMB3 or newer. -- Clients supporting this type of encryption include -- Windows 8 and newer, -- Windows server 2012 and newer, -- and smbclient of Samba 4.1 and newer. -- -- -- -- The protocol implementation offers various options: -- -- -- -- -- -- The capability to perform SMB encryption can be -- negotiated during protocol negotiation. -- -- -- -- -- -- Data encryption can be enabled globally. In that case, -- an encryption-capable connection will have all traffic -- in all its sessions encrypted. In particular all share -- connections will be encrypted. -- -- -- -- -- -- Data encryption can also be enabled per share if not -- enabled globally. For an encryption-capable connection, -- all connections to an encryption-enabled share will be -- encrypted. -- -- -- -- -- -- Encryption can be enforced. This means that session -- setups will be denied on non-encryption-capable -- connections if data encryption has been enabled -- globally. And tree connections will be denied for -- non-encryption capable connections to shares with data -- encryption enabled. -- -- -- -- -- -- These features can be controlled with settings of -- smb encrypt as follows: -- -- -- -- -- -- Leaving it as default, explicitly setting -- default, or setting it to -- enabled globally will enable -- negotiation of encryption but will not turn on -- data encryption globally or per share. -- -- -- -- -- -- Setting it to desired globally -- will enable negotiation and will turn on data encryption -- on sessions and share connections for those clients -- that support it. -- -- -- -- -- -- Setting it to required globally -- will enable negotiation and turn on data encryption -- on sessions and share connections. Clients that do -- not support encryption will be denied access to the -- server. -- -- -- -- -- -- Setting it to off globally will -- completely disable the encryption feature for all -- connections. Setting smb encrypt = -- required for individual shares (while it's -- globally off) will deny access to this shares for all -- clients. -- -- -- -- -- -- Setting it to desired on a share -- will turn on data encryption for this share for clients -- that support encryption if negotiation has been -- enabled globally. -- -- -- -- -- -- Setting it to required on a share -- will enforce data encryption for this share if -- negotiation has been enabled globally. I.e. clients that -- do not support encryption will be denied access to the -- share. -- -- -- Note that this allows per-share enforcing to be -- controlled in Samba differently from Windows: -- In Windows, RejectUnencryptedAccess -- is a global setting, and if it is set, all shares with -- data encryption turned on -- are automatically enforcing encryption. In order to -- achieve the same effect in Samba, one -- has to globally set smb encrypt to -- enabled, and then set all shares -- that should be encrypted to -- required. -- Additionally, it is possible in Samba to have some -- shares with encryption required -- and some other shares with encryption only -- desired, which is not possible in -- Windows. -- -- -- -- -- -- Setting it to off or -- enabled for a share has -- no effect. -- -- -- -- -- -- - - - default -diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c -index a3abaa2ec67..c0070b716a5 100644 ---- a/source3/param/loadparm.c -+++ b/source3/param/loadparm.c -@@ -241,7 +241,7 @@ static const struct loadparm_service _sDefault = - .aio_write_size = 1, - .map_readonly = MAP_READONLY_NO, - .directory_name_cache_size = 100, -- .smb_encrypt = SMB_SIGNING_DEFAULT, -+ .server_smb_encrypt = SMB_SIGNING_DEFAULT, - .kernel_share_modes = true, - .durable_handles = true, - .check_parent_directory_delete_on_close = false, -diff --git a/source3/smbd/service.c b/source3/smbd/service.c -index 3802d16179b..9aa89e3eb02 100644 ---- a/source3/smbd/service.c -+++ b/source3/smbd/service.c -@@ -558,9 +558,9 @@ static NTSTATUS make_connection_snum(struct smbXsrv_connection *xconn, - /* Case options for the share. */ - conn_setup_case_options(conn); - -- conn->encrypt_level = lp_smb_encrypt(snum); -+ conn->encrypt_level = lp_server_smb_encrypt(snum); - if (conn->encrypt_level > SMB_SIGNING_OFF) { -- if (lp_smb_encrypt(-1) == SMB_SIGNING_OFF) { -+ if (lp_server_smb_encrypt(-1) == SMB_SIGNING_OFF) { - if (conn->encrypt_level == SMB_SIGNING_REQUIRED) { - DBG_ERR("Service [%s] requires encryption, but " - "it is disabled globally!\n", -diff --git a/source3/smbd/smb2_negprot.c b/source3/smbd/smb2_negprot.c -index 4071f42b5e0..674942b71de 100644 ---- a/source3/smbd/smb2_negprot.c -+++ b/source3/smbd/smb2_negprot.c -@@ -335,7 +335,7 @@ NTSTATUS smbd_smb2_request_process_negprot(struct smbd_smb2_request *req) - } - - if ((protocol >= PROTOCOL_SMB2_24) && -- (lp_smb_encrypt(-1) != SMB_SIGNING_OFF) && -+ (lp_server_smb_encrypt(-1) != SMB_SIGNING_OFF) && - (in_capabilities & SMB2_CAP_ENCRYPTION)) { - capabilities |= SMB2_CAP_ENCRYPTION; - } -diff --git a/source3/smbd/smb2_sesssetup.c b/source3/smbd/smb2_sesssetup.c -index 2b6b3a820d4..8957411e167 100644 ---- a/source3/smbd/smb2_sesssetup.c -+++ b/source3/smbd/smb2_sesssetup.c -@@ -292,12 +292,12 @@ static NTSTATUS smbd_smb2_auth_generic_return(struct smbXsrv_session *session, - x->global->signing_flags = SMBXSRV_SIGNING_REQUIRED; - } - -- if ((lp_smb_encrypt(-1) >= SMB_SIGNING_DESIRED) && -+ if ((lp_server_smb_encrypt(-1) >= SMB_SIGNING_DESIRED) && - (xconn->smb2.client.capabilities & SMB2_CAP_ENCRYPTION)) { - x->global->encryption_flags = SMBXSRV_ENCRYPTION_DESIRED; - } - -- if (lp_smb_encrypt(-1) == SMB_SIGNING_REQUIRED) { -+ if (lp_server_smb_encrypt(-1) == SMB_SIGNING_REQUIRED) { - x->global->encryption_flags = SMBXSRV_ENCRYPTION_REQUIRED | - SMBXSRV_ENCRYPTION_DESIRED; - } -diff --git a/source3/smbd/smb2_tcon.c b/source3/smbd/smb2_tcon.c -index 76112d04889..0dd3c653b4b 100644 ---- a/source3/smbd/smb2_tcon.c -+++ b/source3/smbd/smb2_tcon.c -@@ -302,13 +302,13 @@ static NTSTATUS smbd_smb2_tree_connect(struct smbd_smb2_request *req, - TALLOC_FREE(proxy); - } - -- if ((lp_smb_encrypt(snum) >= SMB_SIGNING_DESIRED) && -+ if ((lp_server_smb_encrypt(snum) >= SMB_SIGNING_DESIRED) && - (conn->smb2.server.cipher != 0)) - { - encryption_desired = true; - } - -- if (lp_smb_encrypt(snum) == SMB_SIGNING_REQUIRED) { -+ if (lp_server_smb_encrypt(snum) == SMB_SIGNING_REQUIRED) { - encryption_desired = true; - encryption_required = true; - } -diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c -index 7acde285a90..b745e0906b1 100644 ---- a/source3/smbd/trans2.c -+++ b/source3/smbd/trans2.c -@@ -4484,7 +4484,7 @@ static void call_trans2setfsinfo(connection_struct *conn, - return; - } - -- if (lp_smb_encrypt(SNUM(conn)) == SMB_SIGNING_OFF) { -+ if (lp_server_smb_encrypt(SNUM(conn)) == SMB_SIGNING_OFF) { - reply_nterror( - req, - NT_STATUS_NOT_SUPPORTED); --- -2.29.2 - - -From a351d15240e7c8638883155404fe2f3d70029e7e Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Thu, 28 May 2020 10:04:19 +0200 -Subject: [PATCH 005/104] param: Create and use enum_smb_encryption_vals - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher ---- - .../smbdotconf/security/serversmbencrypt.xml | 2 +- - docs-xml/smbdotconf/security/smbencrypt.xml | 2 +- - lib/param/param_table.c | 23 +++++++++++++++++++ - libcli/smb/smb_constants.h | 9 ++++++++ - 4 files changed, 34 insertions(+), 2 deletions(-) - -diff --git a/docs-xml/smbdotconf/security/serversmbencrypt.xml b/docs-xml/smbdotconf/security/serversmbencrypt.xml -index 714aacbf1ca..5f38b46419e 100644 ---- a/docs-xml/smbdotconf/security/serversmbencrypt.xml -+++ b/docs-xml/smbdotconf/security/serversmbencrypt.xml -@@ -1,7 +1,7 @@ - - - -diff --git a/docs-xml/smbdotconf/security/smbencrypt.xml b/docs-xml/smbdotconf/security/smbencrypt.xml -index 798e616b765..60271200c0a 100644 ---- a/docs-xml/smbdotconf/security/smbencrypt.xml -+++ b/docs-xml/smbdotconf/security/smbencrypt.xml -@@ -1,7 +1,7 @@ - -diff --git a/lib/param/param_table.c b/lib/param/param_table.c -index 47b85de1f87..e2f737279dc 100644 ---- a/lib/param/param_table.c -+++ b/lib/param/param_table.c -@@ -138,6 +138,29 @@ static const struct enum_list enum_smb_signing_vals[] = { - {-1, NULL} - }; - -+static const struct enum_list enum_smb_encryption_vals[] = { -+ {SMB_ENCRYPTION_DEFAULT, "default"}, -+ {SMB_ENCRYPTION_OFF, "No"}, -+ {SMB_ENCRYPTION_OFF, "False"}, -+ {SMB_ENCRYPTION_OFF, "0"}, -+ {SMB_ENCRYPTION_OFF, "Off"}, -+ {SMB_ENCRYPTION_OFF, "disabled"}, -+ {SMB_ENCRYPTION_IF_REQUIRED, "if_required"}, -+ {SMB_ENCRYPTION_IF_REQUIRED, "Yes"}, -+ {SMB_ENCRYPTION_IF_REQUIRED, "True"}, -+ {SMB_ENCRYPTION_IF_REQUIRED, "1"}, -+ {SMB_ENCRYPTION_IF_REQUIRED, "On"}, -+ {SMB_ENCRYPTION_IF_REQUIRED, "enabled"}, -+ {SMB_ENCRYPTION_IF_REQUIRED, "auto"}, -+ {SMB_ENCRYPTION_DESIRED, "desired"}, -+ {SMB_ENCRYPTION_REQUIRED, "required"}, -+ {SMB_ENCRYPTION_REQUIRED, "mandatory"}, -+ {SMB_ENCRYPTION_REQUIRED, "force"}, -+ {SMB_ENCRYPTION_REQUIRED, "forced"}, -+ {SMB_ENCRYPTION_REQUIRED, "enforced"}, -+ {-1, NULL} -+}; -+ - static const struct enum_list enum_mdns_name_values[] = { - {MDNS_NAME_NETBIOS, "netbios"}, - {MDNS_NAME_MDNS, "mdns"}, -diff --git a/libcli/smb/smb_constants.h b/libcli/smb/smb_constants.h -index d2345f094e1..8ee99e25566 100644 ---- a/libcli/smb/smb_constants.h -+++ b/libcli/smb/smb_constants.h -@@ -106,6 +106,15 @@ enum smb_signing_setting { - SMB_SIGNING_REQUIRED = 3, - }; - -+/* This MUST align with 'enum smb_signing_setting' */ -+enum smb_encryption_setting { -+ SMB_ENCRYPTION_DEFAULT = SMB_SIGNING_DEFAULT, -+ SMB_ENCRYPTION_OFF = SMB_SIGNING_OFF, -+ SMB_ENCRYPTION_IF_REQUIRED = SMB_SIGNING_IF_REQUIRED, -+ SMB_ENCRYPTION_DESIRED = SMB_SIGNING_DESIRED, -+ SMB_ENCRYPTION_REQUIRED = SMB_SIGNING_REQUIRED, -+}; -+ - /* types of buffers in core SMB protocol */ - #define SMB_DATA_BLOCK 0x1 - #define SMB_ASCII4 0x4 --- -2.29.2 - - -From 021975ea03413244d02d35940973f67956adec2b Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Tue, 26 May 2020 09:34:54 +0200 -Subject: [PATCH 006/104] s3:smbd: Use 'enum smb_encryption_setting' values - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher ---- - source3/param/loadparm.c | 2 +- - source3/smbd/service.c | 8 ++++---- - source3/smbd/smb2_negprot.c | 2 +- - source3/smbd/smb2_sesssetup.c | 4 ++-- - source3/smbd/smb2_tcon.c | 4 ++-- - source3/smbd/trans2.c | 3 ++- - 6 files changed, 12 insertions(+), 11 deletions(-) - -diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c -index c0070b716a5..4ad541301b3 100644 ---- a/source3/param/loadparm.c -+++ b/source3/param/loadparm.c -@@ -241,7 +241,7 @@ static const struct loadparm_service _sDefault = - .aio_write_size = 1, - .map_readonly = MAP_READONLY_NO, - .directory_name_cache_size = 100, -- .server_smb_encrypt = SMB_SIGNING_DEFAULT, -+ .server_smb_encrypt = SMB_ENCRYPTION_DEFAULT, - .kernel_share_modes = true, - .durable_handles = true, - .check_parent_directory_delete_on_close = false, -diff --git a/source3/smbd/service.c b/source3/smbd/service.c -index 9aa89e3eb02..d7d17d3dee1 100644 ---- a/source3/smbd/service.c -+++ b/source3/smbd/service.c -@@ -559,16 +559,16 @@ static NTSTATUS make_connection_snum(struct smbXsrv_connection *xconn, - conn_setup_case_options(conn); - - conn->encrypt_level = lp_server_smb_encrypt(snum); -- if (conn->encrypt_level > SMB_SIGNING_OFF) { -- if (lp_server_smb_encrypt(-1) == SMB_SIGNING_OFF) { -- if (conn->encrypt_level == SMB_SIGNING_REQUIRED) { -+ if (conn->encrypt_level > SMB_ENCRYPTION_OFF) { -+ if (lp_server_smb_encrypt(-1) == SMB_ENCRYPTION_OFF) { -+ if (conn->encrypt_level == SMB_ENCRYPTION_REQUIRED) { - DBG_ERR("Service [%s] requires encryption, but " - "it is disabled globally!\n", - lp_const_servicename(snum)); - status = NT_STATUS_ACCESS_DENIED; - goto err_root_exit; - } -- conn->encrypt_level = SMB_SIGNING_OFF; -+ conn->encrypt_level = SMB_ENCRYPTION_OFF; - } - } - -diff --git a/source3/smbd/smb2_negprot.c b/source3/smbd/smb2_negprot.c -index 674942b71de..99303f1b07b 100644 ---- a/source3/smbd/smb2_negprot.c -+++ b/source3/smbd/smb2_negprot.c -@@ -335,7 +335,7 @@ NTSTATUS smbd_smb2_request_process_negprot(struct smbd_smb2_request *req) - } - - if ((protocol >= PROTOCOL_SMB2_24) && -- (lp_server_smb_encrypt(-1) != SMB_SIGNING_OFF) && -+ (lp_server_smb_encrypt(-1) != SMB_ENCRYPTION_OFF) && - (in_capabilities & SMB2_CAP_ENCRYPTION)) { - capabilities |= SMB2_CAP_ENCRYPTION; - } -diff --git a/source3/smbd/smb2_sesssetup.c b/source3/smbd/smb2_sesssetup.c -index 8957411e167..907dd92321e 100644 ---- a/source3/smbd/smb2_sesssetup.c -+++ b/source3/smbd/smb2_sesssetup.c -@@ -292,12 +292,12 @@ static NTSTATUS smbd_smb2_auth_generic_return(struct smbXsrv_session *session, - x->global->signing_flags = SMBXSRV_SIGNING_REQUIRED; - } - -- if ((lp_server_smb_encrypt(-1) >= SMB_SIGNING_DESIRED) && -+ if ((lp_server_smb_encrypt(-1) >= SMB_ENCRYPTION_DESIRED) && - (xconn->smb2.client.capabilities & SMB2_CAP_ENCRYPTION)) { - x->global->encryption_flags = SMBXSRV_ENCRYPTION_DESIRED; - } - -- if (lp_server_smb_encrypt(-1) == SMB_SIGNING_REQUIRED) { -+ if (lp_server_smb_encrypt(-1) == SMB_ENCRYPTION_REQUIRED) { - x->global->encryption_flags = SMBXSRV_ENCRYPTION_REQUIRED | - SMBXSRV_ENCRYPTION_DESIRED; - } -diff --git a/source3/smbd/smb2_tcon.c b/source3/smbd/smb2_tcon.c -index 0dd3c653b4b..d7e0cf90f47 100644 ---- a/source3/smbd/smb2_tcon.c -+++ b/source3/smbd/smb2_tcon.c -@@ -302,13 +302,13 @@ static NTSTATUS smbd_smb2_tree_connect(struct smbd_smb2_request *req, - TALLOC_FREE(proxy); - } - -- if ((lp_server_smb_encrypt(snum) >= SMB_SIGNING_DESIRED) && -+ if ((lp_server_smb_encrypt(snum) >= SMB_ENCRYPTION_DESIRED) && - (conn->smb2.server.cipher != 0)) - { - encryption_desired = true; - } - -- if (lp_server_smb_encrypt(snum) == SMB_SIGNING_REQUIRED) { -+ if (lp_server_smb_encrypt(snum) == SMB_ENCRYPTION_REQUIRED) { - encryption_desired = true; - encryption_required = true; - } -diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c -index b745e0906b1..2f2fdcb7260 100644 ---- a/source3/smbd/trans2.c -+++ b/source3/smbd/trans2.c -@@ -4484,7 +4484,8 @@ static void call_trans2setfsinfo(connection_struct *conn, - return; - } - -- if (lp_server_smb_encrypt(SNUM(conn)) == SMB_SIGNING_OFF) { -+ if (lp_server_smb_encrypt(SNUM(conn)) == -+ SMB_ENCRYPTION_OFF) { - reply_nterror( - req, - NT_STATUS_NOT_SUPPORTED); --- -2.29.2 - - -From 7153b9b229a2feea129f1bb1cd423dd4e79d5a05 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Thu, 9 Apr 2020 10:38:41 +0200 -Subject: [PATCH 007/104] docs-xml: Add 'client smb encrypt' - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher ---- - .../smbdotconf/security/clientsmbencrypt.xml | 126 ++++++++++++++++++ - lib/param/loadparm.c | 4 + - source3/param/loadparm.c | 2 + - 3 files changed, 132 insertions(+) - create mode 100644 docs-xml/smbdotconf/security/clientsmbencrypt.xml - -diff --git a/docs-xml/smbdotconf/security/clientsmbencrypt.xml b/docs-xml/smbdotconf/security/clientsmbencrypt.xml -new file mode 100644 -index 00000000000..05df152e734 ---- /dev/null -+++ b/docs-xml/smbdotconf/security/clientsmbencrypt.xml -@@ -0,0 +1,126 @@ -+ -+ -+ -+ This parameter controls whether a client should try or is required -+ to use SMB encryption. It has different effects depending on whether -+ the connection uses SMB1 or SMB3: -+ -+ -+ -+ -+ -+ If the connection uses SMB1, then this option controls the use -+ of a Samba-specific extension to the SMB protocol introduced in -+ Samba 3.2 that makes use of the Unix extensions. -+ -+ -+ -+ -+ -+ If the connection uses SMB2 or newer, then this option controls -+ the use of the SMB-level encryption that is supported in SMB -+ version 3.0 and above and available in Windows 8 and newer. -+ -+ -+ -+ -+ -+ This parameter can be set globally. Possible values are -+ -+ off, -+ if_required, -+ desired, -+ and -+ required. -+ A special value is default which is -+ the implicit default setting of if_required. -+ -+ -+ -+ -+ Effects for SMB1 -+ -+ -+ The Samba-specific encryption of SMB1 connections is an -+ extension to the SMB protocol negotiated as part of the UNIX -+ extensions. SMB encryption uses the GSSAPI (SSPI on Windows) -+ ability to encrypt and sign every request/response in a SMB -+ protocol stream. When enabled it provides a secure method of -+ SMB/CIFS communication, similar to an ssh protected session, but -+ using SMB/CIFS authentication to negotiate encryption and -+ signing keys. Currently this is only supported smbclient of by -+ Samba 3.2 and newer. Windows does not support this feature. -+ -+ -+ -+ When set to default, SMB encryption is probed, but not -+ enforced. When set to required, SMB encryption is required and -+ if set to disabled, SMB encryption can not be negotiated. -+ -+ -+ -+ -+ -+ Effects for SMB3 and newer -+ -+ -+ Native SMB transport encryption is available in SMB version 3.0 -+ or newer. It is only used by Samba if -+ client max protocol is set to -+ SMB3 or newer. -+ -+ -+ -+ These features can be controlled with settings of -+ client smb encrypt as follows: -+ -+ -+ -+ -+ -+ Leaving it as default, explicitly setting -+ default, or setting it to -+ if_required globally will enable -+ negotiation of encryption but will not turn on -+ data encryption globally. -+ -+ -+ -+ -+ -+ Setting it to desired globally -+ will enable negotiation and will turn on data encryption -+ on sessions and share connections for those servers -+ that support it. -+ -+ -+ -+ -+ -+ Setting it to required globally -+ will enable negotiation and turn on data encryption -+ on sessions and share connections. Clients that do -+ not support encryption will be denied access to the -+ server. -+ -+ -+ -+ -+ -+ Setting it to off globally will -+ completely disable the encryption feature for all -+ connections. -+ -+ -+ -+ -+ -+ -+ -+ -+default -+ -diff --git a/lib/param/loadparm.c b/lib/param/loadparm.c -index 006caabc092..67f5709b213 100644 ---- a/lib/param/loadparm.c -+++ b/lib/param/loadparm.c -@@ -3079,6 +3079,10 @@ struct loadparm_context *loadparm_init(TALLOC_CTX *mem_ctx) - lpcfg_do_global_parameter( - lp_ctx, "ldap max search request size", "256000"); - -+ lpcfg_do_global_parameter(lp_ctx, -+ "client smb encrypt", -+ "default"); -+ - for (i = 0; parm_table[i].label; i++) { - if (!(lp_ctx->flags[i] & FLAG_CMDLINE)) { - lp_ctx->flags[i] |= FLAG_DEFAULT; -diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c -index 4ad541301b3..6418a42b6eb 100644 ---- a/source3/param/loadparm.c -+++ b/source3/param/loadparm.c -@@ -960,6 +960,8 @@ static void init_globals(struct loadparm_context *lp_ctx, bool reinit_globals) - Globals.ldap_max_authenticated_request_size = 16777216; - Globals.ldap_max_search_request_size = 256000; - -+ Globals.client_smb_encrypt = SMB_ENCRYPTION_DEFAULT; -+ - /* Now put back the settings that were set with lp_set_cmdline() */ - apply_lp_set_cmdline(); - } --- -2.29.2 - - -From f151e19473330373801c4d85ef3d5ce0918ac17d Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Wed, 22 Jul 2020 17:48:25 +0200 -Subject: [PATCH 008/104] lib:param: Add lpcfg_parse_enum_vals() - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher ---- - lib/param/loadparm.c | 30 ++++++++++++++++++++++++++++++ - lib/param/loadparm.h | 2 ++ - 2 files changed, 32 insertions(+) - -diff --git a/lib/param/loadparm.c b/lib/param/loadparm.c -index 67f5709b213..b1410791c60 100644 ---- a/lib/param/loadparm.c -+++ b/lib/param/loadparm.c -@@ -3675,3 +3675,33 @@ char *lpcfg_substituted_string(TALLOC_CTX *mem_ctx, - raw_value, - lp_sub->private_data); - } -+ -+/** -+ * @brief Parse a string value of a given parameter to its integer enum value. -+ * -+ * @param[in] param_name The parameter name (e.g. 'client smb encrypt') -+ * -+ * @param[in] param_value The parameter value (e.g. 'required'). -+ * -+ * @return The integer value of the enum the param_value matches or INT32_MIN -+ * on error. -+ */ -+int32_t lpcfg_parse_enum_vals(const char *param_name, -+ const char *param_value) -+{ -+ struct parm_struct *parm = NULL; -+ int32_t ret = INT32_MIN; -+ bool ok; -+ -+ parm = lpcfg_parm_struct(NULL, param_name); -+ if (parm == NULL) { -+ return INT32_MIN; -+ } -+ -+ ok = lp_set_enum_parm(parm, param_value, &ret); -+ if (!ok) { -+ return INT32_MIN; -+ } -+ -+ return ret; -+} -diff --git a/lib/param/loadparm.h b/lib/param/loadparm.h -index 323fcf84523..e66ce2324b4 100644 ---- a/lib/param/loadparm.h -+++ b/lib/param/loadparm.h -@@ -316,6 +316,8 @@ bool lp_do_section(const char *pszSectionName, void *userdata); - bool store_lp_set_cmdline(const char *pszParmName, const char *pszParmValue); - - int num_parameters(void); -+int32_t lpcfg_parse_enum_vals(const char *param_name, -+ const char *param_value); - - struct loadparm_substitution; - #ifdef LOADPARM_SUBSTITUTION_INTERNALS --- -2.29.2 - - -From 6364c5bcde41ed5bdb478747511003796a601e74 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Wed, 9 Oct 2019 09:38:08 +0200 -Subject: [PATCH 009/104] libcli:smb: Add smb_signing_setting_translate() - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher ---- - libcli/smb/smb_util.h | 7 ++++ - libcli/smb/test_util_translate.c | 64 ++++++++++++++++++++++++++++++++ - libcli/smb/util.c | 20 ++++++++++ - libcli/smb/wscript | 5 +++ - selftest/tests.py | 2 + - 5 files changed, 98 insertions(+) - create mode 100644 libcli/smb/test_util_translate.c - -diff --git a/libcli/smb/smb_util.h b/libcli/smb/smb_util.h -index 8861741c92f..15bdbe856d1 100644 ---- a/libcli/smb/smb_util.h -+++ b/libcli/smb/smb_util.h -@@ -24,6 +24,9 @@ - #include "smb_constants.h" - #include - -+#ifndef _SMB_UTIL_H -+#define _SMB_UTIL_H -+ - const char *smb_protocol_types_string(enum protocol_types protocol); - char *attrib_string(TALLOC_CTX *mem_ctx, uint32_t attrib); - uint32_t unix_perms_to_wire(mode_t perms); -@@ -46,3 +49,7 @@ NTSTATUS smb_bytes_pull_str(TALLOC_CTX *mem_ctx, char **_str, bool ucs2, - const uint8_t *buf, size_t buf_len, - const uint8_t *position, - size_t *_consumed); -+ -+enum smb_signing_setting smb_signing_setting_translate(const char *str); -+ -+#endif /* _SMB_UTIL_H */ -diff --git a/libcli/smb/test_util_translate.c b/libcli/smb/test_util_translate.c -new file mode 100644 -index 00000000000..4b81984affa ---- /dev/null -+++ b/libcli/smb/test_util_translate.c -@@ -0,0 +1,64 @@ -+/* -+ * Unix SMB/CIFS implementation. -+ * -+ * Copyright (C) 2020 Andreas Schneider -+ * -+ * This program is free software; you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License as published by -+ * the Free Software Foundation; either version 3 of the License, or -+ * (at your option) any later version. -+ * -+ * This program is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ * GNU General Public License for more details. -+ * -+ * You should have received a copy of the GNU General Public License -+ * along with this program. If not, see . -+ */ -+ -+#include -+#include -+#include -+#include -+#include -+ -+#include "lib/replace/replace.h" -+#include -+ -+#include "libcli/smb/util.c" -+ -+static void test_smb_signing_setting_translate(void **state) -+{ -+ enum smb_signing_setting signing_state; -+ -+ signing_state = smb_signing_setting_translate("wurst"); -+ assert_int_equal(signing_state, SMB_SIGNING_REQUIRED); -+ -+ signing_state = smb_signing_setting_translate("off"); -+ assert_int_equal(signing_state, SMB_SIGNING_OFF); -+ -+ signing_state = smb_signing_setting_translate("if_required"); -+ assert_int_equal(signing_state, SMB_SIGNING_IF_REQUIRED); -+ -+ signing_state = smb_signing_setting_translate("mandatory"); -+ assert_int_equal(signing_state, SMB_SIGNING_REQUIRED); -+ -+} -+ -+int main(int argc, char *argv[]) -+{ -+ int rc; -+ const struct CMUnitTest tests[] = { -+ cmocka_unit_test(test_smb_signing_setting_translate), -+ }; -+ -+ if (argc == 2) { -+ cmocka_set_test_filter(argv[1]); -+ } -+ cmocka_set_message_output(CM_OUTPUT_SUBUNIT); -+ -+ rc = cmocka_run_group_tests(tests, NULL, NULL); -+ -+ return rc; -+} -diff --git a/libcli/smb/util.c b/libcli/smb/util.c -index 6fdf35fbbf3..da0e4db2bf3 100644 ---- a/libcli/smb/util.c -+++ b/libcli/smb/util.c -@@ -22,6 +22,7 @@ - #include "includes.h" - #include "libcli/smb/smb_common.h" - #include "system/filesys.h" -+#include "lib/param/loadparm.h" - - const char *smb_protocol_types_string(enum protocol_types protocol) - { -@@ -428,3 +429,22 @@ NTSTATUS smb_bytes_pull_str(TALLOC_CTX *mem_ctx, char **_str, bool ucs2, - return internal_bytes_pull_str(mem_ctx, _str, ucs2, true, - buf, buf_len, position, _consumed); - } -+ -+/** -+ * @brief Translate SMB signing settings as string to an enum. -+ * -+ * @param[in] str The string to translate. -+ * -+ * @return A corresponding enum @smb_signing_setting tranlated from the string. -+ */ -+enum smb_signing_setting smb_signing_setting_translate(const char *str) -+{ -+ enum smb_signing_setting signing_state = SMB_SIGNING_REQUIRED; -+ int32_t val = lpcfg_parse_enum_vals("client signing", str); -+ -+ if (val != INT32_MIN) { -+ signing_state = val; -+ } -+ -+ return signing_state; -+} -diff --git a/libcli/smb/wscript b/libcli/smb/wscript -index 86e377f570b..c047fd33278 100644 ---- a/libcli/smb/wscript -+++ b/libcli/smb/wscript -@@ -72,3 +72,8 @@ def build(bld): - source='test_smb1cli_session.c', - deps='cmocka cli_smb_common', - for_selftest=True) -+ -+ bld.SAMBA_BINARY('test_util_translate', -+ source='test_util_translate.c', -+ deps='cmocka cli_smb_common', -+ for_selftest=True) -diff --git a/selftest/tests.py b/selftest/tests.py -index 6918e1306c3..20981754db4 100644 ---- a/selftest/tests.py -+++ b/selftest/tests.py -@@ -376,6 +376,8 @@ plantestsuite("samba.unittests.lib_util_modules", "none", - - plantestsuite("samba.unittests.smb1cli_session", "none", - [os.path.join(bindir(), "default/libcli/smb/test_smb1cli_session")]) -+plantestsuite("samba.unittests.smb_util_translate", "none", -+ [os.path.join(bindir(), "default/libcli/smb/test_util_translate")]) - - plantestsuite("samba.unittests.talloc_keep_secret", "none", - [os.path.join(bindir(), "default/lib/util/test_talloc_keep_secret")]) --- -2.29.2 - - -From 8ceec22ead224c3581b18b0fc95cb7f7f9c061a8 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Tue, 26 May 2020 08:39:34 +0200 -Subject: [PATCH 010/104] libcli:smb: Add smb_encryption_setting_translate() - -Add encryption enum and function to avoid confusion when reading the -code. - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher ---- - libcli/smb/smb_util.h | 1 + - libcli/smb/test_util_translate.c | 19 +++++++++++++++++++ - libcli/smb/util.c | 20 ++++++++++++++++++++ - 3 files changed, 40 insertions(+) - -diff --git a/libcli/smb/smb_util.h b/libcli/smb/smb_util.h -index 15bdbe856d1..2a727db8b6f 100644 ---- a/libcli/smb/smb_util.h -+++ b/libcli/smb/smb_util.h -@@ -51,5 +51,6 @@ NTSTATUS smb_bytes_pull_str(TALLOC_CTX *mem_ctx, char **_str, bool ucs2, - size_t *_consumed); - - enum smb_signing_setting smb_signing_setting_translate(const char *str); -+enum smb_encryption_setting smb_encryption_setting_translate(const char *str); - - #endif /* _SMB_UTIL_H */ -diff --git a/libcli/smb/test_util_translate.c b/libcli/smb/test_util_translate.c -index 4b81984affa..b300af52c09 100644 ---- a/libcli/smb/test_util_translate.c -+++ b/libcli/smb/test_util_translate.c -@@ -46,11 +46,30 @@ static void test_smb_signing_setting_translate(void **state) - - } - -+static void test_smb_encryption_setting_translate(void **state) -+{ -+ enum smb_encryption_setting encryption_state; -+ -+ encryption_state = smb_encryption_setting_translate("wurst"); -+ assert_int_equal(encryption_state, SMB_ENCRYPTION_REQUIRED); -+ -+ encryption_state = smb_encryption_setting_translate("off"); -+ assert_int_equal(encryption_state, SMB_ENCRYPTION_OFF); -+ -+ encryption_state = smb_encryption_setting_translate("if_required"); -+ assert_int_equal(encryption_state, SMB_ENCRYPTION_IF_REQUIRED); -+ -+ encryption_state = smb_encryption_setting_translate("mandatory"); -+ assert_int_equal(encryption_state, SMB_ENCRYPTION_REQUIRED); -+ -+} -+ - int main(int argc, char *argv[]) - { - int rc; - const struct CMUnitTest tests[] = { - cmocka_unit_test(test_smb_signing_setting_translate), -+ cmocka_unit_test(test_smb_encryption_setting_translate), - }; - - if (argc == 2) { -diff --git a/libcli/smb/util.c b/libcli/smb/util.c -index da0e4db2bf3..ac2887ee5c4 100644 ---- a/libcli/smb/util.c -+++ b/libcli/smb/util.c -@@ -448,3 +448,23 @@ enum smb_signing_setting smb_signing_setting_translate(const char *str) - - return signing_state; - } -+ -+/** -+ * @brief Translate SMB encryption settings as string to an enum. -+ * -+ * @param[in] str The string to translate. -+ * -+ * @return A corresponding enum @smb_encryption_setting tranlated from the -+ * string. -+ */ -+enum smb_encryption_setting smb_encryption_setting_translate(const char *str) -+{ -+ enum smb_encryption_setting encryption_state = SMB_ENCRYPTION_REQUIRED; -+ int32_t val = lpcfg_parse_enum_vals("client smb encrypt", str); -+ -+ if (val != INT32_MIN) { -+ encryption_state = val; -+ } -+ -+ return encryption_state; -+} --- -2.29.2 - - -From dc53c158acdeffc6e53436359a56bcf7071b3d83 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Wed, 9 Oct 2019 09:47:59 +0200 -Subject: [PATCH 011/104] s3:lib: Use smb_signing_setting_translate for cmdline - parsing - -The function will be removed soon. - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher ---- - source3/lib/util_cmdline.c | 17 +++-------------- - source3/wscript_build | 2 +- - 2 files changed, 4 insertions(+), 15 deletions(-) - -diff --git a/source3/lib/util_cmdline.c b/source3/lib/util_cmdline.c -index 90ee67c4cb7..bc1f1c3ed25 100644 ---- a/source3/lib/util_cmdline.c -+++ b/source3/lib/util_cmdline.c -@@ -28,6 +28,7 @@ - #include "librpc/gen_ndr/samr.h" - #include "auth/credentials/credentials.h" - #include "auth/gensec/gensec.h" -+#include "libcli/smb/smb_util.h" - - /**************************************************************************n - Code to cope with username/password auth options from the commandline. -@@ -240,20 +241,8 @@ void set_cmdline_auth_info_password(struct user_auth_info *auth_info, - bool set_cmdline_auth_info_signing_state(struct user_auth_info *auth_info, - const char *arg) - { -- auth_info->signing_state = SMB_SIGNING_DEFAULT; -- if (strequal(arg, "off") || strequal(arg, "no") || -- strequal(arg, "false")) { -- auth_info->signing_state = SMB_SIGNING_OFF; -- } else if (strequal(arg, "on") || strequal(arg, "yes") || -- strequal(arg, "if_required") || -- strequal(arg, "true") || strequal(arg, "auto")) { -- auth_info->signing_state = SMB_SIGNING_IF_REQUIRED; -- } else if (strequal(arg, "force") || strequal(arg, "required") || -- strequal(arg, "forced")) { -- auth_info->signing_state = SMB_SIGNING_REQUIRED; -- } else { -- return false; -- } -+ auth_info->signing_state = smb_signing_setting_translate(arg); -+ - return true; - } - -diff --git a/source3/wscript_build b/source3/wscript_build -index d86a9fcadbf..c1051c62393 100644 ---- a/source3/wscript_build -+++ b/source3/wscript_build -@@ -279,7 +279,7 @@ bld.SAMBA3_LIBRARY('popt_samba3_cmdline', - - bld.SAMBA3_LIBRARY('util_cmdline', - source='lib/util_cmdline.c', -- deps='secrets3 samba-credentials', -+ deps='secrets3 samba-credentials cli_smb_common', - private_library=True) - - bld.SAMBA3_LIBRARY('cmdline_contexts', --- -2.29.2 - - -From c6f52fc629ca09e450b3bd0c1bdc56fdabeae141 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Thu, 23 Jul 2020 07:47:18 +0200 -Subject: [PATCH 012/104] auth:creds: Remove unused credentials autoproto - header - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher ---- - auth/credentials/credentials_krb5.c | 1 - - auth/credentials/credentials_secrets.c | 1 - - auth/credentials/wscript_build | 1 - - source4/auth/kerberos/kerberos_util.c | 1 - - source4/auth/tests/kerberos.c | 1 - - 5 files changed, 5 deletions(-) - -diff --git a/auth/credentials/credentials_krb5.c b/auth/credentials/credentials_krb5.c -index 20e677e521a..259b35b73b0 100644 ---- a/auth/credentials/credentials_krb5.c -+++ b/auth/credentials/credentials_krb5.c -@@ -27,7 +27,6 @@ - #include "auth/kerberos/kerberos.h" - #include "auth/credentials/credentials.h" - #include "auth/credentials/credentials_internal.h" --#include "auth/credentials/credentials_proto.h" - #include "auth/credentials/credentials_krb5.h" - #include "auth/kerberos/kerberos_credentials.h" - #include "auth/kerberos/kerberos_srv_keytab.h" -diff --git a/auth/credentials/credentials_secrets.c b/auth/credentials/credentials_secrets.c -index 54f3ce2d078..52a89d4d5b4 100644 ---- a/auth/credentials/credentials_secrets.c -+++ b/auth/credentials/credentials_secrets.c -@@ -29,7 +29,6 @@ - #include "system/filesys.h" - #include "auth/credentials/credentials.h" - #include "auth/credentials/credentials_internal.h" --#include "auth/credentials/credentials_proto.h" - #include "auth/credentials/credentials_krb5.h" - #include "auth/kerberos/kerberos_util.h" - #include "param/param.h" -diff --git a/auth/credentials/wscript_build b/auth/credentials/wscript_build -index f5aba1de248..564a04fe8dd 100644 ---- a/auth/credentials/wscript_build -+++ b/auth/credentials/wscript_build -@@ -2,7 +2,6 @@ - - bld.SAMBA_LIBRARY('samba-credentials', - source='credentials.c', -- autoproto='credentials_proto.h', - public_headers='credentials.h', - pc_files='samba-credentials.pc', - deps='LIBCRYPTO samba-errors events LIBCLI_AUTH samba-security CREDENTIALS_SECRETS CREDENTIALS_KRB5', -diff --git a/source4/auth/kerberos/kerberos_util.c b/source4/auth/kerberos/kerberos_util.c -index ffef24f285c..544d9d853cc 100644 ---- a/source4/auth/kerberos/kerberos_util.c -+++ b/source4/auth/kerberos/kerberos_util.c -@@ -24,7 +24,6 @@ - #include "system/kerberos.h" - #include "auth/kerberos/kerberos.h" - #include "auth/credentials/credentials.h" --#include "auth/credentials/credentials_proto.h" - #include "auth/credentials/credentials_krb5.h" - #include "auth/kerberos/kerberos_credentials.h" - #include "auth/kerberos/kerberos_util.h" -diff --git a/source4/auth/tests/kerberos.c b/source4/auth/tests/kerberos.c -index 7711eac2afa..d9be3562adb 100644 ---- a/source4/auth/tests/kerberos.c -+++ b/source4/auth/tests/kerberos.c -@@ -10,7 +10,6 @@ - #include "system/kerberos.h" - #include "auth/kerberos/kerberos.h" - #include "auth/credentials/credentials.h" --#include "auth/credentials/credentials_proto.h" - #include "auth/credentials/credentials_krb5.h" - #include "auth/kerberos/kerberos_credentials.h" - #include "auth/kerberos/kerberos_util.h" --- -2.29.2 - - -From 62bca83b540c9402d86f0668839150d2abf3adec Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Tue, 26 May 2020 09:32:44 +0200 -Subject: [PATCH 013/104] auth:creds: Add - cli_credentials_(get|set)_smb_signing() - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher ---- - auth/credentials/credentials.c | 45 +++++++++++++++++++++++++ - auth/credentials/credentials.h | 7 ++++ - auth/credentials/credentials_internal.h | 4 +++ - 3 files changed, 56 insertions(+) - -diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c -index 80a31b248ae..365a6def7ea 100644 ---- a/auth/credentials/credentials.c -+++ b/auth/credentials/credentials.c -@@ -44,6 +44,8 @@ _PUBLIC_ struct cli_credentials *cli_credentials_init(TALLOC_CTX *mem_ctx) - - cred->winbind_separator = '\\'; - -+ cred->signing_state = SMB_SIGNING_DEFAULT; -+ - return cred; - } - -@@ -922,6 +924,12 @@ _PUBLIC_ void cli_credentials_set_conf(struct cli_credentials *cred, - if (sep != NULL && sep[0] != '\0') { - cred->winbind_separator = *lpcfg_winbind_separator(lp_ctx); - } -+ -+ if (cred->signing_state_obtained <= CRED_SMB_CONF) { -+ /* Will be set to default for invalid smb.conf values */ -+ cred->signing_state = lpcfg_client_signing(lp_ctx); -+ cred->signing_state_obtained = CRED_SMB_CONF; -+ } - } - - /** -@@ -1304,6 +1312,43 @@ _PUBLIC_ bool cli_credentials_parse_password_fd(struct cli_credentials *credenti - return true; - } - -+/** -+ * @brief Set the SMB signing state to request for a SMB connection. -+ * -+ * @param[in] creds The credentials structure to update. -+ * -+ * @param[in] signing_state The signing state to set. -+ * -+ * @param obtained This way the described signing state was specified. -+ * -+ * @return true if we could set the signing state, false otherwise. -+ */ -+_PUBLIC_ bool cli_credentials_set_smb_signing(struct cli_credentials *creds, -+ enum smb_signing_setting signing_state, -+ enum credentials_obtained obtained) -+{ -+ if (obtained >= creds->signing_state_obtained) { -+ creds->signing_state_obtained = obtained; -+ creds->signing_state = signing_state; -+ return true; -+ } -+ -+ return false; -+} -+ -+/** -+ * @brief Obtain the SMB signing state from a credentials structure. -+ * -+ * @param[in] creds The credential structure to obtain the SMB signing state -+ * from. -+ * -+ * @return The SMB singing state. -+ */ -+_PUBLIC_ enum smb_signing_setting -+cli_credentials_get_smb_signing(struct cli_credentials *creds) -+{ -+ return creds->signing_state; -+} - - /** - * Encrypt a data blob using the session key and the negotiated encryption -diff --git a/auth/credentials/credentials.h b/auth/credentials/credentials.h -index 7154c2a008c..422391ad585 100644 ---- a/auth/credentials/credentials.h -+++ b/auth/credentials/credentials.h -@@ -38,6 +38,7 @@ struct gssapi_creds_container; - struct smb_krb5_context; - struct keytab_container; - struct db_context; -+enum smb_signing_setting; - - /* In order of priority */ - enum credentials_obtained { -@@ -290,6 +291,12 @@ void *_cli_credentials_callback_data(struct cli_credentials *cred); - #define cli_credentials_callback_data_void(_cred) \ - _cli_credentials_callback_data(_cred) - -+bool cli_credentials_set_smb_signing(struct cli_credentials *cred, -+ enum smb_signing_setting signing_state, -+ enum credentials_obtained obtained); -+enum smb_signing_setting -+cli_credentials_get_smb_signing(struct cli_credentials *cred); -+ - /** - * Return attached NETLOGON credentials - */ -diff --git a/auth/credentials/credentials_internal.h b/auth/credentials/credentials_internal.h -index 68f1f25dce1..9cde0000b5f 100644 ---- a/auth/credentials/credentials_internal.h -+++ b/auth/credentials/credentials_internal.h -@@ -24,6 +24,7 @@ - - #include "../lib/util/data_blob.h" - #include "librpc/gen_ndr/misc.h" -+#include "libcli/smb/smb_constants.h" - - struct cli_credentials { - enum credentials_obtained workstation_obtained; -@@ -36,6 +37,7 @@ struct cli_credentials { - enum credentials_obtained principal_obtained; - enum credentials_obtained keytab_obtained; - enum credentials_obtained server_gss_creds_obtained; -+ enum credentials_obtained signing_state_obtained; - - /* Threshold values (essentially a MAX() over a number of the - * above) for the ccache and GSS credentials, to ensure we -@@ -117,6 +119,8 @@ struct cli_credentials { - char winbind_separator; - - bool password_will_be_nt_hash; -+ -+ enum smb_signing_setting signing_state; - }; - - #endif /* __CREDENTIALS_INTERNAL_H__ */ --- -2.29.2 - - -From a14f3c5f3f39173650bd56ee034bd35ea111ee07 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Wed, 3 Jun 2020 11:56:01 +0200 -Subject: [PATCH 014/104] auth:creds: Add python bindings for - (get|set)_smb_signing - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher ---- - auth/credentials/pycredentials.c | 63 +++++++++++++++++++++++++++++++ - python/samba/tests/credentials.py | 6 +++ - 2 files changed, 69 insertions(+) - -diff --git a/auth/credentials/pycredentials.c b/auth/credentials/pycredentials.c -index 68edc282741..846c418419f 100644 ---- a/auth/credentials/pycredentials.c -+++ b/auth/credentials/pycredentials.c -@@ -34,6 +34,7 @@ - #include "auth/credentials/credentials_internal.h" - #include "system/kerberos.h" - #include "auth/kerberos/kerberos.h" -+#include "libcli/smb/smb_constants.h" - - void initcredentials(void); - -@@ -929,6 +930,52 @@ static PyObject *py_creds_encrypt_netr_crypt_password(PyObject *self, - Py_RETURN_NONE; - } - -+static PyObject *py_creds_get_smb_signing(PyObject *self, PyObject *unused) -+{ -+ enum smb_signing_setting signing_state; -+ struct cli_credentials *creds = NULL; -+ -+ creds = PyCredentials_AsCliCredentials(self); -+ if (creds == NULL) { -+ PyErr_Format(PyExc_TypeError, "Credentials expected"); -+ return NULL; -+ } -+ -+ signing_state = cli_credentials_get_smb_signing(creds); -+ return PyLong_FromLong(signing_state); -+} -+ -+static PyObject *py_creds_set_smb_signing(PyObject *self, PyObject *args) -+{ -+ enum smb_signing_setting signing_state; -+ struct cli_credentials *creds = NULL; -+ enum credentials_obtained obt = CRED_SPECIFIED; -+ -+ creds = PyCredentials_AsCliCredentials(self); -+ if (creds == NULL) { -+ PyErr_Format(PyExc_TypeError, "Credentials expected"); -+ return NULL; -+ } -+ if (!PyArg_ParseTuple(args, "i|i", &signing_state, &obt)) { -+ return NULL; -+ } -+ -+ switch (signing_state) { -+ case SMB_SIGNING_DEFAULT: -+ case SMB_SIGNING_OFF: -+ case SMB_SIGNING_IF_REQUIRED: -+ case SMB_SIGNING_DESIRED: -+ case SMB_SIGNING_REQUIRED: -+ break; -+ default: -+ PyErr_Format(PyExc_TypeError, "Invalid signing state value"); -+ return NULL; -+ } -+ -+ cli_credentials_set_smb_signing(creds, signing_state, obt); -+ Py_RETURN_NONE; -+} -+ - static PyMethodDef py_creds_methods[] = { - { - .ml_name = "get_username", -@@ -1209,6 +1256,16 @@ static PyMethodDef py_creds_methods[] = { - "Encrypt the supplied password using the session key and\n" - "the negotiated encryption algorithm in place\n" - "i.e. it overwrites the original data"}, -+ { -+ .ml_name = "get_smb_signing", -+ .ml_meth = py_creds_get_smb_signing, -+ .ml_flags = METH_NOARGS, -+ }, -+ { -+ .ml_name = "set_smb_signing", -+ .ml_meth = py_creds_set_smb_signing, -+ .ml_flags = METH_VARARGS, -+ }, - { .ml_name = NULL } - }; - -@@ -1295,6 +1352,12 @@ MODULE_INIT_FUNC(credentials) - PyModule_AddObject(m, "CLI_CRED_NTLM_AUTH", PyLong_FromLong(CLI_CRED_NTLM_AUTH)); - PyModule_AddObject(m, "CLI_CRED_CLEAR_AUTH", PyLong_FromLong(CLI_CRED_CLEAR_AUTH)); - -+ PyModule_AddObject(m, "SMB_SIGNING_DEFAULT", PyLong_FromLong(SMB_SIGNING_DEFAULT)); -+ PyModule_AddObject(m, "SMB_SIGNING_OFF", PyLong_FromLong(SMB_SIGNING_OFF)); -+ PyModule_AddObject(m, "SMB_SIGNING_IF_REQUIRED", PyLong_FromLong(SMB_SIGNING_IF_REQUIRED)); -+ PyModule_AddObject(m, "SMB_SIGNING_DESIRED", PyLong_FromLong(SMB_SIGNING_DESIRED)); -+ PyModule_AddObject(m, "SMB_SIGNING_REQUIRED", PyLong_FromLong(SMB_SIGNING_REQUIRED)); -+ - Py_INCREF(&PyCredentials); - PyModule_AddObject(m, "Credentials", (PyObject *)&PyCredentials); - Py_INCREF(&PyCredentialCacheContainer); -diff --git a/python/samba/tests/credentials.py b/python/samba/tests/credentials.py -index 6454ac9ff7c..e5f8122fa21 100644 ---- a/python/samba/tests/credentials.py -+++ b/python/samba/tests/credentials.py -@@ -456,3 +456,9 @@ class CredentialsTests(samba.tests.TestCaseInTempDir): - self.assertEqual(creds.get_principal(), "user@samba.org") - self.assertEqual(creds.is_anonymous(), False) - self.assertEqual(creds.authentication_requested(), True) -+ -+ def test_smb_signing(self): -+ creds = credentials.Credentials() -+ self.assertEqual(creds.get_smb_signing(), credentials.SMB_SIGNING_DEFAULT) -+ creds.set_smb_signing(credentials.SMB_SIGNING_REQUIRED) -+ self.assertEqual(creds.get_smb_signing(), credentials.SMB_SIGNING_REQUIRED) --- -2.29.2 - - -From 9fdc98da5c625acd11205b2bb28deb780ef905ec Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Thu, 28 May 2020 16:31:35 +0200 -Subject: [PATCH 015/104] auth:creds: Add - cli_credentials_(get|set)_smb_ipc_signing() - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher ---- - auth/credentials/credentials.c | 51 +++++++++++++++++++++++++ - auth/credentials/credentials.h | 6 +++ - auth/credentials/credentials_internal.h | 3 ++ - 3 files changed, 60 insertions(+) - -diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c -index 365a6def7ea..dc5d51f1424 100644 ---- a/auth/credentials/credentials.c -+++ b/auth/credentials/credentials.c -@@ -46,6 +46,12 @@ _PUBLIC_ struct cli_credentials *cli_credentials_init(TALLOC_CTX *mem_ctx) - - cred->signing_state = SMB_SIGNING_DEFAULT; - -+ /* -+ * The default value of lpcfg_client_ipc_signing() is REQUIRED, so use -+ * the same value here. -+ */ -+ cred->ipc_signing_state = SMB_SIGNING_REQUIRED; -+ - return cred; - } - -@@ -930,6 +936,12 @@ _PUBLIC_ void cli_credentials_set_conf(struct cli_credentials *cred, - cred->signing_state = lpcfg_client_signing(lp_ctx); - cred->signing_state_obtained = CRED_SMB_CONF; - } -+ -+ if (cred->ipc_signing_state_obtained <= CRED_SMB_CONF) { -+ /* Will be set to required for invalid smb.conf values */ -+ cred->ipc_signing_state = lpcfg_client_ipc_signing(lp_ctx); -+ cred->ipc_signing_state_obtained = CRED_SMB_CONF; -+ } - } - - /** -@@ -1350,6 +1362,45 @@ cli_credentials_get_smb_signing(struct cli_credentials *creds) - return creds->signing_state; - } - -+/** -+ * @brief Set the SMB IPC signing state to request for a SMB connection. -+ * -+ * @param[in] creds The credentials structure to update. -+ * -+ * @param[in] signing_state The signing state to set. -+ * -+ * @param obtained This way the described signing state was specified. -+ * -+ * @return true if we could set the signing state, false otherwise. -+ */ -+_PUBLIC_ bool -+cli_credentials_set_smb_ipc_signing(struct cli_credentials *creds, -+ enum smb_signing_setting ipc_signing_state, -+ enum credentials_obtained obtained) -+{ -+ if (obtained >= creds->ipc_signing_state_obtained) { -+ creds->ipc_signing_state_obtained = obtained; -+ creds->ipc_signing_state = ipc_signing_state; -+ return true; -+ } -+ -+ return false; -+} -+ -+/** -+ * @brief Obtain the SMB IPC signing state from a credentials structure. -+ * -+ * @param[in] creds The credential structure to obtain the SMB IPC signing -+ * state from. -+ * -+ * @return The SMB singing state. -+ */ -+_PUBLIC_ enum smb_signing_setting -+cli_credentials_get_smb_ipc_signing(struct cli_credentials *creds) -+{ -+ return creds->ipc_signing_state; -+} -+ - /** - * Encrypt a data blob using the session key and the negotiated encryption - * algorithm -diff --git a/auth/credentials/credentials.h b/auth/credentials/credentials.h -index 422391ad585..25bec916278 100644 ---- a/auth/credentials/credentials.h -+++ b/auth/credentials/credentials.h -@@ -297,6 +297,12 @@ bool cli_credentials_set_smb_signing(struct cli_credentials *cred, - enum smb_signing_setting - cli_credentials_get_smb_signing(struct cli_credentials *cred); - -+bool cli_credentials_set_smb_ipc_signing(struct cli_credentials *cred, -+ enum smb_signing_setting ipc_signing_state, -+ enum credentials_obtained obtained); -+enum smb_signing_setting -+cli_credentials_get_smb_ipc_signing(struct cli_credentials *cred); -+ - /** - * Return attached NETLOGON credentials - */ -diff --git a/auth/credentials/credentials_internal.h b/auth/credentials/credentials_internal.h -index 9cde0000b5f..54e8271471f 100644 ---- a/auth/credentials/credentials_internal.h -+++ b/auth/credentials/credentials_internal.h -@@ -38,6 +38,7 @@ struct cli_credentials { - enum credentials_obtained keytab_obtained; - enum credentials_obtained server_gss_creds_obtained; - enum credentials_obtained signing_state_obtained; -+ enum credentials_obtained ipc_signing_state_obtained; - - /* Threshold values (essentially a MAX() over a number of the - * above) for the ccache and GSS credentials, to ensure we -@@ -121,6 +122,8 @@ struct cli_credentials { - bool password_will_be_nt_hash; - - enum smb_signing_setting signing_state; -+ -+ enum smb_signing_setting ipc_signing_state; - }; - - #endif /* __CREDENTIALS_INTERNAL_H__ */ --- -2.29.2 - - -From d8e43a7c8058a6a395493360cf2faae24f64e2e2 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Wed, 3 Jun 2020 12:32:46 +0200 -Subject: [PATCH 016/104] auth:creds: Add python bindings for - (get|set)_smb_ipc_signing - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher ---- - auth/credentials/pycredentials.c | 56 +++++++++++++++++++++++++++++++ - python/samba/tests/credentials.py | 6 ++++ - 2 files changed, 62 insertions(+) - -diff --git a/auth/credentials/pycredentials.c b/auth/credentials/pycredentials.c -index 846c418419f..1a83c506088 100644 ---- a/auth/credentials/pycredentials.c -+++ b/auth/credentials/pycredentials.c -@@ -976,6 +976,52 @@ static PyObject *py_creds_set_smb_signing(PyObject *self, PyObject *args) - Py_RETURN_NONE; - } - -+static PyObject *py_creds_get_smb_ipc_signing(PyObject *self, PyObject *unused) -+{ -+ enum smb_signing_setting signing_state; -+ struct cli_credentials *creds = NULL; -+ -+ creds = PyCredentials_AsCliCredentials(self); -+ if (creds == NULL) { -+ PyErr_Format(PyExc_TypeError, "Credentials expected"); -+ return NULL; -+ } -+ -+ signing_state = cli_credentials_get_smb_ipc_signing(creds); -+ return PyLong_FromLong(signing_state); -+} -+ -+static PyObject *py_creds_set_smb_ipc_signing(PyObject *self, PyObject *args) -+{ -+ enum smb_signing_setting signing_state; -+ struct cli_credentials *creds = NULL; -+ enum credentials_obtained obt = CRED_SPECIFIED; -+ -+ creds = PyCredentials_AsCliCredentials(self); -+ if (creds == NULL) { -+ PyErr_Format(PyExc_TypeError, "Credentials expected"); -+ return NULL; -+ } -+ if (!PyArg_ParseTuple(args, "i|i", &signing_state, &obt)) { -+ return NULL; -+ } -+ -+ switch (signing_state) { -+ case SMB_SIGNING_DEFAULT: -+ case SMB_SIGNING_OFF: -+ case SMB_SIGNING_IF_REQUIRED: -+ case SMB_SIGNING_DESIRED: -+ case SMB_SIGNING_REQUIRED: -+ break; -+ default: -+ PyErr_Format(PyExc_TypeError, "Invalid signing state value"); -+ return NULL; -+ } -+ -+ cli_credentials_set_smb_ipc_signing(creds, signing_state, obt); -+ Py_RETURN_NONE; -+} -+ - static PyMethodDef py_creds_methods[] = { - { - .ml_name = "get_username", -@@ -1266,6 +1312,16 @@ static PyMethodDef py_creds_methods[] = { - .ml_meth = py_creds_set_smb_signing, - .ml_flags = METH_VARARGS, - }, -+ { -+ .ml_name = "get_smb_ipc_signing", -+ .ml_meth = py_creds_get_smb_ipc_signing, -+ .ml_flags = METH_NOARGS, -+ }, -+ { -+ .ml_name = "set_smb_ipc_signing", -+ .ml_meth = py_creds_set_smb_ipc_signing, -+ .ml_flags = METH_VARARGS, -+ }, - { .ml_name = NULL } - }; - -diff --git a/python/samba/tests/credentials.py b/python/samba/tests/credentials.py -index e5f8122fa21..8edf13ce6ff 100644 ---- a/python/samba/tests/credentials.py -+++ b/python/samba/tests/credentials.py -@@ -462,3 +462,9 @@ class CredentialsTests(samba.tests.TestCaseInTempDir): - self.assertEqual(creds.get_smb_signing(), credentials.SMB_SIGNING_DEFAULT) - creds.set_smb_signing(credentials.SMB_SIGNING_REQUIRED) - self.assertEqual(creds.get_smb_signing(), credentials.SMB_SIGNING_REQUIRED) -+ -+ def test_smb_ipc_signing(self): -+ creds = credentials.Credentials() -+ self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_REQUIRED) -+ creds.set_smb_ipc_signing(credentials.SMB_SIGNING_OFF) -+ self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_OFF) --- -2.29.2 - - -From 767d356f718965b4595b8322729556b63e66425d Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Thu, 28 May 2020 16:10:52 +0200 -Subject: [PATCH 017/104] auth:creds: Add - cli_credentials_(get|set)_smb_encryption() - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher ---- - auth/credentials/credentials.c | 45 +++++++++++++++++++++++++ - auth/credentials/credentials.h | 7 ++++ - auth/credentials/credentials_internal.h | 3 ++ - 3 files changed, 55 insertions(+) - -diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c -index dc5d51f1424..9168b92d3ec 100644 ---- a/auth/credentials/credentials.c -+++ b/auth/credentials/credentials.c -@@ -51,6 +51,7 @@ _PUBLIC_ struct cli_credentials *cli_credentials_init(TALLOC_CTX *mem_ctx) - * the same value here. - */ - cred->ipc_signing_state = SMB_SIGNING_REQUIRED; -+ cred->encryption_state = SMB_ENCRYPTION_DEFAULT; - - return cred; - } -@@ -942,6 +943,12 @@ _PUBLIC_ void cli_credentials_set_conf(struct cli_credentials *cred, - cred->ipc_signing_state = lpcfg_client_ipc_signing(lp_ctx); - cred->ipc_signing_state_obtained = CRED_SMB_CONF; - } -+ -+ if (cred->encryption_state_obtained <= CRED_SMB_CONF) { -+ /* Will be set to default for invalid smb.conf values */ -+ cred->encryption_state = lpcfg_client_smb_encrypt(lp_ctx); -+ cred->encryption_state_obtained = CRED_SMB_CONF; -+ } - } - - /** -@@ -1401,6 +1408,44 @@ cli_credentials_get_smb_ipc_signing(struct cli_credentials *creds) - return creds->ipc_signing_state; - } - -+/** -+ * @brief Set the SMB encryption state to request for a SMB connection. -+ * -+ * @param[in] creds The credentials structure to update. -+ * -+ * @param[in] encryption_state The encryption state to set. -+ * -+ * @param obtained This way the described encryption state was specified. -+ * -+ * @return true if we could set the encryption state, false otherwise. -+ */ -+_PUBLIC_ bool cli_credentials_set_smb_encryption(struct cli_credentials *creds, -+ enum smb_encryption_setting encryption_state, -+ enum credentials_obtained obtained) -+{ -+ if (obtained >= creds->encryption_state_obtained) { -+ creds->encryption_state_obtained = obtained; -+ creds->encryption_state = encryption_state; -+ return true; -+ } -+ -+ return false; -+} -+ -+/** -+ * @brief Obtain the SMB encryption state from a credentials structure. -+ * -+ * @param[in] creds The credential structure to obtain the SMB encryption state -+ * from. -+ * -+ * @return The SMB singing state. -+ */ -+_PUBLIC_ enum smb_encryption_setting -+cli_credentials_get_smb_encryption(struct cli_credentials *creds) -+{ -+ return creds->encryption_state; -+} -+ - /** - * Encrypt a data blob using the session key and the negotiated encryption - * algorithm -diff --git a/auth/credentials/credentials.h b/auth/credentials/credentials.h -index 25bec916278..7d0cf53194b 100644 ---- a/auth/credentials/credentials.h -+++ b/auth/credentials/credentials.h -@@ -39,6 +39,7 @@ struct smb_krb5_context; - struct keytab_container; - struct db_context; - enum smb_signing_setting; -+enum smb_encryption_setting; - - /* In order of priority */ - enum credentials_obtained { -@@ -303,6 +304,12 @@ bool cli_credentials_set_smb_ipc_signing(struct cli_credentials *cred, - enum smb_signing_setting - cli_credentials_get_smb_ipc_signing(struct cli_credentials *cred); - -+bool cli_credentials_set_smb_encryption(struct cli_credentials *cred, -+ enum smb_encryption_setting encryption_state, -+ enum credentials_obtained obtained); -+enum smb_encryption_setting -+cli_credentials_get_smb_encryption(struct cli_credentials *cred); -+ - /** - * Return attached NETLOGON credentials - */ -diff --git a/auth/credentials/credentials_internal.h b/auth/credentials/credentials_internal.h -index 54e8271471f..3b86b742448 100644 ---- a/auth/credentials/credentials_internal.h -+++ b/auth/credentials/credentials_internal.h -@@ -39,6 +39,7 @@ struct cli_credentials { - enum credentials_obtained server_gss_creds_obtained; - enum credentials_obtained signing_state_obtained; - enum credentials_obtained ipc_signing_state_obtained; -+ enum credentials_obtained encryption_state_obtained; - - /* Threshold values (essentially a MAX() over a number of the - * above) for the ccache and GSS credentials, to ensure we -@@ -124,6 +125,8 @@ struct cli_credentials { - enum smb_signing_setting signing_state; - - enum smb_signing_setting ipc_signing_state; -+ -+ enum smb_encryption_setting encryption_state; - }; - - #endif /* __CREDENTIALS_INTERNAL_H__ */ --- -2.29.2 - - -From 88dd0d8871ae2a54bc089f1e761ded6940b270b0 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Wed, 3 Jun 2020 12:38:30 +0200 -Subject: [PATCH 018/104] auth:creds: Add python bindings for - (get|set)_smb_encryption - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher ---- - auth/credentials/pycredentials.c | 62 +++++++++++++++++++++++++++++++ - python/samba/tests/credentials.py | 6 +++ - 2 files changed, 68 insertions(+) - -diff --git a/auth/credentials/pycredentials.c b/auth/credentials/pycredentials.c -index 1a83c506088..628aae6500b 100644 ---- a/auth/credentials/pycredentials.c -+++ b/auth/credentials/pycredentials.c -@@ -1022,6 +1022,52 @@ static PyObject *py_creds_set_smb_ipc_signing(PyObject *self, PyObject *args) - Py_RETURN_NONE; - } - -+static PyObject *py_creds_get_smb_encryption(PyObject *self, PyObject *unused) -+{ -+ enum smb_encryption_setting encryption_state; -+ struct cli_credentials *creds = NULL; -+ -+ creds = PyCredentials_AsCliCredentials(self); -+ if (creds == NULL) { -+ PyErr_Format(PyExc_TypeError, "Credentials expected"); -+ return NULL; -+ } -+ -+ encryption_state = cli_credentials_get_smb_encryption(creds); -+ return PyLong_FromLong(encryption_state); -+} -+ -+static PyObject *py_creds_set_smb_encryption(PyObject *self, PyObject *args) -+{ -+ enum smb_encryption_setting encryption_state; -+ struct cli_credentials *creds = NULL; -+ enum credentials_obtained obt = CRED_SPECIFIED; -+ -+ creds = PyCredentials_AsCliCredentials(self); -+ if (creds == NULL) { -+ PyErr_Format(PyExc_TypeError, "Credentials expected"); -+ return NULL; -+ } -+ if (!PyArg_ParseTuple(args, "i|i", &encryption_state, &obt)) { -+ return NULL; -+ } -+ -+ switch (encryption_state) { -+ case SMB_ENCRYPTION_DEFAULT: -+ case SMB_ENCRYPTION_OFF: -+ case SMB_ENCRYPTION_IF_REQUIRED: -+ case SMB_ENCRYPTION_DESIRED: -+ case SMB_ENCRYPTION_REQUIRED: -+ break; -+ default: -+ PyErr_Format(PyExc_TypeError, "Invalid encryption state value"); -+ return NULL; -+ } -+ -+ cli_credentials_set_smb_encryption(creds, encryption_state, obt); -+ Py_RETURN_NONE; -+} -+ - static PyMethodDef py_creds_methods[] = { - { - .ml_name = "get_username", -@@ -1322,6 +1368,16 @@ static PyMethodDef py_creds_methods[] = { - .ml_meth = py_creds_set_smb_ipc_signing, - .ml_flags = METH_VARARGS, - }, -+ { -+ .ml_name = "get_smb_encryption", -+ .ml_meth = py_creds_get_smb_encryption, -+ .ml_flags = METH_NOARGS, -+ }, -+ { -+ .ml_name = "set_smb_encryption", -+ .ml_meth = py_creds_set_smb_encryption, -+ .ml_flags = METH_VARARGS, -+ }, - { .ml_name = NULL } - }; - -@@ -1414,6 +1470,12 @@ MODULE_INIT_FUNC(credentials) - PyModule_AddObject(m, "SMB_SIGNING_DESIRED", PyLong_FromLong(SMB_SIGNING_DESIRED)); - PyModule_AddObject(m, "SMB_SIGNING_REQUIRED", PyLong_FromLong(SMB_SIGNING_REQUIRED)); - -+ PyModule_AddObject(m, "SMB_ENCRYPTION_DEFAULT", PyLong_FromLong(SMB_ENCRYPTION_DEFAULT)); -+ PyModule_AddObject(m, "SMB_ENCRYPTION_OFF", PyLong_FromLong(SMB_ENCRYPTION_OFF)); -+ PyModule_AddObject(m, "SMB_ENCRYPTION_IF_REQUIRED", PyLong_FromLong(SMB_ENCRYPTION_IF_REQUIRED)); -+ PyModule_AddObject(m, "SMB_ENCRYPTION_DESIRED", PyLong_FromLong(SMB_ENCRYPTION_DESIRED)); -+ PyModule_AddObject(m, "SMB_ENCRYPTION_REQUIRED", PyLong_FromLong(SMB_ENCRYPTION_REQUIRED)); -+ - Py_INCREF(&PyCredentials); - PyModule_AddObject(m, "Credentials", (PyObject *)&PyCredentials); - Py_INCREF(&PyCredentialCacheContainer); -diff --git a/python/samba/tests/credentials.py b/python/samba/tests/credentials.py -index 8edf13ce6ff..e0a6248d37a 100644 ---- a/python/samba/tests/credentials.py -+++ b/python/samba/tests/credentials.py -@@ -468,3 +468,9 @@ class CredentialsTests(samba.tests.TestCaseInTempDir): - self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_REQUIRED) - creds.set_smb_ipc_signing(credentials.SMB_SIGNING_OFF) - self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_OFF) -+ -+ def test_smb_encryption(self): -+ creds = credentials.Credentials() -+ self.assertEqual(creds.get_smb_encryption(), credentials.SMB_ENCRYPTION_DEFAULT) -+ creds.set_smb_encryption(credentials.SMB_ENCRYPTION_REQUIRED) -+ self.assertEqual(creds.get_smb_encryption(), credentials.SMB_ENCRYPTION_REQUIRED) --- -2.29.2 - - -From 41df2d5330c051066691576af9ccf505cb0573e3 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Thu, 4 Jun 2020 11:19:53 +0200 -Subject: [PATCH 019/104] auth:creds: Add python bindings for - cli_credentials_set_conf() - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher ---- - auth/credentials/pycredentials.c | 41 +++++++++++++++++++++++++++++++ - python/samba/tests/credentials.py | 33 +++++++++++++++++++++++++ - 2 files changed, 74 insertions(+) - -diff --git a/auth/credentials/pycredentials.c b/auth/credentials/pycredentials.c -index 628aae6500b..17c90573f09 100644 ---- a/auth/credentials/pycredentials.c -+++ b/auth/credentials/pycredentials.c -@@ -621,6 +621,42 @@ static PyObject *py_creds_set_forced_sasl_mech(PyObject *self, PyObject *args) - Py_RETURN_NONE; - } - -+static PyObject *py_creds_set_conf(PyObject *self, PyObject *args) -+{ -+ PyObject *py_lp_ctx = Py_None; -+ struct loadparm_context *lp_ctx; -+ TALLOC_CTX *mem_ctx; -+ struct cli_credentials *creds; -+ -+ creds = PyCredentials_AsCliCredentials(self); -+ if (creds == NULL) { -+ PyErr_Format(PyExc_TypeError, "Credentials expected"); -+ return NULL; -+ } -+ -+ if (!PyArg_ParseTuple(args, "|O", &py_lp_ctx)) { -+ return NULL; -+ } -+ -+ mem_ctx = talloc_new(NULL); -+ if (mem_ctx == NULL) { -+ PyErr_NoMemory(); -+ return NULL; -+ } -+ -+ lp_ctx = lpcfg_from_py_object(mem_ctx, py_lp_ctx); -+ if (lp_ctx == NULL) { -+ talloc_free(mem_ctx); -+ return NULL; -+ } -+ -+ cli_credentials_set_conf(creds, lp_ctx); -+ -+ talloc_free(mem_ctx); -+ -+ Py_RETURN_NONE; -+} -+ - static PyObject *py_creds_guess(PyObject *self, PyObject *args) - { - PyObject *py_lp_ctx = Py_None; -@@ -1279,6 +1315,11 @@ static PyMethodDef py_creds_methods[] = { - .ml_meth = py_creds_set_krb_forwardable, - .ml_flags = METH_VARARGS, - }, -+ { -+ .ml_name = "set_conf", -+ .ml_meth = py_creds_set_conf, -+ .ml_flags = METH_VARARGS, -+ }, - { - .ml_name = "guess", - .ml_meth = py_creds_guess, -diff --git a/python/samba/tests/credentials.py b/python/samba/tests/credentials.py -index e0a6248d37a..6187bded0b6 100644 ---- a/python/samba/tests/credentials.py -+++ b/python/samba/tests/credentials.py -@@ -463,14 +463,47 @@ class CredentialsTests(samba.tests.TestCaseInTempDir): - creds.set_smb_signing(credentials.SMB_SIGNING_REQUIRED) - self.assertEqual(creds.get_smb_signing(), credentials.SMB_SIGNING_REQUIRED) - -+ def test_smb_signing_set_conf(self): -+ lp = samba.tests.env_loadparm() -+ -+ creds = credentials.Credentials() -+ creds.set_conf(lp) -+ self.assertEqual(creds.get_smb_signing(), credentials.SMB_SIGNING_DEFAULT) -+ creds.set_smb_signing(credentials.SMB_SIGNING_OFF) -+ self.assertEqual(creds.get_smb_signing(), credentials.SMB_SIGNING_OFF) -+ creds.set_conf(lp) -+ self.assertEqual(creds.get_smb_signing(), credentials.SMB_SIGNING_OFF) -+ - def test_smb_ipc_signing(self): - creds = credentials.Credentials() - self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_REQUIRED) - creds.set_smb_ipc_signing(credentials.SMB_SIGNING_OFF) - self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_OFF) - -+ def test_smb_ipc_signing_set_conf(self): -+ lp = samba.tests.env_loadparm() -+ -+ creds = credentials.Credentials() -+ creds.set_conf(lp) -+ self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_REQUIRED) -+ creds.set_smb_ipc_signing(credentials.SMB_SIGNING_OFF) -+ self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_OFF) -+ creds.set_conf(lp) -+ self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_OFF) -+ - def test_smb_encryption(self): - creds = credentials.Credentials() - self.assertEqual(creds.get_smb_encryption(), credentials.SMB_ENCRYPTION_DEFAULT) - creds.set_smb_encryption(credentials.SMB_ENCRYPTION_REQUIRED) - self.assertEqual(creds.get_smb_encryption(), credentials.SMB_ENCRYPTION_REQUIRED) -+ -+ def test_smb_encryption_set_conf(self): -+ lp = samba.tests.env_loadparm() -+ -+ creds = credentials.Credentials() -+ creds.set_conf(lp) -+ self.assertEqual(creds.get_smb_encryption(), credentials.SMB_ENCRYPTION_DEFAULT) -+ creds.set_smb_encryption(credentials.SMB_ENCRYPTION_OFF) -+ self.assertEqual(creds.get_smb_encryption(), credentials.SMB_ENCRYPTION_OFF) -+ creds.set_conf(lp) -+ self.assertEqual(creds.get_smb_encryption(), credentials.SMB_ENCRYPTION_OFF) --- -2.29.2 - - -From cdb470d7c408baa07eabf83ec566baecc8e5138c Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Thu, 23 Jul 2020 08:14:23 +0200 -Subject: [PATCH 020/104] auth:creds: Bump library version - -We added new functions so bump the version. - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher ---- - auth/credentials/wscript_build | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/auth/credentials/wscript_build b/auth/credentials/wscript_build -index 564a04fe8dd..1e3302e3e48 100644 ---- a/auth/credentials/wscript_build -+++ b/auth/credentials/wscript_build -@@ -5,7 +5,7 @@ bld.SAMBA_LIBRARY('samba-credentials', - public_headers='credentials.h', - pc_files='samba-credentials.pc', - deps='LIBCRYPTO samba-errors events LIBCLI_AUTH samba-security CREDENTIALS_SECRETS CREDENTIALS_KRB5', -- vnum='0.0.1' -+ vnum='0.1.0' - ) - - bld.SAMBA_SUBSYSTEM('CREDENTIALS_KRB5', --- -2.29.2 - - -From a11a02e0802dbb3300d9b3232b936b74b1f89a32 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Wed, 27 May 2020 11:10:30 +0200 -Subject: [PATCH 021/104] s3:lib: Use cli_credential_(get|set)_smb_signing() - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher ---- - source3/lib/util_cmdline.c | 18 ++++++++++++------ - 1 file changed, 12 insertions(+), 6 deletions(-) - -diff --git a/source3/lib/util_cmdline.c b/source3/lib/util_cmdline.c -index bc1f1c3ed25..6038ec11515 100644 ---- a/source3/lib/util_cmdline.c -+++ b/source3/lib/util_cmdline.c -@@ -40,7 +40,6 @@ struct user_auth_info { - struct loadparm_context *lp_ctx; - bool got_username; - bool got_pass; -- int signing_state; - bool smb_encrypt; - bool use_machine_account; - bool use_pw_nt_hash; -@@ -70,7 +69,6 @@ struct user_auth_info *user_auth_info_init(TALLOC_CTX *mem_ctx) - - cli_credentials_set_conf(result->creds, result->lp_ctx); - -- result->signing_state = SMB_SIGNING_DEFAULT; - return result; - } - -@@ -241,15 +239,23 @@ void set_cmdline_auth_info_password(struct user_auth_info *auth_info, - bool set_cmdline_auth_info_signing_state(struct user_auth_info *auth_info, - const char *arg) - { -- auth_info->signing_state = smb_signing_setting_translate(arg); -+ enum smb_signing_setting signing_state = -+ smb_signing_setting_translate(arg); -+ bool ok; - -- return true; -+ ok = cli_credentials_set_smb_signing(auth_info->creds, -+ signing_state, -+ CRED_SPECIFIED); -+ -+ return ok; - } - - void set_cmdline_auth_info_signing_state_raw(struct user_auth_info *auth_info, - int signing_state) - { -- auth_info->signing_state = signing_state; -+ cli_credentials_set_smb_signing(auth_info->creds, -+ signing_state, -+ CRED_SPECIFIED); - } - - int get_cmdline_auth_info_signing_state(const struct user_auth_info *auth_info) -@@ -257,7 +263,7 @@ int get_cmdline_auth_info_signing_state(const struct user_auth_info *auth_info) - if (auth_info->smb_encrypt) { - return SMB_SIGNING_REQUIRED; - } -- return auth_info->signing_state; -+ return cli_credentials_get_smb_signing(auth_info->creds); - } - - void set_cmdline_auth_info_use_ccache(struct user_auth_info *auth_info, bool b) --- -2.29.2 - - -From 6e5fba172b910545f722d33aa3fb185f48492c18 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Wed, 10 Jun 2020 12:45:34 +0200 -Subject: [PATCH 022/104] s3:lib: Set smb encryption also via cli creds API - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher ---- - source3/lib/util_cmdline.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/source3/lib/util_cmdline.c b/source3/lib/util_cmdline.c -index 6038ec11515..9c9e2f0ac0f 100644 ---- a/source3/lib/util_cmdline.c -+++ b/source3/lib/util_cmdline.c -@@ -377,6 +377,9 @@ void set_cmdline_auth_info_use_krb5_ticket(struct user_auth_info *auth_info) - /* This should only be used by lib/popt_common.c JRA */ - void set_cmdline_auth_info_smb_encrypt(struct user_auth_info *auth_info) - { -+ cli_credentials_set_smb_encryption(auth_info->creds, -+ SMB_ENCRYPTION_REQUIRED, -+ CRED_SPECIFIED); - auth_info->smb_encrypt = true; - } - --- -2.29.2 - - -From 01eb7d2f16a4f16931a0adffc395ec0b5946ef56 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Thu, 13 Aug 2020 10:40:23 +0200 -Subject: [PATCH 023/104] python: Remove unused sign argument from - smb_connection() - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher ---- - python/samba/netcmd/gpo.py | 9 ++++----- - 1 file changed, 4 insertions(+), 5 deletions(-) - -diff --git a/python/samba/netcmd/gpo.py b/python/samba/netcmd/gpo.py -index 1e2c2918ebe..ad60cda0690 100644 ---- a/python/samba/netcmd/gpo.py -+++ b/python/samba/netcmd/gpo.py -@@ -382,13 +382,13 @@ def create_directory_hier(conn, remotedir): - if not conn.chkpath(path): - conn.mkdir(path) - --def smb_connection(dc_hostname, service, lp, creds, sign=False): -+def smb_connection(dc_hostname, service, lp, creds): - # SMB connect to DC - try: - # the SMB bindings rely on having a s3 loadparm - s3_lp = s3param.get_context() - s3_lp.load(lp.configfile) -- conn = libsmb.Conn(dc_hostname, service, lp=s3_lp, creds=creds, sign=sign) -+ conn = libsmb.Conn(dc_hostname, service, lp=s3_lp, creds=creds, sign=True) - except Exception: - raise CommandError("Error connecting to '%s' using SMB" % dc_hostname) - return conn -@@ -998,7 +998,7 @@ class cmd_fetch(GPOCommand): - - # SMB connect to DC - conn = smb_connection(dc_hostname, service, lp=self.lp, -- creds=self.creds, sign=True) -+ creds=self.creds) - - # Copy GPT - tmpdir, gpodir = self.construct_tmpdir(tmpdir, gpo) -@@ -1629,8 +1629,7 @@ class cmd_admxload(Command): - conn = smb_connection(dc_hostname, - 'sysvol', - lp=self.lp, -- creds=self.creds, -- sign=True) -+ creds=self.creds) - - smb_dir = '\\'.join([self.lp.get('realm').lower(), - 'Policies', 'PolicyDefinitions']) --- -2.29.2 - - -From 7ad70308d9f5b5d892e507a58eb946839be33374 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Wed, 3 Jun 2020 14:02:37 +0200 -Subject: [PATCH 024/104] python: Set smb signing via the creds API - -Pair-Programmed-With: Stefan Metzmacher - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher ---- - python/samba/gpclass.py | 7 +++++++ - python/samba/netcmd/domain_backup.py | 10 +++++++++- - python/samba/netcmd/gpo.py | 6 ++++++ - 3 files changed, 22 insertions(+), 1 deletion(-) - -diff --git a/python/samba/gpclass.py b/python/samba/gpclass.py -index cc574e12a42..1781a55a618 100644 ---- a/python/samba/gpclass.py -+++ b/python/samba/gpclass.py -@@ -38,6 +38,7 @@ from tempfile import NamedTemporaryFile - from samba.dcerpc import preg - from samba.dcerpc import misc - from samba.ndr import ndr_pack, ndr_unpack -+from samba.credentials import SMB_SIGNING_REQUIRED - - try: - from enum import Enum -@@ -421,7 +422,13 @@ def check_refresh_gpo_list(dc_hostname, lp, creds, gpos): - # the SMB bindings rely on having a s3 loadparm - s3_lp = s3param.get_context() - s3_lp.load(lp.configfile) -+ -+ # Force signing for the connection -+ saved_signing_state = creds.get_smb_signing() -+ creds.set_smb_signing(SMB_SIGNING_REQUIRED) - conn = libsmb.Conn(dc_hostname, 'sysvol', lp=s3_lp, creds=creds, sign=True) -+ # Reset signing state -+ creds.set_smb_signing(saved_signing_state) - cache_path = lp.cache_path('gpo_cache') - for gpo in gpos: - if not gpo.file_sys_path: -diff --git a/python/samba/netcmd/domain_backup.py b/python/samba/netcmd/domain_backup.py -index a3dc7fb454f..a9e0ba5bc67 100644 ---- a/python/samba/netcmd/domain_backup.py -+++ b/python/samba/netcmd/domain_backup.py -@@ -54,6 +54,7 @@ from subprocess import CalledProcessError - from samba import sites - from samba.dsdb import _dsdb_load_udv_v2 - from samba.ndr import ndr_pack -+from samba.credentials import SMB_SIGNING_REQUIRED - - - # work out a SID (based on a free RID) to use when the domain gets restored. -@@ -115,7 +116,14 @@ def smb_sysvol_conn(server, lp, creds): - # the SMB bindings rely on having a s3 loadparm - s3_lp = s3param.get_context() - s3_lp.load(lp.configfile) -- return libsmb.Conn(server, "sysvol", lp=s3_lp, creds=creds, sign=True) -+ -+ # Force signing for the connection -+ saved_signing_state = creds.get_smb_signing() -+ creds.set_smb_signing(SMB_SIGNING_REQUIRED) -+ conn = libsmb.Conn(server, "sysvol", lp=s3_lp, creds=creds, sign=True) -+ # Reset signing state -+ creds.set_smb_signing(saved_signing_state) -+ return conn - - - def get_timestamp(): -diff --git a/python/samba/netcmd/gpo.py b/python/samba/netcmd/gpo.py -index ad60cda0690..0f2f6520fc3 100644 ---- a/python/samba/netcmd/gpo.py -+++ b/python/samba/netcmd/gpo.py -@@ -62,6 +62,7 @@ from samba.gp_parse.gp_csv import GPAuditCsvParser - from samba.gp_parse.gp_inf import GptTmplInfParser - from samba.gp_parse.gp_aas import GPAasParser - from samba import param -+from samba.credentials import SMB_SIGNING_REQUIRED - - - def attr_default(msg, attrname, default): -@@ -384,6 +385,9 @@ def create_directory_hier(conn, remotedir): - - def smb_connection(dc_hostname, service, lp, creds): - # SMB connect to DC -+ # Force signing for the smb connection -+ saved_signing_state = creds.get_smb_signing() -+ creds.set_smb_signing(SMB_SIGNING_REQUIRED) - try: - # the SMB bindings rely on having a s3 loadparm - s3_lp = s3param.get_context() -@@ -391,6 +395,8 @@ def smb_connection(dc_hostname, service, lp, creds): - conn = libsmb.Conn(dc_hostname, service, lp=s3_lp, creds=creds, sign=True) - except Exception: - raise CommandError("Error connecting to '%s' using SMB" % dc_hostname) -+ # Reset signing state -+ creds.set_smb_signing(saved_signing_state) - return conn - - --- -2.29.2 - - -From 70b7a6d80c3699727f7bf36a4a9255bb90c67cec Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Thu, 28 May 2020 17:22:12 +0200 -Subject: [PATCH 025/104] s3:libsmb: Introduce CLI_FULL_CONNECTION_IPC - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher ---- - examples/winexe/winexe.c | 2 +- - source3/include/client.h | 1 + - source3/libnet/libnet_join.c | 6 +++--- - source3/libsmb/cliconnect.c | 3 ++- - source3/rpc_server/spoolss/srv_spoolss_nt.c | 4 +++- - source3/rpcclient/cmd_spoolss.c | 2 +- - source3/rpcclient/rpcclient.c | 2 +- - source3/utils/mdfind.c | 2 +- - source3/utils/net_ads.c | 3 ++- - source3/utils/net_util.c | 9 +++++++-- - source3/utils/netlookup.c | 4 +++- - 11 files changed, 25 insertions(+), 13 deletions(-) - -diff --git a/examples/winexe/winexe.c b/examples/winexe/winexe.c -index fc6b15f8e52..bb9c27e2e6d 100644 ---- a/examples/winexe/winexe.c -+++ b/examples/winexe/winexe.c -@@ -1919,7 +1919,7 @@ int main(int argc, const char *argv[]) - "IPC$", - "?????", - options.credentials, -- 0, -+ CLI_FULL_CONNECTION_IPC, - 0); - - if (!NT_STATUS_IS_OK(status)) { -diff --git a/source3/include/client.h b/source3/include/client.h -index 6a3b1b02ff3..19a738900b7 100644 ---- a/source3/include/client.h -+++ b/source3/include/client.h -@@ -121,5 +121,6 @@ struct file_info { - #define CLI_FULL_CONNECTION_FORCE_ASCII 0x0100 - #define CLI_FULL_CONNECTION_FORCE_SMB1 0x0400 - #define CLI_FULL_CONNECTION_DISABLE_SMB1 0x0800 -+#define CLI_FULL_CONNECTION_IPC 0x1000 - - #endif /* _CLIENT_H */ -diff --git a/source3/libnet/libnet_join.c b/source3/libnet/libnet_join.c -index 34938603606..392e3eff74f 100644 ---- a/source3/libnet/libnet_join.c -+++ b/source3/libnet/libnet_join.c -@@ -1068,7 +1068,7 @@ static NTSTATUS libnet_join_connect_dc_ipc(const char *dc, - bool use_ccache = false; - bool pw_nt_hash = false; - struct cli_credentials *creds = NULL; -- int flags = 0; -+ int flags = CLI_FULL_CONNECTION_IPC; - NTSTATUS status; - - if (use_kerberos && pass) { -@@ -1684,7 +1684,7 @@ NTSTATUS libnet_join_ok(struct messaging_context *msg_ctx, - struct netlogon_creds_CredentialState *creds = NULL; - uint32_t netlogon_flags = 0; - NTSTATUS status; -- int flags = 0; -+ int flags = CLI_FULL_CONNECTION_IPC; - - if (!dc_name) { - TALLOC_FREE(frame); -@@ -1734,7 +1734,7 @@ NTSTATUS libnet_join_ok(struct messaging_context *msg_ctx, - NULL, 0, - "IPC$", "IPC", - anon_creds, -- 0, -+ flags, - SMB_SIGNING_OFF); - } - -diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c -index 1fb1f0127b9..f20146378e3 100644 ---- a/source3/libsmb/cliconnect.c -+++ b/source3/libsmb/cliconnect.c -@@ -2788,7 +2788,7 @@ static struct tevent_req *cli_start_connection_send( - } - state->ev = ev; - -- if (signing_state == SMB_SIGNING_IPC_DEFAULT) { -+ if (flags & CLI_FULL_CONNECTION_IPC) { - state->min_protocol = lp_client_ipc_min_protocol(); - state->max_protocol = lp_client_ipc_max_protocol(); - } else { -@@ -3673,6 +3673,7 @@ struct cli_state *get_ipc_connect(char *server, - uint32_t flags = CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK; - - flags |= CLI_FULL_CONNECTION_FORCE_SMB1; -+ flags |= CLI_FULL_CONNECTION_IPC; - - nt_status = cli_full_connection_creds(&cli, NULL, server, server_ss, 0, "IPC$", "IPC", - get_cmdline_auth_info_creds(user_info), -diff --git a/source3/rpc_server/spoolss/srv_spoolss_nt.c b/source3/rpc_server/spoolss/srv_spoolss_nt.c -index 10c1b1d54f2..f578f1c4131 100644 ---- a/source3/rpc_server/spoolss/srv_spoolss_nt.c -+++ b/source3/rpc_server/spoolss/srv_spoolss_nt.c -@@ -2482,7 +2482,9 @@ static bool spoolss_connect_to_client(struct rpc_pipe_client **pp_pipe, struct c - /* setup the connection */ - ret = cli_full_connection_creds( pp_cli, lp_netbios_name(), remote_machine, - &rm_addr, 0, "IPC$", "IPC", -- anon_creds, 0, SMB_SIGNING_OFF); -+ anon_creds, -+ CLI_FULL_CONNECTION_IPC, -+ SMB_SIGNING_OFF); - TALLOC_FREE(anon_creds); - if ( !NT_STATUS_IS_OK( ret ) ) { - DEBUG(2,("spoolss_connect_to_client: connection to [%s] failed!\n", -diff --git a/source3/rpcclient/cmd_spoolss.c b/source3/rpcclient/cmd_spoolss.c -index a7e0c673a65..7198a451ab7 100644 ---- a/source3/rpcclient/cmd_spoolss.c -+++ b/source3/rpcclient/cmd_spoolss.c -@@ -3537,7 +3537,7 @@ static WERROR cmd_spoolss_printercmp(struct rpc_pipe_client *cli, - "IPC$", "IPC", - get_cmdline_auth_info_creds( - popt_get_cmdline_auth_info()), -- 0, /* flags */ -+ CLI_FULL_CONNECTION_IPC, - get_cmdline_auth_info_signing_state( - popt_get_cmdline_auth_info())); - -diff --git a/source3/rpcclient/rpcclient.c b/source3/rpcclient/rpcclient.c -index 67a1066fc15..c86474d08f1 100644 ---- a/source3/rpcclient/rpcclient.c -+++ b/source3/rpcclient/rpcclient.c -@@ -1019,7 +1019,7 @@ out_free: - static int opt_port = 0; - int result = 0; - TALLOC_CTX *frame = talloc_stackframe(); -- uint32_t flags = 0; -+ uint32_t flags = CLI_FULL_CONNECTION_IPC; - struct dcerpc_binding *binding = NULL; - enum dcerpc_transport_t transport; - uint32_t bflags = 0; -diff --git a/source3/utils/mdfind.c b/source3/utils/mdfind.c -index 2f952c29b4f..a3c879e75fb 100644 ---- a/source3/utils/mdfind.c -+++ b/source3/utils/mdfind.c -@@ -70,7 +70,7 @@ int main(int argc, char **argv) - const char *mds_query = NULL; - struct cli_state *cli = NULL; - char *basepath = NULL; -- uint32_t flags = 0; -+ uint32_t flags = CLI_FULL_CONNECTION_IPC; - int signing_state = SMB_SIGNING_IPC_DEFAULT; - uint64_t *cnids = NULL; - size_t ncnids; -diff --git a/source3/utils/net_ads.c b/source3/utils/net_ads.c -index e5db844c2f2..28ef6dc9974 100644 ---- a/source3/utils/net_ads.c -+++ b/source3/utils/net_ads.c -@@ -2437,7 +2437,8 @@ static int net_ads_printer_publish(struct net_context *c, int argc, const char * - nt_status = cli_full_connection_creds(&cli, lp_netbios_name(), servername, - &server_ss, 0, - "IPC$", "IPC", -- creds, 0, -+ creds, -+ CLI_FULL_CONNECTION_IPC, - SMB_SIGNING_IPC_DEFAULT); - - if (NT_STATUS_IS_ERR(nt_status)) { -diff --git a/source3/utils/net_util.c b/source3/utils/net_util.c -index c566ecc9000..d01b2d8c771 100644 ---- a/source3/utils/net_util.c -+++ b/source3/utils/net_util.c -@@ -110,6 +110,7 @@ NTSTATUS connect_to_service(struct net_context *c, - NTSTATUS nt_status; - enum smb_signing_setting signing_setting = SMB_SIGNING_DEFAULT; - struct cli_credentials *creds = NULL; -+ int flags = 0; - - creds = net_context_creds(c, c); - if (creds == NULL) { -@@ -119,12 +120,14 @@ NTSTATUS connect_to_service(struct net_context *c, - - if (strequal(service_type, "IPC")) { - signing_setting = SMB_SIGNING_IPC_DEFAULT; -+ flags |= CLI_FULL_CONNECTION_IPC; - } - - nt_status = cli_full_connection_creds(cli_ctx, NULL, server_name, - server_ss, c->opt_port, - service_name, service_type, -- creds, 0, -+ creds, -+ flags, - signing_setting); - if (!NT_STATUS_IS_OK(nt_status)) { - d_fprintf(stderr, _("Could not connect to server %s\n"), -@@ -195,7 +198,9 @@ NTSTATUS connect_to_ipc_anonymous(struct net_context *c, - nt_status = cli_full_connection_creds(cli_ctx, c->opt_requester_name, - server_name, server_ss, c->opt_port, - "IPC$", "IPC", -- anon_creds, 0, SMB_SIGNING_OFF); -+ anon_creds, -+ CLI_FULL_CONNECTION_IPC, -+ SMB_SIGNING_OFF); - - if (NT_STATUS_IS_OK(nt_status)) { - return nt_status; -diff --git a/source3/utils/netlookup.c b/source3/utils/netlookup.c -index 6cea2ee306c..2241beb331f 100644 ---- a/source3/utils/netlookup.c -+++ b/source3/utils/netlookup.c -@@ -98,7 +98,9 @@ static struct con_struct *create_cs(struct net_context *c, - nt_status = cli_full_connection_creds(&cs->cli, lp_netbios_name(), lp_netbios_name(), - &loopback_ss, 0, - "IPC$", "IPC", -- anon_creds, 0, SMB_SIGNING_OFF); -+ anon_creds, -+ CLI_FULL_CONNECTION_IPC, -+ SMB_SIGNING_OFF); - - if (!NT_STATUS_IS_OK(nt_status)) { - DEBUG(2,("create_cs: Connect failed. Error was %s\n", nt_errstr(nt_status))); --- -2.29.2 - - -From 19ac5889da3b5bec1fddba0e08daed7cbe24f604 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Thu, 28 May 2020 17:29:25 +0200 -Subject: [PATCH 026/104] s3:pylibsmb: Add ipc=True support for - CLI_FULL_CONNECTION_IPC - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher ---- - source3/libsmb/pylibsmb.c | 13 +++++++++++-- - 1 file changed, 11 insertions(+), 2 deletions(-) - -diff --git a/source3/libsmb/pylibsmb.c b/source3/libsmb/pylibsmb.c -index 3fcc3424a57..3579a040830 100644 ---- a/source3/libsmb/pylibsmb.c -+++ b/source3/libsmb/pylibsmb.c -@@ -445,6 +445,8 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, - int signing_state = SMB_SIGNING_DEFAULT; - PyObject *py_force_smb1 = Py_False; - bool force_smb1 = false; -+ PyObject *py_ipc = Py_False; -+ bool use_ipc = false; - struct tevent_req *req; - bool ret; - int flags = 0; -@@ -452,6 +454,7 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, - static const char *kwlist[] = { - "host", "share", "lp", "creds", - "multi_threaded", "sign", "force_smb1", -+ "ipc", - NULL - }; - -@@ -462,12 +465,13 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, - } - - ret = ParseTupleAndKeywords( -- args, kwds, "ssO|O!OOO", kwlist, -+ args, kwds, "ssO|O!OOOO", kwlist, - &host, &share, &py_lp, - py_type_Credentials, &creds, - &py_multi_threaded, - &py_sign, -- &py_force_smb1); -+ &py_force_smb1, -+ &py_ipc); - - Py_DECREF(py_type_Credentials); - -@@ -493,6 +497,11 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, - flags = CLI_FULL_CONNECTION_FORCE_SMB1; - } - -+ use_ipc = PyObject_IsTrue(py_ipc); -+ if (use_ipc) { -+ flags |= CLI_FULL_CONNECTION_IPC; -+ } -+ - if (multi_threaded) { - #ifdef HAVE_PTHREAD - ret = py_cli_state_setup_mt_ev(self); --- -2.29.2 - - -From ff93a26bdd480edb3e488b207b1fb6529cd52a38 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Fri, 24 Jul 2020 09:47:11 +0200 -Subject: [PATCH 027/104] python:tests: Mark libsmb connection as an IPC - connection - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher ---- - python/samba/tests/dcerpc/raw_testcase.py | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/python/samba/tests/dcerpc/raw_testcase.py b/python/samba/tests/dcerpc/raw_testcase.py -index ba7440df13b..2c028d381db 100644 ---- a/python/samba/tests/dcerpc/raw_testcase.py -+++ b/python/samba/tests/dcerpc/raw_testcase.py -@@ -43,7 +43,7 @@ class smb_pipe_socket(object): - lp3 = s3param.get_context() - lp3.load(lp.configfile) - self.smbconn = libsmb.Conn(target_hostname, 'IPC$', lp3, -- creds=creds, sign=True) -+ creds=creds, ipc=True, sign=True) - self.smbfid = self.smbconn.create(pipename, - DesiredAccess=0x12019f, - ShareAccess=0x7, --- -2.29.2 - - -From b904f4bf9279264438e7b50ba90930562f4146fa Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Mon, 17 Aug 2020 12:52:39 +0200 -Subject: [PATCH 028/104] python:tests: Set smb ipc signing via the creds API - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher ---- - python/samba/tests/dcerpc/raw_testcase.py | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/python/samba/tests/dcerpc/raw_testcase.py b/python/samba/tests/dcerpc/raw_testcase.py -index 2c028d381db..d6f5de7440a 100644 ---- a/python/samba/tests/dcerpc/raw_testcase.py -+++ b/python/samba/tests/dcerpc/raw_testcase.py -@@ -36,14 +36,18 @@ from samba.ntstatus import ( - from samba import NTSTATUSError - from samba.samba3 import param as s3param - from samba.samba3 import libsmb_samba_internal as libsmb -+from samba.credentials import SMB_SIGNING_REQUIRED - - class smb_pipe_socket(object): - - def __init__(self, target_hostname, pipename, creds, impersonation_level, lp): - lp3 = s3param.get_context() - lp3.load(lp.configfile) -+ saved_signing_state = creds.get_smb_ipc_signing() -+ creds.set_smb_ipc_signing(SMB_SIGNING_REQUIRED) - self.smbconn = libsmb.Conn(target_hostname, 'IPC$', lp3, - creds=creds, ipc=True, sign=True) -+ creds.set_smb_ipc_signing(saved_signing_state) - self.smbfid = self.smbconn.create(pipename, - DesiredAccess=0x12019f, - ShareAccess=0x7, --- -2.29.2 - - -From 19c1b06e7ca4ae26f36207b7dd070b33a853ff29 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Thu, 28 May 2020 17:59:19 +0200 -Subject: [PATCH 029/104] s3:libsmb: Use 'enum smb_signing_setting' in - cliconnect.c - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher ---- - source3/libsmb/cliconnect.c | 14 +++++++------- - source3/libsmb/proto.h | 10 +++++----- - 2 files changed, 12 insertions(+), 12 deletions(-) - -diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c -index f20146378e3..bb20aa59385 100644 ---- a/source3/libsmb/cliconnect.c -+++ b/source3/libsmb/cliconnect.c -@@ -2631,7 +2631,7 @@ static NTSTATUS cli_connect_sock_recv(struct tevent_req *req, - - struct cli_connect_nb_state { - const char *desthost; -- int signing_state; -+ enum smb_signing_setting signing_state; - int flags; - struct cli_state *cli; - }; -@@ -2642,7 +2642,7 @@ static struct tevent_req *cli_connect_nb_send( - TALLOC_CTX *mem_ctx, struct tevent_context *ev, - const char *host, const struct sockaddr_storage *dest_ss, - uint16_t port, int name_type, const char *myname, -- int signing_state, int flags) -+ enum smb_signing_setting signing_state, int flags) - { - struct tevent_req *req, *subreq; - struct cli_connect_nb_state *state; -@@ -2727,7 +2727,7 @@ static NTSTATUS cli_connect_nb_recv(struct tevent_req *req, - - NTSTATUS cli_connect_nb(const char *host, const struct sockaddr_storage *dest_ss, - uint16_t port, int name_type, const char *myname, -- int signing_state, int flags, struct cli_state **pcli) -+ enum smb_signing_setting signing_state, int flags, struct cli_state **pcli) - { - struct tevent_context *ev; - struct tevent_req *req; -@@ -2776,7 +2776,7 @@ static struct tevent_req *cli_start_connection_send( - TALLOC_CTX *mem_ctx, struct tevent_context *ev, - const char *my_name, const char *dest_host, - const struct sockaddr_storage *dest_ss, int port, -- int signing_state, int flags) -+ enum smb_signing_setting signing_state, int flags) - { - struct tevent_req *req, *subreq; - struct cli_start_connection_state *state; -@@ -2881,7 +2881,7 @@ NTSTATUS cli_start_connection(struct cli_state **output_cli, - const char *my_name, - const char *dest_host, - const struct sockaddr_storage *dest_ss, int port, -- int signing_state, int flags) -+ enum smb_signing_setting signing_state, int flags) - { - struct tevent_context *ev; - struct tevent_req *req; -@@ -3361,7 +3361,7 @@ struct tevent_req *cli_full_connection_creds_send( - const struct sockaddr_storage *dest_ss, int port, - const char *service, const char *service_type, - struct cli_credentials *creds, -- int flags, int signing_state) -+ int flags, enum smb_signing_setting signing_state) - { - struct tevent_req *req, *subreq; - struct cli_full_connection_creds_state *state; -@@ -3520,7 +3520,7 @@ NTSTATUS cli_full_connection_creds(struct cli_state **output_cli, - const char *service, const char *service_type, - struct cli_credentials *creds, - int flags, -- int signing_state) -+ enum smb_signing_setting signing_state) - { - struct tevent_context *ev; - struct tevent_req *req; -diff --git a/source3/libsmb/proto.h b/source3/libsmb/proto.h -index d214cdabca4..995187e21b4 100644 ---- a/source3/libsmb/proto.h -+++ b/source3/libsmb/proto.h -@@ -86,12 +86,12 @@ NTSTATUS cli_tree_connect(struct cli_state *cli, const char *share, - NTSTATUS cli_tdis(struct cli_state *cli); - NTSTATUS cli_connect_nb(const char *host, const struct sockaddr_storage *dest_ss, - uint16_t port, int name_type, const char *myname, -- int signing_state, int flags, struct cli_state **pcli); -+ enum smb_signing_setting signing_state, int flags, struct cli_state **pcli); - NTSTATUS cli_start_connection(struct cli_state **output_cli, - const char *my_name, - const char *dest_host, - const struct sockaddr_storage *dest_ss, int port, -- int signing_state, int flags); -+ enum smb_signing_setting signing_state, int flags); - NTSTATUS cli_smb1_setup_encryption(struct cli_state *cli, - struct cli_credentials *creds); - struct tevent_req *cli_full_connection_creds_send( -@@ -100,7 +100,7 @@ struct tevent_req *cli_full_connection_creds_send( - const struct sockaddr_storage *dest_ss, int port, - const char *service, const char *service_type, - struct cli_credentials *creds, -- int flags, int signing_state); -+ int flags, enum smb_signing_setting signing_state); - NTSTATUS cli_full_connection_creds_recv(struct tevent_req *req, - struct cli_state **output_cli); - NTSTATUS cli_full_connection_creds(struct cli_state **output_cli, -@@ -110,7 +110,7 @@ NTSTATUS cli_full_connection_creds(struct cli_state **output_cli, - const char *service, const char *service_type, - struct cli_credentials *creds, - int flags, -- int signing_state); -+ enum smb_signing_setting signing_state); - NTSTATUS cli_raw_tcon(struct cli_state *cli, - const char *service, const char *pass, const char *dev, - uint16_t *max_xmit, uint16_t *tid); -@@ -177,7 +177,7 @@ extern struct GUID cli_state_client_guid; - struct cli_state *cli_state_create(TALLOC_CTX *mem_ctx, - int fd, - const char *remote_name, -- int signing_state, -+ enum smb_signing_setting signing_state, - int flags); - void cli_nt_pipes_close(struct cli_state *cli); - void cli_shutdown(struct cli_state *cli); --- -2.29.2 - - -From 8ecad37d1fcc8d6fe07560df1bab35f2f70595f7 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Thu, 28 May 2020 18:11:31 +0200 -Subject: [PATCH 030/104] s3:client: Turn off smb signing for message op - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher ---- - python/samba/gpclass.py | 2 +- - python/samba/netcmd/domain_backup.py | 2 +- - python/samba/netcmd/gpo.py | 2 +- - python/samba/tests/dcerpc/raw_testcase.py | 2 +- - source3/client/client.c | 5 ++++- - source3/libsmb/pylibsmb.c | 20 +++++++++----------- - 6 files changed, 17 insertions(+), 16 deletions(-) - -diff --git a/python/samba/gpclass.py b/python/samba/gpclass.py -index 1781a55a618..2c00f5349a0 100644 ---- a/python/samba/gpclass.py -+++ b/python/samba/gpclass.py -@@ -426,7 +426,7 @@ def check_refresh_gpo_list(dc_hostname, lp, creds, gpos): - # Force signing for the connection - saved_signing_state = creds.get_smb_signing() - creds.set_smb_signing(SMB_SIGNING_REQUIRED) -- conn = libsmb.Conn(dc_hostname, 'sysvol', lp=s3_lp, creds=creds, sign=True) -+ conn = libsmb.Conn(dc_hostname, 'sysvol', lp=s3_lp, creds=creds) - # Reset signing state - creds.set_smb_signing(saved_signing_state) - cache_path = lp.cache_path('gpo_cache') -diff --git a/python/samba/netcmd/domain_backup.py b/python/samba/netcmd/domain_backup.py -index a9e0ba5bc67..2977b071ec3 100644 ---- a/python/samba/netcmd/domain_backup.py -+++ b/python/samba/netcmd/domain_backup.py -@@ -120,7 +120,7 @@ def smb_sysvol_conn(server, lp, creds): - # Force signing for the connection - saved_signing_state = creds.get_smb_signing() - creds.set_smb_signing(SMB_SIGNING_REQUIRED) -- conn = libsmb.Conn(server, "sysvol", lp=s3_lp, creds=creds, sign=True) -+ conn = libsmb.Conn(server, "sysvol", lp=s3_lp, creds=creds) - # Reset signing state - creds.set_smb_signing(saved_signing_state) - return conn -diff --git a/python/samba/netcmd/gpo.py b/python/samba/netcmd/gpo.py -index 0f2f6520fc3..bbaa0c17881 100644 ---- a/python/samba/netcmd/gpo.py -+++ b/python/samba/netcmd/gpo.py -@@ -392,7 +392,7 @@ def smb_connection(dc_hostname, service, lp, creds): - # the SMB bindings rely on having a s3 loadparm - s3_lp = s3param.get_context() - s3_lp.load(lp.configfile) -- conn = libsmb.Conn(dc_hostname, service, lp=s3_lp, creds=creds, sign=True) -+ conn = libsmb.Conn(dc_hostname, service, lp=s3_lp, creds=creds) - except Exception: - raise CommandError("Error connecting to '%s' using SMB" % dc_hostname) - # Reset signing state -diff --git a/python/samba/tests/dcerpc/raw_testcase.py b/python/samba/tests/dcerpc/raw_testcase.py -index d6f5de7440a..34785e2a2a7 100644 ---- a/python/samba/tests/dcerpc/raw_testcase.py -+++ b/python/samba/tests/dcerpc/raw_testcase.py -@@ -46,7 +46,7 @@ class smb_pipe_socket(object): - saved_signing_state = creds.get_smb_ipc_signing() - creds.set_smb_ipc_signing(SMB_SIGNING_REQUIRED) - self.smbconn = libsmb.Conn(target_hostname, 'IPC$', lp3, -- creds=creds, ipc=True, sign=True) -+ creds=creds, ipc=True) - creds.set_smb_ipc_signing(saved_signing_state) - self.smbfid = self.smbconn.create(pipename, - DesiredAccess=0x12019f, -diff --git a/source3/client/client.c b/source3/client/client.c -index 8c7ceb644aa..56309efcea7 100644 ---- a/source3/client/client.c -+++ b/source3/client/client.c -@@ -6164,7 +6164,10 @@ static int do_message_op(struct user_auth_info *a_info) - - status = cli_connect_nb(desthost, have_ip ? &dest_ss : NULL, - port ? port : NBT_SMB_PORT, name_type, -- lp_netbios_name(), SMB_SIGNING_DEFAULT, 0, &cli); -+ lp_netbios_name(), -+ SMB_SIGNING_OFF, -+ 0, -+ &cli); - if (!NT_STATUS_IS_OK(status)) { - d_printf("Connection to %s failed. Error %s\n", desthost, nt_errstr(status)); - return 1; -diff --git a/source3/libsmb/pylibsmb.c b/source3/libsmb/pylibsmb.c -index 3579a040830..f8a4d56cf53 100644 ---- a/source3/libsmb/pylibsmb.c -+++ b/source3/libsmb/pylibsmb.c -@@ -440,9 +440,7 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, - PyObject *py_lp = Py_None; - PyObject *py_multi_threaded = Py_False; - bool multi_threaded = false; -- PyObject *py_sign = Py_False; -- bool sign = false; -- int signing_state = SMB_SIGNING_DEFAULT; -+ enum smb_signing_setting signing_state = SMB_SIGNING_DEFAULT; - PyObject *py_force_smb1 = Py_False; - bool force_smb1 = false; - PyObject *py_ipc = Py_False; -@@ -453,7 +451,7 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, - - static const char *kwlist[] = { - "host", "share", "lp", "creds", -- "multi_threaded", "sign", "force_smb1", -+ "multi_threaded", "force_smb1", - "ipc", - NULL - }; -@@ -465,11 +463,10 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, - } - - ret = ParseTupleAndKeywords( -- args, kwds, "ssO|O!OOOO", kwlist, -+ args, kwds, "ssO|O!OOO", kwlist, - &host, &share, &py_lp, - py_type_Credentials, &creds, - &py_multi_threaded, -- &py_sign, - &py_force_smb1, - &py_ipc); - -@@ -480,13 +477,8 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, - } - - multi_threaded = PyObject_IsTrue(py_multi_threaded); -- sign = PyObject_IsTrue(py_sign); - force_smb1 = PyObject_IsTrue(py_force_smb1); - -- if (sign) { -- signing_state = SMB_SIGNING_REQUIRED; -- } -- - if (force_smb1) { - /* - * As most of the cli_*_send() function -@@ -532,6 +524,12 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, - cli_creds = PyCredentials_AsCliCredentials(creds); - } - -+ if (use_ipc) { -+ signing_state = cli_credentials_get_smb_ipc_signing(cli_creds); -+ } else { -+ signing_state = cli_credentials_get_smb_signing(cli_creds); -+ } -+ - req = cli_full_connection_creds_send( - NULL, self->ev, "myname", host, NULL, 0, share, "?????", - cli_creds, flags, signing_state); --- -2.29.2 - - -From 5325ea198e03bf4a51b101c74788df548eeedbac Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Thu, 28 May 2020 18:20:02 +0200 -Subject: [PATCH 031/104] s3:libsmb: Remove signing_state from - cli_full_connection_creds_send() - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher ---- - source3/libsmb/cliconnect.c | 11 +++++++++-- - source3/libsmb/proto.h | 2 +- - source3/libsmb/pylibsmb.c | 9 +-------- - 3 files changed, 11 insertions(+), 11 deletions(-) - -diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c -index bb20aa59385..0ff9c283e39 100644 ---- a/source3/libsmb/cliconnect.c -+++ b/source3/libsmb/cliconnect.c -@@ -3361,10 +3361,11 @@ struct tevent_req *cli_full_connection_creds_send( - const struct sockaddr_storage *dest_ss, int port, - const char *service, const char *service_type, - struct cli_credentials *creds, -- int flags, enum smb_signing_setting signing_state) -+ int flags) - { - struct tevent_req *req, *subreq; - struct cli_full_connection_creds_state *state; -+ enum smb_signing_setting signing_state; - - req = tevent_req_create(mem_ctx, &state, - struct cli_full_connection_creds_state); -@@ -3379,6 +3380,12 @@ struct tevent_req *cli_full_connection_creds_send( - state->creds = creds; - state->flags = flags; - -+ if (flags & CLI_FULL_CONNECTION_IPC) { -+ signing_state = cli_credentials_get_smb_ipc_signing(creds); -+ } else { -+ signing_state = cli_credentials_get_smb_signing(creds); -+ } -+ - subreq = cli_start_connection_send( - state, ev, my_name, dest_host, dest_ss, port, - signing_state, flags); -@@ -3532,7 +3539,7 @@ NTSTATUS cli_full_connection_creds(struct cli_state **output_cli, - } - req = cli_full_connection_creds_send( - ev, ev, my_name, dest_host, dest_ss, port, service, -- service_type, creds, flags, signing_state); -+ service_type, creds, flags); - if (req == NULL) { - goto fail; - } -diff --git a/source3/libsmb/proto.h b/source3/libsmb/proto.h -index 995187e21b4..bef04d32638 100644 ---- a/source3/libsmb/proto.h -+++ b/source3/libsmb/proto.h -@@ -100,7 +100,7 @@ struct tevent_req *cli_full_connection_creds_send( - const struct sockaddr_storage *dest_ss, int port, - const char *service, const char *service_type, - struct cli_credentials *creds, -- int flags, enum smb_signing_setting signing_state); -+ int flags); - NTSTATUS cli_full_connection_creds_recv(struct tevent_req *req, - struct cli_state **output_cli); - NTSTATUS cli_full_connection_creds(struct cli_state **output_cli, -diff --git a/source3/libsmb/pylibsmb.c b/source3/libsmb/pylibsmb.c -index f8a4d56cf53..c7a2d73afcb 100644 ---- a/source3/libsmb/pylibsmb.c -+++ b/source3/libsmb/pylibsmb.c -@@ -440,7 +440,6 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, - PyObject *py_lp = Py_None; - PyObject *py_multi_threaded = Py_False; - bool multi_threaded = false; -- enum smb_signing_setting signing_state = SMB_SIGNING_DEFAULT; - PyObject *py_force_smb1 = Py_False; - bool force_smb1 = false; - PyObject *py_ipc = Py_False; -@@ -524,15 +523,9 @@ static int py_cli_state_init(struct py_cli_state *self, PyObject *args, - cli_creds = PyCredentials_AsCliCredentials(creds); - } - -- if (use_ipc) { -- signing_state = cli_credentials_get_smb_ipc_signing(cli_creds); -- } else { -- signing_state = cli_credentials_get_smb_signing(cli_creds); -- } -- - req = cli_full_connection_creds_send( - NULL, self->ev, "myname", host, NULL, 0, share, "?????", -- cli_creds, flags, signing_state); -+ cli_creds, flags); - if (!py_tevent_req_wait_exc(self, req)) { - return -1; - } --- -2.29.2 - - -From 1517d0eb1036056851871e994849c647217ef36d Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Thu, 4 Jun 2020 14:59:14 +0200 -Subject: [PATCH 032/104] s3:libsmb: Remove signing_state from - cli_full_connection_creds() - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher ---- - examples/fuse/smb2mount.c | 3 +-- - examples/winexe/winexe.c | 4 +--- - source3/libnet/libnet_join.c | 9 +++------ - source3/libsmb/cliconnect.c | 6 ++---- - source3/libsmb/libsmb_server.c | 8 +------- - source3/libsmb/proto.h | 3 +-- - source3/rpc_server/spoolss/srv_spoolss_nt.c | 3 +-- - source3/rpcclient/cmd_spoolss.c | 5 +---- - source3/rpcclient/rpcclient.c | 3 +-- - source3/torture/locktest2.c | 11 +++++++++-- - source3/torture/torture.c | 6 ++---- - source3/utils/mdfind.c | 3 +-- - source3/utils/net_ads.c | 3 +-- - source3/utils/net_util.c | 8 ++------ - source3/utils/netlookup.c | 3 +-- - source3/utils/smbcacls.c | 3 +-- - source3/utils/smbcquotas.c | 4 +--- - 17 files changed, 30 insertions(+), 55 deletions(-) - -diff --git a/examples/fuse/smb2mount.c b/examples/fuse/smb2mount.c -index ea1d9a11e0b..6206c3a9701 100644 ---- a/examples/fuse/smb2mount.c -+++ b/examples/fuse/smb2mount.c -@@ -37,8 +37,7 @@ static struct cli_state *connect_one(const struct user_auth_info *auth_info, - NULL, port, - share, "?????", - get_cmdline_auth_info_creds(auth_info), -- flags, -- get_cmdline_auth_info_signing_state(auth_info)); -+ flags); - if (!NT_STATUS_IS_OK(nt_status)) { - DBG_ERR("cli_full_connection failed! (%s)\n", - nt_errstr(nt_status)); -diff --git a/examples/winexe/winexe.c b/examples/winexe/winexe.c -index bb9c27e2e6d..03e7ec85198 100644 ---- a/examples/winexe/winexe.c -+++ b/examples/winexe/winexe.c -@@ -360,7 +360,6 @@ static NTSTATUS winexe_svc_upload( - "ADMIN$", - "?????", - credentials, -- 0, - 0); - if (!NT_STATUS_IS_OK(status)) { - DBG_WARNING("cli_full_connection_creds failed: %s\n", -@@ -1919,8 +1918,7 @@ int main(int argc, const char *argv[]) - "IPC$", - "?????", - options.credentials, -- CLI_FULL_CONNECTION_IPC, -- 0); -+ CLI_FULL_CONNECTION_IPC); - - if (!NT_STATUS_IS_OK(status)) { - DBG_WARNING("cli_full_connection_creds failed: %s\n", -diff --git a/source3/libnet/libnet_join.c b/source3/libnet/libnet_join.c -index 392e3eff74f..f3bf27e6c00 100644 ---- a/source3/libnet/libnet_join.c -+++ b/source3/libnet/libnet_join.c -@@ -1095,8 +1095,7 @@ static NTSTATUS libnet_join_connect_dc_ipc(const char *dc, - NULL, 0, - "IPC$", "IPC", - creds, -- flags, -- SMB_SIGNING_IPC_DEFAULT); -+ flags); - if (!NT_STATUS_IS_OK(status)) { - TALLOC_FREE(frame); - return status; -@@ -1716,8 +1715,7 @@ NTSTATUS libnet_join_ok(struct messaging_context *msg_ctx, - NULL, 0, - "IPC$", "IPC", - cli_creds, -- flags, -- SMB_SIGNING_IPC_DEFAULT); -+ flags); - - if (!NT_STATUS_IS_OK(status)) { - struct cli_credentials *anon_creds = NULL; -@@ -1734,8 +1732,7 @@ NTSTATUS libnet_join_ok(struct messaging_context *msg_ctx, - NULL, 0, - "IPC$", "IPC", - anon_creds, -- flags, -- SMB_SIGNING_OFF); -+ flags); - } - - if (!NT_STATUS_IS_OK(status)) { -diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c -index 0ff9c283e39..b24743d789b 100644 ---- a/source3/libsmb/cliconnect.c -+++ b/source3/libsmb/cliconnect.c -@@ -3526,8 +3526,7 @@ NTSTATUS cli_full_connection_creds(struct cli_state **output_cli, - const struct sockaddr_storage *dest_ss, int port, - const char *service, const char *service_type, - struct cli_credentials *creds, -- int flags, -- enum smb_signing_setting signing_state) -+ int flags) - { - struct tevent_context *ev; - struct tevent_req *req; -@@ -3684,8 +3683,7 @@ struct cli_state *get_ipc_connect(char *server, - - nt_status = cli_full_connection_creds(&cli, NULL, server, server_ss, 0, "IPC$", "IPC", - get_cmdline_auth_info_creds(user_info), -- flags, -- SMB_SIGNING_DEFAULT); -+ flags); - - if (NT_STATUS_IS_OK(nt_status)) { - return cli; -diff --git a/source3/libsmb/libsmb_server.c b/source3/libsmb/libsmb_server.c -index 3d1cd602f6c..33dc8419deb 100644 ---- a/source3/libsmb/libsmb_server.c -+++ b/source3/libsmb/libsmb_server.c -@@ -785,7 +785,6 @@ SMBC_attr_server(TALLOC_CTX *ctx, - pp_workgroup, pp_username, pp_password); - if (!ipc_srv) { - struct cli_credentials *creds = NULL; -- int signing_state = SMB_SIGNING_DEFAULT; - - /* We didn't find a cached connection. Get the password */ - if (!*pp_password || (*pp_password)[0] == '\0') { -@@ -812,16 +811,11 @@ SMBC_attr_server(TALLOC_CTX *ctx, - return NULL; - } - -- if (context->internal->smb_encryption_level != SMBC_ENCRYPTLEVEL_NONE) { -- signing_state = SMB_SIGNING_REQUIRED; -- } -- - nt_status = cli_full_connection_creds(&ipc_cli, - lp_netbios_name(), server, - NULL, 0, "IPC$", "?????", - creds, -- flags, -- signing_state); -+ flags); - if (! NT_STATUS_IS_OK(nt_status)) { - TALLOC_FREE(creds); - DEBUG(1,("cli_full_connection failed! (%s)\n", -diff --git a/source3/libsmb/proto.h b/source3/libsmb/proto.h -index bef04d32638..850cf12c8a6 100644 ---- a/source3/libsmb/proto.h -+++ b/source3/libsmb/proto.h -@@ -109,8 +109,7 @@ NTSTATUS cli_full_connection_creds(struct cli_state **output_cli, - const struct sockaddr_storage *dest_ss, int port, - const char *service, const char *service_type, - struct cli_credentials *creds, -- int flags, -- enum smb_signing_setting signing_state); -+ int flags); - NTSTATUS cli_raw_tcon(struct cli_state *cli, - const char *service, const char *pass, const char *dev, - uint16_t *max_xmit, uint16_t *tid); -diff --git a/source3/rpc_server/spoolss/srv_spoolss_nt.c b/source3/rpc_server/spoolss/srv_spoolss_nt.c -index f578f1c4131..906fab2adb5 100644 ---- a/source3/rpc_server/spoolss/srv_spoolss_nt.c -+++ b/source3/rpc_server/spoolss/srv_spoolss_nt.c -@@ -2483,8 +2483,7 @@ static bool spoolss_connect_to_client(struct rpc_pipe_client **pp_pipe, struct c - ret = cli_full_connection_creds( pp_cli, lp_netbios_name(), remote_machine, - &rm_addr, 0, "IPC$", "IPC", - anon_creds, -- CLI_FULL_CONNECTION_IPC, -- SMB_SIGNING_OFF); -+ CLI_FULL_CONNECTION_IPC); - TALLOC_FREE(anon_creds); - if ( !NT_STATUS_IS_OK( ret ) ) { - DEBUG(2,("spoolss_connect_to_client: connection to [%s] failed!\n", -diff --git a/source3/rpcclient/cmd_spoolss.c b/source3/rpcclient/cmd_spoolss.c -index 7198a451ab7..02889a0a666 100644 ---- a/source3/rpcclient/cmd_spoolss.c -+++ b/source3/rpcclient/cmd_spoolss.c -@@ -3537,10 +3537,7 @@ static WERROR cmd_spoolss_printercmp(struct rpc_pipe_client *cli, - "IPC$", "IPC", - get_cmdline_auth_info_creds( - popt_get_cmdline_auth_info()), -- CLI_FULL_CONNECTION_IPC, -- get_cmdline_auth_info_signing_state( -- popt_get_cmdline_auth_info())); -- -+ CLI_FULL_CONNECTION_IPC); - if ( !NT_STATUS_IS_OK(nt_status) ) - return WERR_GEN_FAILURE; - -diff --git a/source3/rpcclient/rpcclient.c b/source3/rpcclient/rpcclient.c -index c86474d08f1..2ead6cc7ba5 100644 ---- a/source3/rpcclient/rpcclient.c -+++ b/source3/rpcclient/rpcclient.c -@@ -1206,8 +1206,7 @@ out_free: - "IPC$", "IPC", - get_cmdline_auth_info_creds( - popt_get_cmdline_auth_info()), -- flags, -- SMB_SIGNING_IPC_DEFAULT); -+ flags); - - if (!NT_STATUS_IS_OK(nt_status)) { - DEBUG(0,("Cannot connect to server. Error was %s\n", nt_errstr(nt_status))); -diff --git a/source3/torture/locktest2.c b/source3/torture/locktest2.c -index 84c335f959f..92ddb7629b9 100644 ---- a/source3/torture/locktest2.c -+++ b/source3/torture/locktest2.c -@@ -217,8 +217,15 @@ static struct cli_state *connect_one(char *share) - - slprintf(myname,sizeof(myname), "lock-%lu-%u", (unsigned long)getpid(), count++); - -- nt_status = cli_full_connection_creds(&c, myname, server_n, NULL, 0, share, "?????", -- creds, 0, SMB_SIGNING_DEFAULT); -+ nt_status = cli_full_connection_creds(&c, -+ myname, -+ server_n, -+ NULL, -+ 0, -+ share, -+ "?????", -+ creds, -+ 0); - TALLOC_FREE(creds); - if (!NT_STATUS_IS_OK(nt_status)) { - DEBUG(0, ("cli_full_connection failed with error %s\n", nt_errstr(nt_status))); -diff --git a/source3/torture/torture.c b/source3/torture/torture.c -index 2a3133373e9..a4edeefd628 100644 ---- a/source3/torture/torture.c -+++ b/source3/torture/torture.c -@@ -345,8 +345,7 @@ static bool torture_open_connection_share(struct cli_state **c, - sharename, - "?????", - torture_creds, -- flags, -- signing_state); -+ flags); - if (!NT_STATUS_IS_OK(status)) { - printf("failed to open share connection: //%s/%s port:%d - %s\n", - hostname, sharename, port_to_use, nt_errstr(status)); -@@ -1523,8 +1522,7 @@ static bool run_tcon_devtype_test(int dummy) - NULL, /* service */ - NULL, /* service_type */ - torture_creds, -- flags, -- signing_state); -+ flags); - - if (!NT_STATUS_IS_OK(status)) { - printf("could not open connection\n"); -diff --git a/source3/utils/mdfind.c b/source3/utils/mdfind.c -index a3c879e75fb..2ac4fde7daf 100644 ---- a/source3/utils/mdfind.c -+++ b/source3/utils/mdfind.c -@@ -153,8 +153,7 @@ int main(int argc, char **argv) - "IPC$", - "IPC", - creds, -- flags, -- SMB_SIGNING_IPC_DEFAULT); -+ flags); - if (!NT_STATUS_IS_OK(status)) { - DBG_ERR("Cannot connect to server: %s\n", nt_errstr(status)); - goto fail; -diff --git a/source3/utils/net_ads.c b/source3/utils/net_ads.c -index 28ef6dc9974..7f5b9c3a440 100644 ---- a/source3/utils/net_ads.c -+++ b/source3/utils/net_ads.c -@@ -2438,8 +2438,7 @@ static int net_ads_printer_publish(struct net_context *c, int argc, const char * - &server_ss, 0, - "IPC$", "IPC", - creds, -- CLI_FULL_CONNECTION_IPC, -- SMB_SIGNING_IPC_DEFAULT); -+ CLI_FULL_CONNECTION_IPC); - - if (NT_STATUS_IS_ERR(nt_status)) { - d_fprintf(stderr, _("Unable to open a connection to %s to " -diff --git a/source3/utils/net_util.c b/source3/utils/net_util.c -index d01b2d8c771..b139fb2d0da 100644 ---- a/source3/utils/net_util.c -+++ b/source3/utils/net_util.c -@@ -108,7 +108,6 @@ NTSTATUS connect_to_service(struct net_context *c, - const char *service_type) - { - NTSTATUS nt_status; -- enum smb_signing_setting signing_setting = SMB_SIGNING_DEFAULT; - struct cli_credentials *creds = NULL; - int flags = 0; - -@@ -119,7 +118,6 @@ NTSTATUS connect_to_service(struct net_context *c, - } - - if (strequal(service_type, "IPC")) { -- signing_setting = SMB_SIGNING_IPC_DEFAULT; - flags |= CLI_FULL_CONNECTION_IPC; - } - -@@ -127,8 +125,7 @@ NTSTATUS connect_to_service(struct net_context *c, - server_ss, c->opt_port, - service_name, service_type, - creds, -- flags, -- signing_setting); -+ flags); - if (!NT_STATUS_IS_OK(nt_status)) { - d_fprintf(stderr, _("Could not connect to server %s\n"), - server_name); -@@ -199,8 +196,7 @@ NTSTATUS connect_to_ipc_anonymous(struct net_context *c, - server_name, server_ss, c->opt_port, - "IPC$", "IPC", - anon_creds, -- CLI_FULL_CONNECTION_IPC, -- SMB_SIGNING_OFF); -+ CLI_FULL_CONNECTION_IPC); - - if (NT_STATUS_IS_OK(nt_status)) { - return nt_status; -diff --git a/source3/utils/netlookup.c b/source3/utils/netlookup.c -index 2241beb331f..aaf78b0977a 100644 ---- a/source3/utils/netlookup.c -+++ b/source3/utils/netlookup.c -@@ -99,8 +99,7 @@ static struct con_struct *create_cs(struct net_context *c, - &loopback_ss, 0, - "IPC$", "IPC", - anon_creds, -- CLI_FULL_CONNECTION_IPC, -- SMB_SIGNING_OFF); -+ CLI_FULL_CONNECTION_IPC); - - if (!NT_STATUS_IS_OK(nt_status)) { - DEBUG(2,("create_cs: Connect failed. Error was %s\n", nt_errstr(nt_status))); -diff --git a/source3/utils/smbcacls.c b/source3/utils/smbcacls.c -index f3209c31877..5983ebbd0a5 100644 ---- a/source3/utils/smbcacls.c -+++ b/source3/utils/smbcacls.c -@@ -778,8 +778,7 @@ static struct cli_state *connect_one(const struct user_auth_info *auth_info, - NULL, 0, - share, "?????", - get_cmdline_auth_info_creds(auth_info), -- flags, -- get_cmdline_auth_info_signing_state(auth_info)); -+ flags); - if (!NT_STATUS_IS_OK(nt_status)) { - DEBUG(0,("cli_full_connection failed! (%s)\n", nt_errstr(nt_status))); - return NULL; -diff --git a/source3/utils/smbcquotas.c b/source3/utils/smbcquotas.c -index 954d6eba804..fea066ce468 100644 ---- a/source3/utils/smbcquotas.c -+++ b/source3/utils/smbcquotas.c -@@ -527,9 +527,7 @@ static struct cli_state *connect_one(const char *share) - share, "?????", - get_cmdline_auth_info_creds( - popt_get_cmdline_auth_info()), -- flags, -- get_cmdline_auth_info_signing_state( -- popt_get_cmdline_auth_info())); -+ flags); - if (!NT_STATUS_IS_OK(nt_status)) { - DEBUG(0,("cli_full_connection failed! (%s)\n", nt_errstr(nt_status))); - return NULL; --- -2.29.2 - - -From 07ccfed08ceadd0b7497e7259e855b1937522129 Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Mon, 8 Jun 2020 08:04:24 +0200 -Subject: [PATCH 033/104] s3:libsmb: Add encryption support to - cli_full_connection_creds*() - -Pair-Programmed-With: Andreas Schneider - -Signed-off-by: Andreas Schneider -Signed-off-by: Stefan Metzmacher -Reviewed-by: Andreas Schneider ---- - source3/libsmb/cliconnect.c | 166 ++++++++++++++++++++++++++++++++++++ - 1 file changed, 166 insertions(+) - -diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c -index b24743d789b..abfd18bfaf1 100644 ---- a/source3/libsmb/cliconnect.c -+++ b/source3/libsmb/cliconnect.c -@@ -3352,6 +3352,10 @@ static int cli_full_connection_creds_state_destructor( - static void cli_full_connection_creds_conn_done(struct tevent_req *subreq); - static void cli_full_connection_creds_sess_start(struct tevent_req *req); - static void cli_full_connection_creds_sess_done(struct tevent_req *subreq); -+static void cli_full_connection_creds_enc_start(struct tevent_req *req); -+static void cli_full_connection_creds_enc_tcon(struct tevent_req *subreq); -+static void cli_full_connection_creds_enc_ver(struct tevent_req *subreq); -+static void cli_full_connection_creds_enc_done(struct tevent_req *subreq); - static void cli_full_connection_creds_tcon_start(struct tevent_req *req); - static void cli_full_connection_creds_tcon_done(struct tevent_req *subreq); - -@@ -3366,6 +3370,8 @@ struct tevent_req *cli_full_connection_creds_send( - struct tevent_req *req, *subreq; - struct cli_full_connection_creds_state *state; - enum smb_signing_setting signing_state; -+ enum smb_encryption_setting encryption_state = -+ cli_credentials_get_smb_encryption(creds); - - req = tevent_req_create(mem_ctx, &state, - struct cli_full_connection_creds_state); -@@ -3386,6 +3392,16 @@ struct tevent_req *cli_full_connection_creds_send( - signing_state = cli_credentials_get_smb_signing(creds); - } - -+ if (encryption_state == SMB_ENCRYPTION_REQUIRED) { -+ if (flags & CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK) { -+ encryption_state = SMB_ENCRYPTION_DESIRED; -+ } -+ } -+ -+ if (encryption_state >= SMB_ENCRYPTION_DESIRED) { -+ signing_state = SMB_SIGNING_REQUIRED; -+ } -+ - subreq = cli_start_connection_send( - state, ev, my_name, dest_host, dest_ss, port, - signing_state, flags); -@@ -3460,6 +3476,156 @@ static void cli_full_connection_creds_sess_done(struct tevent_req *subreq) - return; - } - -+ cli_full_connection_creds_enc_start(req); -+} -+ -+static void cli_full_connection_creds_enc_start(struct tevent_req *req) -+{ -+ struct cli_full_connection_creds_state *state = tevent_req_data( -+ req, struct cli_full_connection_creds_state); -+ enum smb_encryption_setting encryption_state = -+ cli_credentials_get_smb_encryption(state->creds); -+ struct tevent_req *subreq = NULL; -+ NTSTATUS status; -+ -+ if (encryption_state < SMB_ENCRYPTION_DESIRED) { -+ cli_full_connection_creds_tcon_start(req); -+ return; -+ } -+ -+ if (smbXcli_conn_protocol(state->cli->conn) >= PROTOCOL_SMB2_02) { -+ status = smb2cli_session_encryption_on(state->cli->smb2.session); -+ if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) { -+ if (encryption_state < SMB_ENCRYPTION_REQUIRED) { -+ cli_full_connection_creds_tcon_start(req); -+ return; -+ } -+ d_printf("Encryption required and " -+ "server doesn't support " -+ "SMB3 encryption - failing connect\n"); -+ tevent_req_nterror(req, status); -+ return; -+ } else if (!NT_STATUS_IS_OK(status)) { -+ d_printf("Encryption required and " -+ "setup failed with error %s.\n", -+ nt_errstr(status)); -+ tevent_req_nterror(req, status); -+ return; -+ } -+ -+ cli_full_connection_creds_tcon_start(req); -+ return; -+ } -+ -+ if (!SERVER_HAS_UNIX_CIFS(state->cli)) { -+ if (encryption_state < SMB_ENCRYPTION_REQUIRED) { -+ cli_full_connection_creds_tcon_start(req); -+ return; -+ } -+ -+ status = NT_STATUS_NOT_SUPPORTED; -+ d_printf("Encryption required and " -+ "server doesn't support " -+ "SMB1 Unix Extensions - failing connect\n"); -+ tevent_req_nterror(req, status); -+ return; -+ } -+ -+ /* -+ * We do a tcon on IPC$ just to setup the encryption, -+ * the real tcon will be encrypted then. -+ */ -+ subreq = cli_tree_connect_send(state, state->ev, state->cli, -+ "IPC$", "IPC", NULL); -+ if (tevent_req_nomem(subreq, req)) { -+ return; -+ } -+ tevent_req_set_callback(subreq, cli_full_connection_creds_enc_tcon, req); -+} -+ -+static void cli_full_connection_creds_enc_tcon(struct tevent_req *subreq) -+{ -+ struct tevent_req *req = tevent_req_callback_data( -+ subreq, struct tevent_req); -+ struct cli_full_connection_creds_state *state = tevent_req_data( -+ req, struct cli_full_connection_creds_state); -+ NTSTATUS status; -+ -+ status = cli_tree_connect_recv(subreq); -+ TALLOC_FREE(subreq); -+ if (tevent_req_nterror(req, status)) { -+ return; -+ } -+ -+ subreq = cli_unix_extensions_version_send(state, state->ev, state->cli); -+ if (tevent_req_nomem(subreq, req)) { -+ return; -+ } -+ tevent_req_set_callback(subreq, cli_full_connection_creds_enc_ver, req); -+} -+ -+static void cli_full_connection_creds_enc_ver(struct tevent_req *subreq) -+{ -+ struct tevent_req *req = tevent_req_callback_data( -+ subreq, struct tevent_req); -+ struct cli_full_connection_creds_state *state = tevent_req_data( -+ req, struct cli_full_connection_creds_state); -+ enum smb_encryption_setting encryption_state = -+ cli_credentials_get_smb_encryption(state->creds); -+ uint16_t major, minor; -+ uint32_t caplow, caphigh; -+ NTSTATUS status; -+ -+ status = cli_unix_extensions_version_recv(subreq, -+ &major, &minor, -+ &caplow, -+ &caphigh); -+ TALLOC_FREE(subreq); -+ if (!NT_STATUS_IS_OK(status)) { -+ if (encryption_state < SMB_ENCRYPTION_REQUIRED) { -+ cli_full_connection_creds_tcon_start(req); -+ return; -+ } -+ DEBUG(10, ("%s: cli_unix_extensions_version " -+ "returned %s\n", __func__, nt_errstr(status))); -+ tevent_req_nterror(req, NT_STATUS_UNKNOWN_REVISION); -+ return; -+ } -+ -+ if (!(caplow & CIFS_UNIX_TRANSPORT_ENCRYPTION_CAP)) { -+ if (encryption_state < SMB_ENCRYPTION_REQUIRED) { -+ cli_full_connection_creds_tcon_start(req); -+ return; -+ } -+ DEBUG(10, ("%s: CIFS_UNIX_TRANSPORT_ENCRYPTION_CAP " -+ "not supported\n", __func__)); -+ tevent_req_nterror(req, NT_STATUS_UNSUPPORTED_COMPRESSION); -+ return; -+ } -+ -+ subreq = cli_smb1_setup_encryption_send(state, state->ev, -+ state->cli, -+ state->creds); -+ if (tevent_req_nomem(subreq, req)) { -+ return; -+ } -+ tevent_req_set_callback(subreq, -+ cli_full_connection_creds_enc_done, -+ req); -+} -+ -+static void cli_full_connection_creds_enc_done(struct tevent_req *subreq) -+{ -+ struct tevent_req *req = tevent_req_callback_data( -+ subreq, struct tevent_req); -+ NTSTATUS status; -+ -+ status = cli_smb1_setup_encryption_recv(subreq); -+ TALLOC_FREE(subreq); -+ if (tevent_req_nterror(req, status)) { -+ return; -+ } -+ - cli_full_connection_creds_tcon_start(req); - } - --- -2.29.2 - - -From bf05adca0d32212d4eead676ef89d4a96d3949a0 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Wed, 10 Jun 2020 11:26:00 +0200 -Subject: [PATCH 034/104] python: Add a test for SMB encryption - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher ---- - python/samba/tests/libsmb.py | 37 ++++++++++++++++++++++++++++++++++++ - 1 file changed, 37 insertions(+) - -diff --git a/python/samba/tests/libsmb.py b/python/samba/tests/libsmb.py -index e8f8e7fe94d..81d4e482644 100644 ---- a/python/samba/tests/libsmb.py -+++ b/python/samba/tests/libsmb.py -@@ -21,10 +21,12 @@ from samba.samba3 import libsmb_samba_internal as libsmb - from samba.dcerpc import security - from samba.samba3 import param as s3param - from samba import credentials -+from samba.credentials import SMB_ENCRYPTION_REQUIRED - import samba.tests - import threading - import sys - import os -+import random - - - class LibsmbTestCase(samba.tests.TestCase): -@@ -77,6 +79,41 @@ class LibsmbTestCase(samba.tests.TestCase): - if t.exc: - raise t.exc[0](t.exc[1]) - -+ def test_SMB3EncryptionRequired(self): -+ test_dir = 'testing_%d' % random.randint(0, 0xFFFF) -+ -+ lp = s3param.get_context() -+ lp.load(os.getenv("SMB_CONF_PATH")) -+ -+ creds = credentials.Credentials() -+ creds.guess(lp) -+ creds.set_username(os.getenv("USERNAME")) -+ creds.set_password(os.getenv("PASSWORD")) -+ creds.set_smb_encryption(SMB_ENCRYPTION_REQUIRED) -+ -+ c = libsmb.Conn(os.getenv("SERVER_IP"), "tmp", -+ lp, creds) -+ -+ c.mkdir(test_dir) -+ c.rmdir(test_dir) -+ -+ def test_SMB1EncryptionRequired(self): -+ test_dir = 'testing_%d' % random.randint(0, 0xFFFF) -+ -+ lp = s3param.get_context() -+ lp.load(os.getenv("SMB_CONF_PATH")) -+ -+ creds = credentials.Credentials() -+ creds.guess(lp) -+ creds.set_username(os.getenv("USERNAME")) -+ creds.set_password(os.getenv("PASSWORD")) -+ creds.set_smb_encryption(SMB_ENCRYPTION_REQUIRED) -+ -+ c = libsmb.Conn(os.getenv("SERVER_IP"), "tmp", -+ lp, creds, force_smb1=True) -+ -+ c.mkdir(test_dir) -+ c.rmdir(test_dir) - - if __name__ == "__main__": - import unittest --- -2.29.2 - - -From 86954cbf471bf391f50866d5d983c57cf8a4f064 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Wed, 10 Jun 2020 12:31:02 +0200 -Subject: [PATCH 035/104] s3:net: Use cli_credentials_set_smb_encryption() - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher ---- - source3/utils/net_util.c | 16 ++++++---------- - 1 file changed, 6 insertions(+), 10 deletions(-) - -diff --git a/source3/utils/net_util.c b/source3/utils/net_util.c -index b139fb2d0da..5829d891075 100644 ---- a/source3/utils/net_util.c -+++ b/source3/utils/net_util.c -@@ -148,16 +148,6 @@ NTSTATUS connect_to_service(struct net_context *c, - return nt_status; - } - -- if (c->smb_encrypt) { -- nt_status = cli_cm_force_encryption_creds(*cli_ctx, -- creds, -- service_name); -- if (!NT_STATUS_IS_OK(nt_status)) { -- cli_shutdown(*cli_ctx); -- *cli_ctx = NULL; -- } -- } -- - return nt_status; - } - -@@ -577,6 +567,12 @@ struct cli_credentials *net_context_creds(struct net_context *c, - CRED_SPECIFIED); - } - -+ if (c->smb_encrypt) { -+ cli_credentials_set_smb_encryption(creds, -+ SMB_ENCRYPTION_REQUIRED, -+ CRED_SPECIFIED); -+ } -+ - return creds; - } - --- -2.29.2 - - -From 1d065c5960ea2bce6bab5420476a0c21ba40d26e Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Wed, 10 Jun 2020 12:40:13 +0200 -Subject: [PATCH 036/104] s3:libsmb: Use cli_credentials_set_smb_encryption() - -This also adds a SMBC_ENCRYPTLEVEL_DEFAULT to 'enum -smbc_smb_encrypt_level' in order to use the smb.conf default value. - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher ---- - source3/include/libsmbclient.h | 1 + - source3/libsmb/ABI/smbclient-0.7.0.sigs | 188 ++++++++++++++++++++++++ - source3/libsmb/libsmb_context.c | 4 +- - source3/libsmb/libsmb_server.c | 72 +++------ - source3/libsmb/wscript | 2 +- - 5 files changed, 216 insertions(+), 51 deletions(-) - create mode 100644 source3/libsmb/ABI/smbclient-0.7.0.sigs - -diff --git a/source3/include/libsmbclient.h b/source3/include/libsmbclient.h -index c47e7c2a872..84c98089251 100644 ---- a/source3/include/libsmbclient.h -+++ b/source3/include/libsmbclient.h -@@ -225,6 +225,7 @@ typedef enum smbc_share_mode - */ - typedef enum smbc_smb_encrypt_level - { -+ SMBC_ENCRYPTLEVEL_DEFAULT = -1, - SMBC_ENCRYPTLEVEL_NONE = 0, - SMBC_ENCRYPTLEVEL_REQUEST = 1, - SMBC_ENCRYPTLEVEL_REQUIRE = 2 -diff --git a/source3/libsmb/ABI/smbclient-0.7.0.sigs b/source3/libsmb/ABI/smbclient-0.7.0.sigs -new file mode 100644 -index 00000000000..ee758e21b50 ---- /dev/null -+++ b/source3/libsmb/ABI/smbclient-0.7.0.sigs -@@ -0,0 +1,188 @@ -+smbc_chmod: int (const char *, mode_t) -+smbc_close: int (int) -+smbc_closedir: int (int) -+smbc_creat: int (const char *, mode_t) -+smbc_fgetxattr: int (int, const char *, const void *, size_t) -+smbc_flistxattr: int (int, char *, size_t) -+smbc_free_context: int (SMBCCTX *, int) -+smbc_fremovexattr: int (int, const char *) -+smbc_fsetxattr: int (int, const char *, const void *, size_t, int) -+smbc_fstat: int (int, struct stat *) -+smbc_fstatvfs: int (int, struct statvfs *) -+smbc_ftruncate: int (int, off_t) -+smbc_getDebug: int (SMBCCTX *) -+smbc_getFunctionAddCachedServer: smbc_add_cached_srv_fn (SMBCCTX *) -+smbc_getFunctionAuthData: smbc_get_auth_data_fn (SMBCCTX *) -+smbc_getFunctionAuthDataWithContext: smbc_get_auth_data_with_context_fn (SMBCCTX *) -+smbc_getFunctionCheckServer: smbc_check_server_fn (SMBCCTX *) -+smbc_getFunctionChmod: smbc_chmod_fn (SMBCCTX *) -+smbc_getFunctionClose: smbc_close_fn (SMBCCTX *) -+smbc_getFunctionClosedir: smbc_closedir_fn (SMBCCTX *) -+smbc_getFunctionCreat: smbc_creat_fn (SMBCCTX *) -+smbc_getFunctionFstat: smbc_fstat_fn (SMBCCTX *) -+smbc_getFunctionFstatVFS: smbc_fstatvfs_fn (SMBCCTX *) -+smbc_getFunctionFstatdir: smbc_fstatdir_fn (SMBCCTX *) -+smbc_getFunctionFtruncate: smbc_ftruncate_fn (SMBCCTX *) -+smbc_getFunctionGetCachedServer: smbc_get_cached_srv_fn (SMBCCTX *) -+smbc_getFunctionGetdents: smbc_getdents_fn (SMBCCTX *) -+smbc_getFunctionGetxattr: smbc_getxattr_fn (SMBCCTX *) -+smbc_getFunctionListPrintJobs: smbc_list_print_jobs_fn (SMBCCTX *) -+smbc_getFunctionListxattr: smbc_listxattr_fn (SMBCCTX *) -+smbc_getFunctionLseek: smbc_lseek_fn (SMBCCTX *) -+smbc_getFunctionLseekdir: smbc_lseekdir_fn (SMBCCTX *) -+smbc_getFunctionMkdir: smbc_mkdir_fn (SMBCCTX *) -+smbc_getFunctionNotify: smbc_notify_fn (SMBCCTX *) -+smbc_getFunctionOpen: smbc_open_fn (SMBCCTX *) -+smbc_getFunctionOpenPrintJob: smbc_open_print_job_fn (SMBCCTX *) -+smbc_getFunctionOpendir: smbc_opendir_fn (SMBCCTX *) -+smbc_getFunctionPrintFile: smbc_print_file_fn (SMBCCTX *) -+smbc_getFunctionPurgeCachedServers: smbc_purge_cached_fn (SMBCCTX *) -+smbc_getFunctionRead: smbc_read_fn (SMBCCTX *) -+smbc_getFunctionReaddir: smbc_readdir_fn (SMBCCTX *) -+smbc_getFunctionReaddirPlus: smbc_readdirplus_fn (SMBCCTX *) -+smbc_getFunctionReaddirPlus2: smbc_readdirplus2_fn (SMBCCTX *) -+smbc_getFunctionRemoveCachedServer: smbc_remove_cached_srv_fn (SMBCCTX *) -+smbc_getFunctionRemoveUnusedServer: smbc_remove_unused_server_fn (SMBCCTX *) -+smbc_getFunctionRemovexattr: smbc_removexattr_fn (SMBCCTX *) -+smbc_getFunctionRename: smbc_rename_fn (SMBCCTX *) -+smbc_getFunctionRmdir: smbc_rmdir_fn (SMBCCTX *) -+smbc_getFunctionSetxattr: smbc_setxattr_fn (SMBCCTX *) -+smbc_getFunctionSplice: smbc_splice_fn (SMBCCTX *) -+smbc_getFunctionStat: smbc_stat_fn (SMBCCTX *) -+smbc_getFunctionStatVFS: smbc_statvfs_fn (SMBCCTX *) -+smbc_getFunctionTelldir: smbc_telldir_fn (SMBCCTX *) -+smbc_getFunctionUnlink: smbc_unlink_fn (SMBCCTX *) -+smbc_getFunctionUnlinkPrintJob: smbc_unlink_print_job_fn (SMBCCTX *) -+smbc_getFunctionUtimes: smbc_utimes_fn (SMBCCTX *) -+smbc_getFunctionWrite: smbc_write_fn (SMBCCTX *) -+smbc_getNetbiosName: const char *(SMBCCTX *) -+smbc_getOptionBrowseMaxLmbCount: int (SMBCCTX *) -+smbc_getOptionCaseSensitive: smbc_bool (SMBCCTX *) -+smbc_getOptionDebugToStderr: smbc_bool (SMBCCTX *) -+smbc_getOptionFallbackAfterKerberos: smbc_bool (SMBCCTX *) -+smbc_getOptionFullTimeNames: smbc_bool (SMBCCTX *) -+smbc_getOptionNoAutoAnonymousLogin: smbc_bool (SMBCCTX *) -+smbc_getOptionOneSharePerServer: smbc_bool (SMBCCTX *) -+smbc_getOptionOpenShareMode: smbc_share_mode (SMBCCTX *) -+smbc_getOptionSmbEncryptionLevel: smbc_smb_encrypt_level (SMBCCTX *) -+smbc_getOptionUrlEncodeReaddirEntries: smbc_bool (SMBCCTX *) -+smbc_getOptionUseCCache: smbc_bool (SMBCCTX *) -+smbc_getOptionUseKerberos: smbc_bool (SMBCCTX *) -+smbc_getOptionUseNTHash: smbc_bool (SMBCCTX *) -+smbc_getOptionUserData: void *(SMBCCTX *) -+smbc_getPort: uint16_t (SMBCCTX *) -+smbc_getServerCacheData: struct smbc_server_cache *(SMBCCTX *) -+smbc_getTimeout: int (SMBCCTX *) -+smbc_getUser: const char *(SMBCCTX *) -+smbc_getWorkgroup: const char *(SMBCCTX *) -+smbc_getdents: int (unsigned int, struct smbc_dirent *, int) -+smbc_getxattr: int (const char *, const char *, const void *, size_t) -+smbc_init: int (smbc_get_auth_data_fn, int) -+smbc_init_context: SMBCCTX *(SMBCCTX *) -+smbc_lgetxattr: int (const char *, const char *, const void *, size_t) -+smbc_list_print_jobs: int (const char *, smbc_list_print_job_fn) -+smbc_listxattr: int (const char *, char *, size_t) -+smbc_llistxattr: int (const char *, char *, size_t) -+smbc_lremovexattr: int (const char *, const char *) -+smbc_lseek: off_t (int, off_t, int) -+smbc_lseekdir: int (int, off_t) -+smbc_lsetxattr: int (const char *, const char *, const void *, size_t, int) -+smbc_mkdir: int (const char *, mode_t) -+smbc_new_context: SMBCCTX *(void) -+smbc_notify: int (int, smbc_bool, uint32_t, unsigned int, smbc_notify_callback_fn, void *) -+smbc_open: int (const char *, int, mode_t) -+smbc_open_print_job: int (const char *) -+smbc_opendir: int (const char *) -+smbc_option_get: void *(SMBCCTX *, char *) -+smbc_option_set: void (SMBCCTX *, char *, ...) -+smbc_print_file: int (const char *, const char *) -+smbc_read: ssize_t (int, void *, size_t) -+smbc_readdir: struct smbc_dirent *(unsigned int) -+smbc_readdirplus: const struct libsmb_file_info *(unsigned int) -+smbc_readdirplus2: const struct libsmb_file_info *(unsigned int, struct stat *) -+smbc_removexattr: int (const char *, const char *) -+smbc_rename: int (const char *, const char *) -+smbc_rmdir: int (const char *) -+smbc_setConfiguration: int (SMBCCTX *, const char *) -+smbc_setDebug: void (SMBCCTX *, int) -+smbc_setFunctionAddCachedServer: void (SMBCCTX *, smbc_add_cached_srv_fn) -+smbc_setFunctionAuthData: void (SMBCCTX *, smbc_get_auth_data_fn) -+smbc_setFunctionAuthDataWithContext: void (SMBCCTX *, smbc_get_auth_data_with_context_fn) -+smbc_setFunctionCheckServer: void (SMBCCTX *, smbc_check_server_fn) -+smbc_setFunctionChmod: void (SMBCCTX *, smbc_chmod_fn) -+smbc_setFunctionClose: void (SMBCCTX *, smbc_close_fn) -+smbc_setFunctionClosedir: void (SMBCCTX *, smbc_closedir_fn) -+smbc_setFunctionCreat: void (SMBCCTX *, smbc_creat_fn) -+smbc_setFunctionFstat: void (SMBCCTX *, smbc_fstat_fn) -+smbc_setFunctionFstatVFS: void (SMBCCTX *, smbc_fstatvfs_fn) -+smbc_setFunctionFstatdir: void (SMBCCTX *, smbc_fstatdir_fn) -+smbc_setFunctionFtruncate: void (SMBCCTX *, smbc_ftruncate_fn) -+smbc_setFunctionGetCachedServer: void (SMBCCTX *, smbc_get_cached_srv_fn) -+smbc_setFunctionGetdents: void (SMBCCTX *, smbc_getdents_fn) -+smbc_setFunctionGetxattr: void (SMBCCTX *, smbc_getxattr_fn) -+smbc_setFunctionListPrintJobs: void (SMBCCTX *, smbc_list_print_jobs_fn) -+smbc_setFunctionListxattr: void (SMBCCTX *, smbc_listxattr_fn) -+smbc_setFunctionLseek: void (SMBCCTX *, smbc_lseek_fn) -+smbc_setFunctionLseekdir: void (SMBCCTX *, smbc_lseekdir_fn) -+smbc_setFunctionMkdir: void (SMBCCTX *, smbc_mkdir_fn) -+smbc_setFunctionNotify: void (SMBCCTX *, smbc_notify_fn) -+smbc_setFunctionOpen: void (SMBCCTX *, smbc_open_fn) -+smbc_setFunctionOpenPrintJob: void (SMBCCTX *, smbc_open_print_job_fn) -+smbc_setFunctionOpendir: void (SMBCCTX *, smbc_opendir_fn) -+smbc_setFunctionPrintFile: void (SMBCCTX *, smbc_print_file_fn) -+smbc_setFunctionPurgeCachedServers: void (SMBCCTX *, smbc_purge_cached_fn) -+smbc_setFunctionRead: void (SMBCCTX *, smbc_read_fn) -+smbc_setFunctionReaddir: void (SMBCCTX *, smbc_readdir_fn) -+smbc_setFunctionReaddirPlus: void (SMBCCTX *, smbc_readdirplus_fn) -+smbc_setFunctionReaddirPlus2: void (SMBCCTX *, smbc_readdirplus2_fn) -+smbc_setFunctionRemoveCachedServer: void (SMBCCTX *, smbc_remove_cached_srv_fn) -+smbc_setFunctionRemoveUnusedServer: void (SMBCCTX *, smbc_remove_unused_server_fn) -+smbc_setFunctionRemovexattr: void (SMBCCTX *, smbc_removexattr_fn) -+smbc_setFunctionRename: void (SMBCCTX *, smbc_rename_fn) -+smbc_setFunctionRmdir: void (SMBCCTX *, smbc_rmdir_fn) -+smbc_setFunctionSetxattr: void (SMBCCTX *, smbc_setxattr_fn) -+smbc_setFunctionSplice: void (SMBCCTX *, smbc_splice_fn) -+smbc_setFunctionStat: void (SMBCCTX *, smbc_stat_fn) -+smbc_setFunctionStatVFS: void (SMBCCTX *, smbc_statvfs_fn) -+smbc_setFunctionTelldir: void (SMBCCTX *, smbc_telldir_fn) -+smbc_setFunctionUnlink: void (SMBCCTX *, smbc_unlink_fn) -+smbc_setFunctionUnlinkPrintJob: void (SMBCCTX *, smbc_unlink_print_job_fn) -+smbc_setFunctionUtimes: void (SMBCCTX *, smbc_utimes_fn) -+smbc_setFunctionWrite: void (SMBCCTX *, smbc_write_fn) -+smbc_setLogCallback: void (SMBCCTX *, void *, smbc_debug_callback_fn) -+smbc_setNetbiosName: void (SMBCCTX *, const char *) -+smbc_setOptionBrowseMaxLmbCount: void (SMBCCTX *, int) -+smbc_setOptionCaseSensitive: void (SMBCCTX *, smbc_bool) -+smbc_setOptionDebugToStderr: void (SMBCCTX *, smbc_bool) -+smbc_setOptionFallbackAfterKerberos: void (SMBCCTX *, smbc_bool) -+smbc_setOptionFullTimeNames: void (SMBCCTX *, smbc_bool) -+smbc_setOptionNoAutoAnonymousLogin: void (SMBCCTX *, smbc_bool) -+smbc_setOptionOneSharePerServer: void (SMBCCTX *, smbc_bool) -+smbc_setOptionOpenShareMode: void (SMBCCTX *, smbc_share_mode) -+smbc_setOptionProtocols: smbc_bool (SMBCCTX *, const char *, const char *) -+smbc_setOptionSmbEncryptionLevel: void (SMBCCTX *, smbc_smb_encrypt_level) -+smbc_setOptionUrlEncodeReaddirEntries: void (SMBCCTX *, smbc_bool) -+smbc_setOptionUseCCache: void (SMBCCTX *, smbc_bool) -+smbc_setOptionUseKerberos: void (SMBCCTX *, smbc_bool) -+smbc_setOptionUseNTHash: void (SMBCCTX *, smbc_bool) -+smbc_setOptionUserData: void (SMBCCTX *, void *) -+smbc_setPort: void (SMBCCTX *, uint16_t) -+smbc_setServerCacheData: void (SMBCCTX *, struct smbc_server_cache *) -+smbc_setTimeout: void (SMBCCTX *, int) -+smbc_setUser: void (SMBCCTX *, const char *) -+smbc_setWorkgroup: void (SMBCCTX *, const char *) -+smbc_set_context: SMBCCTX *(SMBCCTX *) -+smbc_set_credentials: void (const char *, const char *, const char *, smbc_bool, const char *) -+smbc_set_credentials_with_fallback: void (SMBCCTX *, const char *, const char *, const char *) -+smbc_setxattr: int (const char *, const char *, const void *, size_t, int) -+smbc_stat: int (const char *, struct stat *) -+smbc_statvfs: int (char *, struct statvfs *) -+smbc_telldir: off_t (int) -+smbc_unlink: int (const char *) -+smbc_unlink_print_job: int (const char *, int) -+smbc_urldecode: int (char *, char *, size_t) -+smbc_urlencode: int (char *, char *, int) -+smbc_utime: int (const char *, struct utimbuf *) -+smbc_utimes: int (const char *, struct timeval *) -+smbc_version: const char *(void) -+smbc_write: ssize_t (int, const void *, size_t) -diff --git a/source3/libsmb/libsmb_context.c b/source3/libsmb/libsmb_context.c -index eaa0cdeca93..ea741f41c7d 100644 ---- a/source3/libsmb/libsmb_context.c -+++ b/source3/libsmb/libsmb_context.c -@@ -171,7 +171,7 @@ smbc_new_context(void) - - smbc_setOptionFullTimeNames(context, False); - smbc_setOptionOpenShareMode(context, SMBC_SHAREMODE_DENY_NONE); -- smbc_setOptionSmbEncryptionLevel(context, SMBC_ENCRYPTLEVEL_NONE); -+ smbc_setOptionSmbEncryptionLevel(context, SMBC_ENCRYPTLEVEL_DEFAULT); - smbc_setOptionUseCCache(context, True); - smbc_setOptionCaseSensitive(context, False); - smbc_setOptionBrowseMaxLmbCount(context, 3); /* # LMBs to query */ -@@ -474,6 +474,8 @@ smbc_option_get(SMBCCTX *context, - } else if (strcmp(option_name, "smb_encrypt_level") == 0) { - switch(smbc_getOptionSmbEncryptionLevel(context)) - { -+ case SMBC_ENCRYPTLEVEL_DEFAULT: -+ return discard_const_p(void, "default"); - case 0: - return discard_const_p(void, "none"); - case 1: -diff --git a/source3/libsmb/libsmb_server.c b/source3/libsmb/libsmb_server.c -index 33dc8419deb..eb58d7c6ac9 100644 ---- a/source3/libsmb/libsmb_server.c -+++ b/source3/libsmb/libsmb_server.c -@@ -284,6 +284,29 @@ static struct cli_credentials *SMBC_auth_credentials(TALLOC_CTX *mem_ctx, - return NULL; - } - -+ switch (context->internal->smb_encryption_level) { -+ case SMBC_ENCRYPTLEVEL_DEFAULT: -+ /* Use the config option */ -+ break; -+ case SMBC_ENCRYPTLEVEL_NONE: -+ cli_credentials_set_smb_encryption(creds, -+ SMB_ENCRYPTION_OFF, -+ CRED_SPECIFIED); -+ break; -+ case SMBC_ENCRYPTLEVEL_REQUEST: -+ cli_credentials_set_smb_encryption(creds, -+ SMB_ENCRYPTION_DESIRED, -+ CRED_SPECIFIED); -+ break; -+ case SMBC_ENCRYPTLEVEL_REQUIRE: -+ default: -+ cli_credentials_set_smb_encryption(creds, -+ SMB_ENCRYPTION_REQUIRED, -+ CRED_SPECIFIED); -+ break; -+ } -+ -+ - return creds; - } - -@@ -625,30 +648,6 @@ SMBC_server_internal(TALLOC_CTX *ctx, - smbXcli_tcon_set_fs_attributes(tcon, fs_attrs); - } - -- if (context->internal->smb_encryption_level) { -- /* Attempt encryption. */ -- status = cli_cm_force_encryption_creds(c, -- creds, -- share); -- if (!NT_STATUS_IS_OK(status)) { -- -- /* -- * context->smb_encryption_level == 1 -- * means don't fail if encryption can't be negotiated, -- * == 2 means fail if encryption can't be negotiated. -- */ -- -- DEBUG(4,(" SMB encrypt failed\n")); -- -- if (context->internal->smb_encryption_level == 2) { -- cli_shutdown(c); -- errno = EPERM; -- return NULL; -- } -- } -- DEBUG(4,(" SMB encrypt ok\n")); -- } -- - /* - * Ok, we have got a nice connection - * Let's allocate a server structure. -@@ -825,31 +824,6 @@ SMBC_attr_server(TALLOC_CTX *ctx, - } - talloc_steal(ipc_cli, creds); - -- if (context->internal->smb_encryption_level) { -- /* Attempt encryption. */ -- nt_status = cli_cm_force_encryption_creds(ipc_cli, -- creds, -- "IPC$"); -- if (!NT_STATUS_IS_OK(nt_status)) { -- -- /* -- * context->smb_encryption_level == -- * 1 means don't fail if encryption can't be -- * negotiated, == 2 means fail if encryption -- * can't be negotiated. -- */ -- -- DEBUG(4,(" SMB encrypt failed on IPC$\n")); -- -- if (context->internal->smb_encryption_level == 2) { -- cli_shutdown(ipc_cli); -- errno = EPERM; -- return NULL; -- } -- } -- DEBUG(4,(" SMB encrypt ok on IPC$\n")); -- } -- - ipc_srv = SMB_MALLOC_P(SMBCSRV); - if (!ipc_srv) { - errno = ENOMEM; -diff --git a/source3/libsmb/wscript b/source3/libsmb/wscript -index ec4a516b2ee..61503d0a98b 100644 ---- a/source3/libsmb/wscript -+++ b/source3/libsmb/wscript -@@ -26,5 +26,5 @@ def build(bld): - public_headers='../include/libsmbclient.h', - abi_directory='ABI', - abi_match='smbc_*', -- vnum='0.6.0', -+ vnum='0.7.0', - pc_files='smbclient.pc') --- -2.29.2 - - -From a35be10e055edb18b961c30c106fbefd08cd8c42 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Wed, 10 Jun 2020 12:43:33 +0200 -Subject: [PATCH 037/104] s3:client: Remove unused smb encryption code - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher ---- - source3/client/smbspool.c | 10 ---------- - 1 file changed, 10 deletions(-) - -diff --git a/source3/client/smbspool.c b/source3/client/smbspool.c -index f56dc323b6e..16a8d44c069 100644 ---- a/source3/client/smbspool.c -+++ b/source3/client/smbspool.c -@@ -584,16 +584,6 @@ smb_complete_connection(struct cli_state **output_cli, - - return nt_status; - } --#if 0 -- /* Need to work out how to specify this on the URL. */ -- if (smb_encrypt) { -- if (!cli_cm_force_encryption_creds(cli, creds, share)) { -- fprintf(stderr, "ERROR: encryption setup failed\n"); -- cli_shutdown(cli); -- return NULL; -- } -- } --#endif - - *output_cli = cli; - return NT_STATUS_OK; --- -2.29.2 - - -From 59362e873109a541d5381fe9a302a9464b83b549 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Wed, 10 Jun 2020 12:47:05 +0200 -Subject: [PATCH 038/104] s3:utils: Remove obsolete force encryption from - smbacls - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher ---- - source3/utils/smbcacls.c | 10 ---------- - 1 file changed, 10 deletions(-) - -diff --git a/source3/utils/smbcacls.c b/source3/utils/smbcacls.c -index 5983ebbd0a5..8fd9fcc5780 100644 ---- a/source3/utils/smbcacls.c -+++ b/source3/utils/smbcacls.c -@@ -784,16 +784,6 @@ static struct cli_state *connect_one(const struct user_auth_info *auth_info, - return NULL; - } - -- if (get_cmdline_auth_info_smb_encrypt(auth_info)) { -- nt_status = cli_cm_force_encryption_creds(c, -- get_cmdline_auth_info_creds(auth_info), -- share); -- if (!NT_STATUS_IS_OK(nt_status)) { -- cli_shutdown(c); -- c = NULL; -- } -- } -- - return c; - } - --- -2.29.2 - - -From d642ed3f0e60699c5650eb80ba02f9552b8f7bd9 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Wed, 10 Jun 2020 12:48:18 +0200 -Subject: [PATCH 039/104] s3:utils: Remove obsolete force encryption from - mdfind - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher ---- - source3/utils/mdfind.c | 7 ------- - 1 file changed, 7 deletions(-) - -diff --git a/source3/utils/mdfind.c b/source3/utils/mdfind.c -index 2ac4fde7daf..ef2657e4fa5 100644 ---- a/source3/utils/mdfind.c -+++ b/source3/utils/mdfind.c -@@ -159,13 +159,6 @@ int main(int argc, char **argv) - goto fail; - } - -- if (get_cmdline_auth_info_smb_encrypt(auth)) { -- status = cli_cm_force_encryption_creds(cli, creds, "IPC$"); -- if (!NT_STATUS_IS_OK(status)) { -- goto fail; -- } -- } -- - status = cli_rpc_pipe_open_noauth_transport(cli, - NCACN_NP, - &ndr_table_mdssvc, --- -2.29.2 - - -From 4588a03309c7ce7404f54e010f4a93656bf9ff47 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Wed, 10 Jun 2020 12:49:28 +0200 -Subject: [PATCH 040/104] s3:utils: Remove obsolete force encryption from - smbcquotas - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher ---- - source3/utils/smbcquotas.c | 11 ----------- - 1 file changed, 11 deletions(-) - -diff --git a/source3/utils/smbcquotas.c b/source3/utils/smbcquotas.c -index fea066ce468..4ceac7b3ab0 100644 ---- a/source3/utils/smbcquotas.c -+++ b/source3/utils/smbcquotas.c -@@ -533,17 +533,6 @@ static struct cli_state *connect_one(const char *share) - return NULL; - } - -- if (get_cmdline_auth_info_smb_encrypt(popt_get_cmdline_auth_info())) { -- nt_status = cli_cm_force_encryption_creds(c, -- get_cmdline_auth_info_creds( -- popt_get_cmdline_auth_info()), -- share); -- if (!NT_STATUS_IS_OK(nt_status)) { -- cli_shutdown(c); -- return NULL; -- } -- } -- - return c; - } - --- -2.29.2 - - -From 23b759045448c9072f8342778ea36b721c481bfd Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Wed, 10 Jun 2020 12:51:18 +0200 -Subject: [PATCH 041/104] s3:rpcclient: Remove obsolete force encryption from - rpcclient - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher ---- - source3/rpcclient/rpcclient.c | 11 ----------- - 1 file changed, 11 deletions(-) - -diff --git a/source3/rpcclient/rpcclient.c b/source3/rpcclient/rpcclient.c -index 2ead6cc7ba5..575a42ebf70 100644 ---- a/source3/rpcclient/rpcclient.c -+++ b/source3/rpcclient/rpcclient.c -@@ -1214,17 +1214,6 @@ out_free: - goto done; - } - -- if (get_cmdline_auth_info_smb_encrypt(popt_get_cmdline_auth_info())) { -- nt_status = cli_cm_force_encryption_creds(cli, -- get_cmdline_auth_info_creds( -- popt_get_cmdline_auth_info()), -- "IPC$"); -- if (!NT_STATUS_IS_OK(nt_status)) { -- result = 1; -- goto done; -- } -- } -- - #if 0 /* COMMENT OUT FOR TESTING */ - memset(cmdline_auth_info.password,'X',sizeof(cmdline_auth_info.password)); - #endif --- -2.29.2 - - -From b42861ddc3b16cdda39c86d0549ed3af8e22cf7b Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Mon, 6 Jul 2020 10:58:36 +0200 -Subject: [PATCH 042/104] examples: Remove obsolete force encryption from - smb2mount - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher ---- - examples/fuse/smb2mount.c | 11 ----------- - 1 file changed, 11 deletions(-) - -diff --git a/examples/fuse/smb2mount.c b/examples/fuse/smb2mount.c -index 6206c3a9701..c64be573462 100644 ---- a/examples/fuse/smb2mount.c -+++ b/examples/fuse/smb2mount.c -@@ -44,17 +44,6 @@ static struct cli_state *connect_one(const struct user_auth_info *auth_info, - return NULL; - } - -- if (get_cmdline_auth_info_smb_encrypt(auth_info)) { -- nt_status = cli_cm_force_encryption_creds( -- c, -- get_cmdline_auth_info_creds(auth_info), -- share); -- if (!NT_STATUS_IS_OK(nt_status)) { -- cli_shutdown(c); -- c = NULL; -- } -- } -- - return c; - } - --- -2.29.2 - - -From 9718e834445fa9fb77a947aee35ff49f9ce98572 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Mon, 6 Jul 2020 11:05:59 +0200 -Subject: [PATCH 043/104] s3:libsmb: Make cli_cm_force_encryption_creds() - static - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher ---- - source3/libsmb/clidfs.c | 6 +++--- - source3/libsmb/proto.h | 3 --- - 2 files changed, 3 insertions(+), 6 deletions(-) - -diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c -index 4495a027830..aff998f6187 100644 ---- a/source3/libsmb/clidfs.c -+++ b/source3/libsmb/clidfs.c -@@ -43,9 +43,9 @@ - Ensure a connection is encrypted. - ********************************************************************/ - --NTSTATUS cli_cm_force_encryption_creds(struct cli_state *c, -- struct cli_credentials *creds, -- const char *sharename) -+static NTSTATUS cli_cm_force_encryption_creds(struct cli_state *c, -+ struct cli_credentials *creds, -+ const char *sharename) - { - uint16_t major, minor; - uint32_t caplow, caphigh; -diff --git a/source3/libsmb/proto.h b/source3/libsmb/proto.h -index 850cf12c8a6..eeabcaa7463 100644 ---- a/source3/libsmb/proto.h -+++ b/source3/libsmb/proto.h -@@ -123,9 +123,6 @@ struct cli_state *get_ipc_connect_master_ip(TALLOC_CTX *ctx, - - /* The following definitions come from libsmb/clidfs.c */ - --NTSTATUS cli_cm_force_encryption_creds(struct cli_state *c, -- struct cli_credentials *creds, -- const char *sharename); - NTSTATUS cli_cm_open(TALLOC_CTX *ctx, - struct cli_state *referring_cli, - const char *server, --- -2.29.2 - - -From 7e0b354aca307a2eaf45dcf0ca2e1203e7784fd3 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Thu, 13 Aug 2020 16:16:55 +0200 -Subject: [PATCH 044/104] s4:libcli: Return NTSTATUS errors for - smb_composite_connect_send() - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher ---- - source4/libcli/smb_composite/connect.c | 40 +++++++++++++++++++------- - 1 file changed, 29 insertions(+), 11 deletions(-) - -diff --git a/source4/libcli/smb_composite/connect.c b/source4/libcli/smb_composite/connect.c -index 582d43ef173..ad50ae0ac81 100644 ---- a/source4/libcli/smb_composite/connect.c -+++ b/source4/libcli/smb_composite/connect.c -@@ -420,15 +420,25 @@ struct composite_context *smb_composite_connect_send(struct smb_composite_connec - struct connect_state *state; - - c = talloc_zero(mem_ctx, struct composite_context); -- if (c == NULL) goto failed; -- -- c->event_ctx = event_ctx; -- if (c->event_ctx == NULL) goto failed; -+ if (c == NULL) { -+ goto nomem; -+ } - - state = talloc_zero(c, struct connect_state); -- if (state == NULL) goto failed; -+ if (state == NULL) { -+ goto nomem; -+ } -+ -+ c->event_ctx = event_ctx; -+ if (c->event_ctx == NULL) { -+ composite_error(c, NT_STATUS_INVALID_PARAMETER_MIX); -+ return c; -+ } - -- if (io->in.gensec_settings == NULL) goto failed; -+ if (io->in.gensec_settings == NULL) { -+ composite_error(c, NT_STATUS_INVALID_PARAMETER_MIX); -+ return c; -+ } - state->io = io; - - c->state = COMPOSITE_STATE_IN_PROGRESS; -@@ -449,12 +459,14 @@ struct composite_context *smb_composite_connect_send(struct smb_composite_connec - &io->in.options, - &state->transport); - if (!NT_STATUS_IS_OK(status)) { -- goto failed; -+ composite_error(c, status); -+ return c; - } - - status = connect_send_session(c, io); - if (!NT_STATUS_IS_OK(status)) { -- goto failed; -+ composite_error(c, status); -+ return c; - } - - return c; -@@ -468,15 +480,18 @@ struct composite_context *smb_composite_connect_send(struct smb_composite_connec - io->in.socket_options, - &state->calling, - &state->called); -- if (state->creq == NULL) goto failed; -+ if (state->creq == NULL) { -+ composite_error(c, NT_STATUS_NO_MEMORY); -+ return c; -+ } - - state->stage = CONNECT_SOCKET; - state->creq->async.private_data = c; - state->creq->async.fn = composite_handler; - - return c; --failed: -- talloc_free(c); -+nomem: -+ TALLOC_FREE(c); - return NULL; - } - -@@ -506,5 +521,8 @@ NTSTATUS smb_composite_connect(struct smb_composite_connect *io, TALLOC_CTX *mem - struct tevent_context *ev) - { - struct composite_context *c = smb_composite_connect_send(io, mem_ctx, resolve_ctx, ev); -+ if (c == NULL) { -+ return NT_STATUS_NO_MEMORY; -+ } - return smb_composite_connect_recv(c, mem_ctx); - } --- -2.29.2 - - -From 667f1730533b589820c2c7c492000fb86445797a Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Tue, 7 Jul 2020 12:54:26 +0200 -Subject: [PATCH 045/104] s4:libcli: Return if encryption is requested for SMB1 - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher ---- - source4/libcli/smb_composite/sesssetup.c | 7 +++++++ - 1 file changed, 7 insertions(+) - -diff --git a/source4/libcli/smb_composite/sesssetup.c b/source4/libcli/smb_composite/sesssetup.c -index 6ee4929e8d7..51e121bdce6 100644 ---- a/source4/libcli/smb_composite/sesssetup.c -+++ b/source4/libcli/smb_composite/sesssetup.c -@@ -620,10 +620,17 @@ struct composite_context *smb_composite_sesssetup_send(struct smbcli_session *se - struct composite_context *c; - struct sesssetup_state *state; - NTSTATUS status; -+ enum smb_encryption_setting encryption_state = -+ cli_credentials_get_smb_encryption(io->in.credentials); - - c = composite_create(session, session->transport->ev); - if (c == NULL) return NULL; - -+ if (encryption_state > SMB_ENCRYPTION_DESIRED) { -+ composite_error(c, NT_STATUS_PROTOCOL_NOT_SUPPORTED); -+ return c; -+ } -+ - state = talloc_zero(c, struct sesssetup_state); - if (composite_nomem(state, c)) return c; - c->private_data = state; --- -2.29.2 - - -From 97ce0f36abf29c234fbc4d8846ce0b68b2e4a6ab Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Tue, 7 Jul 2020 12:29:39 +0200 -Subject: [PATCH 046/104] s3:libcli: Split out smb2_connect_tcon_start() - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher ---- - source4/libcli/smb2/connect.c | 13 ++++++++++++- - 1 file changed, 12 insertions(+), 1 deletion(-) - -diff --git a/source4/libcli/smb2/connect.c b/source4/libcli/smb2/connect.c -index 6fc3993a4e8..95ff05eac8f 100644 ---- a/source4/libcli/smb2/connect.c -+++ b/source4/libcli/smb2/connect.c -@@ -237,6 +237,7 @@ static void smb2_connect_session_start(struct tevent_req *req) - tevent_req_set_callback(subreq, smb2_connect_session_done, req); - } - -+static void smb2_connect_tcon_start(struct tevent_req *req); - static void smb2_connect_tcon_done(struct tevent_req *subreq); - - static void smb2_connect_session_done(struct tevent_req *subreq) -@@ -248,7 +249,6 @@ static void smb2_connect_session_done(struct tevent_req *subreq) - tevent_req_data(req, - struct smb2_connect_state); - NTSTATUS status; -- uint32_t timeout_msec; - - status = smb2_session_setup_spnego_recv(subreq); - TALLOC_FREE(subreq); -@@ -289,6 +289,17 @@ static void smb2_connect_session_done(struct tevent_req *subreq) - return; - } - -+ smb2_connect_tcon_start(req); -+} -+ -+static void smb2_connect_tcon_start(struct tevent_req *req) -+{ -+ struct smb2_connect_state *state = -+ tevent_req_data(req, -+ struct smb2_connect_state); -+ struct tevent_req *subreq = NULL; -+ uint32_t timeout_msec; -+ - timeout_msec = state->transport->options.request_timeout * 1000; - - subreq = smb2cli_tcon_send(state, state->ev, --- -2.29.2 - - -From bf357c3c06df5ac5aeea7851a7e285d68f3ab974 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Tue, 7 Jul 2020 12:44:26 +0200 -Subject: [PATCH 047/104] s4:libcli: Add smb2_connect_enc_start() - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher ---- - source4/libcli/smb2/connect.c | 38 +++++++++++++++++++++++++++++++++++ - 1 file changed, 38 insertions(+) - -diff --git a/source4/libcli/smb2/connect.c b/source4/libcli/smb2/connect.c -index 95ff05eac8f..3a3ecdf20e8 100644 ---- a/source4/libcli/smb2/connect.c -+++ b/source4/libcli/smb2/connect.c -@@ -237,6 +237,7 @@ static void smb2_connect_session_start(struct tevent_req *req) - tevent_req_set_callback(subreq, smb2_connect_session_done, req); - } - -+static void smb2_connect_enc_start(struct tevent_req *req); - static void smb2_connect_tcon_start(struct tevent_req *req); - static void smb2_connect_tcon_done(struct tevent_req *subreq); - -@@ -289,6 +290,43 @@ static void smb2_connect_session_done(struct tevent_req *subreq) - return; - } - -+ smb2_connect_enc_start(req); -+} -+ -+static void smb2_connect_enc_start(struct tevent_req *req) -+{ -+ struct smb2_connect_state *state = -+ tevent_req_data(req, -+ struct smb2_connect_state); -+ enum smb_encryption_setting encryption_state = -+ cli_credentials_get_smb_encryption(state->credentials); -+ NTSTATUS status; -+ -+ if (encryption_state < SMB_ENCRYPTION_DESIRED) { -+ smb2_connect_tcon_start(req); -+ return; -+ } -+ -+ status = smb2cli_session_encryption_on(state->session->smbXcli); -+ if (!NT_STATUS_IS_OK(status)) { -+ if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) { -+ if (encryption_state < SMB_ENCRYPTION_REQUIRED) { -+ smb2_connect_tcon_start(req); -+ return; -+ } -+ -+ DBG_ERR("Encryption required and server doesn't support " -+ "SMB3 encryption - failing connect\n"); -+ tevent_req_nterror(req, status); -+ return; -+ } -+ -+ DBG_ERR("Encryption required and setup failed with error %s.\n", -+ nt_errstr(status)); -+ tevent_req_nterror(req, NT_STATUS_PROTOCOL_NOT_SUPPORTED); -+ return; -+ } -+ - smb2_connect_tcon_start(req); - } - --- -2.29.2 - - -From 5a984891f73b07211d64e5a2f262915386aea7f4 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Fri, 24 Jul 2020 10:18:52 +0200 -Subject: [PATCH 048/104] s4:libcli: Require signing for SMB encryption - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher ---- - source4/libcli/smb2/connect.c | 9 ++++++++- - 1 file changed, 8 insertions(+), 1 deletion(-) - -diff --git a/source4/libcli/smb2/connect.c b/source4/libcli/smb2/connect.c -index 3a3ecdf20e8..9540704491e 100644 ---- a/source4/libcli/smb2/connect.c -+++ b/source4/libcli/smb2/connect.c -@@ -31,6 +31,7 @@ - #include "param/param.h" - #include "auth/credentials/credentials.h" - #include "../libcli/smb/smbXcli_base.h" -+#include "smb2_constants.h" - - struct smb2_connect_state { - struct tevent_context *ev; -@@ -76,6 +77,8 @@ struct tevent_req *smb2_connect_send(TALLOC_CTX *mem_ctx, - struct smb2_connect_state *state; - struct composite_context *creq; - static const char *default_ports[] = { "445", "139", NULL }; -+ enum smb_encryption_setting encryption_state = -+ cli_credentials_get_smb_encryption(credentials); - - req = tevent_req_create(mem_ctx, &state, - struct smb2_connect_state); -@@ -99,6 +102,10 @@ struct tevent_req *smb2_connect_send(TALLOC_CTX *mem_ctx, - state->ports = default_ports; - } - -+ if (encryption_state >= SMB_ENCRYPTION_DESIRED) { -+ state->options.signing = SMB_SIGNING_REQUIRED; -+ } -+ - make_nbt_name_client(&state->calling, - cli_credentials_get_workstation(credentials)); - -@@ -116,7 +123,7 @@ struct tevent_req *smb2_connect_send(TALLOC_CTX *mem_ctx, - - status = smb2_transport_raw_init(state, ev, - existing_conn, -- options, -+ &state->options, - &state->transport); - if (tevent_req_nterror(req, status)) { - return tevent_req_post(req, ev); --- -2.29.2 - - -From b733749b324891e6352fbb9ef51fa0452baa313e Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Tue, 7 Jul 2020 14:27:07 +0200 -Subject: [PATCH 049/104] python:tests: Add test for SMB encrypted DCERPC - connection - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher - -Autobuild-User(master): Andreas Schneider -Autobuild-Date(master): Wed Aug 19 17:46:28 UTC 2020 on sn-devel-184 ---- - python/samba/tests/dcerpc/binding.py | 82 ++++++++++++++++++++++++++++ - selftest/tests.py | 1 + - 2 files changed, 83 insertions(+) - create mode 100644 python/samba/tests/dcerpc/binding.py - -diff --git a/python/samba/tests/dcerpc/binding.py b/python/samba/tests/dcerpc/binding.py -new file mode 100644 -index 00000000000..8e0d6a5ef0a ---- /dev/null -+++ b/python/samba/tests/dcerpc/binding.py -@@ -0,0 +1,82 @@ -+# -+# Unix SMB/CIFS implementation. -+# Copyright (c) 2020 Andreas Schneider -+# -+# This program is free software; you can redistribute it and/or modify -+# it under the terms of the GNU General Public License as published by -+# the Free Software Foundation; either version 3 of the License, or -+# (at your option) any later version. -+# -+# This program is distributed in the hope that it will be useful, -+# but WITHOUT ANY WARRANTY; without even the implied warranty of -+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+# GNU General Public License for more details. -+# -+# You should have received a copy of the GNU General Public License -+# along with this program. If not, see . -+# -+ -+"""Tests for samba.dcerpc., credentials and binding strings""" -+ -+import samba.tests -+from samba.tests import RpcInterfaceTestCase, TestCase -+from samba.dcerpc import lsa -+import samba.dcerpc.security as security -+from samba.credentials import Credentials, SMB_ENCRYPTION_REQUIRED -+from samba import NTSTATUSError -+ -+class RpcBindingTests(RpcInterfaceTestCase): -+ def setUp(self): -+ super(RpcBindingTests, self).setUp() -+ -+ def get_user_creds(self): -+ c = Credentials() -+ c.guess() -+ domain = samba.tests.env_get_var_value('DOMAIN') -+ username = samba.tests.env_get_var_value('USERNAME') -+ password = samba.tests.env_get_var_value('PASSWORD') -+ c.set_domain(domain) -+ c.set_username(username) -+ c.set_password(password) -+ return c -+ -+ def test_smb3_dcerpc_encryption(self): -+ creds = self.get_user_creds() -+ creds.set_smb_encryption(SMB_ENCRYPTION_REQUIRED) -+ -+ lp = self.get_loadparm() -+ lp.set('client ipc max protocol', 'SMB3') -+ lp.set('client ipc min protocol', 'SMB3') -+ -+ binding_string = ("ncacn_np:%s" % (samba.tests.env_get_var_value('SERVER'))) -+ lsa_conn = lsa.lsarpc(binding_string, lp, creds) -+ -+ objectAttr = lsa.ObjectAttribute() -+ objectAttr.sec_qos = lsa.QosInfo() -+ -+ pol_handle = lsa_conn.OpenPolicy2('', -+ objectAttr, -+ security.SEC_FLAG_MAXIMUM_ALLOWED) -+ self.assertIsNotNone(pol_handle) -+ -+ def test_smb2_dcerpc_encryption(self): -+ creds = self.get_user_creds() -+ creds.set_smb_encryption(SMB_ENCRYPTION_REQUIRED) -+ -+ lp = self.get_loadparm() -+ lp.set('client ipc max protocol', 'SMB2') -+ lp.set('client ipc min protocol', 'SMB2') -+ -+ binding_string = ("ncacn_np:%s" % (samba.tests.env_get_var_value('SERVER'))) -+ self.assertRaises(NTSTATUSError, lsa.lsarpc, binding_string, lp, creds) -+ -+ def test_smb1_dcerpc_encryption(self): -+ creds = self.get_user_creds() -+ creds.set_smb_encryption(SMB_ENCRYPTION_REQUIRED) -+ -+ lp = self.get_loadparm() -+ lp.set('client ipc max protocol', 'NT1') -+ lp.set('client ipc min protocol', 'NT1') -+ -+ binding_string = ("ncacn_np:%s" % (samba.tests.env_get_var_value('SERVER'))) -+ self.assertRaises(NTSTATUSError, lsa.lsarpc, binding_string, lp, creds) -diff --git a/selftest/tests.py b/selftest/tests.py -index 20981754db4..adcb5b53189 100644 ---- a/selftest/tests.py -+++ b/selftest/tests.py -@@ -92,6 +92,7 @@ planpythontestsuite( - extra_path=[os.path.join(samba4srcdir, "..", "buildtools"), - os.path.join(samba4srcdir, "..", "third_party", "waf")]) - planpythontestsuite("fileserver", "samba.tests.smbd_fuzztest") -+planpythontestsuite("nt4_dc_smb1", "samba.tests.dcerpc.binding") - - - def cmdline(script, *args): --- -2.29.2 - - -From 141c2ebfb18be8ca2b313e900539cfa6b5927ded Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Fri, 4 Sep 2020 10:47:54 +0200 -Subject: [PATCH 050/104] auth:gensec: Add gensec_security_sasl_names() - -Pair-Programmed-With: Andreas Schneider - -Signed-off-by: Andreas Schneider -Signed-off-by: Stefan Metzmacher -(cherry picked from commit b34e8dc8982b625d946e2ac8794ee41311bc41c2) ---- - auth/gensec/gensec.h | 2 + - auth/gensec/gensec_start.c | 87 ++++++++++++++++++++++++++++++++++++++ - 2 files changed, 89 insertions(+) - -diff --git a/auth/gensec/gensec.h b/auth/gensec/gensec.h -index d424067d02c..fe26fff171a 100644 ---- a/auth/gensec/gensec.h -+++ b/auth/gensec/gensec.h -@@ -308,6 +308,8 @@ const struct gensec_security_ops **gensec_use_kerberos_mechs(TALLOC_CTX *mem_ctx - - NTSTATUS gensec_start_mech_by_sasl_name(struct gensec_security *gensec_security, - const char *sasl_name); -+const char **gensec_security_sasl_names(struct gensec_security *gensec_security, -+ TALLOC_CTX *mem_ctx); - - int gensec_setting_int(struct gensec_settings *settings, const char *mechanism, const char *name, int default_value); - bool gensec_setting_bool(struct gensec_settings *settings, const char *mechanism, const char *name, bool default_value); -diff --git a/auth/gensec/gensec_start.c b/auth/gensec/gensec_start.c -index d2d62d6652e..4eb45643714 100644 ---- a/auth/gensec/gensec_start.c -+++ b/auth/gensec/gensec_start.c -@@ -299,6 +299,93 @@ const struct gensec_security_ops *gensec_security_by_name(struct gensec_security - return NULL; - } - -+static const char **gensec_security_sasl_names_from_ops( -+ struct gensec_security *gensec_security, -+ TALLOC_CTX *mem_ctx, -+ const struct gensec_security_ops * const *ops) -+{ -+ const char **sasl_names = NULL; -+ size_t i, sasl_names_count = 0; -+ -+ if (ops == NULL) { -+ return NULL; -+ } -+ -+ sasl_names = talloc_array(mem_ctx, const char *, 1); -+ if (sasl_names == NULL) { -+ return NULL; -+ } -+ -+ for (i = 0; ops[i] != NULL; i++) { -+ enum gensec_role role = GENSEC_SERVER; -+ const char **tmp = NULL; -+ -+ if (ops[i]->sasl_name == NULL) { -+ continue; -+ } -+ -+ if (gensec_security != NULL) { -+ if (!gensec_security_ops_enabled(ops[i], -+ gensec_security)) { -+ continue; -+ } -+ -+ role = gensec_security->gensec_role; -+ } -+ -+ switch (role) { -+ case GENSEC_CLIENT: -+ if (ops[i]->client_start == NULL) { -+ continue; -+ } -+ break; -+ case GENSEC_SERVER: -+ if (ops[i]->server_start == NULL) { -+ continue; -+ } -+ break; -+ } -+ -+ tmp = talloc_realloc(mem_ctx, -+ sasl_names, -+ const char *, -+ sasl_names_count + 2); -+ if (tmp == NULL) { -+ TALLOC_FREE(sasl_names); -+ return NULL; -+ } -+ sasl_names = tmp; -+ -+ sasl_names[sasl_names_count] = ops[i]->sasl_name; -+ sasl_names_count++; -+ } -+ sasl_names[sasl_names_count] = NULL; -+ -+ return sasl_names; -+} -+ -+/** -+ * @brief Get the sasl names from the gensec security context. -+ * -+ * @param[in] gensec_security The gensec security context. -+ * -+ * @param[in] mem_ctx The memory context to allocate memory on. -+ * -+ * @return An allocated array with sasl names, NULL on error. -+ */ -+_PUBLIC_ -+const char **gensec_security_sasl_names(struct gensec_security *gensec_security, -+ TALLOC_CTX *mem_ctx) -+{ -+ const struct gensec_security_ops **ops = NULL; -+ -+ ops = gensec_security_mechs(gensec_security, mem_ctx); -+ -+ return gensec_security_sasl_names_from_ops(gensec_security, -+ mem_ctx, -+ ops); -+} -+ - /** - * Return a unique list of security subsystems from those specified in - * the list of SASL names. --- -2.29.2 - - -From b68a26966dddb4ec8a7bc7ec3441dbf03efd6af9 Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Fri, 4 Sep 2020 10:48:27 +0200 -Subject: [PATCH 051/104] s4:ldap_server: Use samba_server_gensec_start() in - ldapsrv_backend_Init() - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Andreas Schneider -(cherry picked from commit 5e3363e0b82193700f91a9bae5080aae0b744e5c) ---- - source4/dsdb/samdb/ldb_modules/rootdse.c | 4 +- - source4/ldap_server/ldap_backend.c | 49 +++++++++++------------- - 2 files changed, 25 insertions(+), 28 deletions(-) - -diff --git a/source4/dsdb/samdb/ldb_modules/rootdse.c b/source4/dsdb/samdb/ldb_modules/rootdse.c -index 55340fa4f1e..4be9550747c 100644 ---- a/source4/dsdb/samdb/ldb_modules/rootdse.c -+++ b/source4/dsdb/samdb/ldb_modules/rootdse.c -@@ -230,7 +230,7 @@ static int rootdse_add_dynamic(struct rootdse_context *ac, struct ldb_message *m - struct ldb_context *ldb; - struct rootdse_private_data *priv = talloc_get_type(ldb_module_get_private(ac->module), struct rootdse_private_data); - const char * const *attrs = ac->req->op.search.attrs; -- char **server_sasl; -+ const char **server_sasl = NULL; - const struct dsdb_schema *schema; - int *val; - struct ldb_control *edn_control; -@@ -341,7 +341,7 @@ static int rootdse_add_dynamic(struct rootdse_context *ac, struct ldb_message *m - } - - server_sasl = talloc_get_type(ldb_get_opaque(ldb, "supportedSASLMechanisms"), -- char *); -+ const char *); - if (server_sasl && do_attribute(attrs, "supportedSASLMechanisms")) { - for (i = 0; server_sasl && server_sasl[i]; i++) { - char *sasl_name = talloc_strdup(msg, server_sasl[i]); -diff --git a/source4/ldap_server/ldap_backend.c b/source4/ldap_server/ldap_backend.c -index 2839082daef..915d9b94f9b 100644 ---- a/source4/ldap_server/ldap_backend.c -+++ b/source4/ldap_server/ldap_backend.c -@@ -33,6 +33,7 @@ - #include "ldb_wrap.h" - #include "lib/tsocket/tsocket.h" - #include "libcli/ldap/ldap_proto.h" -+#include "source4/auth/auth.h" - - static int map_ldb_error(TALLOC_CTX *mem_ctx, int ldb_err, - const char *add_err_string, const char **errstring) -@@ -199,37 +200,33 @@ int ldapsrv_backend_Init(struct ldapsrv_connection *conn, - } - - if (conn->server_credentials) { -- char **sasl_mechs = NULL; -- const struct gensec_security_ops * const *backends = gensec_security_all(); -- const struct gensec_security_ops **ops -- = gensec_use_kerberos_mechs(conn, backends, conn->server_credentials); -- unsigned int i, j = 0; -- for (i = 0; ops && ops[i]; i++) { -- if (!lpcfg_parm_bool(conn->lp_ctx, NULL, "gensec", ops[i]->name, ops[i]->enabled)) -- continue; -- -- if (ops[i]->sasl_name && ops[i]->server_start) { -- char *sasl_name = talloc_strdup(conn, ops[i]->sasl_name); -- -- if (!sasl_name) { -- return LDB_ERR_OPERATIONS_ERROR; -- } -- sasl_mechs = talloc_realloc(conn, sasl_mechs, char *, j + 2); -- if (!sasl_mechs) { -- return LDB_ERR_OPERATIONS_ERROR; -- } -- sasl_mechs[j] = sasl_name; -- talloc_steal(sasl_mechs, sasl_name); -- sasl_mechs[j+1] = NULL; -- j++; -- } -+ struct gensec_security *gensec_security = NULL; -+ const char **sasl_mechs = NULL; -+ NTSTATUS status; -+ -+ status = samba_server_gensec_start(conn, -+ conn->connection->event.ctx, -+ conn->connection->msg_ctx, -+ conn->lp_ctx, -+ conn->server_credentials, -+ "ldap", -+ &gensec_security); -+ if (!NT_STATUS_IS_OK(status)) { -+ DBG_ERR("samba_server_gensec_start failed: %s\n", -+ nt_errstr(status)); -+ return LDB_ERR_OPERATIONS_ERROR; - } -- talloc_unlink(conn, ops); - - /* ldb can have a different lifetime to conn, so we - need to ensure that sasl_mechs lives as long as the - ldb does */ -- talloc_steal(conn->ldb, sasl_mechs); -+ sasl_mechs = gensec_security_sasl_names(gensec_security, -+ conn->ldb); -+ TALLOC_FREE(gensec_security); -+ if (sasl_mechs == NULL) { -+ DBG_ERR("Failed to get sasl mechs!\n"); -+ return LDB_ERR_OPERATIONS_ERROR; -+ } - - ldb_set_opaque(conn->ldb, "supportedSASLMechanisms", sasl_mechs); - } --- -2.29.2 - - -From fa5761777851f6d2ecdaa88fdea3260e42dc634c Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Fri, 4 Sep 2020 14:39:15 +0200 -Subject: [PATCH 052/104] auth:gensec: Make gensec_use_kerberos_mechs() a - static function - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Andreas Schneider -(cherry picked from commit 2186d4131ad4c7961d0c830bf9d48f3d06d27924) ---- - auth/gensec/gensec.h | 3 --- - auth/gensec/gensec_start.c | 7 ++++--- - 2 files changed, 4 insertions(+), 6 deletions(-) - -diff --git a/auth/gensec/gensec.h b/auth/gensec/gensec.h -index fe26fff171a..8bece3c3458 100644 ---- a/auth/gensec/gensec.h -+++ b/auth/gensec/gensec.h -@@ -302,9 +302,6 @@ NTSTATUS gensec_wrap(struct gensec_security *gensec_security, - - const struct gensec_security_ops * const *gensec_security_all(void); - bool gensec_security_ops_enabled(const struct gensec_security_ops *ops, struct gensec_security *security); --const struct gensec_security_ops **gensec_use_kerberos_mechs(TALLOC_CTX *mem_ctx, -- const struct gensec_security_ops * const *old_gensec_list, -- struct cli_credentials *creds); - - NTSTATUS gensec_start_mech_by_sasl_name(struct gensec_security *gensec_security, - const char *sasl_name); -diff --git a/auth/gensec/gensec_start.c b/auth/gensec/gensec_start.c -index 4eb45643714..ebcab76999a 100644 ---- a/auth/gensec/gensec_start.c -+++ b/auth/gensec/gensec_start.c -@@ -83,9 +83,10 @@ bool gensec_security_ops_enabled(const struct gensec_security_ops *ops, struct g - * more compplex. - */ - --_PUBLIC_ const struct gensec_security_ops **gensec_use_kerberos_mechs(TALLOC_CTX *mem_ctx, -- const struct gensec_security_ops * const *old_gensec_list, -- struct cli_credentials *creds) -+static const struct gensec_security_ops **gensec_use_kerberos_mechs( -+ TALLOC_CTX *mem_ctx, -+ const struct gensec_security_ops * const *old_gensec_list, -+ struct cli_credentials *creds) - { - const struct gensec_security_ops **new_gensec_list; - int i, j, num_mechs_in; --- -2.29.2 - - -From 3c052ba053b6fee6c97f13aca8eafe680321ded8 Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Fri, 4 Sep 2020 14:41:43 +0200 -Subject: [PATCH 053/104] auth:gensec: Pass use_kerberos and keep_schannel to - gensec_use_kerberos_mechs() - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Andreas Schneider -(cherry picked from commit a33a40bbc848e5691869cf264009d23a03128f31) ---- - auth/gensec/gensec_start.c | 26 ++++++++++++++------------ - 1 file changed, 14 insertions(+), 12 deletions(-) - -diff --git a/auth/gensec/gensec_start.c b/auth/gensec/gensec_start.c -index ebcab76999a..8d1b41fec74 100644 ---- a/auth/gensec/gensec_start.c -+++ b/auth/gensec/gensec_start.c -@@ -86,19 +86,11 @@ bool gensec_security_ops_enabled(const struct gensec_security_ops *ops, struct g - static const struct gensec_security_ops **gensec_use_kerberos_mechs( - TALLOC_CTX *mem_ctx, - const struct gensec_security_ops * const *old_gensec_list, -- struct cli_credentials *creds) -+ enum credentials_use_kerberos use_kerberos, -+ bool keep_schannel) - { - const struct gensec_security_ops **new_gensec_list; - int i, j, num_mechs_in; -- enum credentials_use_kerberos use_kerberos = CRED_AUTO_USE_KERBEROS; -- bool keep_schannel = false; -- -- if (creds) { -- use_kerberos = cli_credentials_get_kerberos_state(creds); -- if (cli_credentials_get_netlogon_creds(creds) != NULL) { -- keep_schannel = true; -- } -- } - - for (num_mechs_in=0; old_gensec_list && old_gensec_list[num_mechs_in]; num_mechs_in++) { - /* noop */ -@@ -163,18 +155,28 @@ _PUBLIC_ const struct gensec_security_ops **gensec_security_mechs( - struct gensec_security *gensec_security, - TALLOC_CTX *mem_ctx) - { -- struct cli_credentials *creds = NULL; - const struct gensec_security_ops * const *backends = gensec_security_all(); -+ enum credentials_use_kerberos use_kerberos = CRED_AUTO_USE_KERBEROS; -+ bool keep_schannel = false; - - if (gensec_security != NULL) { -+ struct cli_credentials *creds = NULL; -+ - creds = gensec_get_credentials(gensec_security); -+ if (creds != NULL) { -+ use_kerberos = cli_credentials_get_kerberos_state(creds); -+ if (cli_credentials_get_netlogon_creds(creds) != NULL) { -+ keep_schannel = true; -+ } -+ } - - if (gensec_security->settings->backends) { - backends = gensec_security->settings->backends; - } - } - -- return gensec_use_kerberos_mechs(mem_ctx, backends, creds); -+ return gensec_use_kerberos_mechs(mem_ctx, backends, -+ use_kerberos, keep_schannel); - - } - --- -2.29.2 - - -From ec9c5e93a31763c48d5c2d0e8859d9750aa36ed1 Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Fri, 4 Sep 2020 17:00:45 +0200 -Subject: [PATCH 054/104] auth:gensec: If Kerberos is required, keep schannel - for machine account auth - -Signed-off-by: Stefan Metzmacher -Signed-off-by: Andreas Schneider -(cherry picked from commit 515cffb1f20eacb041ff7b3d43f8a122a82ddfbd) ---- - auth/gensec/gensec_start.c | 9 +++++++++ - 1 file changed, 9 insertions(+) - -diff --git a/auth/gensec/gensec_start.c b/auth/gensec/gensec_start.c -index 8d1b41fec74..3f42d611140 100644 ---- a/auth/gensec/gensec_start.c -+++ b/auth/gensec/gensec_start.c -@@ -168,6 +168,15 @@ _PUBLIC_ const struct gensec_security_ops **gensec_security_mechs( - if (cli_credentials_get_netlogon_creds(creds) != NULL) { - keep_schannel = true; - } -+ -+ /* -+ * Even if Kerberos is set to REQUIRED, keep the -+ * schannel auth mechanism that machine accounts are -+ * able to authenticate via netlogon. -+ */ -+ if (gensec_security->gensec_role == GENSEC_SERVER) { -+ keep_schannel = true; -+ } - } - - if (gensec_security->settings->backends) { --- -2.29.2 - - -From d3f6c14e95159b4fed2034d563479607b48ee9ea Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Fri, 4 Sep 2020 12:21:21 +0200 -Subject: [PATCH 055/104] auth:creds: Add cli_credentials_init_server() - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher -(cherry picked from commit 2c00bea2aefdcc69608dffdafa7ce581d31f9354) ---- - auth/credentials/credentials.c | 25 +++++++++++++++++++++++++ - auth/credentials/credentials.h | 2 ++ - 2 files changed, 27 insertions(+) - -diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c -index 9168b92d3ec..77c35dd104b 100644 ---- a/auth/credentials/credentials.c -+++ b/auth/credentials/credentials.c -@@ -56,6 +56,31 @@ _PUBLIC_ struct cli_credentials *cli_credentials_init(TALLOC_CTX *mem_ctx) - return cred; - } - -+_PUBLIC_ -+struct cli_credentials *cli_credentials_init_server(TALLOC_CTX *mem_ctx, -+ struct loadparm_context *lp_ctx) -+{ -+ struct cli_credentials *server_creds = NULL; -+ NTSTATUS status; -+ -+ server_creds = cli_credentials_init(mem_ctx); -+ if (server_creds == NULL) { -+ return NULL; -+ } -+ -+ cli_credentials_set_conf(server_creds, lp_ctx); -+ -+ status = cli_credentials_set_machine_account(server_creds, lp_ctx); -+ if (!NT_STATUS_IS_OK(status)) { -+ DEBUG(1, ("Failed to obtain server credentials: %s\n", -+ nt_errstr(status))); -+ TALLOC_FREE(server_creds); -+ return NULL; -+ } -+ -+ return server_creds; -+} -+ - _PUBLIC_ void cli_credentials_set_callback_data(struct cli_credentials *cred, - void *callback_data) - { -diff --git a/auth/credentials/credentials.h b/auth/credentials/credentials.h -index 7d0cf53194b..438bcdce232 100644 ---- a/auth/credentials/credentials.h -+++ b/auth/credentials/credentials.h -@@ -76,6 +76,8 @@ bool cli_credentials_set_workstation(struct cli_credentials *cred, - enum credentials_obtained obtained); - bool cli_credentials_is_anonymous(struct cli_credentials *cred); - struct cli_credentials *cli_credentials_init(TALLOC_CTX *mem_ctx); -+struct cli_credentials *cli_credentials_init_server(TALLOC_CTX *mem_ctx, -+ struct loadparm_context *lp_ctx); - void cli_credentials_set_anonymous(struct cli_credentials *cred); - bool cli_credentials_wrong_password(struct cli_credentials *cred); - const char *cli_credentials_get_password(struct cli_credentials *cred); --- -2.29.2 - - -From b6249e4af652be9f02741ed0de59889734bff13f Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Fri, 4 Sep 2020 12:21:36 +0200 -Subject: [PATCH 056/104] s4:rpc_server: Use cli_credentials_init_server() - -Signed-off-by: Andreas Schneider -(cherry picked from commit 6c94ebf77fdb7383be2042f5e20ba2ef598cd4a4) ---- - source4/rpc_server/dcerpc_server.c | 17 +++-------------- - 1 file changed, 3 insertions(+), 14 deletions(-) - -diff --git a/source4/rpc_server/dcerpc_server.c b/source4/rpc_server/dcerpc_server.c -index 084857a44bf..e64148ef788 100644 ---- a/source4/rpc_server/dcerpc_server.c -+++ b/source4/rpc_server/dcerpc_server.c -@@ -673,25 +673,14 @@ NTSTATUS dcesrv_gensec_prepare(TALLOC_CTX *mem_ctx, - struct cli_credentials *server_creds = NULL; - struct imessaging_context *imsg_ctx = - dcesrv_imessaging_context(call->conn); -- NTSTATUS status; - -- server_creds = cli_credentials_init(call->auth_state); -- if (!server_creds) { -+ server_creds = cli_credentials_init_server(call->auth_state, -+ call->conn->dce_ctx->lp_ctx); -+ if (server_creds == NULL) { - DEBUG(1, ("Failed to init server credentials\n")); - return NT_STATUS_NO_MEMORY; - } - -- cli_credentials_set_conf(server_creds, call->conn->dce_ctx->lp_ctx); -- -- status = cli_credentials_set_machine_account(server_creds, -- call->conn->dce_ctx->lp_ctx); -- if (!NT_STATUS_IS_OK(status)) { -- DEBUG(1, ("Failed to obtain server credentials: %s\n", -- nt_errstr(status))); -- talloc_free(server_creds); -- return status; -- } -- - return samba_server_gensec_start(mem_ctx, - call->event_ctx, - imsg_ctx, --- -2.29.2 - - -From b0db24f086aad67ca9e536c6c94ef413983b5586 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Mon, 7 Sep 2020 09:19:43 +0200 -Subject: [PATCH 057/104] s4:smb_server: Use cli_credentials_init_server() for - negprot - -Signed-off-by: Andreas Schneider - -Autobuild-User(master): Stefan Metzmacher -Autobuild-Date(master): Mon Sep 7 13:22:26 UTC 2020 on sn-devel-184 - -(cherry picked from commit 0b742ec6a0558397d5cf01b99a401f8e2bc0e2e0) ---- - source4/smb_server/smb/negprot.c | 28 ++++++++++++++-------------- - source4/smb_server/smb2/negprot.c | 25 +++++++++++++------------ - 2 files changed, 27 insertions(+), 26 deletions(-) - -diff --git a/source4/smb_server/smb/negprot.c b/source4/smb_server/smb/negprot.c -index a6177a72019..04b69dd9883 100644 ---- a/source4/smb_server/smb/negprot.c -+++ b/source4/smb_server/smb/negprot.c -@@ -374,22 +374,22 @@ static void reply_nt1(struct smbsrv_request *req, uint16_t choice) - DATA_BLOB blob = data_blob_null; - const char *oid; - NTSTATUS nt_status; -- -- server_credentials -- = cli_credentials_init(req); -- if (!server_credentials) { -- smbsrv_terminate_connection(req->smb_conn, "Failed to init server credentials\n"); -- return; -- } -- -- cli_credentials_set_conf(server_credentials, req->smb_conn->lp_ctx); -- nt_status = cli_credentials_set_machine_account(server_credentials, req->smb_conn->lp_ctx); -- if (!NT_STATUS_IS_OK(nt_status)) { -- DEBUG(10, ("Failed to obtain server credentials, perhaps a standalone server?: %s\n", nt_errstr(nt_status))); -+ -+ server_credentials = -+ cli_credentials_init_server(req, req->smb_conn->lp_ctx); -+ if (server_credentials == NULL) { -+ DBG_DEBUG("Failed to obtain server credentials, " -+ "perhaps a standalone server?\n"); - /* -- * We keep the server_credentials as anonymous -- * this is required for the spoolss.notify test -+ * Create anon server credentials for for the -+ * spoolss.notify test. - */ -+ server_credentials = cli_credentials_init_anon(req); -+ if (server_credentials == NULL) { -+ smbsrv_terminate_connection(req->smb_conn, -+ "Failed to init server credentials\n"); -+ return; -+ } - } - - nt_status = samba_server_gensec_start(req, -diff --git a/source4/smb_server/smb2/negprot.c b/source4/smb_server/smb2/negprot.c -index 4aaaf46793b..c433eb194bd 100644 ---- a/source4/smb_server/smb2/negprot.c -+++ b/source4/smb_server/smb2/negprot.c -@@ -39,20 +39,21 @@ static NTSTATUS smb2srv_negprot_secblob(struct smb2srv_request *req, DATA_BLOB * - NTSTATUS nt_status; - struct cli_credentials *server_credentials; - -- server_credentials = cli_credentials_init(req); -- if (!server_credentials) { -- smbsrv_terminate_connection(req->smb_conn, "Failed to init server credentials\n"); -- return NT_STATUS_NO_MEMORY; -- } -- -- cli_credentials_set_conf(server_credentials, req->smb_conn->lp_ctx); -- nt_status = cli_credentials_set_machine_account(server_credentials, req->smb_conn->lp_ctx); -- if (!NT_STATUS_IS_OK(nt_status)) { -- DEBUG(10, ("Failed to obtain server credentials, perhaps a standalone server?: %s\n", nt_errstr(nt_status))); -+ server_credentials = -+ cli_credentials_init_server(req, req->smb_conn->lp_ctx); -+ if (server_credentials == NULL) { -+ DBG_DEBUG("Failed to obtain server credentials, " -+ "perhaps a standalone server?\n"); - /* -- * We keep the server_credentials as anonymous -- * this is required for the spoolss.notify test -+ * Create anon server credentials for for the -+ * spoolss.notify test. - */ -+ server_credentials = cli_credentials_init_anon(req); -+ if (server_credentials == NULL) { -+ smbsrv_terminate_connection(req->smb_conn, -+ "Failed to init server credentials\n"); -+ return NT_STATUS_NO_MEMORY; -+ } - } - - req->smb_conn->negotiate.server_credentials = talloc_steal(req->smb_conn, server_credentials); --- -2.29.2 - - -From 96aae2c7cf11aeaadc98e0e18f88d1c9387019a7 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Tue, 8 Sep 2020 10:15:22 +0200 -Subject: [PATCH 058/104] selftest: Rename 'smb encrypt' to 'server smb - encrypt' - -This makes it more clear what we want. 'smb encrypt' is a synonym for -'server smb encrypt'. - -Signed-off-by: Andreas Schneider -Reviewed-by: Jeremy Allison -(cherry picked from commit c75e8ff47b4d79b37240f9461ddae10a4f03c892) ---- - selftest/target/Samba3.pm | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm -index e141f102ef1..c070086ca49 100755 ---- a/selftest/target/Samba3.pm -+++ b/selftest/target/Samba3.pm -@@ -1178,7 +1178,7 @@ sub setup_simpleserver - ntlm auth = yes - vfs objects = xattr_tdb streams_depot - change notify = no -- smb encrypt = off -+ server smb encrypt = off - - [vfs_aio_pthread] - path = $prefix_abs/share -@@ -1245,7 +1245,7 @@ sub setup_simpleserver - [enc_desired] - path = $prefix_abs/share - vfs objects = -- smb encrypt = desired -+ server smb encrypt = desired - - [hidenewfiles] - path = $prefix_abs/share -@@ -2351,7 +2351,7 @@ sub provision($$) - [tmpenc] - path = $shrdir - comment = encrypt smb username is [%U] -- smb encrypt = required -+ server smb encrypt = required - vfs objects = dirsort - [tmpguest] - path = $shrdir --- -2.29.2 - - -From f4d1c495b4eb8a3125812e1d1d81639afdd15c06 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Tue, 8 Sep 2020 12:30:08 +0200 -Subject: [PATCH 059/104] selftest: Move enc_desired to provision to have it in - 'fileserver' too - -Signed-off-by: Andreas Schneider -Reviewed-by: Jeremy Allison -(cherry picked from commit 1b67943f938ae774360dc3db73db940f9982243b) ---- - selftest/target/Samba3.pm | 11 ++++++----- - 1 file changed, 6 insertions(+), 5 deletions(-) - -diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm -index c070086ca49..fa3ca8962a5 100755 ---- a/selftest/target/Samba3.pm -+++ b/selftest/target/Samba3.pm -@@ -1242,11 +1242,6 @@ sub setup_simpleserver - hide files = /hidefile/ - hide dot files = yes - --[enc_desired] -- path = $prefix_abs/share -- vfs objects = -- server smb encrypt = desired -- - [hidenewfiles] - path = $prefix_abs/share - hide new files timeout = 5 -@@ -2833,7 +2828,13 @@ sub provision($$) - [delete_readonly] - path = $prefix_abs/share - delete readonly = yes -+ -+[enc_desired] -+ path = $prefix_abs/share -+ vfs objects = -+ server smb encrypt = desired - "; -+ - close(CONF); - - my $net = Samba::bindir_path($self, "net"); --- -2.29.2 - - -From c69630ece0849fdca724003600f1b39d6411e194 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Tue, 8 Sep 2020 10:15:20 +0200 -Subject: [PATCH 060/104] s3:tests: Add smbclient tests for 'client smb - encrypt' - -Signed-off-by: Andreas Schneider -Reviewed-by: Jeremy Allison -(cherry picked from commit e7577ab6cbc83b496ac091c3e425c7c7fea29cdb) ---- - selftest/knownfail.d/smbclient-encryption | 2 + - selftest/target/Samba3.pm | 5 ++ - .../script/tests/test_smbclient_encryption.sh | 72 +++++++++++++++++++ - source3/selftest/tests.py | 6 ++ - 4 files changed, 85 insertions(+) - create mode 100644 selftest/knownfail.d/smbclient-encryption - create mode 100755 source3/script/tests/test_smbclient_encryption.sh - -diff --git a/selftest/knownfail.d/smbclient-encryption b/selftest/knownfail.d/smbclient-encryption -new file mode 100644 -index 00000000000..972096bdc8b ---- /dev/null -+++ b/selftest/knownfail.d/smbclient-encryption -@@ -0,0 +1,2 @@ -+^samba3.blackbox.smbclient.encryption.smbclient.smb3.client.encrypt.required...LOCALSHARE4.enc_desired..simpleserver -+^samba3.blackbox.smbclient.encryption.smbclient.smb3.client.encrypt.required...LOCALSHARE4.tmp..simpleserver -diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm -index fa3ca8962a5..ffc19c7d5a2 100755 ---- a/selftest/target/Samba3.pm -+++ b/selftest/target/Samba3.pm -@@ -2833,6 +2833,11 @@ sub provision($$) - path = $prefix_abs/share - vfs objects = - server smb encrypt = desired -+ -+[enc_off] -+ path = $prefix_abs/share -+ vfs objects = -+ server smb encrypt = off - "; - - close(CONF); -diff --git a/source3/script/tests/test_smbclient_encryption.sh b/source3/script/tests/test_smbclient_encryption.sh -new file mode 100755 -index 00000000000..9a717cdac4f ---- /dev/null -+++ b/source3/script/tests/test_smbclient_encryption.sh -@@ -0,0 +1,72 @@ -+#!/bin/sh -+ -+if [ $# -lt 5 ]; then -+cat < -Date: Thu, 27 Aug 2020 15:19:27 +0200 -Subject: [PATCH 061/104] s3:client: Remove global smb_encrypt - -Signed-off-by: Andreas Schneider -Reviewed-by: Jeremy Allison -(cherry picked from commit 1189b20cb7ea09cfed5c246cf977442a51ef72cb) ---- - source3/client/client.c | 25 ++++++++++++++++--------- - 1 file changed, 16 insertions(+), 9 deletions(-) - -diff --git a/source3/client/client.c b/source3/client/client.c -index 56309efcea7..60d4fb3c5ee 100644 ---- a/source3/client/client.c -+++ b/source3/client/client.c -@@ -96,9 +96,6 @@ static unsigned int put_total_time_ms = 0; - /* totals globals */ - static double dir_total; - --/* encrypted state. */ --static bool smb_encrypt; -- - /* root cli_state connection */ - - struct cli_state *cli; -@@ -2758,7 +2755,7 @@ static int cmd_posix_encrypt(void) - d_printf("posix_encrypt failed with error %s\n", nt_errstr(status)); - } else { - d_printf("encryption on\n"); -- smb_encrypt = true; -+ set_cmdline_auth_info_smb_encrypt(popt_get_cmdline_auth_info()); - } - - return 0; -@@ -5283,6 +5280,9 @@ int cmd_iosize(void) - TALLOC_CTX *ctx = talloc_tos(); - char *buf; - int iosize; -+ bool smb_encrypt = -+ get_cmdline_auth_info_smb_encrypt( -+ popt_get_cmdline_auth_info()); - - if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { - if (smbXcli_conn_protocol(cli->conn) < PROTOCOL_SMB2_02) { -@@ -5546,6 +5546,9 @@ static int process_command_string(const char *cmd_in) - TALLOC_CTX *ctx = talloc_tos(); - char *cmd = talloc_strdup(ctx, cmd_in); - int rc = 0; -+ bool smb_encrypt = -+ get_cmdline_auth_info_smb_encrypt( -+ popt_get_cmdline_auth_info()); - - if (!cmd) { - return 1; -@@ -5999,6 +6002,9 @@ static int process(const char *base_directory) - { - int rc = 0; - NTSTATUS status; -+ bool smb_encrypt = -+ get_cmdline_auth_info_smb_encrypt( -+ popt_get_cmdline_auth_info()); - - status = cli_cm_open(talloc_tos(), NULL, - desthost, -@@ -6037,6 +6043,9 @@ static int process(const char *base_directory) - static int do_host_query(const char *query_host) - { - NTSTATUS status; -+ bool smb_encrypt = -+ get_cmdline_auth_info_smb_encrypt( -+ popt_get_cmdline_auth_info()); - - status = cli_cm_open(talloc_tos(), NULL, - query_host, -@@ -6114,6 +6123,9 @@ static int do_tar_op(const char *base_directory) - { - struct tar *tar_ctx = tar_get_ctx(); - int ret = 0; -+ bool smb_encrypt = -+ get_cmdline_auth_info_smb_encrypt( -+ popt_get_cmdline_auth_info()); - - /* do we already have a connection? */ - if (!cli) { -@@ -6459,9 +6471,6 @@ int main(int argc,char *argv[]) - case 'q': - quiet=true; - break; -- case 'e': -- smb_encrypt=true; -- break; - case 'B': - return(do_smb_browse()); - -@@ -6531,8 +6540,6 @@ int main(int argc,char *argv[]) - - /* Ensure we have a password (or equivalent). */ - popt_common_credentials_post(); -- smb_encrypt = get_cmdline_auth_info_smb_encrypt( -- popt_get_cmdline_auth_info()); - - max_protocol = lp_client_max_protocol(); - --- -2.29.2 - - -From 1c461fb323ba59539c8dab2547032bdb48c60178 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Thu, 27 Aug 2020 15:24:27 +0200 -Subject: [PATCH 062/104] s3:libsmb: Remove force_encrypt from cli_cm_open() - -Signed-off-by: Andreas Schneider -Reviewed-by: Jeremy Allison -(cherry picked from commit a9fbc8dae878ddfa54153e91cc1128c307816b76) ---- - source3/client/client.c | 21 ++++----------------- - source3/lib/netapi/cm.c | 1 - - source3/libsmb/clidfs.c | 4 ++-- - source3/libsmb/proto.h | 1 - - 4 files changed, 6 insertions(+), 21 deletions(-) - -diff --git a/source3/client/client.c b/source3/client/client.c -index 60d4fb3c5ee..3a610086511 100644 ---- a/source3/client/client.c -+++ b/source3/client/client.c -@@ -5546,9 +5546,6 @@ static int process_command_string(const char *cmd_in) - TALLOC_CTX *ctx = talloc_tos(); - char *cmd = talloc_strdup(ctx, cmd_in); - int rc = 0; -- bool smb_encrypt = -- get_cmdline_auth_info_smb_encrypt( -- popt_get_cmdline_auth_info()); - - if (!cmd) { - return 1; -@@ -5561,7 +5558,6 @@ static int process_command_string(const char *cmd_in) - status = cli_cm_open(talloc_tos(), NULL, - desthost, - service, popt_get_cmdline_auth_info(), -- smb_encrypt, - max_protocol, - have_ip ? &dest_ss : NULL, port, - name_type, -@@ -6002,14 +5998,11 @@ static int process(const char *base_directory) - { - int rc = 0; - NTSTATUS status; -- bool smb_encrypt = -- get_cmdline_auth_info_smb_encrypt( -- popt_get_cmdline_auth_info()); - - status = cli_cm_open(talloc_tos(), NULL, - desthost, - service, popt_get_cmdline_auth_info(), -- smb_encrypt, max_protocol, -+ max_protocol, - have_ip ? &dest_ss : NULL, port, - name_type, &cli); - if (!NT_STATUS_IS_OK(status)) { -@@ -6043,14 +6036,11 @@ static int process(const char *base_directory) - static int do_host_query(const char *query_host) - { - NTSTATUS status; -- bool smb_encrypt = -- get_cmdline_auth_info_smb_encrypt( -- popt_get_cmdline_auth_info()); - - status = cli_cm_open(talloc_tos(), NULL, - query_host, - "IPC$", popt_get_cmdline_auth_info(), -- smb_encrypt, max_protocol, -+ max_protocol, - have_ip ? &dest_ss : NULL, port, - name_type, &cli); - if (!NT_STATUS_IS_OK(status)) { -@@ -6097,7 +6087,7 @@ static int do_host_query(const char *query_host) - status = cli_cm_open(talloc_tos(), NULL, - query_host, - "IPC$", popt_get_cmdline_auth_info(), -- smb_encrypt, max_proto, -+ max_proto, - have_ip ? &dest_ss : NULL, NBT_SMB_PORT, - name_type, &cli); - if (!NT_STATUS_IS_OK(status)) { -@@ -6123,9 +6113,6 @@ static int do_tar_op(const char *base_directory) - { - struct tar *tar_ctx = tar_get_ctx(); - int ret = 0; -- bool smb_encrypt = -- get_cmdline_auth_info_smb_encrypt( -- popt_get_cmdline_auth_info()); - - /* do we already have a connection? */ - if (!cli) { -@@ -6134,7 +6121,7 @@ static int do_tar_op(const char *base_directory) - status = cli_cm_open(talloc_tos(), NULL, - desthost, - service, popt_get_cmdline_auth_info(), -- smb_encrypt, max_protocol, -+ max_protocol, - have_ip ? &dest_ss : NULL, port, - name_type, &cli); - if (!NT_STATUS_IS_OK(status)) { -diff --git a/source3/lib/netapi/cm.c b/source3/lib/netapi/cm.c -index 1b8f2a4e97a..0fd31ef3d5a 100644 ---- a/source3/lib/netapi/cm.c -+++ b/source3/lib/netapi/cm.c -@@ -110,7 +110,6 @@ static WERROR libnetapi_open_ipc_connection(struct libnetapi_ctx *ctx, - status = cli_cm_open(ctx, NULL, - server_name, "IPC$", - auth_info, -- false, - lp_client_ipc_max_protocol(), - NULL, 0, 0x20, &cli_ipc); - if (!NT_STATUS_IS_OK(status)) { -diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c -index aff998f6187..4825b8f3fae 100644 ---- a/source3/libsmb/clidfs.c -+++ b/source3/libsmb/clidfs.c -@@ -383,7 +383,6 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, - const char *server, - const char *share, - const struct user_auth_info *auth_info, -- bool force_encrypt, - int max_protocol, - const struct sockaddr_storage *dest_ss, - int port, -@@ -393,6 +392,8 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, - /* Try to reuse an existing connection in this list. */ - struct cli_state *c = cli_cm_find(referring_cli, server, share); - NTSTATUS status; -+ bool force_encrypt = -+ get_cmdline_auth_info_smb_encrypt(auth_info); - - if (c) { - *pcli = c; -@@ -962,7 +963,6 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, - smbXcli_conn_remote_name(rootcli->conn), - "IPC$", - dfs_auth_info, -- cli_state_is_encryption_on(rootcli), - smbXcli_conn_protocol(rootcli->conn), - NULL, /* dest_ss not needed, we reuse the transport */ - 0, -diff --git a/source3/libsmb/proto.h b/source3/libsmb/proto.h -index eeabcaa7463..bb3e9e6874e 100644 ---- a/source3/libsmb/proto.h -+++ b/source3/libsmb/proto.h -@@ -128,7 +128,6 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, - const char *server, - const char *share, - const struct user_auth_info *auth_info, -- bool force_encrypt, - int max_protocol, - const struct sockaddr_storage *dest_ss, - int port, --- -2.29.2 - - -From 411587b7301ec115398e430bcac16c5a22bdfe41 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Thu, 27 Aug 2020 15:26:39 +0200 -Subject: [PATCH 063/104] s3:libsmb: Remove force_encrypt from cli_cm_connect() - -Signed-off-by: Andreas Schneider -Reviewed-by: Jeremy Allison -(cherry picked from commit d27e237cf37fb254646d94827935d9c302c379ff) ---- - source3/libsmb/clidfs.c | 7 ++----- - 1 file changed, 2 insertions(+), 5 deletions(-) - -diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c -index 4825b8f3fae..b0032005398 100644 ---- a/source3/libsmb/clidfs.c -+++ b/source3/libsmb/clidfs.c -@@ -287,7 +287,6 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, - const char *server, - const char *share, - const struct user_auth_info *auth_info, -- bool force_encrypt, - int max_protocol, - const struct sockaddr_storage *dest_ss, - int port, -@@ -296,6 +295,8 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, - { - struct cli_state *cli = NULL; - NTSTATUS status; -+ bool force_encrypt = -+ get_cmdline_auth_info_smb_encrypt(auth_info); - - status = do_connect(ctx, server, share, - auth_info, -@@ -392,8 +393,6 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, - /* Try to reuse an existing connection in this list. */ - struct cli_state *c = cli_cm_find(referring_cli, server, share); - NTSTATUS status; -- bool force_encrypt = -- get_cmdline_auth_info_smb_encrypt(auth_info); - - if (c) { - *pcli = c; -@@ -414,7 +413,6 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, - server, - share, - auth_info, -- force_encrypt, - max_protocol, - dest_ss, - port, -@@ -1020,7 +1018,6 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, - dfs_refs[count].server, - dfs_refs[count].share, - dfs_auth_info, -- cli_state_is_encryption_on(rootcli), - smbXcli_conn_protocol(rootcli->conn), - NULL, /* dest_ss */ - 0, /* port */ --- -2.29.2 - - -From af532caa1ba9727663abf17465b04768c6f7173e Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Thu, 27 Aug 2020 15:28:28 +0200 -Subject: [PATCH 064/104] s3:libsmb: Remove force_encrypt from clidfs - do_connect() - -Signed-off-by: Andreas Schneider -Reviewed-by: Jeremy Allison -(cherry picked from commit 615a9a68166bdeb0ab7dbacf395c6125ec70f288) ---- - source3/libsmb/clidfs.c | 9 ++++----- - 1 file changed, 4 insertions(+), 5 deletions(-) - -diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c -index b0032005398..5503506de97 100644 ---- a/source3/libsmb/clidfs.c -+++ b/source3/libsmb/clidfs.c -@@ -107,7 +107,6 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, - const char *server, - const char *share, - const struct user_auth_info *auth_info, -- bool force_encrypt, - int max_protocol, - const struct sockaddr_storage *dest_ss, - int port, -@@ -123,6 +122,8 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, - enum protocol_types protocol = PROTOCOL_NONE; - int signing_state = get_cmdline_auth_info_signing_state(auth_info); - struct cli_credentials *creds = NULL; -+ bool force_encrypt = -+ get_cmdline_auth_info_smb_encrypt(auth_info); - - if (force_encrypt) { - signing_state = SMB_SIGNING_REQUIRED; -@@ -233,7 +234,7 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, - cli_shutdown(c); - return do_connect(ctx, newserver, - newshare, auth_info, -- force_encrypt, max_protocol, -+ max_protocol, - NULL, port, name_type, pcli); - } - -@@ -295,12 +296,10 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, - { - struct cli_state *cli = NULL; - NTSTATUS status; -- bool force_encrypt = -- get_cmdline_auth_info_smb_encrypt(auth_info); - - status = do_connect(ctx, server, share, - auth_info, -- force_encrypt, max_protocol, -+ max_protocol, - dest_ss, port, name_type, &cli); - - if (!NT_STATUS_IS_OK(status)) { --- -2.29.2 - - -From 918aa81d36bcd8b28fa98deadd811b8602fb3f6d Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Thu, 27 Aug 2020 15:52:11 +0200 -Subject: [PATCH 065/104] s3:libsmb: Remove force_encrypt from - cli_check_msdfs_proxy() - -Signed-off-by: Andreas Schneider -Reviewed-by: Jeremy Allison -(cherry picked from commit 4ddec1ca257fff418847c5d1e83a3fb7cb5ade1a) ---- - source3/libsmb/clidfs.c | 17 ++++++++++++----- - source3/libsmb/libsmb_server.c | 4 ---- - source3/libsmb/proto.h | 1 - - 3 files changed, 12 insertions(+), 10 deletions(-) - -diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c -index 5503506de97..736c565a7a8 100644 ---- a/source3/libsmb/clidfs.c -+++ b/source3/libsmb/clidfs.c -@@ -230,7 +230,7 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, - if (smbXcli_conn_dfs_supported(c->conn) && - cli_check_msdfs_proxy(ctx, c, sharename, - &newserver, &newshare, -- force_encrypt, creds)) { -+ creds)) { - cli_shutdown(c); - return do_connect(ctx, newserver, - newshare, auth_info, -@@ -1176,7 +1176,6 @@ bool cli_check_msdfs_proxy(TALLOC_CTX *ctx, - const char *sharename, - char **pp_newserver, - char **pp_newshare, -- bool force_encrypt, - struct cli_credentials *creds) - { - struct client_dfs_referral *refs = NULL; -@@ -1188,6 +1187,8 @@ bool cli_check_msdfs_proxy(TALLOC_CTX *ctx, - char *newextrapath = NULL; - NTSTATUS status; - const char *remote_name; -+ enum smb_encryption_setting encryption_state = -+ cli_credentials_get_smb_encryption(creds); - - if (!cli || !sharename) { - return false; -@@ -1223,11 +1224,17 @@ bool cli_check_msdfs_proxy(TALLOC_CTX *ctx, - return false; - } - -- if (force_encrypt) { -+ if (encryption_state >= SMB_ENCRYPTION_DESIRED) { - status = cli_cm_force_encryption_creds(cli, creds, "IPC$"); - if (!NT_STATUS_IS_OK(status)) { -- cli_state_restore_tcon(cli, orig_tcon); -- return false; -+ switch (encryption_state) { -+ case SMB_ENCRYPTION_DESIRED: -+ break; -+ case SMB_ENCRYPTION_REQUIRED: -+ default: -+ cli_state_restore_tcon(cli, orig_tcon); -+ return false; -+ } - } - } - -diff --git a/source3/libsmb/libsmb_server.c b/source3/libsmb/libsmb_server.c -index eb58d7c6ac9..5a1055ba773 100644 ---- a/source3/libsmb/libsmb_server.c -+++ b/source3/libsmb/libsmb_server.c -@@ -587,10 +587,6 @@ SMBC_server_internal(TALLOC_CTX *ctx, - if (smbXcli_conn_dfs_supported(c->conn) && - cli_check_msdfs_proxy(ctx, c, share, - &newserver, &newshare, -- /* FIXME: cli_check_msdfs_proxy() does -- not support smbc_smb_encrypt_level type */ -- context->internal->smb_encryption_level ? -- true : false, - creds)) { - cli_shutdown(c); - srv = SMBC_server_internal(ctx, context, connect_if_not_found, -diff --git a/source3/libsmb/proto.h b/source3/libsmb/proto.h -index bb3e9e6874e..f2b0a8c5ff8 100644 ---- a/source3/libsmb/proto.h -+++ b/source3/libsmb/proto.h -@@ -161,7 +161,6 @@ bool cli_check_msdfs_proxy(TALLOC_CTX *ctx, - const char *sharename, - char **pp_newserver, - char **pp_newshare, -- bool force_encrypt, - struct cli_credentials *creds); - - /* The following definitions come from libsmb/clientgen.c */ --- -2.29.2 - - -From 00bba24fda3f117eced7f306d5d4019f14595d38 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Tue, 18 Aug 2020 17:15:09 +0200 -Subject: [PATCH 066/104] s3:libsmb: Pass cli_credentials to clidfs - do_connect() - -Signed-off-by: Andreas Schneider -Reviewed-by: Jeremy Allison -(cherry picked from commit 276563de06f2071ec2ed9a8b73f92215ab621bba) ---- - selftest/knownfail.d/smbclient-encryption | 2 -- - source3/libsmb/clidfs.c | 34 +++++++++++++---------- - 2 files changed, 20 insertions(+), 16 deletions(-) - delete mode 100644 selftest/knownfail.d/smbclient-encryption - -diff --git a/selftest/knownfail.d/smbclient-encryption b/selftest/knownfail.d/smbclient-encryption -deleted file mode 100644 -index 972096bdc8b..00000000000 ---- a/selftest/knownfail.d/smbclient-encryption -+++ /dev/null -@@ -1,2 +0,0 @@ --^samba3.blackbox.smbclient.encryption.smbclient.smb3.client.encrypt.required...LOCALSHARE4.enc_desired..simpleserver --^samba3.blackbox.smbclient.encryption.smbclient.smb3.client.encrypt.required...LOCALSHARE4.tmp..simpleserver -diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c -index 736c565a7a8..d536e0597af 100644 ---- a/source3/libsmb/clidfs.c -+++ b/source3/libsmb/clidfs.c -@@ -106,7 +106,7 @@ static NTSTATUS cli_cm_force_encryption_creds(struct cli_state *c, - static NTSTATUS do_connect(TALLOC_CTX *ctx, - const char *server, - const char *share, -- const struct user_auth_info *auth_info, -+ struct cli_credentials *creds, - int max_protocol, - const struct sockaddr_storage *dest_ss, - int port, -@@ -120,12 +120,12 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, - NTSTATUS status; - int flags = 0; - enum protocol_types protocol = PROTOCOL_NONE; -- int signing_state = get_cmdline_auth_info_signing_state(auth_info); -- struct cli_credentials *creds = NULL; -- bool force_encrypt = -- get_cmdline_auth_info_smb_encrypt(auth_info); -+ enum smb_signing_setting signing_state = -+ cli_credentials_get_smb_signing(creds); -+ enum smb_encryption_setting encryption_state = -+ cli_credentials_get_smb_encryption(creds); - -- if (force_encrypt) { -+ if (encryption_state >= SMB_ENCRYPTION_DESIRED) { - signing_state = SMB_SIGNING_REQUIRED; - } - -@@ -192,13 +192,12 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, - smb2cli_conn_set_max_credits(c->conn, DEFAULT_SMB2_MAX_CREDITS); - } - -- creds = get_cmdline_auth_info_creds(auth_info); -- - status = cli_session_setup_creds(c, creds); - if (!NT_STATUS_IS_OK(status)) { - /* If a password was not supplied then - * try again with a null username. */ -- if (force_encrypt || smbXcli_conn_signing_mandatory(c->conn) || -+ if (encryption_state == SMB_ENCRYPTION_REQUIRED || -+ smbXcli_conn_signing_mandatory(c->conn) || - cli_credentials_authentication_requested(creds) || - cli_credentials_is_anonymous(creds) || - !NT_STATUS_IS_OK(status = cli_session_setup_anon(c))) -@@ -233,7 +232,7 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, - creds)) { - cli_shutdown(c); - return do_connect(ctx, newserver, -- newshare, auth_info, -+ newshare, creds, - max_protocol, - NULL, port, name_type, pcli); - } -@@ -247,13 +246,19 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, - return status; - } - -- if (force_encrypt) { -+ if (encryption_state >= SMB_ENCRYPTION_DESIRED) { - status = cli_cm_force_encryption_creds(c, - creds, - sharename); - if (!NT_STATUS_IS_OK(status)) { -- cli_shutdown(c); -- return status; -+ switch (encryption_state) { -+ case SMB_ENCRYPTION_DESIRED: -+ break; -+ case SMB_ENCRYPTION_REQUIRED: -+ default: -+ cli_shutdown(c); -+ return status; -+ } - } - } - -@@ -295,10 +300,11 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, - struct cli_state **pcli) - { - struct cli_state *cli = NULL; -+ struct cli_credentials *creds = get_cmdline_auth_info_creds(auth_info); - NTSTATUS status; - - status = do_connect(ctx, server, share, -- auth_info, -+ creds, - max_protocol, - dest_ss, port, name_type, &cli); - --- -2.29.2 - - -From 0dfe1d347c131b66172d324a5a16336875b24d50 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Tue, 18 Aug 2020 17:18:16 +0200 -Subject: [PATCH 067/104] s3:libsmb: Pass cli_credentials to cli_cm_connect() - -Signed-off-by: Andreas Schneider -Reviewed-by: Jeremy Allison -(cherry picked from commit c8349111243fec81a2b95484e56a6d6bebaba80e) ---- - source3/libsmb/clidfs.c | 9 +++++---- - 1 file changed, 5 insertions(+), 4 deletions(-) - -diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c -index d536e0597af..a2c6f5fe5ec 100644 ---- a/source3/libsmb/clidfs.c -+++ b/source3/libsmb/clidfs.c -@@ -292,7 +292,7 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, - struct cli_state *referring_cli, - const char *server, - const char *share, -- const struct user_auth_info *auth_info, -+ struct cli_credentials *creds, - int max_protocol, - const struct sockaddr_storage *dest_ss, - int port, -@@ -300,7 +300,6 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, - struct cli_state **pcli) - { - struct cli_state *cli = NULL; -- struct cli_credentials *creds = get_cmdline_auth_info_creds(auth_info); - NTSTATUS status; - - status = do_connect(ctx, server, share, -@@ -397,6 +396,7 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, - { - /* Try to reuse an existing connection in this list. */ - struct cli_state *c = cli_cm_find(referring_cli, server, share); -+ struct cli_credentials *creds = get_cmdline_auth_info_creds(auth_info); - NTSTATUS status; - - if (c) { -@@ -417,7 +417,7 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, - referring_cli, - server, - share, -- auth_info, -+ creds, - max_protocol, - dest_ss, - port, -@@ -886,6 +886,7 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, - struct smbXcli_tcon *root_tcon = NULL; - struct smbXcli_tcon *target_tcon = NULL; - struct cli_dfs_path_split *dfs_refs = NULL; -+ struct cli_credentials *creds = get_cmdline_auth_info_creds(dfs_auth_info); - - if ( !rootcli || !path || !targetcli ) { - return NT_STATUS_INVALID_PARAMETER; -@@ -1022,7 +1023,7 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, - status = cli_cm_connect(ctx, rootcli, - dfs_refs[count].server, - dfs_refs[count].share, -- dfs_auth_info, -+ creds, - smbXcli_conn_protocol(rootcli->conn), - NULL, /* dest_ss */ - 0, /* port */ --- -2.29.2 - - -From baf5499376658651aa03ba864e6541e2daf06b3a Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Tue, 18 Aug 2020 17:26:54 +0200 -Subject: [PATCH 068/104] s3:libsmb: Pass cli_credentials to cli_cm_open() - -Signed-off-by: Andreas Schneider -Reviewed-by: Jeremy Allison -(cherry picked from commit df1623abd7267916696e2e60c146ef8fa6c9dfc9) ---- - source3/client/client.c | 23 ++++++++++++++++++----- - source3/lib/netapi/cm.c | 4 +++- - source3/libsmb/clidfs.c | 25 ++++++++++++------------- - source3/libsmb/proto.h | 18 +++++++++--------- - 4 files changed, 42 insertions(+), 28 deletions(-) - -diff --git a/source3/client/client.c b/source3/client/client.c -index 3a610086511..c54b5065b44 100644 ---- a/source3/client/client.c -+++ b/source3/client/client.c -@@ -5546,6 +5546,8 @@ static int process_command_string(const char *cmd_in) - TALLOC_CTX *ctx = talloc_tos(); - char *cmd = talloc_strdup(ctx, cmd_in); - int rc = 0; -+ struct cli_credentials *creds = -+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); - - if (!cmd) { - return 1; -@@ -5557,7 +5559,8 @@ static int process_command_string(const char *cmd_in) - - status = cli_cm_open(talloc_tos(), NULL, - desthost, -- service, popt_get_cmdline_auth_info(), -+ service, -+ creds, - max_protocol, - have_ip ? &dest_ss : NULL, port, - name_type, -@@ -5998,10 +6001,13 @@ static int process(const char *base_directory) - { - int rc = 0; - NTSTATUS status; -+ struct cli_credentials *creds = -+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); - - status = cli_cm_open(talloc_tos(), NULL, - desthost, -- service, popt_get_cmdline_auth_info(), -+ service, -+ creds, - max_protocol, - have_ip ? &dest_ss : NULL, port, - name_type, &cli); -@@ -6036,10 +6042,13 @@ static int process(const char *base_directory) - static int do_host_query(const char *query_host) - { - NTSTATUS status; -+ struct cli_credentials *creds = -+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); - - status = cli_cm_open(talloc_tos(), NULL, - query_host, -- "IPC$", popt_get_cmdline_auth_info(), -+ "IPC$", -+ creds, - max_protocol, - have_ip ? &dest_ss : NULL, port, - name_type, &cli); -@@ -6086,7 +6095,8 @@ static int do_host_query(const char *query_host) - d_printf("Reconnecting with SMB1 for workgroup listing.\n"); - status = cli_cm_open(talloc_tos(), NULL, - query_host, -- "IPC$", popt_get_cmdline_auth_info(), -+ "IPC$", -+ creds, - max_proto, - have_ip ? &dest_ss : NULL, NBT_SMB_PORT, - name_type, &cli); -@@ -6113,6 +6123,8 @@ static int do_tar_op(const char *base_directory) - { - struct tar *tar_ctx = tar_get_ctx(); - int ret = 0; -+ struct cli_credentials *creds = -+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); - - /* do we already have a connection? */ - if (!cli) { -@@ -6120,7 +6132,8 @@ static int do_tar_op(const char *base_directory) - - status = cli_cm_open(talloc_tos(), NULL, - desthost, -- service, popt_get_cmdline_auth_info(), -+ service, -+ creds, - max_protocol, - have_ip ? &dest_ss : NULL, port, - name_type, &cli); -diff --git a/source3/lib/netapi/cm.c b/source3/lib/netapi/cm.c -index 0fd31ef3d5a..943f7498e8c 100644 ---- a/source3/lib/netapi/cm.c -+++ b/source3/lib/netapi/cm.c -@@ -71,6 +71,7 @@ static WERROR libnetapi_open_ipc_connection(struct libnetapi_ctx *ctx, - struct cli_state *cli_ipc = NULL; - struct client_ipc_connection *p; - NTSTATUS status; -+ struct cli_credentials *creds = NULL; - - if (!ctx || !pp || !server_name) { - return WERR_INVALID_PARAMETER; -@@ -106,10 +107,11 @@ static WERROR libnetapi_open_ipc_connection(struct libnetapi_ctx *ctx, - if (ctx->use_ccache) { - set_cmdline_auth_info_use_ccache(auth_info, true); - } -+ creds = get_cmdline_auth_info_creds(auth_info); - - status = cli_cm_open(ctx, NULL, - server_name, "IPC$", -- auth_info, -+ creds, - lp_client_ipc_max_protocol(), - NULL, 0, 0x20, &cli_ipc); - if (!NT_STATUS_IS_OK(status)) { -diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c -index a2c6f5fe5ec..ef75fb36a45 100644 ---- a/source3/libsmb/clidfs.c -+++ b/source3/libsmb/clidfs.c -@@ -384,19 +384,18 @@ static struct cli_state *cli_cm_find(struct cli_state *cli, - ****************************************************************************/ - - NTSTATUS cli_cm_open(TALLOC_CTX *ctx, -- struct cli_state *referring_cli, -- const char *server, -- const char *share, -- const struct user_auth_info *auth_info, -- int max_protocol, -- const struct sockaddr_storage *dest_ss, -- int port, -- int name_type, -- struct cli_state **pcli) -+ struct cli_state *referring_cli, -+ const char *server, -+ const char *share, -+ struct cli_credentials *creds, -+ int max_protocol, -+ const struct sockaddr_storage *dest_ss, -+ int port, -+ int name_type, -+ struct cli_state **pcli) - { - /* Try to reuse an existing connection in this list. */ - struct cli_state *c = cli_cm_find(referring_cli, server, share); -- struct cli_credentials *creds = get_cmdline_auth_info_creds(auth_info); - NTSTATUS status; - - if (c) { -@@ -404,11 +403,11 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, - return NT_STATUS_OK; - } - -- if (auth_info == NULL) { -+ if (creds == NULL) { - /* Can't do a new connection - * without auth info. */ - d_printf("cli_cm_open() Unable to open connection [\\%s\\%s] " -- "without auth info\n", -+ "without client credentials\n", - server, share ); - return NT_STATUS_INVALID_PARAMETER; - } -@@ -966,7 +965,7 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, - rootcli, - smbXcli_conn_remote_name(rootcli->conn), - "IPC$", -- dfs_auth_info, -+ creds, - smbXcli_conn_protocol(rootcli->conn), - NULL, /* dest_ss not needed, we reuse the transport */ - 0, -diff --git a/source3/libsmb/proto.h b/source3/libsmb/proto.h -index f2b0a8c5ff8..0b8cf2a6036 100644 ---- a/source3/libsmb/proto.h -+++ b/source3/libsmb/proto.h -@@ -124,15 +124,15 @@ struct cli_state *get_ipc_connect_master_ip(TALLOC_CTX *ctx, - /* The following definitions come from libsmb/clidfs.c */ - - NTSTATUS cli_cm_open(TALLOC_CTX *ctx, -- struct cli_state *referring_cli, -- const char *server, -- const char *share, -- const struct user_auth_info *auth_info, -- int max_protocol, -- const struct sockaddr_storage *dest_ss, -- int port, -- int name_type, -- struct cli_state **pcli); -+ struct cli_state *referring_cli, -+ const char *server, -+ const char *share, -+ struct cli_credentials *creds, -+ int max_protocol, -+ const struct sockaddr_storage *dest_ss, -+ int port, -+ int name_type, -+ struct cli_state **pcli); - void cli_cm_display(struct cli_state *c); - struct client_dfs_referral; - NTSTATUS cli_dfs_get_referral_ex(TALLOC_CTX *ctx, --- -2.29.2 - - -From ee496daf60a5340ab9e4f16430e2d93fd121659b Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Tue, 18 Aug 2020 17:42:25 +0200 -Subject: [PATCH 069/104] s3:libsmb: Pass cli_credentials to - cli_resolve_path(), using helper variables. - -Signed-off-by: Andreas Schneider -Signed-off-by: Jeremy Allison -(cherry picked from commit 5245ab3c4dacc88d5cbe3bb1e3e339e4fb77a4db) ---- - source3/client/client.c | 148 +++++++++++++++++++++++++++------- - source3/libsmb/clidfs.c | 5 +- - source3/libsmb/libsmb_dir.c | 43 ++++++++-- - source3/libsmb/libsmb_file.c | 13 ++- - source3/libsmb/libsmb_stat.c | 6 +- - source3/libsmb/libsmb_xattr.c | 13 ++- - source3/libsmb/proto.h | 2 +- - source3/utils/smbcacls.c | 5 +- - 8 files changed, 188 insertions(+), 47 deletions(-) - -diff --git a/source3/client/client.c b/source3/client/client.c -index c54b5065b44..13e48f80a01 100644 ---- a/source3/client/client.c -+++ b/source3/client/client.c -@@ -298,9 +298,14 @@ static int do_dskattr(void) - struct cli_state *targetcli = NULL; - char *targetpath = NULL; - TALLOC_CTX *ctx = talloc_tos(); -+ struct cli_credentials *creds = -+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); - NTSTATUS status; - -- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), cli, -+ status = cli_resolve_path(ctx, -+ "", -+ creds, -+ cli, - client_get_cur_dir(), &targetcli, - &targetpath); - if (!NT_STATUS_IS_OK(status)) { -@@ -390,6 +395,8 @@ static int do_cd(const char *new_dir) - uint32_t attributes; - int ret = 1; - TALLOC_CTX *ctx = talloc_stackframe(); -+ struct cli_credentials *creds = -+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); - NTSTATUS status; - - newdir = talloc_strdup(ctx, new_dir); -@@ -432,7 +439,8 @@ static int do_cd(const char *new_dir) - new_cd = client_clean_name(ctx, new_cd); - client_set_cur_dir(new_cd); - -- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), -+ status = cli_resolve_path(ctx, "", -+ creds, - cli, new_cd, &targetcli, &targetpath); - if (!NT_STATUS_IS_OK(status)) { - d_printf("cd %s: %s\n", new_cd, nt_errstr(status)); -@@ -809,6 +817,8 @@ NTSTATUS do_list(const char *mask, - TALLOC_CTX *ctx = talloc_tos(); - struct cli_state *targetcli = NULL; - char *targetpath = NULL; -+ struct cli_credentials *creds = -+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); - NTSTATUS ret_status = NT_STATUS_OK; - NTSTATUS status = NT_STATUS_OK; - -@@ -832,7 +842,7 @@ NTSTATUS do_list(const char *mask, - /* check for dfs */ - - status = cli_resolve_path(ctx, "", -- popt_get_cmdline_auth_info(), -+ creds, - cli, head, &targetcli, &targetpath); - if (!NT_STATUS_IS_OK(status)) { - d_printf("do_list: [%s] %s\n", head, -@@ -1042,6 +1052,8 @@ static int do_get(const char *rname, const char *lname_in, bool reget) - struct cli_state *targetcli = NULL; - char *targetname = NULL; - char *lname = NULL; -+ struct cli_credentials *creds = -+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); - NTSTATUS status; - - lname = talloc_strdup(ctx, lname_in); -@@ -1056,7 +1068,8 @@ static int do_get(const char *rname, const char *lname_in, bool reget) - } - } - -- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), -+ status = cli_resolve_path(ctx, "", -+ creds, - cli, rname, &targetcli, &targetname); - if (!NT_STATUS_IS_OK(status)) { - d_printf("Failed to open %s: %s\n", rname, nt_errstr(status)); -@@ -1413,9 +1426,12 @@ static bool do_mkdir(const char *name) - TALLOC_CTX *ctx = talloc_tos(); - struct cli_state *targetcli; - char *targetname = NULL; -+ struct cli_credentials *creds = -+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); - NTSTATUS status; - -- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), -+ status = cli_resolve_path(ctx, "", -+ creds, - cli, name, &targetcli, &targetname); - if (!NT_STATUS_IS_OK(status)) { - d_printf("mkdir %s: %s\n", name, nt_errstr(status)); -@@ -1474,6 +1490,8 @@ static int cmd_mkdir(void) - TALLOC_CTX *ctx = talloc_tos(); - char *mask = NULL; - char *buf = NULL; -+ struct cli_credentials *creds = -+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); - NTSTATUS status; - - mask = talloc_strdup(ctx, client_get_cur_dir()); -@@ -1510,7 +1528,8 @@ static int cmd_mkdir(void) - } - - status = cli_resolve_path(ctx, "", -- popt_get_cmdline_auth_info(), cli, mask, -+ creds, -+ cli, mask, - &targetcli, &targetname); - if (!NT_STATUS_IS_OK(status)) { - return 1; -@@ -1824,9 +1843,12 @@ static int do_put(const char *rname, const char *lname, bool reput) - struct cli_state *targetcli; - char *targetname = NULL; - struct push_state state; -+ struct cli_credentials *creds = -+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); - NTSTATUS status; - -- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), -+ status = cli_resolve_path(ctx, "", -+ creds, - cli, rname, &targetcli, &targetname); - if (!NT_STATUS_IS_OK(status)) { - d_printf("Failed to open %s: %s\n", rname, nt_errstr(status)); -@@ -2601,6 +2623,8 @@ static int cmd_wdel(void) - uint32_t attribute; - struct cli_state *targetcli; - char *targetname = NULL; -+ struct cli_credentials *creds = -+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); - NTSTATUS status; - - if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { -@@ -2626,7 +2650,8 @@ static int cmd_wdel(void) - return 1; - } - -- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), -+ status = cli_resolve_path(ctx, "", -+ creds, - cli, mask, &targetcli, &targetname); - if (!NT_STATUS_IS_OK(status)) { - d_printf("cmd_wdel %s: %s\n", mask, nt_errstr(status)); -@@ -2652,6 +2677,8 @@ static int cmd_open(void) - char *targetname = NULL; - struct cli_state *targetcli; - uint16_t fnum = (uint16_t)-1; -+ struct cli_credentials *creds = -+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); - NTSTATUS status; - - if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { -@@ -2671,7 +2698,8 @@ static int cmd_open(void) - return 1; - } - -- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), -+ status = cli_resolve_path(ctx, "", -+ creds, - cli, mask, &targetcli, &targetname); - if (!NT_STATUS_IS_OK(status)) { - d_printf("open %s: %s\n", mask, nt_errstr(status)); -@@ -2773,6 +2801,8 @@ static int cmd_posix_open(void) - struct cli_state *targetcli; - mode_t mode; - uint16_t fnum; -+ struct cli_credentials *creds = -+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); - NTSTATUS status; - - if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { -@@ -2797,7 +2827,8 @@ static int cmd_posix_open(void) - } - mode = (mode_t)strtol(buf, (char **)NULL, 8); - -- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), -+ status = cli_resolve_path(ctx, "", -+ creds, - cli, mask, &targetcli, &targetname); - if (!NT_STATUS_IS_OK(status)) { - d_printf("posix_open %s: %s\n", mask, nt_errstr(status)); -@@ -2832,6 +2863,8 @@ static int cmd_posix_mkdir(void) - char *targetname = NULL; - struct cli_state *targetcli; - mode_t mode; -+ struct cli_credentials *creds = -+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); - NTSTATUS status; - - if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { -@@ -2856,7 +2889,8 @@ static int cmd_posix_mkdir(void) - } - mode = (mode_t)strtol(buf, (char **)NULL, 8); - -- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), -+ status = cli_resolve_path(ctx, "", -+ creds, - cli, mask, &targetcli, &targetname); - if (!NT_STATUS_IS_OK(status)) { - d_printf("posix_mkdir %s: %s\n", mask, nt_errstr(status)); -@@ -2880,6 +2914,8 @@ static int cmd_posix_unlink(void) - char *buf = NULL; - char *targetname = NULL; - struct cli_state *targetcli; -+ struct cli_credentials *creds = -+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); - NTSTATUS status; - - if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { -@@ -2898,7 +2934,8 @@ static int cmd_posix_unlink(void) - return 1; - } - -- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), -+ status = cli_resolve_path(ctx, "", -+ creds, - cli, mask, &targetcli, &targetname); - if (!NT_STATUS_IS_OK(status)) { - d_printf("posix_unlink %s: %s\n", mask, nt_errstr(status)); -@@ -2923,6 +2960,8 @@ static int cmd_posix_rmdir(void) - char *buf = NULL; - char *targetname = NULL; - struct cli_state *targetcli; -+ struct cli_credentials *creds = -+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); - NTSTATUS status; - - if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { -@@ -2941,7 +2980,8 @@ static int cmd_posix_rmdir(void) - return 1; - } - -- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), -+ status = cli_resolve_path(ctx, "", -+ creds, - cli, mask, &targetcli, &targetname); - if (!NT_STATUS_IS_OK(status)) { - d_printf("posix_rmdir %s: %s\n", mask, nt_errstr(status)); -@@ -3230,6 +3270,8 @@ static int cmd_rmdir(void) - char *buf = NULL; - char *targetname = NULL; - struct cli_state *targetcli; -+ struct cli_credentials *creds = -+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); - NTSTATUS status; - - if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { -@@ -3248,7 +3290,8 @@ static int cmd_rmdir(void) - return 1; - } - -- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), -+ status = cli_resolve_path(ctx, "", -+ creds, - cli, mask, &targetcli, &targetname); - if (!NT_STATUS_IS_OK(status)) { - d_printf("rmdir %s: %s\n", mask, nt_errstr(status)); -@@ -3277,6 +3320,8 @@ static int cmd_link(void) - char *buf2 = NULL; - char *targetname = NULL; - struct cli_state *targetcli; -+ struct cli_credentials *creds = -+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); - NTSTATUS status; - - if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL) || -@@ -3307,7 +3352,8 @@ static int cmd_link(void) - return 1; - } - -- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), -+ status = cli_resolve_path(ctx, "", -+ creds, - cli, oldname, &targetcli, &targetname); - if (!NT_STATUS_IS_OK(status)) { - d_printf("link %s: %s\n", oldname, nt_errstr(status)); -@@ -3340,6 +3386,8 @@ static int cmd_readlink(void) - char *targetname = NULL; - char *linkname = NULL; - struct cli_state *targetcli; -+ struct cli_credentials *creds = -+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); - NTSTATUS status; - - if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL)) { -@@ -3358,7 +3406,8 @@ static int cmd_readlink(void) - return 1; - } - -- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), -+ status = cli_resolve_path(ctx, "", -+ creds, - cli, name, &targetcli, &targetname); - if (!NT_STATUS_IS_OK(status)) { - d_printf("readlink %s: %s\n", name, nt_errstr(status)); -@@ -3397,6 +3446,8 @@ static int cmd_symlink(void) - char *buf = NULL; - char *buf2 = NULL; - struct cli_state *newcli; -+ struct cli_credentials *creds = -+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); - NTSTATUS status; - - if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL) || -@@ -3419,7 +3470,8 @@ static int cmd_symlink(void) - } - /* New name must be present in share namespace. */ - status = cli_resolve_path(ctx, "", -- popt_get_cmdline_auth_info(), cli, newname, -+ creds, -+ cli, newname, - &newcli, &newname); - if (!NT_STATUS_IS_OK(status)) { - d_printf("link %s: %s\n", newname, -@@ -3455,6 +3507,8 @@ static int cmd_chmod(void) - char *targetname = NULL; - struct cli_state *targetcli; - mode_t mode; -+ struct cli_credentials *creds = -+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); - NTSTATUS status; - - if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL) || -@@ -3476,7 +3530,8 @@ static int cmd_chmod(void) - - mode = (mode_t)strtol(buf, NULL, 8); - -- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), -+ status = cli_resolve_path(ctx, "", -+ creds, - cli, src, &targetcli, &targetname); - if (!NT_STATUS_IS_OK(status)) { - d_printf("chmod %s: %s\n", src, nt_errstr(status)); -@@ -3620,6 +3675,8 @@ static int cmd_getfacl(void) - size_t num_dir_acls = 0; - size_t expected_buflen; - uint16_t i; -+ struct cli_credentials *creds = -+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); - NTSTATUS status; - - if (!next_token_talloc(ctx, &cmd_ptr,&name,NULL)) { -@@ -3638,7 +3695,8 @@ static int cmd_getfacl(void) - return 1; - } - -- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), -+ status = cli_resolve_path(ctx, "", -+ creds, - cli, src, &targetcli, &targetname); - if (!NT_STATUS_IS_OK(status)) { - d_printf("stat %s: %s\n", src, nt_errstr(status)); -@@ -3803,6 +3861,8 @@ static int cmd_geteas(void) - NTSTATUS status; - size_t i, num_eas; - struct ea_struct *eas; -+ struct cli_credentials *creds = -+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); - - if (!next_token_talloc(ctx, &cmd_ptr,&name,NULL)) { - d_printf("geteas filename\n"); -@@ -3820,7 +3880,8 @@ static int cmd_geteas(void) - return 1; - } - -- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), -+ status = cli_resolve_path(ctx, "", -+ creds, - cli, src, &targetcli, &targetname); - if (!NT_STATUS_IS_OK(status)) { - d_printf("stat %s: %s\n", src, nt_errstr(status)); -@@ -3859,6 +3920,8 @@ static int cmd_setea(void) - char *eavalue = NULL; - char *targetname = NULL; - struct cli_state *targetcli; -+ struct cli_credentials *creds = -+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); - NTSTATUS status; - - if (!next_token_talloc(ctx, &cmd_ptr, &name, NULL) -@@ -3881,7 +3944,8 @@ static int cmd_setea(void) - return 1; - } - -- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), -+ status = cli_resolve_path(ctx, "", -+ creds, - cli, src, &targetcli, &targetname); - if (!NT_STATUS_IS_OK(status)) { - d_printf("stat %s: %s\n", src, nt_errstr(status)); -@@ -3913,6 +3977,8 @@ static int cmd_stat(void) - SMB_STRUCT_STAT sbuf; - struct tm *lt; - time_t tmp_time; -+ struct cli_credentials *creds = -+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); - NTSTATUS status; - - if (!next_token_talloc(ctx, &cmd_ptr,&name,NULL)) { -@@ -3931,7 +3997,8 @@ static int cmd_stat(void) - return 1; - } - -- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), -+ status = cli_resolve_path(ctx, "", -+ creds, - cli, src, &targetcli, &targetname); - if (!NT_STATUS_IS_OK(status)) { - d_printf("stat %s: %s\n", src, nt_errstr(status)); -@@ -4020,6 +4087,8 @@ static int cmd_chown(void) - char *buf, *buf2, *buf3; - struct cli_state *targetcli; - char *targetname = NULL; -+ struct cli_credentials *creds = -+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); - NTSTATUS status; - - if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL) || -@@ -4043,7 +4112,8 @@ static int cmd_chown(void) - if (src == NULL) { - return 1; - } -- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), -+ status = cli_resolve_path(ctx, "", -+ creds, - cli, src, &targetcli, &targetname); - if (!NT_STATUS_IS_OK(status)) { - d_printf("chown %s: %s\n", src, nt_errstr(status)); -@@ -4077,6 +4147,8 @@ static int cmd_rename(void) - struct cli_state *targetcli; - char *targetsrc; - char *targetdest; -+ struct cli_credentials *creds = -+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); - NTSTATUS status; - bool replace = false; - -@@ -4115,14 +4187,16 @@ static int cmd_rename(void) - replace = true; - } - -- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), -+ status = cli_resolve_path(ctx, "", -+ creds, - cli, src, &targetcli, &targetsrc); - if (!NT_STATUS_IS_OK(status)) { - d_printf("rename %s: %s\n", src, nt_errstr(status)); - return 1; - } - -- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), -+ status = cli_resolve_path(ctx, "", -+ creds, - cli, dest, &targetcli, &targetdest); - if (!NT_STATUS_IS_OK(status)) { - d_printf("rename %s: %s\n", dest, nt_errstr(status)); -@@ -4179,6 +4253,8 @@ static int cmd_scopy(void) - off_t written = 0; - struct scopy_timing st; - int rc = 0; -+ struct cli_credentials *creds = -+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); - NTSTATUS status; - - if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL) || -@@ -4211,14 +4287,16 @@ static int cmd_scopy(void) - return 1; - } - -- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), -+ status = cli_resolve_path(ctx, "", -+ creds, - cli, src, &targetcli, &targetsrc); - if (!NT_STATUS_IS_OK(status)) { - d_printf("scopy %s: %s\n", src, nt_errstr(status)); - return 1; - } - -- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), -+ status = cli_resolve_path(ctx, "", -+ creds, - cli, dest, &targetcli, &targetdest); - if (!NT_STATUS_IS_OK(status)) { - d_printf("scopy %s: %s\n", dest, nt_errstr(status)); -@@ -4317,6 +4395,8 @@ static int cmd_hardlink(void) - char *buf, *buf2; - struct cli_state *targetcli; - char *targetname; -+ struct cli_credentials *creds = -+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); - NTSTATUS status; - - if (!next_token_talloc(ctx, &cmd_ptr,&buf,NULL) || -@@ -4349,7 +4429,8 @@ static int cmd_hardlink(void) - return 1; - } - -- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), -+ status = cli_resolve_path(ctx, "", -+ creds, - cli, src, &targetcli, &targetname); - if (!NT_STATUS_IS_OK(status)) { - d_printf("hardlink %s: %s\n", src, nt_errstr(status)); -@@ -5023,9 +5104,13 @@ static int cmd_show_connect( void ) - TALLOC_CTX *ctx = talloc_tos(); - struct cli_state *targetcli; - char *targetpath; -+ struct cli_credentials *creds = -+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); - NTSTATUS status; - -- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), cli, -+ status = cli_resolve_path(ctx, "", -+ creds, -+ cli, - client_get_cur_dir(), &targetcli, - &targetpath); - if (!NT_STATUS_IS_OK(status)) { -@@ -5685,6 +5770,8 @@ static char **remote_completion(const char *text, int len) - struct cli_state *targetcli = NULL; - int i; - struct completion_remote info = { NULL, NULL, 1, 0, NULL, 0 }; -+ struct cli_credentials *creds = -+ get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()); - NTSTATUS status; - - /* can't have non-static initialisation on Sun CC, so do it -@@ -5745,7 +5832,8 @@ static char **remote_completion(const char *text, int len) - goto cleanup; - } - -- status = cli_resolve_path(ctx, "", popt_get_cmdline_auth_info(), -+ status = cli_resolve_path(ctx, "", -+ creds, - cli, dirmask, &targetcli, &targetpath); - if (!NT_STATUS_IS_OK(status)) { - goto cleanup; -diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c -index ef75fb36a45..e6695159a96 100644 ---- a/source3/libsmb/clidfs.c -+++ b/source3/libsmb/clidfs.c -@@ -859,7 +859,7 @@ struct cli_dfs_path_split { - - NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, - const char *mountpt, -- const struct user_auth_info *dfs_auth_info, -+ struct cli_credentials *creds, - struct cli_state *rootcli, - const char *path, - struct cli_state **targetcli, -@@ -885,7 +885,6 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, - struct smbXcli_tcon *root_tcon = NULL; - struct smbXcli_tcon *target_tcon = NULL; - struct cli_dfs_path_split *dfs_refs = NULL; -- struct cli_credentials *creds = get_cmdline_auth_info_creds(dfs_auth_info); - - if ( !rootcli || !path || !targetcli ) { - return NT_STATUS_INVALID_PARAMETER; -@@ -1130,7 +1129,7 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, - if (!strequal(*pp_targetpath, "\\") && !strequal(*pp_targetpath, "/")) { - status = cli_resolve_path(ctx, - newmount, -- dfs_auth_info, -+ creds, - *targetcli, - *pp_targetpath, - &newcli, -diff --git a/source3/libsmb/libsmb_dir.c b/source3/libsmb/libsmb_dir.c -index 12abb734c2d..0326f27125b 100644 ---- a/source3/libsmb/libsmb_dir.c -+++ b/source3/libsmb/libsmb_dir.c -@@ -911,6 +911,7 @@ SMBC_opendir_ctx(SMBCCTX *context, - */ - char *targetpath; - struct cli_state *targetcli; -+ struct cli_credentials *creds = NULL; - NTSTATUS status; - - /* We connect to the server and list the directory */ -@@ -943,8 +944,12 @@ SMBC_opendir_ctx(SMBCCTX *context, - return NULL; - } - -+ creds = get_cmdline_auth_info_creds( -+ context->internal->auth_info); -+ - status = cli_resolve_path( -- frame, "", context->internal->auth_info, -+ frame, "", -+ creds, - srv->cli, path, &targetcli, &targetpath); - if (!NT_STATUS_IS_OK(status)) { - d_printf("Could not resolve %s\n", path); -@@ -1543,6 +1548,7 @@ SMBC_mkdir_ctx(SMBCCTX *context, - char *targetpath = NULL; - uint16_t port = 0; - struct cli_state *targetcli = NULL; -+ struct cli_credentials *creds = NULL; - TALLOC_CTX *frame = talloc_stackframe(); - NTSTATUS status; - -@@ -1595,8 +1601,11 @@ SMBC_mkdir_ctx(SMBCCTX *context, - - } - -+ creds = get_cmdline_auth_info_creds(context->internal->auth_info); -+ - /*d_printf(">>>mkdir: resolving %s\n", path);*/ -- status = cli_resolve_path(frame, "", context->internal->auth_info, -+ status = cli_resolve_path(frame, "", -+ creds, - srv->cli, path, &targetcli, &targetpath); - if (!NT_STATUS_IS_OK(status)) { - d_printf("Could not resolve %s\n", path); -@@ -1654,6 +1663,7 @@ SMBC_rmdir_ctx(SMBCCTX *context, - char *targetpath = NULL; - uint16_t port = 0; - struct cli_state *targetcli = NULL; -+ struct cli_credentials *creds = NULL; - TALLOC_CTX *frame = talloc_stackframe(); - NTSTATUS status; - -@@ -1706,8 +1716,11 @@ SMBC_rmdir_ctx(SMBCCTX *context, - - } - -+ creds = get_cmdline_auth_info_creds(context->internal->auth_info), -+ - /*d_printf(">>>rmdir: resolving %s\n", path);*/ -- status = cli_resolve_path(frame, "", context->internal->auth_info, -+ status = cli_resolve_path(frame, "", -+ creds, - srv->cli, path, &targetcli, &targetpath); - if (!NT_STATUS_IS_OK(status)) { - d_printf("Could not resolve %s\n", path); -@@ -1959,6 +1972,7 @@ SMBC_chmod_ctx(SMBCCTX *context, - char *path = NULL; - uint32_t attr; - uint16_t port = 0; -+ struct cli_credentials *creds = NULL; - TALLOC_CTX *frame = talloc_stackframe(); - NTSTATUS status; - -@@ -2010,8 +2024,11 @@ SMBC_chmod_ctx(SMBCCTX *context, - return -1; /* errno set by SMBC_server */ - } - -+ creds = get_cmdline_auth_info_creds(context->internal->auth_info); -+ - /*d_printf(">>>unlink: resolving %s\n", path);*/ -- status = cli_resolve_path(frame, "", context->internal->auth_info, -+ status = cli_resolve_path(frame, "", -+ creds, - srv->cli, path, &targetcli, &targetpath); - if (!NT_STATUS_IS_OK(status)) { - d_printf("Could not resolve %s\n", path); -@@ -2152,6 +2169,7 @@ SMBC_unlink_ctx(SMBCCTX *context, - uint16_t port = 0; - struct cli_state *targetcli = NULL; - SMBCSRV *srv = NULL; -+ struct cli_credentials *creds = NULL; - TALLOC_CTX *frame = talloc_stackframe(); - NTSTATUS status; - -@@ -2204,8 +2222,11 @@ SMBC_unlink_ctx(SMBCCTX *context, - - } - -+ creds = get_cmdline_auth_info_creds(context->internal->auth_info); -+ - /*d_printf(">>>unlink: resolving %s\n", path);*/ -- status = cli_resolve_path(frame, "", context->internal->auth_info, -+ status = cli_resolve_path(frame, "", -+ creds, - srv->cli, path, &targetcli, &targetpath); - if (!NT_STATUS_IS_OK(status)) { - d_printf("Could not resolve %s\n", path); -@@ -2282,6 +2303,8 @@ SMBC_rename_ctx(SMBCCTX *ocontext, - SMBCSRV *srv = NULL; - uint16_t port1 = 0; - uint16_t port2 = 0; -+ struct cli_credentials *ocreds = NULL; -+ struct cli_credentials *ncreds = NULL; - TALLOC_CTX *frame = talloc_stackframe(); - NTSTATUS status; - -@@ -2375,7 +2398,10 @@ SMBC_rename_ctx(SMBCCTX *ocontext, - password1); - - /*d_printf(">>>rename: resolving %s\n", path1);*/ -- status = cli_resolve_path(frame, "", ocontext->internal->auth_info, -+ ocreds = get_cmdline_auth_info_creds(ocontext->internal->auth_info); -+ -+ status = cli_resolve_path(frame, "", -+ ocreds, - srv->cli, path1, &targetcli1, &targetpath1); - if (!NT_STATUS_IS_OK(status)) { - d_printf("Could not resolve %s\n", path1); -@@ -2392,7 +2418,10 @@ SMBC_rename_ctx(SMBCCTX *ocontext, - - /*d_printf(">>>rename: resolved path as %s\n", targetpath1);*/ - /*d_printf(">>>rename: resolving %s\n", path2);*/ -- status = cli_resolve_path(frame, "", ncontext->internal->auth_info, -+ ncreds = get_cmdline_auth_info_creds(ncontext->internal->auth_info); -+ -+ status = cli_resolve_path(frame, "", -+ ncreds, - srv->cli, path2, &targetcli2, &targetpath2); - if (!NT_STATUS_IS_OK(status)) { - d_printf("Could not resolve %s\n", path2); -diff --git a/source3/libsmb/libsmb_file.c b/source3/libsmb/libsmb_file.c -index 0791df36690..a44925e0e0e 100644 ---- a/source3/libsmb/libsmb_file.c -+++ b/source3/libsmb/libsmb_file.c -@@ -103,6 +103,8 @@ SMBC_open_ctx(SMBCCTX *context, - if (strlen(path) > 0 && path[strlen(path) - 1] == '\\') { - status = NT_STATUS_OBJECT_PATH_INVALID; - } else { -+ struct cli_credentials *creds = NULL; -+ - file = SMB_MALLOC_P(SMBCFILE); - if (!file) { - errno = ENOMEM; -@@ -112,9 +114,12 @@ SMBC_open_ctx(SMBCCTX *context, - - ZERO_STRUCTP(file); - -+ creds = get_cmdline_auth_info_creds( -+ context->internal->auth_info); - /*d_printf(">>>open: resolving %s\n", path);*/ - status = cli_resolve_path( -- frame, "", context->internal->auth_info, -+ frame, "", -+ creds, - srv->cli, path, &targetcli, &targetpath); - if (!NT_STATUS_IS_OK(status)) { - d_printf("Could not resolve %s\n", path); -@@ -461,6 +466,7 @@ SMBC_getatr(SMBCCTX * context, - struct timespec change_time_ts = {0}; - time_t write_time = 0; - SMB_INO_T ino = 0; -+ struct cli_credentials *creds = NULL; - TALLOC_CTX *frame = talloc_stackframe(); - NTSTATUS status; - -@@ -490,7 +496,10 @@ SMBC_getatr(SMBCCTX * context, - } - DEBUG(4,("SMBC_getatr: sending qpathinfo\n")); - -- status = cli_resolve_path(frame, "", context->internal->auth_info, -+ creds = get_cmdline_auth_info_creds(context->internal->auth_info); -+ -+ status = cli_resolve_path(frame, "", -+ creds, - srv->cli, fixedpath, - &targetcli, &targetpath); - if (!NT_STATUS_IS_OK(status)) { -diff --git a/source3/libsmb/libsmb_stat.c b/source3/libsmb/libsmb_stat.c -index 790934bd565..1260928d0ff 100644 ---- a/source3/libsmb/libsmb_stat.c -+++ b/source3/libsmb/libsmb_stat.c -@@ -242,6 +242,7 @@ SMBC_fstat_ctx(SMBCCTX *context, - struct cli_state *targetcli = NULL; - SMB_INO_T ino = 0; - uint16_t port = 0; -+ struct cli_credentials *creds = NULL; - TALLOC_CTX *frame = talloc_stackframe(); - NTSTATUS status; - -@@ -279,8 +280,11 @@ SMBC_fstat_ctx(SMBCCTX *context, - return -1; - } - -+ creds = get_cmdline_auth_info_creds(context->internal->auth_info); -+ - /*d_printf(">>>fstat: resolving %s\n", path);*/ -- status = cli_resolve_path(frame, "", context->internal->auth_info, -+ status = cli_resolve_path(frame, "", -+ creds, - file->srv->cli, path, - &targetcli, &targetpath); - if (!NT_STATUS_IS_OK(status)) { -diff --git a/source3/libsmb/libsmb_xattr.c b/source3/libsmb/libsmb_xattr.c -index d1b6548eb90..8b74d0a39e3 100644 ---- a/source3/libsmb/libsmb_xattr.c -+++ b/source3/libsmb/libsmb_xattr.c -@@ -860,13 +860,18 @@ cacl_get(SMBCCTX *context, - if (ipc_cli && (all || some_nt || all_nt_acls)) { - char *targetpath = NULL; - struct cli_state *targetcli = NULL; -+ struct cli_credentials *creds = NULL; - NTSTATUS status; - - /* Point to the portion after "system.nt_sec_desc." */ - name += 19; /* if (all) this will be invalid but unused */ - -+ creds = get_cmdline_auth_info_creds( -+ context->internal->auth_info); -+ - status = cli_resolve_path( -- ctx, "", context->internal->auth_info, -+ ctx, "", -+ creds, - cli, filename, &targetcli, &targetpath); - if (!NT_STATUS_IS_OK(status)) { - DEBUG(5, ("cacl_get Could not resolve %s\n", -@@ -1511,6 +1516,7 @@ cacl_set(SMBCCTX *context, - bool numeric = True; - char *targetpath = NULL; - struct cli_state *targetcli = NULL; -+ struct cli_credentials *creds = NULL; - NTSTATUS status; - - /* the_acl will be null for REMOVE_ALL operations */ -@@ -1540,7 +1546,10 @@ cacl_set(SMBCCTX *context, - return -1; - } - -- status = cli_resolve_path(ctx, "", context->internal->auth_info, -+ creds = get_cmdline_auth_info_creds(context->internal->auth_info); -+ -+ status = cli_resolve_path(ctx, "", -+ creds, - cli, filename, &targetcli, &targetpath); - if (!NT_STATUS_IS_OK(status)) { - DEBUG(5,("cacl_set: Could not resolve %s\n", filename)); -diff --git a/source3/libsmb/proto.h b/source3/libsmb/proto.h -index 0b8cf2a6036..517738dbcd7 100644 ---- a/source3/libsmb/proto.h -+++ b/source3/libsmb/proto.h -@@ -150,7 +150,7 @@ NTSTATUS cli_dfs_get_referral(TALLOC_CTX *ctx, - size_t *consumed); - NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, - const char *mountpt, -- const struct user_auth_info *dfs_auth_info, -+ struct cli_credentials *creds, - struct cli_state *rootcli, - const char *path, - struct cli_state **targetcli, -diff --git a/source3/utils/smbcacls.c b/source3/utils/smbcacls.c -index 8fd9fcc5780..4989ec633c3 100644 ---- a/source3/utils/smbcacls.c -+++ b/source3/utils/smbcacls.c -@@ -806,6 +806,7 @@ int main(int argc, char *argv[]) - than going via LSA calls to resolve them */ - int numeric = 0; - struct cli_state *targetcli = NULL; -+ struct cli_credentials *creds = NULL; - char *targetfile = NULL; - NTSTATUS status; - -@@ -1069,9 +1070,11 @@ int main(int argc, char *argv[]) - } - } - -+ creds = get_cmdline_auth_info_creds(popt_get_cmdline_auth_info()), -+ - status = cli_resolve_path(frame, - "", -- popt_get_cmdline_auth_info(), -+ creds, - cli, - filename, - &targetcli, --- -2.29.2 - - -From aa21292bdc66f8f26244da5f1422bc41afafa6f7 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Thu, 27 Aug 2020 16:40:49 +0200 -Subject: [PATCH 070/104] s3:client: Remove global max_protocol - -Signed-off-by: Andreas Schneider -Reviewed-by: Jeremy Allison -(cherry picked from commit d07f28645f37c1f976017d5b89864791a18d1943) ---- - source3/client/client.c | 13 +++++-------- - 1 file changed, 5 insertions(+), 8 deletions(-) - -diff --git a/source3/client/client.c b/source3/client/client.c -index 13e48f80a01..902cdec8b64 100644 ---- a/source3/client/client.c -+++ b/source3/client/client.c -@@ -61,7 +61,6 @@ static int io_bufsize = 0; /* we use the default size */ - static int io_timeout = (CLIENT_TIMEOUT/1000); /* Per operation timeout (in seconds). */ - - static int name_type = 0x20; --static int max_protocol = -1; - - static int process_tok(char *tok); - static int cmd_help(void); -@@ -5646,7 +5645,7 @@ static int process_command_string(const char *cmd_in) - desthost, - service, - creds, -- max_protocol, -+ lp_client_max_protocol(), - have_ip ? &dest_ss : NULL, port, - name_type, - &cli); -@@ -6096,7 +6095,7 @@ static int process(const char *base_directory) - desthost, - service, - creds, -- max_protocol, -+ lp_client_max_protocol(), - have_ip ? &dest_ss : NULL, port, - name_type, &cli); - if (!NT_STATUS_IS_OK(status)) { -@@ -6137,7 +6136,7 @@ static int do_host_query(const char *query_host) - query_host, - "IPC$", - creds, -- max_protocol, -+ lp_client_max_protocol(), - have_ip ? &dest_ss : NULL, port, - name_type, &cli); - if (!NT_STATUS_IS_OK(status)) { -@@ -6172,7 +6171,7 @@ static int do_host_query(const char *query_host) - if (port != NBT_SMB_PORT || - smbXcli_conn_protocol(cli->conn) > PROTOCOL_NT1) - { -- int max_proto = MIN(max_protocol, PROTOCOL_NT1); -+ int max_proto = MIN(lp_client_max_protocol(), PROTOCOL_NT1); - - /* - * Workgroups simply don't make sense over anything -@@ -6222,7 +6221,7 @@ static int do_tar_op(const char *base_directory) - desthost, - service, - creds, -- max_protocol, -+ lp_client_max_protocol(), - have_ip ? &dest_ss : NULL, port, - name_type, &cli); - if (!NT_STATUS_IS_OK(status)) { -@@ -6629,8 +6628,6 @@ int main(int argc,char *argv[]) - /* Ensure we have a password (or equivalent). */ - popt_common_credentials_post(); - -- max_protocol = lp_client_max_protocol(); -- - if (tar_to_process(tar_ctx)) { - if (cmdstr) - process_command_string(cmdstr); --- -2.29.2 - - -From 517baf60c6597388cfd1a17bf998272586d3bfc9 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Thu, 27 Aug 2020 16:43:46 +0200 -Subject: [PATCH 071/104] s3:libsmb: Remove max_protocol from cli_cm_open() - -Signed-off-by: Andreas Schneider -Reviewed-by: Jeremy Allison -(cherry picked from commit 4aac9daf095e7c2de6a27697a13385ee87a4b634) ---- - source3/client/client.c | 7 ------- - source3/lib/netapi/cm.c | 1 - - source3/libsmb/clidfs.c | 4 +--- - source3/libsmb/proto.h | 1 - - 4 files changed, 1 insertion(+), 12 deletions(-) - -diff --git a/source3/client/client.c b/source3/client/client.c -index 902cdec8b64..82764c5ca16 100644 ---- a/source3/client/client.c -+++ b/source3/client/client.c -@@ -5645,7 +5645,6 @@ static int process_command_string(const char *cmd_in) - desthost, - service, - creds, -- lp_client_max_protocol(), - have_ip ? &dest_ss : NULL, port, - name_type, - &cli); -@@ -6095,7 +6094,6 @@ static int process(const char *base_directory) - desthost, - service, - creds, -- lp_client_max_protocol(), - have_ip ? &dest_ss : NULL, port, - name_type, &cli); - if (!NT_STATUS_IS_OK(status)) { -@@ -6136,7 +6134,6 @@ static int do_host_query(const char *query_host) - query_host, - "IPC$", - creds, -- lp_client_max_protocol(), - have_ip ? &dest_ss : NULL, port, - name_type, &cli); - if (!NT_STATUS_IS_OK(status)) { -@@ -6171,8 +6168,6 @@ static int do_host_query(const char *query_host) - if (port != NBT_SMB_PORT || - smbXcli_conn_protocol(cli->conn) > PROTOCOL_NT1) - { -- int max_proto = MIN(lp_client_max_protocol(), PROTOCOL_NT1); -- - /* - * Workgroups simply don't make sense over anything - * else but port 139 and SMB1. -@@ -6184,7 +6179,6 @@ static int do_host_query(const char *query_host) - query_host, - "IPC$", - creds, -- max_proto, - have_ip ? &dest_ss : NULL, NBT_SMB_PORT, - name_type, &cli); - if (!NT_STATUS_IS_OK(status)) { -@@ -6221,7 +6215,6 @@ static int do_tar_op(const char *base_directory) - desthost, - service, - creds, -- lp_client_max_protocol(), - have_ip ? &dest_ss : NULL, port, - name_type, &cli); - if (!NT_STATUS_IS_OK(status)) { -diff --git a/source3/lib/netapi/cm.c b/source3/lib/netapi/cm.c -index 943f7498e8c..3f4e188b396 100644 ---- a/source3/lib/netapi/cm.c -+++ b/source3/lib/netapi/cm.c -@@ -112,7 +112,6 @@ static WERROR libnetapi_open_ipc_connection(struct libnetapi_ctx *ctx, - status = cli_cm_open(ctx, NULL, - server_name, "IPC$", - creds, -- lp_client_ipc_max_protocol(), - NULL, 0, 0x20, &cli_ipc); - if (!NT_STATUS_IS_OK(status)) { - cli_ipc = NULL; -diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c -index e6695159a96..fb1a0c72e6d 100644 ---- a/source3/libsmb/clidfs.c -+++ b/source3/libsmb/clidfs.c -@@ -388,7 +388,6 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, - const char *server, - const char *share, - struct cli_credentials *creds, -- int max_protocol, - const struct sockaddr_storage *dest_ss, - int port, - int name_type, -@@ -417,7 +416,7 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, - server, - share, - creds, -- max_protocol, -+ lp_client_max_protocol(), - dest_ss, - port, - name_type, -@@ -965,7 +964,6 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, - smbXcli_conn_remote_name(rootcli->conn), - "IPC$", - creds, -- smbXcli_conn_protocol(rootcli->conn), - NULL, /* dest_ss not needed, we reuse the transport */ - 0, - 0x20, -diff --git a/source3/libsmb/proto.h b/source3/libsmb/proto.h -index 517738dbcd7..8aaaff2cb1e 100644 ---- a/source3/libsmb/proto.h -+++ b/source3/libsmb/proto.h -@@ -128,7 +128,6 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, - const char *server, - const char *share, - struct cli_credentials *creds, -- int max_protocol, - const struct sockaddr_storage *dest_ss, - int port, - int name_type, --- -2.29.2 - - -From b35001a76bc0ff7fc10bd319abfda481b8a81c9b Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Thu, 27 Aug 2020 16:45:12 +0200 -Subject: [PATCH 072/104] s3:libcmb: Remove max_protocol from cli_cm_connect() - -Signed-off-by: Andreas Schneider -Reviewed-by: Jeremy Allison -(cherry picked from commit 2159582610ecc932047b85a77ec321b3d3ac806f) ---- - source3/libsmb/clidfs.c | 5 +---- - 1 file changed, 1 insertion(+), 4 deletions(-) - -diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c -index fb1a0c72e6d..023dd4d2757 100644 ---- a/source3/libsmb/clidfs.c -+++ b/source3/libsmb/clidfs.c -@@ -293,7 +293,6 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, - const char *server, - const char *share, - struct cli_credentials *creds, -- int max_protocol, - const struct sockaddr_storage *dest_ss, - int port, - int name_type, -@@ -304,7 +303,7 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, - - status = do_connect(ctx, server, share, - creds, -- max_protocol, -+ lp_client_max_protocol(), - dest_ss, port, name_type, &cli); - - if (!NT_STATUS_IS_OK(status)) { -@@ -416,7 +415,6 @@ NTSTATUS cli_cm_open(TALLOC_CTX *ctx, - server, - share, - creds, -- lp_client_max_protocol(), - dest_ss, - port, - name_type, -@@ -1020,7 +1018,6 @@ NTSTATUS cli_resolve_path(TALLOC_CTX *ctx, - dfs_refs[count].server, - dfs_refs[count].share, - creds, -- smbXcli_conn_protocol(rootcli->conn), - NULL, /* dest_ss */ - 0, /* port */ - 0x20, --- -2.29.2 - - -From 4e405a5acc748c07f74a27ed57deeffc4e2c20d7 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Thu, 27 Aug 2020 16:46:29 +0200 -Subject: [PATCH 073/104] s3:libsmb: Remove max_protocol from clidfs - do_connect() - -The if check for max_protocol == 0 is part of lp_client_max_protocol(). - -Signed-off-by: Andreas Schneider -Reviewed-by: Jeremy Allison -(cherry picked from commit 50b59b4c28bc816094a4ca97f64450860e2495b2) ---- - source3/libsmb/clidfs.c | 8 +------- - 1 file changed, 1 insertion(+), 7 deletions(-) - -diff --git a/source3/libsmb/clidfs.c b/source3/libsmb/clidfs.c -index 023dd4d2757..ee5becf76a6 100644 ---- a/source3/libsmb/clidfs.c -+++ b/source3/libsmb/clidfs.c -@@ -107,7 +107,6 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, - const char *server, - const char *share, - struct cli_credentials *creds, -- int max_protocol, - const struct sockaddr_storage *dest_ss, - int port, - int name_type, -@@ -167,14 +166,11 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, - return status; - } - -- if (max_protocol == 0) { -- max_protocol = PROTOCOL_LATEST; -- } - DEBUG(4,(" session request ok\n")); - - status = smbXcli_negprot(c->conn, c->timeout, - lp_client_min_protocol(), -- max_protocol); -+ lp_client_max_protocol()); - - if (!NT_STATUS_IS_OK(status)) { - d_printf("protocol negotiation failed: %s\n", -@@ -233,7 +229,6 @@ static NTSTATUS do_connect(TALLOC_CTX *ctx, - cli_shutdown(c); - return do_connect(ctx, newserver, - newshare, creds, -- max_protocol, - NULL, port, name_type, pcli); - } - -@@ -303,7 +298,6 @@ static NTSTATUS cli_cm_connect(TALLOC_CTX *ctx, - - status = do_connect(ctx, server, share, - creds, -- lp_client_max_protocol(), - dest_ss, port, name_type, &cli); - - if (!NT_STATUS_IS_OK(status)) { --- -2.29.2 - - -From c710bcf3600beb7f9a08c56108c0c93f32a9139b Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Mon, 10 Aug 2020 15:47:35 +0200 -Subject: [PATCH 074/104] s3:include: Move loadparm prototypes to own header - file - -Signed-off-by: Andreas Schneider -Reviewed-by: Jeremy Allison -(cherry picked from commit d4d8218b9618dd289f54b41f13d7015f1b3994fd) ---- - source3/include/includes.h | 3 + - source3/include/proto.h | 167 ------------------------------- - source3/param/loadparm.h | 200 +++++++++++++++++++++++++++++++++++++ - 3 files changed, 203 insertions(+), 167 deletions(-) - create mode 100644 source3/param/loadparm.h - -diff --git a/source3/include/includes.h b/source3/include/includes.h -index 8fa65cc3122..c94f919ed59 100644 ---- a/source3/include/includes.h -+++ b/source3/include/includes.h -@@ -293,6 +293,9 @@ typedef char fstring[FSTRING_LEN]; - #endif - - #include "lib/param/loadparm.h" -+#include "source3/param/loadparm.h" -+/* Automatically generated by generate_param.py. */ -+#include "source3/param/param_proto.h" - - /* String routines */ - -diff --git a/source3/include/proto.h b/source3/include/proto.h -index 12aa392abae..b9a6cb7f116 100644 ---- a/source3/include/proto.h -+++ b/source3/include/proto.h -@@ -739,173 +739,6 @@ NTSTATUS trust_pw_change(struct netlogon_creds_cli_context *context, - const char *dcname, - bool force); - --/* The following definitions come from param/loadparm.c */ -- --const struct loadparm_substitution *loadparm_s3_global_substitution(void); -- --char *lp_parm_substituted_string(TALLOC_CTX *mem_ctx, -- const struct loadparm_substitution *lp_sub, -- int snum, -- const char *type, -- const char *option, -- const char *def); -- --#include "source3/param/param_proto.h" -- --char *lp_servicename(TALLOC_CTX *ctx, const struct loadparm_substitution *, int); --const char *lp_const_servicename(int); --bool lp_autoloaded(int); --const char *lp_dnsdomain(void); --int lp_winbind_max_domain_connections(void); --bool lp_idmap_range(const char *domain_name, uint32_t *low, uint32_t *high); --bool lp_idmap_default_range(uint32_t *low, uint32_t *high); --const char *lp_idmap_backend(const char *domain_name); --const char *lp_idmap_default_backend (void); --int lp_security(void); --int lp_client_max_protocol(void); --int lp_client_ipc_min_protocol(void); --int lp_client_ipc_max_protocol(void); --int lp_client_ipc_signing(void); --int lp_smb2_max_credits(void); --int lp_cups_encrypt(void); --bool lp_widelinks(int ); --int lp_rpc_low_port(void); --int lp_rpc_high_port(void); --bool lp_lanman_auth(void); --enum samba_weak_crypto lp_weak_crypto(void); -- --int lp_wi_scan_global_parametrics( -- const char *regex, size_t max_matches, -- bool (*cb)(const char *string, regmatch_t matches[], -- void *private_data), -- void *private_data); -- --const char *lp_parm_const_string(int snum, const char *type, const char *option, const char *def); --struct loadparm_service; --const char *lp_parm_const_string_service(struct loadparm_service *service, const char *type, -- const char *option, const char *def); --const char **lp_parm_string_list(int snum, const char *type, const char *option, const char **def); --int lp_parm_int(int snum, const char *type, const char *option, int def); --unsigned long lp_parm_ulong(int snum, const char *type, const char *option, unsigned long def); --unsigned long long lp_parm_ulonglong(int snum, const char *type, -- const char *option, -- unsigned long long def); --bool lp_parm_bool(int snum, const char *type, const char *option, bool def); --struct enum_list; --int lp_parm_enum(int snum, const char *type, const char *option, -- const struct enum_list *_enum, int def); --char *canonicalize_servicename(TALLOC_CTX *ctx, const char *src); --bool lp_add_home(const char *pszHomename, int iDefaultService, -- const char *user, const char *pszHomedir); --int lp_add_service(const char *pszService, int iDefaultService); --bool lp_add_printer(const char *pszPrintername, int iDefaultService); --bool lp_parameter_is_valid(const char *pszParmName); --bool lp_parameter_is_global(const char *pszParmName); --bool lp_canonicalize_parameter(const char *parm_name, const char **canon_parm, -- bool *inverse); --bool lp_canonicalize_parameter_with_value(const char *parm_name, -- const char *val, -- const char **canon_parm, -- const char **canon_val); --void show_parameter_list(void); --bool lp_invert_boolean(const char *str, const char **inverse_str); --bool lp_canonicalize_boolean(const char *str, const char**canon_str); --bool process_registry_service(const char *service_name); --bool process_registry_shares(void); --bool lp_config_backend_is_registry(void); --bool lp_config_backend_is_file(void); --bool lp_file_list_changed(void); --const char *lp_ldap_machine_suffix(TALLOC_CTX *ctx); --const char *lp_ldap_user_suffix(TALLOC_CTX *ctx); --const char *lp_ldap_group_suffix(TALLOC_CTX *ctx); --const char *lp_ldap_idmap_suffix(TALLOC_CTX *ctx); --struct parm_struct; --/* Return a pointer to a service by name. */ --struct loadparm_service *lp_service(const char *pszServiceName); --struct loadparm_service *lp_servicebynum(int snum); --struct loadparm_service *lp_default_loadparm_service(void); --void *lp_parm_ptr(struct loadparm_service *service, struct parm_struct *parm); --void *lp_local_ptr_by_snum(int snum, struct parm_struct *parm); --bool lp_do_parameter(int snum, const char *pszParmName, const char *pszParmValue); --bool lp_set_cmdline(const char *pszParmName, const char *pszParmValue); --bool dump_a_parameter(int snum, char *parm_name, FILE * f, bool isGlobal); --bool lp_snum_ok(int iService); --void lp_add_one_printer(const char *name, const char *comment, -- const char *location, void *pdata); --bool lp_loaded(void); --void lp_killunused(struct smbd_server_connection *sconn, -- bool (*snumused) (struct smbd_server_connection *, int)); --void lp_kill_all_services(void); --void lp_killservice(int iServiceIn); --const char* server_role_str(uint32_t role); --enum usershare_err parse_usershare_file(TALLOC_CTX *ctx, -- SMB_STRUCT_STAT *psbuf, -- const char *servicename, -- int snum, -- char **lines, -- int numlines, -- char **pp_sharepath, -- char **pp_comment, -- char **pp_cp_share_name, -- struct security_descriptor **ppsd, -- bool *pallow_guest); --int load_usershare_service(const char *servicename); --int load_usershare_shares(struct smbd_server_connection *sconn, -- bool (*snumused) (struct smbd_server_connection *, int)); --void gfree_loadparm(void); --bool lp_load_initial_only(const char *pszFname); --bool lp_load_global(const char *file_name); --bool lp_load_with_shares(const char *file_name); --bool lp_load_client(const char *file_name); --bool lp_load_global_no_reinit(const char *file_name); --bool lp_load_no_reinit(const char *file_name); --bool lp_load_client_no_reinit(const char *file_name); --bool lp_load_with_registry_shares(const char *pszFname); --int lp_numservices(void); --void lp_dump(FILE *f, bool show_defaults, int maxtoprint); --void lp_dump_one(FILE * f, bool show_defaults, int snum); --int lp_servicenumber(const char *pszServiceName); --const char *volume_label(TALLOC_CTX *ctx, int snum); --bool lp_domain_master(void); --bool lp_preferred_master(void); --void lp_remove_service(int snum); --void lp_copy_service(int snum, const char *new_name); --int lp_default_server_announce(void); --const char *lp_printername(TALLOC_CTX *ctx, -- const struct loadparm_substitution *lp_sub, -- int snum); --void lp_set_logfile(const char *name); --int lp_maxprintjobs(int snum); --const char *lp_printcapname(void); --bool lp_disable_spoolss( void ); --void lp_set_spoolss_state( uint32_t state ); --uint32_t lp_get_spoolss_state( void ); --struct smb_signing_state; --void set_use_sendfile(int snum, bool val); --void lp_set_mangling_method(const char *new_method); --bool lp_posix_pathnames(void); --void lp_set_posix_pathnames(void); --enum brl_flavour lp_posix_cifsu_locktype(files_struct *fsp); --void lp_set_posix_default_cifsx_readwrite_locktype(enum brl_flavour val); --int lp_min_receive_file_size(void); --void widelinks_warning(int snum); --const char *lp_ncalrpc_dir(void); --void _lp_set_server_role(int server_role); -- --/* The following definitions come from param/loadparm_ctx.c */ -- --const struct loadparm_s3_helpers *loadparm_s3_helpers(void); -- --/* The following definitions come from param/loadparm_server_role.c */ -- --int lp_server_role(void); --void set_server_role(void); -- --/* The following definitions come from param/util.c */ -- --uint32_t get_int_param( const char* param ); --char* get_string_param( const char* param ); -- - /* The following definitions come from lib/server_contexts.c */ - struct tevent_context *global_event_context(void); - void global_event_context_free(void); -diff --git a/source3/param/loadparm.h b/source3/param/loadparm.h -new file mode 100644 -index 00000000000..7686877ccf1 ---- /dev/null -+++ b/source3/param/loadparm.h -@@ -0,0 +1,200 @@ -+/* -+ * -+ * Unix SMB/CIFS implementation. -+ * -+ * Type definitions for loadparm -+ * -+ * Copyright (c) 2020 Andreas Schneider -+ * This program is free software: you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License as published by -+ * the Free Software Foundation, either version 3 of the License, or -+ * (at your option) any later version. -+ * -+ * This program is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ * GNU General Public License for more details. -+ * -+ * You should have received a copy of the GNU General Public License -+ * along with this program. If not, see . -+ */ -+ -+#ifndef _S3_LOADPARM_H -+#define _S3_LOADPARM_H -+ -+#include -+#include -+ -+/* Forward declarations */ -+typedef struct stat_ex SMB_STRUCT_STAT; -+typedef struct files_struct files_struct; -+struct smbd_server_connection; -+struct security_descriptor; -+ -+/* The following definitions come from param/loadparm.c */ -+ -+const struct loadparm_substitution *loadparm_s3_global_substitution(void); -+ -+char *lp_parm_substituted_string(TALLOC_CTX *mem_ctx, -+ const struct loadparm_substitution *lp_sub, -+ int snum, -+ const char *type, -+ const char *option, -+ const char *def); -+ -+char *lp_servicename(TALLOC_CTX *ctx, const struct loadparm_substitution *, int); -+const char *lp_const_servicename(int); -+bool lp_autoloaded(int); -+const char *lp_dnsdomain(void); -+int lp_winbind_max_domain_connections(void); -+bool lp_idmap_range(const char *domain_name, uint32_t *low, uint32_t *high); -+bool lp_idmap_default_range(uint32_t *low, uint32_t *high); -+const char *lp_idmap_backend(const char *domain_name); -+const char *lp_idmap_default_backend (void); -+int lp_security(void); -+int lp_client_max_protocol(void); -+int lp_client_ipc_min_protocol(void); -+int lp_client_ipc_max_protocol(void); -+int lp_client_ipc_signing(void); -+int lp_smb2_max_credits(void); -+int lp_cups_encrypt(void); -+bool lp_widelinks(int ); -+int lp_rpc_low_port(void); -+int lp_rpc_high_port(void); -+bool lp_lanman_auth(void); -+enum samba_weak_crypto lp_weak_crypto(void); -+ -+int lp_wi_scan_global_parametrics( -+ const char *regex, size_t max_matches, -+ bool (*cb)(const char *string, regmatch_t matches[], -+ void *private_data), -+ void *private_data); -+ -+const char *lp_parm_const_string(int snum, const char *type, const char *option, const char *def); -+struct loadparm_service; -+const char *lp_parm_const_string_service(struct loadparm_service *service, const char *type, -+ const char *option, const char *def); -+const char **lp_parm_string_list(int snum, const char *type, const char *option, const char **def); -+int lp_parm_int(int snum, const char *type, const char *option, int def); -+unsigned long lp_parm_ulong(int snum, const char *type, const char *option, unsigned long def); -+unsigned long long lp_parm_ulonglong(int snum, const char *type, -+ const char *option, -+ unsigned long long def); -+bool lp_parm_bool(int snum, const char *type, const char *option, bool def); -+struct enum_list; -+int lp_parm_enum(int snum, const char *type, const char *option, -+ const struct enum_list *_enum, int def); -+char *canonicalize_servicename(TALLOC_CTX *ctx, const char *src); -+bool lp_add_home(const char *pszHomename, int iDefaultService, -+ const char *user, const char *pszHomedir); -+int lp_add_service(const char *pszService, int iDefaultService); -+bool lp_add_printer(const char *pszPrintername, int iDefaultService); -+bool lp_parameter_is_valid(const char *pszParmName); -+bool lp_parameter_is_global(const char *pszParmName); -+bool lp_canonicalize_parameter(const char *parm_name, const char **canon_parm, -+ bool *inverse); -+bool lp_canonicalize_parameter_with_value(const char *parm_name, -+ const char *val, -+ const char **canon_parm, -+ const char **canon_val); -+void show_parameter_list(void); -+bool lp_invert_boolean(const char *str, const char **inverse_str); -+bool lp_canonicalize_boolean(const char *str, const char**canon_str); -+bool process_registry_service(const char *service_name); -+bool process_registry_shares(void); -+bool lp_config_backend_is_registry(void); -+bool lp_config_backend_is_file(void); -+bool lp_file_list_changed(void); -+const char *lp_ldap_machine_suffix(TALLOC_CTX *ctx); -+const char *lp_ldap_user_suffix(TALLOC_CTX *ctx); -+const char *lp_ldap_group_suffix(TALLOC_CTX *ctx); -+const char *lp_ldap_idmap_suffix(TALLOC_CTX *ctx); -+struct parm_struct; -+/* Return a pointer to a service by name. */ -+struct loadparm_service *lp_service(const char *pszServiceName); -+struct loadparm_service *lp_servicebynum(int snum); -+struct loadparm_service *lp_default_loadparm_service(void); -+void *lp_parm_ptr(struct loadparm_service *service, struct parm_struct *parm); -+void *lp_local_ptr_by_snum(int snum, struct parm_struct *parm); -+bool lp_do_parameter(int snum, const char *pszParmName, const char *pszParmValue); -+bool lp_set_cmdline(const char *pszParmName, const char *pszParmValue); -+bool dump_a_parameter(int snum, char *parm_name, FILE * f, bool isGlobal); -+bool lp_snum_ok(int iService); -+void lp_add_one_printer(const char *name, const char *comment, -+ const char *location, void *pdata); -+bool lp_loaded(void); -+void lp_killunused(struct smbd_server_connection *sconn, -+ bool (*snumused) (struct smbd_server_connection *, int)); -+void lp_kill_all_services(void); -+void lp_killservice(int iServiceIn); -+const char* server_role_str(uint32_t role); -+enum usershare_err parse_usershare_file(TALLOC_CTX *ctx, -+ SMB_STRUCT_STAT *psbuf, -+ const char *servicename, -+ int snum, -+ char **lines, -+ int numlines, -+ char **pp_sharepath, -+ char **pp_comment, -+ char **pp_cp_share_name, -+ struct security_descriptor **ppsd, -+ bool *pallow_guest); -+int load_usershare_service(const char *servicename); -+int load_usershare_shares(struct smbd_server_connection *sconn, -+ bool (*snumused) (struct smbd_server_connection *, int)); -+void gfree_loadparm(void); -+bool lp_load_initial_only(const char *pszFname); -+bool lp_load_global(const char *file_name); -+bool lp_load_with_shares(const char *file_name); -+bool lp_load_client(const char *file_name); -+bool lp_load_global_no_reinit(const char *file_name); -+bool lp_load_no_reinit(const char *file_name); -+bool lp_load_client_no_reinit(const char *file_name); -+bool lp_load_with_registry_shares(const char *pszFname); -+int lp_numservices(void); -+void lp_dump(FILE *f, bool show_defaults, int maxtoprint); -+void lp_dump_one(FILE * f, bool show_defaults, int snum); -+int lp_servicenumber(const char *pszServiceName); -+const char *volume_label(TALLOC_CTX *ctx, int snum); -+bool lp_domain_master(void); -+bool lp_preferred_master(void); -+void lp_remove_service(int snum); -+void lp_copy_service(int snum, const char *new_name); -+int lp_default_server_announce(void); -+const char *lp_printername(TALLOC_CTX *ctx, -+ const struct loadparm_substitution *lp_sub, -+ int snum); -+void lp_set_logfile(const char *name); -+int lp_maxprintjobs(int snum); -+const char *lp_printcapname(void); -+bool lp_disable_spoolss( void ); -+void lp_set_spoolss_state( uint32_t state ); -+uint32_t lp_get_spoolss_state( void ); -+struct smb_signing_state; -+void set_use_sendfile(int snum, bool val); -+void lp_set_mangling_method(const char *new_method); -+bool lp_posix_pathnames(void); -+void lp_set_posix_pathnames(void); -+enum brl_flavour lp_posix_cifsu_locktype(files_struct *fsp); -+void lp_set_posix_default_cifsx_readwrite_locktype(enum brl_flavour val); -+int lp_min_receive_file_size(void); -+void widelinks_warning(int snum); -+const char *lp_ncalrpc_dir(void); -+void _lp_set_server_role(int server_role); -+uint32_t lp_get_async_dns_timeout(void); -+ -+/* The following definitions come from param/loadparm_ctx.c */ -+ -+const struct loadparm_s3_helpers *loadparm_s3_helpers(void); -+ -+/* The following definitions come from param/loadparm_server_role.c */ -+ -+int lp_server_role(void); -+void set_server_role(void); -+ -+/* The following definitions come from param/util.c */ -+ -+uint32_t get_int_param( const char* param ); -+char *get_string_param( const char* param ); -+ -+#endif /* _S3_LOADPARM_H */ --- -2.29.2 - - -From 62a13e686241e752ba927da046dda68324f3a550 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Tue, 11 Aug 2020 10:41:07 +0200 -Subject: [PATCH 075/104] s3:lib: Move interface prototypes to own header file - -Signed-off-by: Andreas Schneider -Reviewed-by: Jeremy Allison - -Autobuild-User(master): Jeremy Allison -Autobuild-Date(master): Fri Oct 9 20:36:13 UTC 2020 on sn-devel-184 - -(cherry picked from commit 925cc9aafbe17cb2cbd89f468fac70f96ae89475) ---- - source3/include/proto.h | 21 +------------------ - source3/lib/interface.h | 46 +++++++++++++++++++++++++++++++++++++++++ - 2 files changed, 47 insertions(+), 20 deletions(-) - create mode 100644 source3/lib/interface.h - -diff --git a/source3/include/proto.h b/source3/include/proto.h -index b9a6cb7f116..1bbd8e9d526 100644 ---- a/source3/include/proto.h -+++ b/source3/include/proto.h -@@ -84,26 +84,7 @@ NTSTATUS vfs_at_fspcwd(TALLOC_CTX *mem_ctx, - struct connection_struct *conn, - struct files_struct **_fsp); - --/* The following definitions come from lib/interface.c */ -- --bool ismyaddr(const struct sockaddr *ip); --bool ismyip_v4(struct in_addr ip); --bool is_local_net(const struct sockaddr *from); --void setup_linklocal_scope_id(struct sockaddr *pss); --bool is_local_net_v4(struct in_addr from); --int iface_count(void); --int iface_count_v4_nl(void); --const struct in_addr *first_ipv4_iface(void); --struct interface *get_interface(int n); --const struct sockaddr_storage *iface_n_sockaddr_storage(int n); --const struct in_addr *iface_n_ip_v4(int n); --const struct in_addr *iface_n_bcast_v4(int n); --const struct sockaddr_storage *iface_n_bcast(int n); --const struct sockaddr_storage *iface_ip(const struct sockaddr *ip); --bool iface_local(const struct sockaddr *ip); --void load_interfaces(void); --void gfree_interfaces(void); --bool interfaces_changed(void); -+#include "source3/lib/interface.h" - - /* The following definitions come from lib/ldap_debug_handler.c */ - -diff --git a/source3/lib/interface.h b/source3/lib/interface.h -new file mode 100644 -index 00000000000..f45435b4a81 ---- /dev/null -+++ b/source3/lib/interface.h -@@ -0,0 +1,46 @@ -+/* -+ * -+ * Unix SMB/CIFS implementation. -+ * -+ * Type definitions for interfaces -+ * -+ * Copyright (c) 2020 Andreas Schneider -+ * This program is free software: you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License as published by -+ * the Free Software Foundation, either version 3 of the License, or -+ * (at your option) any later version. -+ * -+ * This program is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ * GNU General Public License for more details. -+ * -+ * You should have received a copy of the GNU General Public License -+ * along with this program. If not, see . -+ */ -+ -+#ifndef _INTERFACE_H -+#define _INTERFACE_H -+ -+#include -+ -+bool ismyaddr(const struct sockaddr *ip); -+bool ismyip_v4(struct in_addr ip); -+bool is_local_net(const struct sockaddr *from); -+void setup_linklocal_scope_id(struct sockaddr *pss); -+bool is_local_net_v4(struct in_addr from); -+int iface_count(void); -+int iface_count_v4_nl(void); -+const struct in_addr *first_ipv4_iface(void); -+struct interface *get_interface(int n); -+const struct sockaddr_storage *iface_n_sockaddr_storage(int n); -+const struct in_addr *iface_n_ip_v4(int n); -+const struct in_addr *iface_n_bcast_v4(int n); -+const struct sockaddr_storage *iface_n_bcast(int n); -+const struct sockaddr_storage *iface_ip(const struct sockaddr *ip); -+bool iface_local(const struct sockaddr *ip); -+void load_interfaces(void); -+void gfree_interfaces(void); -+bool interfaces_changed(void); -+ -+#endif /* _INTERFACE_H */ --- -2.29.2 - - -From 2b704c32b55432d08eae3cae2267a4b6319c6c6c Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Fri, 7 Feb 2020 16:48:16 +0100 -Subject: [PATCH 076/104] idl: Add SID_SAMBA_SMB3 - -Signed-off-by: Andreas Schneider -Reviewed-by: Alexander Bokovoy -(cherry picked from commit 56879ec5876625346df89110f62d52e3fd5b8934) ---- - librpc/idl/security.idl | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/librpc/idl/security.idl b/librpc/idl/security.idl -index a92e8f1518e..06bf7449a70 100644 ---- a/librpc/idl/security.idl -+++ b/librpc/idl/security.idl -@@ -282,6 +282,9 @@ interface security - const string SID_SAMBA_UNIX_USER_OWNER = "S-1-22-1"; - const string SID_SAMBA_UNIX_GROUP_OWNER = "S-1-22-2"; - -+ /* Information passing via security token */ -+ const string SID_SAMBA_SMB3 = "S-1-22-1397571891"; -+ - /* SECURITY_NT_SERVICE */ - const string NAME_NT_SERVICE = "NT SERVICE"; - --- -2.29.2 - - -From ae4b1eccc9ef043a753126f942345a57a92004ed Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Fri, 7 Feb 2020 16:48:29 +0100 -Subject: [PATCH 077/104] s3:smbd: Add SMB3 connection information to session - info - -Signed-off-by: Andreas Schneider -Reviewed-by: Alexander Bokovoy -(cherry picked from commit 905c2b9722a64ee57f3fbcff51e6bb591c6e3edc) ---- - source3/include/vfs.h | 1 + - source3/smbd/pipes.c | 82 +++++++++++++++++++++++++++++++++++++- - source3/smbd/smb2_server.c | 5 +++ - 3 files changed, 87 insertions(+), 1 deletion(-) - -diff --git a/source3/include/vfs.h b/source3/include/vfs.h -index d527f850628..c0d60636c31 100644 ---- a/source3/include/vfs.h -+++ b/source3/include/vfs.h -@@ -411,6 +411,7 @@ typedef struct files_struct { - bool use_ofd_locks : 1; - bool closing : 1; - bool lock_failure_seen : 1; -+ bool encryption_required : 1; - } fsp_flags; - - struct tevent_timer *update_write_time_event; -diff --git a/source3/smbd/pipes.c b/source3/smbd/pipes.c -index 2dd38bb7ab3..d51a3de9497 100644 ---- a/source3/smbd/pipes.c -+++ b/source3/smbd/pipes.c -@@ -30,13 +30,16 @@ - #include "smbd/globals.h" - #include "libcli/security/security.h" - #include "rpc_server/srv_pipe_hnd.h" -+#include "auth/auth_util.h" - - NTSTATUS open_np_file(struct smb_request *smb_req, const char *name, - struct files_struct **pfsp) - { -+ struct smbXsrv_connection *xconn = smb_req->xconn; - struct connection_struct *conn = smb_req->conn; - struct files_struct *fsp; - struct smb_filename *smb_fname = NULL; -+ struct auth_session_info *session_info = conn->session_info; - NTSTATUS status; - - status = file_new(smb_req, conn, &fsp); -@@ -68,10 +71,87 @@ NTSTATUS open_np_file(struct smb_request *smb_req, const char *name, - return status; - } - -+ if (smb_req->smb2req != NULL && smb_req->smb2req->was_encrypted) { -+ struct security_token *security_token = NULL; -+ uint16_t dialect = xconn->smb2.server.dialect; -+ uint16_t srv_smb_encrypt = 0x0002; -+ uint16_t cipher = xconn->smb2.server.cipher; -+ char smb3_sid_str[SID_MAX_SIZE]; -+ struct dom_sid smb3_dom_sid; -+ struct dom_sid smb3_sid; -+ uint32_t i; -+ bool ok; -+ int rc; -+ -+ session_info = copy_session_info(fsp, conn->session_info); -+ if (session_info == NULL) { -+ DBG_ERR("Failed to copy session info\n"); -+ file_free(smb_req, fsp); -+ return NT_STATUS_NO_MEMORY; -+ } -+ security_token = session_info->security_token; -+ -+ ok = dom_sid_parse(SID_SAMBA_SMB3, &smb3_dom_sid); -+ if (!ok) { -+ file_free(smb_req, fsp); -+ return NT_STATUS_BUFFER_TOO_SMALL; -+ } -+ -+ /* -+ * Security check: -+ * -+ * Make sure we don't have a SMB3 SID in the security token! -+ */ -+ for (i = 0; i < security_token->num_sids; i++) { -+ int cmp; -+ -+ cmp = dom_sid_compare_domain(&security_token->sids[i], -+ &smb3_dom_sid); -+ if (cmp == 0) { -+ DBG_ERR("ERROR: An SMB3 SID has already been " -+ "detected in the security token!\n"); -+ file_free(smb_req, fsp); -+ return NT_STATUS_ACCESS_DENIED; -+ } -+ } -+ -+ rc = snprintf(smb3_sid_str, -+ sizeof(smb3_sid_str), -+ "%s-%u-%u-%u", -+ SID_SAMBA_SMB3, -+ dialect, -+ srv_smb_encrypt, -+ cipher); -+ if (rc < 0) { -+ DBG_ERR("Buffer too small\n"); -+ file_free(smb_req, fsp); -+ return NT_STATUS_BUFFER_TOO_SMALL; -+ } -+ -+ ok = dom_sid_parse(smb3_sid_str, &smb3_sid); -+ if (!ok) { -+ DBG_ERR("Failed to parse SMB3 SID\n"); -+ file_free(smb_req, fsp); -+ return NT_STATUS_INVALID_PARAMETER; -+ } -+ -+ status = add_sid_to_array_unique(security_token, -+ &smb3_sid, -+ &security_token->sids, -+ &security_token->num_sids); -+ if (!NT_STATUS_IS_OK(status)) { -+ DBG_ERR("Failed to add SMB3 SID to security token\n"); -+ file_free(smb_req, fsp); -+ return status; -+ } -+ -+ fsp->fsp_flags.encryption_required = true; -+ } -+ - status = np_open(fsp, name, - conn->sconn->remote_address, - conn->sconn->local_address, -- conn->session_info, -+ session_info, - conn->sconn->ev_ctx, - conn->sconn->msg_ctx, - conn->sconn->dce_ctx, -diff --git a/source3/smbd/smb2_server.c b/source3/smbd/smb2_server.c -index cf9de185c1f..cd24b7d2ed5 100644 ---- a/source3/smbd/smb2_server.c -+++ b/source3/smbd/smb2_server.c -@@ -3232,6 +3232,11 @@ NTSTATUS smbd_smb2_request_dispatch(struct smbd_smb2_request *req) - return smbd_smb2_request_error(req, - NT_STATUS_FILE_CLOSED); - } -+ } else { -+ if (fsp->fsp_flags.encryption_required && !req->was_encrypted) { -+ return smbd_smb2_request_error(req, -+ NT_STATUS_ACCESS_DENIED); -+ } - } - } - --- -2.29.2 - - -From 49853bdabadcde29032b0ae09f015a0adf3cd22c Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Thu, 12 Mar 2020 14:11:56 +0100 -Subject: [PATCH 078/104] librpc: Add dcerpc helper - dcerpc_is_transport_encrypted() - -Signed-off-by: Andreas Schneider -Reviewed-by: Alexander Bokovoy -(cherry picked from commit 8bbe5c8c94aaf75d715f558c363e5b2de49f7bf9) ---- - librpc/rpc/dcerpc_helper.c | 137 +++++++++++++++++++++++++++++++++++++ - librpc/rpc/dcerpc_helper.h | 26 +++++++ - librpc/wscript_build | 9 +++ - 3 files changed, 172 insertions(+) - create mode 100644 librpc/rpc/dcerpc_helper.c - create mode 100644 librpc/rpc/dcerpc_helper.h - -diff --git a/librpc/rpc/dcerpc_helper.c b/librpc/rpc/dcerpc_helper.c -new file mode 100644 -index 00000000000..c5443764628 ---- /dev/null -+++ b/librpc/rpc/dcerpc_helper.c -@@ -0,0 +1,137 @@ -+/* -+ * Copyright (c) 2020 Andreas Schneider -+ * -+ * This program is free software: you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License as published by -+ * the Free Software Foundation, either version 3 of the License, or -+ * (at your option) any later version. -+ * -+ * This program is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ * GNU General Public License for more details. -+ * -+ * You should have received a copy of the GNU General Public License -+ * along with this program. If not, see . -+ */ -+ -+#include "includes.h" -+#include "librpc/gen_ndr/security.h" -+#include "librpc/gen_ndr/auth.h" -+#include "lib/crypto/gnutls_helpers.h" -+#include "libcli/security/dom_sid.h" -+#include "libcli/smb/smb2_constants.h" -+ -+#include "dcerpc_helper.h" -+ -+static bool smb3_sid_parse(const struct dom_sid *sid, -+ uint16_t *pdialect, -+ uint16_t *pencrypt, -+ uint16_t *pcipher) -+{ -+ uint16_t dialect; -+ uint16_t encrypt; -+ uint16_t cipher; -+ -+ if (sid->sub_auths[0] != 1397571891) { -+ return false; -+ } -+ -+ dialect = sid->sub_auths[1]; -+ if (dialect > 0x03ff) { -+ return false; -+ } -+ -+ encrypt = sid->sub_auths[2]; -+ if (encrypt > 0x0002) { -+ return false; -+ } -+ -+ cipher = sid->sub_auths[3]; -+ if (cipher > SMB2_ENCRYPTION_AES128_GCM) { -+ return false; -+ } -+ -+ if (pdialect != NULL) { -+ *pdialect = dialect; -+ } -+ -+ if (pencrypt != NULL) { -+ *pencrypt = encrypt; -+ } -+ -+ if (pcipher != NULL) { -+ *pcipher = cipher; -+ } -+ -+ return true; -+} -+ -+bool dcerpc_is_transport_encrypted(struct auth_session_info *session_info) -+{ -+ struct security_token *token = session_info->security_token; -+ struct dom_sid smb3_dom_sid; -+ const struct dom_sid *smb3_sid = NULL; -+ uint16_t dialect = 0; -+ uint16_t encrypt = 0; -+ uint16_t cipher = 0; -+ uint32_t i; -+ bool ok; -+ -+ ok = dom_sid_parse(SID_SAMBA_SMB3, &smb3_dom_sid); -+ if (!ok) { -+ return false; -+ } -+ -+ for (i = 0; i < token->num_sids; i++) { -+ int cmp; -+ -+ /* There is only one SMB3 SID allowed! */ -+ cmp = dom_sid_compare_domain(&token->sids[i], &smb3_dom_sid); -+ if (cmp == 0) { -+ if (smb3_sid == NULL) { -+ smb3_sid = &token->sids[i]; -+ } else { -+ DBG_ERR("ERROR: The SMB3 SID has been detected " -+ "multiple times\n"); -+ return false; -+ } -+ } -+ } -+ -+ if (smb3_sid == NULL) { -+ return false; -+ } -+ -+ ok = smb3_sid_parse(smb3_sid, &dialect, &encrypt, &cipher); -+ if (!ok) { -+ DBG_ERR("Failed to parse SMB3 SID!\n"); -+ return false; -+ } -+ -+ DBG_DEBUG("SMB SID - dialect: %#04x, encrypt: %#04x, cipher: %#04x\n", -+ dialect, -+ encrypt, -+ cipher); -+ -+ if (dialect < SMB3_DIALECT_REVISION_300) { -+ DBG_DEBUG("Invalid SMB3 dialect!\n"); -+ return false; -+ } -+ -+ if (encrypt != DCERPC_SMB_ENCRYPTION_REQUIRED) { -+ DBG_DEBUG("Invalid SMB3 encryption!\n"); -+ return false; -+ } -+ -+ switch (cipher) { -+ case SMB2_ENCRYPTION_AES128_CCM: -+ case SMB2_ENCRYPTION_AES128_GCM: -+ break; -+ default: -+ DBG_DEBUG("Invalid SMB3 cipher!\n"); -+ return false; -+ } -+ -+ return true; -+} -diff --git a/librpc/rpc/dcerpc_helper.h b/librpc/rpc/dcerpc_helper.h -new file mode 100644 -index 00000000000..c0f09ee494e ---- /dev/null -+++ b/librpc/rpc/dcerpc_helper.h -@@ -0,0 +1,26 @@ -+/* -+ * Copyright (c) 2020 Andreas Schneider -+ * -+ * This program is free software: you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License as published by -+ * the Free Software Foundation, either version 3 of the License, or -+ * (at your option) any later version. -+ * -+ * This program is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ * GNU General Public License for more details. -+ * -+ * You should have received a copy of the GNU General Public License -+ * along with this program. If not, see . -+ */ -+ -+#ifndef _DCERPC_HELPER_H -+#define _DCERPC_HELPER_H -+ -+#define DCERPC_SMB_ENCRYPTION_OFF 0x0000 -+#define DCERPC_SMB_ENCRYPTION_REQUIRED 0x0002 -+ -+bool dcerpc_is_transport_encrypted(struct auth_session_info *session_info); -+ -+#endif /* _DCERPC_HELPER_H */ -diff --git a/librpc/wscript_build b/librpc/wscript_build -index 27b180fa63d..109a1834841 100644 ---- a/librpc/wscript_build -+++ b/librpc/wscript_build -@@ -669,6 +669,15 @@ bld.SAMBA_LIBRARY('dcerpc-server-core', - autoproto='rpc/dcesrv_core_proto.h', - vnum='0.0.1') - -+bld.SAMBA_SUBSYSTEM('DCERPC_HELPER', -+ source='rpc/dcerpc_helper.c', -+ public_deps=''' -+ samba-hostconfig -+ samba-security -+ gnutls -+ GNUTLS_HELPERS -+ ''') -+ - bld.SAMBA_SUBSYSTEM('NDR_WINBIND', - source='gen_ndr/ndr_winbind.c', - public_deps='ndr NDR_LSA' --- -2.29.2 - - -From 0490f135fdcc293561b0af98b4ce0f4d56eb14a6 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Fri, 28 Aug 2020 16:31:17 +0200 -Subject: [PATCH 079/104] s3:smbd: Use defines to set 'srv_smb_encrypt' - -Signed-off-by: Andreas Schneider -Reviewed-by: Alexander Bokovoy -(cherry picked from commit 5f1a73be6311c68a21a550c0de5078baeb78f4ee) ---- - source3/smbd/pipes.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/source3/smbd/pipes.c b/source3/smbd/pipes.c -index d51a3de9497..785cbb23b5f 100644 ---- a/source3/smbd/pipes.c -+++ b/source3/smbd/pipes.c -@@ -31,6 +31,7 @@ - #include "libcli/security/security.h" - #include "rpc_server/srv_pipe_hnd.h" - #include "auth/auth_util.h" -+#include "librpc/rpc/dcerpc_helper.h" - - NTSTATUS open_np_file(struct smb_request *smb_req, const char *name, - struct files_struct **pfsp) -@@ -74,7 +75,7 @@ NTSTATUS open_np_file(struct smb_request *smb_req, const char *name, - if (smb_req->smb2req != NULL && smb_req->smb2req->was_encrypted) { - struct security_token *security_token = NULL; - uint16_t dialect = xconn->smb2.server.dialect; -- uint16_t srv_smb_encrypt = 0x0002; -+ uint16_t srv_smb_encrypt = DCERPC_SMB_ENCRYPTION_REQUIRED; - uint16_t cipher = xconn->smb2.server.cipher; - char smb3_sid_str[SID_MAX_SIZE]; - struct dom_sid smb3_dom_sid; --- -2.29.2 - - -From bbbb58dd5f37f82b46872d4a9eb3c6f6c1939a26 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Tue, 12 Nov 2019 16:56:45 +0100 -Subject: [PATCH 080/104] s3:rpc_server: Allow to use RC4 for setting passwords - -Signed-off-by: Andreas Schneider -Reviewed-by: Alexander Bokovoy -(cherry picked from commit c6a21e1897985f267bcfc681179cea95165c3c57) ---- - source3/rpc_server/samr/srv_samr_chgpasswd.c | 3 + - source3/rpc_server/samr/srv_samr_nt.c | 78 +++++++++++++++++++- - source3/rpc_server/wscript_build | 2 +- - 3 files changed, 81 insertions(+), 2 deletions(-) - -diff --git a/source3/rpc_server/samr/srv_samr_chgpasswd.c b/source3/rpc_server/samr/srv_samr_chgpasswd.c -index cb9837ecf01..e326745169e 100644 ---- a/source3/rpc_server/samr/srv_samr_chgpasswd.c -+++ b/source3/rpc_server/samr/srv_samr_chgpasswd.c -@@ -769,11 +769,13 @@ static NTSTATUS check_oem_password(const char *user, - .size = 16, - }; - -+ GNUTLS_FIPS140_SET_LAX_MODE(); - rc = gnutls_cipher_init(&cipher_hnd, - GNUTLS_CIPHER_ARCFOUR_128, - &enc_key, - NULL); - if (rc < 0) { -+ GNUTLS_FIPS140_SET_STRICT_MODE(); - return gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); - } - -@@ -781,6 +783,7 @@ static NTSTATUS check_oem_password(const char *user, - password_encrypted, - 516); - gnutls_cipher_deinit(cipher_hnd); -+ GNUTLS_FIPS140_SET_STRICT_MODE(); - if (rc < 0) { - return gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); - } -diff --git a/source3/rpc_server/samr/srv_samr_nt.c b/source3/rpc_server/samr/srv_samr_nt.c -index 5ffc3331185..77cb18b6a88 100644 ---- a/source3/rpc_server/samr/srv_samr_nt.c -+++ b/source3/rpc_server/samr/srv_samr_nt.c -@@ -46,6 +46,8 @@ - #include "rpc_server/srv_access_check.h" - #include "../lib/tsocket/tsocket.h" - #include "lib/util/base64.h" -+#include "param/param.h" -+#include "librpc/rpc/dcerpc_helper.h" - - #include "lib/crypto/gnutls_helpers.h" - #include -@@ -1887,6 +1889,7 @@ NTSTATUS _samr_ChangePasswordUser2(struct pipes_struct *p, - char *user_name = NULL; - char *rhost; - const char *wks = NULL; -+ bool encrypted; - - DEBUG(5,("_samr_ChangePasswordUser2: %d\n", __LINE__)); - -@@ -1915,6 +1918,12 @@ NTSTATUS _samr_ChangePasswordUser2(struct pipes_struct *p, - return NT_STATUS_NO_MEMORY; - } - -+ encrypted = dcerpc_is_transport_encrypted(p->session_info); -+ if (lp_weak_crypto() == SAMBA_WEAK_CRYPTO_DISALLOWED && -+ !encrypted) { -+ return NT_STATUS_ACCESS_DENIED; -+ } -+ - /* - * UNIX username case mangling not required, pass_oem_change - * is case insensitive. -@@ -1948,6 +1957,7 @@ NTSTATUS _samr_OemChangePasswordUser2(struct pipes_struct *p, - char *user_name = NULL; - const char *wks = NULL; - char *rhost; -+ bool encrypted; - - DEBUG(5,("_samr_OemChangePasswordUser2: %d\n", __LINE__)); - -@@ -1985,6 +1995,12 @@ NTSTATUS _samr_OemChangePasswordUser2(struct pipes_struct *p, - return NT_STATUS_NO_MEMORY; - } - -+ encrypted = dcerpc_is_transport_encrypted(p->session_info); -+ if (lp_weak_crypto() == SAMBA_WEAK_CRYPTO_DISALLOWED && -+ !encrypted) { -+ return NT_STATUS_ACCESS_DENIED; -+ } -+ - status = pass_oem_change(user_name, - rhost, - r->in.password->data, -@@ -5200,8 +5216,13 @@ NTSTATUS _samr_SetUserInfo(struct pipes_struct *p, - char *rhost; - DATA_BLOB session_key; - struct dom_sid_buf buf; -+ struct loadparm_context *lp_ctx = NULL; -+ bool encrypted; - -- DEBUG(5,("_samr_SetUserInfo: %d\n", __LINE__)); -+ lp_ctx = loadparm_init_s3(p->mem_ctx, loadparm_s3_helpers()); -+ if (lp_ctx == NULL) { -+ return NT_STATUS_NO_MEMORY; -+ } - - /* This is tricky. A WinXP domain join sets - (SAMR_USER_ACCESS_SET_PASSWORD|SAMR_USER_ACCESS_SET_ATTRIBUTES|SAMR_USER_ACCESS_GET_ATTRIBUTES) -@@ -5390,13 +5411,27 @@ NTSTATUS _samr_SetUserInfo(struct pipes_struct *p, - break; - - case 23: -+ encrypted = -+ dcerpc_is_transport_encrypted(p->session_info); -+ if (lp_weak_crypto() == SAMBA_WEAK_CRYPTO_DISALLOWED && -+ !encrypted) { -+ status = NT_STATUS_ACCESS_DENIED; -+ break; -+ } -+ - status = session_extract_session_key(p->session_info, &session_key, KEY_USE_16BYTES); - if(!NT_STATUS_IS_OK(status)) { - break; - } -+ /* -+ * This can be allowed as it requires a session key -+ * which we only have if we have a SMB session. -+ */ -+ GNUTLS_FIPS140_SET_LAX_MODE(); - status = arc4_decrypt_data(session_key, - info->info23.password.data, - 516); -+ GNUTLS_FIPS140_SET_STRICT_MODE(); - if(!NT_STATUS_IS_OK(status)) { - break; - } -@@ -5412,14 +5447,27 @@ NTSTATUS _samr_SetUserInfo(struct pipes_struct *p, - break; - - case 24: -+ encrypted = -+ dcerpc_is_transport_encrypted(p->session_info); -+ if (lp_weak_crypto() == SAMBA_WEAK_CRYPTO_DISALLOWED && -+ !encrypted) { -+ status = NT_STATUS_ACCESS_DENIED; -+ break; -+ } - - status = session_extract_session_key(p->session_info, &session_key, KEY_USE_16BYTES); - if(!NT_STATUS_IS_OK(status)) { - break; - } -+ /* -+ * This can be allowed as it requires a session key -+ * which we only have if we have a SMB session. -+ */ -+ GNUTLS_FIPS140_SET_LAX_MODE(); - status = arc4_decrypt_data(session_key, - info->info24.password.data, - 516); -+ GNUTLS_FIPS140_SET_STRICT_MODE(); - if(!NT_STATUS_IS_OK(status)) { - break; - } -@@ -5434,12 +5482,26 @@ NTSTATUS _samr_SetUserInfo(struct pipes_struct *p, - break; - - case 25: -+ encrypted = -+ dcerpc_is_transport_encrypted(p->session_info); -+ if (lp_weak_crypto() == SAMBA_WEAK_CRYPTO_DISALLOWED && -+ !encrypted) { -+ status = NT_STATUS_ACCESS_DENIED; -+ break; -+ } -+ - status = session_extract_session_key(p->session_info, &session_key, KEY_USE_16BYTES); - if(!NT_STATUS_IS_OK(status)) { - break; - } -+ /* -+ * This can be allowed as it requires a session key -+ * which we only have if we have a SMB session. -+ */ -+ GNUTLS_FIPS140_SET_LAX_MODE(); - status = decode_rc4_passwd_buffer(&session_key, - &info->info25.password); -+ GNUTLS_FIPS140_SET_STRICT_MODE(); - if (!NT_STATUS_IS_OK(status)) { - break; - } -@@ -5454,12 +5516,26 @@ NTSTATUS _samr_SetUserInfo(struct pipes_struct *p, - break; - - case 26: -+ encrypted = -+ dcerpc_is_transport_encrypted(p->session_info); -+ if (lp_weak_crypto() == SAMBA_WEAK_CRYPTO_DISALLOWED && -+ !encrypted) { -+ status = NT_STATUS_ACCESS_DENIED; -+ break; -+ } -+ - status = session_extract_session_key(p->session_info, &session_key, KEY_USE_16BYTES); - if(!NT_STATUS_IS_OK(status)) { - break; - } -+ /* -+ * This can be allowed as it requires a session key -+ * which we only have if we have a SMB session. -+ */ -+ GNUTLS_FIPS140_SET_LAX_MODE(); - status = decode_rc4_passwd_buffer(&session_key, - &info->info26.password); -+ GNUTLS_FIPS140_SET_STRICT_MODE(); - if (!NT_STATUS_IS_OK(status)) { - break; - } -diff --git a/source3/rpc_server/wscript_build b/source3/rpc_server/wscript_build -index 2af02ad6fa8..eb91ac09384 100644 ---- a/source3/rpc_server/wscript_build -+++ b/source3/rpc_server/wscript_build -@@ -85,7 +85,7 @@ bld.SAMBA3_SUBSYSTEM('RPC_SAMR', - source='''samr/srv_samr_nt.c - samr/srv_samr_util.c - samr/srv_samr_chgpasswd.c''', -- deps='PLAINTEXT_AUTH SRV_ACCESS_CHECK') -+ deps='PLAINTEXT_AUTH SRV_ACCESS_CHECK DCERPC_HELPER') - - bld.SAMBA3_SUBSYSTEM('RPC_SPOOLSS', - source='''spoolss/srv_spoolss_nt.c --- -2.29.2 - - -From c3ffe2ce09c761a69ba83ae55beb4af4e53095d7 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Fri, 15 Nov 2019 13:49:40 +0100 -Subject: [PATCH 081/104] s4:rpc_server: Allow to use RC4 for setting passwords - -Signed-off-by: Andreas Schneider -Reviewed-by: Alexander Bokovoy -(cherry picked from commit a9c532c6d3e85fbe49b7040254cfc66ab54074bc) ---- - source4/rpc_server/samr/samr_password.c | 30 +++++++++++++++++++++++++ - source4/rpc_server/wscript_build | 2 +- - 2 files changed, 31 insertions(+), 1 deletion(-) - -diff --git a/source4/rpc_server/samr/samr_password.c b/source4/rpc_server/samr/samr_password.c -index 52a644176e2..83b104fbd0e 100644 ---- a/source4/rpc_server/samr/samr_password.c -+++ b/source4/rpc_server/samr/samr_password.c -@@ -31,6 +31,8 @@ - #include "../lib/util/util_ldb.h" - #include "rpc_server/samr/proto.h" - #include "auth/auth_sam.h" -+#include "lib/param/loadparm.h" -+#include "librpc/rpc/dcerpc_helper.h" - - #include "lib/crypto/gnutls_helpers.h" - #include -@@ -129,6 +131,8 @@ NTSTATUS dcesrv_samr_OemChangePasswordUser2(struct dcesrv_call_state *dce_call, - struct dom_sid *user_objectSid = NULL; - gnutls_cipher_hd_t cipher_hnd = NULL; - gnutls_datum_t lm_session_key; -+ struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx; -+ bool encrypted; - int rc; - - if (pwbuf == NULL) { -@@ -144,6 +148,12 @@ NTSTATUS dcesrv_samr_OemChangePasswordUser2(struct dcesrv_call_state *dce_call, - return NT_STATUS_ACCESS_DISABLED_BY_POLICY_OTHER; - } - -+ encrypted = dcerpc_is_transport_encrypted(session_info); -+ if (lpcfg_weak_crypto(lp_ctx) == SAMBA_WEAK_CRYPTO_DISALLOWED && -+ !encrypted) { -+ return NT_STATUS_ACCESS_DENIED; -+ } -+ - /* Connect to a SAMDB with system privileges for fetching the old pw - * hashes. */ - sam_ctx = samdb_connect(mem_ctx, -@@ -188,11 +198,13 @@ NTSTATUS dcesrv_samr_OemChangePasswordUser2(struct dcesrv_call_state *dce_call, - .size = sizeof(lm_pwd->hash), - }; - -+ GNUTLS_FIPS140_SET_LAX_MODE(); - rc = gnutls_cipher_init(&cipher_hnd, - GNUTLS_CIPHER_ARCFOUR_128, - &lm_session_key, - NULL); - if (rc < 0) { -+ GNUTLS_FIPS140_SET_STRICT_MODE(); - status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); - goto failed; - } -@@ -201,6 +213,7 @@ NTSTATUS dcesrv_samr_OemChangePasswordUser2(struct dcesrv_call_state *dce_call, - pwbuf->data, - 516); - gnutls_cipher_deinit(cipher_hnd); -+ GNUTLS_FIPS140_SET_STRICT_MODE(); - if (rc < 0) { - status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); - goto failed; -@@ -607,7 +620,17 @@ NTSTATUS samr_set_password(struct dcesrv_call_state *dce_call, - DATA_BLOB session_key = data_blob(NULL, 0); - gnutls_cipher_hd_t cipher_hnd = NULL; - gnutls_datum_t _session_key; -+ struct auth_session_info *session_info = -+ dcesrv_call_session_info(dce_call); -+ struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx; - int rc; -+ bool encrypted; -+ -+ encrypted = dcerpc_is_transport_encrypted(session_info); -+ if (lpcfg_weak_crypto(lp_ctx) == SAMBA_WEAK_CRYPTO_DISALLOWED && -+ !encrypted) { -+ return NT_STATUS_ACCESS_DENIED; -+ } - - nt_status = dcesrv_transport_session_key(dce_call, &session_key); - if (!NT_STATUS_IS_OK(nt_status)) { -@@ -621,11 +644,17 @@ NTSTATUS samr_set_password(struct dcesrv_call_state *dce_call, - .size = session_key.length, - }; - -+ /* -+ * This is safe to support as we only have a session key -+ * over a SMB connection which we force to be encrypted. -+ */ -+ GNUTLS_FIPS140_SET_LAX_MODE(); - rc = gnutls_cipher_init(&cipher_hnd, - GNUTLS_CIPHER_ARCFOUR_128, - &_session_key, - NULL); - if (rc < 0) { -+ GNUTLS_FIPS140_SET_STRICT_MODE(); - nt_status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); - goto out; - } -@@ -634,6 +663,7 @@ NTSTATUS samr_set_password(struct dcesrv_call_state *dce_call, - pwbuf->data, - 516); - gnutls_cipher_deinit(cipher_hnd); -+ GNUTLS_FIPS140_SET_STRICT_MODE(); - if (rc < 0) { - nt_status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); - goto out; -diff --git a/source4/rpc_server/wscript_build b/source4/rpc_server/wscript_build -index de55ad6239a..c9c1978f223 100644 ---- a/source4/rpc_server/wscript_build -+++ b/source4/rpc_server/wscript_build -@@ -87,7 +87,7 @@ bld.SAMBA_MODULE('dcesrv_samr', - autoproto='samr/proto.h', - subsystem='dcerpc_server', - init_function='dcerpc_server_samr_init', -- deps='samdb DCERPC_COMMON ndr-standard auth4_sam GNUTLS_HELPERS' -+ deps='samdb DCERPC_COMMON ndr-standard auth4_sam GNUTLS_HELPERS DCERPC_HELPER' - ) - - --- -2.29.2 - - -From 6163af4d52811d487fa3568d0588e6afd7f43167 Mon Sep 17 00:00:00 2001 -From: Isaac Boukris -Date: Thu, 20 Aug 2020 12:45:49 +0200 -Subject: [PATCH 082/104] lib:crypto: Add py binding for set_relax/strict fips - mode - -Signed-off-by: Isaac Boukris -Reviewed-by: Andreas Schneider -Reviewed-by: Alexander Bokovoy -(cherry picked from commit 32d4c75d6cbf9153068a0487347097707afb356a) ---- - lib/crypto/py_crypto.c | 16 ++++++++++++++++ - 1 file changed, 16 insertions(+) - -diff --git a/lib/crypto/py_crypto.c b/lib/crypto/py_crypto.c -index 32b946eee8f..ad18d3ada0f 100644 ---- a/lib/crypto/py_crypto.c -+++ b/lib/crypto/py_crypto.c -@@ -24,6 +24,7 @@ - - #include - #include -+#include "lib/crypto/gnutls_helpers.h" - - static PyObject *py_crypto_arcfour_crypt_blob(PyObject *module, PyObject *args) - { -@@ -85,12 +86,27 @@ static PyObject *py_crypto_arcfour_crypt_blob(PyObject *module, PyObject *args) - return result; - } - -+static PyObject *py_crypto_set_relax_mode(PyObject *module) -+{ -+ GNUTLS_FIPS140_SET_LAX_MODE(); -+ -+ Py_RETURN_NONE; -+} -+ -+static PyObject *py_crypto_set_strict_mode(PyObject *module) -+{ -+ GNUTLS_FIPS140_SET_STRICT_MODE(); -+ -+ Py_RETURN_NONE; -+} - - static const char py_crypto_arcfour_crypt_blob_doc[] = "arcfour_crypt_blob(data, key)\n" - "Encrypt the data with RC4 algorithm using the key"; - - static PyMethodDef py_crypto_methods[] = { - { "arcfour_crypt_blob", (PyCFunction)py_crypto_arcfour_crypt_blob, METH_VARARGS, py_crypto_arcfour_crypt_blob_doc }, -+ { "set_relax_mode", (PyCFunction)py_crypto_set_relax_mode, METH_NOARGS, "Set fips to relax mode" }, -+ { "set_strict_mode", (PyCFunction)py_crypto_set_strict_mode, METH_NOARGS, "Set fips to strict mode" }, - {0}, - }; - --- -2.29.2 - - -From 0dbd9d87a529585cabd793ae4c2bc1d94044c619 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Wed, 28 Oct 2020 17:05:36 +0100 -Subject: [PATCH 083/104] s4:param: Add 'weak crypto' getter to pyparam - -Signed-off-by: Andreas Schneider -Reviewed-by: Alexander Bokovoy -(cherry picked from commit 7d54e4b49c235dc571f47d15e6b0a6fa63340773) ---- - source4/param/pyparam.c | 22 ++++++++++++++++++++++ - 1 file changed, 22 insertions(+) - -diff --git a/source4/param/pyparam.c b/source4/param/pyparam.c -index 4023fac4dd6..e15592b5743 100644 ---- a/source4/param/pyparam.c -+++ b/source4/param/pyparam.c -@@ -463,6 +463,23 @@ static PyObject *py_lp_ctx_config_file(PyObject *self, void *closure) - return PyUnicode_FromString(configfile); - } - -+static PyObject *py_lp_ctx_weak_crypto(PyObject *self, void *closure) -+{ -+ enum samba_weak_crypto weak_crypto = -+ lpcfg_weak_crypto(PyLoadparmContext_AsLoadparmContext(self)); -+ -+ switch(weak_crypto) { -+ case SAMBA_WEAK_CRYPTO_UNKNOWN: -+ Py_RETURN_NONE; -+ case SAMBA_WEAK_CRYPTO_ALLOWED: -+ return PyUnicode_FromString("allowed"); -+ case SAMBA_WEAK_CRYPTO_DISALLOWED: -+ return PyUnicode_FromString("disallowed"); -+ } -+ -+ Py_RETURN_NONE; -+} -+ - static PyGetSetDef py_lp_ctx_getset[] = { - { - .name = discard_const_p(char, "default_service"), -@@ -473,6 +490,11 @@ static PyGetSetDef py_lp_ctx_getset[] = { - .get = (getter)py_lp_ctx_config_file, - .doc = discard_const_p(char, "Name of last config file that was loaded.") - }, -+ { -+ .name = discard_const_p(char, "weak_crypto"), -+ .get = (getter)py_lp_ctx_weak_crypto, -+ .doc = discard_const_p(char, "If weak crypto is allowed.") -+ }, - { .name = NULL } - }; - --- -2.29.2 - - -From 29e334546e28b10ff31f0de453951648c4e51296 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Wed, 21 Oct 2020 10:09:22 +0200 -Subject: [PATCH 084/104] python:tests: Add SAMR password change tests for fips - -Signed-off-by: Andreas Schneider -Reviewed-by: Alexander Bokovoy -(cherry picked from commit 9a3ba502d8193b25799ef92917efafd52de2e8c2) ---- - .../tests/dcerpc/samr_change_password.py | 188 ++++++++++++++++++ - selftest/tests.py | 2 + - 2 files changed, 190 insertions(+) - create mode 100644 python/samba/tests/dcerpc/samr_change_password.py - -diff --git a/python/samba/tests/dcerpc/samr_change_password.py b/python/samba/tests/dcerpc/samr_change_password.py -new file mode 100644 -index 00000000000..109eeea98cc ---- /dev/null -+++ b/python/samba/tests/dcerpc/samr_change_password.py -@@ -0,0 +1,188 @@ -+# Unix SMB/CIFS implementation. -+# -+# Copyright © 2020 Andreas Schneider -+# -+# This program is free software; you can redistribute it and/or modify -+# it under the terms of the GNU General Public License as published by -+# the Free Software Foundation; either version 3 of the License, or -+# (at your option) any later version. -+# -+# This program is distributed in the hope that it will be useful, -+# but WITHOUT ANY WARRANTY; without even the implied warranty of -+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+# GNU General Public License for more details. -+# -+# You should have received a copy of the GNU General Public License -+# along with this program. If not, see . -+# -+ -+"""Tests for samba.dcerpc.samr.password""" -+ -+import os -+import ctypes -+import samba.tests -+ -+from samba import crypto, generate_random_password, generate_random_bytes, ntstatus -+from samba.auth import system_session -+from samba.credentials import Credentials -+from samba.credentials import SMB_ENCRYPTION_REQUIRED -+from samba.dcerpc import samr, security, lsa -+from samba.samdb import SamDB -+from samba.tests import RpcInterfaceTestCase -+ -+ -+class SamrPasswordTests(RpcInterfaceTestCase): -+ def setUp(self): -+ super(SamrPasswordTests, self).setUp() -+ self.open_samdb() -+ -+ self.create_user_account(10000) -+ -+ self.remote_server = samba.tests.env_get_var_value('SERVER') -+ self.remote_domain = samba.tests.env_get_var_value('DOMAIN') -+ self.remote_user = samba.tests.env_get_var_value('USERNAME') -+ self.remote_password = samba.tests.env_get_var_value('PASSWORD') -+ self.remote_binding_string = "ncacn_np:%s[krb5]" % (self.remote_server) -+ -+ self.remote_creds = Credentials() -+ self.remote_creds.guess(self.lp) -+ self.remote_creds.set_username(self.remote_user) -+ self.remote_creds.set_password(self.remote_password) -+ -+ def tearDown(self): -+ super(SamrPasswordTests, self).tearDown() -+ -+ samr.Close(self.user_handle) -+ samr.Close(self.domain_handle) -+ samr.Close(self.handle) -+ -+ samba.tests.delete_force(self.samdb, self.user_dn) -+ -+ # -+ # Open the samba database -+ # -+ def open_samdb(self): -+ self.lp = samba.tests.env_loadparm() -+ -+ self.local_creds = Credentials() -+ self.local_creds.guess(self.lp) -+ self.session = system_session() -+ self.samdb = SamDB(session_info=self.session, -+ credentials=self.local_creds, -+ lp=self.lp) -+ -+ # -+ # Open a SAMR Domain handle -+ # -+ def open_domain_handle(self): -+ self.handle = self.conn.Connect2(None, -+ security.SEC_FLAG_MAXIMUM_ALLOWED) -+ -+ self.domain_sid = self.conn.LookupDomain(self.handle, -+ lsa.String(self.remote_domain)) -+ -+ self.domain_handle = self.conn.OpenDomain(self.handle, -+ security.SEC_FLAG_MAXIMUM_ALLOWED, -+ self.domain_sid) -+ -+ def open_user_handle(self): -+ name = lsa.String(self.user_name) -+ -+ rids = self.conn.LookupNames(self.domain_handle, [name]) -+ -+ self.user_handle = self.conn.OpenUser(self.domain_handle, -+ security.SEC_FLAG_MAXIMUM_ALLOWED, -+ rids[0].ids[0]) -+ # -+ # Create a test user account -+ # -+ def create_user_account(self, user_id): -+ self.user_name = ("SAMR_USER_%d" % user_id) -+ self.user_pass = generate_random_password(32, 32) -+ self.user_dn = "cn=%s,cn=users,%s" % (self.user_name, self.samdb.domain_dn()) -+ -+ samba.tests.delete_force(self.samdb, self.user_dn) -+ -+ self.samdb.newuser(self.user_name, -+ self.user_pass, -+ description="Password for " + self.user_name + " is " + self.user_pass, -+ givenname=self.user_name, -+ surname=self.user_name) -+ -+ -+ def init_samr_CryptPassword(self, password, session_key): -+ -+ def encode_pw_buffer(password): -+ data = bytearray([0] * 516) -+ -+ p = samba.string_to_byte_array(password.encode('utf-16-le')) -+ plen = len(p) -+ -+ b = generate_random_bytes(512 - plen) -+ -+ i = 512 - plen -+ data[0:i] = b -+ data[i:i+plen] = p -+ data[512:516] = plen.to_bytes(4, byteorder='little') -+ -+ return bytes(data) -+ -+ # This is a test, so always allow to encrypt using RC4 -+ try: -+ crypto.set_relax_mode() -+ encrypted_blob = samba.arcfour_encrypt(session_key, encode_pw_buffer(password)) -+ finally: -+ crypto.set_strict_mode() -+ -+ out_blob = samr.CryptPassword() -+ out_blob.data = list(encrypted_blob) -+ -+ return out_blob -+ -+ -+ def test_setUserInfo2_Password(self, password='P@ssw0rd'): -+ self.conn = samr.samr(self.remote_binding_string, -+ self.get_loadparm(), -+ self.remote_creds) -+ self.open_domain_handle() -+ self.open_user_handle() -+ -+ password='P@ssw0rd' -+ -+ level = 24 -+ info = samr.UserInfo24() -+ -+ info.password_expired = 0 -+ info.password = self.init_samr_CryptPassword(password, self.conn.session_key) -+ -+ # If the server is in FIPS mode, it should reject the password change! -+ try: -+ self.conn.SetUserInfo2(self.user_handle, level, info) -+ except samba.NTSTATUSError as e: -+ code = ctypes.c_uint32(e.args[0]).value -+ print(code) -+ if ((code == ntstatus.NT_STATUS_ACCESS_DENIED) and -+ (self.lp.weak_crypto == 'disallowed')): -+ pass -+ else: -+ raise -+ -+ -+ def test_setUserInfo2_Password_Encrypted(self, password='P@ssw0rd'): -+ self.remote_creds.set_smb_encryption(SMB_ENCRYPTION_REQUIRED) -+ -+ self.conn = samr.samr(self.remote_binding_string, -+ self.get_loadparm(), -+ self.remote_creds) -+ self.open_domain_handle() -+ self.open_user_handle() -+ -+ password='P@ssw0rd' -+ -+ level = 24 -+ info = samr.UserInfo24() -+ -+ info.password_expired = 0 -+ info.password = self.init_samr_CryptPassword(password, self.conn.session_key) -+ -+ self.conn.SetUserInfo2(self.user_handle, level, info) -diff --git a/selftest/tests.py b/selftest/tests.py -index adcb5b53189..86cab3f8046 100644 ---- a/selftest/tests.py -+++ b/selftest/tests.py -@@ -93,6 +93,8 @@ planpythontestsuite( - os.path.join(samba4srcdir, "..", "third_party", "waf")]) - planpythontestsuite("fileserver", "samba.tests.smbd_fuzztest") - planpythontestsuite("nt4_dc_smb1", "samba.tests.dcerpc.binding") -+for env in [ 'ad_dc:local', 'ad_dc_fips:local' ]: -+ planpythontestsuite(env, "samba.tests.dcerpc.samr_change_password") - - - def cmdline(script, *args): --- -2.29.2 - - -From de2b1caebf0183bd24d06969ebf7d03223f7d9fc Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Wed, 21 Oct 2020 10:09:22 +0200 -Subject: [PATCH 085/104] python:tests: Add SAMR password change tests for fips - -Signed-off-by: Andreas Schneider -Reviewed-by: Alexander Bokovoy - -Autobuild-User(master): Andreas Schneider -Autobuild-Date(master): Thu Oct 29 15:41:37 UTC 2020 on sn-devel-184 - -(cherry picked from commit ebd687335b9accfdbae7dbc65c9882ab4d5c0986) ---- - selftest/target/Samba4.pm | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/selftest/target/Samba4.pm b/selftest/target/Samba4.pm -index 649e923ff9a..1ebdf2a5484 100755 ---- a/selftest/target/Samba4.pm -+++ b/selftest/target/Samba4.pm -@@ -1040,7 +1040,7 @@ servicePrincipalName: http/testupnspn.$ctx->{dnsname} - $samba_tool_cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" "; - $samba_tool_cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" "; - $samba_tool_cmd .= Samba::bindir_path($self, "samba-tool") -- . " group addmembers --configfile=$ctx->{smb_conf} 'Allowed RODC Password Replication Group' '$testallowed_account'"; -+ . " group addmembers --configfile=$ctx->{smb_conf} 'Allowed RODC Password Replication Group' '$testallowed_account' -d10"; - unless (system($samba_tool_cmd) == 0) { - warn("Unable to add '$testallowed_account' user to 'Allowed RODC Password Replication Group': \n$samba_tool_cmd\n"); - return undef; --- -2.29.2 - - -From 5f240ac738df737712cbc2cdd40c8a56ab9e165b Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Thu, 20 Aug 2020 09:40:41 +0200 -Subject: [PATCH 086/104] auth:creds: Rename CRED_USE_KERBEROS values - -Signed-off-by: Andreas Schneider -Reviewed-by: Alexander Bokovoy -(cherry picked from commit 1298280a22ef7494fb85a6a5953bae15d22fa204) ---- - auth/credentials/credentials.c | 8 +++++--- - auth/credentials/credentials.h | 9 ++++++--- - auth/credentials/credentials_krb5.c | 4 ++-- - auth/credentials/credentials_ntlm.c | 2 +- - auth/credentials/credentials_secrets.c | 5 +++-- - auth/credentials/pycredentials.c | 6 +++--- - auth/credentials/tests/simple.c | 2 +- - auth/credentials/wscript_build | 2 +- - auth/gensec/gensec_start.c | 8 ++++---- - examples/winexe/winexe.c | 4 ++-- - source3/auth/auth_generic.c | 4 ++-- - source3/lib/util_cmdline.c | 18 +++++++++--------- - source3/libads/sasl.c | 8 ++++---- - source3/libnet/libnet_join.c | 2 +- - source3/libsmb/cliconnect.c | 16 ++++++++-------- - source3/passdb/passdb.c | 6 +++--- - source3/passdb/pdb_samba_dsdb.c | 4 ++-- - source3/rpc_client/cli_pipe.c | 2 +- - source3/rpcclient/rpcclient.c | 8 ++++---- - source3/utils/net_ads.c | 2 +- - source3/utils/net_util.c | 6 +++--- - source3/utils/ntlm_auth.c | 4 ++-- - source3/winbindd/winbindd_cm.c | 2 +- - source4/auth/gensec/gensec_gssapi.c | 2 +- - source4/auth/session.c | 2 +- - source4/lib/cmdline/popt_credentials.c | 4 ++-- - source4/torture/ldap/session_expiry.c | 2 +- - source4/torture/raw/session.c | 4 ++-- - source4/torture/rpc/schannel.c | 4 ++-- - source4/torture/smb2/session.c | 12 ++++++------ - 30 files changed, 84 insertions(+), 78 deletions(-) - -diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c -index 77c35dd104b..1bdd6f15a09 100644 ---- a/auth/credentials/credentials.c -+++ b/auth/credentials/credentials.c -@@ -44,6 +44,8 @@ _PUBLIC_ struct cli_credentials *cli_credentials_init(TALLOC_CTX *mem_ctx) - - cred->winbind_separator = '\\'; - -+ cred->use_kerberos = CRED_USE_KERBEROS_DESIRED; -+ - cred->signing_state = SMB_SIGNING_DEFAULT; - - /* -@@ -360,7 +362,7 @@ _PUBLIC_ bool cli_credentials_authentication_requested(struct cli_credentials *c - return true; - } - -- if (cli_credentials_get_kerberos_state(cred) == CRED_MUST_USE_KERBEROS) { -+ if (cli_credentials_get_kerberos_state(cred) == CRED_USE_KERBEROS_REQUIRED) { - return true; - } - -@@ -1018,7 +1020,7 @@ _PUBLIC_ void cli_credentials_guess(struct cli_credentials *cred, - } - - if (lp_ctx != NULL && -- cli_credentials_get_kerberos_state(cred) != CRED_DONT_USE_KERBEROS) { -+ cli_credentials_get_kerberos_state(cred) != CRED_USE_KERBEROS_DISABLED) { - cli_credentials_set_ccache(cred, lp_ctx, NULL, CRED_GUESS_FILE, - &error_string); - } -@@ -1097,7 +1099,7 @@ _PUBLIC_ void cli_credentials_set_anonymous(struct cli_credentials *cred) - cli_credentials_set_principal(cred, NULL, CRED_SPECIFIED); - cli_credentials_set_realm(cred, NULL, CRED_SPECIFIED); - cli_credentials_set_workstation(cred, "", CRED_UNINITIALISED); -- cli_credentials_set_kerberos_state(cred, CRED_DONT_USE_KERBEROS); -+ cli_credentials_set_kerberos_state(cred, CRED_USE_KERBEROS_DISABLED); - } - - /** -diff --git a/auth/credentials/credentials.h b/auth/credentials/credentials.h -index 438bcdce232..f468b8558dd 100644 ---- a/auth/credentials/credentials.h -+++ b/auth/credentials/credentials.h -@@ -53,9 +53,12 @@ enum credentials_obtained { - }; - - enum credentials_use_kerberos { -- CRED_AUTO_USE_KERBEROS = 0, /* Default, we try kerberos if available */ -- CRED_DONT_USE_KERBEROS, /* Sometimes trying kerberos just does 'bad things', so don't */ -- CRED_MUST_USE_KERBEROS /* Sometimes administrators are parinoid, so always do kerberos */ -+ /** Sometimes trying kerberos just does 'bad things', so don't */ -+ CRED_USE_KERBEROS_DISABLED = 0, -+ /** Default, we try kerberos if available */ -+ CRED_USE_KERBEROS_DESIRED, -+ /** Sometimes administrators are paranoid, so always do kerberos */ -+ CRED_USE_KERBEROS_REQUIRED, - }; - - enum credentials_krb_forwardable { -diff --git a/auth/credentials/credentials_krb5.c b/auth/credentials/credentials_krb5.c -index 259b35b73b0..36f6b59a72b 100644 ---- a/auth/credentials/credentials_krb5.c -+++ b/auth/credentials/credentials_krb5.c -@@ -871,7 +871,7 @@ _PUBLIC_ int cli_credentials_get_client_gss_creds(struct cli_credentials *cred, - ret = cli_credentials_get_ccache(cred, event_ctx, lp_ctx, - &ccache, error_string); - if (ret) { -- if (cli_credentials_get_kerberos_state(cred) == CRED_MUST_USE_KERBEROS) { -+ if (cli_credentials_get_kerberos_state(cred) == CRED_USE_KERBEROS_REQUIRED) { - DEBUG(1, ("Failed to get kerberos credentials (kerberos required): %s\n", *error_string)); - } else { - DEBUG(4, ("Failed to get kerberos credentials: %s\n", *error_string)); -@@ -1431,7 +1431,7 @@ _PUBLIC_ void cli_credentials_set_impersonate_principal(struct cli_credentials * - cred->impersonate_principal = talloc_strdup(cred, principal); - talloc_free(cred->self_service); - cred->self_service = talloc_strdup(cred, self_service); -- cli_credentials_set_kerberos_state(cred, CRED_MUST_USE_KERBEROS); -+ cli_credentials_set_kerberos_state(cred, CRED_USE_KERBEROS_REQUIRED); - } - - /* -diff --git a/auth/credentials/credentials_ntlm.c b/auth/credentials/credentials_ntlm.c -index f1b22a6c9e2..1bec60e5dce 100644 ---- a/auth/credentials/credentials_ntlm.c -+++ b/auth/credentials/credentials_ntlm.c -@@ -53,7 +53,7 @@ _PUBLIC_ NTSTATUS cli_credentials_get_ntlm_response(struct cli_credentials *cred - const struct samr_Password *nt_hash = NULL; - int rc; - -- if (cred->use_kerberos == CRED_MUST_USE_KERBEROS) { -+ if (cred->use_kerberos == CRED_USE_KERBEROS_REQUIRED) { - TALLOC_FREE(frame); - return NT_STATUS_INVALID_PARAMETER_MIX; - } -diff --git a/auth/credentials/credentials_secrets.c b/auth/credentials/credentials_secrets.c -index 52a89d4d5b4..58067a5bece 100644 ---- a/auth/credentials/credentials_secrets.c -+++ b/auth/credentials/credentials_secrets.c -@@ -370,7 +370,8 @@ _PUBLIC_ NTSTATUS cli_credentials_set_machine_account_db_ctx(struct cli_credenti - } - - if (secrets_tdb_password_more_recent) { -- enum credentials_use_kerberos use_kerberos = CRED_DONT_USE_KERBEROS; -+ enum credentials_use_kerberos use_kerberos = -+ CRED_USE_KERBEROS_DISABLED; - char *machine_account = talloc_asprintf(tmp_ctx, "%s$", lpcfg_netbios_name(lp_ctx)); - cli_credentials_set_password(cred, secrets_tdb_password, CRED_SPECIFIED); - cli_credentials_set_old_password(cred, secrets_tdb_old_password, CRED_SPECIFIED); -@@ -386,7 +387,7 @@ _PUBLIC_ NTSTATUS cli_credentials_set_machine_account_db_ctx(struct cli_credenti - - FALL_THROUGH; - case ROLE_ACTIVE_DIRECTORY_DC: -- use_kerberos = CRED_AUTO_USE_KERBEROS; -+ use_kerberos = CRED_USE_KERBEROS_DESIRED; - break; - } - } -diff --git a/auth/credentials/pycredentials.c b/auth/credentials/pycredentials.c -index 17c90573f09..95dde276ef7 100644 ---- a/auth/credentials/pycredentials.c -+++ b/auth/credentials/pycredentials.c -@@ -1492,9 +1492,9 @@ MODULE_INIT_FUNC(credentials) - PyModule_AddObject(m, "CALLBACK_RESULT", PyLong_FromLong(CRED_CALLBACK_RESULT)); - PyModule_AddObject(m, "SPECIFIED", PyLong_FromLong(CRED_SPECIFIED)); - -- PyModule_AddObject(m, "AUTO_USE_KERBEROS", PyLong_FromLong(CRED_AUTO_USE_KERBEROS)); -- PyModule_AddObject(m, "DONT_USE_KERBEROS", PyLong_FromLong(CRED_DONT_USE_KERBEROS)); -- PyModule_AddObject(m, "MUST_USE_KERBEROS", PyLong_FromLong(CRED_MUST_USE_KERBEROS)); -+ PyModule_AddObject(m, "AUTO_USE_KERBEROS", PyLong_FromLong(CRED_USE_KERBEROS_DESIRED)); -+ PyModule_AddObject(m, "DONT_USE_KERBEROS", PyLong_FromLong(CRED_USE_KERBEROS_DISABLED)); -+ PyModule_AddObject(m, "MUST_USE_KERBEROS", PyLong_FromLong(CRED_USE_KERBEROS_REQUIRED)); - - PyModule_AddObject(m, "AUTO_KRB_FORWARDABLE", PyLong_FromLong(CRED_AUTO_KRB_FORWARDABLE)); - PyModule_AddObject(m, "NO_KRB_FORWARDABLE", PyLong_FromLong(CRED_NO_KRB_FORWARDABLE)); -diff --git a/auth/credentials/tests/simple.c b/auth/credentials/tests/simple.c -index 7f122bed3bc..b39d7a2251b 100644 ---- a/auth/credentials/tests/simple.c -+++ b/auth/credentials/tests/simple.c -@@ -73,7 +73,7 @@ static bool test_guess(struct torture_context *tctx) - const char *passwd_fd = getenv("PASSWD_FD"); - const char *passwd_file = getenv("PASSWD_FILE"); - -- cli_credentials_set_kerberos_state(creds, CRED_MUST_USE_KERBEROS); -+ cli_credentials_set_kerberos_state(creds, CRED_USE_KERBEROS_REQUIRED); - - unsetenv("USER"); - unsetenv("PASSWD_FD"); -diff --git a/auth/credentials/wscript_build b/auth/credentials/wscript_build -index 1e3302e3e48..ad16b7d8008 100644 ---- a/auth/credentials/wscript_build -+++ b/auth/credentials/wscript_build -@@ -5,7 +5,7 @@ bld.SAMBA_LIBRARY('samba-credentials', - public_headers='credentials.h', - pc_files='samba-credentials.pc', - deps='LIBCRYPTO samba-errors events LIBCLI_AUTH samba-security CREDENTIALS_SECRETS CREDENTIALS_KRB5', -- vnum='0.1.0' -+ vnum='1.0.0' - ) - - bld.SAMBA_SUBSYSTEM('CREDENTIALS_KRB5', -diff --git a/auth/gensec/gensec_start.c b/auth/gensec/gensec_start.c -index 3f42d611140..56306efed13 100644 ---- a/auth/gensec/gensec_start.c -+++ b/auth/gensec/gensec_start.c -@@ -117,18 +117,18 @@ static const struct gensec_security_ops **gensec_use_kerberos_mechs( - } - - switch (use_kerberos) { -- case CRED_AUTO_USE_KERBEROS: -+ case CRED_USE_KERBEROS_DESIRED: - keep = true; - break; - -- case CRED_DONT_USE_KERBEROS: -+ case CRED_USE_KERBEROS_DISABLED: - if (old_gensec_list[i]->kerberos == false) { - keep = true; - } - - break; - -- case CRED_MUST_USE_KERBEROS: -+ case CRED_USE_KERBEROS_REQUIRED: - if (old_gensec_list[i]->kerberos == true) { - keep = true; - } -@@ -156,7 +156,7 @@ _PUBLIC_ const struct gensec_security_ops **gensec_security_mechs( - TALLOC_CTX *mem_ctx) - { - const struct gensec_security_ops * const *backends = gensec_security_all(); -- enum credentials_use_kerberos use_kerberos = CRED_AUTO_USE_KERBEROS; -+ enum credentials_use_kerberos use_kerberos = CRED_USE_KERBEROS_DESIRED; - bool keep_schannel = false; - - if (gensec_security != NULL) { -diff --git a/examples/winexe/winexe.c b/examples/winexe/winexe.c -index 03e7ec85198..95386211c0a 100644 ---- a/examples/winexe/winexe.c -+++ b/examples/winexe/winexe.c -@@ -283,8 +283,8 @@ static void parse_args(int argc, const char *argv[], - if (opt_kerberos) { - cli_credentials_set_kerberos_state(cred, - strcmp(opt_kerberos, "yes") -- ? CRED_MUST_USE_KERBEROS -- : CRED_DONT_USE_KERBEROS); -+ ? CRED_USE_KERBEROS_REQUIRED -+ : CRED_USE_KERBEROS_DISABLED); - } - - if (options->runas == NULL && options->runas_file != NULL) { -diff --git a/source3/auth/auth_generic.c b/source3/auth/auth_generic.c -index 0e9500ac08d..f314acd9559 100644 ---- a/source3/auth/auth_generic.c -+++ b/source3/auth/auth_generic.c -@@ -356,9 +356,9 @@ NTSTATUS auth_generic_prepare(TALLOC_CTX *mem_ctx, - cli_credentials_set_conf(server_credentials, lp_ctx); - - if (lp_security() == SEC_ADS || USE_KERBEROS_KEYTAB) { -- cli_credentials_set_kerberos_state(server_credentials, CRED_AUTO_USE_KERBEROS); -+ cli_credentials_set_kerberos_state(server_credentials, CRED_USE_KERBEROS_DESIRED); - } else { -- cli_credentials_set_kerberos_state(server_credentials, CRED_DONT_USE_KERBEROS); -+ cli_credentials_set_kerberos_state(server_credentials, CRED_USE_KERBEROS_DISABLED); - } - - nt_status = gensec_server_start(tmp_ctx, gensec_settings, -diff --git a/source3/lib/util_cmdline.c b/source3/lib/util_cmdline.c -index 9c9e2f0ac0f..d2af34ee19b 100644 ---- a/source3/lib/util_cmdline.c -+++ b/source3/lib/util_cmdline.c -@@ -307,9 +307,9 @@ void set_cmdline_auth_info_use_kerberos(struct user_auth_info *auth_info, - enum credentials_use_kerberos krb5_state; - - if (b) { -- krb5_state = CRED_MUST_USE_KERBEROS; -+ krb5_state = CRED_USE_KERBEROS_REQUIRED; - } else { -- krb5_state = CRED_DONT_USE_KERBEROS; -+ krb5_state = CRED_USE_KERBEROS_DISABLED; - } - - cli_credentials_set_kerberos_state(auth_info->creds, krb5_state); -@@ -321,7 +321,7 @@ bool get_cmdline_auth_info_use_kerberos(const struct user_auth_info *auth_info) - - krb5_state = cli_credentials_get_kerberos_state(auth_info->creds); - -- if (krb5_state == CRED_MUST_USE_KERBEROS) { -+ if (krb5_state == CRED_USE_KERBEROS_REQUIRED) { - return true; - } - -@@ -336,17 +336,17 @@ void set_cmdline_auth_info_fallback_after_kerberos(struct user_auth_info *auth_i - krb5_state = cli_credentials_get_kerberos_state(auth_info->creds); - - switch (krb5_state) { -- case CRED_MUST_USE_KERBEROS: -+ case CRED_USE_KERBEROS_REQUIRED: - if (b) { -- krb5_state = CRED_AUTO_USE_KERBEROS; -+ krb5_state = CRED_USE_KERBEROS_DESIRED; - } - break; -- case CRED_AUTO_USE_KERBEROS: -+ case CRED_USE_KERBEROS_DESIRED: - if (!b) { -- krb5_state = CRED_MUST_USE_KERBEROS; -+ krb5_state = CRED_USE_KERBEROS_REQUIRED; - } - break; -- case CRED_DONT_USE_KERBEROS: -+ case CRED_USE_KERBEROS_DISABLED: - /* nothing to do */ - break; - } -@@ -360,7 +360,7 @@ bool get_cmdline_auth_info_fallback_after_kerberos(const struct user_auth_info * - - krb5_state = cli_credentials_get_kerberos_state(auth_info->creds); - -- if (krb5_state == CRED_AUTO_USE_KERBEROS) { -+ if (krb5_state == CRED_USE_KERBEROS_DESIRED) { - return true; - } - -diff --git a/source3/libads/sasl.c b/source3/libads/sasl.c -index 87beeafe3ed..90ffa040ec0 100644 ---- a/source3/libads/sasl.c -+++ b/source3/libads/sasl.c -@@ -158,7 +158,7 @@ static ADS_STATUS ads_sasl_spnego_gensec_bind(ADS_STRUCT *ads, - use_spnego_principal = false; - } - -- if (krb5_state == CRED_DONT_USE_KERBEROS) { -+ if (krb5_state == CRED_USE_KERBEROS_DISABLED) { - use_spnego_principal = false; - } - -@@ -565,7 +565,7 @@ static ADS_STATUS ads_sasl_spnego_bind(ADS_STRUCT *ads) - { - - status = ads_sasl_spnego_gensec_bind(ads, "GSS-SPNEGO", -- CRED_MUST_USE_KERBEROS, -+ CRED_USE_KERBEROS_REQUIRED, - p.service, p.hostname, - blob); - if (ADS_ERR_OK(status)) { -@@ -581,7 +581,7 @@ static ADS_STATUS ads_sasl_spnego_bind(ADS_STRUCT *ads) - - if (ADS_ERR_OK(status)) { - status = ads_sasl_spnego_gensec_bind(ads, "GSS-SPNEGO", -- CRED_MUST_USE_KERBEROS, -+ CRED_USE_KERBEROS_REQUIRED, - p.service, p.hostname, - blob); - if (!ADS_ERR_OK(status)) { -@@ -616,7 +616,7 @@ static ADS_STATUS ads_sasl_spnego_bind(ADS_STRUCT *ads) - library for HMAC_MD4 encryption */ - mech = "NTLMSSP"; - status = ads_sasl_spnego_gensec_bind(ads, "GSS-SPNEGO", -- CRED_DONT_USE_KERBEROS, -+ CRED_USE_KERBEROS_DISABLED, - p.service, p.hostname, - data_blob_null); - done: -diff --git a/source3/libnet/libnet_join.c b/source3/libnet/libnet_join.c -index f3bf27e6c00..bd3aeec9434 100644 ---- a/source3/libnet/libnet_join.c -+++ b/source3/libnet/libnet_join.c -@@ -1707,7 +1707,7 @@ NTSTATUS libnet_join_ok(struct messaging_context *msg_ctx, - - if (use_kerberos) { - cli_credentials_set_kerberos_state(cli_creds, -- CRED_MUST_USE_KERBEROS); -+ CRED_USE_KERBEROS_REQUIRED); - } - - status = cli_full_connection_creds(&cli, NULL, -diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c -index abfd18bfaf1..f7b4741de89 100644 ---- a/source3/libsmb/cliconnect.c -+++ b/source3/libsmb/cliconnect.c -@@ -124,13 +124,13 @@ struct cli_credentials *cli_session_creds_init(TALLOC_CTX *mem_ctx, - - if (use_kerberos && fallback_after_kerberos) { - cli_credentials_set_kerberos_state(creds, -- CRED_AUTO_USE_KERBEROS); -+ CRED_USE_KERBEROS_DESIRED); - } else if (use_kerberos) { - cli_credentials_set_kerberos_state(creds, -- CRED_MUST_USE_KERBEROS); -+ CRED_USE_KERBEROS_REQUIRED); - } else { - cli_credentials_set_kerberos_state(creds, -- CRED_DONT_USE_KERBEROS); -+ CRED_USE_KERBEROS_DISABLED); - } - - if (use_ccache) { -@@ -255,7 +255,7 @@ NTSTATUS cli_session_creds_prepare_krb5(struct cli_state *cli, - - krb5_state = cli_credentials_get_kerberos_state(creds); - -- if (krb5_state != CRED_DONT_USE_KERBEROS) { -+ if (krb5_state != CRED_USE_KERBEROS_DISABLED) { - try_kerberos = true; - } - -@@ -275,7 +275,7 @@ NTSTATUS cli_session_creds_prepare_krb5(struct cli_state *cli, - try_kerberos = false; - } - -- if (krb5_state == CRED_MUST_USE_KERBEROS && !try_kerberos) { -+ if (krb5_state == CRED_USE_KERBEROS_REQUIRED && !try_kerberos) { - DEBUG(0, ("Kerberos auth with '%s' (%s\\%s) to access " - "'%s' not possible\n", - user_principal, user_domain, user_account, -@@ -286,7 +286,7 @@ NTSTATUS cli_session_creds_prepare_krb5(struct cli_state *cli, - - if (pass == NULL || strlen(pass) == 0) { - need_kinit = false; -- } else if (krb5_state == CRED_MUST_USE_KERBEROS) { -+ } else if (krb5_state == CRED_USE_KERBEROS_REQUIRED) { - need_kinit = try_kerberos; - } else { - need_kinit = try_kerberos; -@@ -321,14 +321,14 @@ NTSTATUS cli_session_creds_prepare_krb5(struct cli_state *cli, - if (ret != 0) { - int dbglvl = DBGLVL_NOTICE; - -- if (krb5_state == CRED_MUST_USE_KERBEROS) { -+ if (krb5_state == CRED_USE_KERBEROS_REQUIRED) { - dbglvl = DBGLVL_ERR; - } - - DEBUG(dbglvl, ("Kinit for %s to access %s failed: %s\n", - user_principal, target_hostname, - error_message(ret))); -- if (krb5_state == CRED_MUST_USE_KERBEROS) { -+ if (krb5_state == CRED_USE_KERBEROS_REQUIRED) { - TALLOC_FREE(frame); - return krb5_to_nt_status(ret); - } -diff --git a/source3/passdb/passdb.c b/source3/passdb/passdb.c -index 8ed1bafcea3..b12c845d9d2 100644 ---- a/source3/passdb/passdb.c -+++ b/source3/passdb/passdb.c -@@ -2630,7 +2630,7 @@ NTSTATUS pdb_get_trust_credentials(const char *netbios_domain, - /* - * It's not possible to use NTLMSSP with a domain trust account. - */ -- cli_credentials_set_kerberos_state(creds, CRED_MUST_USE_KERBEROS); -+ cli_credentials_set_kerberos_state(creds, CRED_USE_KERBEROS_REQUIRED); - } else { - /* - * We can't use kerberos against an NT4 domain. -@@ -2638,7 +2638,7 @@ NTSTATUS pdb_get_trust_credentials(const char *netbios_domain, - * We should have a mode that also disallows NTLMSSP here, - * as only NETLOGON SCHANNEL is possible. - */ -- cli_credentials_set_kerberos_state(creds, CRED_DONT_USE_KERBEROS); -+ cli_credentials_set_kerberos_state(creds, CRED_USE_KERBEROS_DISABLED); - } - - ok = cli_credentials_set_username(creds, account_name, CRED_SPECIFIED); -@@ -2656,7 +2656,7 @@ NTSTATUS pdb_get_trust_credentials(const char *netbios_domain, - /* - * We currently can't do kerberos just with an NTHASH. - */ -- cli_credentials_set_kerberos_state(creds, CRED_DONT_USE_KERBEROS); -+ cli_credentials_set_kerberos_state(creds, CRED_USE_KERBEROS_DISABLED); - goto done; - } - -diff --git a/source3/passdb/pdb_samba_dsdb.c b/source3/passdb/pdb_samba_dsdb.c -index 276bda88efc..93e8f5bebe6 100644 ---- a/source3/passdb/pdb_samba_dsdb.c -+++ b/source3/passdb/pdb_samba_dsdb.c -@@ -2599,13 +2599,13 @@ static NTSTATUS pdb_samba_dsdb_get_trusteddom_creds(struct pdb_methods *m, - * Force kerberos if this is an active directory domain - */ - cli_credentials_set_kerberos_state(creds, -- CRED_MUST_USE_KERBEROS); -+ CRED_USE_KERBEROS_REQUIRED); - } else { - /* - * TODO: we should allow krb5 with the raw nt hash. - */ - cli_credentials_set_kerberos_state(creds, -- CRED_DONT_USE_KERBEROS); -+ CRED_USE_KERBEROS_DISABLED); - } - - *_creds = talloc_move(mem_ctx, &creds); -diff --git a/source3/rpc_client/cli_pipe.c b/source3/rpc_client/cli_pipe.c -index 8227ef0b0bd..ba6c86cc227 100644 ---- a/source3/rpc_client/cli_pipe.c -+++ b/source3/rpc_client/cli_pipe.c -@@ -2637,7 +2637,7 @@ NTSTATUS rpccli_ncalrpc_bind_data(TALLOC_CTX *mem_ctx, - NAME_NT_AUTHORITY, /* domain */ - "SYSTEM", - NULL, /* password */ -- CRED_DONT_USE_KERBEROS, -+ CRED_USE_KERBEROS_DISABLED, - NULL, /* netlogon_creds_CredentialState */ - presult); - } -diff --git a/source3/rpcclient/rpcclient.c b/source3/rpcclient/rpcclient.c -index 575a42ebf70..a38f69f5592 100644 ---- a/source3/rpcclient/rpcclient.c -+++ b/source3/rpcclient/rpcclient.c -@@ -810,19 +810,19 @@ static NTSTATUS do_cmd(struct cli_state *cli, - case DCERPC_AUTH_TYPE_SPNEGO: - switch (pipe_default_auth_spnego_type) { - case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP: -- krb5_state = CRED_DONT_USE_KERBEROS; -+ krb5_state = CRED_USE_KERBEROS_DISABLED; - break; - case PIPE_AUTH_TYPE_SPNEGO_KRB5: -- krb5_state = CRED_MUST_USE_KERBEROS; -+ krb5_state = CRED_USE_KERBEROS_REQUIRED; - break; - case PIPE_AUTH_TYPE_SPNEGO_NONE: -- krb5_state = CRED_AUTO_USE_KERBEROS; -+ krb5_state = CRED_USE_KERBEROS_DESIRED; - break; - } - FALL_THROUGH; - case DCERPC_AUTH_TYPE_NTLMSSP: - case DCERPC_AUTH_TYPE_KRB5: -- if (krb5_state != CRED_AUTO_USE_KERBEROS) { -+ if (krb5_state != CRED_USE_KERBEROS_DESIRED) { - cli_credentials_set_kerberos_state(creds, - krb5_state); - } -diff --git a/source3/utils/net_ads.c b/source3/utils/net_ads.c -index 7f5b9c3a440..1a0e8a5c9dd 100644 ---- a/source3/utils/net_ads.c -+++ b/source3/utils/net_ads.c -@@ -2432,7 +2432,7 @@ static int net_ads_printer_publish(struct net_context *c, int argc, const char * - talloc_destroy(mem_ctx); - return -1; - } -- cli_credentials_set_kerberos_state(creds, CRED_MUST_USE_KERBEROS); -+ cli_credentials_set_kerberos_state(creds, CRED_USE_KERBEROS_REQUIRED); - - nt_status = cli_full_connection_creds(&cli, lp_netbios_name(), servername, - &server_ss, 0, -diff --git a/source3/utils/net_util.c b/source3/utils/net_util.c -index 5829d891075..6c5321db0fd 100644 ---- a/source3/utils/net_util.c -+++ b/source3/utils/net_util.c -@@ -493,13 +493,13 @@ struct cli_credentials *net_context_creds(struct net_context *c, - - if (c->opt_kerberos && c->opt_user_specified) { - cli_credentials_set_kerberos_state(creds, -- CRED_AUTO_USE_KERBEROS); -+ CRED_USE_KERBEROS_DESIRED); - } else if (c->opt_kerberos) { - cli_credentials_set_kerberos_state(creds, -- CRED_MUST_USE_KERBEROS); -+ CRED_USE_KERBEROS_REQUIRED); - } else { - cli_credentials_set_kerberos_state(creds, -- CRED_DONT_USE_KERBEROS); -+ CRED_USE_KERBEROS_DISABLED); - } - - if (c->opt_ccache) { -diff --git a/source3/utils/ntlm_auth.c b/source3/utils/ntlm_auth.c -index 7f8d2688978..bfaeff5188d 100644 ---- a/source3/utils/ntlm_auth.c -+++ b/source3/utils/ntlm_auth.c -@@ -1364,9 +1364,9 @@ static NTSTATUS ntlm_auth_prepare_gensec_server(TALLOC_CTX *mem_ctx, - cli_credentials_set_conf(server_credentials, lp_ctx); - - if (lp_server_role() == ROLE_ACTIVE_DIRECTORY_DC || lp_security() == SEC_ADS || USE_KERBEROS_KEYTAB) { -- cli_credentials_set_kerberos_state(server_credentials, CRED_AUTO_USE_KERBEROS); -+ cli_credentials_set_kerberos_state(server_credentials, CRED_USE_KERBEROS_DESIRED); - } else { -- cli_credentials_set_kerberos_state(server_credentials, CRED_DONT_USE_KERBEROS); -+ cli_credentials_set_kerberos_state(server_credentials, CRED_USE_KERBEROS_DISABLED); - } - - nt_status = gensec_server_start(tmp_ctx, gensec_settings, -diff --git a/source3/winbindd/winbindd_cm.c b/source3/winbindd/winbindd_cm.c -index 5fb22d7e9c8..466a0095ef2 100644 ---- a/source3/winbindd/winbindd_cm.c -+++ b/source3/winbindd/winbindd_cm.c -@@ -706,7 +706,7 @@ static NTSTATUS cm_get_ipc_credentials(TALLOC_CTX *mem_ctx, - } - - cli_credentials_set_conf(creds, lp_ctx); -- cli_credentials_set_kerberos_state(creds, CRED_DONT_USE_KERBEROS); -+ cli_credentials_set_kerberos_state(creds, CRED_USE_KERBEROS_DISABLED); - - ok = cli_credentials_set_domain(creds, netbios_domain, CRED_SPECIFIED); - if (!ok) { -diff --git a/source4/auth/gensec/gensec_gssapi.c b/source4/auth/gensec/gensec_gssapi.c -index d66abf32a7f..b668d4ed258 100644 ---- a/source4/auth/gensec/gensec_gssapi.c -+++ b/source4/auth/gensec/gensec_gssapi.c -@@ -1556,7 +1556,7 @@ static NTSTATUS gensec_gssapi_session_info(struct gensec_security *gensec_securi - } - - /* This credential handle isn't useful for password authentication, so ensure nobody tries to do that */ -- cli_credentials_set_kerberos_state(session_info->credentials, CRED_MUST_USE_KERBEROS); -+ cli_credentials_set_kerberos_state(session_info->credentials, CRED_USE_KERBEROS_REQUIRED); - - /* It has been taken from this place... */ - gensec_gssapi_state->delegated_cred_handle = GSS_C_NO_CREDENTIAL; -diff --git a/source4/auth/session.c b/source4/auth/session.c -index c5fc226a7d7..8e44dcd24f1 100644 ---- a/source4/auth/session.c -+++ b/source4/auth/session.c -@@ -295,7 +295,7 @@ struct auth_session_info *auth_session_info_from_transport(TALLOC_CTX *mem_ctx, - /* This credential handle isn't useful for password - * authentication, so ensure nobody tries to do that */ - cli_credentials_set_kerberos_state(creds, -- CRED_MUST_USE_KERBEROS); -+ CRED_USE_KERBEROS_REQUIRED); - - } - #endif -diff --git a/source4/lib/cmdline/popt_credentials.c b/source4/lib/cmdline/popt_credentials.c -index 5dd61f6339c..7d8963da99e 100644 ---- a/source4/lib/cmdline/popt_credentials.c -+++ b/source4/lib/cmdline/popt_credentials.c -@@ -120,8 +120,8 @@ static void popt_common_credentials_callback(poptContext con, - cli_credentials_set_kerberos_state( - popt_get_cmdline_credentials(), - use_kerberos -- ? CRED_MUST_USE_KERBEROS -- : CRED_DONT_USE_KERBEROS); -+ ? CRED_USE_KERBEROS_REQUIRED -+ : CRED_USE_KERBEROS_DISABLED); - break; - } - -diff --git a/source4/torture/ldap/session_expiry.c b/source4/torture/ldap/session_expiry.c -index 35dda439b17..e5e38450745 100644 ---- a/source4/torture/ldap/session_expiry.c -+++ b/source4/torture/ldap/session_expiry.c -@@ -55,7 +55,7 @@ bool torture_ldap_session_expiry(struct torture_context *torture) - torture, url!=NULL, ret, fail, "talloc_asprintf failed"); - - cli_credentials_set_kerberos_state( -- credentials, CRED_MUST_USE_KERBEROS); -+ credentials, CRED_USE_KERBEROS_REQUIRED); - - ok = lpcfg_set_option( - torture->lp_ctx, "gensec_gssapi:requested_life_time=4"); -diff --git a/source4/torture/raw/session.c b/source4/torture/raw/session.c -index 0c460ae3069..e246d25e9fb 100644 ---- a/source4/torture/raw/session.c -+++ b/source4/torture/raw/session.c -@@ -245,12 +245,12 @@ static bool test_session_expire1(struct torture_context *tctx) - - use_kerberos = cli_credentials_get_kerberos_state( - popt_get_cmdline_credentials()); -- if (use_kerberos != CRED_MUST_USE_KERBEROS) { -+ if (use_kerberos != CRED_USE_KERBEROS_REQUIRED) { - torture_warning(tctx, "smb2.session.expire1 requires -k yes!"); - torture_skip(tctx, "smb2.session.expire1 requires -k yes!"); - } - -- torture_assert_int_equal(tctx, use_kerberos, CRED_MUST_USE_KERBEROS, -+ torture_assert_int_equal(tctx, use_kerberos, CRED_USE_KERBEROS_REQUIRED, - "please use -k yes"); - - lpcfg_set_option(tctx->lp_ctx, "gensec_gssapi:requested_life_time=4"); -diff --git a/source4/torture/rpc/schannel.c b/source4/torture/rpc/schannel.c -index fff0b1aacbd..a5755041040 100644 ---- a/source4/torture/rpc/schannel.c -+++ b/source4/torture/rpc/schannel.c -@@ -965,8 +965,8 @@ bool torture_rpc_schannel_bench1(struct torture_context *torture) - torture_assert(torture, s->join_ctx2 != NULL, - "Failed to join domain with acct_flags=ACB_WSTRUST"); - -- cli_credentials_set_kerberos_state(s->wks_creds1, CRED_DONT_USE_KERBEROS); -- cli_credentials_set_kerberos_state(s->wks_creds2, CRED_DONT_USE_KERBEROS); -+ cli_credentials_set_kerberos_state(s->wks_creds1, CRED_USE_KERBEROS_DISABLED); -+ cli_credentials_set_kerberos_state(s->wks_creds2, CRED_USE_KERBEROS_DISABLED); - - for (i=0; i < s->nprocs; i++) { - struct cli_credentials *wks = s->wks_creds1; -diff --git a/source4/torture/smb2/session.c b/source4/torture/smb2/session.c -index 07c6faebb15..701dfc10a07 100644 ---- a/source4/torture/smb2/session.c -+++ b/source4/torture/smb2/session.c -@@ -956,7 +956,7 @@ bool test_session_reauth6(struct torture_context *tctx, struct smb2_tree *tree) - - krb_state = cli_credentials_get_kerberos_state( - popt_get_cmdline_credentials()); -- if (krb_state == CRED_MUST_USE_KERBEROS) { -+ if (krb_state == CRED_USE_KERBEROS_REQUIRED) { - torture_skip(tctx, - "Can't test failing session setup with kerberos."); - } -@@ -1064,12 +1064,12 @@ static bool test_session_expire1i(struct torture_context *tctx, - size_t i; - - use_kerberos = cli_credentials_get_kerberos_state(credentials); -- if (use_kerberos != CRED_MUST_USE_KERBEROS) { -+ if (use_kerberos != CRED_USE_KERBEROS_REQUIRED) { - torture_warning(tctx, "smb2.session.expire1 requires -k yes!"); - torture_skip(tctx, "smb2.session.expire1 requires -k yes!"); - } - -- torture_assert_int_equal(tctx, use_kerberos, CRED_MUST_USE_KERBEROS, -+ torture_assert_int_equal(tctx, use_kerberos, CRED_USE_KERBEROS_REQUIRED, - "please use -k yes"); - - cli_credentials_invalidate_ccache(credentials, CRED_SPECIFIED); -@@ -1250,12 +1250,12 @@ static bool test_session_expire2i(struct torture_context *tctx, - struct smb2_notify ntf2; - - use_kerberos = cli_credentials_get_kerberos_state(credentials); -- if (use_kerberos != CRED_MUST_USE_KERBEROS) { -+ if (use_kerberos != CRED_USE_KERBEROS_REQUIRED) { - torture_warning(tctx, "smb2.session.expire2 requires -k yes!"); - torture_skip(tctx, "smb2.session.expire2 requires -k yes!"); - } - -- torture_assert_int_equal(tctx, use_kerberos, CRED_MUST_USE_KERBEROS, -+ torture_assert_int_equal(tctx, use_kerberos, CRED_USE_KERBEROS_REQUIRED, - "please use -k yes"); - - cli_credentials_invalidate_ccache(credentials, CRED_SPECIFIED); -@@ -1612,7 +1612,7 @@ static bool test_session_expire_disconnect(struct torture_context *tctx) - bool connected; - - use_kerberos = cli_credentials_get_kerberos_state(credentials); -- if (use_kerberos != CRED_MUST_USE_KERBEROS) { -+ if (use_kerberos != CRED_USE_KERBEROS_REQUIRED) { - torture_warning(tctx, "smb2.session.expire1 requires -k yes!"); - torture_skip(tctx, "smb2.session.expire1 requires -k yes!"); - } --- -2.29.2 - - -From 03fb4e57548098264386dfd056f37ad2c86a937a Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Tue, 1 Sep 2020 12:32:28 +0200 -Subject: [PATCH 087/104] auth:creds:tests: Migrate test to a cmocka unit test - -Signed-off-by: Andreas Schneider -Reviewed-by: Alexander Bokovoy -(cherry picked from commit 1a92994a9513f5e73d30604a1dc217ddeb1ac8d5) ---- - auth/credentials/tests/test_creds.c | 221 ++++++++++++++++++++++++++++ - auth/credentials/wscript_build | 6 + - selftest/tests.py | 2 + - source4/torture/local/local.c | 1 - - source4/torture/local/wscript_build | 2 +- - 5 files changed, 230 insertions(+), 2 deletions(-) - create mode 100644 auth/credentials/tests/test_creds.c - -diff --git a/auth/credentials/tests/test_creds.c b/auth/credentials/tests/test_creds.c -new file mode 100644 -index 00000000000..d2d3d30d73d ---- /dev/null -+++ b/auth/credentials/tests/test_creds.c -@@ -0,0 +1,221 @@ -+/* -+ * Unix SMB/CIFS implementation. -+ * -+ * Copyright (C) 2018-2019 Andreas Schneider -+ * -+ * This program is free software; you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License as published by -+ * the Free Software Foundation; either version 3 of the License, or -+ * (at your option) any later version. -+ * -+ * This program is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ * GNU General Public License for more details. -+ * -+ * You should have received a copy of the GNU General Public License -+ * along with this program. If not, see . -+ */ -+ -+#include -+#include -+#include -+#include -+#include -+ -+#include "lib/replace/replace.h" -+#include "auth/credentials/credentials.c" -+ -+static int setup_talloc_context(void **state) -+{ -+ TALLOC_CTX *frame = talloc_stackframe(); -+ -+ *state = frame; -+ return 0; -+} -+ -+static int teardown_talloc_context(void **state) -+{ -+ TALLOC_CTX *frame = *state; -+ TALLOC_FREE(frame); -+ return 0; -+} -+ -+static void torture_creds_init(void **state) -+{ -+ TALLOC_CTX *mem_ctx = *state; -+ struct cli_credentials *creds = NULL; -+ const char *username = NULL; -+ const char *domain = NULL; -+ const char *password = NULL; -+ bool ok; -+ -+ creds = cli_credentials_init(mem_ctx); -+ assert_non_null(creds); -+ assert_null(creds->username); -+ assert_int_equal(creds->username_obtained, CRED_UNINITIALISED); -+ -+ domain = cli_credentials_get_domain(creds); -+ assert_null(domain); -+ ok = cli_credentials_set_domain(creds, "WURST", CRED_SPECIFIED); -+ assert_true(ok); -+ assert_int_equal(creds->domain_obtained, CRED_SPECIFIED); -+ domain = cli_credentials_get_domain(creds); -+ assert_string_equal(domain, "WURST"); -+ -+ username = cli_credentials_get_username(creds); -+ assert_null(username); -+ ok = cli_credentials_set_username(creds, "brot", CRED_SPECIFIED); -+ assert_true(ok); -+ assert_int_equal(creds->username_obtained, CRED_SPECIFIED); -+ username = cli_credentials_get_username(creds); -+ assert_string_equal(username, "brot"); -+ -+ password = cli_credentials_get_password(creds); -+ assert_null(password); -+ ok = cli_credentials_set_password(creds, "SECRET", CRED_SPECIFIED); -+ assert_true(ok); -+ assert_int_equal(creds->password_obtained, CRED_SPECIFIED); -+ password = cli_credentials_get_password(creds); -+ assert_string_equal(password, "SECRET"); -+} -+ -+static void torture_creds_init_anonymous(void **state) -+{ -+ TALLOC_CTX *mem_ctx = *state; -+ struct cli_credentials *creds = NULL; -+ -+ creds = cli_credentials_init_anon(mem_ctx); -+ assert_non_null(creds); -+ -+ assert_string_equal(creds->domain, ""); -+ assert_int_equal(creds->domain_obtained, CRED_SPECIFIED); -+ -+ assert_string_equal(creds->username, ""); -+ assert_int_equal(creds->username_obtained, CRED_SPECIFIED); -+ -+ assert_null(creds->password); -+ assert_int_equal(creds->password_obtained, CRED_SPECIFIED); -+} -+ -+static void torture_creds_guess(void **state) -+{ -+ TALLOC_CTX *mem_ctx = *state; -+ struct cli_credentials *creds = NULL; -+ const char *env_user = getenv("USER"); -+ -+ creds = cli_credentials_init(mem_ctx); -+ assert_non_null(creds); -+ -+ setenv("PASSWD", "SECRET", 1); -+ cli_credentials_guess(creds, NULL); -+ -+ assert_string_equal(creds->username, env_user); -+ assert_int_equal(creds->username_obtained, CRED_GUESS_ENV); -+ -+ assert_string_equal(creds->password, "SECRET"); -+ assert_int_equal(creds->password_obtained, CRED_GUESS_ENV); -+ unsetenv("PASSWD"); -+} -+ -+static void torture_creds_anon_guess(void **state) -+{ -+ TALLOC_CTX *mem_ctx = *state; -+ struct cli_credentials *creds = NULL; -+ -+ creds = cli_credentials_init_anon(mem_ctx); -+ assert_non_null(creds); -+ -+ setenv("PASSWD", "SECRET", 1); -+ cli_credentials_guess(creds, NULL); -+ -+ assert_string_equal(creds->username, ""); -+ assert_int_equal(creds->username_obtained, CRED_SPECIFIED); -+ -+ assert_null(creds->password); -+ assert_int_equal(creds->password_obtained, CRED_SPECIFIED); -+ unsetenv("PASSWD"); -+} -+ -+static void torture_creds_parse_string(void **state) -+{ -+ TALLOC_CTX *mem_ctx = *state; -+ struct cli_credentials *creds = NULL; -+ -+ creds = cli_credentials_init(mem_ctx); -+ assert_non_null(creds); -+ -+ /* Anonymous */ -+ cli_credentials_parse_string(creds, "%", CRED_SPECIFIED); -+ -+ assert_string_equal(creds->domain, ""); -+ assert_int_equal(creds->domain_obtained, CRED_SPECIFIED); -+ -+ assert_string_equal(creds->username, ""); -+ assert_int_equal(creds->username_obtained, CRED_SPECIFIED); -+ -+ assert_null(creds->password); -+ assert_int_equal(creds->password_obtained, CRED_SPECIFIED); -+ -+ /* Username + password */ -+ cli_credentials_parse_string(creds, "wurst%BROT", CRED_SPECIFIED); -+ -+ assert_string_equal(creds->domain, ""); -+ assert_int_equal(creds->domain_obtained, CRED_SPECIFIED); -+ -+ assert_string_equal(creds->username, "wurst"); -+ assert_int_equal(creds->username_obtained, CRED_SPECIFIED); -+ -+ assert_string_equal(creds->password, "BROT"); -+ assert_int_equal(creds->password_obtained, CRED_SPECIFIED); -+ -+ /* Domain + username + password */ -+ cli_credentials_parse_string(creds, "XXL\\wurst%BROT", CRED_SPECIFIED); -+ -+ assert_string_equal(creds->domain, "XXL"); -+ assert_int_equal(creds->domain_obtained, CRED_SPECIFIED); -+ -+ assert_string_equal(creds->username, "wurst"); -+ assert_int_equal(creds->username_obtained, CRED_SPECIFIED); -+ -+ assert_string_equal(creds->password, "BROT"); -+ assert_int_equal(creds->password_obtained, CRED_SPECIFIED); -+ -+ /* Principal */ -+ cli_credentials_parse_string(creds, "wurst@brot.realm", CRED_SPECIFIED); -+ -+ assert_string_equal(creds->domain, ""); -+ assert_int_equal(creds->domain_obtained, CRED_SPECIFIED); -+ -+ assert_string_equal(creds->username, "wurst@brot.realm"); -+ assert_int_equal(creds->username_obtained, CRED_SPECIFIED); -+ -+ assert_string_equal(creds->principal, "wurst@brot.realm"); -+ assert_int_equal(creds->principal_obtained, CRED_SPECIFIED); -+ -+ assert_string_equal(creds->password, "BROT"); -+ assert_int_equal(creds->password_obtained, CRED_SPECIFIED); -+} -+ -+int main(int argc, char *argv[]) -+{ -+ int rc; -+ const struct CMUnitTest tests[] = { -+ cmocka_unit_test(torture_creds_init), -+ cmocka_unit_test(torture_creds_init_anonymous), -+ cmocka_unit_test(torture_creds_guess), -+ cmocka_unit_test(torture_creds_anon_guess), -+ cmocka_unit_test(torture_creds_parse_string), -+ }; -+ -+ if (argc == 2) { -+ cmocka_set_test_filter(argv[1]); -+ } -+ cmocka_set_message_output(CM_OUTPUT_SUBUNIT); -+ -+ rc = cmocka_run_group_tests(tests, -+ setup_talloc_context, -+ teardown_talloc_context); -+ -+ return rc; -+} -diff --git a/auth/credentials/wscript_build b/auth/credentials/wscript_build -index ad16b7d8008..46111164b36 100644 ---- a/auth/credentials/wscript_build -+++ b/auth/credentials/wscript_build -@@ -31,3 +31,9 @@ bld.SAMBA_PYTHON('pycredentials', - public_deps='samba-credentials cmdline-credentials %s %s CREDENTIALS_KRB5 CREDENTIALS_SECRETS' % (pytalloc_util, pyparam_util), - realname='samba/credentials.so' - ) -+ -+bld.SAMBA_BINARY('test_creds', -+ source='tests/test_creds.c', -+ deps='cmocka samba-credentials', -+ local_include=False, -+ for_selftest=True) -diff --git a/selftest/tests.py b/selftest/tests.py -index 86cab3f8046..4a968cdbe8a 100644 ---- a/selftest/tests.py -+++ b/selftest/tests.py -@@ -418,3 +418,5 @@ plantestsuite("samba.unittests.test_oLschema2ldif", "none", - if with_elasticsearch_backend: - plantestsuite("samba.unittests.mdsparser_es", "none", - [os.path.join(bindir(), "default/source3/test_mdsparser_es")] + [configuration]) -+plantestsuite("samba.unittests.credentials", "none", -+ [os.path.join(bindir(), "default/auth/credentials/test_creds")]) -diff --git a/source4/torture/local/local.c b/source4/torture/local/local.c -index a3186788524..d19b55e9502 100644 ---- a/source4/torture/local/local.c -+++ b/source4/torture/local/local.c -@@ -70,7 +70,6 @@ - torture_local_tevent_req, - torture_local_torture, - torture_local_dbspeed, -- torture_local_credentials, - torture_ldb, - torture_dsdb_dn, - torture_dsdb_syntax, -diff --git a/source4/torture/local/wscript_build b/source4/torture/local/wscript_build -index 38b6c8f4b6e..f0ab0357986 100644 ---- a/source4/torture/local/wscript_build -+++ b/source4/torture/local/wscript_build -@@ -16,7 +16,7 @@ TORTURE_LOCAL_SOURCE = '''../../../lib/util/charset/tests/iconv.c - ../../libcli/security/tests/sddl.c ../../../lib/tdr/testsuite.c - ../../../lib/tevent/testsuite.c ../../param/tests/share.c - ../../../lib/tevent/test_req.c -- ../../param/tests/loadparm.c ../../../auth/credentials/tests/simple.c local.c -+ ../../param/tests/loadparm.c local.c - dbspeed.c torture.c ../ldb/ldb.c ../../dsdb/common/tests/dsdb_dn.c - ../../dsdb/schema/tests/schema_syntax.c - ../../../lib/util/tests/anonymous_shared.c --- -2.29.2 - - -From 82565bd73ee76d51b6569743644be1b916461acd Mon Sep 17 00:00:00 2001 -From: Isaac Boukris -Date: Thu, 20 Aug 2020 12:09:05 +0200 -Subject: [PATCH 088/104] Add smb2cli_session_get_encryption_cipher() - -When 'session->smb2->should_encrypt' is true, the client MUST encrypt -all transport messages (see also MS-SMB2 3.2.4.1.8). - -Signed-off-by: Isaac Boukris -Reviewed-by: Stefan Metzmacher -Reviewed-by: Alexander Bokovoy -(cherry picked from commit f0f8de9d4a4e05445e427f00bb10eb34e1110a97) ---- - libcli/smb/smbXcli_base.c | 13 +++++++++++++ - libcli/smb/smbXcli_base.h | 1 + - 2 files changed, 14 insertions(+) - -diff --git a/libcli/smb/smbXcli_base.c b/libcli/smb/smbXcli_base.c -index 4909797543c..1be3a5506a0 100644 ---- a/libcli/smb/smbXcli_base.c -+++ b/libcli/smb/smbXcli_base.c -@@ -6461,6 +6461,19 @@ NTSTATUS smb2cli_session_encryption_on(struct smbXcli_session *session) - return NT_STATUS_OK; - } - -+uint16_t smb2cli_session_get_encryption_cipher(struct smbXcli_session *session) -+{ -+ if (session->conn->protocol < PROTOCOL_SMB2_24) { -+ return 0; -+ } -+ -+ if (!session->smb2->should_encrypt) { -+ return 0; -+ } -+ -+ return session->conn->smb2.server.cipher; -+} -+ - struct smbXcli_tcon *smbXcli_tcon_create(TALLOC_CTX *mem_ctx) - { - struct smbXcli_tcon *tcon; -diff --git a/libcli/smb/smbXcli_base.h b/libcli/smb/smbXcli_base.h -index 2afc7165cd9..db5f5d58799 100644 ---- a/libcli/smb/smbXcli_base.h -+++ b/libcli/smb/smbXcli_base.h -@@ -518,6 +518,7 @@ NTSTATUS smb2cli_session_set_channel_key(struct smbXcli_session *session, - const DATA_BLOB channel_key, - const struct iovec *recv_iov); - NTSTATUS smb2cli_session_encryption_on(struct smbXcli_session *session); -+uint16_t smb2cli_session_get_encryption_cipher(struct smbXcli_session *session); - - struct smbXcli_tcon *smbXcli_tcon_create(TALLOC_CTX *mem_ctx); - struct smbXcli_tcon *smbXcli_tcon_copy(TALLOC_CTX *mem_ctx, --- -2.29.2 - - -From f74c5cc57398ee42fecdfda17f4d442ca1abd9a5 Mon Sep 17 00:00:00 2001 -From: Isaac Boukris -Date: Thu, 20 Aug 2020 12:18:21 +0200 -Subject: [PATCH 089/104] Add dcerpc_transport_encrypted() - -Signed-off-by: Isaac Boukris -Reviewed-by: Stefan Metzmacher -Reviewed-by: Alexander Bokovoy -(cherry picked from commit 339bfcd67af2675d10287946d8f5dabba1022d57) ---- - source4/librpc/rpc/dcerpc.h | 2 ++ - source4/librpc/rpc/dcerpc_smb.c | 11 +++++++++++ - source4/librpc/rpc/dcerpc_util.c | 13 +++++++++++++ - 3 files changed, 26 insertions(+) - -diff --git a/source4/librpc/rpc/dcerpc.h b/source4/librpc/rpc/dcerpc.h -index 6b0b841d64d..57124f10778 100644 ---- a/source4/librpc/rpc/dcerpc.h -+++ b/source4/librpc/rpc/dcerpc.h -@@ -87,6 +87,7 @@ struct dcecli_connection { - struct dcerpc_transport { - enum dcerpc_transport_t transport; - void *private_data; -+ bool encrypted; - - struct tstream_context *stream; - /** to serialize write events */ -@@ -181,6 +182,7 @@ NTSTATUS dcerpc_bind_auth_none(struct dcerpc_pipe *p, - const struct ndr_interface_table *table); - NTSTATUS dcerpc_fetch_session_key(struct dcerpc_pipe *p, - DATA_BLOB *session_key); -+bool dcerpc_transport_encrypted(struct dcerpc_pipe *p); - struct composite_context; - NTSTATUS dcerpc_secondary_connection_recv(struct composite_context *c, - struct dcerpc_pipe **p2); -diff --git a/source4/librpc/rpc/dcerpc_smb.c b/source4/librpc/rpc/dcerpc_smb.c -index b20b154a1cb..101ed64f0cd 100644 ---- a/source4/librpc/rpc/dcerpc_smb.c -+++ b/source4/librpc/rpc/dcerpc_smb.c -@@ -145,6 +145,7 @@ static void dcerpc_pipe_open_smb_done(struct tevent_req *subreq) - struct dcerpc_pipe_open_smb_state); - struct composite_context *ctx = state->ctx; - struct dcecli_connection *c = state->c; -+ uint16_t enc_cipher; - - ctx->status = tstream_smbXcli_np_open_recv(subreq, - state->smb, -@@ -173,6 +174,16 @@ static void dcerpc_pipe_open_smb_done(struct tevent_req *subreq) - /* Over-ride the default session key with the SMB session key */ - c->security_state.session_key = smb_session_key; - -+ enc_cipher = smb2cli_session_get_encryption_cipher(state->smb->session); -+ switch (enc_cipher) { -+ case SMB2_ENCRYPTION_AES128_CCM: -+ case SMB2_ENCRYPTION_AES128_GCM: -+ c->transport.encrypted = true; -+ break; -+ default: -+ c->transport.encrypted = false; -+ } -+ - c->transport.private_data = talloc_move(c, &state->smb); - - composite_done(ctx); -diff --git a/source4/librpc/rpc/dcerpc_util.c b/source4/librpc/rpc/dcerpc_util.c -index bd79a072bc8..6ea27a8d9a3 100644 ---- a/source4/librpc/rpc/dcerpc_util.c -+++ b/source4/librpc/rpc/dcerpc_util.c -@@ -743,6 +743,19 @@ _PUBLIC_ NTSTATUS dcerpc_fetch_session_key(struct dcerpc_pipe *p, - return NT_STATUS_OK; - } - -+_PUBLIC_ bool dcerpc_transport_encrypted(struct dcerpc_pipe *p) -+{ -+ if (p == NULL) { -+ return false; -+ } -+ -+ if (p->conn == NULL) { -+ return false; -+ } -+ -+ return p->conn->transport.encrypted; -+} -+ - /* - create a secondary context from a primary connection - --- -2.29.2 - - -From 89a12dbf4a5b819dbd136e743c59025298009049 Mon Sep 17 00:00:00 2001 -From: Isaac Boukris -Date: Thu, 20 Aug 2020 12:35:01 +0200 -Subject: [PATCH 090/104] Add py binding for dcerpc_transport_encrypted - -Signed-off-by: Isaac Boukris -Reviewed-by: Stefan Metzmacher -Reviewed-by: Alexander Bokovoy -(cherry picked from commit eba91f0dfa8e3267689b4076302e257f4cecd63b) ---- - source4/librpc/rpc/pyrpc.c | 14 ++++++++++++++ - 1 file changed, 14 insertions(+) - -diff --git a/source4/librpc/rpc/pyrpc.c b/source4/librpc/rpc/pyrpc.c -index be914ed5f14..309a6d72e26 100644 ---- a/source4/librpc/rpc/pyrpc.c -+++ b/source4/librpc/rpc/pyrpc.c -@@ -293,11 +293,25 @@ static PyObject *py_iface_request(PyObject *self, PyObject *args, PyObject *kwar - return ret; - } - -+static PyObject *py_iface_transport_encrypted(PyObject *self) -+{ -+ dcerpc_InterfaceObject *iface = (dcerpc_InterfaceObject *)self; -+ -+ if (dcerpc_transport_encrypted(iface->pipe)) { -+ Py_RETURN_TRUE; -+ } -+ -+ Py_RETURN_FALSE; -+} -+ - static PyMethodDef dcerpc_interface_methods[] = { - { "request", PY_DISCARD_FUNC_SIG(PyCFunction, py_iface_request), - METH_VARARGS|METH_KEYWORDS, - "S.request(opnum, data, object=None) -> data\n" - "Make a raw request" }, -+ { "transport_encrypted", PY_DISCARD_FUNC_SIG(PyCFunction, py_iface_transport_encrypted), -+ METH_NOARGS, -+ "Check if the DCE transport is encrypted" }, - { NULL, NULL, 0, NULL }, - }; - --- -2.29.2 - - -From a08aab47494ab4f2972de3ebe4b022a1d23216a5 Mon Sep 17 00:00:00 2001 -From: Isaac Boukris -Date: Thu, 20 Aug 2020 12:44:08 +0200 -Subject: [PATCH 091/104] selftest: add a test for py dce transport_encrypted - -Signed-off-by: Isaac Boukris -Reviewed-by: Stefan Metzmacher -Reviewed-by: Alexander Bokovoy -(cherry picked from commit a77551bea969ce73a3dc27384d94b4126bef04f7) ---- - python/samba/tests/dcerpc/binding.py | 23 ++++++++++++++++++++++- - 1 file changed, 22 insertions(+), 1 deletion(-) - -diff --git a/python/samba/tests/dcerpc/binding.py b/python/samba/tests/dcerpc/binding.py -index 8e0d6a5ef0a..24e4ac77d89 100644 ---- a/python/samba/tests/dcerpc/binding.py -+++ b/python/samba/tests/dcerpc/binding.py -@@ -22,7 +22,7 @@ import samba.tests - from samba.tests import RpcInterfaceTestCase, TestCase - from samba.dcerpc import lsa - import samba.dcerpc.security as security --from samba.credentials import Credentials, SMB_ENCRYPTION_REQUIRED -+from samba.credentials import Credentials, SMB_ENCRYPTION_REQUIRED, SMB_ENCRYPTION_OFF - from samba import NTSTATUSError - - class RpcBindingTests(RpcInterfaceTestCase): -@@ -40,6 +40,26 @@ class RpcBindingTests(RpcInterfaceTestCase): - c.set_password(password) - return c - -+ def test_smb3_dcerpc_no_encryption(self): -+ creds = self.get_user_creds() -+ creds.set_smb_encryption(SMB_ENCRYPTION_OFF) -+ -+ lp = self.get_loadparm() -+ lp.set('client ipc max protocol', 'SMB3') -+ lp.set('client ipc min protocol', 'SMB3') -+ -+ binding_string = ("ncacn_np:%s" % (samba.tests.env_get_var_value('SERVER'))) -+ lsa_conn = lsa.lsarpc(binding_string, lp, creds) -+ self.assertFalse(lsa_conn.transport_encrypted()) -+ -+ objectAttr = lsa.ObjectAttribute() -+ objectAttr.sec_qos = lsa.QosInfo() -+ -+ pol_handle = lsa_conn.OpenPolicy2('', -+ objectAttr, -+ security.SEC_FLAG_MAXIMUM_ALLOWED) -+ self.assertIsNotNone(pol_handle) -+ - def test_smb3_dcerpc_encryption(self): - creds = self.get_user_creds() - creds.set_smb_encryption(SMB_ENCRYPTION_REQUIRED) -@@ -50,6 +70,7 @@ class RpcBindingTests(RpcInterfaceTestCase): - - binding_string = ("ncacn_np:%s" % (samba.tests.env_get_var_value('SERVER'))) - lsa_conn = lsa.lsarpc(binding_string, lp, creds) -+ self.assertTrue(lsa_conn.transport_encrypted()) - - objectAttr = lsa.ObjectAttribute() - objectAttr.sec_qos = lsa.QosInfo() --- -2.29.2 - - -From 4e8f7954ceed5a14987eb56197f265618fd77acc Mon Sep 17 00:00:00 2001 -From: Isaac Boukris -Date: Thu, 20 Aug 2020 12:47:12 +0200 -Subject: [PATCH 092/104] Add CreateTrustedDomainRelax wrapper for fips mode - -Signed-off-by: Isaac Boukris -Reviewed-by: Stefan Metzmacher -Reviewed-by: Alexander Bokovoy -(cherry picked from commit c2644032b49b4160517a7c73634cebc54a76f827) ---- - python/samba/trust_utils.py | 62 +++++++++++++++++++++++++++++++++++++ - 1 file changed, 62 insertions(+) - create mode 100644 python/samba/trust_utils.py - -diff --git a/python/samba/trust_utils.py b/python/samba/trust_utils.py -new file mode 100644 -index 00000000000..b4df0fa5bb8 ---- /dev/null -+++ b/python/samba/trust_utils.py -@@ -0,0 +1,62 @@ -+# trust utils -+# -+# Copyright Isaac Boukris 2020 -+# -+# This program is free software; you can redistribute it and/or modify -+# it under the terms of the GNU General Public License as published by -+# the Free Software Foundation; either version 3 of the License, or -+# (at your option) any later version. -+# -+# This program is distributed in the hope that it will be useful, -+# but WITHOUT ANY WARRANTY; without even the implied warranty of -+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+# GNU General Public License for more details. -+# -+# You should have received a copy of the GNU General Public License -+# along with this program. If not, see . -+ -+ -+from samba.dcerpc import lsa, drsblobs -+from samba.ndr import ndr_pack -+from samba import arcfour_encrypt, string_to_byte_array -+import random -+from samba import crypto -+ -+def CreateTrustedDomainRelax(lsaconn, policy, trust_info, mask, in_blob, out_blob): -+ -+ def generate_AuthInfoInternal(session_key, incoming=None, outgoing=None): -+ confounder = [0] * 512 -+ for i in range(len(confounder)): -+ confounder[i] = random.randint(0, 255) -+ -+ trustpass = drsblobs.trustDomainPasswords() -+ -+ trustpass.confounder = confounder -+ trustpass.outgoing = outgoing -+ trustpass.incoming = incoming -+ -+ trustpass_blob = ndr_pack(trustpass) -+ -+ encrypted_trustpass = arcfour_encrypt(session_key, trustpass_blob) -+ -+ auth_blob = lsa.DATA_BUF2() -+ auth_blob.size = len(encrypted_trustpass) -+ auth_blob.data = string_to_byte_array(encrypted_trustpass) -+ -+ auth_info = lsa.TrustDomainInfoAuthInfoInternal() -+ auth_info.auth_blob = auth_blob -+ -+ return auth_info -+ -+ session_key = lsaconn.session_key -+ -+ try: -+ if lsaconn.transport_encrypted(): -+ crypto.set_relax_mode() -+ auth_info = generate_AuthInfoInternal(session_key, -+ incoming=in_blob, -+ outgoing=out_blob) -+ finally: -+ crypto.set_strict_mode() -+ -+ return lsaconn.CreateTrustedDomainEx2(policy, trust_info, auth_info, mask) --- -2.29.2 - - -From 2e16b3d7d5419e76d33b2c3a794a043be5c0a4a5 Mon Sep 17 00:00:00 2001 -From: Isaac Boukris -Date: Thu, 20 Aug 2020 12:49:17 +0200 -Subject: [PATCH 093/104] Use the new CreateTrustedDomainRelax() - -Signed-off-by: Isaac Boukris -Reviewed-by: Stefan Metzmacher -Reviewed-by: Alexander Bokovoy -(cherry picked from commit baf4e2930ee13b47c23c63c7e945fdc4444f0c69) ---- - python/samba/netcmd/domain.py | 57 ++++++++--------------------------- - 1 file changed, 13 insertions(+), 44 deletions(-) - -diff --git a/python/samba/netcmd/domain.py b/python/samba/netcmd/domain.py -index 1d12c362911..93a3258d28d 100644 ---- a/python/samba/netcmd/domain.py -+++ b/python/samba/netcmd/domain.py -@@ -102,6 +102,7 @@ from samba.netcmd.domain_backup import cmd_domain_backup - - from samba.compat import binary_type - from samba.compat import get_string -+from samba.trust_utils import CreateTrustedDomainRelax - - string_version_to_constant = { - "2008_R2": DS_DOMAIN_FUNCTION_2008_R2, -@@ -2528,54 +2529,20 @@ class cmd_domain_trust_create(DomainTrustCommand): - - return blob - -- def generate_AuthInfoInternal(session_key, incoming=None, outgoing=None): -- confounder = [0] * 512 -- for i in range(len(confounder)): -- confounder[i] = random.randint(0, 255) -- -- trustpass = drsblobs.trustDomainPasswords() -- -- trustpass.confounder = confounder -- trustpass.outgoing = outgoing -- trustpass.incoming = incoming -- -- trustpass_blob = ndr_pack(trustpass) -- -- encrypted_trustpass = arcfour_encrypt(session_key, trustpass_blob) -- -- auth_blob = lsa.DATA_BUF2() -- auth_blob.size = len(encrypted_trustpass) -- auth_blob.data = string_to_byte_array(encrypted_trustpass) -- -- auth_info = lsa.TrustDomainInfoAuthInfoInternal() -- auth_info.auth_blob = auth_blob -- -- return auth_info -- - update_time = samba.current_unix_time() - incoming_blob = generate_AuthInOutBlob(incoming_secret, update_time) - outgoing_blob = generate_AuthInOutBlob(outgoing_secret, update_time) - -- local_tdo_handle = None -- remote_tdo_handle = None -- -- local_auth_info = generate_AuthInfoInternal(local_lsa.session_key, -- incoming=incoming_blob, -- outgoing=outgoing_blob) -- if remote_trust_info: -- remote_auth_info = generate_AuthInfoInternal(remote_lsa.session_key, -- incoming=outgoing_blob, -- outgoing=incoming_blob) -- - try: - if remote_trust_info: - self.outf.write("Creating remote TDO.\n") - current_request = {"location": "remote", "name": "CreateTrustedDomainEx2"} -- remote_tdo_handle = \ -- remote_lsa.CreateTrustedDomainEx2(remote_policy, -- remote_trust_info, -- remote_auth_info, -- lsa.LSA_TRUSTED_DOMAIN_ALL_ACCESS) -+ remote_tdo_handle = CreateTrustedDomainRelax(remote_lsa, -+ remote_policy, -+ remote_trust_info, -+ lsa.LSA_TRUSTED_DOMAIN_ALL_ACCESS, -+ outgoing_blob, -+ incoming_blob) - self.outf.write("Remote TDO created.\n") - if enc_types: - self.outf.write("Setting supported encryption types on remote TDO.\n") -@@ -2586,10 +2553,12 @@ class cmd_domain_trust_create(DomainTrustCommand): - - self.outf.write("Creating local TDO.\n") - current_request = {"location": "local", "name": "CreateTrustedDomainEx2"} -- local_tdo_handle = local_lsa.CreateTrustedDomainEx2(local_policy, -- local_trust_info, -- local_auth_info, -- lsa.LSA_TRUSTED_DOMAIN_ALL_ACCESS) -+ local_tdo_handle = CreateTrustedDomainRelax(local_lsa, -+ local_policy, -+ local_trust_info, -+ lsa.LSA_TRUSTED_DOMAIN_ALL_ACCESS, -+ incoming_blob, -+ outgoing_blob) - self.outf.write("Local TDO created\n") - if enc_types: - self.outf.write("Setting supported encryption types on local TDO.\n") --- -2.29.2 - - -From 2661a29e81b6b33dce6ca1e39c9e4eeaab53fef7 Mon Sep 17 00:00:00 2001 -From: Isaac Boukris -Date: Tue, 1 Sep 2020 20:14:29 +0300 -Subject: [PATCH 094/104] selftest: add a test for the CreateTrustedDomainRelax - wrapper - -Originally copied from 'source4/scripting/devel/createtrust' -(had to drop the TRUST_AUTH_TYPE_VERSION part though, as it -fails against samba DC). - -Signed-off-by: Isaac Boukris -Reviewed-by: Stefan Metzmacher -Reviewed-by: Alexander Bokovoy -(cherry picked from commit cfaad16ff632df83a881fe5d8ec498bab102c9c9) ---- - python/samba/tests/dcerpc/createtrustrelax.py | 131 ++++++++++++++++++ - selftest/knownfail.d/createtrustrelax_server | 1 + - source4/selftest/tests.py | 4 + - 3 files changed, 136 insertions(+) - create mode 100644 python/samba/tests/dcerpc/createtrustrelax.py - create mode 100644 selftest/knownfail.d/createtrustrelax_server - -diff --git a/python/samba/tests/dcerpc/createtrustrelax.py b/python/samba/tests/dcerpc/createtrustrelax.py -new file mode 100644 -index 00000000000..48beb0f9680 ---- /dev/null -+++ b/python/samba/tests/dcerpc/createtrustrelax.py -@@ -0,0 +1,131 @@ -+# Unix SMB/CIFS implementation. -+# -+# Copyright (C) Andrew Bartlett 2011 -+# Copyright (C) Isaac Boukris 2020 -+# -+# This program is free software; you can redistribute it and/or modify -+# it under the terms of the GNU General Public License as published by -+# the Free Software Foundation; either version 3 of the License, or -+# (at your option) any later version. -+# -+# This program is distributed in the hope that it will be useful, -+# but WITHOUT ANY WARRANTY; without even the implied warranty of -+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+# GNU General Public License for more details. -+# -+# You should have received a copy of the GNU General Public License -+# along with this program. If not, see . -+# -+ -+"""Tests for the CreateTrustedDomainRelax wrapper""" -+ -+import os -+import samba -+from samba.tests import TestCase -+from samba.dcerpc import lsa, security, drsblobs -+from samba.credentials import Credentials, SMB_ENCRYPTION_REQUIRED, SMB_ENCRYPTION_OFF -+from samba.trust_utils import CreateTrustedDomainRelax -+ -+class CreateTrustedDomainRelaxTest(TestCase): -+ def setUp(self): -+ super(CreateTrustedDomainRelaxTest, self).setUp() -+ -+ def get_user_creds(self): -+ c = Credentials() -+ c.guess() -+ domain = samba.tests.env_get_var_value('DOMAIN') -+ username = samba.tests.env_get_var_value('USERNAME') -+ password = samba.tests.env_get_var_value('PASSWORD') -+ c.set_domain(domain) -+ c.set_username(username) -+ c.set_password(password) -+ return c -+ -+ def _create_trust_relax(self, smbencrypt=True): -+ creds = self.get_user_creds() -+ -+ if smbencrypt: -+ creds.set_smb_encryption(SMB_ENCRYPTION_REQUIRED) -+ else: -+ creds.set_smb_encryption(SMB_ENCRYPTION_OFF) -+ -+ lp = self.get_loadparm() -+ -+ binding_string = ("ncacn_np:%s" % (samba.tests.env_get_var_value('SERVER'))) -+ lsa_conn = lsa.lsarpc(binding_string, lp, creds) -+ -+ if smbencrypt: -+ self.assertTrue(lsa_conn.transport_encrypted()) -+ else: -+ self.assertFalse(lsa_conn.transport_encrypted()) -+ -+ objectAttr = lsa.ObjectAttribute() -+ objectAttr.sec_qos = lsa.QosInfo() -+ -+ pol_handle = lsa_conn.OpenPolicy2('', -+ objectAttr, -+ security.SEC_FLAG_MAXIMUM_ALLOWED) -+ self.assertIsNotNone(pol_handle) -+ -+ name = lsa.String() -+ name.string = "tests.samba.example.com" -+ try: -+ info = lsa_conn.QueryTrustedDomainInfoByName(pol_handle, name, -+ lsa.LSA_TRUSTED_DOMAIN_INFO_FULL_INFO) -+ -+ lsa_conn.DeleteTrustedDomain(pol_handle, info.info_ex.sid) -+ except RuntimeError: -+ pass -+ -+ info = lsa.TrustDomainInfoInfoEx() -+ info.domain_name.string = name.string -+ info.netbios_name.string = "createtrustrelax" -+ info.sid = security.dom_sid("S-1-5-21-538490383-3740119673-95748416") -+ info.trust_direction = lsa.LSA_TRUST_DIRECTION_INBOUND | lsa.LSA_TRUST_DIRECTION_OUTBOUND -+ info.trust_type = lsa.LSA_TRUST_TYPE_UPLEVEL -+ info.trust_attributes = lsa.LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE -+ -+ password_blob = samba.string_to_byte_array("password".encode('utf-16-le')) -+ -+ clear_value = drsblobs.AuthInfoClear() -+ clear_value.size = len(password_blob) -+ clear_value.password = password_blob -+ -+ clear_authentication_information = drsblobs.AuthenticationInformation() -+ clear_authentication_information.LastUpdateTime = 0 -+ clear_authentication_information.AuthType = lsa.TRUST_AUTH_TYPE_CLEAR -+ clear_authentication_information.AuthInfo = clear_value -+ -+ authentication_information_array = drsblobs.AuthenticationInformationArray() -+ authentication_information_array.count = 1 -+ authentication_information_array.array = [clear_authentication_information] -+ -+ outgoing = drsblobs.trustAuthInOutBlob() -+ outgoing.count = 1 -+ outgoing.current = authentication_information_array -+ -+ trustdom_handle = None -+ try: -+ trustdom_handle = CreateTrustedDomainRelax(lsa_conn, -+ pol_handle, -+ info, -+ security.SEC_STD_DELETE, -+ outgoing, -+ outgoing) -+ except samba.NTSTATUSError as nt: -+ raise AssertionError(nt) -+ except OSError as e: -+ if smbencrypt: -+ raise AssertionError(e) -+ -+ if smbencrypt: -+ self.assertIsNotNone(trustdom_handle) -+ lsa_conn.DeleteTrustedDomain(pol_handle, info.sid) -+ else: -+ self.assertIsNone(trustdom_handle) -+ -+ def test_create_trust_relax_encrypt(self): -+ self._create_trust_relax(True) -+ -+ def test_create_trust_relax_no_enc(self): -+ self._create_trust_relax(False) -diff --git a/selftest/knownfail.d/createtrustrelax_server b/selftest/knownfail.d/createtrustrelax_server -new file mode 100644 -index 00000000000..80effda8343 ---- /dev/null -+++ b/selftest/knownfail.d/createtrustrelax_server -@@ -0,0 +1 @@ -+^samba.tests.dcerpc.createtrustrelax.samba.tests.dcerpc.createtrustrelax.CreateTrustedDomainRelaxTest.test_create_trust_relax_encrypt\(ad_dc_fips\) -diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py -index 3a903a7eee0..96f51b68cfc 100755 ---- a/source4/selftest/tests.py -+++ b/source4/selftest/tests.py -@@ -704,6 +704,10 @@ def planoldpythontestsuite(env, module, name=None, extra_path=[], environ={}, ex - name = module - plantestsuite_loadlist(name, env, args) - -+if have_gnutls_crypto_policies: -+ planoldpythontestsuite("ad_dc", "samba.tests.dcerpc.createtrustrelax", environ={'GNUTLS_FORCE_FIPS_MODE':'1'}) -+ planoldpythontestsuite("ad_dc_fips", "samba.tests.dcerpc.createtrustrelax", environ={'GNUTLS_FORCE_FIPS_MODE':'1'}) -+ - # Run complex search expressions test once for each database backend. - # Right now ad_dc has mdb and ad_dc_ntvfs has tdb - mdb_testenv = "ad_dc" --- -2.29.2 - - -From 3d3a03764d56b58a81ef99123720bd5555eaf040 Mon Sep 17 00:00:00 2001 -From: Isaac Boukris -Date: Thu, 5 Nov 2020 15:38:19 +0200 -Subject: [PATCH 095/104] Remove source4/scripting/devel/createtrust script - -We now have the 'samba-tool domain trust' command. - -Signed-off-by: Isaac Boukris -Reviewed-by: Stefan Metzmacher -Reviewed-by: Alexander Bokovoy - -Autobuild-User(master): Isaac Boukris -Autobuild-Date(master): Fri Nov 6 11:25:02 UTC 2020 on sn-devel-184 - -(cherry picked from commit 604153525afc892f57a1df710c41ffca275b0dd3) ---- - source4/scripting/devel/createtrust | 125 ---------------------------- - 1 file changed, 125 deletions(-) - delete mode 100755 source4/scripting/devel/createtrust - -diff --git a/source4/scripting/devel/createtrust b/source4/scripting/devel/createtrust -deleted file mode 100755 -index 26b0d0dcb68..00000000000 ---- a/source4/scripting/devel/createtrust -+++ /dev/null -@@ -1,125 +0,0 @@ --#!/usr/bin/env python3 -- --# create a domain trust -- --import sys --from optparse import OptionParser -- --sys.path.insert(0, "bin/python") -- --import samba --import samba.getopt as options --from samba.dcerpc import lsa, security, drsblobs --from samba.ndr import ndr_pack --from samba import arcfour_encrypt, string_to_byte_array --import random -- --########### main code ########### --if __name__ == "__main__": -- parser = OptionParser("createtrust [options] server") -- sambaopts = options.SambaOptions(parser) -- credopts = options.CredentialsOptionsDouble(parser) -- parser.add_option_group(credopts) -- -- (opts, args) = parser.parse_args() -- -- lp = sambaopts.get_loadparm() -- creds = credopts.get_credentials(lp) -- -- if len(args) != 1: -- parser.error("You must supply a server") -- -- if not creds.authentication_requested(): -- parser.error("You must supply credentials") -- -- server = args[0] -- -- binding_str = "ncacn_np:%s[print]" % server -- -- lsaconn = lsa.lsarpc(binding_str, lp, creds) -- -- objectAttr = lsa.ObjectAttribute() -- objectAttr.sec_qos = lsa.QosInfo() -- -- pol_handle = lsaconn.OpenPolicy2(''.decode('utf-8'), -- objectAttr, security.SEC_FLAG_MAXIMUM_ALLOWED) -- -- name = lsa.String() -- name.string = "sub2.win2k3.obed.home.abartlet.net" -- try: -- info = lsaconn.QueryTrustedDomainInfoByName(pol_handle, name, lsa.LSA_TRUSTED_DOMAIN_INFO_FULL_INFO) -- -- lsaconn.DeleteTrustedDomain(pol_handle, info.info_ex.sid) -- except RuntimeError: -- pass -- -- info = lsa.TrustDomainInfoInfoEx() -- info.domain_name.string = "sub2.win2k3.obed.home.abartlet.net" -- info.netbios_name.string = "sub2" -- info.sid = security.dom_sid("S-1-5-21-538090388-3760119675-95745416") -- info.trust_direction = lsa.LSA_TRUST_DIRECTION_INBOUND | lsa.LSA_TRUST_DIRECTION_OUTBOUND -- info.trust_type = lsa.LSA_TRUST_TYPE_UPLEVEL -- info.trust_attributes = lsa.LSA_TRUST_ATTRIBUTE_WITHIN_FOREST -- -- password_blob = string_to_byte_array("password".encode('utf-16-le')) -- -- clear_value = drsblobs.AuthInfoClear() -- clear_value.size = len(password_blob) -- clear_value.password = password_blob -- -- clear_authentication_information = drsblobs.AuthenticationInformation() -- clear_authentication_information.LastUpdateTime = 0 -- clear_authentication_information.AuthType = lsa.TRUST_AUTH_TYPE_CLEAR -- clear_authentication_information.AuthInfo = clear_value -- -- version_value = drsblobs.AuthInfoVersion() -- version_value.version = 1 -- -- version = drsblobs.AuthenticationInformation() -- version.LastUpdateTime = 0 -- version.AuthType = lsa.TRUST_AUTH_TYPE_VERSION -- version.AuthInfo = version_value -- -- authentication_information_array = drsblobs.AuthenticationInformationArray() -- authentication_information_array.count = 2 -- authentication_information_array.array = [clear_authentication_information, version] -- -- outgoing = drsblobs.trustAuthInOutBlob() -- outgoing.count = 1 -- outgoing.current = authentication_information_array -- -- trustpass = drsblobs.trustDomainPasswords() -- confounder = [3] * 512 -- -- for i in range(512): -- confounder[i] = random.randint(0, 255) -- -- trustpass.confounder = confounder -- --# print "confounder: ", trustpass.confounder -- -- trustpass.outgoing = outgoing -- trustpass.incoming = outgoing -- -- trustpass_blob = ndr_pack(trustpass) -- --# print "trustpass_blob: ", list(trustpass_blob) -- -- encrypted_trustpass = arcfour_encrypt(lsaconn.session_key, trustpass_blob) -- --# print "encrypted_trustpass: ", list(encrypted_trustpass) -- -- auth_blob = lsa.DATA_BUF2() -- auth_blob.size = len(encrypted_trustpass) -- auth_blob.data = string_to_byte_array(encrypted_trustpass) -- -- auth_info = lsa.TrustDomainInfoAuthInfoInternal() -- auth_info.auth_blob = auth_blob -- -- --# print "auth_info.auth_blob.data: ", auth_info.auth_blob.data -- -- trustdom_handle = lsaconn.CreateTrustedDomainEx2(pol_handle, -- info, -- auth_info, -- security.SEC_STD_DELETE) --- -2.29.2 - - -From 8bdfdf2b2489393586dbc99b1d2282c61acdce09 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Fri, 6 Nov 2020 14:30:26 +0100 -Subject: [PATCH 096/104] s3:rpc_server: Use gnutls_cipher_decrypt() in - get_trustdom_auth_blob() - -It doesn't matter for RC4, but just to be correct. - -Signed-off-by: Andreas Schneider -Reviewed-by: Alexander Bokovoy -(cherry picked from commit 6c11e5f42ba3248c97d85c989d422b256d2465a9) ---- - source3/rpc_server/lsa/srv_lsa_nt.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/source3/rpc_server/lsa/srv_lsa_nt.c b/source3/rpc_server/lsa/srv_lsa_nt.c -index 198387424e6..e749caf2551 100644 ---- a/source3/rpc_server/lsa/srv_lsa_nt.c -+++ b/source3/rpc_server/lsa/srv_lsa_nt.c -@@ -1726,7 +1726,7 @@ static NTSTATUS get_trustdom_auth_blob(struct pipes_struct *p, - goto out; - } - -- rc = gnutls_cipher_encrypt(cipher_hnd, -+ rc = gnutls_cipher_decrypt(cipher_hnd, - auth_blob->data, - auth_blob->length); - gnutls_cipher_deinit(cipher_hnd); --- -2.29.2 - - -From 37fce305caff75a8ee1ab185f37e984809225239 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Fri, 6 Nov 2020 14:33:38 +0100 -Subject: [PATCH 097/104] s4:rpc_server: Use gnutls_cipher_decrypt() in - get_trustdom_auth_blob() - -It doesn't matter for RC4, but just to be correct. - -Signed-off-by: Andreas Schneider -Reviewed-by: Alexander Bokovoy -(cherry picked from commit c93ccebdfedd60c1d19f1b1436ac30062259952a) ---- - source4/rpc_server/lsa/dcesrv_lsa.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/source4/rpc_server/lsa/dcesrv_lsa.c b/source4/rpc_server/lsa/dcesrv_lsa.c -index 8333cb149b6..4bb8aaa9592 100644 ---- a/source4/rpc_server/lsa/dcesrv_lsa.c -+++ b/source4/rpc_server/lsa/dcesrv_lsa.c -@@ -889,7 +889,7 @@ static NTSTATUS get_trustdom_auth_blob(struct dcesrv_call_state *dce_call, - goto out; - } - -- rc = gnutls_cipher_encrypt(cipher_hnd, -+ rc = gnutls_cipher_decrypt(cipher_hnd, - auth_blob->data, - auth_blob->length); - gnutls_cipher_deinit(cipher_hnd); --- -2.29.2 - - -From caf59e243ed0f99056176ef81fe617b170ec6cfd Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Thu, 20 Aug 2020 13:40:21 +0200 -Subject: [PATCH 098/104] s3:rpc_server: Allow to use RC4 for creating trusts - -Signed-off-by: Andreas Schneider -Reviewed-by: Alexander Bokovoy -Reviewed-by: Stefan Metzmacher -(cherry picked from commit 4425f2c113a4dc33a8dc609d84a92018d61b4d2e) ---- - source3/rpc_server/lsa/srv_lsa_nt.c | 13 +++++++++++++ - 1 file changed, 13 insertions(+) - -diff --git a/source3/rpc_server/lsa/srv_lsa_nt.c b/source3/rpc_server/lsa/srv_lsa_nt.c -index e749caf2551..d6d606ddeca 100644 ---- a/source3/rpc_server/lsa/srv_lsa_nt.c -+++ b/source3/rpc_server/lsa/srv_lsa_nt.c -@@ -51,6 +51,8 @@ - #include "../libcli/lsarpc/util_lsarpc.h" - #include "lsa.h" - #include "librpc/rpc/dcesrv_core.h" -+#include "librpc/rpc/dcerpc_helper.h" -+#include "lib/param/loadparm.h" - - #include "lib/crypto/gnutls_helpers.h" - #include -@@ -1706,6 +1708,14 @@ static NTSTATUS get_trustdom_auth_blob(struct pipes_struct *p, - gnutls_datum_t my_session_key; - NTSTATUS status; - int rc; -+ bool encrypted; -+ -+ encrypted = -+ dcerpc_is_transport_encrypted(p->session_info); -+ if (lp_weak_crypto() == SAMBA_WEAK_CRYPTO_DISALLOWED && -+ !encrypted) { -+ return NT_STATUS_ACCESS_DENIED; -+ } - - status = session_extract_session_key(p->session_info, &lsession_key, KEY_USE_16BYTES); - if (!NT_STATUS_IS_OK(status)) { -@@ -1717,11 +1727,13 @@ static NTSTATUS get_trustdom_auth_blob(struct pipes_struct *p, - .size = lsession_key.length, - }; - -+ GNUTLS_FIPS140_SET_LAX_MODE(); - rc = gnutls_cipher_init(&cipher_hnd, - GNUTLS_CIPHER_ARCFOUR_128, - &my_session_key, - NULL); - if (rc < 0) { -+ GNUTLS_FIPS140_SET_STRICT_MODE(); - status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); - goto out; - } -@@ -1730,6 +1742,7 @@ static NTSTATUS get_trustdom_auth_blob(struct pipes_struct *p, - auth_blob->data, - auth_blob->length); - gnutls_cipher_deinit(cipher_hnd); -+ GNUTLS_FIPS140_SET_STRICT_MODE(); - if (rc < 0) { - status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); - goto out; --- -2.29.2 - - -From 14b972e7f4224ccf87b1d08824194a4d7d37aef0 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Thu, 20 Aug 2020 13:51:39 +0200 -Subject: [PATCH 099/104] s4:rpc_server: Allow to use RC4 for creating trusts - -Signed-off-by: Andreas Schneider -Reviewed-by: Alexander Bokovoy -Reviewed-by: Stefan Metzmacher -(cherry picked from commit c75dd1ea178325b8f65343cb5c35bb93f43a49a3) ---- - source4/rpc_server/lsa/dcesrv_lsa.c | 18 ++++++++++++++++++ - 1 file changed, 18 insertions(+) - -diff --git a/source4/rpc_server/lsa/dcesrv_lsa.c b/source4/rpc_server/lsa/dcesrv_lsa.c -index 4bb8aaa9592..5b3ef71d458 100644 ---- a/source4/rpc_server/lsa/dcesrv_lsa.c -+++ b/source4/rpc_server/lsa/dcesrv_lsa.c -@@ -33,6 +33,8 @@ - #include "libcli/lsarpc/util_lsarpc.h" - #include "lib/messaging/irpc.h" - #include "libds/common/roles.h" -+#include "lib/param/loadparm.h" -+#include "librpc/rpc/dcerpc_helper.h" - - #include "lib/crypto/gnutls_helpers.h" - #include -@@ -869,6 +871,19 @@ static NTSTATUS get_trustdom_auth_blob(struct dcesrv_call_state *dce_call, - gnutls_cipher_hd_t cipher_hnd = NULL; - gnutls_datum_t _session_key; - int rc; -+ struct auth_session_info *session_info = -+ dcesrv_call_session_info(dce_call); -+ struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx; -+ bool encrypted; -+ -+ encrypted = -+ dcerpc_is_transport_encrypted(session_info); -+ if (lpcfg_weak_crypto(lp_ctx) == SAMBA_WEAK_CRYPTO_DISALLOWED && -+ !encrypted) { -+ DBG_ERR("Transport isn't encrypted and weak crypto disallowed!\n"); -+ return NT_STATUS_ACCESS_DENIED; -+ } -+ - - nt_status = dcesrv_transport_session_key(dce_call, &session_key); - if (!NT_STATUS_IS_OK(nt_status)) { -@@ -880,11 +895,13 @@ static NTSTATUS get_trustdom_auth_blob(struct dcesrv_call_state *dce_call, - .size = session_key.length, - }; - -+ GNUTLS_FIPS140_SET_LAX_MODE(); - rc = gnutls_cipher_init(&cipher_hnd, - GNUTLS_CIPHER_ARCFOUR_128, - &_session_key, - NULL); - if (rc < 0) { -+ GNUTLS_FIPS140_SET_STRICT_MODE(); - nt_status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); - goto out; - } -@@ -893,6 +910,7 @@ static NTSTATUS get_trustdom_auth_blob(struct dcesrv_call_state *dce_call, - auth_blob->data, - auth_blob->length); - gnutls_cipher_deinit(cipher_hnd); -+ GNUTLS_FIPS140_SET_STRICT_MODE(); - if (rc < 0) { - nt_status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); - goto out; --- -2.29.2 - - -From 5fdca81ab920d021e5f1c81a05cf3a91244ef405 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Fri, 6 Nov 2020 10:13:48 +0100 -Subject: [PATCH 100/104] sefltest: Enable the dcerpc.createtrustrelax test - against ad_dc_fips - -Signed-off-by: Andreas Schneider -Reviewed-by: Alexander Bokovoy -Reviewed-by: Stefan Metzmacher - -Autobuild-User(master): Andreas Schneider -Autobuild-Date(master): Mon Nov 9 10:22:51 UTC 2020 on sn-devel-184 - -(cherry picked from commit b89134013041e772418c2c8bcfffe8a9ade6db91) ---- - selftest/knownfail.d/createtrustrelax_server | 1 - - 1 file changed, 1 deletion(-) - delete mode 100644 selftest/knownfail.d/createtrustrelax_server - -diff --git a/selftest/knownfail.d/createtrustrelax_server b/selftest/knownfail.d/createtrustrelax_server -deleted file mode 100644 -index 80effda8343..00000000000 ---- a/selftest/knownfail.d/createtrustrelax_server -+++ /dev/null -@@ -1 +0,0 @@ --^samba.tests.dcerpc.createtrustrelax.samba.tests.dcerpc.createtrustrelax.CreateTrustedDomainRelaxTest.test_create_trust_relax_encrypt\(ad_dc_fips\) --- -2.29.2 - - -From 2547b1d495afa0f7235064f4949a297e46338287 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Wed, 11 Nov 2020 13:42:06 +0100 -Subject: [PATCH 101/104] s3:smbd: Fix possible null pointer dereference in - token_contains_name() - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14572 - -Signed-off-by: Andreas Schneider -Reviewed-by: Alexander Bokovoy - -Autobuild-User(master): Alexander Bokovoy -Autobuild-Date(master): Thu Nov 12 15:13:47 UTC 2020 on sn-devel-184 - -(cherry picked from commit 8036bf9717f83e83c3e4a9cf00fded42e9a5de15) ---- - source3/smbd/share_access.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/source3/smbd/share_access.c b/source3/smbd/share_access.c -index 57754a0f766..694c0c290e8 100644 ---- a/source3/smbd/share_access.c -+++ b/source3/smbd/share_access.c -@@ -79,7 +79,7 @@ static bool token_contains_name(TALLOC_CTX *mem_ctx, - enum lsa_SidType type; - - if (username != NULL) { -- size_t domain_len = strlen(domain); -+ size_t domain_len = domain != NULL ? strlen(domain) : 0; - - /* Check if username starts with domain name */ - if (domain_len > 0) { --- -2.29.2 - - -From 14cba0db4c3e8a20923491f01cd6eb658c8d76ae Mon Sep 17 00:00:00 2001 -From: Alexander Bokovoy -Date: Tue, 10 Nov 2020 17:35:24 +0200 -Subject: [PATCH 102/104] lookup_name: allow lookup names prefixed with DNS - forest root for FreeIPA DC - -In FreeIPA deployment with active Global Catalog service, when a two-way -trust to Active Directory forest is established, Windows systems can -look up FreeIPA users and groups. When using a security tab in Windows -Explorer on AD side, a lookup over a trusted forest might come as -realm\name instead of NetBIOS domain name: - --------------------------------------------------------------------- -[2020/01/13 11:12:39.859134, 1, pid=33253, effective(1732401004, 1732401004), real(1732401004, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:471(ndr_print_function_debug) - lsa_LookupNames3: struct lsa_LookupNames3 - in: struct lsa_LookupNames3 - handle : * - handle: struct policy_handle - handle_type : 0x00000000 (0) - uuid : 0000000e-0000-0000-1c5e-a750e5810000 - num_names : 0x00000001 (1) - names: ARRAY(1) - names: struct lsa_String - length : 0x001e (30) - size : 0x0020 (32) - string : * - string : 'ipa.test\admins' - sids : * - sids: struct lsa_TransSidArray3 - count : 0x00000000 (0) - sids : NULL - level : LSA_LOOKUP_NAMES_UPLEVEL_TRUSTS_ONLY2 (6) - count : * - count : 0x00000000 (0) - lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) - client_revision : LSA_CLIENT_REVISION_2 (2) --------------------------------------------------------------------- - -If we are running as a DC and PASSDB supports returning domain info -(pdb_get_domain_info() returns a valid structure), check domain of the -name in lookup_name() against DNS forest name and allow the request to -be done against the primary domain. This corresponds to FreeIPA's use of -Samba as a DC. For normal domain members a realm-based lookup falls back -to a lookup over to its own domain controller with the help of winbindd. - -Signed-off-by: Alexander Bokovoy -Reviewed-by: Stefan Metzmacher - -Autobuild-User(master): Alexander Bokovoy -Autobuild-Date(master): Wed Nov 11 10:59:01 UTC 2020 on sn-devel-184 - -(cherry picked from commit 31c703766fd2b89737826fb7e9a707f0622bb8cd) ---- - source3/passdb/lookup_sid.c | 37 ++++++++++++++++++++++++++++--------- - 1 file changed, 28 insertions(+), 9 deletions(-) - -diff --git a/source3/passdb/lookup_sid.c b/source3/passdb/lookup_sid.c -index 82c47b3145b..864246da56e 100644 ---- a/source3/passdb/lookup_sid.c -+++ b/source3/passdb/lookup_sid.c -@@ -113,17 +113,36 @@ bool lookup_name(TALLOC_CTX *mem_ctx, - full_name, domain, name)); - DEBUG(10, ("lookup_name: flags = 0x0%x\n", flags)); - -- if (((flags & LOOKUP_NAME_DOMAIN) || (flags == 0)) && -- strequal(domain, get_global_sam_name())) -- { -+ if ((flags & LOOKUP_NAME_DOMAIN) || (flags == 0)) { -+ bool check_global_sam = false; -+ -+ check_global_sam = strequal(domain, get_global_sam_name()); -+ -+ /* If we are running on a DC that has PASSDB module with domain -+ * information, check if DNS forest name is matching the domain -+ * name. This is the case of FreeIPA domain controller when -+ * trusted AD DC looks up users found in a Global Catalog of -+ * the forest root domain. */ -+ if (!check_global_sam && (IS_DC)) { -+ struct pdb_domain_info *dom_info = NULL; -+ dom_info = pdb_get_domain_info(tmp_ctx); -+ -+ if ((dom_info != NULL) && (dom_info->dns_forest != NULL)) { -+ check_global_sam = strequal(domain, dom_info->dns_forest); -+ } - -- /* It's our own domain, lookup the name in passdb */ -- if (lookup_global_sam_name(name, flags, &rid, &type)) { -- sid_compose(&sid, get_global_sam_sid(), rid); -- goto ok; -+ TALLOC_FREE(dom_info); -+ } -+ -+ if (check_global_sam) { -+ /* It's our own domain, lookup the name in passdb */ -+ if (lookup_global_sam_name(name, flags, &rid, &type)) { -+ sid_compose(&sid, get_global_sam_sid(), rid); -+ goto ok; -+ } -+ TALLOC_FREE(tmp_ctx); -+ return false; - } -- TALLOC_FREE(tmp_ctx); -- return false; - } - - if ((flags & LOOKUP_NAME_BUILTIN) && --- -2.29.2 - - -From 35297bdac5cf9699234ec45ae97e54ceec75ebe9 Mon Sep 17 00:00:00 2001 -From: Alexander Bokovoy -Date: Wed, 11 Nov 2020 14:42:55 +0200 -Subject: [PATCH 103/104] auth_sam: use pdb_get_domain_info to look up DNS - forest information - -When Samba is used as a part of FreeIPA domain controller, Windows -clients for a trusted AD forest may try to authenticate (perform logon -operation) as a REALM\name user account. - -Fix auth_sam plugins to accept DNS forest name if we are running on a DC -with PASSDB module providing domain information (e.g. pdb_get_domain_info() -returning non-NULL structure). Right now, only FreeIPA or Samba AD DC -PASSDB backends return this information but Samba AD DC configuration is -explicitly ignored by the two auth_sam (strict and netlogon3) modules. - -Detailed logs below: - -[2020/11/11 09:23:53.281296, 1, pid=42677, effective(65534, 65534), real(65534, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:482(ndr_print_function_debug) - netr_LogonSamLogonWithFlags: struct netr_LogonSamLogonWithFlags - in: struct netr_LogonSamLogonWithFlags - server_name : * - server_name : '\\master.ipa.test' - computer_name : * - computer_name : 'AD1' - credential : * - credential: struct netr_Authenticator - cred: struct netr_Credential - data : 529f4b087c5f6546 - timestamp : Wed Nov 11 09:23:55 AM 2020 UTC - return_authenticator : * - return_authenticator: struct netr_Authenticator - cred: struct netr_Credential - data : 204f28f622010000 - timestamp : Fri May 2 06:37:50 AM 1986 UTC - logon_level : NetlogonNetworkTransitiveInformation (6) - logon : * - logon : union netr_LogonLevel(case 6) - network : * - network: struct netr_NetworkInfo - identity_info: struct netr_IdentityInfo - domain_name: struct lsa_String - length : 0x0010 (16) - size : 0x01fe (510) - string : * - string : 'IPA.TEST' - parameter_control : 0x00002ae0 (10976) - 0: MSV1_0_CLEARTEXT_PASSWORD_ALLOWED - 0: MSV1_0_UPDATE_LOGON_STATISTICS - 0: MSV1_0_RETURN_USER_PARAMETERS - 0: MSV1_0_DONT_TRY_GUEST_ACCOUNT - 1: MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT - 1: MSV1_0_RETURN_PASSWORD_EXPIRY - 1: MSV1_0_USE_CLIENT_CHALLENGE - 0: MSV1_0_TRY_GUEST_ACCOUNT_ONLY - 1: MSV1_0_RETURN_PROFILE_PATH - 0: MSV1_0_TRY_SPECIFIED_DOMAIN_ONLY - 1: MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT - 0: MSV1_0_DISABLE_PERSONAL_FALLBACK - 1: MSV1_0_ALLOW_FORCE_GUEST - 0: MSV1_0_CLEARTEXT_PASSWORD_SUPPLIED - 0: MSV1_0_USE_DOMAIN_FOR_ROUTING_ONLY - 0: MSV1_0_ALLOW_MSVCHAPV2 - 0: MSV1_0_S4U2SELF - 0: MSV1_0_CHECK_LOGONHOURS_FOR_S4U - 0: MSV1_0_SUBAUTHENTICATION_DLL_EX - logon_id : 0x0000000000884ef2 (8933106) - account_name: struct lsa_String - length : 0x000e (14) - size : 0x000e (14) - string : * - string : 'idmuser' - workstation: struct lsa_String - length : 0x0000 (0) - size : 0x0000 (0) - string : * - string : '' - challenge : 417207867bd33c74 - nt: struct netr_ChallengeResponse - length : 0x00c0 (192) - size : 0x00c0 (192) - data : * - data: ARRAY(192) - [0000] A5 24 62 6E 31 DF 69 66 9E DC 54 D6 63 4C D6 2F .$bn1.if ..T.cL./ - [0010] 01 01 00 00 00 00 00 00 50 37 D7 60 0C B8 D6 01 ........ P7.`.... - [0020] 15 1B 38 4F 47 95 4D 62 00 00 00 00 02 00 0E 00 ..8OG.Mb ........ - [0030] 57 00 49 00 4E 00 32 00 30 00 31 00 36 00 01 00 W.I.N.2. 0.1.6... - [0040] 06 00 41 00 44 00 31 00 04 00 18 00 77 00 69 00 ..A.D.1. ....w.i. - [0050] 6E 00 32 00 30 00 31 00 36 00 2E 00 74 00 65 00 n.2.0.1. 6...t.e. - [0060] 73 00 74 00 03 00 20 00 61 00 64 00 31 00 2E 00 s.t... . a.d.1... - [0070] 77 00 69 00 6E 00 32 00 30 00 31 00 36 00 2E 00 w.i.n.2. 0.1.6... - [0080] 74 00 65 00 73 00 74 00 05 00 18 00 77 00 69 00 t.e.s.t. ....w.i. - [0090] 6E 00 32 00 30 00 31 00 36 00 2E 00 74 00 65 00 n.2.0.1. 6...t.e. - [00A0] 73 00 74 00 07 00 08 00 50 37 D7 60 0C B8 D6 01 s.t..... P7.`.... - [00B0] 06 00 04 00 02 00 00 00 00 00 00 00 00 00 00 00 ........ ........ - lm: struct netr_ChallengeResponse - length : 0x0018 (24) - size : 0x0018 (24) - data : * - data : 000000000000000000000000000000000000000000000000 - validation_level : 0x0006 (6) - flags : * - flags : 0x00000000 (0) - 0: NETLOGON_SAMLOGON_FLAG_PASS_TO_FOREST_ROOT - 0: NETLOGON_SAMLOGON_FLAG_PASS_CROSS_FOREST_HOP - 0: NETLOGON_SAMLOGON_FLAG_RODC_TO_OTHER_DOMAIN - 0: NETLOGON_SAMLOGON_FLAG_RODC_NTLM_REQUEST - -In such case checks for a workgroup name will not match the DNS forest -name used in the username specification: - -[2020/11/11 09:23:53.283055, 3, pid=42677, effective(65534, 65534), real(65534, 0), class=auth] ../../source3/auth/auth.c:200(auth_check_ntlm_password) - check_ntlm_password: Checking password for unmapped user [IPA.TEST]\[idmuser]@[] with the new password interface -[2020/11/11 09:23:53.283073, 3, pid=42677, effective(65534, 65534), real(65534, 0), class=auth] ../../source3/auth/auth.c:203(auth_check_ntlm_password) - check_ntlm_password: mapped user is: [IPA.TEST]\[idmuser]@[] -[2020/11/11 09:23:53.283082, 10, pid=42677, effective(65534, 65534), real(65534, 0), class=auth] ../../source3/auth/auth.c:213(auth_check_ntlm_password) - check_ntlm_password: auth_context challenge created by fixed -[2020/11/11 09:23:53.283091, 10, pid=42677, effective(65534, 65534), real(65534, 0), class=auth] ../../source3/auth/auth.c:216(auth_check_ntlm_password) - challenge is: -[2020/11/11 09:23:53.283099, 5, pid=42677, effective(65534, 65534), real(65534, 0)] ../../lib/util/util.c:678(dump_data) - [0000] 41 72 07 86 7B D3 3C 74 Ar..{. -Reviewed-by: Andreas Schneider -(cherry picked from commit 2a8b672652dcbcf55ec59be537773d76f0f14d0a) ---- - source3/auth/auth_sam.c | 45 +++++++++++++++++++++++++++++++++++++---- - 1 file changed, 41 insertions(+), 4 deletions(-) - -diff --git a/source3/auth/auth_sam.c b/source3/auth/auth_sam.c -index 3c12f959faf..e8e0d543f8c 100644 ---- a/source3/auth/auth_sam.c -+++ b/source3/auth/auth_sam.c -@@ -22,6 +22,7 @@ - - #include "includes.h" - #include "auth.h" -+#include "passdb.h" - - #undef DBGC_CLASS - #define DBGC_CLASS DBGC_AUTH -@@ -142,10 +143,28 @@ static NTSTATUS auth_samstrict_auth(const struct auth_context *auth_context, - break; - case ROLE_DOMAIN_PDC: - case ROLE_DOMAIN_BDC: -- if ( !is_local_name && !is_my_domain ) { -- DEBUG(6,("check_samstrict_security: %s is not one of my local names or domain name (DC)\n", -- effective_domain)); -- return NT_STATUS_NOT_IMPLEMENTED; -+ if (!is_local_name && !is_my_domain) { -+ /* If we are running on a DC that has PASSDB module with domain -+ * information, check if DNS forest name is matching the domain -+ * name. This is the case of FreeIPA domain controller when -+ * trusted AD DCs attempt to authenticate FreeIPA users using -+ * the forest root domain (which is the only domain in FreeIPA). -+ */ -+ struct pdb_domain_info *dom_info = NULL; -+ -+ dom_info = pdb_get_domain_info(mem_ctx); -+ if ((dom_info != NULL) && (dom_info->dns_forest != NULL)) { -+ is_my_domain = strequal(user_info->mapped.domain_name, -+ dom_info->dns_forest); -+ } -+ -+ TALLOC_FREE(dom_info); -+ if (!is_my_domain) { -+ DEBUG(6,("check_samstrict_security: %s is not one " -+ "of my local names or domain name (DC)\n", -+ effective_domain)); -+ return NT_STATUS_NOT_IMPLEMENTED; -+ } - } - - break; -@@ -230,6 +249,24 @@ static NTSTATUS auth_sam_netlogon3_auth(const struct auth_context *auth_context, - } - - is_my_domain = strequal(user_info->mapped.domain_name, lp_workgroup()); -+ if (!is_my_domain) { -+ /* If we are running on a DC that has PASSDB module with domain -+ * information, check if DNS forest name is matching the domain -+ * name. This is the case of FreeIPA domain controller when -+ * trusted AD DCs attempt to authenticate FreeIPA users using -+ * the forest root domain (which is the only domain in FreeIPA). -+ */ -+ struct pdb_domain_info *dom_info = NULL; -+ dom_info = pdb_get_domain_info(mem_ctx); -+ -+ if ((dom_info != NULL) && (dom_info->dns_forest != NULL)) { -+ is_my_domain = strequal(user_info->mapped.domain_name, -+ dom_info->dns_forest); -+ } -+ -+ TALLOC_FREE(dom_info); -+ } -+ - if (!is_my_domain) { - DBG_INFO("%s is not our domain name (DC for %s)\n", - effective_domain, lp_workgroup()); --- -2.29.2 - - -From 173cabf40d71470a233b7648b1bf8795f8bda091 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Fri, 27 Nov 2020 11:22:15 +0100 -Subject: [PATCH 104/104] docs-xml: Add a section about weak crypto in testparm - manpage - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14583 - -Signed-off-by: Andreas Schneider -Reviewed-by: Alexander Bokovoy - -Autobuild-User(master): Andreas Schneider -Autobuild-Date(master): Fri Nov 27 13:48:20 UTC 2020 on sn-devel-184 - -(cherry picked from commit 5c27740aeff273bcd5f027d36874e56170234146) ---- - docs-xml/manpages/testparm.1.xml | 9 +++++++++ - 1 file changed, 9 insertions(+) - -diff --git a/docs-xml/manpages/testparm.1.xml b/docs-xml/manpages/testparm.1.xml -index 9099cda010f..7c7abf50e8b 100644 ---- a/docs-xml/manpages/testparm.1.xml -+++ b/docs-xml/manpages/testparm.1.xml -@@ -171,6 +171,15 @@ - errors and warnings if the file did not load. If the file was - loaded OK, the program then dumps all known service details - to stdout. -+ -+ For certain use cases, SMB protocol requires use of -+ cryptographic algorithms which are known to be weak and already -+ broken. DES and ARCFOUR (RC4) ciphers and the SHA1 and MD5 hash -+ algorithms are considered weak but they are required for backward -+ compatibility. The testparm utility shows whether the Samba tools -+ will fall back to these weak crypto algorithms if it is not possible -+ to use strong cryptography by default. -+ In FIPS mode weak crypto cannot be enabled. - - - --- -2.29.2 - diff --git a/samba.spec b/samba.spec index babc903..47d165a 100644 --- a/samba.spec +++ b/samba.spec @@ -110,13 +110,13 @@ %global main_release 0 -%global samba_version 4.13.4 -%global talloc_version 2.3.1 +%global samba_version 4.14.0 +%global talloc_version 2.3.2 %global tdb_version 1.4.3 %global tevent_version 0.10.2 %global ldb_version 2.2.0 # This should be rc1 or nil -%global pre_release %nil +%global pre_release rc1 %global samba_release %{main_release}%{?dist} %if "x%{?pre_release}" != "x" @@ -177,11 +177,6 @@ Source14: samba.pamd Source201: README.downgrade Patch1: samba-s4u.patch -# Backport bug fixes to https://gitlab.com/samba-redhat/samba/-/tree/v4-13-redhat -# This will give us CI and makes it easy to generate patchsets. -# -# Generate the patchset using: git format-patch -l1 --stdout -N > samba-4.13-redhat.patch -Patch2: samba-4.13-redhat.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -258,6 +253,7 @@ BuildRequires: perl(Archive::Tar) BuildRequires: perl(Test::More) BuildRequires: popt-devel BuildRequires: python3-devel +BuildRequires: python3-dns BuildRequires: python3-setuptools BuildRequires: quota-devel BuildRequires: readline-devel @@ -324,6 +320,7 @@ BuildRequires: krb5-server >= %{required_mit_krb5} BuildRequires: ldb-tools BuildRequires: python3-gpg BuildRequires: python3-markdown +BuildRequires: python3-setproctitle BuildRequires: tdb-tools %endif @@ -439,6 +436,7 @@ Requires: tdb-tools # samba-tool needs mdb_copy Requires: lmdb Requires: ldb-tools +Requires: python3-setproctitle # Force using libldb version to be the same as build version # Otherwise LDB modules will not be loaded and samba-tool will fail # See bug 1507420 @@ -858,6 +856,7 @@ projects to store temporary data. If an application is already using TDB for temporary data it is very easy to convert that application to be cluster aware and use CTDB instead. +%if %{with testsuite} ### CTDB-TEST %package -n ctdb-tests Summary: CTDB clustered database test suite @@ -877,6 +876,9 @@ CTDB is a cluster implementation of the TDB database used by Samba and other projects to store temporary data. If an application is already using TDB for temporary data it is very easy to convert that application to be cluster aware and use CTDB instead. + +#endif with selftest +%endif #endif with clustering %endif @@ -1967,7 +1969,6 @@ fi %{_includedir}/samba-4.0/util/idtree.h %{_includedir}/samba-4.0/util/idtree_random.h %{_includedir}/samba-4.0/util/signal.h -%{_includedir}/samba-4.0/util/string_wrappers.h %{_includedir}/samba-4.0/util/substitute.h %{_includedir}/samba-4.0/util/tevent_ntstatus.h %{_includedir}/samba-4.0/util/tevent_unix.h @@ -2137,7 +2138,6 @@ fi %{python3_sitearch}/samba/__pycache__/auth_util.*.pyc %{python3_sitearch}/samba/__pycache__/colour.*.pyc %{python3_sitearch}/samba/__pycache__/common.*.pyc -%{python3_sitearch}/samba/__pycache__/compat.*.pyc %{python3_sitearch}/samba/__pycache__/dbchecker.*.pyc %{python3_sitearch}/samba/__pycache__/descriptor.*.pyc %{python3_sitearch}/samba/__pycache__/dnsresolver.*.pyc @@ -2145,8 +2145,11 @@ fi %{python3_sitearch}/samba/__pycache__/getopt.*.pyc %{python3_sitearch}/samba/__pycache__/gpclass.*.pyc %{python3_sitearch}/samba/__pycache__/gp_ext_loader.*.pyc +%{python3_sitearch}/samba/__pycache__/gp_msgs_ext.*.pyc %{python3_sitearch}/samba/__pycache__/gp_scripts_ext.*.pyc %{python3_sitearch}/samba/__pycache__/gp_sec_ext.*.pyc +%{python3_sitearch}/samba/__pycache__/gp_smb_conf_ext.*.pyc +%{python3_sitearch}/samba/__pycache__/gp_sudoers_ext.*.pyc %{python3_sitearch}/samba/__pycache__/graph.*.pyc %{python3_sitearch}/samba/__pycache__/hostconfig.*.pyc %{python3_sitearch}/samba/__pycache__/idmap.*.pyc @@ -2164,6 +2167,7 @@ fi %{python3_sitearch}/samba/__pycache__/trust_utils.*.pyc %{python3_sitearch}/samba/__pycache__/upgrade.*.pyc %{python3_sitearch}/samba/__pycache__/upgradehelpers.*.pyc +%{python3_sitearch}/samba/__pycache__/vgp_sudoers_ext.*.pyc %{python3_sitearch}/samba/__pycache__/xattr.*.pyc %{python3_sitearch}/samba/_glue.*.so %{python3_sitearch}/samba/_ldb.*.so @@ -2172,7 +2176,6 @@ fi %{python3_sitearch}/samba/dbchecker.py %{python3_sitearch}/samba/colour.py %{python3_sitearch}/samba/common.py -%{python3_sitearch}/samba/compat.py %{python3_sitearch}/samba/credentials.*.so %{python3_sitearch}/samba/crypto.*.so %dir %{python3_sitearch}/samba/dcerpc @@ -2245,6 +2248,9 @@ fi %{python3_sitearch}/samba/emulate/traffic.py %{python3_sitearch}/samba/emulate/traffic_packets.py %{python3_sitearch}/samba/gp_ext_loader.py +%{python3_sitearch}/samba/gp_msgs_ext.py +%{python3_sitearch}/samba/gp_smb_conf_ext.py +%{python3_sitearch}/samba/gp_sudoers_ext.py %dir %{python3_sitearch}/samba/gp_parse %{python3_sitearch}/samba/gp_parse/__init__.py %dir %{python3_sitearch}/samba/gp_parse/__pycache__ @@ -2333,7 +2339,9 @@ fi %{python3_sitearch}/samba/samba3/__init__.py %dir %{python3_sitearch}/samba/samba3/__pycache__ %{python3_sitearch}/samba/samba3/__pycache__/__init__.*.pyc -%{python3_sitearch}/samba/samba3/libsmb_samba_internal.*.so +%{python3_sitearch}/samba/samba3/__pycache__/libsmb_samba_internal.*.pyc +%{python3_sitearch}/samba/samba3/libsmb_samba_cwrapper.cpython*.so +%{python3_sitearch}/samba/samba3/libsmb_samba_internal.py %{python3_sitearch}/samba/samba3/mdscli.*.so %{python3_sitearch}/samba/samba3/param.*.so %{python3_sitearch}/samba/samba3/passdb.*.so @@ -2348,13 +2356,10 @@ fi %{python3_sitearch}/samba/subunit/__pycache__/run.*.pyc %{python3_sitearch}/samba/subunit/run.py %{python3_sitearch}/samba/tdb_util.py -%dir %{python3_sitearch}/samba/third_party -%{python3_sitearch}/samba/third_party/__init__.py -%dir %{python3_sitearch}/samba/third_party/__pycache__ -%{python3_sitearch}/samba/third_party/__pycache__/__init__.*.pyc %{python3_sitearch}/samba/trust_utils.py %{python3_sitearch}/samba/upgrade.py %{python3_sitearch}/samba/upgradehelpers.py +%{python3_sitearch}/samba/vgp_sudoers_ext.py %{python3_sitearch}/samba/werror.*.so %{python3_sitearch}/samba/xattr.py %{python3_sitearch}/samba/xattr_native.*.so @@ -2466,6 +2471,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/complex_expressions.*.pyc %{python3_sitearch}/samba/tests/__pycache__/core.*.pyc %{python3_sitearch}/samba/tests/__pycache__/credentials.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/cred_opt.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dckeytab.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dns.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dns_base.*.pyc @@ -2539,6 +2545,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/security.*.pyc %{python3_sitearch}/samba/tests/__pycache__/segfault.*.pyc %{python3_sitearch}/samba/tests/__pycache__/smb.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/smb-notify.*.pyc %{python3_sitearch}/samba/tests/__pycache__/smbd_base.*.pyc %{python3_sitearch}/samba/tests/__pycache__/smbd_fuzztest.*.pyc %{python3_sitearch}/samba/tests/__pycache__/source.*.pyc @@ -2575,6 +2582,8 @@ fi %{python3_sitearch}/samba/tests/blackbox/__pycache__/samba_dnsupdate.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/smbcacls.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/smbcacls_basic.*.pyc +%{python3_sitearch}/samba/tests/blackbox/__pycache__/smbcacls_dfs_propagate_inherit.*.pyc +%{python3_sitearch}/samba/tests/blackbox/__pycache__/smbcacls_propagate_inhertance.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/smbcontrol.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/smbcontrol_process.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/traffic_learner.*.pyc @@ -2589,6 +2598,8 @@ fi %{python3_sitearch}/samba/tests/blackbox/samba_dnsupdate.py %{python3_sitearch}/samba/tests/blackbox/smbcacls.py %{python3_sitearch}/samba/tests/blackbox/smbcacls_basic.py +%{python3_sitearch}/samba/tests/blackbox/smbcacls_dfs_propagate_inherit.py +%{python3_sitearch}/samba/tests/blackbox/smbcacls_propagate_inhertance.py %{python3_sitearch}/samba/tests/blackbox/smbcontrol.py %{python3_sitearch}/samba/tests/blackbox/smbcontrol_process.py %{python3_sitearch}/samba/tests/blackbox/traffic_learner.py @@ -2598,6 +2609,7 @@ fi %{python3_sitearch}/samba/tests/complex_expressions.py %{python3_sitearch}/samba/tests/core.py %{python3_sitearch}/samba/tests/credentials.py +%{python3_sitearch}/samba/tests/cred_opt.py %dir %{python3_sitearch}/samba/tests/dcerpc %{python3_sitearch}/samba/tests/dcerpc/__init__.py %dir %{python3_sitearch}/samba/tests/dcerpc/__pycache__ @@ -2689,14 +2701,26 @@ fi %{python3_sitearch}/samba/tests/kcc/ldif_import_export.py %dir %{python3_sitearch}/samba/tests/krb5 %dir %{python3_sitearch}/samba/tests/krb5/__pycache__ +%{python3_sitearch}/samba/tests/krb5/__pycache__/as_canonicalization_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/compatability_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kcrypto.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_base_test.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tgs_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/raw_testcase.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/rfc4120_constants.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/rfc4120_pyasn1.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/simple_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/s4u_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/xrealm_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/as_canonicalization_tests.py +%{python3_sitearch}/samba/tests/krb5/compatability_tests.py %{python3_sitearch}/samba/tests/krb5/kcrypto.py +%{python3_sitearch}/samba/tests/krb5/kdc_base_test.py +%{python3_sitearch}/samba/tests/krb5/kdc_tests.py +%{python3_sitearch}/samba/tests/krb5/kdc_tgs_tests.py %{python3_sitearch}/samba/tests/krb5/raw_testcase.py +%{python3_sitearch}/samba/tests/krb5/rfc4120_constants.py %{python3_sitearch}/samba/tests/krb5/rfc4120_pyasn1.py %{python3_sitearch}/samba/tests/krb5/simple_tests.py %{python3_sitearch}/samba/tests/krb5/s4u_tests.py @@ -2822,6 +2846,7 @@ fi %{python3_sitearch}/samba/tests/security.py %{python3_sitearch}/samba/tests/segfault.py %{python3_sitearch}/samba/tests/smb.py +%{python3_sitearch}/samba/tests/smb-notify.py %{python3_sitearch}/samba/tests/smbd_base.py %{python3_sitearch}/samba/tests/smbd_fuzztest.py %{python3_sitearch}/samba/tests/source.py @@ -2890,6 +2915,8 @@ fi %ghost %{_libdir}/krb5/plugins/libkrb5/winbind_krb5_locator.so %dir %{_libdir}/samba/krb5 %{_libdir}/samba/krb5/winbind_krb5_locator.so +# correct rpm package? +%{_libdir}/samba/krb5/async_dns_krb5_locator.so %{_mandir}/man8/winbind_krb5_locator.8* ### WINBIND-MODULES @@ -2941,11 +2968,10 @@ fi %{_sbindir}/ctdbd %{_sbindir}/ctdbd_wrapper %{_bindir}/ctdb -%{_bindir}/ctdb_local_daemons -%{_bindir}/ping_pong -%{_bindir}/ltdbtool %{_bindir}/ctdb_diagnostics +%{_bindir}/ltdbtool %{_bindir}/onnode +%{_bindir}/ping_pong %dir %{_libexecdir}/ctdb %{_libexecdir}/ctdb/ctdb-config @@ -3006,8 +3032,10 @@ fi %{_datadir}/ctdb/events/legacy/70.iscsi.script %{_datadir}/ctdb/events/legacy/91.lvs.script +%if %{with testsuite} %files -n ctdb-tests %doc ctdb/tests/README +%{_bindir}/ctdb_local_daemons %{_bindir}/ctdb_run_tests %{_bindir}/ctdb_run_cluster_tests @@ -3145,7 +3173,6 @@ fi %{_datadir}/ctdb/tests/INTEGRATION/simple/basics.005.process_exists.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/basics.010.statistics.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/basics.011.statistics_reset.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.001.isnotrecmaster.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.002.recmaster_yield.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.010.getrelock.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.012.reclock_command.sh @@ -3786,6 +3813,8 @@ fi %{_datadir}/ctdb/tests/UNIT/tool/README %dir %{_datadir}/ctdb/tests/UNIT/tool/scripts %{_datadir}/ctdb/tests/UNIT/tool/scripts/local.sh +#endif with selftest +%endif #endif with clustering %endif @@ -3798,6 +3827,9 @@ fi %endif %changelog +* Wed Jan 27 2021 Guenther Deschner - 4.14.0rc1-0 +- Update to Samba 4.14.0rc1 + * Tue Jan 26 2021 Guenther Deschner - 4.13.4-0 - Update to Samba 4.13.4 diff --git a/sources b/sources index 2d17de0..11873bc 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.13.4.tar.xz) = c6fb8b4186da25c69d1bc662780a12c6fa6fa70fc65fa487dba2d547c96e8f7f8f8736b8edc2564b599be875b00d891631fa37838632efac593bf83eb33392f9 -SHA512 (samba-4.13.4.tar.asc) = b8c0ccd7e716d2de6e9da2a53577bc31983eaec4ed4583bb88b52b2ca8b80045c8c0349a97a12e796df84a5942293f5a40e74eff8c003b3062f8f6454dc2a631 +SHA512 (samba-4.14.0rc1.tar.xz) = 1ae0401be3fbad6f46b3216649b7c00671136554bfa672fd01f5027ca3babb4fb7019863414fd7a49d443b8f5a913d4fb645ccf8df2d1aceb7214323ea66f87b +SHA512 (samba-4.14.0rc1.tar.asc) = f876da3c00418ec2b612b52354a8bfd1544984d5dd69752f18ec78d0b30243ea6c6c976b6ece3988094a986cf8568f440b63eacaee4d8a1e60039d899d21bff3 From 5e5dc1ede596138fc5ad060c9ef6fcdfedcb4cf5 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 3 Feb 2021 11:28:40 +0100 Subject: [PATCH 076/425] Add missing post requirement for libwbclient --- samba.spec | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/samba.spec b/samba.spec index 47d165a..d56d5c9 100644 --- a/samba.spec +++ b/samba.spec @@ -190,6 +190,7 @@ Requires: %{name}-common-tools = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} %if %{with libwbclient} +Requires(post): libwbclient = %{samba_depver} Requires: libwbclient = %{samba_depver} %endif @@ -431,6 +432,10 @@ Requires: %{name}-libs = %{samba_depver} Requires: %{name}-dc-provision = %{samba_depver} Requires: %{name}-dc-libs = %{samba_depver} Requires: %{name}-winbind = %{samba_depver} + +Requires(post): libwbclient = %{samba_depver} +Requires: libwbclient = %{samba_depver} + # samba-tool needs tdbbackup Requires: tdb-tools # samba-tool needs mdb_copy @@ -737,6 +742,8 @@ Requires: %{name}-common-tools = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-winbind-modules = %{samba_depver} + +Requires(post): libwbclient = %{samba_depver} Requires: libwbclient = %{samba_depver} Provides: samba4-winbind = %{samba_depver} From e267c837dc2a3935d7eec67ac07067268e051e2d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 4 Feb 2021 13:26:29 +0100 Subject: [PATCH 077/425] Update to Samba 4.14.0rc2 Guenther --- .gitignore | 2 ++ samba.spec | 5 ++++- sources | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 3e7538e..c74b20e 100644 --- a/.gitignore +++ b/.gitignore @@ -233,3 +233,5 @@ samba-3.6.0pre1.tar.gz /samba-4.13.4.tar.asc /samba-4.14.0rc1.tar.xz /samba-4.14.0rc1.tar.asc +/samba-4.14.0rc2.tar.xz +/samba-4.14.0rc2.tar.asc diff --git a/samba.spec b/samba.spec index d56d5c9..5f6927d 100644 --- a/samba.spec +++ b/samba.spec @@ -116,7 +116,7 @@ %global tevent_version 0.10.2 %global ldb_version 2.2.0 # This should be rc1 or nil -%global pre_release rc1 +%global pre_release rc2 %global samba_release %{main_release}%{?dist} %if "x%{?pre_release}" != "x" @@ -3834,6 +3834,9 @@ fi %endif %changelog +* Thu Feb 04 2021 Guenther Deschner - 4.14.0rc2-0 +- Update to Samba 4.14.0rc2 + * Wed Jan 27 2021 Guenther Deschner - 4.14.0rc1-0 - Update to Samba 4.14.0rc1 diff --git a/sources b/sources index 11873bc..2f38afc 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.14.0rc1.tar.xz) = 1ae0401be3fbad6f46b3216649b7c00671136554bfa672fd01f5027ca3babb4fb7019863414fd7a49d443b8f5a913d4fb645ccf8df2d1aceb7214323ea66f87b -SHA512 (samba-4.14.0rc1.tar.asc) = f876da3c00418ec2b612b52354a8bfd1544984d5dd69752f18ec78d0b30243ea6c6c976b6ece3988094a986cf8568f440b63eacaee4d8a1e60039d899d21bff3 +SHA512 (samba-4.14.0rc2.tar.xz) = 7dd006538ef2d386dc60949bc23a25ff731a0fb4ec4a078500a27b7ea8352b6b5b7c306e0592007d6e79a13da1bfc201ed34c57df6bf2fda3484e5053f13a6e2 +SHA512 (samba-4.14.0rc2.tar.asc) = 104ac6e7ddb341f12432bb3686a80460fe67523a19f9eb058da112eafe0411839ea73510ad964d5f0a3da1d0372d716593fb68a9cc1ae7e7af5e7457417b2d24 From 8f1e592d6ac5c84499756644ea5d6217d6aef1ec Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 4 Feb 2021 16:59:03 +0100 Subject: [PATCH 078/425] Add python3-pyasn1 for krb5 tests --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index 5f6927d..e9ae425 100644 --- a/samba.spec +++ b/samba.spec @@ -287,6 +287,7 @@ BuildRequires: liburing-devel >= 0.4 # Add python3-iso8601 to avoid that the # version in Samba is being packaged BuildRequires: python3-iso8601 +BuildRequires: python3-pyasn1 BuildRequires: bind BuildRequires: krb5-server >= %{required_mit_krb5} From 6cddc6448b7d74a4d9af0d95ce4a37febf4b5ea4 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 4 Feb 2021 17:08:03 +0100 Subject: [PATCH 079/425] Protect 'Require' of libwbclient --- samba.spec | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/samba.spec b/samba.spec index e9ae425..06571f3 100644 --- a/samba.spec +++ b/samba.spec @@ -434,8 +434,10 @@ Requires: %{name}-dc-provision = %{samba_depver} Requires: %{name}-dc-libs = %{samba_depver} Requires: %{name}-winbind = %{samba_depver} +%if %{with libwbclient} Requires(post): libwbclient = %{samba_depver} Requires: libwbclient = %{samba_depver} +%endif # samba-tool needs tdbbackup Requires: tdb-tools @@ -744,8 +746,10 @@ Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-winbind-modules = %{samba_depver} +%if %{with libwbclient} Requires(post): libwbclient = %{samba_depver} Requires: libwbclient = %{samba_depver} +%endif Provides: samba4-winbind = %{samba_depver} Obsoletes: samba4-winbind < %{samba_depver} From 83436d8564d89b55ac9238adcfe6a8aa58861e09 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 18 Feb 2021 13:13:02 +0100 Subject: [PATCH 080/425] Update to Samba 4.14.0rc3 Guenther --- .gitignore | 2 ++ samba.spec | 5 ++++- sources | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index c74b20e..1668ffb 100644 --- a/.gitignore +++ b/.gitignore @@ -235,3 +235,5 @@ samba-3.6.0pre1.tar.gz /samba-4.14.0rc1.tar.asc /samba-4.14.0rc2.tar.xz /samba-4.14.0rc2.tar.asc +/samba-4.14.0rc3.tar.xz +/samba-4.14.0rc3.tar.asc diff --git a/samba.spec b/samba.spec index 06571f3..373e69d 100644 --- a/samba.spec +++ b/samba.spec @@ -116,7 +116,7 @@ %global tevent_version 0.10.2 %global ldb_version 2.2.0 # This should be rc1 or nil -%global pre_release rc2 +%global pre_release rc3 %global samba_release %{main_release}%{?dist} %if "x%{?pre_release}" != "x" @@ -3839,6 +3839,9 @@ fi %endif %changelog +* Thu Feb 18 2021 Guenther Deschner - 4.14.0rc3-0 +- Update to Samba 4.14.0rc3 + * Thu Feb 04 2021 Guenther Deschner - 4.14.0rc2-0 - Update to Samba 4.14.0rc2 diff --git a/sources b/sources index 2f38afc..19aab9f 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.14.0rc2.tar.xz) = 7dd006538ef2d386dc60949bc23a25ff731a0fb4ec4a078500a27b7ea8352b6b5b7c306e0592007d6e79a13da1bfc201ed34c57df6bf2fda3484e5053f13a6e2 -SHA512 (samba-4.14.0rc2.tar.asc) = 104ac6e7ddb341f12432bb3686a80460fe67523a19f9eb058da112eafe0411839ea73510ad964d5f0a3da1d0372d716593fb68a9cc1ae7e7af5e7457417b2d24 +SHA512 (samba-4.14.0rc3.tar.xz) = 5f99e61d87f742850018d4bbed8d7dfd058f3f6b7db068d384680e6ded9fa63b9c1505f918d4e71dcf5d6ff516078346bc24c5ede8078ebec4f05032fb988edd +SHA512 (samba-4.14.0rc3.tar.asc) = 6565849b11918d7d8f0ccc809d862f579ab69a645f8ba6fc26c1e3fc446199874400240a1a5ccf0bd310394e49e6730d033673c6281d23b84fb661243e98ff08 From 45765aba68c9eee4f274541b236aabc05dc72ea9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 1 Mar 2021 12:15:45 +0100 Subject: [PATCH 081/425] Update to Samba 4.14.0rc4 Guenther --- .gitignore | 2 ++ samba.spec | 5 ++++- sources | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 1668ffb..80b0ec3 100644 --- a/.gitignore +++ b/.gitignore @@ -237,3 +237,5 @@ samba-3.6.0pre1.tar.gz /samba-4.14.0rc2.tar.asc /samba-4.14.0rc3.tar.xz /samba-4.14.0rc3.tar.asc +/samba-4.14.0rc4.tar.xz +/samba-4.14.0rc4.tar.asc diff --git a/samba.spec b/samba.spec index 373e69d..9728166 100644 --- a/samba.spec +++ b/samba.spec @@ -116,7 +116,7 @@ %global tevent_version 0.10.2 %global ldb_version 2.2.0 # This should be rc1 or nil -%global pre_release rc3 +%global pre_release rc4 %global samba_release %{main_release}%{?dist} %if "x%{?pre_release}" != "x" @@ -3839,6 +3839,9 @@ fi %endif %changelog +* Mon Mar 01 2021 Guenther Deschner - 4.14.0rc4-0 +- Update to Samba 4.14.0rc4 + * Thu Feb 18 2021 Guenther Deschner - 4.14.0rc3-0 - Update to Samba 4.14.0rc3 diff --git a/sources b/sources index 19aab9f..2d69cdb 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.14.0rc3.tar.xz) = 5f99e61d87f742850018d4bbed8d7dfd058f3f6b7db068d384680e6ded9fa63b9c1505f918d4e71dcf5d6ff516078346bc24c5ede8078ebec4f05032fb988edd -SHA512 (samba-4.14.0rc3.tar.asc) = 6565849b11918d7d8f0ccc809d862f579ab69a645f8ba6fc26c1e3fc446199874400240a1a5ccf0bd310394e49e6730d033673c6281d23b84fb661243e98ff08 +SHA512 (samba-4.14.0rc4.tar.xz) = 82d5577998158338eb2aef4f1466114d549e6b6e728b4f0cf1d2aa09ebb0139d0731e56da24c051ddc8b9a85ab084e1f3db0ac083ca7d92a30270d10e8eba1ea +SHA512 (samba-4.14.0rc4.tar.asc) = a24ac0882279ed1374569ad5e738f9b594aba8b7a0bd86b8a14963146d5f2f55c44fe2e3b925a449f50ef5401418265a8536ed8dbc72b16d443c4a7b9e0b5a68 From 18faec13bc46d06d6b3d91c3d1c4160d8fcbfc6d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 2 Mar 2021 16:12:49 +0100 Subject: [PATCH 082/425] Rebuilt for updated systemd-rpm-macros See https://pagure.io/fesco/issue/2583. --- samba.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 9728166..e8a0be2 100644 --- a/samba.spec +++ b/samba.spec @@ -145,7 +145,7 @@ Name: samba Version: %{samba_version} -Release: %{samba_release} +Release: %{samba_release}.2 %if 0%{?rhel} Epoch: 0 @@ -3839,6 +3839,10 @@ fi %endif %changelog +* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 2:4.14.0-0.0.rc4.2 +- Rebuilt for updated systemd-rpm-macros + See https://pagure.io/fesco/issue/2583. + * Mon Mar 01 2021 Guenther Deschner - 4.14.0rc4-0 - Update to Samba 4.14.0rc4 From f931b17773ce7c2cbf6553618b4af4af0730dd65 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 9 Mar 2021 17:08:03 +0100 Subject: [PATCH 083/425] Update to Samba 4.14.0 Guenther --- .gitignore | 2 ++ samba.spec | 9 ++++++--- sources | 4 ++-- 3 files changed, 10 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 80b0ec3..d616a91 100644 --- a/.gitignore +++ b/.gitignore @@ -239,3 +239,5 @@ samba-3.6.0pre1.tar.gz /samba-4.14.0rc3.tar.asc /samba-4.14.0rc4.tar.xz /samba-4.14.0rc4.tar.asc +/samba-4.14.0.tar.xz +/samba-4.14.0.tar.asc diff --git a/samba.spec b/samba.spec index e8a0be2..77e355a 100644 --- a/samba.spec +++ b/samba.spec @@ -108,7 +108,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global main_release 0 +%global main_release 1 %global samba_version 4.14.0 %global talloc_version 2.3.2 @@ -116,7 +116,7 @@ %global tevent_version 0.10.2 %global ldb_version 2.2.0 # This should be rc1 or nil -%global pre_release rc4 +%global pre_release %nil %global samba_release %{main_release}%{?dist} %if "x%{?pre_release}" != "x" @@ -145,7 +145,7 @@ Name: samba Version: %{samba_version} -Release: %{samba_release}.2 +Release: %{samba_release} %if 0%{?rhel} Epoch: 0 @@ -3839,6 +3839,9 @@ fi %endif %changelog +* Tue Mar 09 2021 Guenther Deschner - 4.14.0-3 +- Update to Samba 4.14.0 + * Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 2:4.14.0-0.0.rc4.2 - Rebuilt for updated systemd-rpm-macros See https://pagure.io/fesco/issue/2583. diff --git a/sources b/sources index 2d69cdb..e353852 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.14.0rc4.tar.xz) = 82d5577998158338eb2aef4f1466114d549e6b6e728b4f0cf1d2aa09ebb0139d0731e56da24c051ddc8b9a85ab084e1f3db0ac083ca7d92a30270d10e8eba1ea -SHA512 (samba-4.14.0rc4.tar.asc) = a24ac0882279ed1374569ad5e738f9b594aba8b7a0bd86b8a14963146d5f2f55c44fe2e3b925a449f50ef5401418265a8536ed8dbc72b16d443c4a7b9e0b5a68 +SHA512 (samba-4.14.0.tar.xz) = 0f8e5d6e404769b37562ab7660e9829139e4cdea6288a7ff93f244e5dd02d2b35659321cc5dfd38f3b3e55e7c044626397ef959e3887e32cc9dc70ad8061d1d3 +SHA512 (samba-4.14.0.tar.asc) = 701e6df132549d7f627fb08ff187d448382a657f332c9d0368c53f0583287712537f5f510a8c7a6b5cd20e7ee2cae210c3f789704b47095a27bbaedbff29d992 From e5dda56658468f5cff3cbf3fa9dbe84aa93f1729 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 24 Mar 2021 11:20:23 +0100 Subject: [PATCH 084/425] Update to Samba 4.14.1 resolves: #1941400, #1942496 - Security fixes for CVE-2020-27840 resolves: #1941402, #1942497 - Security fixes for CVE-2021-20277 Guenther --- .gitignore | 2 ++ samba.spec | 9 +++++++-- sources | 4 ++-- 3 files changed, 11 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index d616a91..4790826 100644 --- a/.gitignore +++ b/.gitignore @@ -241,3 +241,5 @@ samba-3.6.0pre1.tar.gz /samba-4.14.0rc4.tar.asc /samba-4.14.0.tar.xz /samba-4.14.0.tar.asc +/samba-4.14.1.tar.xz +/samba-4.14.1.tar.asc diff --git a/samba.spec b/samba.spec index 77e355a..35973f8 100644 --- a/samba.spec +++ b/samba.spec @@ -108,9 +108,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global main_release 1 +%global main_release 0 -%global samba_version 4.14.0 +%global samba_version 4.14.1 %global talloc_version 2.3.2 %global tdb_version 1.4.3 %global tevent_version 0.10.2 @@ -3839,6 +3839,11 @@ fi %endif %changelog +* Wed Mar 24 2021 Guenther Deschner - 4.14.1-0 +- Update to Samba 4.14.1 +- resolves: #1941400, #1942496 - Security fixes for CVE-2020-27840 +- resolves: #1941402, #1942497 - Security fixes for CVE-2021-20277 + * Tue Mar 09 2021 Guenther Deschner - 4.14.0-3 - Update to Samba 4.14.0 diff --git a/sources b/sources index e353852..b090bed 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.14.0.tar.xz) = 0f8e5d6e404769b37562ab7660e9829139e4cdea6288a7ff93f244e5dd02d2b35659321cc5dfd38f3b3e55e7c044626397ef959e3887e32cc9dc70ad8061d1d3 -SHA512 (samba-4.14.0.tar.asc) = 701e6df132549d7f627fb08ff187d448382a657f332c9d0368c53f0583287712537f5f510a8c7a6b5cd20e7ee2cae210c3f789704b47095a27bbaedbff29d992 +SHA512 (samba-4.14.1.tar.xz) = edc3a089b2bce082d6eb895c7416d5c3199b9ddb6510b18ac54348209c78d50c44e24ce45aaca86ae3081a2ceb6870f79f746de6b2235a7cd19880865a6c31be +SHA512 (samba-4.14.1.tar.asc) = 2a898c72714b3ec1f53c1fe4e2106280e49146c04088b9936774ea48224908ed6b0304d316399490a9a5f9ef59ae326c2e2bd748c97b65063af0e00303123740 From b05e4ed148ffa8ec8d988e871cdbc351cdc83d80 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 25 Mar 2021 00:20:05 +0100 Subject: [PATCH 085/425] Update to Samba 4.14.2 related: #1941400, #1942496 - Security fixes for CVE-2020-27840 related: #1941402, #1942497 - Security fixes for CVE-2021-20277 Guenther --- .gitignore | 2 ++ samba.spec | 9 +++++++-- sources | 4 ++-- 3 files changed, 11 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 4790826..01c732c 100644 --- a/.gitignore +++ b/.gitignore @@ -243,3 +243,5 @@ samba-3.6.0pre1.tar.gz /samba-4.14.0.tar.asc /samba-4.14.1.tar.xz /samba-4.14.1.tar.asc +/samba-4.14.2.tar.xz +/samba-4.14.2.tar.asc diff --git a/samba.spec b/samba.spec index 35973f8..1cd7a05 100644 --- a/samba.spec +++ b/samba.spec @@ -110,11 +110,11 @@ %global main_release 0 -%global samba_version 4.14.1 +%global samba_version 4.14.2 %global talloc_version 2.3.2 %global tdb_version 1.4.3 %global tevent_version 0.10.2 -%global ldb_version 2.2.0 +%global ldb_version 2.3.0 # This should be rc1 or nil %global pre_release %nil @@ -3839,6 +3839,11 @@ fi %endif %changelog +* Thu Mar 25 2021 Guenther Deschner - 4.14.2-0 +- Update to Samba 4.14.2 +- related: #1941400, #1942496 - Security fixes for CVE-2020-27840 +- related: #1941402, #1942497 - Security fixes for CVE-2021-20277 + * Wed Mar 24 2021 Guenther Deschner - 4.14.1-0 - Update to Samba 4.14.1 - resolves: #1941400, #1942496 - Security fixes for CVE-2020-27840 diff --git a/sources b/sources index b090bed..03983cb 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.14.1.tar.xz) = edc3a089b2bce082d6eb895c7416d5c3199b9ddb6510b18ac54348209c78d50c44e24ce45aaca86ae3081a2ceb6870f79f746de6b2235a7cd19880865a6c31be -SHA512 (samba-4.14.1.tar.asc) = 2a898c72714b3ec1f53c1fe4e2106280e49146c04088b9936774ea48224908ed6b0304d316399490a9a5f9ef59ae326c2e2bd748c97b65063af0e00303123740 +SHA512 (samba-4.14.2.tar.xz) = 5353cf67eac165afc0443639266354402f8d20437f8cd9389ff33201ab8261aacd21cfb9140b5816a9c39e2471fe6bce405d5b99103b1410768f56619010429d +SHA512 (samba-4.14.2.tar.asc) = 586d8a38be861195f87f4d23149c5483494a7fdbb530f4707b8ce0cfb39723ca0b6c5d9c1064c6235d1bb652558c5c113482d46163982e67c78bff2238605e25 From d08e5bf692e8b0a1b3ee54d7a8d1691f5cf8e082 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Wed, 7 Apr 2021 18:05:51 +0300 Subject: [PATCH 086/425] Fix RPC server memory leaks Resolves: rhbz#1946950 Signed-off-by: Alexander Bokovoy --- samba-bz14675-fix.patch | 157 ++++++++++++++++++++++++++++++++++++++++ samba.spec | 7 +- 2 files changed, 163 insertions(+), 1 deletion(-) create mode 100644 samba-bz14675-fix.patch diff --git a/samba-bz14675-fix.patch b/samba-bz14675-fix.patch new file mode 100644 index 0000000..f625a95 --- /dev/null +++ b/samba-bz14675-fix.patch @@ -0,0 +1,157 @@ +From 75a66ce1da41c5b081771b2db55c2994d378d882 Mon Sep 17 00:00:00 2001 +From: Ralph Boehme +Date: Tue, 23 Mar 2021 11:40:21 +0100 +Subject: [PATCH 1/3] pidl: set the per-request memory context in the pidl + generator + +The talloc memory context referenced by the pipe_struct mem_ctx member is used +as talloc parent for RPC response data by the RPC service implementations. + +In Samba versions up to 4.10 all talloc children of p->mem_ctx were freed after +a RPC response was delivered by calling talloc_free_children(p->mem_ctx). Commit +60fa8e255254d38e9443bf96f2c0f31430be6ab8 removed this call which resulted in all +memory allocations on this context not getting released, which can consume +significant memory in long running RPC connections. + +Instead of putting the talloc_free_children(p->mem_ctx) back, just use the +mem_ctx argument of the ${pipename}_op_dispatch_internal() function which is a +dcesrv_call_state object created by dcesrv_process_ncacn_packet() and released +by the RPC server when the RPC request processing is finished. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14675 +CI: https://gitlab.com/samba-team/samba/-/merge_requests/1861 + +Signed-off-by: Ralph Boehme +Reviewed-by: Volker Lendecke +(cherry picked from commit 4c3fb2a5912966a61e7ebdb05eb3231a0e1d6033) +--- + pidl/lib/Parse/Pidl/Samba4/NDR/ServerCompat.pm | 2 ++ + source3/rpc_server/rpc_handles.c | 6 ------ + 2 files changed, 2 insertions(+), 6 deletions(-) + +diff --git a/pidl/lib/Parse/Pidl/Samba4/NDR/ServerCompat.pm b/pidl/lib/Parse/Pidl/Samba4/NDR/ServerCompat.pm +index 54feea0a9ef..d1368c3dbca 100644 +--- a/pidl/lib/Parse/Pidl/Samba4/NDR/ServerCompat.pm ++++ b/pidl/lib/Parse/Pidl/Samba4/NDR/ServerCompat.pm +@@ -299,6 +299,7 @@ sub boilerplate_iface($) + $self->pidl("/* Update pipes struct opnum */"); + $self->pidl("p->opnum = opnum;"); + $self->pidl("p->dce_call = dce_call;"); ++ $self->pidl("p->mem_ctx = mem_ctx;"); + $self->pidl("/* Update pipes struct session info */"); + $self->pidl("pipe_session_info = p->session_info;"); + $self->pidl("p->session_info = dce_call->auth_state->session_info;"); +@@ -344,6 +345,7 @@ sub boilerplate_iface($) + $self->pidl(""); + + $self->pidl("p->dce_call = NULL;"); ++ $self->pidl("p->mem_ctx = NULL;"); + $self->pidl("/* Restore session info */"); + $self->pidl("p->session_info = pipe_session_info;"); + $self->pidl("p->auth.auth_type = 0;"); +diff --git a/source3/rpc_server/rpc_handles.c b/source3/rpc_server/rpc_handles.c +index 45968746440..9ef93231466 100644 +--- a/source3/rpc_server/rpc_handles.c ++++ b/source3/rpc_server/rpc_handles.c +@@ -60,12 +60,6 @@ int make_base_pipes_struct(TALLOC_CTX *mem_ctx, + return ENOMEM; + } + +- p->mem_ctx = talloc_named(p, 0, "pipe %s %p", pipe_name, p); +- if (!p->mem_ctx) { +- talloc_free(p); +- return ENOMEM; +- } +- + p->msg_ctx = msg_ctx; + p->transport = transport; + +-- +2.30.2 + + +From 33a7749f7fc5c58752815789d086d696a20878e7 Mon Sep 17 00:00:00 2001 +From: Ralph Boehme +Date: Mon, 22 Mar 2021 12:06:39 +0100 +Subject: [PATCH 2/3] spools: avoid leaking memory into the callers mem_ctx + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14675 +CI: https://gitlab.com/samba-team/samba/-/merge_requests/1861 + +Signed-off-by: Ralph Boehme +Reviewed-by: Volker Lendecke +(cherry picked from commit 481176ec745c14b78fca68e01a61c83405a4b97b) +--- + source3/rpc_server/spoolss/srv_spoolss_nt.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/source3/rpc_server/spoolss/srv_spoolss_nt.c b/source3/rpc_server/spoolss/srv_spoolss_nt.c +index d20c19d5271..24ea7367ec8 100644 +--- a/source3/rpc_server/spoolss/srv_spoolss_nt.c ++++ b/source3/rpc_server/spoolss/srv_spoolss_nt.c +@@ -5731,7 +5731,8 @@ static WERROR construct_printer_driver_info_level(TALLOC_CTX *mem_ctx, + } + + if (pinfo2->drivername == NULL || pinfo2->drivername[0] == '\0') { +- return WERR_UNKNOWN_PRINTER_DRIVER; ++ result = WERR_UNKNOWN_PRINTER_DRIVER; ++ goto done; + } + + DBG_INFO("Construct printer driver [%s] for [%s]\n", +@@ -7023,7 +7024,8 @@ static WERROR update_printer(struct pipes_struct *p, + raddr = tsocket_address_inet_addr_string(p->remote_address, + p->mem_ctx); + if (raddr == NULL) { +- return WERR_NOT_ENOUGH_MEMORY; ++ result = WERR_NOT_ENOUGH_MEMORY; ++ goto done; + } + + /* add_printer_hook() will call reload_services() */ +-- +2.30.2 + + +From 602290d48d3bc49acca64a089822f26da293ee1e Mon Sep 17 00:00:00 2001 +From: Volker Lendecke +Date: Tue, 23 Mar 2021 17:06:15 +0100 +Subject: [PATCH 3/3] rpc_server3: Fix a memleak for internal pipes +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +state->call should not be talloc'ed off a long-lived context + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14675 +CI: https://gitlab.com/samba-team/samba/-/merge_requests/1861 +RN: Memory leak in the RPC server + +Signed-off-by: Volker Lendecke +Reviewed-by: Samuel Cabrero +Reviewed-by: Ralph Boehme + +Autobuild-User(master): Ralph Böhme +Autobuild-Date(master): Wed Mar 31 12:14:01 UTC 2021 on sn-devel-184 + +(cherry picked from commit 12f516e4680753460e7fe8811e6c6ff70057580c) +--- + source3/rpc_server/rpc_ncacn_np.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/source3/rpc_server/rpc_ncacn_np.c b/source3/rpc_server/rpc_ncacn_np.c +index 9ba271c2479..494b002e714 100644 +--- a/source3/rpc_server/rpc_ncacn_np.c ++++ b/source3/rpc_server/rpc_ncacn_np.c +@@ -476,7 +476,7 @@ static struct tevent_req *rpcint_bh_raw_call_send(TALLOC_CTX *mem_ctx, + return tevent_req_post(req, ev); + } + +- state->call = talloc_zero(hs->conn, struct dcesrv_call_state); ++ state->call = talloc_zero(state, struct dcesrv_call_state); + if (tevent_req_nomem(state->call, req)) { + return tevent_req_post(req, ev); + } +-- +2.30.2 + diff --git a/samba.spec b/samba.spec index 1cd7a05..acc4c01 100644 --- a/samba.spec +++ b/samba.spec @@ -108,7 +108,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global main_release 0 +%global main_release 1 %global samba_version 4.14.2 %global talloc_version 2.3.2 @@ -177,6 +177,7 @@ Source14: samba.pamd Source201: README.downgrade Patch1: samba-s4u.patch +Patch2: samba-bz14675-fix.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -3839,6 +3840,10 @@ fi %endif %changelog +* Wed Apr 07 2021 Alexander Bokovoy - 4.14.2-1 +- Fix memory leaks in RPC server +- resolves: #1946950 + * Thu Mar 25 2021 Guenther Deschner - 4.14.2-0 - Update to Samba 4.14.2 - related: #1941400, #1942496 - Security fixes for CVE-2020-27840 From e68a8ba5b9322a57f5320b52db05a835a2d95ff2 Mon Sep 17 00:00:00 2001 From: "Richard W.M. Jones" Date: Wed, 14 Apr 2021 10:23:01 +0100 Subject: [PATCH 087/425] Rebuild for updated liburing. --- samba.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index acc4c01..78ed11d 100644 --- a/samba.spec +++ b/samba.spec @@ -108,7 +108,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global main_release 1 +%global main_release 2 %global samba_version 4.14.2 %global talloc_version 2.3.2 @@ -3840,6 +3840,9 @@ fi %endif %changelog +* Wed Apr 14 2021 Richard W.M. Jones - 2:4.14.2-2 +- Rebuild for updated liburing. + * Wed Apr 07 2021 Alexander Bokovoy - 4.14.2-1 - Fix memory leaks in RPC server - resolves: #1946950 From 4651019383635d0d339d3654462aafc2bc8055f5 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 19 Apr 2021 09:24:32 +0200 Subject: [PATCH 088/425] Remove unused filter-requires-samba.sh --- filter-requires-samba.sh | 3 --- 1 file changed, 3 deletions(-) delete mode 100755 filter-requires-samba.sh diff --git a/filter-requires-samba.sh b/filter-requires-samba.sh deleted file mode 100755 index 1ec1679..0000000 --- a/filter-requires-samba.sh +++ /dev/null @@ -1,3 +0,0 @@ -#!/bin/sh - -/usr/lib/rpm/perl.req $* | grep -E -v '(Net::LDAP|Crypt::SmbHash|CGI|Unicode::MapUTF8|smbldap_tools|Carp|Convert::ASN1|Getopt::Long|Getopt::Std|IO::Socket|POSIX|Time::Local|strict)' From 2ae69028bfe678b41e1c0d14fec091f7b03ccde1 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 19 Apr 2021 09:25:41 +0200 Subject: [PATCH 089/425] Remove findsmb script resolves: #1949295 --- samba.spec | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 78ed11d..d63ec76 100644 --- a/samba.spec +++ b/samba.spec @@ -108,7 +108,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global main_release 2 +%global main_release 3 %global samba_version 4.14.2 %global talloc_version 2.3.2 @@ -1514,7 +1514,7 @@ fi %{_bindir}/cifsdd %{_bindir}/dbwrap_tool %{_bindir}/dumpmscat -%{_bindir}/findsmb +%exclude %{_bindir}/findsmb %{_bindir}/mvxattr %{_bindir}/mdfind %{_bindir}/nmblookup @@ -1543,7 +1543,7 @@ fi %{_mandir}/man1/regpatch.1* %{_mandir}/man1/regshell.1* %{_mandir}/man1/regtree.1* -%{_mandir}/man1/findsmb.1* +%exclude %{_mandir}/man1/findsmb.1* %{_mandir}/man1/log2pcap.1* %{_mandir}/man1/mdfind.1* %{_mandir}/man1/mvxattr.1* @@ -3840,6 +3840,9 @@ fi %endif %changelog +* Mon Apr 19 2021 Andreas Schneider - 4.12.2-1 +- resolves: #1949295 - Remove findsmb script + * Wed Apr 14 2021 Richard W.M. Jones - 2:4.14.2-2 - Rebuild for updated liburing. From 36271448222cb1918686eab2cd6b712cc8af30c3 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 19 Apr 2021 11:06:07 +0200 Subject: [PATCH 090/425] Added python3-ldb to BR --- samba.spec | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index d63ec76..15b1bce 100644 --- a/samba.spec +++ b/samba.spec @@ -108,7 +108,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global main_release 3 +%global main_release 4 %global samba_version 4.14.2 %global talloc_version 2.3.2 @@ -311,6 +311,7 @@ BuildRequires: libtdb-devel >= %{tdb_version} BuildRequires: python3-tdb >= %{tdb_version} BuildRequires: libldb-devel >= %{ldb_version} +BuildRequires: python3-ldb >= %{ldb_version} BuildRequires: python3-ldb-devel >= %{ldb_version} %else BuildRequires: lmdb-devel @@ -3840,7 +3841,10 @@ fi %endif %changelog -* Mon Apr 19 2021 Andreas Schneider - 4.12.2-1 +* Mon Apr 19 2021 Michal Ambroz - 4.14.2-4 + - Added python3-ldb to BR + +* Mon Apr 19 2021 Andreas Schneider - 4.12.2-3 - resolves: #1949295 - Remove findsmb script * Wed Apr 14 2021 Richard W.M. Jones - 2:4.14.2-2 From fba068844ee376438eb353a258252804a1f9312e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 20 Apr 2021 12:39:17 +0200 Subject: [PATCH 091/425] Update to Samba 4.14.3 resolves: #1951531 Guenther --- .gitignore | 2 + samba-bz14675-fix.patch | 157 ---------------------------------------- samba.spec | 9 ++- sources | 4 +- 4 files changed, 10 insertions(+), 162 deletions(-) delete mode 100644 samba-bz14675-fix.patch diff --git a/.gitignore b/.gitignore index 01c732c..36ab993 100644 --- a/.gitignore +++ b/.gitignore @@ -245,3 +245,5 @@ samba-3.6.0pre1.tar.gz /samba-4.14.1.tar.asc /samba-4.14.2.tar.xz /samba-4.14.2.tar.asc +/samba-4.14.3.tar.xz +/samba-4.14.3.tar.asc diff --git a/samba-bz14675-fix.patch b/samba-bz14675-fix.patch deleted file mode 100644 index f625a95..0000000 --- a/samba-bz14675-fix.patch +++ /dev/null @@ -1,157 +0,0 @@ -From 75a66ce1da41c5b081771b2db55c2994d378d882 Mon Sep 17 00:00:00 2001 -From: Ralph Boehme -Date: Tue, 23 Mar 2021 11:40:21 +0100 -Subject: [PATCH 1/3] pidl: set the per-request memory context in the pidl - generator - -The talloc memory context referenced by the pipe_struct mem_ctx member is used -as talloc parent for RPC response data by the RPC service implementations. - -In Samba versions up to 4.10 all talloc children of p->mem_ctx were freed after -a RPC response was delivered by calling talloc_free_children(p->mem_ctx). Commit -60fa8e255254d38e9443bf96f2c0f31430be6ab8 removed this call which resulted in all -memory allocations on this context not getting released, which can consume -significant memory in long running RPC connections. - -Instead of putting the talloc_free_children(p->mem_ctx) back, just use the -mem_ctx argument of the ${pipename}_op_dispatch_internal() function which is a -dcesrv_call_state object created by dcesrv_process_ncacn_packet() and released -by the RPC server when the RPC request processing is finished. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14675 -CI: https://gitlab.com/samba-team/samba/-/merge_requests/1861 - -Signed-off-by: Ralph Boehme -Reviewed-by: Volker Lendecke -(cherry picked from commit 4c3fb2a5912966a61e7ebdb05eb3231a0e1d6033) ---- - pidl/lib/Parse/Pidl/Samba4/NDR/ServerCompat.pm | 2 ++ - source3/rpc_server/rpc_handles.c | 6 ------ - 2 files changed, 2 insertions(+), 6 deletions(-) - -diff --git a/pidl/lib/Parse/Pidl/Samba4/NDR/ServerCompat.pm b/pidl/lib/Parse/Pidl/Samba4/NDR/ServerCompat.pm -index 54feea0a9ef..d1368c3dbca 100644 ---- a/pidl/lib/Parse/Pidl/Samba4/NDR/ServerCompat.pm -+++ b/pidl/lib/Parse/Pidl/Samba4/NDR/ServerCompat.pm -@@ -299,6 +299,7 @@ sub boilerplate_iface($) - $self->pidl("/* Update pipes struct opnum */"); - $self->pidl("p->opnum = opnum;"); - $self->pidl("p->dce_call = dce_call;"); -+ $self->pidl("p->mem_ctx = mem_ctx;"); - $self->pidl("/* Update pipes struct session info */"); - $self->pidl("pipe_session_info = p->session_info;"); - $self->pidl("p->session_info = dce_call->auth_state->session_info;"); -@@ -344,6 +345,7 @@ sub boilerplate_iface($) - $self->pidl(""); - - $self->pidl("p->dce_call = NULL;"); -+ $self->pidl("p->mem_ctx = NULL;"); - $self->pidl("/* Restore session info */"); - $self->pidl("p->session_info = pipe_session_info;"); - $self->pidl("p->auth.auth_type = 0;"); -diff --git a/source3/rpc_server/rpc_handles.c b/source3/rpc_server/rpc_handles.c -index 45968746440..9ef93231466 100644 ---- a/source3/rpc_server/rpc_handles.c -+++ b/source3/rpc_server/rpc_handles.c -@@ -60,12 +60,6 @@ int make_base_pipes_struct(TALLOC_CTX *mem_ctx, - return ENOMEM; - } - -- p->mem_ctx = talloc_named(p, 0, "pipe %s %p", pipe_name, p); -- if (!p->mem_ctx) { -- talloc_free(p); -- return ENOMEM; -- } -- - p->msg_ctx = msg_ctx; - p->transport = transport; - --- -2.30.2 - - -From 33a7749f7fc5c58752815789d086d696a20878e7 Mon Sep 17 00:00:00 2001 -From: Ralph Boehme -Date: Mon, 22 Mar 2021 12:06:39 +0100 -Subject: [PATCH 2/3] spools: avoid leaking memory into the callers mem_ctx - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14675 -CI: https://gitlab.com/samba-team/samba/-/merge_requests/1861 - -Signed-off-by: Ralph Boehme -Reviewed-by: Volker Lendecke -(cherry picked from commit 481176ec745c14b78fca68e01a61c83405a4b97b) ---- - source3/rpc_server/spoolss/srv_spoolss_nt.c | 6 ++++-- - 1 file changed, 4 insertions(+), 2 deletions(-) - -diff --git a/source3/rpc_server/spoolss/srv_spoolss_nt.c b/source3/rpc_server/spoolss/srv_spoolss_nt.c -index d20c19d5271..24ea7367ec8 100644 ---- a/source3/rpc_server/spoolss/srv_spoolss_nt.c -+++ b/source3/rpc_server/spoolss/srv_spoolss_nt.c -@@ -5731,7 +5731,8 @@ static WERROR construct_printer_driver_info_level(TALLOC_CTX *mem_ctx, - } - - if (pinfo2->drivername == NULL || pinfo2->drivername[0] == '\0') { -- return WERR_UNKNOWN_PRINTER_DRIVER; -+ result = WERR_UNKNOWN_PRINTER_DRIVER; -+ goto done; - } - - DBG_INFO("Construct printer driver [%s] for [%s]\n", -@@ -7023,7 +7024,8 @@ static WERROR update_printer(struct pipes_struct *p, - raddr = tsocket_address_inet_addr_string(p->remote_address, - p->mem_ctx); - if (raddr == NULL) { -- return WERR_NOT_ENOUGH_MEMORY; -+ result = WERR_NOT_ENOUGH_MEMORY; -+ goto done; - } - - /* add_printer_hook() will call reload_services() */ --- -2.30.2 - - -From 602290d48d3bc49acca64a089822f26da293ee1e Mon Sep 17 00:00:00 2001 -From: Volker Lendecke -Date: Tue, 23 Mar 2021 17:06:15 +0100 -Subject: [PATCH 3/3] rpc_server3: Fix a memleak for internal pipes -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -state->call should not be talloc'ed off a long-lived context - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14675 -CI: https://gitlab.com/samba-team/samba/-/merge_requests/1861 -RN: Memory leak in the RPC server - -Signed-off-by: Volker Lendecke -Reviewed-by: Samuel Cabrero -Reviewed-by: Ralph Boehme - -Autobuild-User(master): Ralph Böhme -Autobuild-Date(master): Wed Mar 31 12:14:01 UTC 2021 on sn-devel-184 - -(cherry picked from commit 12f516e4680753460e7fe8811e6c6ff70057580c) ---- - source3/rpc_server/rpc_ncacn_np.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/source3/rpc_server/rpc_ncacn_np.c b/source3/rpc_server/rpc_ncacn_np.c -index 9ba271c2479..494b002e714 100644 ---- a/source3/rpc_server/rpc_ncacn_np.c -+++ b/source3/rpc_server/rpc_ncacn_np.c -@@ -476,7 +476,7 @@ static struct tevent_req *rpcint_bh_raw_call_send(TALLOC_CTX *mem_ctx, - return tevent_req_post(req, ev); - } - -- state->call = talloc_zero(hs->conn, struct dcesrv_call_state); -+ state->call = talloc_zero(state, struct dcesrv_call_state); - if (tevent_req_nomem(state->call, req)) { - return tevent_req_post(req, ev); - } --- -2.30.2 - diff --git a/samba.spec b/samba.spec index 15b1bce..f43d0f9 100644 --- a/samba.spec +++ b/samba.spec @@ -108,9 +108,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global main_release 4 +%global main_release 0 -%global samba_version 4.14.2 +%global samba_version 4.14.3 %global talloc_version 2.3.2 %global tdb_version 1.4.3 %global tevent_version 0.10.2 @@ -177,7 +177,6 @@ Source14: samba.pamd Source201: README.downgrade Patch1: samba-s4u.patch -Patch2: samba-bz14675-fix.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -3841,6 +3840,10 @@ fi %endif %changelog +* Tue Apr 20 2021 Guenther Deschner - 4.14.3-0 +- Update to Samba 4.14.3 +- resolves: #1951531 + * Mon Apr 19 2021 Michal Ambroz - 4.14.2-4 - Added python3-ldb to BR diff --git a/sources b/sources index 03983cb..028c64a 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.14.2.tar.xz) = 5353cf67eac165afc0443639266354402f8d20437f8cd9389ff33201ab8261aacd21cfb9140b5816a9c39e2471fe6bce405d5b99103b1410768f56619010429d -SHA512 (samba-4.14.2.tar.asc) = 586d8a38be861195f87f4d23149c5483494a7fdbb530f4707b8ce0cfb39723ca0b6c5d9c1064c6235d1bb652558c5c113482d46163982e67c78bff2238605e25 +SHA512 (samba-4.14.3.tar.xz) = fef8c9f166e3add2248f25a5ee1131e20bfb882ae1d2bae61c8593419a3d7edd6e3ef3cdea34d24afa6f2b4bb8d3653a5788ff166dbaee689730078616657cb6 +SHA512 (samba-4.14.3.tar.asc) = 494e572344728466fafb6a982c96b1c54fedff9d2bb642b60a3b9e2a9d6beda4fcbe3f6f648cb33f2546bd2a60b98c514b9ddb125f9814b0576ddf34966f54ed From 42492545482bc3cfda443a2098377921b21e2b93 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 20 Apr 2021 17:31:05 +0200 Subject: [PATCH 092/425] Drop NIS support resolves: #1942378 --- samba.spec | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index f43d0f9..e7cb1e0 100644 --- a/samba.spec +++ b/samba.spec @@ -108,7 +108,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global main_release 0 +%global main_release 1 %global samba_version 4.14.3 %global talloc_version 2.3.2 @@ -236,8 +236,6 @@ BuildRequires: libattr-devel BuildRequires: libcap-devel BuildRequires: libicu-devel BuildRequires: libcmocka-devel -BuildRequires: libnsl2-devel -BuildRequires: libtirpc-devel BuildRequires: libuuid-devel BuildRequires: libxslt BuildRequires: lmdb @@ -3840,6 +3838,9 @@ fi %endif %changelog +* Tue Apr 20 2021 Andreas Schneider - 4.14.3-1 +- resolves: #1942378 - Drop NIS support + * Tue Apr 20 2021 Guenther Deschner - 4.14.3-0 - Update to Samba 4.14.3 - resolves: #1951531 From b88dfc7eaa6e8efb239f4f1af96340a1a249788c Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 26 Apr 2021 14:36:31 +0200 Subject: [PATCH 093/425] Add Provides: bundled(libreplace) This might be useful if it will ever have security issues. --- samba.spec | 40 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 40 insertions(+) diff --git a/samba.spec b/samba.spec index e7cb1e0..4581bdc 100644 --- a/samba.spec +++ b/samba.spec @@ -214,6 +214,8 @@ Obsoletes: samba-swat < %{samba_depver} Provides: samba4-swat = %{samba_depver} Obsoletes: samba4-swat < %{samba_depver} +Provides: bundled(libreplace) + BuildRequires: make BuildRequires: gcc BuildRequires: avahi-devel @@ -354,6 +356,8 @@ Obsoletes: samba4-client < %{samba_depver} Requires(post): %{_sbindir}/update-alternatives Requires(postun): %{_sbindir}/update-alternatives +Provides: bundled(libreplace) + %description client The %{name}-client package provides some SMB/CIFS clients to complement the built-in SMB/CIFS filesystem in Linux. These clients allow access @@ -391,6 +395,8 @@ Obsoletes: samba-dc-libs < %{samba_depver} Obsoletes: samba-dc-bind-dlz < %{samba_depver} %endif +Provides: bundled(libreplace) + %description common samba-common provides files necessary for both the server and client packages of Samba. @@ -405,6 +411,8 @@ Requires: %{name}-client-libs = %{samba_depver} Requires: libwbclient = %{samba_depver} %endif +Provides: bundled(libreplace) + %description common-libs The samba-common-libs package contains internal libraries needed by the SMB/CIFS clients. @@ -419,6 +427,8 @@ Requires: samba-libs = %{samba_depver} Requires: libwbclient = %{samba_depver} %endif +Provides: bundled(libreplace) + %description common-tools The samba-common-tools package contains tools for Samba servers and SMB/CIFS clients. @@ -456,6 +466,8 @@ Requires: krb5-server >= %{required_mit_krb5} Provides: samba4-dc = %{samba_depver} Obsoletes: samba4-dc < %{samba_depver} +Provides: bundled(libreplace) + %description dc The samba-dc package provides AD Domain Controller functionality @@ -476,6 +488,8 @@ Requires: %{name}-libs = %{samba_depver} Provides: samba4-dc-libs = %{samba_depver} Obsoletes: samba4-dc-libs < %{samba_depver} +Provides: bundled(libreplace) + %description dc-libs The %{name}-dc-libs package contains the libraries needed by the DC to link against the SMB, RPC and other protocols. @@ -488,6 +502,8 @@ Requires: %{name}-dc-libs = %{samba_depver} Requires: %{name}-dc = %{samba_depver} Requires: bind +Provides: bundled(libreplace) + %description dc-bind-dlz The %{name}-dc-bind-dlz package contains the libraries for bind to manage all name server related details of Samba AD. @@ -515,6 +531,8 @@ Summary: Samba VFS module for Ceph distributed storage system Requires: %{name} = %{samba_depver} Requires: %{name}-libs = %{samba_depver} +Provides: bundled(libreplace) + %description vfs-cephfs Samba VFS module for Ceph distributed storage system integration. #endif with vfs_cephfs @@ -537,6 +555,8 @@ Requires: libwbclient = %{samba_depver} Obsoletes: samba-glusterfs < %{samba_depver} Provides: samba-glusterfs = %{samba_depver} +Provides: bundled(libreplace) + %description vfs-glusterfs Samba VFS module for GlusterFS integration. %endif @@ -568,6 +588,8 @@ Requires: libwbclient = %{samba_depver} Provides: samba4-libs = %{samba_depver} Obsoletes: samba4-libs < %{samba_depver} +Provides: bundled(libreplace) + %description libs The %{name}-libs package contains the libraries needed by programs that link against the SMB, RPC and other protocols provided by the Samba suite. @@ -640,6 +662,8 @@ Requires: libsmbclient = %{samba_depver} Requires: libwbclient = %{samba_depver} %endif +Provides: bundled(libreplace) + %description -n python3-%{name} The python3-%{name} package contains the Python 3 libraries needed by programs that use SMB, RPC and other Samba provided protocols in Python 3 programs. @@ -714,6 +738,8 @@ Requires: perl(Archive::Tar) Provides: samba4-test = %{samba_depver} Obsoletes: samba4-test < %{samba_depver} +Provides: bundled(libreplace) + %description test %{name}-test provides testing tools for both the server and client packages of Samba. @@ -731,6 +757,8 @@ Requires: libwbclient = %{samba_depver} Provides: %{name}-test-devel = %{samba_depver} Obsoletes: %{name}-test-devel < %{samba_depver} +Provides: bundled(libreplace) + %description test-libs %{name}-test-libs provides libraries required by the testing tools. @@ -756,6 +784,8 @@ Obsoletes: samba4-winbind < %{samba_depver} # Old NetworkManager expects the dispatcher scripts in a different place Conflicts: NetworkManager < 1.20 +Provides: bundled(libreplace) + %description winbind The samba-winbind package provides the winbind NSS library, and some client tools. Winbind enables Linux to be a full member in Windows domains and to use @@ -776,6 +806,8 @@ Requires: libwbclient = %{samba_depver} Provides: samba4-winbind-clients = %{samba_depver} Obsoletes: samba4-winbind-clients < %{samba_depver} +Provides: bundled(libreplace) + %description winbind-clients The samba-winbind-clients package provides the wbinfo and ntlm_auth tool. @@ -803,6 +835,8 @@ Requires(post): %{_sbindir}/update-alternatives Requires(postun): %{_sbindir}/update-alternatives Requires(preun): %{_sbindir}/update-alternatives +Provides: bundled(libreplace) + %description winbind-krb5-locator The winbind krb5 locator is a plugin for the system kerberos library to allow the local kerberos library to use the same KDC as samba and winbind use @@ -817,6 +851,8 @@ Requires: libwbclient = %{samba_depver} %endif Requires: pam +Provides: bundled(libreplace) + %description winbind-modules The samba-winbind-modules package provides the NSS library and a PAM module necessary to communicate to the Winbind Daemon @@ -828,6 +864,8 @@ Summary: Samba Winexe Windows Binary License: GPLv3 Requires: %{name}-client-libs = %{samba_depver} +Provides: bundled(libreplace) + %description winexe Winexe is a Remote Windows®-command executor %endif @@ -861,6 +899,8 @@ Requires(post): systemd-units Requires(preun): systemd-units Requires(postun): systemd-units +Provides: bundled(libreplace) + %description -n ctdb CTDB is a cluster implementation of the TDB database used by Samba and other projects to store temporary data. If an application is already using TDB for From 1520f9620ff6e71e81f0a6e086739c19d71fbfb0 Mon Sep 17 00:00:00 2001 From: Anoop C S Date: Wed, 28 Apr 2021 10:30:49 +0530 Subject: [PATCH 094/425] Fix wrong conditional build check for AD DC resolves: #1954263 --- samba.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index 4581bdc..2c319cb 100644 --- a/samba.spec +++ b/samba.spec @@ -108,7 +108,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global main_release 1 +%global main_release 2 %global samba_version 4.14.3 %global talloc_version 2.3.2 @@ -389,7 +389,7 @@ Recommends: logrotate Provides: samba4-common = %{samba_depver} Obsoletes: samba4-common < %{samba_depver} -%if %{with dc} || %{with testsuite} +%if %{without dc} && %{without testsuite} Obsoletes: samba-dc < %{samba_depver} Obsoletes: samba-dc-libs < %{samba_depver} Obsoletes: samba-dc-bind-dlz < %{samba_depver} @@ -3878,6 +3878,9 @@ fi %endif %changelog +* Wed Apr 28 2021 Anoop C S - 4.14.3-2 +- resolves: #1954263 - wrong conditional build check of AD DC + * Tue Apr 20 2021 Andreas Schneider - 4.14.3-1 - resolves: #1942378 - Drop NIS support From 7f81bed73eb43ba7d6334ec57e3ff590706454e9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 29 Apr 2021 11:25:29 +0200 Subject: [PATCH 095/425] Update to Samba 4.14.4 resolves: #1949442, #1955027 - Security fixes for CVE-2021-20254 resolves: #1955011 Guenther --- .gitignore | 2 ++ samba.spec | 9 +++++++-- sources | 4 ++-- 3 files changed, 11 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 36ab993..8c4ef1d 100644 --- a/.gitignore +++ b/.gitignore @@ -247,3 +247,5 @@ samba-3.6.0pre1.tar.gz /samba-4.14.2.tar.asc /samba-4.14.3.tar.xz /samba-4.14.3.tar.asc +/samba-4.14.4.tar.xz +/samba-4.14.4.tar.asc diff --git a/samba.spec b/samba.spec index 2c319cb..a4d6b1e 100644 --- a/samba.spec +++ b/samba.spec @@ -108,9 +108,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global main_release 2 +%global main_release 0 -%global samba_version 4.14.3 +%global samba_version 4.14.4 %global talloc_version 2.3.2 %global tdb_version 1.4.3 %global tevent_version 0.10.2 @@ -3878,6 +3878,11 @@ fi %endif %changelog +* Thu Apr 29 2021 Guenther Deschner - 4.14.4-0 +- Update to Samba 4.14.4 +- resolves: #1949442, #1955027 - Security fixes for CVE-2021-20254 +- resolves: #1955011 + * Wed Apr 28 2021 Anoop C S - 4.14.3-2 - resolves: #1954263 - wrong conditional build check of AD DC diff --git a/sources b/sources index 028c64a..2a2b6e2 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.14.3.tar.xz) = fef8c9f166e3add2248f25a5ee1131e20bfb882ae1d2bae61c8593419a3d7edd6e3ef3cdea34d24afa6f2b4bb8d3653a5788ff166dbaee689730078616657cb6 -SHA512 (samba-4.14.3.tar.asc) = 494e572344728466fafb6a982c96b1c54fedff9d2bb642b60a3b9e2a9d6beda4fcbe3f6f648cb33f2546bd2a60b98c514b9ddb125f9814b0576ddf34966f54ed +SHA512 (samba-4.14.4.tar.xz) = 649bd946dfc95f02a960b710c3fdcd7ad44a33a849892c5ffabc8d0f8dfa88524bf9761b4e4131cb417d3c62c34dde8ce06708bd5173bbf8248b62e08755c9af +SHA512 (samba-4.14.4.tar.asc) = 82e698310c7a1c9783d4e1c7ec2d5032cee518c73fd4065343cd2f0bdf84764e58d7e48c97ebe0106c17eb63e1922192ef0ca6c0747eee6ddd388c3a62ebd683 From d47396691c18735fbaa117d13ce4ff74c3037d07 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 30 Apr 2021 15:58:06 +0200 Subject: [PATCH 096/425] Remove obsolete world writeable /var/spool/samba The default smb.conf we install already uses /var/tmp --- samba.spec | 2 -- smb.conf.example | 2 +- 2 files changed, 1 insertion(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index a4d6b1e..c3860fb 100644 --- a/samba.spec +++ b/samba.spec @@ -1051,7 +1051,6 @@ install -d -m 0755 %{buildroot}/var/lib/samba/scripts install -d -m 0755 %{buildroot}/var/lib/samba/sysvol install -d -m 0755 %{buildroot}/var/lib/samba/winbindd_privileged install -d -m 0755 %{buildroot}/var/log/samba/old -install -d -m 0755 %{buildroot}/var/spool/samba install -d -m 0755 %{buildroot}/run/samba install -d -m 0755 %{buildroot}/run/winbindd install -d -m 0755 %{buildroot}/%{_libdir}/samba @@ -1493,7 +1492,6 @@ fi %{_unitdir}/nmb.service %{_unitdir}/smb.service -%attr(1777,root,root) %dir /var/spool/samba %dir %{_sysconfdir}/openldap/schema %config %{_sysconfdir}/openldap/schema/samba.schema %config(noreplace) %{_sysconfdir}/pam.d/samba diff --git a/smb.conf.example b/smb.conf.example index e672ce9..4e6b5d4 100644 --- a/smb.conf.example +++ b/smb.conf.example @@ -281,7 +281,7 @@ [printers] comment = All Printers - path = /var/spool/samba + path = /var/tmp browseable = no guest ok = no writable = no From f6040f38cdd2635a60a9b75be86934d7affa60d0 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 30 Apr 2021 16:02:59 +0200 Subject: [PATCH 097/425] Move %{?dist} to Release tag This is expected by rpminspect and it doesn't resolve variables in spec files. --- samba.spec | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index c3860fb..bb1942c 100644 --- a/samba.spec +++ b/samba.spec @@ -118,9 +118,9 @@ # This should be rc1 or nil %global pre_release %nil -%global samba_release %{main_release}%{?dist} +%global samba_release %{main_release} %if "x%{?pre_release}" != "x" -%global samba_release 0.%{main_release}.%{pre_release}%{?dist} +%global samba_release 0.%{main_release}.%{pre_release} %endif # This is a network daemon, do a hardened build @@ -145,7 +145,7 @@ Name: samba Version: %{samba_version} -Release: %{samba_release} +Release: %{samba_release}%{?dist} %if 0%{?rhel} Epoch: 0 From 9d2d74174937e3ed095ab300663020b301f5b0e4 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 3 May 2021 14:00:53 +0200 Subject: [PATCH 098/425] Add rpminspect.yml This ignore false positives. --- rpminspect.yml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100644 rpminspect.yml diff --git a/rpminspect.yml b/rpminspect.yml new file mode 100644 index 0000000..e48a7b5 --- /dev/null +++ b/rpminspect.yml @@ -0,0 +1,15 @@ +--- +badfuncs: + ignore: + - /usr/libexec/ctdb/smnotify + - /usr/bin/smbtorture + - /usr/sbin/nmbd + - /usr/bin/nmblookup + - /usr/lib64/libndr.so.* + - /usr/lib64/libsmbconf.so.* + - /usr/lib64/samba/libgse-samba4.so + - /usr/lib64/samba/libsamba-sockets-samba4.so + +runpath: + allowed_paths: + - /usr/lib64/samba From 0f1369ca591c6b519f2e7e39ffcf1dbedd64b107 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 3 May 2021 14:07:05 +0200 Subject: [PATCH 099/425] rpminspect: Allow also non-64bit lib dirs --- rpminspect.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/rpminspect.yml b/rpminspect.yml index e48a7b5..fd87e22 100644 --- a/rpminspect.yml +++ b/rpminspect.yml @@ -5,10 +5,10 @@ badfuncs: - /usr/bin/smbtorture - /usr/sbin/nmbd - /usr/bin/nmblookup - - /usr/lib64/libndr.so.* - - /usr/lib64/libsmbconf.so.* - - /usr/lib64/samba/libgse-samba4.so - - /usr/lib64/samba/libsamba-sockets-samba4.so + - /usr/lib*/libndr.so.* + - /usr/lib*/libsmbconf.so.* + - /usr/lib*/samba/libgse-samba4.so + - /usr/lib*/samba/libsamba-sockets-samba4.so runpath: allowed_paths: From 7f443ad2e84142b24052c5eb75389b5eab510fee Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 4 May 2021 09:07:45 +0200 Subject: [PATCH 100/425] Fix rpminspec.yaml name --- rpminspect.yml => rpminspect.yaml | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename rpminspect.yml => rpminspect.yaml (100%) diff --git a/rpminspect.yml b/rpminspect.yaml similarity index 100% rename from rpminspect.yml rename to rpminspect.yaml From 8fae59d7cc5485324243889dd0b2038e08c94592 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 4 May 2021 09:09:55 +0200 Subject: [PATCH 101/425] rpminspect: Allow also to path on non 64bit platforms --- rpminspect.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rpminspect.yaml b/rpminspect.yaml index fd87e22..7e9dab8 100644 --- a/rpminspect.yaml +++ b/rpminspect.yaml @@ -12,4 +12,4 @@ badfuncs: runpath: allowed_paths: - - /usr/lib64/samba + - /usr/lib*/samba From d3d2a031b75122efde97677048d5b6a26b46215d Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 11 May 2021 15:16:15 +0200 Subject: [PATCH 102/425] Do not drop tirpc which is uses for quota --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index bb1942c..26e2ba0 100644 --- a/samba.spec +++ b/samba.spec @@ -238,6 +238,7 @@ BuildRequires: libattr-devel BuildRequires: libcap-devel BuildRequires: libicu-devel BuildRequires: libcmocka-devel +BuildRequires: libtirpc-devel BuildRequires: libuuid-devel BuildRequires: libxslt BuildRequires: lmdb From 3356311a1775769ec4d68c521fb7cb57f2033b1a Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 12 May 2021 11:31:21 +0200 Subject: [PATCH 103/425] Build vfs_io_uring also on RHEL >= 8 --- samba.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index 26e2ba0..58560be 100644 --- a/samba.spec +++ b/samba.spec @@ -92,7 +92,7 @@ %endif # Build vfs_io_uring module by default on 64bit Fedora -%if 0%{?fedora} +%if 0%{?fedora} || 0%{?rhel} >= 8 %ifarch aarch64 ppc64le s390x x86_64 %bcond_without vfs_io_uring @@ -103,7 +103,7 @@ %else %bcond_with vfs_io_uring -#endif fedora +#endif fedora || rhel >= 8 %endif %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") From 554a3330e3643376135c15491434278c7d15c927 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 12 May 2021 11:32:42 +0200 Subject: [PATCH 104/425] rpminspect: Update to the version from CentOS Stream --- rpminspect.yaml | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/rpminspect.yaml b/rpminspect.yaml index 7e9dab8..6de38d7 100644 --- a/rpminspect.yaml +++ b/rpminspect.yaml @@ -1,15 +1,16 @@ --- badfuncs: ignore: - - /usr/libexec/ctdb/smnotify - - /usr/bin/smbtorture - - /usr/sbin/nmbd - /usr/bin/nmblookup + - /usr/bin/smbtorture - /usr/lib*/libndr.so.* - /usr/lib*/libsmbconf.so.* - /usr/lib*/samba/libgse-samba4.so - /usr/lib*/samba/libsamba-sockets-samba4.so + - /usr/libexec/ctdb/smnotify + - /usr/sbin/nmbd runpath: allowed_paths: - - /usr/lib*/samba + - /usr/lib/samba + - /usr/lib64/samba From b69385bc2d27e7e8ce842b18ceb1e57347a13bf4 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 12 May 2021 14:42:03 +0200 Subject: [PATCH 105/425] Fix comment to match if-clause --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 58560be..75a14eb 100644 --- a/samba.spec +++ b/samba.spec @@ -929,7 +929,7 @@ projects to store temporary data. If an application is already using TDB for temporary data it is very easy to convert that application to be cluster aware and use CTDB instead. -#endif with selftest +#endif with testsuite %endif #endif with clustering %endif From f08374c6d458c1564f30c54d2a3589466797191c Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 12 May 2021 14:49:04 +0200 Subject: [PATCH 106/425] Fix updating if vfs_glusterfs or ctdb-tests pacakges are installed --- samba.spec | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/samba.spec b/samba.spec index 75a14eb..7de116b 100644 --- a/samba.spec +++ b/samba.spec @@ -396,6 +396,22 @@ Obsoletes: samba-dc-libs < %{samba_depver} Obsoletes: samba-dc-bind-dlz < %{samba_depver} %endif +# If only build glusterfs for RHGS and Fedora, so obsolete it on other version +# of the distro +%if %{without vfs_glusterfs} +Obsoletes: samba-vfs-glusterfs < %{samba_depver} +# endif without vfs_glusterfs +%endif + +# ctdb-tests package has been dropped if we do not build the testsuite +%if %{with clustering} +%if %{without testsuite} +Obsoletes: ctdb-tests< %{samba_depver} +# endif without testsuite +%endif +# endif with clustering +%endif + Provides: bundled(libreplace) %description common From 06f8e7b2d96722b10ff41884c64a6ccb3addd760 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 12 May 2021 15:52:52 +0200 Subject: [PATCH 107/425] Fix typo and add ctdb-tests-debuginfo --- samba.spec | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 7de116b..06378fc 100644 --- a/samba.spec +++ b/samba.spec @@ -406,7 +406,8 @@ Obsoletes: samba-vfs-glusterfs < %{samba_depver} # ctdb-tests package has been dropped if we do not build the testsuite %if %{with clustering} %if %{without testsuite} -Obsoletes: ctdb-tests< %{samba_depver} +Obsoletes: ctdb-tests < %{samba_depver} +Obsoletes: ctdb-tests-debuginfo < %{samba_depver} # endif without testsuite %endif # endif with clustering From 4e19062fc1aa8d2be126e9d8d7f7215ee90633d1 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 18 May 2021 13:14:04 +0200 Subject: [PATCH 108/425] Fix building with gcc 11.x Signed-off-by: Andreas Schneider --- samba-4.14-gcc11-fixes.patch | 408 +++++++++++++++++++++++++++++++++++ samba.spec | 8 +- 2 files changed, 415 insertions(+), 1 deletion(-) create mode 100644 samba-4.14-gcc11-fixes.patch diff --git a/samba-4.14-gcc11-fixes.patch b/samba-4.14-gcc11-fixes.patch new file mode 100644 index 0000000..ca7f673 --- /dev/null +++ b/samba-4.14-gcc11-fixes.patch @@ -0,0 +1,408 @@ +From 661e76cbc5f87040877d361d801a52cff355d603 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?G=C3=BCnther=20Deschner?= +Date: Mon, 3 May 2021 21:27:43 +0200 +Subject: [PATCH 1/3] Fix gcc11 compiler issue "-Werror=maybe-uninitialized" +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14699 + +../../source4/dsdb/common/util_links.c: In function ‘ndr_guid_compare’: +../../source4/dsdb/common/util_links.c:38:29: error: ‘v1_data’ may be used uninitialized [-Werror=maybe-uninitialized] + 38 | struct ldb_val v1 = data_blob_const(v1_data, sizeof(v1_data)); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +In file included from ../../source4/../lib/util/samba_util.h:48, + from ../../source4/include/includes.h:62, + from ../../source4/dsdb/common/util_links.c:22: +../../lib/util/data_blob.h:116:20: note: by argument 1 of type ‘const void *’ to ‘data_blob_const’ declared here + 116 | _PUBLIC_ DATA_BLOB data_blob_const(const void *p, size_t length); + | ^~~~~~~~~~~~~~~ +../../source4/dsdb/common/util_links.c:37:17: note: ‘v1_data’ declared here + 37 | uint8_t v1_data[16]; + | ^~~~~~~ +cc1: all warnings being treated as errors + +../../libcli/auth/smbencrypt.c: In function ‘decode_wkssvc_join_password_buffer’: +../../libcli/auth/smbencrypt.c:1045:32: error: ‘_confounder’ may be used uninitialized [-Werror=maybe-uninitialized] + 1045 | DATA_BLOB confounder = data_blob_const(_confounder, 8); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +In file included from ../../source4/../lib/util/samba_util.h:48, + from ../../source4/include/includes.h:62, + from ../../libcli/auth/smbencrypt.c:24: +../../lib/util/data_blob.h:116:20: note: by argument 1 of type ‘const void *’ to ‘data_blob_const’ declared here + 116 | _PUBLIC_ DATA_BLOB data_blob_const(const void *p, size_t length); + | ^~~~~~~~~~~~~~~ +../../libcli/auth/smbencrypt.c:1044:17: note: ‘_confounder’ declared here + 1044 | uint8_t _confounder[8]; + | ^~~~~~~~~~~ +cc1: all warnings being treated as errors + +[2624/3991] Compiling source4/torture/rpc/samr.c +../../source3/rpc_client/cli_samr.c: In function ‘dcerpc_samr_chgpasswd_user2’: +../../source3/rpc_client/cli_samr.c:158:33: error: ‘old_nt_hash’ may be used uninitialized [-Werror=maybe-uninitialized] + 158 | DATA_BLOB session_key = data_blob_const(old_nt_hash, 16); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +In file included from ../../source3/../lib/util/samba_util.h:48, + from ../../source3/include/includes.h:256, + from ../../source3/rpc_client/cli_samr.c:24: +../../lib/util/data_blob.h:116:20: note: by argument 1 of type ‘const void *’ to ‘data_blob_const’ declared here + 116 | _PUBLIC_ DATA_BLOB data_blob_const(const void *p, size_t length); + | ^~~~~~~~~~~~~~~ +../../source3/rpc_client/cli_samr.c:152:17: note: ‘old_nt_hash’ declared here + 152 | uint8_t old_nt_hash[16]; + | ^~~~~~~~~~~ +../../source3/rpc_client/cli_samr.c: In function ‘dcerpc_samr_chgpasswd_user3’: +../../source3/rpc_client/cli_samr.c:365:33: error: ‘old_nt_hash’ may be used uninitialized [-Werror=maybe-uninitialized] + 365 | DATA_BLOB session_key = data_blob_const(old_nt_hash, 16); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +In file included from ../../source3/../lib/util/samba_util.h:48, + from ../../source3/include/includes.h:256, + from ../../source3/rpc_client/cli_samr.c:24: +../../lib/util/data_blob.h:116:20: note: by argument 1 of type ‘const void *’ to ‘data_blob_const’ declared here + 116 | _PUBLIC_ DATA_BLOB data_blob_const(const void *p, size_t length); + | ^~~~~~~~~~~~~~~ +../../source3/rpc_client/cli_samr.c:358:17: note: ‘old_nt_hash’ declared here + 358 | uint8_t old_nt_hash[16]; + | ^~~~~~~~~~~ +cc1: all warnings being treated as errors + +[3399/3991] Compiling source3/rpcclient/cmd_spotlight.c +../../source3/rpcclient/cmd_spotlight.c: In function ‘cmd_mdssvc_fetch_properties’: +../../source3/rpcclient/cmd_spotlight.c:60:18: error: ‘share_path’ may be used uninitialized [-Werror=maybe-uninitialized] + 60 | status = dcerpc_mdssvc_open(b, mem_ctx, + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + 61 | &device_id, + | ~~~~~~~~~~~ + 62 | &unkn1, + | ~~~~~~~ + 63 | &unkn2, + | ~~~~~~~ + 64 | argv[2], + | ~~~~~~~~ + 65 | argv[1], + | ~~~~~~~~ + 66 | share_path, + | ~~~~~~~~~~~ + 67 | &share_handle); + | ~~~~~~~~~~~~~~ +In file included from ../../source3/rpcclient/cmd_spotlight.c:24: +source3/../librpc/gen_ndr/ndr_mdssvc_c.h:26:10: note: by argument 8 of type ‘const char *’ to ‘dcerpc_mdssvc_open’ declared here + 26 | NTSTATUS dcerpc_mdssvc_open(struct dcerpc_binding_handle *h, + | ^~~~~~~~~~~~~~~~~~ +../../source3/rpcclient/cmd_spotlight.c:40:14: note: ‘share_path’ declared here + 40 | char share_path[1025]; + | ^~~~~~~~~~ +cc1: all warnings being treated as errors + +../../source4/torture/rpc/samr.c: In function ‘test_ChangePasswordUser2’: +../../source4/torture/rpc/samr.c:2266:19: error: ‘old_nt_hash’ may be used uninitialized [-Werror=maybe-uninitialized] + 2266 | = data_blob_const(old_nt_hash, sizeof(old_nt_hash)); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +In file included from ../../source4/../lib/util/samba_util.h:48, + from ../../source4/include/includes.h:62, + from ../../source4/torture/rpc/samr.c:24: +../../lib/util/data_blob.h:116:20: note: by argument 1 of type ‘const void *’ to ‘data_blob_const’ declared here + 116 | _PUBLIC_ DATA_BLOB data_blob_const(const void *p, size_t length); + | ^~~~~~~~~~~~~~~ +../../source4/torture/rpc/samr.c:2263:17: note: ‘old_nt_hash’ declared here + 2263 | uint8_t old_nt_hash[16], new_nt_hash[16]; + | ^~~~~~~~~~~ +../../source4/torture/rpc/samr.c: In function ‘test_ChangePasswordUser2_ntstatus’: +../../source4/torture/rpc/samr.c:2371:19: error: ‘old_nt_hash’ may be used uninitialized [-Werror=maybe-uninitialized] + 2371 | = data_blob_const(old_nt_hash, sizeof(old_nt_hash)); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +In file included from ../../source4/../lib/util/samba_util.h:48, + from ../../source4/include/includes.h:62, + from ../../source4/torture/rpc/samr.c:24: +../../lib/util/data_blob.h:116:20: note: by argument 1 of type ‘const void *’ to ‘data_blob_const’ declared here + 116 | _PUBLIC_ DATA_BLOB data_blob_const(const void *p, size_t length); + | ^~~~~~~~~~~~~~~ +../../source4/torture/rpc/samr.c:2368:17: note: ‘old_nt_hash’ declared here + 2368 | uint8_t old_nt_hash[16], new_nt_hash[16]; + | ^~~~~~~~~~~ +../../source4/torture/rpc/samr.c: In function ‘test_ChangePasswordUser3’: +../../source4/torture/rpc/samr.c:2478:38: error: ‘old_nt_hash’ may be used uninitialized [-Werror=maybe-uninitialized] + 2478 | DATA_BLOB old_nt_hash_blob = data_blob_const(old_nt_hash, 16); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +In file included from ../../source4/../lib/util/samba_util.h:48, + from ../../source4/include/includes.h:62, + from ../../source4/torture/rpc/samr.c:24: +../../lib/util/data_blob.h:116:20: note: by argument 1 of type ‘const void *’ to ‘data_blob_const’ declared here + 116 | _PUBLIC_ DATA_BLOB data_blob_const(const void *p, size_t length); + | ^~~~~~~~~~~~~~~ +../../source4/torture/rpc/samr.c:2473:17: note: ‘old_nt_hash’ declared here + 2473 | uint8_t old_nt_hash[16], new_nt_hash[16]; + | ^~~~~~~~~~~ +../../source4/torture/rpc/samr.c: In function ‘test_ChangePasswordRandomBytes’: +../../source4/torture/rpc/samr.c:2794:19: error: ‘old_nt_hash’ may be used uninitialized [-Werror=maybe-uninitialized] + 2794 | = data_blob_const(old_nt_hash, + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ + 2795 | sizeof(old_nt_hash)); + | ~~~~~~~~~~~~~~~~~~~~ +In file included from ../../source4/../lib/util/samba_util.h:48, + from ../../source4/include/includes.h:62, + from ../../source4/torture/rpc/samr.c:24: +../../lib/util/data_blob.h:116:20: note: by argument 1 of type ‘const void *’ to ‘data_blob_const’ declared here + 116 | _PUBLIC_ DATA_BLOB data_blob_const(const void *p, size_t length); + | ^~~~~~~~~~~~~~~ +../../source4/torture/rpc/samr.c:2792:17: note: ‘old_nt_hash’ declared here + 2792 | uint8_t old_nt_hash[16], new_nt_hash[16]; + | ^~~~~~~~~~~ +cc1: all warnings being treated as errors + +Guenther + +Signed-off-by: Guenther Deschner +Reviewed-by: Andreas Schneider +(cherry picked from commit 0e1695df7fe8952b5c503cf7ab1ff31784736988) +--- + libcli/auth/smbencrypt.c | 2 +- + source3/rpc_client/cli_samr.c | 4 ++-- + source3/rpcclient/cmd_spotlight.c | 2 +- + source4/dsdb/common/util_links.c | 2 +- + source4/torture/rpc/samr.c | 8 ++++---- + 5 files changed, 9 insertions(+), 9 deletions(-) + +diff --git a/libcli/auth/smbencrypt.c b/libcli/auth/smbencrypt.c +index 337e89ef559..468374699f7 100644 +--- a/libcli/auth/smbencrypt.c ++++ b/libcli/auth/smbencrypt.c +@@ -1041,7 +1041,7 @@ WERROR decode_wkssvc_join_password_buffer(TALLOC_CTX *mem_ctx, + DATA_BLOB *session_key, + char **pwd) + { +- uint8_t _confounder[8]; ++ uint8_t _confounder[8] = { 0 }; + DATA_BLOB confounder = data_blob_const(_confounder, 8); + uint8_t pwbuf[516] = {0}; + DATA_BLOB decrypt_pwbuf = data_blob_const(pwbuf, 516); +diff --git a/source3/rpc_client/cli_samr.c b/source3/rpc_client/cli_samr.c +index acd96480a20..25b54298b32 100644 +--- a/source3/rpc_client/cli_samr.c ++++ b/source3/rpc_client/cli_samr.c +@@ -149,7 +149,7 @@ NTSTATUS dcerpc_samr_chgpasswd_user2(struct dcerpc_binding_handle *h, + struct samr_Password old_nt_hash_enc; + struct samr_Password old_lanman_hash_enc; + +- uint8_t old_nt_hash[16]; ++ uint8_t old_nt_hash[16] = { 0 }; + uint8_t old_lanman_hash[16]; + uint8_t new_nt_hash[16]; + uint8_t new_lanman_hash[16]; +@@ -355,7 +355,7 @@ NTSTATUS dcerpc_samr_chgpasswd_user3(struct dcerpc_binding_handle *h, + struct samr_Password old_nt_hash_enc; + struct samr_Password old_lanman_hash_enc; + +- uint8_t old_nt_hash[16]; ++ uint8_t old_nt_hash[16] = { 0 }; + uint8_t old_lanman_hash[16]; + uint8_t new_nt_hash[16]; + uint8_t new_lanman_hash[16]; +diff --git a/source3/rpcclient/cmd_spotlight.c b/source3/rpcclient/cmd_spotlight.c +index 661ada7efb8..24db9893df6 100644 +--- a/source3/rpcclient/cmd_spotlight.c ++++ b/source3/rpcclient/cmd_spotlight.c +@@ -37,7 +37,7 @@ static NTSTATUS cmd_mdssvc_fetch_properties( + uint32_t unkn1 = 23; + uint32_t unkn2 = 0; + struct policy_handle share_handle; +- char share_path[1025]; ++ char share_path[1025] = { 0 }; + uint32_t mds_status; + uint32_t flags; /* server always returns 0x6b000001 ? */ + uint32_t unkn3; /* server always returns 0 ? */ +diff --git a/source4/dsdb/common/util_links.c b/source4/dsdb/common/util_links.c +index 9e9e2b0161a..08fc2d657bb 100644 +--- a/source4/dsdb/common/util_links.c ++++ b/source4/dsdb/common/util_links.c +@@ -34,7 +34,7 @@ + */ + int ndr_guid_compare(const struct GUID *guid1, const struct GUID *guid2) + { +- uint8_t v1_data[16]; ++ uint8_t v1_data[16] = { 0 }; + struct ldb_val v1 = data_blob_const(v1_data, sizeof(v1_data)); + uint8_t v2_data[16]; + struct ldb_val v2 = data_blob_const(v2_data, sizeof(v2_data)); +diff --git a/source4/torture/rpc/samr.c b/source4/torture/rpc/samr.c +index 5863a6d1ee6..6c901c3c2ab 100644 +--- a/source4/torture/rpc/samr.c ++++ b/source4/torture/rpc/samr.c +@@ -2260,7 +2260,7 @@ static bool test_ChangePasswordUser2(struct dcerpc_pipe *p, struct torture_conte + struct samr_Password nt_verifier, lm_verifier; + char *oldpass; + struct dcerpc_binding_handle *b = p->binding_handle; +- uint8_t old_nt_hash[16], new_nt_hash[16]; ++ uint8_t old_nt_hash[16] = { 0 }, new_nt_hash[16]; + uint8_t old_lm_hash[16], new_lm_hash[16]; + DATA_BLOB old_nt_hash_blob + = data_blob_const(old_nt_hash, sizeof(old_nt_hash)); +@@ -2365,7 +2365,7 @@ static bool test_ChangePasswordUser2_ntstatus(struct dcerpc_pipe *p, struct tort + struct samr_Password nt_verifier, lm_verifier; + const char *oldpass; + struct dcerpc_binding_handle *b = p->binding_handle; +- uint8_t old_nt_hash[16], new_nt_hash[16]; ++ uint8_t old_nt_hash[16] = { 0 }, new_nt_hash[16]; + uint8_t old_lm_hash[16], new_lm_hash[16]; + DATA_BLOB old_nt_hash_blob + = data_blob_const(old_nt_hash, sizeof(old_nt_hash)); +@@ -2470,7 +2470,7 @@ bool test_ChangePasswordUser3(struct dcerpc_pipe *p, struct torture_context *tct + struct samr_Password nt_verifier, lm_verifier; + char *oldpass; + struct dcerpc_binding_handle *b = p->binding_handle; +- uint8_t old_nt_hash[16], new_nt_hash[16]; ++ uint8_t old_nt_hash[16] = { 0 }, new_nt_hash[16]; + uint8_t old_lm_hash[16], new_lm_hash[16]; + NTTIME t; + struct samr_DomInfo1 *dominfo = NULL; +@@ -2789,7 +2789,7 @@ bool test_ChangePasswordRandomBytes(struct dcerpc_pipe *p, struct torture_contex + char *newpass; + char *oldpass; + struct dcerpc_binding_handle *b = p->binding_handle; +- uint8_t old_nt_hash[16], new_nt_hash[16]; ++ uint8_t old_nt_hash[16] = { 0 }, new_nt_hash[16]; + DATA_BLOB old_nt_hash_blob + = data_blob_const(old_nt_hash, + sizeof(old_nt_hash)); +-- +2.31.1 + + +From 7f7777d63085d0a1a030ef1dd1a921a3c4f75c32 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?G=C3=BCnther=20Deschner?= +Date: Mon, 3 May 2021 21:27:58 +0200 +Subject: [PATCH 2/3] Fix gcc11 compiler issue "-Werror=stringop-overflow=" +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14699 + +[3548/3991] Compiling source3/winbindd/winbindd_pam.c +../../source3/winbindd/winbindd_pam.c: In function ‘winbindd_dual_pam_auth_cached’: +../../source3/winbindd/winbindd_pam.c:1069:18: error: ‘winbindd_get_creds’ accessing 128 bytes in a region of size 8 [-Werror=stringop-overflow=] + 1069 | result = winbindd_get_creds(domain, + | ^~~~~~~~~~~~~~~~~~~~~~~~~~ + 1070 | state->mem_ctx, + | ~~~~~~~~~~~~~~~ + 1071 | &sid, + | ~~~~~ + 1072 | &my_info3, + | ~~~~~~~~~~ + 1073 | &cached_nt_pass, + | ~~~~~~~~~~~~~~~~ + 1074 | &cached_salt); + | ~~~~~~~~~~~~~ +../../source3/winbindd/winbindd_pam.c:1069:18: note: referencing argument 5 of type ‘const uint8_t **’ {aka ‘const unsigned char **’} +../../source3/winbindd/winbindd_pam.c:1069:18: error: ‘winbindd_get_creds’ accessing 128 bytes in a region of size 8 [-Werror=stringop-overflow=] +../../source3/winbindd/winbindd_pam.c:1069:18: note: referencing argument 6 of type ‘const uint8_t **’ {aka ‘const unsigned char **’} +In file included from ../../source3/winbindd/winbindd.h:359, + from ../../source3/winbindd/winbindd_pam.c:26: +../../source3/winbindd/winbindd_proto.h:251:10: note: in a call to function ‘winbindd_get_creds’ + 251 | NTSTATUS winbindd_get_creds(struct winbindd_domain *domain, + | ^~~~~~~~~~~~~~~~~~ +cc1: all warnings being treated as errors + +Guenther + +Signed-off-by: Guenther Deschner +Reviewed-by: Andreas Schneider +(cherry picked from commit 17ae9974f36ce8929f0c50c357dd4f88fbf37d7c) +--- + source3/winbindd/winbindd_creds.c | 4 ++-- + source3/winbindd/winbindd_proto.h | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/source3/winbindd/winbindd_creds.c b/source3/winbindd/winbindd_creds.c +index 2d7aacf36a9..97262bbf87b 100644 +--- a/source3/winbindd/winbindd_creds.c ++++ b/source3/winbindd/winbindd_creds.c +@@ -33,8 +33,8 @@ NTSTATUS winbindd_get_creds(struct winbindd_domain *domain, + TALLOC_CTX *mem_ctx, + const struct dom_sid *sid, + struct netr_SamInfo3 **info3, +- const uint8_t *cached_nt_pass[NT_HASH_LEN], +- const uint8_t *cred_salt[NT_HASH_LEN]) ++ const uint8_t **cached_nt_pass, ++ const uint8_t **cred_salt) + { + struct netr_SamInfo3 *info; + NTSTATUS status; +diff --git a/source3/winbindd/winbindd_proto.h b/source3/winbindd/winbindd_proto.h +index 8923bb3124f..12a113ed636 100644 +--- a/source3/winbindd/winbindd_proto.h ++++ b/source3/winbindd/winbindd_proto.h +@@ -252,8 +252,8 @@ NTSTATUS winbindd_get_creds(struct winbindd_domain *domain, + TALLOC_CTX *mem_ctx, + const struct dom_sid *sid, + struct netr_SamInfo3 **info3, +- const uint8_t *cached_nt_pass[NT_HASH_LEN], +- const uint8_t *cred_salt[NT_HASH_LEN]); ++ const uint8_t **cached_nt_pass, ++ const uint8_t **cred_salt); + NTSTATUS winbindd_store_creds(struct winbindd_domain *domain, + const char *user, + const char *pass, +-- +2.31.1 + + +From 0f06f48c2ce23047527ddc8127845777beeb92c1 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 6 May 2021 19:07:04 +0200 +Subject: [PATCH 3/3] lib:replace: Do not build strndup test with gcc 11 or + newer +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14699 + +gcc11 with -O3 detects that the size is incorrect: + +lib/replace/tests/testsuite.c:286:13: error: ‘strndup’ specified bound 10 exceeds source size 4 [-Werror=stringop-overread] + 286 | x = strndup("bla", 10); + | ^~~~~~~~~~~~~~~~~~ + +Signed-off-by: Andreas Schneider +Reviewed-by: Guenther Deschner +(cherry picked from commit 8f12793ca5e7c9aa7c23a17400986878ae110e70) +--- + lib/replace/tests/testsuite.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/lib/replace/tests/testsuite.c b/lib/replace/tests/testsuite.c +index 2ece95332d2..17ce022c178 100644 +--- a/lib/replace/tests/testsuite.c ++++ b/lib/replace/tests/testsuite.c +@@ -272,6 +272,16 @@ static int test_strndup(void) + return false; + } + free(x); ++ ++#ifdef __GNUC__ ++# if __GNUC__ < 11 ++ /* ++ * This code will not compile with gcc11 -O3 anymore. ++ * ++ * error: ‘strndup’ specified bound 10 exceeds source size 4 [-Werror=stringop-overread] ++ * x = strndup("bla", 10); ++ * ^~~~~~~~~~~~~~~~~~ ++ */ + x = strndup("bla", 10); + if (strcmp(x, "bla") != 0) { + printf("failure: strndup [\ninvalid\n]\n"); +@@ -279,6 +289,9 @@ static int test_strndup(void) + return false; + } + free(x); ++# endif ++#endif /* __GNUC__ */ ++ + printf("success: strndup\n"); + return true; + } +-- +2.31.1 + diff --git a/samba.spec b/samba.spec index 06378fc..c9efe87 100644 --- a/samba.spec +++ b/samba.spec @@ -108,7 +108,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global main_release 0 +%global main_release 1 %global samba_version 4.14.4 %global talloc_version 2.3.2 @@ -176,6 +176,8 @@ Source13: pam_winbind.conf Source14: samba.pamd Source201: README.downgrade + +Patch0: samba-4.14-gcc11-fixes.patch Patch1: samba-s4u.patch Requires(pre): /usr/sbin/groupadd @@ -3894,6 +3896,10 @@ fi %endif %changelog +* Tue May 18 2021 Andreas Schneider - 4.14.4-1 +- Fixed building with gcc 11.x +- Fixed quota support + * Thu Apr 29 2021 Guenther Deschner - 4.14.4-0 - Update to Samba 4.14.4 - resolves: #1949442, #1955027 - Security fixes for CVE-2021-20254 From aa94f9dec1a1832af398260d1982f24e6b2f3b80 Mon Sep 17 00:00:00 2001 From: Pete Walter Date: Wed, 19 May 2021 21:18:29 +0100 Subject: [PATCH 109/425] Rebuild for ICU 69 --- samba.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index c9efe87..88d69f9 100644 --- a/samba.spec +++ b/samba.spec @@ -145,7 +145,7 @@ Name: samba Version: %{samba_version} -Release: %{samba_release}%{?dist} +Release: %{samba_release}%{?dist}.1 %if 0%{?rhel} Epoch: 0 @@ -3896,6 +3896,9 @@ fi %endif %changelog +* Wed May 19 2021 Pete Walter - 2:4.14.4-1.1 +- Rebuild for ICU 69 + * Tue May 18 2021 Andreas Schneider - 4.14.4-1 - Fixed building with gcc 11.x - Fixed quota support From 249389209b1cb7448ae807748bfbad9fd9f8a2bb Mon Sep 17 00:00:00 2001 From: Pete Walter Date: Thu, 20 May 2021 10:16:32 +0100 Subject: [PATCH 110/425] Fix release number --- samba.spec | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 88d69f9..b9d6811 100644 --- a/samba.spec +++ b/samba.spec @@ -108,7 +108,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global main_release 1 +%global main_release 2 %global samba_version 4.14.4 %global talloc_version 2.3.2 @@ -145,7 +145,7 @@ Name: samba Version: %{samba_version} -Release: %{samba_release}%{?dist}.1 +Release: %{samba_release}%{?dist} %if 0%{?rhel} Epoch: 0 @@ -3896,7 +3896,7 @@ fi %endif %changelog -* Wed May 19 2021 Pete Walter - 2:4.14.4-1.1 +* Wed May 19 2021 Pete Walter - 2:4.14.4-2 - Rebuild for ICU 69 * Tue May 18 2021 Andreas Schneider - 4.14.4-1 From eb93f258dcdec11b3e3fb6b9e813fbe359a5466c Mon Sep 17 00:00:00 2001 From: Pete Walter Date: Thu, 20 May 2021 10:17:02 +0100 Subject: [PATCH 111/425] Use baserelease rather than main_release macro baserelease is what we have standardized across Fedora and what rpmdev-bumpspec knows how to handle. --- samba.spec | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index b9d6811..99aeffe 100644 --- a/samba.spec +++ b/samba.spec @@ -108,7 +108,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global main_release 2 +%global baserelease 2 %global samba_version 4.14.4 %global talloc_version 2.3.2 @@ -118,9 +118,9 @@ # This should be rc1 or nil %global pre_release %nil -%global samba_release %{main_release} +%global samba_release %{baserelease} %if "x%{?pre_release}" != "x" -%global samba_release 0.%{main_release}.%{pre_release} +%global samba_release 0.%{baserelease}.%{pre_release} %endif # This is a network daemon, do a hardened build From d08addb413ec321b489e1feade86bc0a5f723697 Mon Sep 17 00:00:00 2001 From: Jitka Plesnikova Date: Fri, 21 May 2021 22:04:47 +0200 Subject: [PATCH 112/425] Perl 5.34 rebuild --- samba.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 99aeffe..f6ded1b 100644 --- a/samba.spec +++ b/samba.spec @@ -108,7 +108,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 2 +%global baserelease 3 %global samba_version 4.14.4 %global talloc_version 2.3.2 @@ -3896,6 +3896,9 @@ fi %endif %changelog +* Fri May 21 2021 Jitka Plesnikova - 2:4.14.4-3 +- Perl 5.34 rebuild + * Wed May 19 2021 Pete Walter - 2:4.14.4-2 - Rebuild for ICU 69 From 2f7e875944924d984f6a5c0a072db488419d3034 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 31 May 2021 08:39:07 +0200 Subject: [PATCH 113/425] Move Obsoletes to samba-common-libs package The samba-common package is a noarch package. This could cause issues. --- samba.spec | 48 +++++++++++++++++++++++------------------------- 1 file changed, 23 insertions(+), 25 deletions(-) diff --git a/samba.spec b/samba.spec index f6ded1b..8004d93 100644 --- a/samba.spec +++ b/samba.spec @@ -392,31 +392,6 @@ Recommends: logrotate Provides: samba4-common = %{samba_depver} Obsoletes: samba4-common < %{samba_depver} -%if %{without dc} && %{without testsuite} -Obsoletes: samba-dc < %{samba_depver} -Obsoletes: samba-dc-libs < %{samba_depver} -Obsoletes: samba-dc-bind-dlz < %{samba_depver} -%endif - -# If only build glusterfs for RHGS and Fedora, so obsolete it on other version -# of the distro -%if %{without vfs_glusterfs} -Obsoletes: samba-vfs-glusterfs < %{samba_depver} -# endif without vfs_glusterfs -%endif - -# ctdb-tests package has been dropped if we do not build the testsuite -%if %{with clustering} -%if %{without testsuite} -Obsoletes: ctdb-tests < %{samba_depver} -Obsoletes: ctdb-tests-debuginfo < %{samba_depver} -# endif without testsuite -%endif -# endif with clustering -%endif - -Provides: bundled(libreplace) - %description common samba-common provides files necessary for both the server and client packages of Samba. @@ -433,6 +408,29 @@ Requires: libwbclient = %{samba_depver} Provides: bundled(libreplace) +%if %{without dc} && %{without testsuite} +Obsoletes: samba-dc < %{samba_depver} +Obsoletes: samba-dc-libs < %{samba_depver} +Obsoletes: samba-dc-bind-dlz < %{samba_depver} +%endif + +# ctdb-tests package has been dropped if we do not build the testsuite +%if %{with clustering} +%if %{without testsuite} +Obsoletes: ctdb-tests < %{samba_depver} +Obsoletes: ctdb-tests-debuginfo < %{samba_depver} +# endif without testsuite +%endif +# endif with clustering +%endif + +# If only build glusterfs for RHGS and Fedora, so obsolete it on other version +# of the distro +%if %{without vfs_glusterfs} +Obsoletes: samba-vfs-glusterfs < %{samba_depver} +# endif without vfs_glusterfs +%endif + %description common-libs The samba-common-libs package contains internal libraries needed by the SMB/CIFS clients. From a42aaa69c3fb20cad1df34a9e8d5243758de7fcd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 1 Jun 2021 11:29:05 +0200 Subject: [PATCH 114/425] Update to Samba 4.14.5 resolves: #1966456 Guenther --- .gitignore | 2 + samba-4.14-gcc11-fixes.patch | 408 ----------------------------------- samba.spec | 11 +- sources | 4 +- 4 files changed, 11 insertions(+), 414 deletions(-) delete mode 100644 samba-4.14-gcc11-fixes.patch diff --git a/.gitignore b/.gitignore index 8c4ef1d..1ff7739 100644 --- a/.gitignore +++ b/.gitignore @@ -249,3 +249,5 @@ samba-3.6.0pre1.tar.gz /samba-4.14.3.tar.asc /samba-4.14.4.tar.xz /samba-4.14.4.tar.asc +/samba-4.14.5.tar.xz +/samba-4.14.5.tar.asc diff --git a/samba-4.14-gcc11-fixes.patch b/samba-4.14-gcc11-fixes.patch deleted file mode 100644 index ca7f673..0000000 --- a/samba-4.14-gcc11-fixes.patch +++ /dev/null @@ -1,408 +0,0 @@ -From 661e76cbc5f87040877d361d801a52cff355d603 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?G=C3=BCnther=20Deschner?= -Date: Mon, 3 May 2021 21:27:43 +0200 -Subject: [PATCH 1/3] Fix gcc11 compiler issue "-Werror=maybe-uninitialized" -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14699 - -../../source4/dsdb/common/util_links.c: In function ‘ndr_guid_compare’: -../../source4/dsdb/common/util_links.c:38:29: error: ‘v1_data’ may be used uninitialized [-Werror=maybe-uninitialized] - 38 | struct ldb_val v1 = data_blob_const(v1_data, sizeof(v1_data)); - | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -In file included from ../../source4/../lib/util/samba_util.h:48, - from ../../source4/include/includes.h:62, - from ../../source4/dsdb/common/util_links.c:22: -../../lib/util/data_blob.h:116:20: note: by argument 1 of type ‘const void *’ to ‘data_blob_const’ declared here - 116 | _PUBLIC_ DATA_BLOB data_blob_const(const void *p, size_t length); - | ^~~~~~~~~~~~~~~ -../../source4/dsdb/common/util_links.c:37:17: note: ‘v1_data’ declared here - 37 | uint8_t v1_data[16]; - | ^~~~~~~ -cc1: all warnings being treated as errors - -../../libcli/auth/smbencrypt.c: In function ‘decode_wkssvc_join_password_buffer’: -../../libcli/auth/smbencrypt.c:1045:32: error: ‘_confounder’ may be used uninitialized [-Werror=maybe-uninitialized] - 1045 | DATA_BLOB confounder = data_blob_const(_confounder, 8); - | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -In file included from ../../source4/../lib/util/samba_util.h:48, - from ../../source4/include/includes.h:62, - from ../../libcli/auth/smbencrypt.c:24: -../../lib/util/data_blob.h:116:20: note: by argument 1 of type ‘const void *’ to ‘data_blob_const’ declared here - 116 | _PUBLIC_ DATA_BLOB data_blob_const(const void *p, size_t length); - | ^~~~~~~~~~~~~~~ -../../libcli/auth/smbencrypt.c:1044:17: note: ‘_confounder’ declared here - 1044 | uint8_t _confounder[8]; - | ^~~~~~~~~~~ -cc1: all warnings being treated as errors - -[2624/3991] Compiling source4/torture/rpc/samr.c -../../source3/rpc_client/cli_samr.c: In function ‘dcerpc_samr_chgpasswd_user2’: -../../source3/rpc_client/cli_samr.c:158:33: error: ‘old_nt_hash’ may be used uninitialized [-Werror=maybe-uninitialized] - 158 | DATA_BLOB session_key = data_blob_const(old_nt_hash, 16); - | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -In file included from ../../source3/../lib/util/samba_util.h:48, - from ../../source3/include/includes.h:256, - from ../../source3/rpc_client/cli_samr.c:24: -../../lib/util/data_blob.h:116:20: note: by argument 1 of type ‘const void *’ to ‘data_blob_const’ declared here - 116 | _PUBLIC_ DATA_BLOB data_blob_const(const void *p, size_t length); - | ^~~~~~~~~~~~~~~ -../../source3/rpc_client/cli_samr.c:152:17: note: ‘old_nt_hash’ declared here - 152 | uint8_t old_nt_hash[16]; - | ^~~~~~~~~~~ -../../source3/rpc_client/cli_samr.c: In function ‘dcerpc_samr_chgpasswd_user3’: -../../source3/rpc_client/cli_samr.c:365:33: error: ‘old_nt_hash’ may be used uninitialized [-Werror=maybe-uninitialized] - 365 | DATA_BLOB session_key = data_blob_const(old_nt_hash, 16); - | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -In file included from ../../source3/../lib/util/samba_util.h:48, - from ../../source3/include/includes.h:256, - from ../../source3/rpc_client/cli_samr.c:24: -../../lib/util/data_blob.h:116:20: note: by argument 1 of type ‘const void *’ to ‘data_blob_const’ declared here - 116 | _PUBLIC_ DATA_BLOB data_blob_const(const void *p, size_t length); - | ^~~~~~~~~~~~~~~ -../../source3/rpc_client/cli_samr.c:358:17: note: ‘old_nt_hash’ declared here - 358 | uint8_t old_nt_hash[16]; - | ^~~~~~~~~~~ -cc1: all warnings being treated as errors - -[3399/3991] Compiling source3/rpcclient/cmd_spotlight.c -../../source3/rpcclient/cmd_spotlight.c: In function ‘cmd_mdssvc_fetch_properties’: -../../source3/rpcclient/cmd_spotlight.c:60:18: error: ‘share_path’ may be used uninitialized [-Werror=maybe-uninitialized] - 60 | status = dcerpc_mdssvc_open(b, mem_ctx, - | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - 61 | &device_id, - | ~~~~~~~~~~~ - 62 | &unkn1, - | ~~~~~~~ - 63 | &unkn2, - | ~~~~~~~ - 64 | argv[2], - | ~~~~~~~~ - 65 | argv[1], - | ~~~~~~~~ - 66 | share_path, - | ~~~~~~~~~~~ - 67 | &share_handle); - | ~~~~~~~~~~~~~~ -In file included from ../../source3/rpcclient/cmd_spotlight.c:24: -source3/../librpc/gen_ndr/ndr_mdssvc_c.h:26:10: note: by argument 8 of type ‘const char *’ to ‘dcerpc_mdssvc_open’ declared here - 26 | NTSTATUS dcerpc_mdssvc_open(struct dcerpc_binding_handle *h, - | ^~~~~~~~~~~~~~~~~~ -../../source3/rpcclient/cmd_spotlight.c:40:14: note: ‘share_path’ declared here - 40 | char share_path[1025]; - | ^~~~~~~~~~ -cc1: all warnings being treated as errors - -../../source4/torture/rpc/samr.c: In function ‘test_ChangePasswordUser2’: -../../source4/torture/rpc/samr.c:2266:19: error: ‘old_nt_hash’ may be used uninitialized [-Werror=maybe-uninitialized] - 2266 | = data_blob_const(old_nt_hash, sizeof(old_nt_hash)); - | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -In file included from ../../source4/../lib/util/samba_util.h:48, - from ../../source4/include/includes.h:62, - from ../../source4/torture/rpc/samr.c:24: -../../lib/util/data_blob.h:116:20: note: by argument 1 of type ‘const void *’ to ‘data_blob_const’ declared here - 116 | _PUBLIC_ DATA_BLOB data_blob_const(const void *p, size_t length); - | ^~~~~~~~~~~~~~~ -../../source4/torture/rpc/samr.c:2263:17: note: ‘old_nt_hash’ declared here - 2263 | uint8_t old_nt_hash[16], new_nt_hash[16]; - | ^~~~~~~~~~~ -../../source4/torture/rpc/samr.c: In function ‘test_ChangePasswordUser2_ntstatus’: -../../source4/torture/rpc/samr.c:2371:19: error: ‘old_nt_hash’ may be used uninitialized [-Werror=maybe-uninitialized] - 2371 | = data_blob_const(old_nt_hash, sizeof(old_nt_hash)); - | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -In file included from ../../source4/../lib/util/samba_util.h:48, - from ../../source4/include/includes.h:62, - from ../../source4/torture/rpc/samr.c:24: -../../lib/util/data_blob.h:116:20: note: by argument 1 of type ‘const void *’ to ‘data_blob_const’ declared here - 116 | _PUBLIC_ DATA_BLOB data_blob_const(const void *p, size_t length); - | ^~~~~~~~~~~~~~~ -../../source4/torture/rpc/samr.c:2368:17: note: ‘old_nt_hash’ declared here - 2368 | uint8_t old_nt_hash[16], new_nt_hash[16]; - | ^~~~~~~~~~~ -../../source4/torture/rpc/samr.c: In function ‘test_ChangePasswordUser3’: -../../source4/torture/rpc/samr.c:2478:38: error: ‘old_nt_hash’ may be used uninitialized [-Werror=maybe-uninitialized] - 2478 | DATA_BLOB old_nt_hash_blob = data_blob_const(old_nt_hash, 16); - | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -In file included from ../../source4/../lib/util/samba_util.h:48, - from ../../source4/include/includes.h:62, - from ../../source4/torture/rpc/samr.c:24: -../../lib/util/data_blob.h:116:20: note: by argument 1 of type ‘const void *’ to ‘data_blob_const’ declared here - 116 | _PUBLIC_ DATA_BLOB data_blob_const(const void *p, size_t length); - | ^~~~~~~~~~~~~~~ -../../source4/torture/rpc/samr.c:2473:17: note: ‘old_nt_hash’ declared here - 2473 | uint8_t old_nt_hash[16], new_nt_hash[16]; - | ^~~~~~~~~~~ -../../source4/torture/rpc/samr.c: In function ‘test_ChangePasswordRandomBytes’: -../../source4/torture/rpc/samr.c:2794:19: error: ‘old_nt_hash’ may be used uninitialized [-Werror=maybe-uninitialized] - 2794 | = data_blob_const(old_nt_hash, - | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ - 2795 | sizeof(old_nt_hash)); - | ~~~~~~~~~~~~~~~~~~~~ -In file included from ../../source4/../lib/util/samba_util.h:48, - from ../../source4/include/includes.h:62, - from ../../source4/torture/rpc/samr.c:24: -../../lib/util/data_blob.h:116:20: note: by argument 1 of type ‘const void *’ to ‘data_blob_const’ declared here - 116 | _PUBLIC_ DATA_BLOB data_blob_const(const void *p, size_t length); - | ^~~~~~~~~~~~~~~ -../../source4/torture/rpc/samr.c:2792:17: note: ‘old_nt_hash’ declared here - 2792 | uint8_t old_nt_hash[16], new_nt_hash[16]; - | ^~~~~~~~~~~ -cc1: all warnings being treated as errors - -Guenther - -Signed-off-by: Guenther Deschner -Reviewed-by: Andreas Schneider -(cherry picked from commit 0e1695df7fe8952b5c503cf7ab1ff31784736988) ---- - libcli/auth/smbencrypt.c | 2 +- - source3/rpc_client/cli_samr.c | 4 ++-- - source3/rpcclient/cmd_spotlight.c | 2 +- - source4/dsdb/common/util_links.c | 2 +- - source4/torture/rpc/samr.c | 8 ++++---- - 5 files changed, 9 insertions(+), 9 deletions(-) - -diff --git a/libcli/auth/smbencrypt.c b/libcli/auth/smbencrypt.c -index 337e89ef559..468374699f7 100644 ---- a/libcli/auth/smbencrypt.c -+++ b/libcli/auth/smbencrypt.c -@@ -1041,7 +1041,7 @@ WERROR decode_wkssvc_join_password_buffer(TALLOC_CTX *mem_ctx, - DATA_BLOB *session_key, - char **pwd) - { -- uint8_t _confounder[8]; -+ uint8_t _confounder[8] = { 0 }; - DATA_BLOB confounder = data_blob_const(_confounder, 8); - uint8_t pwbuf[516] = {0}; - DATA_BLOB decrypt_pwbuf = data_blob_const(pwbuf, 516); -diff --git a/source3/rpc_client/cli_samr.c b/source3/rpc_client/cli_samr.c -index acd96480a20..25b54298b32 100644 ---- a/source3/rpc_client/cli_samr.c -+++ b/source3/rpc_client/cli_samr.c -@@ -149,7 +149,7 @@ NTSTATUS dcerpc_samr_chgpasswd_user2(struct dcerpc_binding_handle *h, - struct samr_Password old_nt_hash_enc; - struct samr_Password old_lanman_hash_enc; - -- uint8_t old_nt_hash[16]; -+ uint8_t old_nt_hash[16] = { 0 }; - uint8_t old_lanman_hash[16]; - uint8_t new_nt_hash[16]; - uint8_t new_lanman_hash[16]; -@@ -355,7 +355,7 @@ NTSTATUS dcerpc_samr_chgpasswd_user3(struct dcerpc_binding_handle *h, - struct samr_Password old_nt_hash_enc; - struct samr_Password old_lanman_hash_enc; - -- uint8_t old_nt_hash[16]; -+ uint8_t old_nt_hash[16] = { 0 }; - uint8_t old_lanman_hash[16]; - uint8_t new_nt_hash[16]; - uint8_t new_lanman_hash[16]; -diff --git a/source3/rpcclient/cmd_spotlight.c b/source3/rpcclient/cmd_spotlight.c -index 661ada7efb8..24db9893df6 100644 ---- a/source3/rpcclient/cmd_spotlight.c -+++ b/source3/rpcclient/cmd_spotlight.c -@@ -37,7 +37,7 @@ static NTSTATUS cmd_mdssvc_fetch_properties( - uint32_t unkn1 = 23; - uint32_t unkn2 = 0; - struct policy_handle share_handle; -- char share_path[1025]; -+ char share_path[1025] = { 0 }; - uint32_t mds_status; - uint32_t flags; /* server always returns 0x6b000001 ? */ - uint32_t unkn3; /* server always returns 0 ? */ -diff --git a/source4/dsdb/common/util_links.c b/source4/dsdb/common/util_links.c -index 9e9e2b0161a..08fc2d657bb 100644 ---- a/source4/dsdb/common/util_links.c -+++ b/source4/dsdb/common/util_links.c -@@ -34,7 +34,7 @@ - */ - int ndr_guid_compare(const struct GUID *guid1, const struct GUID *guid2) - { -- uint8_t v1_data[16]; -+ uint8_t v1_data[16] = { 0 }; - struct ldb_val v1 = data_blob_const(v1_data, sizeof(v1_data)); - uint8_t v2_data[16]; - struct ldb_val v2 = data_blob_const(v2_data, sizeof(v2_data)); -diff --git a/source4/torture/rpc/samr.c b/source4/torture/rpc/samr.c -index 5863a6d1ee6..6c901c3c2ab 100644 ---- a/source4/torture/rpc/samr.c -+++ b/source4/torture/rpc/samr.c -@@ -2260,7 +2260,7 @@ static bool test_ChangePasswordUser2(struct dcerpc_pipe *p, struct torture_conte - struct samr_Password nt_verifier, lm_verifier; - char *oldpass; - struct dcerpc_binding_handle *b = p->binding_handle; -- uint8_t old_nt_hash[16], new_nt_hash[16]; -+ uint8_t old_nt_hash[16] = { 0 }, new_nt_hash[16]; - uint8_t old_lm_hash[16], new_lm_hash[16]; - DATA_BLOB old_nt_hash_blob - = data_blob_const(old_nt_hash, sizeof(old_nt_hash)); -@@ -2365,7 +2365,7 @@ static bool test_ChangePasswordUser2_ntstatus(struct dcerpc_pipe *p, struct tort - struct samr_Password nt_verifier, lm_verifier; - const char *oldpass; - struct dcerpc_binding_handle *b = p->binding_handle; -- uint8_t old_nt_hash[16], new_nt_hash[16]; -+ uint8_t old_nt_hash[16] = { 0 }, new_nt_hash[16]; - uint8_t old_lm_hash[16], new_lm_hash[16]; - DATA_BLOB old_nt_hash_blob - = data_blob_const(old_nt_hash, sizeof(old_nt_hash)); -@@ -2470,7 +2470,7 @@ bool test_ChangePasswordUser3(struct dcerpc_pipe *p, struct torture_context *tct - struct samr_Password nt_verifier, lm_verifier; - char *oldpass; - struct dcerpc_binding_handle *b = p->binding_handle; -- uint8_t old_nt_hash[16], new_nt_hash[16]; -+ uint8_t old_nt_hash[16] = { 0 }, new_nt_hash[16]; - uint8_t old_lm_hash[16], new_lm_hash[16]; - NTTIME t; - struct samr_DomInfo1 *dominfo = NULL; -@@ -2789,7 +2789,7 @@ bool test_ChangePasswordRandomBytes(struct dcerpc_pipe *p, struct torture_contex - char *newpass; - char *oldpass; - struct dcerpc_binding_handle *b = p->binding_handle; -- uint8_t old_nt_hash[16], new_nt_hash[16]; -+ uint8_t old_nt_hash[16] = { 0 }, new_nt_hash[16]; - DATA_BLOB old_nt_hash_blob - = data_blob_const(old_nt_hash, - sizeof(old_nt_hash)); --- -2.31.1 - - -From 7f7777d63085d0a1a030ef1dd1a921a3c4f75c32 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?G=C3=BCnther=20Deschner?= -Date: Mon, 3 May 2021 21:27:58 +0200 -Subject: [PATCH 2/3] Fix gcc11 compiler issue "-Werror=stringop-overflow=" -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14699 - -[3548/3991] Compiling source3/winbindd/winbindd_pam.c -../../source3/winbindd/winbindd_pam.c: In function ‘winbindd_dual_pam_auth_cached’: -../../source3/winbindd/winbindd_pam.c:1069:18: error: ‘winbindd_get_creds’ accessing 128 bytes in a region of size 8 [-Werror=stringop-overflow=] - 1069 | result = winbindd_get_creds(domain, - | ^~~~~~~~~~~~~~~~~~~~~~~~~~ - 1070 | state->mem_ctx, - | ~~~~~~~~~~~~~~~ - 1071 | &sid, - | ~~~~~ - 1072 | &my_info3, - | ~~~~~~~~~~ - 1073 | &cached_nt_pass, - | ~~~~~~~~~~~~~~~~ - 1074 | &cached_salt); - | ~~~~~~~~~~~~~ -../../source3/winbindd/winbindd_pam.c:1069:18: note: referencing argument 5 of type ‘const uint8_t **’ {aka ‘const unsigned char **’} -../../source3/winbindd/winbindd_pam.c:1069:18: error: ‘winbindd_get_creds’ accessing 128 bytes in a region of size 8 [-Werror=stringop-overflow=] -../../source3/winbindd/winbindd_pam.c:1069:18: note: referencing argument 6 of type ‘const uint8_t **’ {aka ‘const unsigned char **’} -In file included from ../../source3/winbindd/winbindd.h:359, - from ../../source3/winbindd/winbindd_pam.c:26: -../../source3/winbindd/winbindd_proto.h:251:10: note: in a call to function ‘winbindd_get_creds’ - 251 | NTSTATUS winbindd_get_creds(struct winbindd_domain *domain, - | ^~~~~~~~~~~~~~~~~~ -cc1: all warnings being treated as errors - -Guenther - -Signed-off-by: Guenther Deschner -Reviewed-by: Andreas Schneider -(cherry picked from commit 17ae9974f36ce8929f0c50c357dd4f88fbf37d7c) ---- - source3/winbindd/winbindd_creds.c | 4 ++-- - source3/winbindd/winbindd_proto.h | 4 ++-- - 2 files changed, 4 insertions(+), 4 deletions(-) - -diff --git a/source3/winbindd/winbindd_creds.c b/source3/winbindd/winbindd_creds.c -index 2d7aacf36a9..97262bbf87b 100644 ---- a/source3/winbindd/winbindd_creds.c -+++ b/source3/winbindd/winbindd_creds.c -@@ -33,8 +33,8 @@ NTSTATUS winbindd_get_creds(struct winbindd_domain *domain, - TALLOC_CTX *mem_ctx, - const struct dom_sid *sid, - struct netr_SamInfo3 **info3, -- const uint8_t *cached_nt_pass[NT_HASH_LEN], -- const uint8_t *cred_salt[NT_HASH_LEN]) -+ const uint8_t **cached_nt_pass, -+ const uint8_t **cred_salt) - { - struct netr_SamInfo3 *info; - NTSTATUS status; -diff --git a/source3/winbindd/winbindd_proto.h b/source3/winbindd/winbindd_proto.h -index 8923bb3124f..12a113ed636 100644 ---- a/source3/winbindd/winbindd_proto.h -+++ b/source3/winbindd/winbindd_proto.h -@@ -252,8 +252,8 @@ NTSTATUS winbindd_get_creds(struct winbindd_domain *domain, - TALLOC_CTX *mem_ctx, - const struct dom_sid *sid, - struct netr_SamInfo3 **info3, -- const uint8_t *cached_nt_pass[NT_HASH_LEN], -- const uint8_t *cred_salt[NT_HASH_LEN]); -+ const uint8_t **cached_nt_pass, -+ const uint8_t **cred_salt); - NTSTATUS winbindd_store_creds(struct winbindd_domain *domain, - const char *user, - const char *pass, --- -2.31.1 - - -From 0f06f48c2ce23047527ddc8127845777beeb92c1 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Thu, 6 May 2021 19:07:04 +0200 -Subject: [PATCH 3/3] lib:replace: Do not build strndup test with gcc 11 or - newer -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14699 - -gcc11 with -O3 detects that the size is incorrect: - -lib/replace/tests/testsuite.c:286:13: error: ‘strndup’ specified bound 10 exceeds source size 4 [-Werror=stringop-overread] - 286 | x = strndup("bla", 10); - | ^~~~~~~~~~~~~~~~~~ - -Signed-off-by: Andreas Schneider -Reviewed-by: Guenther Deschner -(cherry picked from commit 8f12793ca5e7c9aa7c23a17400986878ae110e70) ---- - lib/replace/tests/testsuite.c | 13 +++++++++++++ - 1 file changed, 13 insertions(+) - -diff --git a/lib/replace/tests/testsuite.c b/lib/replace/tests/testsuite.c -index 2ece95332d2..17ce022c178 100644 ---- a/lib/replace/tests/testsuite.c -+++ b/lib/replace/tests/testsuite.c -@@ -272,6 +272,16 @@ static int test_strndup(void) - return false; - } - free(x); -+ -+#ifdef __GNUC__ -+# if __GNUC__ < 11 -+ /* -+ * This code will not compile with gcc11 -O3 anymore. -+ * -+ * error: ‘strndup’ specified bound 10 exceeds source size 4 [-Werror=stringop-overread] -+ * x = strndup("bla", 10); -+ * ^~~~~~~~~~~~~~~~~~ -+ */ - x = strndup("bla", 10); - if (strcmp(x, "bla") != 0) { - printf("failure: strndup [\ninvalid\n]\n"); -@@ -279,6 +289,9 @@ static int test_strndup(void) - return false; - } - free(x); -+# endif -+#endif /* __GNUC__ */ -+ - printf("success: strndup\n"); - return true; - } --- -2.31.1 - diff --git a/samba.spec b/samba.spec index 8004d93..5fee109 100644 --- a/samba.spec +++ b/samba.spec @@ -108,9 +108,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 3 +%global baserelease 0 -%global samba_version 4.14.4 +%global samba_version 4.14.5 %global talloc_version 2.3.2 %global tdb_version 1.4.3 %global tevent_version 0.10.2 @@ -177,8 +177,7 @@ Source14: samba.pamd Source201: README.downgrade -Patch0: samba-4.14-gcc11-fixes.patch -Patch1: samba-s4u.patch +Patch0: samba-s4u.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -3894,6 +3893,10 @@ fi %endif %changelog +* Tue Jun 01 2021 Guenther Deschner - 4.14.5-0 +- Update to Samba 4.14.5 +- resolves: #1966456 + * Fri May 21 2021 Jitka Plesnikova - 2:4.14.4-3 - Perl 5.34 rebuild diff --git a/sources b/sources index 2a2b6e2..dcfe75a 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.14.4.tar.xz) = 649bd946dfc95f02a960b710c3fdcd7ad44a33a849892c5ffabc8d0f8dfa88524bf9761b4e4131cb417d3c62c34dde8ce06708bd5173bbf8248b62e08755c9af -SHA512 (samba-4.14.4.tar.asc) = 82e698310c7a1c9783d4e1c7ec2d5032cee518c73fd4065343cd2f0bdf84764e58d7e48c97ebe0106c17eb63e1922192ef0ca6c0747eee6ddd388c3a62ebd683 +SHA512 (samba-4.14.5.tar.xz) = 39952770676b7f74c94ffeb84c91ee0fef29e7d043a916b88ad7547f74d3d10a328722c361f82be49906c4361d4f4d97d06dbdc9119147a617297f126ae3ac12 +SHA512 (samba-4.14.5.tar.asc) = 8c4efa05d47d647031bbca24341b1e2e793a05339c9abcdf28e05d6a8eada7dddc827d5d939bc578ecbcf38ba66374cd852414a8499f79c4ff5888bfd0363463 From 4e6773440bf246fcddb500f3fef3428e4f3cb866 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Fri, 4 Jun 2021 21:14:34 +0200 Subject: [PATCH 115/425] Rebuilt for Python 3.10 --- samba.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 5fee109..43701f8 100644 --- a/samba.spec +++ b/samba.spec @@ -108,7 +108,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 0 +%global baserelease 1 %global samba_version 4.14.5 %global talloc_version 2.3.2 @@ -3893,6 +3893,9 @@ fi %endif %changelog +* Fri Jun 04 2021 Python Maint - 2:4.14.5-1 +- Rebuilt for Python 3.10 + * Tue Jun 01 2021 Guenther Deschner - 4.14.5-0 - Update to Samba 4.14.5 - resolves: #1966456 From e37c5c8b5b48774b81f3607ebefeeb3691081992 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 17 Jun 2021 15:28:43 +0200 Subject: [PATCH 116/425] Remove trailing whitespace --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 43701f8..346dce0 100644 --- a/samba.spec +++ b/samba.spec @@ -59,7 +59,7 @@ # Build vfs_gluster module by default on 64bit Fedora %global is_rhgs 0 -%if "%{dist}" == ".el8rhgs" || "%{dist}" == ".el9rhgs" +%if "%{dist}" == ".el8rhgs" || "%{dist}" == ".el9rhgs" %global is_rhgs 1 %endif From e17d2fbe118773b4d0b10bf9e88f0af40362eaec Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 24 Jun 2021 10:29:25 +0200 Subject: [PATCH 117/425] Add subpackage for vfs-iouring --- samba.spec | 30 ++++++++++++++++++++++++------ 1 file changed, 24 insertions(+), 6 deletions(-) diff --git a/samba.spec b/samba.spec index 346dce0..8818324 100644 --- a/samba.spec +++ b/samba.spec @@ -555,6 +555,20 @@ Samba VFS module for Ceph distributed storage system integration. #endif with vfs_cephfs %endif +### IOURING +%if %{with vfs_cephfs} +%package vfs-iouring +Summary: Samba VFS module for io_uring +Requires: %{name} = %{samba_depver} +Requires: %{name}-libs = %{samba_depver} + +Provides: bundled(libreplace) + +%description vfs-iouring +Samba VFS module for io_uring instance integration. +#endif with vfs_cephfs +%endif + ### GLUSTER %if %{with vfs_glusterfs} %package vfs-glusterfs @@ -1475,9 +1489,6 @@ fi %{_libdir}/samba/vfs/full_audit.so %{_libdir}/samba/vfs/gpfs.so %{_libdir}/samba/vfs/glusterfs_fuse.so -%if %{with vfs_io_uring} -%{_libdir}/samba/vfs/io_uring.so -%endif %{_libdir}/samba/vfs/linux_xfs_sgid.so %{_libdir}/samba/vfs/media_harmony.so %{_libdir}/samba/vfs/offline.so @@ -1535,9 +1546,6 @@ fi %{_mandir}/man8/vfs_full_audit.8* %{_mandir}/man8/vfs_gpfs.8* %{_mandir}/man8/vfs_glusterfs_fuse.8* -%if %{with vfs_io_uring} -%{_mandir}/man8/vfs_io_uring.8* -%endif %{_mandir}/man8/vfs_linux_xfs_sgid.8* %{_mandir}/man8/vfs_media_harmony.8* %{_mandir}/man8/vfs_offline.8* @@ -2097,6 +2105,13 @@ fi %{_mandir}/man8/vfs_ceph_snapshots.8* %endif +### VFS-CEPHFS +%if %{with vfs_io_uring} +%files vfs-iouring +%{_libdir}/samba/vfs/io_uring.so +%{_mandir}/man8/vfs_io_uring.8* +%endif + ### VFS-GLUSTERFS %if %{with vfs_glusterfs} %files vfs-glusterfs @@ -3893,6 +3908,9 @@ fi %endif %changelog +* Thu Jun 24 2021 Andreas Schneider - 4.14.5-2 +- Create a subpackage for vfs-io-uring + * Fri Jun 04 2021 Python Maint - 2:4.14.5-1 - Rebuilt for Python 3.10 From 7be6ccad7b66fc85bdd0ffe8e4d460b926126edd Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 24 Jun 2021 10:32:29 +0200 Subject: [PATCH 118/425] Bump release --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 8818324..b87f7dd 100644 --- a/samba.spec +++ b/samba.spec @@ -108,7 +108,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 1 +%global baserelease 2 %global samba_version 4.14.5 %global talloc_version 2.3.2 From b0ce351e1dca7525a9dfc5cf1676d482db40cdfd Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 24 Jun 2021 11:24:59 +0200 Subject: [PATCH 119/425] Fix typos --- samba.spec | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/samba.spec b/samba.spec index b87f7dd..43649f1 100644 --- a/samba.spec +++ b/samba.spec @@ -108,7 +108,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 2 +%global baserelease 3 %global samba_version 4.14.5 %global talloc_version 2.3.2 @@ -556,7 +556,7 @@ Samba VFS module for Ceph distributed storage system integration. %endif ### IOURING -%if %{with vfs_cephfs} +%if %{with vfs_io_uring} %package vfs-iouring Summary: Samba VFS module for io_uring Requires: %{name} = %{samba_depver} @@ -2105,7 +2105,7 @@ fi %{_mandir}/man8/vfs_ceph_snapshots.8* %endif -### VFS-CEPHFS +### VFS-IOURING %if %{with vfs_io_uring} %files vfs-iouring %{_libdir}/samba/vfs/io_uring.so @@ -3908,7 +3908,7 @@ fi %endif %changelog -* Thu Jun 24 2021 Andreas Schneider - 4.14.5-2 +* Thu Jun 24 2021 Andreas Schneider - 4.14.5-3 - Create a subpackage for vfs-io-uring * Fri Jun 04 2021 Python Maint - 2:4.14.5-1 From 5e4f3ca118c80d33705307e260532839ef71f608 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 24 Jun 2021 13:19:58 +0200 Subject: [PATCH 120/425] Fix typo in comment --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 43649f1..114ef57 100644 --- a/samba.spec +++ b/samba.spec @@ -566,7 +566,7 @@ Provides: bundled(libreplace) %description vfs-iouring Samba VFS module for io_uring instance integration. -#endif with vfs_cephfs +#endif with vfs_io_uring %endif ### GLUSTER From daabe96f8e66e6abc92fa45f7e7fbd600358eca4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 29 Jun 2021 14:29:35 +0200 Subject: [PATCH 121/425] Fix typos Guenther --- samba.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index 114ef57..5887a16 100644 --- a/samba.spec +++ b/samba.spec @@ -423,7 +423,7 @@ Obsoletes: ctdb-tests-debuginfo < %{samba_depver} # endif with clustering %endif -# If only build glusterfs for RHGS and Fedora, so obsolete it on other version +# We only build glusterfs for RHGS and Fedora, so obsolete it on other versions # of the distro %if %{without vfs_glusterfs} Obsoletes: samba-vfs-glusterfs < %{samba_depver} @@ -704,7 +704,7 @@ Summary: Samba python devel files Requires: python3-%{name} = %{samba_depver} %description -n python3-%{name}-devel -The python3-%{name}-devel package contains the Python 3 defel files. +The python3-%{name}-devel package contains the Python 3 devel files. %package -n python3-samba-test Summary: Samba Python libraries From 869e9c50a6bd0e506fbdf93e1f78c30c334ebdc5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 13 Jul 2021 13:28:32 +0200 Subject: [PATCH 122/425] Update to Samba 4.14.6 resolves: #1981764 Guenther --- .gitignore | 2 ++ samba.spec | 8 ++++++-- sources | 4 ++-- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 1ff7739..264eae5 100644 --- a/.gitignore +++ b/.gitignore @@ -251,3 +251,5 @@ samba-3.6.0pre1.tar.gz /samba-4.14.4.tar.asc /samba-4.14.5.tar.xz /samba-4.14.5.tar.asc +/samba-4.14.6.tar.xz +/samba-4.14.6.tar.asc diff --git a/samba.spec b/samba.spec index 5887a16..12f8a78 100644 --- a/samba.spec +++ b/samba.spec @@ -108,9 +108,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 3 +%global baserelease 0 -%global samba_version 4.14.5 +%global samba_version 4.14.6 %global talloc_version 2.3.2 %global tdb_version 1.4.3 %global tevent_version 0.10.2 @@ -3908,6 +3908,10 @@ fi %endif %changelog +* Tue Jul 13 2021 Guenther Deschner - 4.14.6-0 +- Update to Samba 4.14.6 +- resolves: #1981764 + * Thu Jun 24 2021 Andreas Schneider - 4.14.5-3 - Create a subpackage for vfs-io-uring diff --git a/sources b/sources index dcfe75a..3125f87 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.14.5.tar.xz) = 39952770676b7f74c94ffeb84c91ee0fef29e7d043a916b88ad7547f74d3d10a328722c361f82be49906c4361d4f4d97d06dbdc9119147a617297f126ae3ac12 -SHA512 (samba-4.14.5.tar.asc) = 8c4efa05d47d647031bbca24341b1e2e793a05339c9abcdf28e05d6a8eada7dddc827d5d939bc578ecbcf38ba66374cd852414a8499f79c4ff5888bfd0363463 +SHA512 (samba-4.14.6.tar.xz) = 9f9807a8d4c1cc6e7b2b5cc9863702a08bb5243619f17bfb1e3616a826189ec1547a3618d4ab0fe3d00efb5c638eef28fcfd7483d67b25fc8f9dc527b196437c +SHA512 (samba-4.14.6.tar.asc) = 15437f5fd9e28a7312dd670804068596387124a8b9b00e0e4d5fc54ae2490cf4196030e9d327037fc366d3d4ad12c5360f11db750dc01069803c969df67de179 From 15c3d6dc9ddd8a07c949485eb4f0e274208c05f0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 14 Jul 2021 12:25:21 +0200 Subject: [PATCH 123/425] Build with pcp-pmda support by default on Fedora resolves: #1552276 Guenther --- samba.spec | 47 ++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 46 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 12f8a78..b8ff4d6 100644 --- a/samba.spec +++ b/samba.spec @@ -106,9 +106,16 @@ #endif fedora || rhel >= 8 %endif +# Build the ctdb-pcp-pmda package by default on Fedora +%if 0%{?fedora} +%bcond_without pcp_pmda +%else +%bcond_with pcp_pmda +%endif + %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 0 +%global baserelease 1 %global samba_version 4.14.6 %global talloc_version 2.3.2 @@ -285,6 +292,10 @@ BuildRequires: libcephfs-devel BuildRequires: liburing-devel >= 0.4 %endif +%if %{with pcp_pmda} +BuildRequires: pcp-libs-devel +%endif + %if %{with dc} || %{with testsuite} # Add python3-iso8601 to avoid that the # version in Samba is being packaged @@ -961,6 +972,20 @@ and use CTDB instead. #endif with testsuite %endif + +%if %{with pcp_pmda} + +%package -n ctdb-pcp-pmda +Summary: CTDB PCP pmda support +Requires: ctdb = %{version} +Requires: pcp-libs + +%description -n ctdb-pcp-pmda +Performance Co-Pilot (PCP) support for CTDB + +#endif with pcp_pmda +%endif + #endif with clustering %endif @@ -1050,6 +1075,9 @@ export LDFLAGS="%{__global_ldflags} -fuse-ld=gold" %endif %if %{with testsuite} --enable-selftest \ +%endif +%if %{with pcp_pmda} + --enable-pmda \ %endif --with-profiling-data \ --with-systemd \ @@ -3897,6 +3925,19 @@ fi #endif with selftest %endif +%if %{with pcp_pmda} +%files -n ctdb-pcp-pmda +%dir %{_localstatedir}/lib/pcp/pmdas/ctdb +%{_localstatedir}/lib/pcp/pmdas/ctdb/Install +%{_localstatedir}/lib/pcp/pmdas/ctdb/README +%{_localstatedir}/lib/pcp/pmdas/ctdb/Remove +%{_localstatedir}/lib/pcp/pmdas/ctdb/domain.h +%{_localstatedir}/lib/pcp/pmdas/ctdb/help +%{_localstatedir}/lib/pcp/pmdas/ctdb/pmdactdb +%{_localstatedir}/lib/pcp/pmdas/ctdb/pmns +#endif with pcp_pmda +%endif + #endif with clustering %endif @@ -3908,6 +3949,10 @@ fi %endif %changelog +* Wed Jul 14 2021 Guenther Deschner - 4.14.6-1 +- Build with pcp-pmda support by default on Fedora +- resolves: #1552276 + * Tue Jul 13 2021 Guenther Deschner - 4.14.6-0 - Update to Samba 4.14.6 - resolves: #1981764 From dc0913c8f234ed2db830bc9329c04a7a3c3e7ac3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 15 Jul 2021 13:40:13 +0200 Subject: [PATCH 124/425] Update to Samba 4.15.0rc1 resolves: #1982623 Guenther --- .gitignore | 2 ++ samba.spec | 89 ++++++++++++++++++++++++++++++++++++++++++------------ sources | 4 +-- 3 files changed, 74 insertions(+), 21 deletions(-) diff --git a/.gitignore b/.gitignore index 264eae5..d865f0b 100644 --- a/.gitignore +++ b/.gitignore @@ -253,3 +253,5 @@ samba-3.6.0pre1.tar.gz /samba-4.14.5.tar.asc /samba-4.14.6.tar.xz /samba-4.14.6.tar.asc +/samba-4.15.0rc1.tar.xz +/samba-4.15.0rc1.tar.asc diff --git a/samba.spec b/samba.spec index b8ff4d6..90dcd1d 100644 --- a/samba.spec +++ b/samba.spec @@ -115,15 +115,15 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 1 +%global baserelease 0 -%global samba_version 4.14.6 -%global talloc_version 2.3.2 -%global tdb_version 1.4.3 -%global tevent_version 0.10.2 -%global ldb_version 2.3.0 +%global samba_version 4.15.0 +%global talloc_version 2.3.3 +%global tdb_version 1.4.4 +%global tevent_version 0.11.0 +%global ldb_version 2.4.0 # This should be rc1 or nil -%global pre_release %nil +%global pre_release rc1 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -1542,6 +1542,8 @@ fi %{_libdir}/samba/vfs/nfs4acl_xattr.so %endif +%{_libexecdir}/samba/samba-bgqd + %dir %{_datadir}/samba %dir %{_datadir}/samba/mdssvc %{_datadir}/samba/mdssvc/elasticsearch_mappings.json @@ -1553,6 +1555,7 @@ fi %config(noreplace) %{_sysconfdir}/pam.d/samba %{_mandir}/man1/smbstatus.1* %{_mandir}/man8/eventlogadm.8* +%{_mandir}/man8/samba-bgqd.8* %{_mandir}/man8/smbd.8* %{_mandir}/man8/nmbd.8* %{_mandir}/man8/vfs_acl_tdb.8* @@ -1603,9 +1606,8 @@ fi %{_bindir}/cifsdd %{_bindir}/dbwrap_tool %{_bindir}/dumpmscat -%exclude %{_bindir}/findsmb %{_bindir}/mvxattr -%{_bindir}/mdfind +%{_bindir}/mdsearch %{_bindir}/nmblookup %{_bindir}/oLschema2ldif %{_bindir}/regdiff @@ -1632,9 +1634,8 @@ fi %{_mandir}/man1/regpatch.1* %{_mandir}/man1/regshell.1* %{_mandir}/man1/regtree.1* -%exclude %{_mandir}/man1/findsmb.1* %{_mandir}/man1/log2pcap.1* -%{_mandir}/man1/mdfind.1* +%{_mandir}/man1/mdsearch.1* %{_mandir}/man1/mvxattr.1* %{_mandir}/man1/rpcclient.1* %{_mandir}/man1/sharesec.1* @@ -1715,10 +1716,10 @@ fi %{_libdir}/samba/libclidns-samba4.so %{_libdir}/samba/libcluster-samba4.so %{_libdir}/samba/libcmdline-contexts-samba4.so -%{_libdir}/samba/libcmdline-credentials-samba4.so %{_libdir}/samba/libcommon-auth-samba4.so %{_libdir}/samba/libctdb-event-client-samba4.so %{_libdir}/samba/libdbwrap-samba4.so +%{_libdir}/samba/libdcerpc-pkt-auth-samba4.so %{_libdir}/samba/libdcerpc-samba-samba4.so %{_libdir}/samba/libevents-samba4.so %{_libdir}/samba/libflag-mapping-samba4.so @@ -1773,7 +1774,6 @@ fi %{_libdir}/samba/libtime-basic-samba4.so %{_libdir}/samba/libtorture-samba4.so %{_libdir}/samba/libtrusts-util-samba4.so -%{_libdir}/samba/libutil-cmdline-samba4.so %{_libdir}/samba/libutil-reg-samba4.so %{_libdir}/samba/libutil-setid-samba4.so %{_libdir}/samba/libutil-tdb-samba4.so @@ -1837,8 +1837,7 @@ fi ### COMMON-libs %files common-libs # common libraries -%{_libdir}/samba/libpopt-samba3-cmdline-samba4.so -%{_libdir}/samba/libpopt-samba3-samba4.so +%{_libdir}/samba/libcmdline-samba4.so %dir %{_libdir}/samba/ldb @@ -1899,6 +1898,7 @@ fi %{_libdir}/samba/ldb/lazy_commit.so %{_libdir}/samba/ldb/ldbsamba_extensions.so %{_libdir}/samba/ldb/linked_attributes.so +%{_libdir}/samba/ldb/mdb.so %{_libdir}/samba/ldb/new_partition.so %{_libdir}/samba/ldb/objectclass.so %{_libdir}/samba/ldb/objectclass_attrs.so @@ -1985,8 +1985,6 @@ fi %files dc-bind-dlz %attr(770,root,named) %dir /var/lib/samba/bind-dns %dir %{_libdir}/samba/bind9 -%{_libdir}/samba/bind9/dlz_bind9.so -%{_libdir}/samba/bind9/dlz_bind9_9.so %{_libdir}/samba/bind9/dlz_bind9_10.so %{_libdir}/samba/bind9/dlz_bind9_11.so %{_libdir}/samba/bind9/dlz_bind9_12.so @@ -2254,6 +2252,7 @@ fi %{python3_sitearch}/samba/__pycache__/getopt.*.pyc %{python3_sitearch}/samba/__pycache__/gpclass.*.pyc %{python3_sitearch}/samba/__pycache__/gp_ext_loader.*.pyc +%{python3_sitearch}/samba/__pycache__/gp_gnome_settings_ext.*.pyc %{python3_sitearch}/samba/__pycache__/gp_msgs_ext.*.pyc %{python3_sitearch}/samba/__pycache__/gp_scripts_ext.*.pyc %{python3_sitearch}/samba/__pycache__/gp_sec_ext.*.pyc @@ -2276,7 +2275,14 @@ fi %{python3_sitearch}/samba/__pycache__/trust_utils.*.pyc %{python3_sitearch}/samba/__pycache__/upgrade.*.pyc %{python3_sitearch}/samba/__pycache__/upgradehelpers.*.pyc +%{python3_sitearch}/samba/__pycache__/vgp_access_ext.*.pyc +%{python3_sitearch}/samba/__pycache__/vgp_files_ext.*.pyc +%{python3_sitearch}/samba/__pycache__/vgp_issue_ext.*.pyc +%{python3_sitearch}/samba/__pycache__/vgp_motd_ext.*.pyc +%{python3_sitearch}/samba/__pycache__/vgp_openssh_ext.*.pyc +%{python3_sitearch}/samba/__pycache__/vgp_startup_scripts_ext.*.pyc %{python3_sitearch}/samba/__pycache__/vgp_sudoers_ext.*.pyc +%{python3_sitearch}/samba/__pycache__/vgp_symlink_ext.*.pyc %{python3_sitearch}/samba/__pycache__/xattr.*.pyc %{python3_sitearch}/samba/_glue.*.so %{python3_sitearch}/samba/_ldb.*.so @@ -2305,6 +2311,7 @@ fi %{python3_sitearch}/samba/dcerpc/idmap.*.so %{python3_sitearch}/samba/dcerpc/initshutdown.*.so %{python3_sitearch}/samba/dcerpc/irpc.*.so +%{python3_sitearch}/samba/dcerpc/krb5ccache.*.so %{python3_sitearch}/samba/dcerpc/krb5pac.*.so %{python3_sitearch}/samba/dcerpc/lsa.*.so %{python3_sitearch}/samba/dcerpc/messaging.*.so @@ -2336,6 +2343,7 @@ fi %{python3_sitearch}/samba/gensec.*.so %{python3_sitearch}/samba/getopt.py %{python3_sitearch}/samba/gpclass.py +%{python3_sitearch}/samba/gp_gnome_settings_ext.py %{python3_sitearch}/samba/gp_scripts_ext.py %{python3_sitearch}/samba/gp_sec_ext.py %{python3_sitearch}/samba/gpo.*.so @@ -2346,6 +2354,7 @@ fi %{python3_sitearch}/samba/messaging.*.so %{python3_sitearch}/samba/ndr.py %{python3_sitearch}/samba/net.*.so +%{python3_sitearch}/samba/net_s3.*.so %{python3_sitearch}/samba/ntstatus.*.so %{python3_sitearch}/samba/posix_eadb.*.so %dir %{python3_sitearch}/samba/emulate @@ -2468,7 +2477,14 @@ fi %{python3_sitearch}/samba/trust_utils.py %{python3_sitearch}/samba/upgrade.py %{python3_sitearch}/samba/upgradehelpers.py +%{python3_sitearch}/samba/vgp_access_ext.py +%{python3_sitearch}/samba/vgp_files_ext.py +%{python3_sitearch}/samba/vgp_issue_ext.py +%{python3_sitearch}/samba/vgp_motd_ext.py +%{python3_sitearch}/samba/vgp_openssh_ext.py +%{python3_sitearch}/samba/vgp_startup_scripts_ext.py %{python3_sitearch}/samba/vgp_sudoers_ext.py +%{python3_sitearch}/samba/vgp_symlink_ext.py %{python3_sitearch}/samba/werror.*.so %{python3_sitearch}/samba/xattr.py %{python3_sitearch}/samba/xattr_native.*.so @@ -2583,6 +2599,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/cred_opt.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dckeytab.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dns.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/dns_aging.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dns_base.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dns_forwarder.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dns_invalid.*.pyc @@ -2590,6 +2607,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/dns_tkey.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dns_wildcard.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dsdb.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/dsdb_dns.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dsdb_lock.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dsdb_schema_attributes.*.pyc %{python3_sitearch}/samba/tests/__pycache__/docs.*.pyc @@ -2601,9 +2619,11 @@ fi %{python3_sitearch}/samba/tests/__pycache__/getdcname.*.pyc %{python3_sitearch}/samba/tests/__pycache__/glue.*.pyc %{python3_sitearch}/samba/tests/__pycache__/gpo.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/gpo_member.*.pyc %{python3_sitearch}/samba/tests/__pycache__/graph.*.pyc %{python3_sitearch}/samba/tests/__pycache__/group_audit.*.pyc %{python3_sitearch}/samba/tests/__pycache__/hostconfig.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/imports.*.pyc %{python3_sitearch}/samba/tests/__pycache__/join.*.pyc %{python3_sitearch}/samba/tests/__pycache__/krb5_credentials.*.pyc %{python3_sitearch}/samba/tests/__pycache__/ldap_raw.*.pyc @@ -2612,6 +2632,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/libsmb.*.pyc %{python3_sitearch}/samba/tests/__pycache__/lsa_string.*.pyc %{python3_sitearch}/samba/tests/__pycache__/messaging.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/ndr.*.pyc %{python3_sitearch}/samba/tests/__pycache__/netbios.*.pyc %{python3_sitearch}/samba/tests/__pycache__/netcmd.*.pyc %{python3_sitearch}/samba/tests/__pycache__/net_join_no_spnego.*.pyc @@ -2647,10 +2668,12 @@ fi %{python3_sitearch}/samba/tests/__pycache__/s3passdb.*.pyc %{python3_sitearch}/samba/tests/__pycache__/s3registry.*.pyc %{python3_sitearch}/samba/tests/__pycache__/s3windb.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/s3_net_join.*.pyc %{python3_sitearch}/samba/tests/__pycache__/samba_upgradedns_lmdb.*.pyc %{python3_sitearch}/samba/tests/__pycache__/samba3sam.*.pyc %{python3_sitearch}/samba/tests/__pycache__/samdb.*.pyc %{python3_sitearch}/samba/tests/__pycache__/samdb_api.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/sddl.*.pyc %{python3_sitearch}/samba/tests/__pycache__/security.*.pyc %{python3_sitearch}/samba/tests/__pycache__/segfault.*.pyc %{python3_sitearch}/samba/tests/__pycache__/smb.*.pyc @@ -2685,7 +2708,7 @@ fi %{python3_sitearch}/samba/tests/blackbox/__pycache__/bug13653.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/check_output.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/downgradedatabase.*.pyc -%{python3_sitearch}/samba/tests/blackbox/__pycache__/mdfind.*.pyc +%{python3_sitearch}/samba/tests/blackbox/__pycache__/mdsearch.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/ndrdump.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/netads_json.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/samba_dnsupdate.*.pyc @@ -2701,7 +2724,7 @@ fi %{python3_sitearch}/samba/tests/blackbox/bug13653.py %{python3_sitearch}/samba/tests/blackbox/check_output.py %{python3_sitearch}/samba/tests/blackbox/downgradedatabase.py -%{python3_sitearch}/samba/tests/blackbox/mdfind.py +%{python3_sitearch}/samba/tests/blackbox/mdsearch.py %{python3_sitearch}/samba/tests/blackbox/ndrdump.py %{python3_sitearch}/samba/tests/blackbox/netads_json.py %{python3_sitearch}/samba/tests/blackbox/samba_dnsupdate.py @@ -2763,6 +2786,7 @@ fi %{python3_sitearch}/samba/tests/dcerpc/unix.py %{python3_sitearch}/samba/tests/dckeytab.py %{python3_sitearch}/samba/tests/dns.py +%{python3_sitearch}/samba/tests/dns_aging.py %{python3_sitearch}/samba/tests/dns_base.py %{python3_sitearch}/samba/tests/dns_forwarder.py %dir %{python3_sitearch}/samba/tests/dns_forwarder_helpers @@ -2773,6 +2797,7 @@ fi %{python3_sitearch}/samba/tests/dns_tkey.py %{python3_sitearch}/samba/tests/dns_wildcard.py %{python3_sitearch}/samba/tests/dsdb.py +%{python3_sitearch}/samba/tests/dsdb_dns.py %{python3_sitearch}/samba/tests/dsdb_lock.py %{python3_sitearch}/samba/tests/dsdb_schema_attributes.py %{python3_sitearch}/samba/tests/docs.py @@ -2792,9 +2817,11 @@ fi %{python3_sitearch}/samba/tests/get_opt.py %{python3_sitearch}/samba/tests/glue.py %{python3_sitearch}/samba/tests/gpo.py +%{python3_sitearch}/samba/tests/gpo_member.py %{python3_sitearch}/samba/tests/graph.py %{python3_sitearch}/samba/tests/group_audit.py %{python3_sitearch}/samba/tests/hostconfig.py +%{python3_sitearch}/samba/tests/imports.py %{python3_sitearch}/samba/tests/join.py %dir %{python3_sitearch}/samba/tests/kcc %{python3_sitearch}/samba/tests/kcc/__init__.py @@ -2811,27 +2838,39 @@ fi %dir %{python3_sitearch}/samba/tests/krb5 %dir %{python3_sitearch}/samba/tests/krb5/__pycache__ %{python3_sitearch}/samba/tests/krb5/__pycache__/as_canonicalization_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/as_req_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/compatability_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kcrypto.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_base_test.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tgs_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/ms_kile_client_principal_lookup_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/raw_testcase.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/rfc4120_constants.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/rfc4120_pyasn1.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/simple_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/s4u_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/test_ccache.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/test_ldap.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/test_rpc.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/test_smb.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/xrealm_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/as_canonicalization_tests.py +%{python3_sitearch}/samba/tests/krb5/as_req_tests.py %{python3_sitearch}/samba/tests/krb5/compatability_tests.py %{python3_sitearch}/samba/tests/krb5/kcrypto.py %{python3_sitearch}/samba/tests/krb5/kdc_base_test.py %{python3_sitearch}/samba/tests/krb5/kdc_tests.py %{python3_sitearch}/samba/tests/krb5/kdc_tgs_tests.py +%{python3_sitearch}/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py %{python3_sitearch}/samba/tests/krb5/raw_testcase.py %{python3_sitearch}/samba/tests/krb5/rfc4120_constants.py %{python3_sitearch}/samba/tests/krb5/rfc4120_pyasn1.py %{python3_sitearch}/samba/tests/krb5/simple_tests.py +%{python3_sitearch}/samba/tests/krb5/test_ccache.py +%{python3_sitearch}/samba/tests/krb5/test_ldap.py +%{python3_sitearch}/samba/tests/krb5/test_rpc.py +%{python3_sitearch}/samba/tests/krb5/test_smb.py %{python3_sitearch}/samba/tests/krb5/s4u_tests.py %{python3_sitearch}/samba/tests/krb5/xrealm_tests.py %{python3_sitearch}/samba/tests/krb5_credentials.py @@ -2841,6 +2880,7 @@ fi %{python3_sitearch}/samba/tests/loadparm.py %{python3_sitearch}/samba/tests/lsa_string.py %{python3_sitearch}/samba/tests/messaging.py +%{python3_sitearch}/samba/tests/ndr.py %{python3_sitearch}/samba/tests/netbios.py %{python3_sitearch}/samba/tests/netcmd.py %{python3_sitearch}/samba/tests/net_join_no_spnego.py @@ -2876,6 +2916,7 @@ fi %{python3_sitearch}/samba/tests/s3passdb.py %{python3_sitearch}/samba/tests/s3registry.py %{python3_sitearch}/samba/tests/s3windb.py +%{python3_sitearch}/samba/tests/s3_net_join.py %{python3_sitearch}/samba/tests/samba3sam.py %{python3_sitearch}/samba/tests/samba_upgradedns_lmdb.py %dir %{python3_sitearch}/samba/tests/samba_tool @@ -2892,6 +2933,7 @@ fi %{python3_sitearch}/samba/tests/samba_tool/__pycache__/forest.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/fsmo.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/gpo.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/gpo_exts.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/group.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/help.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/join.*.pyc @@ -2903,6 +2945,7 @@ fi %{python3_sitearch}/samba/tests/samba_tool/__pycache__/promote_dc_lmdb_size.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/provision_lmdb_size.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/provision_password_check.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/provision_userPassword_crypt.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/rodc.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/schema.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/sites.*.pyc @@ -2926,6 +2969,7 @@ fi %{python3_sitearch}/samba/tests/samba_tool/forest.py %{python3_sitearch}/samba/tests/samba_tool/fsmo.py %{python3_sitearch}/samba/tests/samba_tool/gpo.py +%{python3_sitearch}/samba/tests/samba_tool/gpo_exts.py %{python3_sitearch}/samba/tests/samba_tool/group.py %{python3_sitearch}/samba/tests/samba_tool/help.py %{python3_sitearch}/samba/tests/samba_tool/join.py @@ -2937,6 +2981,7 @@ fi %{python3_sitearch}/samba/tests/samba_tool/promote_dc_lmdb_size.py %{python3_sitearch}/samba/tests/samba_tool/provision_lmdb_size.py %{python3_sitearch}/samba/tests/samba_tool/provision_password_check.py +%{python3_sitearch}/samba/tests/samba_tool/provision_userPassword_crypt.py %{python3_sitearch}/samba/tests/samba_tool/rodc.py %{python3_sitearch}/samba/tests/samba_tool/schema.py %{python3_sitearch}/samba/tests/samba_tool/sites.py @@ -2952,6 +2997,7 @@ fi %{python3_sitearch}/samba/tests/samba_tool/visualize_drs.py %{python3_sitearch}/samba/tests/samdb.py %{python3_sitearch}/samba/tests/samdb_api.py +%{python3_sitearch}/samba/tests/sddl.py %{python3_sitearch}/samba/tests/security.py %{python3_sitearch}/samba/tests/segfault.py %{python3_sitearch}/samba/tests/smb.py @@ -3095,6 +3141,7 @@ fi %{_libexecdir}/ctdb/ctdb_recovery_helper %{_libexecdir}/ctdb/ctdb_takeover_helper %{_libexecdir}/ctdb/smnotify +%{_libexecdir}/ctdb/tdb_mutex_check %dir %{_localstatedir}/lib/ctdb/ %dir %{_localstatedir}/lib/ctdb/persistent @@ -3949,6 +3996,10 @@ fi %endif %changelog +* Thu Jul 15 2021 Guenther Deschner - 4.15.0rc1 +- Update to Samba 4.15.0rc1 +- resolves: #1982623 + * Wed Jul 14 2021 Guenther Deschner - 4.14.6-1 - Build with pcp-pmda support by default on Fedora - resolves: #1552276 diff --git a/sources b/sources index 3125f87..7562738 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.14.6.tar.xz) = 9f9807a8d4c1cc6e7b2b5cc9863702a08bb5243619f17bfb1e3616a826189ec1547a3618d4ab0fe3d00efb5c638eef28fcfd7483d67b25fc8f9dc527b196437c -SHA512 (samba-4.14.6.tar.asc) = 15437f5fd9e28a7312dd670804068596387124a8b9b00e0e4d5fc54ae2490cf4196030e9d327037fc366d3d4ad12c5360f11db750dc01069803c969df67de179 +SHA512 (samba-4.15.0rc1.tar.xz) = c8b5af52d5360301078d0020d3d9cfb4cf6e8b2a9f5478e07042008d5284f5505e808c870aee024943d7e80203e11ace2ea7145248ac3dc292bd68c9c9b4045a +SHA512 (samba-4.15.0rc1.tar.asc) = a71a90f7e57a9e8f2845cceb7bcc534f7b2e1d8ecf76619774c1b4962c869e0d9d20cc1a1ebb0518837af74a1dc990b6e738b3eeb34daa9e64b41cc47c0bda2a From 8e500051bc8bb49ea3e18bae5e3ca67a88ed530c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 15 Jul 2021 22:25:56 +0200 Subject: [PATCH 125/425] Fix BuildRequires: lmdb-devel Guenther --- samba.spec | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 90dcd1d..7bf3b3f 100644 --- a/samba.spec +++ b/samba.spec @@ -325,10 +325,9 @@ BuildRequires: python3-tdb >= %{tdb_version} BuildRequires: libldb-devel >= %{ldb_version} BuildRequires: python3-ldb >= %{ldb_version} BuildRequires: python3-ldb-devel >= %{ldb_version} -%else -BuildRequires: lmdb-devel -#endif without testsuite +#endif without includelibs %endif +BuildRequires: lmdb-devel %if %{with dc} || %{with testsuite} BuildRequires: bind From 30df8220b4adca5c337385dc1e3eec39aa2cf177 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 15 Jul 2021 23:25:20 +0200 Subject: [PATCH 126/425] Do not include mdb.so for now Guenther --- samba.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/samba.spec b/samba.spec index 7bf3b3f..e000009 100644 --- a/samba.spec +++ b/samba.spec @@ -1897,7 +1897,6 @@ fi %{_libdir}/samba/ldb/lazy_commit.so %{_libdir}/samba/ldb/ldbsamba_extensions.so %{_libdir}/samba/ldb/linked_attributes.so -%{_libdir}/samba/ldb/mdb.so %{_libdir}/samba/ldb/new_partition.so %{_libdir}/samba/ldb/objectclass.so %{_libdir}/samba/ldb/objectclass_attrs.so From c7152a75983f31ccddf0c5460f2b9e3cecd3bf2b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 19 Jul 2021 11:57:57 +0200 Subject: [PATCH 127/425] Fix ctdb-pcp-pmda install resolves: #1983369 Guenther --- samba.spec | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index e000009..e627771 100644 --- a/samba.spec +++ b/samba.spec @@ -115,7 +115,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 0 +%global baserelease 1 %global samba_version 4.15.0 %global talloc_version 2.3.3 @@ -976,7 +976,7 @@ and use CTDB instead. %package -n ctdb-pcp-pmda Summary: CTDB PCP pmda support -Requires: ctdb = %{version} +Requires: ctdb = %{samba_depver} Requires: pcp-libs %description -n ctdb-pcp-pmda @@ -3994,7 +3994,11 @@ fi %endif %changelog -* Thu Jul 15 2021 Guenther Deschner - 4.15.0rc1 +* Mon Jul 19 2021 Guenther Deschner - 4.15.0rc1-1 +- Fix ctdb-pcp-pmda install +- resolves: #1983369 + +* Thu Jul 15 2021 Guenther Deschner - 4.15.0rc1-0 - Update to Samba 4.15.0rc1 - resolves: #1982623 From ab92045b9b972b034356c7142bbcfc7b2c68cffe Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 21 Jul 2021 15:13:25 +0200 Subject: [PATCH 128/425] Fix inclusion and building of ldb mdb module Guenther --- samba.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index e627771..61da2ec 100644 --- a/samba.spec +++ b/samba.spec @@ -325,9 +325,12 @@ BuildRequires: python3-tdb >= %{tdb_version} BuildRequires: libldb-devel >= %{ldb_version} BuildRequires: python3-ldb >= %{ldb_version} BuildRequires: python3-ldb-devel >= %{ldb_version} +%else +# lmdb-devel is required for the mdb ldb module, if samba is configured +# to build includelibs we need lmdb-devel for building that module on our own +BuildRequires: lmdb-devel #endif without includelibs %endif -BuildRequires: lmdb-devel %if %{with dc} || %{with testsuite} BuildRequires: bind @@ -1798,7 +1801,7 @@ fi %{_libdir}/samba/ldb/asq.so %{_libdir}/samba/ldb/ldb.so -#%%{_libdir}/samba/ldb/mdb.so +%{_libdir}/samba/ldb/mdb.so %{_libdir}/samba/ldb/paged_searches.so %{_libdir}/samba/ldb/rdn_name.so %{_libdir}/samba/ldb/sample.so From 0f02de38673e5155ade9efafa79facddd0b3df01 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 23 Jul 2021 16:59:34 +0000 Subject: [PATCH 129/425] - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- samba.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 61da2ec..d6bb29d 100644 --- a/samba.spec +++ b/samba.spec @@ -115,7 +115,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 1 +%global baserelease 2 %global samba_version 4.15.0 %global talloc_version 2.3.3 @@ -3997,6 +3997,9 @@ fi %endif %changelog +* Fri Jul 23 2021 Fedora Release Engineering - 2:4.15.0-0.2.rc1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + * Mon Jul 19 2021 Guenther Deschner - 4.15.0rc1-1 - Fix ctdb-pcp-pmda install - resolves: #1983369 From 03a37fd80f24fea78feeb0b1006742a536753157 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 9 Aug 2021 16:48:31 +0200 Subject: [PATCH 130/425] Update to Samba 4.15.0rc2 resolves: #1991634 Guenther --- .gitignore | 2 ++ samba.spec | 8 ++++++-- sources | 4 ++-- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index d865f0b..ba9b72a 100644 --- a/.gitignore +++ b/.gitignore @@ -255,3 +255,5 @@ samba-3.6.0pre1.tar.gz /samba-4.14.6.tar.asc /samba-4.15.0rc1.tar.xz /samba-4.15.0rc1.tar.asc +/samba-4.15.0rc2.tar.xz +/samba-4.15.0rc2.tar.asc diff --git a/samba.spec b/samba.spec index d6bb29d..2ab345f 100644 --- a/samba.spec +++ b/samba.spec @@ -115,7 +115,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 2 +%global baserelease 3 %global samba_version 4.15.0 %global talloc_version 2.3.3 @@ -123,7 +123,7 @@ %global tevent_version 0.11.0 %global ldb_version 2.4.0 # This should be rc1 or nil -%global pre_release rc1 +%global pre_release rc2 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -3997,6 +3997,10 @@ fi %endif %changelog +* Mon Aug 09 2021 Guenther Deschner - 4.15.0rc2-3 +- Update to Samba 4.15.0rc2 +- resolves: #1991634 + * Fri Jul 23 2021 Fedora Release Engineering - 2:4.15.0-0.2.rc1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild diff --git a/sources b/sources index 7562738..d31e6c6 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.15.0rc1.tar.xz) = c8b5af52d5360301078d0020d3d9cfb4cf6e8b2a9f5478e07042008d5284f5505e808c870aee024943d7e80203e11ace2ea7145248ac3dc292bd68c9c9b4045a -SHA512 (samba-4.15.0rc1.tar.asc) = a71a90f7e57a9e8f2845cceb7bcc534f7b2e1d8ecf76619774c1b4962c869e0d9d20cc1a1ebb0518837af74a1dc990b6e738b3eeb34daa9e64b41cc47c0bda2a +SHA512 (samba-4.15.0rc2.tar.xz) = 5ff2f44c068babd3e37751e4cb52fd73d7c4da8f8d11fb6952206bc970b1206b0af3705991493a0ce1dcbe61d2c9ef6625b6a9b601f77324d5faaa0a9ac4e7d3 +SHA512 (samba-4.15.0rc2.tar.asc) = 8ee5488a0d226d72ae8a84898715ca8f27e7f83dfbc712a52d52e740b08aabd66155c091f92c3ac1a4c58d489ffa6f91a7f293cccb5fba3b878f81fb11da40ff From cc8c80c04bab6ec65a12dbe779bfb12b2b6f793a Mon Sep 17 00:00:00 2001 From: Anoop C S Date: Wed, 11 Aug 2021 11:25:37 +0530 Subject: [PATCH 131/425] Exclude PyDSDB library files Following library files are built without AD DC but has dependency on other components which are only available with DC: /usr/lib64/python3.9/site-packages/samba/dsdb.cpython-39-x86_64-linux-gnu.so /usr/lib64/python3.9/site-packages/samba/dsdb_dns.cpython-39-x86_64-linux-gnu.so Therefore we remove those from buildroot. resolves: #1991353 --- samba.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/samba.spec b/samba.spec index 2ab345f..b180f57 100644 --- a/samba.spec +++ b/samba.spec @@ -1201,6 +1201,8 @@ for i in \ %{python3_sitearch}/samba/dcerpc/dnsserver.*.so \ %{python3_sitearch}/samba/dnsserver.py \ %{python3_sitearch}/samba/domain_update.py \ + %{python3_sitearch}/samba/dsdb.*.so + %{python3_sitearch}/samba/dsdb_dns.*.so %{python3_sitearch}/samba/forest_update.py \ %{python3_sitearch}/samba/kcc/__init__.py \ %{python3_sitearch}/samba/kcc/debug.py \ From db523c32dadf81f3e245ea121ed9e2f01ed6b744 Mon Sep 17 00:00:00 2001 From: Anoop C S Date: Wed, 11 Aug 2021 11:26:39 +0530 Subject: [PATCH 132/425] Move `samba-tool` from samba-dc to samba-common-tools sub-package samba-tool is now built in a non AD DC environment and has been improved to prevent crashes due to import errors. See the following commits in upstream: * https://git.samba.org/?p=samba.git;a=commit;h=779d0f02718b3812024bafcd5477ec3039c7a0cf * https://git.samba.org/?p=samba.git;a=commit;h=fb5fe30e824d2d511188053ce04cf797b769727a * https://git.samba.org/?p=samba.git;a=commit;h=f241fe5d46e8dd2b3265be7eddbd6686a6f920db * https://git.samba.org/?p=samba.git;a=commit;h=a45ea91cd7e8335319c96ea5bda02014f584df63 related: #1991353 --- samba.spec | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index b180f57..3b2523b 100644 --- a/samba.spec +++ b/samba.spec @@ -1193,7 +1193,6 @@ for i in \ %{_libdir}/samba/libscavenge-dns-records-samba4.so \ %{_mandir}/man8/samba.8 \ %{_mandir}/man8/samba_downgrade_db.8 \ - %{_mandir}/man8/samba-tool.8 \ %{_mandir}/man8/samba-gpupdate.8 \ %{_libdir}/samba/ldb/ildap.so \ %{_libdir}/samba/ldb/ldbsamba_extensions.so \ @@ -1854,6 +1853,7 @@ fi %{_bindir}/net %{_bindir}/pdbedit %{_bindir}/profiles +%{_bindir}/samba-tool %{_bindir}/smbcontrol %{_bindir}/smbpasswd %{_bindir}/testparm @@ -1862,13 +1862,13 @@ fi %{_mandir}/man1/testparm.1* %{_mandir}/man8/net.8* %{_mandir}/man8/pdbedit.8* +%{_mandir}/man8/samba-tool.8* %{_mandir}/man8/smbpasswd.8* ### DC %if %{with dc} || %{with testsuite} %files dc %{_unitdir}/samba.service -%{_bindir}/samba-tool %{_sbindir}/samba %{_sbindir}/samba_dnsupdate %{_sbindir}/samba_downgrade_db @@ -1936,7 +1936,6 @@ fi %{_mandir}/man8/samba.8* %{_mandir}/man8/samba_downgrade_db.8* %{_mandir}/man8/samba-gpupdate.8* -%{_mandir}/man8/samba-tool.8* %dir %{_datadir}/samba/admx %{_datadir}/samba/admx/samba.admx %dir %{_datadir}/samba/admx/en-US From 58450895a08c194351abe938afcbe60571e8c087 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 10 Aug 2021 14:39:45 +0200 Subject: [PATCH 133/425] Require libs packages to be updated before restarting winbindd --- samba.spec | 3 +++ 1 file changed, 3 insertions(+) diff --git a/samba.spec b/samba.spec index 3b2523b..033a8fa 100644 --- a/samba.spec +++ b/samba.spec @@ -812,9 +812,12 @@ Summary: Samba winbind Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} +Requires(post): %{name}-common-libs = %{samba_depver} Requires: %{name}-common-tools = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} +Requires(post): %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} +Requires(post): %{name}-libs = %{samba_depver} Requires: %{name}-winbind-modules = %{samba_depver} %if %{with libwbclient} From b904ff11a5a0b84613c4dcfbc3a8014a7103f52c Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 10 Aug 2021 15:23:24 +0200 Subject: [PATCH 134/425] Use more CPUs for re-linking during the install step if possible --- samba.spec | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 033a8fa..bbbdccc 100644 --- a/samba.spec +++ b/samba.spec @@ -1103,7 +1103,8 @@ pushd pidl popd %install -%make_install +# Do not use %%make_install, make is just a wrapper around waf in Samba! +%{__make} %{?_smp_mflags} %{_make_verbose} install DESTDIR=%{buildroot} install -d -m 0755 %{buildroot}/usr/{sbin,bin} install -d -m 0755 %{buildroot}%{_libdir}/security From 47c27ed2c1c2af27aae766e11c72a7f0d5b45a98 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 10 Aug 2021 15:51:28 +0200 Subject: [PATCH 135/425] Document how to build with fedpkg --- samba.spec | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/samba.spec b/samba.spec index bbbdccc..15573f1 100644 --- a/samba.spec +++ b/samba.spec @@ -2,12 +2,16 @@ # # To build and run the tests use: # +# fedpkg local --with testsuite +# or # rpmbuild --rebuild --with testsuite samba.src.rpm # %bcond_with testsuite # Build with internal talloc, tevent, tdb and ldb. # +# fedpkg local --with=testsuite --with=includelibs +# or # rpmbuild --rebuild --with=testsuite --with=includelibs samba.src.rpm # %bcond_with includelibs From 68140d413f26c4fbcaab6a0094e363411f5f35bc Mon Sep 17 00:00:00 2001 From: Anoop C S Date: Thu, 12 Aug 2021 16:23:20 +0530 Subject: [PATCH 136/425] Fix inclusion of PyDSDB library files Commit cc8c80c04bab6ec65a12dbe779bfb12b2b6f793a removed the following PyDSDB library files from buildroot: * /usr/lib64/python3.9/site-packages/samba/dsdb.cpython-39-x86_64-linux-gnu.so * /usr/lib64/python3.9/site-packages/samba/dsdb_dns.cpython-39-x86_64-linux-gnu.so This was done under the impression that their dependency on libdnsserver-common-samba4.so was not built in a non AD DC environment. But in reality it was also conditionally removed from the buildroot. Apart from including PyDSDB back into python3-samba, we avoid removing libdnsserver-common-samba4.so from buildroot and subsequently include it in samba-libs to satisfy all dependencies. Additionally we remove PyDSDB listing from %files section of python3-samba-dc sub-package. --- samba.spec | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 15573f1..1da51f3 100644 --- a/samba.spec +++ b/samba.spec @@ -1196,7 +1196,6 @@ touch %{buildroot}%{_libdir}/krb5/plugins/libkrb5/winbind_krb5_locator.so %if %{without dc} && %{without testsuite} for i in \ %{_libdir}/samba/libdfs-server-ad-samba4.so \ - %{_libdir}/samba/libdnsserver-common-samba4.so \ %{_libdir}/samba/libdsdb-garbage-collect-tombstones-samba4.so \ %{_libdir}/samba/libscavenge-dns-records-samba4.so \ %{_mandir}/man8/samba.8 \ @@ -2168,6 +2167,7 @@ fi %{_libdir}/samba/libauth4-samba4.so %{_libdir}/samba/libauth-unix-token-samba4.so %{_libdir}/samba/libdcerpc-samba4.so +%{_libdir}/samba/libdnsserver-common-samba4.so %{_libdir}/samba/libshares-samba4.so %{_libdir}/samba/libsmbpasswdparser-samba4.so %{_libdir}/samba/libxattr-tdb-samba4.so @@ -2350,6 +2350,8 @@ fi %{python3_sitearch}/samba/descriptor.py %{python3_sitearch}/samba/dnsresolver.py %{python3_sitearch}/samba/drs_utils.py +%{python3_sitearch}/samba/dsdb.*.so +%{python3_sitearch}/samba/dsdb_dns.*.so %{python3_sitearch}/samba/gensec.*.so %{python3_sitearch}/samba/getopt.py %{python3_sitearch}/samba/gpclass.py @@ -2541,8 +2543,6 @@ fi %{python3_sitearch}/samba/dcerpc/dnsserver.*.so %{python3_sitearch}/samba/dckeytab.*.so -%{python3_sitearch}/samba/dsdb.*.so -%{python3_sitearch}/samba/dsdb_dns.*.so %{python3_sitearch}/samba/domain_update.py %{python3_sitearch}/samba/forest_update.py %{python3_sitearch}/samba/ms_forest_updates_markdown.py From 713db3d97218989e8deca020371d7ee02551e598 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 12 Aug 2021 14:41:44 +0200 Subject: [PATCH 137/425] Add missing Requires in samba-common-tools for samba-tool --- samba.spec | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/samba.spec b/samba.spec index 1da51f3..b1d4937 100644 --- a/samba.spec +++ b/samba.spec @@ -119,7 +119,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 3 +%global baserelease 4 %global samba_version 4.15.0 %global talloc_version 2.3.3 @@ -461,6 +461,13 @@ Requires: samba-libs = %{samba_depver} Requires: libwbclient = %{samba_depver} %endif +# samba-tool needs python3-samba +Requires: python3-%{samba} = %{samba_depver} +# samba-tool needs tdbbackup +Requires: tdb-tools +# samba-tool needs mdb_copy +Requires: lmdb + Provides: bundled(libreplace) %description common-tools @@ -482,10 +489,6 @@ Requires(post): libwbclient = %{samba_depver} Requires: libwbclient = %{samba_depver} %endif -# samba-tool needs tdbbackup -Requires: tdb-tools -# samba-tool needs mdb_copy -Requires: lmdb Requires: ldb-tools Requires: python3-setproctitle # Force using libldb version to be the same as build version @@ -4006,6 +4009,9 @@ fi %endif %changelog +* Thu Aug 12 2021 Andreas Schneider - 4.15.0rc2-4 +- Package samba-tool correctly + * Mon Aug 09 2021 Guenther Deschner - 4.15.0rc2-3 - Update to Samba 4.15.0rc2 - resolves: #1991634 From 376ef2f0e02481aa621ca99edd2426b606c217a0 Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Fri, 13 Aug 2021 09:12:01 -0700 Subject: [PATCH 138/425] Fix samba-common-tools dependency It was literally "python3-%{samba}", which obviously didn't work. --- samba.spec | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/samba.spec b/samba.spec index b1d4937..230cfcf 100644 --- a/samba.spec +++ b/samba.spec @@ -119,7 +119,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 4 +%global baserelease 5 %global samba_version 4.15.0 %global talloc_version 2.3.3 @@ -462,7 +462,7 @@ Requires: libwbclient = %{samba_depver} %endif # samba-tool needs python3-samba -Requires: python3-%{samba} = %{samba_depver} +Requires: python3-%{name} = %{samba_depver} # samba-tool needs tdbbackup Requires: tdb-tools # samba-tool needs mdb_copy @@ -4009,10 +4009,13 @@ fi %endif %changelog -* Thu Aug 12 2021 Andreas Schneider - 4.15.0rc2-4 +* Fri Aug 13 2021 Adam Williamson - 4.15.0-0.5.rc2 +- Fix samba-common-tools dependency + +* Thu Aug 12 2021 Andreas Schneider - 4.15.0-0.4.rc2 - Package samba-tool correctly -* Mon Aug 09 2021 Guenther Deschner - 4.15.0rc2-3 +* Mon Aug 09 2021 Guenther Deschner - 4.15.0-0.3.rc2 - Update to Samba 4.15.0rc2 - resolves: #1991634 From cffce0ef3ee070d168ab58bb91a8d73b6173395d Mon Sep 17 00:00:00 2001 From: Anoop C S Date: Thu, 12 Aug 2021 20:43:41 +0530 Subject: [PATCH 139/425] Remove duplicate listing for libdnsserver-common-samba4.so libdnsserver-common-samba4.so is already getting packaged in samba-libs sub-package(see 68140d413f26c4fbcaab6a0094e363411f5f35bc) and samba-dc-libs pulls in samba-libs. Therefore removing it from samba-dc-libs. --- samba.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/samba.spec b/samba.spec index 230cfcf..5880a08 100644 --- a/samba.spec +++ b/samba.spec @@ -1988,7 +1988,6 @@ fi %endif %{_libdir}/libdcerpc-server.so.* -%{_libdir}/samba/libdnsserver-common-samba4.so %{_libdir}/samba/libdsdb-module-samba4.so %{_libdir}/samba/libdsdb-garbage-collect-tombstones-samba4.so %{_libdir}/samba/libscavenge-dns-records-samba4.so From 6410d154ebb5884e7d2d23a8585faa74730e5389 Mon Sep 17 00:00:00 2001 From: Anoop C S Date: Mon, 16 Aug 2021 13:21:01 +0530 Subject: [PATCH 140/425] Revert "Exclude PyDSDB library files" This reverts commit cc8c80c04bab6ec65a12dbe779bfb12b2b6f793a. --- samba.spec | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 5880a08..9110f2a 100644 --- a/samba.spec +++ b/samba.spec @@ -119,7 +119,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 5 +%global baserelease 6 %global samba_version 4.15.0 %global talloc_version 2.3.3 @@ -1210,8 +1210,6 @@ for i in \ %{python3_sitearch}/samba/dcerpc/dnsserver.*.so \ %{python3_sitearch}/samba/dnsserver.py \ %{python3_sitearch}/samba/domain_update.py \ - %{python3_sitearch}/samba/dsdb.*.so - %{python3_sitearch}/samba/dsdb_dns.*.so %{python3_sitearch}/samba/forest_update.py \ %{python3_sitearch}/samba/kcc/__init__.py \ %{python3_sitearch}/samba/kcc/debug.py \ @@ -4008,6 +4006,9 @@ fi %endif %changelog +* Mon Aug 16 2021 Anoop C S - 4.15.0-0.6.rc2 +- Avoid removing PyDSDB library files from buildroot for non AD DC build + * Fri Aug 13 2021 Adam Williamson - 4.15.0-0.5.rc2 - Fix samba-common-tools dependency From fe6291ff86b2f3e9af2416d97144332807d7057a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 25 Aug 2021 13:24:34 +0200 Subject: [PATCH 141/425] Add ceph and etcd mutex helpers for CTDB Guenther --- samba-ctdb-etcd-reclock.patch | 30 +++++++++++++++ samba.spec | 69 ++++++++++++++++++++++++++++++++++- 2 files changed, 97 insertions(+), 2 deletions(-) create mode 100644 samba-ctdb-etcd-reclock.patch diff --git a/samba-ctdb-etcd-reclock.patch b/samba-ctdb-etcd-reclock.patch new file mode 100644 index 0000000..2a55408 --- /dev/null +++ b/samba-ctdb-etcd-reclock.patch @@ -0,0 +1,30 @@ +From 939aed0498269df3c1e012f3b68c314b583f25bd Mon Sep 17 00:00:00 2001 +From: Martin Schwenke +Date: Tue, 27 Apr 2021 15:46:14 +1000 +Subject: [PATCH] utils: Use Python 3 + +Due to the number of flake8 and pylint warnings it is unclear if the +source has Python 3 incompatibilities. These will be cleaned up in +subsequent commits. + +Signed-off-by: "L.P.H. van Belle" +Reviewed-by: Martin Schwenke +Reviewed-by: David Disseldorp +Reviewed-by: Jose A. Rivera +--- + ctdb/utils/etcd/ctdb_etcd_lock | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/ctdb/utils/etcd/ctdb_etcd_lock b/ctdb/utils/etcd/ctdb_etcd_lock +index 000c6bb7208..7f5194eff0a 100755 +--- a/ctdb/utils/etcd/ctdb_etcd_lock ++++ b/ctdb/utils/etcd/ctdb_etcd_lock +@@ -1,4 +1,4 @@ +-#!/usr/bin/python ++#!/usr/bin/env python3 + # + # This program is free software: you can redistribute it and/or modify + # it under the terms of the GNU General Public License as published by +-- +2.31.1 + diff --git a/samba.spec b/samba.spec index 9110f2a..9752b92 100644 --- a/samba.spec +++ b/samba.spec @@ -46,18 +46,21 @@ %bcond_without winexe %endif -# Build vfs_ceph module by default on 64bit Fedora +# Build vfs_ceph module and ctdb cepth mutex helper by default on 64bit Fedora %if 0%{?fedora} %ifarch aarch64 ppc64le s390x x86_64 %bcond_without vfs_cephfs +%bcond_without ceph_mutex %else %bcond_with vfs_cephfs +%bcond_with ceph_mutex #endifarch %endif %else %bcond_with vfs_cephfs +%bcond_with ceph_mutex #endif fedora %endif @@ -117,9 +120,16 @@ %bcond_with pcp_pmda %endif +# Build the etcd helpers by default on Fedora +%if 0%{?fedora} +%bcond_without etcd_mutex +%else +%bcond_with etcd_mutex +%endif + %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 6 +%global baserelease 7 %global samba_version 4.15.0 %global talloc_version 2.3.3 @@ -189,6 +199,7 @@ Source14: samba.pamd Source201: README.downgrade Patch0: samba-s4u.patch +Patch1: samba-ctdb-etcd-reclock.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -299,6 +310,12 @@ BuildRequires: liburing-devel >= 0.4 %if %{with pcp_pmda} BuildRequires: pcp-libs-devel %endif +%if %{with ceph_mutex} +BuildRequires: librados-devel +%endif +%if %{with etcd_mutex} +BuildRequires: python3-etcd +%endif %if %{with dc} || %{with testsuite} # Add python3-iso8601 to avoid that the @@ -998,6 +1015,31 @@ Performance Co-Pilot (PCP) support for CTDB #endif with pcp_pmda %endif +%if %{with etcd_mutex} + +%package -n ctdb-etcd-mutex +Summary: CTDB ETCD mutex helper +Requires: ctdb = %{samba_depver} +Requires: python3-etcd + +%description -n ctdb-etcd-mutex +Support for using an existing ETCD cluster as a mutex helper for CTDB + +#endif with etcd_mutex +%endif + +%if %{with ceph_mutex} + +%package -n ctdb-ceph-mutex +Summary: CTDB ceph mutex helper +Requires: ctdb = %{samba_depver} + +%description -n ctdb-ceph-mutex +Support for using an existing CEPH cluster as a mutex helper for CTDB + +#endif with ceph_mutex +%endif + #endif with clustering %endif @@ -1090,6 +1132,12 @@ export LDFLAGS="%{__global_ldflags} -fuse-ld=gold" %endif %if %{with pcp_pmda} --enable-pmda \ +%endif +%if %{with ceph_mutex} + --enable-ceph-reclock \ +%endif +%if %{with etcd_mutex} + --enable-etcd-reclock \ %endif --with-profiling-data \ --with-systemd \ @@ -3995,6 +4043,20 @@ fi #endif with pcp_pmda %endif +%if %{with etcd_mutex} +%files -n ctdb-etcd-mutex +%{_libexecdir}/ctdb/ctdb_etcd_lock +%{_mandir}/man7/ctdb-etcd.7.gz +#endif with etcd_mutex +%endif + +%if %{with ceph_mutex} +%files -n ctdb-ceph-mutex +%{_libexecdir}/ctdb/ctdb_mutex_ceph_rados_helper +%{_mandir}/man7/ctdb_mutex_ceph_rados_helper.7.gz +#endif with ceph_mutex +%endif + #endif with clustering %endif @@ -4006,6 +4068,9 @@ fi %endif %changelog +* Wed Aug 25 2021 Guenther Deschner - 4.15.0-0.7.rc2 +- Add ceph and etcd mutex helpers for CTDB + * Mon Aug 16 2021 Anoop C S - 4.15.0-0.6.rc2 - Avoid removing PyDSDB library files from buildroot for non AD DC build From a184099345c3df2477106b25e1c223a7899b0a7c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 26 Aug 2021 13:16:50 +0200 Subject: [PATCH 142/425] Update to Samba 4.15.0rc3 resolves: #1998024 Guenther --- .gitignore | 2 ++ samba.spec | 8 ++++++-- sources | 4 ++-- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index ba9b72a..d38fc2e 100644 --- a/.gitignore +++ b/.gitignore @@ -257,3 +257,5 @@ samba-3.6.0pre1.tar.gz /samba-4.15.0rc1.tar.asc /samba-4.15.0rc2.tar.xz /samba-4.15.0rc2.tar.asc +/samba-4.15.0rc3.tar.xz +/samba-4.15.0rc3.tar.asc diff --git a/samba.spec b/samba.spec index 9752b92..29513ba 100644 --- a/samba.spec +++ b/samba.spec @@ -129,7 +129,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 7 +%global baserelease 8 %global samba_version 4.15.0 %global talloc_version 2.3.3 @@ -137,7 +137,7 @@ %global tevent_version 0.11.0 %global ldb_version 2.4.0 # This should be rc1 or nil -%global pre_release rc2 +%global pre_release rc3 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4068,6 +4068,10 @@ fi %endif %changelog +* Thu Aug 26 2021 Guenther Deschner - 4.15.0-0.8.rc3 +- Update to Samba 4.15.0rc3 +- resolves: #1998024 + * Wed Aug 25 2021 Guenther Deschner - 4.15.0-0.7.rc2 - Add ceph and etcd mutex helpers for CTDB diff --git a/sources b/sources index d31e6c6..a810c11 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.15.0rc2.tar.xz) = 5ff2f44c068babd3e37751e4cb52fd73d7c4da8f8d11fb6952206bc970b1206b0af3705991493a0ce1dcbe61d2c9ef6625b6a9b601f77324d5faaa0a9ac4e7d3 -SHA512 (samba-4.15.0rc2.tar.asc) = 8ee5488a0d226d72ae8a84898715ca8f27e7f83dfbc712a52d52e740b08aabd66155c091f92c3ac1a4c58d489ffa6f91a7f293cccb5fba3b878f81fb11da40ff +SHA512 (samba-4.15.0rc3.tar.xz) = 4f3fd39b22cbc08001f1b9f4295a1acba22b6d0c82235704d35667329e608b844f5b793e39fd84e3b4bd7956ae7991c2958031531c673ddbde593799e6af5d47 +SHA512 (samba-4.15.0rc3.tar.asc) = 6f8d7a69d643208c2dbfd4423b5351319c4a8361cac2ea5fa378787a885d63794018ec96334a847a5aaf2e0ad494846164a2a13aab7ffe1b9f35afa671c531d8 From 0a04de2534dc192b9e7d57f60f83e7e0b231dde5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 1 Sep 2021 13:47:44 +0200 Subject: [PATCH 143/425] Update to Samba 4.15.0rc4 resolves: #2000079 Guenther --- .gitignore | 2 ++ samba.spec | 8 ++++++-- sources | 4 ++-- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index d38fc2e..fcd6170 100644 --- a/.gitignore +++ b/.gitignore @@ -259,3 +259,5 @@ samba-3.6.0pre1.tar.gz /samba-4.15.0rc2.tar.asc /samba-4.15.0rc3.tar.xz /samba-4.15.0rc3.tar.asc +/samba-4.15.0rc4.tar.xz +/samba-4.15.0rc4.tar.asc diff --git a/samba.spec b/samba.spec index 29513ba..d9dd415 100644 --- a/samba.spec +++ b/samba.spec @@ -129,7 +129,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 8 +%global baserelease 9 %global samba_version 4.15.0 %global talloc_version 2.3.3 @@ -137,7 +137,7 @@ %global tevent_version 0.11.0 %global ldb_version 2.4.0 # This should be rc1 or nil -%global pre_release rc3 +%global pre_release rc4 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4068,6 +4068,10 @@ fi %endif %changelog +* Wed Sep 01 2021 Guenther Deschner - 4.15.0-0.9.rc4 +- Update to Samba 4.15.0rc4 +- resolves: #2000079 + * Thu Aug 26 2021 Guenther Deschner - 4.15.0-0.8.rc3 - Update to Samba 4.15.0rc3 - resolves: #1998024 diff --git a/sources b/sources index a810c11..3aacdc3 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.15.0rc3.tar.xz) = 4f3fd39b22cbc08001f1b9f4295a1acba22b6d0c82235704d35667329e608b844f5b793e39fd84e3b4bd7956ae7991c2958031531c673ddbde593799e6af5d47 -SHA512 (samba-4.15.0rc3.tar.asc) = 6f8d7a69d643208c2dbfd4423b5351319c4a8361cac2ea5fa378787a885d63794018ec96334a847a5aaf2e0ad494846164a2a13aab7ffe1b9f35afa671c531d8 +SHA512 (samba-4.15.0rc4.tar.xz) = 0fc9fce786b539dec7dd93e6403d5ff4e67e7cb17a4b064e6af23c98e4b122b1ce12653c5dcb7aa4317d91b729f98864988981456a8344e0ff7eb66bf8956104 +SHA512 (samba-4.15.0rc4.tar.asc) = dd2823db2b2b16d0a0c3cb61410320812eeae38f4a76b83951dec8d72e2821043af960aae3929d132a33aa7d7cf1f481446ed32738393192050b147d07116664 From a7a77b0af0670acd8571cc739915a3ca091553e3 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 3 Sep 2021 09:07:20 +0200 Subject: [PATCH 144/425] We need python3-cryptography for krb5 tests --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index d9dd415..678fc7f 100644 --- a/samba.spec +++ b/samba.spec @@ -360,6 +360,7 @@ BuildRequires: ldb-tools BuildRequires: python3-gpg BuildRequires: python3-markdown BuildRequires: python3-setproctitle +BuildRequires: python3-cryptography BuildRequires: tdb-tools %endif From eae8b0478426d67af7df0400d10a2199e15c6881 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 3 Sep 2021 09:07:37 +0200 Subject: [PATCH 145/425] The testsuite requires lmdb-devel --- samba.spec | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 678fc7f..fc4720c 100644 --- a/samba.spec +++ b/samba.spec @@ -346,7 +346,9 @@ BuildRequires: python3-tdb >= %{tdb_version} BuildRequires: libldb-devel >= %{ldb_version} BuildRequires: python3-ldb >= %{ldb_version} BuildRequires: python3-ldb-devel >= %{ldb_version} -%else +%endif + +%if %{with includelibs} || %{with testsuite} # lmdb-devel is required for the mdb ldb module, if samba is configured # to build includelibs we need lmdb-devel for building that module on our own BuildRequires: lmdb-devel From 29bd82541a69a2db6523385bf844cf051f30fb91 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 7 Sep 2021 12:21:08 +0200 Subject: [PATCH 146/425] Update to Samba 4.15.0rc5 resolves: #2001827 Guenther --- .gitignore | 2 ++ samba.spec | 8 ++++++-- sources | 4 ++-- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index fcd6170..3ff73e5 100644 --- a/.gitignore +++ b/.gitignore @@ -261,3 +261,5 @@ samba-3.6.0pre1.tar.gz /samba-4.15.0rc3.tar.asc /samba-4.15.0rc4.tar.xz /samba-4.15.0rc4.tar.asc +/samba-4.15.0rc5.tar.xz +/samba-4.15.0rc5.tar.asc diff --git a/samba.spec b/samba.spec index fc4720c..d0800f8 100644 --- a/samba.spec +++ b/samba.spec @@ -129,7 +129,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 9 +%global baserelease 10 %global samba_version 4.15.0 %global talloc_version 2.3.3 @@ -137,7 +137,7 @@ %global tevent_version 0.11.0 %global ldb_version 2.4.0 # This should be rc1 or nil -%global pre_release rc4 +%global pre_release rc5 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4071,6 +4071,10 @@ fi %endif %changelog +* Tue Sep 07 2021 Guenther Deschner - 4.15.0-0.10.rc5 +- Update to Samba 4.15.0rc5 +- resolves: #2001827 + * Wed Sep 01 2021 Guenther Deschner - 4.15.0-0.9.rc4 - Update to Samba 4.15.0rc4 - resolves: #2000079 diff --git a/sources b/sources index 3aacdc3..aa7540e 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.15.0rc4.tar.xz) = 0fc9fce786b539dec7dd93e6403d5ff4e67e7cb17a4b064e6af23c98e4b122b1ce12653c5dcb7aa4317d91b729f98864988981456a8344e0ff7eb66bf8956104 -SHA512 (samba-4.15.0rc4.tar.asc) = dd2823db2b2b16d0a0c3cb61410320812eeae38f4a76b83951dec8d72e2821043af960aae3929d132a33aa7d7cf1f481446ed32738393192050b147d07116664 +SHA512 (samba-4.15.0rc5.tar.xz) = 53b79354a441e4a29ed7e807e0f18d4249b8ee0f99bf034947dd4c4674f68eb2b795832130025ab214cc3ad2deaa771b202131addc0b563a2d4310b7809e698d +SHA512 (samba-4.15.0rc5.tar.asc) = 0eea9c233c98bd52ad91a2c7bcf384d3dbe5b7017bf76dd29b083256ed95e78b6538d25d93b04710c4684d077755179a813dda82470301b8f87f63b61a6f2461 From c6ac21963a2245eccbaa9140bb228423a7d7b27a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 9 Sep 2021 09:58:04 +0200 Subject: [PATCH 147/425] Update to Samba 4.15.0rc6 resolves: #2002546 Guenther --- .gitignore | 2 ++ samba-s4u.patch | 69 ++++++++++++++++++++++++------------------------- samba.spec | 12 +++++++-- sources | 4 +-- 4 files changed, 48 insertions(+), 39 deletions(-) diff --git a/.gitignore b/.gitignore index 3ff73e5..3b7fe64 100644 --- a/.gitignore +++ b/.gitignore @@ -263,3 +263,5 @@ samba-3.6.0pre1.tar.gz /samba-4.15.0rc4.tar.asc /samba-4.15.0rc5.tar.xz /samba-4.15.0rc5.tar.asc +/samba-4.15.0rc6.tar.xz +/samba-4.15.0rc6.tar.asc diff --git a/samba-s4u.patch b/samba-s4u.patch index 83ed873..bb323f3 100644 --- a/samba-s4u.patch +++ b/samba-s4u.patch @@ -1,22 +1,21 @@ -From fe300549844509624d944b93fc64dc6d382e71c1 Mon Sep 17 00:00:00 2001 +From 7c4125deb1e03917f0a2353740f2c0e9e6cf87c5 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Fri, 27 Sep 2019 18:25:03 +0300 -Subject: [PATCH 3/7] mit-kdc: add basic loacl realm S4U support +Subject: [PATCH 1/3] mit-kdc: add basic loacl realm S4U support Signed-off-by: Isaac Boukris Pair-Programmed-With: Andreas Schneider --- - source4/kdc/mit-kdb/kdb_samba_policies.c | 148 +++++++++--------- - source4/kdc/mit_samba.c | 47 ++---- - source4/kdc/mit_samba.h | 6 +- - wscript_configure_system_mitkrb5 | 3 + - 6 files changed, 91 insertions(+), 115 deletions(-) + source4/kdc/mit-kdb/kdb_samba_policies.c | 148 +++++++++++------------ + source4/kdc/mit_samba.c | 47 ++----- + source4/kdc/mit_samba.h | 6 +- + 3 files changed, 86 insertions(+), 115 deletions(-) diff --git a/source4/kdc/mit-kdb/kdb_samba_policies.c b/source4/kdc/mit-kdb/kdb_samba_policies.c -index 9197551ed61..944324d9a2f 100644 +index ac9865aac60..17d4c4028b9 100644 --- a/source4/kdc/mit-kdb/kdb_samba_policies.c +++ b/source4/kdc/mit-kdb/kdb_samba_policies.c -@@ -192,13 +192,17 @@ static krb5_error_code ks_verify_pac(krb5_context context, +@@ -195,13 +195,17 @@ static krb5_error_code ks_verify_pac(krb5_context context, krb5_keyblock *krbtgt_key, krb5_timestamp authtime, krb5_authdata **tgt_auth_data, @@ -37,7 +36,7 @@ index 9197551ed61..944324d9a2f 100644 mit_ctx = ks_get_context(context); if (mit_ctx == NULL) { -@@ -230,41 +234,43 @@ static krb5_error_code ks_verify_pac(krb5_context context, +@@ -233,41 +237,43 @@ static krb5_error_code ks_verify_pac(krb5_context context, code = krb5_pac_parse(context, authdata[0]->contents, authdata[0]->length, @@ -107,7 +106,7 @@ index 9197551ed61..944324d9a2f 100644 if (code != 0) { goto done; } -@@ -272,17 +278,22 @@ static krb5_error_code ks_verify_pac(krb5_context context, +@@ -275,17 +281,22 @@ static krb5_error_code ks_verify_pac(krb5_context context, code = mit_samba_reget_pac(mit_ctx, context, flags, @@ -134,18 +133,18 @@ index 9197551ed61..944324d9a2f 100644 return code; } -@@ -324,7 +335,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, +@@ -310,7 +321,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, + krb5_authdata ***signed_auth_data) { - #endif krb5_authdata **authdata = NULL; - krb5_boolean is_as_req; + krb5_const_principal pac_client; krb5_error_code code; krb5_pac pac = NULL; krb5_data pac_data; -@@ -334,24 +345,21 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, +@@ -318,24 +329,21 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, + krbtgt = krbtgt == NULL ? local_krbtgt : krbtgt; krbtgt_key = krbtgt_key == NULL ? local_krbtgt_key : krbtgt_key; - #endif - /* FIXME: We don't support S4U yet */ - if (flags & KRB5_KDB_FLAGS_S4U) { @@ -179,7 +178,7 @@ index 9197551ed61..944324d9a2f 100644 client, server, krbtgt, -@@ -363,14 +371,28 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, +@@ -347,14 +355,28 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, if (code != 0) { goto done; } @@ -209,7 +208,7 @@ index 9197551ed61..944324d9a2f 100644 } if (pac == NULL) { -@@ -379,7 +401,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, +@@ -363,7 +385,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, } code = krb5_pac_sign(context, pac, authtime, client_princ, @@ -218,7 +217,7 @@ index 9197551ed61..944324d9a2f 100644 if (code != 0) { DBG_ERR("krb5_pac_sign failed: %d\n", code); goto done; -@@ -405,11 +427,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, +@@ -389,11 +411,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, KRB5_AUTHDATA_IF_RELEVANT, authdata, signed_auth_data); @@ -230,7 +229,7 @@ index 9197551ed61..944324d9a2f 100644 done: krb5_pac_free(context, pac); -@@ -432,32 +449,13 @@ krb5_error_code kdb_samba_db_check_allowed_to_delegate(krb5_context context, +@@ -416,32 +433,13 @@ krb5_error_code kdb_samba_db_check_allowed_to_delegate(krb5_context context, * server; -> delegating service * proxy; -> target principal */ @@ -265,10 +264,10 @@ index 9197551ed61..944324d9a2f 100644 diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c -index 54dcd545ea1..f23327c9613 100644 +index 0a0d3a98315..5f35c6025bf 100644 --- a/source4/kdc/mit_samba.c +++ b/source4/kdc/mit_samba.c -@@ -467,7 +467,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx, +@@ -493,7 +493,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx, krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, krb5_context context, int flags, @@ -276,7 +275,7 @@ index 54dcd545ea1..f23327c9613 100644 krb5_db_entry *client, krb5_db_entry *server, krb5_db_entry *krbtgt, -@@ -615,7 +614,7 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, +@@ -641,7 +640,7 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, context, *pac, server->princ, @@ -285,7 +284,7 @@ index 54dcd545ea1..f23327c9613 100644 deleg_blob); if (!NT_STATUS_IS_OK(nt_status)) { DEBUG(0, ("Update delegation info failed: %s\n", -@@ -937,41 +936,17 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx, +@@ -963,41 +962,17 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx, } int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx, @@ -362,12 +361,13 @@ index ba824557bd5..5aadf206443 100644 int mit_samba_kpasswd_change_password(struct mit_samba_context *ctx, char *pwd, -- -2.25.4 +2.31.1 -From ff1b225493ede3d43cfad571770dacb73f75ec42 Mon Sep 17 00:00:00 2001 + +From b2ada81ed9f89f6b38fb0a9e54811408676671d0 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Fri, 27 Sep 2019 18:35:30 +0300 -Subject: [PATCH 5/7] krb5-mit: enable S4U client support for MIT build +Subject: [PATCH 2/3] krb5-mit: enable S4U client support for MIT build Signed-off-by: Isaac Boukris Pair-Programmed-With: Andreas Schneider @@ -375,7 +375,7 @@ Pair-Programmed-With: Andreas Schneider lib/krb5_wrap/krb5_samba.c | 185 ++++++++++++++++++++++++++ lib/krb5_wrap/krb5_samba.h | 2 - source4/auth/kerberos/kerberos_util.c | 11 -- - 4 files changed, 185 insertions(+), 14 deletions(-) + 3 files changed, 185 insertions(+), 13 deletions(-) diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c index 20ce86c708d..e72ab3c30f7 100644 @@ -574,7 +574,7 @@ index 20ce86c708d..e72ab3c30f7 100644 #if !defined(HAVE_KRB5_MAKE_PRINCIPAL) && defined(HAVE_KRB5_BUILD_PRINCIPAL_ALLOC_VA) diff --git a/lib/krb5_wrap/krb5_samba.h b/lib/krb5_wrap/krb5_samba.h -index ca9a893e4f7..3264ce5eb3b 100644 +index 9550447b2c5..ee3931c7544 100644 --- a/lib/krb5_wrap/krb5_samba.h +++ b/lib/krb5_wrap/krb5_samba.h @@ -252,7 +252,6 @@ krb5_error_code smb_krb5_kinit_password_ccache(krb5_context ctx, @@ -639,14 +639,13 @@ index 544d9d853cc..c14d8c72d8c 100644 ret = smb_krb5_kinit_password_ccache(smb_krb5_context->krb5_context, ccache, -- -2.25.4 +2.31.1 - -From cf1b9bdc09180d68e2b30258839d2f78b7af9c62 Mon Sep 17 00:00:00 2001 +From bc5e97074739d29320a3e890575353fbfd452047 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Sat, 19 Sep 2020 14:16:20 +0200 -Subject: [PATCH 7/7] wip: for canonicalization with new MIT kdc code +Subject: [PATCH 3/3] wip: for canonicalization with new MIT kdc code --- source4/heimdal/lib/hdb/hdb.h | 1 + @@ -696,10 +695,10 @@ index a560a1cd84b..c27b6a8ef4c 100644 ret = smb_krb5_make_principal(context, &entry_ex->entry.principal, lpcfg_realm(lp_ctx), samAccountName, NULL); if (ret) { diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c -index f23327c9613..4084e893cc2 100644 +index 5f35c6025bf..20ee2c2b89e 100644 --- a/source4/kdc/mit_samba.c +++ b/source4/kdc/mit_samba.c -@@ -198,6 +198,9 @@ int mit_samba_get_principal(struct mit_samba_context *ctx, +@@ -224,6 +224,9 @@ int mit_samba_get_principal(struct mit_samba_context *ctx, if (kflags & KRB5_KDB_FLAG_CANONICALIZE) { sflags |= SDB_F_CANON; } @@ -722,5 +721,5 @@ index c929acccce6..a9115ec23d7 100644 void sdb_free_entry(struct sdb_entry_ex *e); void free_sdb_entry(struct sdb_entry *s); -- -2.25.4 +2.31.1 diff --git a/samba.spec b/samba.spec index d0800f8..9a183c7 100644 --- a/samba.spec +++ b/samba.spec @@ -129,7 +129,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 10 +%global baserelease 11 %global samba_version 4.15.0 %global talloc_version 2.3.3 @@ -137,7 +137,7 @@ %global tevent_version 0.11.0 %global ldb_version 2.4.0 # This should be rc1 or nil -%global pre_release rc5 +%global pre_release rc6 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -2813,6 +2813,7 @@ fi %{python3_sitearch}/samba/tests/dcerpc/__pycache__/binding.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/dnsserver.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/integer.*.pyc +%{python3_sitearch}/samba/tests/dcerpc/__pycache__/lsa.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/mdssvc.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/misc.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/raw_protocol.*.pyc @@ -2832,6 +2833,7 @@ fi %{python3_sitearch}/samba/tests/dcerpc/createtrustrelax.py %{python3_sitearch}/samba/tests/dcerpc/dnsserver.py %{python3_sitearch}/samba/tests/dcerpc/integer.py +%{python3_sitearch}/samba/tests/dcerpc/lsa.py %{python3_sitearch}/samba/tests/dcerpc/mdssvc.py %{python3_sitearch}/samba/tests/dcerpc/misc.py %{python3_sitearch}/samba/tests/dcerpc/raw_protocol.py @@ -2901,6 +2903,7 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/as_canonicalization_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/as_req_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/compatability_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/fast_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kcrypto.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_base_test.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tests.*.pyc @@ -2919,6 +2922,7 @@ fi %{python3_sitearch}/samba/tests/krb5/as_canonicalization_tests.py %{python3_sitearch}/samba/tests/krb5/as_req_tests.py %{python3_sitearch}/samba/tests/krb5/compatability_tests.py +%{python3_sitearch}/samba/tests/krb5/fast_tests.py %{python3_sitearch}/samba/tests/krb5/kcrypto.py %{python3_sitearch}/samba/tests/krb5/kdc_base_test.py %{python3_sitearch}/samba/tests/krb5/kdc_tests.py @@ -4071,6 +4075,10 @@ fi %endif %changelog +* Thu Sep 09 2021 Guenther Deschner - 4.15.0-0.11.rc6 +- Update to Samba 4.15.0rc6 +- resolves: #2002546 + * Tue Sep 07 2021 Guenther Deschner - 4.15.0-0.10.rc5 - Update to Samba 4.15.0rc5 - resolves: #2001827 diff --git a/sources b/sources index aa7540e..944c241 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.15.0rc5.tar.xz) = 53b79354a441e4a29ed7e807e0f18d4249b8ee0f99bf034947dd4c4674f68eb2b795832130025ab214cc3ad2deaa771b202131addc0b563a2d4310b7809e698d -SHA512 (samba-4.15.0rc5.tar.asc) = 0eea9c233c98bd52ad91a2c7bcf384d3dbe5b7017bf76dd29b083256ed95e78b6538d25d93b04710c4684d077755179a813dda82470301b8f87f63b61a6f2461 +SHA512 (samba-4.15.0rc6.tar.xz) = 9b3c7e2f34e672072da9fcfc5613079f884ab7120d19f09f18c74262eddc342bff00796ed1b0c30ba1a8b8dc2b22cdba9909baca82da91bd9352de334c1ef271 +SHA512 (samba-4.15.0rc6.tar.asc) = 5aa243b3dc68890feef77d44d2beae2401a9827219fe84a53d564e1e6b56175e46282c7e0c6ac932fd535bc1bf4b8a5403da4281a0bb7919543e2a464b9e8c89 From 2efb445c94ae2cb4eb72b6d83b02bf46eb036c0a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 13 Sep 2021 17:31:33 +0200 Subject: [PATCH 148/425] Update to Samba 4.15.0rc7 resolves: #2003740 Guenther --- .gitignore | 2 ++ samba.spec | 8 ++++++-- sources | 4 ++-- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 3b7fe64..9c56e55 100644 --- a/.gitignore +++ b/.gitignore @@ -265,3 +265,5 @@ samba-3.6.0pre1.tar.gz /samba-4.15.0rc5.tar.asc /samba-4.15.0rc6.tar.xz /samba-4.15.0rc6.tar.asc +/samba-4.15.0rc7.tar.xz +/samba-4.15.0rc7.tar.asc diff --git a/samba.spec b/samba.spec index 9a183c7..36cfb7a 100644 --- a/samba.spec +++ b/samba.spec @@ -129,7 +129,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 11 +%global baserelease 12 %global samba_version 4.15.0 %global talloc_version 2.3.3 @@ -137,7 +137,7 @@ %global tevent_version 0.11.0 %global ldb_version 2.4.0 # This should be rc1 or nil -%global pre_release rc6 +%global pre_release rc7 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4075,6 +4075,10 @@ fi %endif %changelog +* Mon Sep 13 2021 Guenther Deschner - 4.15.0-0.12.rc7 +- Update to Samba 4.15.0rc7 +- resolves: #2003740 + * Thu Sep 09 2021 Guenther Deschner - 4.15.0-0.11.rc6 - Update to Samba 4.15.0rc6 - resolves: #2002546 diff --git a/sources b/sources index 944c241..ec69424 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.15.0rc6.tar.xz) = 9b3c7e2f34e672072da9fcfc5613079f884ab7120d19f09f18c74262eddc342bff00796ed1b0c30ba1a8b8dc2b22cdba9909baca82da91bd9352de334c1ef271 -SHA512 (samba-4.15.0rc6.tar.asc) = 5aa243b3dc68890feef77d44d2beae2401a9827219fe84a53d564e1e6b56175e46282c7e0c6ac932fd535bc1bf4b8a5403da4281a0bb7919543e2a464b9e8c89 +SHA512 (samba-4.15.0rc7.tar.xz) = 0c99c56b0f335f0def3cc7b5fd75509284644c77f4c61b783887251d622c6aa65ed15bf6093a012e5119915f5d85f85bd970562b5f5f124b4d08729a3f80cab2 +SHA512 (samba-4.15.0rc7.tar.asc) = 4847ab608122c71330ee694e66b7ceb54342458f292d0541356c4756705f465d64233408fc6400b04b312c688df352a4ec469e25f1aefac6d19fe284963e978f From bc51ea8a5e6ab645e38f6282dd1a668c3f555567 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 20 Sep 2021 11:30:25 +0200 Subject: [PATCH 149/425] Update to Samba 4.15.0 resolves: #2005817 Guenther --- .gitignore | 2 ++ samba.spec | 8 ++++++-- sources | 4 ++-- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 9c56e55..1738d1e 100644 --- a/.gitignore +++ b/.gitignore @@ -267,3 +267,5 @@ samba-3.6.0pre1.tar.gz /samba-4.15.0rc6.tar.asc /samba-4.15.0rc7.tar.xz /samba-4.15.0rc7.tar.asc +/samba-4.15.0.tar.xz +/samba-4.15.0.tar.asc diff --git a/samba.spec b/samba.spec index 36cfb7a..2077c18 100644 --- a/samba.spec +++ b/samba.spec @@ -129,7 +129,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 12 +%global baserelease 13 %global samba_version 4.15.0 %global talloc_version 2.3.3 @@ -137,7 +137,7 @@ %global tevent_version 0.11.0 %global ldb_version 2.4.0 # This should be rc1 or nil -%global pre_release rc7 +%global pre_release %nil %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4075,6 +4075,10 @@ fi %endif %changelog +* Mon Sep 20 2021 Guenther Deschner - 4.15.0-13 +- Update to Samba 4.15.0 +- resolves: #2005817 + * Mon Sep 13 2021 Guenther Deschner - 4.15.0-0.12.rc7 - Update to Samba 4.15.0rc7 - resolves: #2003740 diff --git a/sources b/sources index ec69424..2e78289 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.15.0rc7.tar.xz) = 0c99c56b0f335f0def3cc7b5fd75509284644c77f4c61b783887251d622c6aa65ed15bf6093a012e5119915f5d85f85bd970562b5f5f124b4d08729a3f80cab2 -SHA512 (samba-4.15.0rc7.tar.asc) = 4847ab608122c71330ee694e66b7ceb54342458f292d0541356c4756705f465d64233408fc6400b04b312c688df352a4ec469e25f1aefac6d19fe284963e978f +SHA512 (samba-4.15.0.tar.xz) = 2fe016ec75a2c788c648466a3bac13a6cdbc158c2f8c18e4fdf09f6ac48b376e6545ab264be92820582ae9fa778010bc639d0b00afacf47a42c002fa291aac5d +SHA512 (samba-4.15.0.tar.asc) = bf1a80c70869ef3c35dde774d5965b8aea4b8be01edc1fd46e1a3bdf972fd3ef17354de726d1d159cb54c92869fbb09b92814c41c3508de67694245aa93d5bc7 From 331ea7c567325a277e6e023e1b88f96c7ac45e27 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 27 Oct 2021 16:10:52 +0200 Subject: [PATCH 150/425] Update to Samba 4.15.1 resolves: #2017847 Guenther --- .gitignore | 2 ++ samba.spec | 14 +++++++++++--- sources | 4 ++-- 3 files changed, 15 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 1738d1e..4140b12 100644 --- a/.gitignore +++ b/.gitignore @@ -269,3 +269,5 @@ samba-3.6.0pre1.tar.gz /samba-4.15.0rc7.tar.asc /samba-4.15.0.tar.xz /samba-4.15.0.tar.asc +/samba-4.15.1.tar.xz +/samba-4.15.1.tar.asc diff --git a/samba.spec b/samba.spec index 2077c18..b04f8d0 100644 --- a/samba.spec +++ b/samba.spec @@ -129,13 +129,13 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 13 +%global baserelease 0 -%global samba_version 4.15.0 +%global samba_version 4.15.1 %global talloc_version 2.3.3 %global tdb_version 1.4.4 %global tevent_version 0.11.0 -%global ldb_version 2.4.0 +%global ldb_version 2.4.1 # This should be rc1 or nil %global pre_release %nil @@ -2912,6 +2912,8 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/raw_testcase.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/rfc4120_constants.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/rfc4120_pyasn1.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/rodc_tests*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/salt_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/simple_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/s4u_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_ccache.*.pyc @@ -2931,6 +2933,8 @@ fi %{python3_sitearch}/samba/tests/krb5/raw_testcase.py %{python3_sitearch}/samba/tests/krb5/rfc4120_constants.py %{python3_sitearch}/samba/tests/krb5/rfc4120_pyasn1.py +%{python3_sitearch}/samba/tests/krb5/rodc_tests.py +%{python3_sitearch}/samba/tests/krb5/salt_tests.py %{python3_sitearch}/samba/tests/krb5/simple_tests.py %{python3_sitearch}/samba/tests/krb5/test_ccache.py %{python3_sitearch}/samba/tests/krb5/test_ldap.py @@ -4075,6 +4079,10 @@ fi %endif %changelog +* Wed Oct 27 2021 Guenther Deschner - 4.15.1-0 +- Update to Samba 4.15.1 +- resolves: #2017847 + * Mon Sep 20 2021 Guenther Deschner - 4.15.0-13 - Update to Samba 4.15.0 - resolves: #2005817 diff --git a/sources b/sources index 2e78289..ac5f2eb 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.15.0.tar.xz) = 2fe016ec75a2c788c648466a3bac13a6cdbc158c2f8c18e4fdf09f6ac48b376e6545ab264be92820582ae9fa778010bc639d0b00afacf47a42c002fa291aac5d -SHA512 (samba-4.15.0.tar.asc) = bf1a80c70869ef3c35dde774d5965b8aea4b8be01edc1fd46e1a3bdf972fd3ef17354de726d1d159cb54c92869fbb09b92814c41c3508de67694245aa93d5bc7 +SHA512 (samba-4.15.1.tar.xz) = 7422c4ed625411f8a4765f8e21f3b8e0c9d68f259cc25ed9f47e6243e849722ad6fa907fad989f19715ca799bc249cda4ef8a8bb930120d61851143072ef7558 +SHA512 (samba-4.15.1.tar.asc) = 0fd0a9761b2dcbd43600490a32d462f50dcd42232a79e40c3a29df5630c9df412bdfac7aeb0eb34b8ce7a9a01ba8e0da612f5771fa9d45f12d77a4ae5c875d82 From 3c2c163325436c4b3b8113e255f133381a6d424f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 5 Nov 2021 15:00:31 +0100 Subject: [PATCH 151/425] Fix winexe core dump resolves: #2020376 Guenther --- samba-4.15.1-winexe.patch | 61 +++++++++++++++++++++++++++++++++++++++ samba.spec | 7 ++++- 2 files changed, 67 insertions(+), 1 deletion(-) create mode 100644 samba-4.15.1-winexe.patch diff --git a/samba-4.15.1-winexe.patch b/samba-4.15.1-winexe.patch new file mode 100644 index 0000000..38460b3 --- /dev/null +++ b/samba-4.15.1-winexe.patch @@ -0,0 +1,61 @@ +From 3d02bf10d7738fe604b524863764de3ca1faa081 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?G=C3=BCnther=20Deschner?= +Date: Thu, 4 Nov 2021 22:22:44 +0100 +Subject: [PATCH] s3-winexe: Fix winexe core dump (use-after-free) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14893 + +Guenther + +Signed-off-by: Guenther Deschner +Reviewed-by: Andreas Schneider + +Autobuild-User(master): Günther Deschner +Autobuild-Date(master): Fri Nov 5 11:43:57 UTC 2021 on sn-devel-184 + +(cherry picked from commit e9495d2ed28a26899dc3dd77bdfe56e284980218) +--- + examples/winexe/winexe.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +diff --git a/examples/winexe/winexe.c b/examples/winexe/winexe.c +index 3e0813a4091..59fb9dbdebb 100644 +--- a/examples/winexe/winexe.c ++++ b/examples/winexe/winexe.c +@@ -220,8 +220,6 @@ static void parse_args(int argc, const char *argv[], + *port_str = '\0'; + } + +- poptFreeContext(pc); +- + if (options->runas == NULL && options->runas_file != NULL) { + struct cli_credentials *runas_cred; + const char *user; +@@ -253,9 +251,19 @@ static void parse_args(int argc, const char *argv[], + + options->credentials = samba_cmdline_get_creds(); + +- options->hostname = argv_new[0] + 2; ++ options->hostname = talloc_strdup(mem_ctx, argv_new[0] + 2); ++ if (options->hostname == NULL) { ++ DBG_ERR("Out of memory\n"); ++ exit(1); ++ } + options->port = port; +- options->cmd = argv_new[1]; ++ options->cmd = talloc_strdup(mem_ctx, argv_new[1]); ++ if (options->cmd == NULL) { ++ DBG_ERR("Out of memory\n"); ++ exit(1); ++ } ++ ++ poptFreeContext(pc); + + options->flags = flag_interactive; + if (flag_reinstall) { +-- +2.33.1 + diff --git a/samba.spec b/samba.spec index b04f8d0..501250c 100644 --- a/samba.spec +++ b/samba.spec @@ -129,7 +129,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 0 +%global baserelease 1 %global samba_version 4.15.1 %global talloc_version 2.3.3 @@ -200,6 +200,7 @@ Source201: README.downgrade Patch0: samba-s4u.patch Patch1: samba-ctdb-etcd-reclock.patch +Patch2: samba-4.15.1-winexe.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -4079,6 +4080,10 @@ fi %endif %changelog +* Fri Nov 05 2021 Guenther Deschner - 4.15.1-1 +- Fix winexe core dump +- resolves: #2020376 + * Wed Oct 27 2021 Guenther Deschner - 4.15.1-0 - Update to Samba 4.15.1 - resolves: #2017847 From 56ca6af06a71b8bbb0939e54290e9ab7307b2cd9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 9 Nov 2021 19:20:55 +0100 Subject: [PATCH 152/425] Update to Samba 4.15.2 resolves: #2019660, #2021711 - Security fixes for CVE-2016-2124 resolves: #2019672, #2021716 - Security fixes for CVE-2020-25717 resolves: #2019726, #2021718 - Security fixes for CVE-2020-25718 resolves: #2019732, #2021719 - Security fixes for CVE-2020-25719 resolves: #2021728, #2021729 - Security fixes for CVE-2020-25721 resolves: #2019764, #2021721 - Security fixes for CVE-2020-25722 resolves: #2021726, #2021727 - Security fixes for CVE-2021-3738 resolves: #2019666, #2021715 - Security fixes for CVE-2021-23192 resolves: #2021625 Guenther --- .gitignore | 2 + samba-s4u.patch | 134 +++++++++++++++++++----------------------------- samba.spec | 28 +++++++++- sources | 4 +- 4 files changed, 83 insertions(+), 85 deletions(-) diff --git a/.gitignore b/.gitignore index 4140b12..b2f1c52 100644 --- a/.gitignore +++ b/.gitignore @@ -271,3 +271,5 @@ samba-3.6.0pre1.tar.gz /samba-4.15.0.tar.asc /samba-4.15.1.tar.xz /samba-4.15.1.tar.asc +/samba-4.15.2.tar.xz +/samba-4.15.2.tar.asc diff --git a/samba-s4u.patch b/samba-s4u.patch index bb323f3..8e84d96 100644 --- a/samba-s4u.patch +++ b/samba-s4u.patch @@ -1,4 +1,4 @@ -From 7c4125deb1e03917f0a2353740f2c0e9e6cf87c5 Mon Sep 17 00:00:00 2001 +From 0b196043f08ea4c025f19c4519175a3a73e1d185 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Fri, 27 Sep 2019 18:25:03 +0300 Subject: [PATCH 1/3] mit-kdc: add basic loacl realm S4U support @@ -6,13 +6,13 @@ Subject: [PATCH 1/3] mit-kdc: add basic loacl realm S4U support Signed-off-by: Isaac Boukris Pair-Programmed-With: Andreas Schneider --- - source4/kdc/mit-kdb/kdb_samba_policies.c | 148 +++++++++++------------ - source4/kdc/mit_samba.c | 47 ++----- + source4/kdc/mit-kdb/kdb_samba_policies.c | 124 +++++++++++------------ + source4/kdc/mit_samba.c | 47 ++------- source4/kdc/mit_samba.h | 6 +- - 3 files changed, 86 insertions(+), 115 deletions(-) + 3 files changed, 71 insertions(+), 106 deletions(-) diff --git a/source4/kdc/mit-kdb/kdb_samba_policies.c b/source4/kdc/mit-kdb/kdb_samba_policies.c -index ac9865aac60..17d4c4028b9 100644 +index f35210669c2..b1c7c5dcc5e 100644 --- a/source4/kdc/mit-kdb/kdb_samba_policies.c +++ b/source4/kdc/mit-kdb/kdb_samba_policies.c @@ -195,13 +195,17 @@ static krb5_error_code ks_verify_pac(krb5_context context, @@ -133,16 +133,15 @@ index ac9865aac60..17d4c4028b9 100644 return code; } -@@ -310,7 +321,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - krb5_authdata ***signed_auth_data) - { +@@ -314,6 +325,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, + krb5_authdata **pac_auth_data = NULL; krb5_authdata **authdata = NULL; -- krb5_boolean is_as_req; + krb5_boolean is_as_req; + krb5_const_principal pac_client; krb5_error_code code; krb5_pac pac = NULL; krb5_data pac_data; -@@ -318,24 +329,21 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, +@@ -325,11 +337,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, krbtgt = krbtgt == NULL ? local_krbtgt : krbtgt; krbtgt_key = krbtgt_key == NULL ? local_krbtgt_key : krbtgt_key; @@ -151,13 +150,13 @@ index ac9865aac60..17d4c4028b9 100644 - return KRB5_KDB_DBTYPE_NOSUP; - } - -- is_as_req = ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) != 0); -- -- if (is_as_req && (flags & KRB5_KDB_FLAG_INCLUDE_PAC)) { -- code = ks_get_pac(context, client, client_key, &pac); -- if (code != 0) { -- goto done; -- } + is_as_req = ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) != 0); + + /* +@@ -390,6 +397,16 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, + ks_client_princ = client->princ; + } + + /* In protocol transition, we are currently not provided with the tgt + * client name to verify the PAC, we could probably skip the name + * verification and just verify the signatures, but since we don't @@ -165,59 +164,31 @@ index ac9865aac60..17d4c4028b9 100644 + if (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION) { + pac_client = server->princ; + } else { -+ pac_client = client_princ; - } - -- if (!is_as_req) { -+ /* TGS request */ -+ if (!(flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY)) { - code = ks_verify_pac(context, - flags, -- client_princ, -+ pac_client, - client, - server, - krbtgt, -@@ -347,14 +355,28 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - if (code != 0) { - goto done; - } -+ -+ /* We require PAC as we don't support LSA_TRUST_TYPE_MIT */ -+ if (pac == NULL) { -+ code = KRB5_KDB_DBTYPE_NOSUP; -+ goto done; -+ } - } - -- if (pac == NULL && client != NULL) { -+ if (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION) { -+ krb5_pac_free(context, pac); -+ pac = NULL; ++ pac_client = ks_client_princ; + } - -+ /* AS request or local realm protocol transition */ -+ if ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) || -+ (client != NULL && (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION))) { - code = ks_get_pac(context, client, client_key, &pac); - if (code != 0) { - goto done; - } -+ /* We require a pac! */ -+ SMB_ASSERT(pac != NULL); ++ + if (client_entry == NULL) { + client_entry = client; } +@@ -454,7 +471,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - if (pac == NULL) { -@@ -363,7 +385,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - } - - code = krb5_pac_sign(context, pac, authtime, client_princ, + code = ks_verify_pac(context, + flags, +- ks_client_princ, ++ pac_client, + client_entry, + server, + krbtgt, +@@ -494,7 +511,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, + is_as_req ? "AS-REQ" : "TGS-REQ", + client_name); + code = krb5_pac_sign(context, pac, authtime, ks_client_princ, - server_key, krbtgt_key, &pac_data); + server_key, krbtgt_key, &pac_data); if (code != 0) { DBG_ERR("krb5_pac_sign failed: %d\n", code); goto done; -@@ -389,11 +411,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, +@@ -520,12 +537,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, KRB5_AUTHDATA_IF_RELEVANT, authdata, signed_auth_data); @@ -226,10 +197,11 @@ index ac9865aac60..17d4c4028b9 100644 - } - - code = 0; - +- done: - krb5_pac_free(context, pac); -@@ -416,32 +433,13 @@ krb5_error_code kdb_samba_db_check_allowed_to_delegate(krb5_context context, + if (client_entry != NULL && client_entry != client) { + ks_free_principal(context, client_entry); +@@ -551,32 +562,13 @@ krb5_error_code kdb_samba_db_check_allowed_to_delegate(krb5_context context, * server; -> delegating service * proxy; -> target principal */ @@ -264,10 +236,10 @@ index ac9865aac60..17d4c4028b9 100644 diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c -index 0a0d3a98315..5f35c6025bf 100644 +index 4239332f0d9..acc3cba6254 100644 --- a/source4/kdc/mit_samba.c +++ b/source4/kdc/mit_samba.c -@@ -493,7 +493,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx, +@@ -501,7 +501,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx, krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, krb5_context context, int flags, @@ -275,7 +247,7 @@ index 0a0d3a98315..5f35c6025bf 100644 krb5_db_entry *client, krb5_db_entry *server, krb5_db_entry *krbtgt, -@@ -641,7 +640,7 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, +@@ -665,7 +664,7 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, context, *pac, server->princ, @@ -284,7 +256,7 @@ index 0a0d3a98315..5f35c6025bf 100644 deleg_blob); if (!NT_STATUS_IS_OK(nt_status)) { DEBUG(0, ("Update delegation info failed: %s\n", -@@ -963,41 +962,17 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx, +@@ -987,41 +986,17 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx, } int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx, @@ -337,7 +309,7 @@ index 0a0d3a98315..5f35c6025bf 100644 static krb5_error_code mit_samba_change_pwd_error(krb5_context context, diff --git a/source4/kdc/mit_samba.h b/source4/kdc/mit_samba.h -index ba824557bd5..5aadf206443 100644 +index 636c77ec97c..9cb00c9610e 100644 --- a/source4/kdc/mit_samba.h +++ b/source4/kdc/mit_samba.h @@ -56,7 +56,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx, @@ -361,10 +333,10 @@ index ba824557bd5..5aadf206443 100644 int mit_samba_kpasswd_change_password(struct mit_samba_context *ctx, char *pwd, -- -2.31.1 +2.33.1 -From b2ada81ed9f89f6b38fb0a9e54811408676671d0 Mon Sep 17 00:00:00 2001 +From 992d38fa35c01f2f0bdb39d387fa29e8eb8d3d37 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Fri, 27 Sep 2019 18:35:30 +0300 Subject: [PATCH 2/3] krb5-mit: enable S4U client support for MIT build @@ -378,10 +350,10 @@ Pair-Programmed-With: Andreas Schneider 3 files changed, 185 insertions(+), 13 deletions(-) diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c -index 20ce86c708d..e72ab3c30f7 100644 +index fff5b4e2a22..791b417d5ba 100644 --- a/lib/krb5_wrap/krb5_samba.c +++ b/lib/krb5_wrap/krb5_samba.c -@@ -2568,6 +2568,191 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx, +@@ -2694,6 +2694,191 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx, return 0; } @@ -574,7 +546,7 @@ index 20ce86c708d..e72ab3c30f7 100644 #if !defined(HAVE_KRB5_MAKE_PRINCIPAL) && defined(HAVE_KRB5_BUILD_PRINCIPAL_ALLOC_VA) diff --git a/lib/krb5_wrap/krb5_samba.h b/lib/krb5_wrap/krb5_samba.h -index 9550447b2c5..ee3931c7544 100644 +index eab67f6d969..b5385c69a33 100644 --- a/lib/krb5_wrap/krb5_samba.h +++ b/lib/krb5_wrap/krb5_samba.h @@ -252,7 +252,6 @@ krb5_error_code smb_krb5_kinit_password_ccache(krb5_context ctx, @@ -639,10 +611,10 @@ index 544d9d853cc..c14d8c72d8c 100644 ret = smb_krb5_kinit_password_ccache(smb_krb5_context->krb5_context, ccache, -- -2.31.1 +2.33.1 -From bc5e97074739d29320a3e890575353fbfd452047 Mon Sep 17 00:00:00 2001 +From f1951b501ca0fb3e613f04437c99dc1bbf204609 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Sat, 19 Sep 2020 14:16:20 +0200 Subject: [PATCH 3/3] wip: for canonicalization with new MIT kdc code @@ -655,7 +627,7 @@ Subject: [PATCH 3/3] wip: for canonicalization with new MIT kdc code 4 files changed, 11 insertions(+), 2 deletions(-) diff --git a/source4/heimdal/lib/hdb/hdb.h b/source4/heimdal/lib/hdb/hdb.h -index 6a09ecb6fe1..bc5211fef35 100644 +index 5ef9d9565f3..dafaffc6c2d 100644 --- a/source4/heimdal/lib/hdb/hdb.h +++ b/source4/heimdal/lib/hdb/hdb.h @@ -63,6 +63,7 @@ enum hdb_lockop{ HDB_RLOCK, HDB_WLOCK }; @@ -667,7 +639,7 @@ index 6a09ecb6fe1..bc5211fef35 100644 /* hdb_capability_flags */ #define HDB_CAP_F_HANDLE_ENTERPRISE_PRINCIPAL 1 diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c -index a560a1cd84b..c27b6a8ef4c 100644 +index aff74f2ee71..d16b4c3329a 100644 --- a/source4/kdc/db-glue.c +++ b/source4/kdc/db-glue.c @@ -916,17 +916,21 @@ static krb5_error_code samba_kdc_message2entry(krb5_context context, @@ -695,7 +667,7 @@ index a560a1cd84b..c27b6a8ef4c 100644 ret = smb_krb5_make_principal(context, &entry_ex->entry.principal, lpcfg_realm(lp_ctx), samAccountName, NULL); if (ret) { diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c -index 5f35c6025bf..20ee2c2b89e 100644 +index acc3cba6254..f0b9df8b613 100644 --- a/source4/kdc/mit_samba.c +++ b/source4/kdc/mit_samba.c @@ -224,6 +224,9 @@ int mit_samba_get_principal(struct mit_samba_context *ctx, @@ -721,5 +693,5 @@ index c929acccce6..a9115ec23d7 100644 void sdb_free_entry(struct sdb_entry_ex *e); void free_sdb_entry(struct sdb_entry *s); -- -2.31.1 +2.33.1 diff --git a/samba.spec b/samba.spec index 501250c..4817ea7 100644 --- a/samba.spec +++ b/samba.spec @@ -129,9 +129,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 1 +%global baserelease 0 -%global samba_version 4.15.1 +%global samba_version 4.15.2 %global talloc_version 2.3.3 %global tdb_version 1.4.4 %global tevent_version 0.11.0 @@ -2669,6 +2669,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/dns_tkey.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dns_wildcard.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dsdb.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/dsdb_api.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dsdb_dns.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dsdb_lock.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dsdb_schema_attributes.*.pyc @@ -2690,6 +2691,8 @@ fi %{python3_sitearch}/samba/tests/__pycache__/krb5_credentials.*.pyc %{python3_sitearch}/samba/tests/__pycache__/ldap_raw.*.pyc %{python3_sitearch}/samba/tests/__pycache__/ldap_referrals.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/ldap_spn.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/ldap_upn_sam_account.*.pyc %{python3_sitearch}/samba/tests/__pycache__/loadparm.*.pyc %{python3_sitearch}/samba/tests/__pycache__/libsmb.*.pyc %{python3_sitearch}/samba/tests/__pycache__/lsa_string.*.pyc @@ -2861,6 +2864,7 @@ fi %{python3_sitearch}/samba/tests/dns_tkey.py %{python3_sitearch}/samba/tests/dns_wildcard.py %{python3_sitearch}/samba/tests/dsdb.py +%{python3_sitearch}/samba/tests/dsdb_api.py %{python3_sitearch}/samba/tests/dsdb_dns.py %{python3_sitearch}/samba/tests/dsdb_lock.py %{python3_sitearch}/samba/tests/dsdb_schema_attributes.py @@ -2901,6 +2905,7 @@ fi %{python3_sitearch}/samba/tests/kcc/ldif_import_export.py %dir %{python3_sitearch}/samba/tests/krb5 %dir %{python3_sitearch}/samba/tests/krb5/__pycache__ +%{python3_sitearch}/samba/tests/krb5/__pycache__/alias_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/as_canonicalization_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/as_req_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/compatability_tests.*.pyc @@ -2916,12 +2921,15 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/rodc_tests*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/salt_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/simple_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/spn_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/s4u_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_ccache.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_ldap.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/test_min_domain_uid.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_rpc.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_smb.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/xrealm_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/alias_tests.py %{python3_sitearch}/samba/tests/krb5/as_canonicalization_tests.py %{python3_sitearch}/samba/tests/krb5/as_req_tests.py %{python3_sitearch}/samba/tests/krb5/compatability_tests.py @@ -2937,8 +2945,10 @@ fi %{python3_sitearch}/samba/tests/krb5/rodc_tests.py %{python3_sitearch}/samba/tests/krb5/salt_tests.py %{python3_sitearch}/samba/tests/krb5/simple_tests.py +%{python3_sitearch}/samba/tests/krb5/spn_tests.py %{python3_sitearch}/samba/tests/krb5/test_ccache.py %{python3_sitearch}/samba/tests/krb5/test_ldap.py +%{python3_sitearch}/samba/tests/krb5/test_min_domain_uid.py %{python3_sitearch}/samba/tests/krb5/test_rpc.py %{python3_sitearch}/samba/tests/krb5/test_smb.py %{python3_sitearch}/samba/tests/krb5/s4u_tests.py @@ -2946,6 +2956,8 @@ fi %{python3_sitearch}/samba/tests/krb5_credentials.py %{python3_sitearch}/samba/tests/ldap_raw.py %{python3_sitearch}/samba/tests/ldap_referrals.py +%{python3_sitearch}/samba/tests/ldap_spn.py +%{python3_sitearch}/samba/tests/ldap_upn_sam_account.py %{python3_sitearch}/samba/tests/libsmb.py %{python3_sitearch}/samba/tests/loadparm.py %{python3_sitearch}/samba/tests/lsa_string.py @@ -4080,6 +4092,18 @@ fi %endif %changelog +* Tue Nov 09 2021 Guenther Deschner - 4.15.2-0 +- Update to Samba 4.15.2 +- resolves: #2019660, #2021711 - Security fixes for CVE-2016-2124 +- resolves: #2019672, #2021716 - Security fixes for CVE-2020-25717 +- resolves: #2019726, #2021718 - Security fixes for CVE-2020-25718 +- resolves: #2019732, #2021719 - Security fixes for CVE-2020-25719 +- resolves: #2021728, #2021729 - Security fixes for CVE-2020-25721 +- resolves: #2019764, #2021721 - Security fixes for CVE-2020-25722 +- resolves: #2021726, #2021727 - Security fixes for CVE-2021-3738 +- resolves: #2019666, #2021715 - Security fixes for CVE-2021-23192 +- resolves: #2021625 + * Fri Nov 05 2021 Guenther Deschner - 4.15.1-1 - Fix winexe core dump - resolves: #2020376 diff --git a/sources b/sources index ac5f2eb..0516493 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.15.1.tar.xz) = 7422c4ed625411f8a4765f8e21f3b8e0c9d68f259cc25ed9f47e6243e849722ad6fa907fad989f19715ca799bc249cda4ef8a8bb930120d61851143072ef7558 -SHA512 (samba-4.15.1.tar.asc) = 0fd0a9761b2dcbd43600490a32d462f50dcd42232a79e40c3a29df5630c9df412bdfac7aeb0eb34b8ce7a9a01ba8e0da612f5771fa9d45f12d77a4ae5c875d82 +SHA512 (samba-4.15.2.tar.xz) = d9aaabbf45ba0293dbda137a21f04d5fa533be07c3826de816513d8e2ae0ef6e6109ce4045dd74bcd5375364f6de5fa8ace6ae4b3c419bfffe55fa2bfeeb0d5d +SHA512 (samba-4.15.2.tar.asc) = 732cc215c047988d4bce3d2ea981474f0cca44dd5a22030f49343aa3a37f6003bb84b116f7cdb0c8c4fd492354c107350f78101d7186fcb6027906ab1c92cf31 From f0333fc6d6d35e2d240714bd05afc916e133e143 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 11 Nov 2021 14:45:45 +0100 Subject: [PATCH 153/425] Fix winbind trusted domain regression related: #2021716 Guenther --- ...a-4.15-fix-winbind-no-trusted-domain.patch | 41 +++++++++++++++++++ samba.spec | 7 +++- 2 files changed, 47 insertions(+), 1 deletion(-) create mode 100644 samba-4.15-fix-winbind-no-trusted-domain.patch diff --git a/samba-4.15-fix-winbind-no-trusted-domain.patch b/samba-4.15-fix-winbind-no-trusted-domain.patch new file mode 100644 index 0000000..4924872 --- /dev/null +++ b/samba-4.15-fix-winbind-no-trusted-domain.patch @@ -0,0 +1,41 @@ +From 2edaf32b4204b9fe363c441c25b6989fe76911a4 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Tue, 9 Nov 2021 20:50:20 +0100 +Subject: [PATCH] s3:winbindd: fix "allow trusted domains = no" regression + +add_trusted_domain() should only reject domains +based on is_allowed_domain(), which now also +checks "allow trusted domains = no", if we don't +have an explicit trust to the domain (SEC_CHAN_NULL). + +We use at least SEC_CHAN_LOCAL for local domains like +BUILTIN. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14899 + +Signed-off-by: Stefan Metzmacher + +Autobuild-User(master): Stefan Metzmacher +Autobuild-Date(master): Wed Nov 10 11:21:31 UTC 2021 on sn-devel-184 + +(cherry picked from commit a7f6c60cb037b4bc9eee276236539b8282213935) +--- + source3/winbindd/winbindd_util.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/source3/winbindd/winbindd_util.c b/source3/winbindd/winbindd_util.c +index 42ddbfd2f44..9d54e462c42 100644 +--- a/source3/winbindd/winbindd_util.c ++++ b/source3/winbindd/winbindd_util.c +@@ -134,7 +134,7 @@ static NTSTATUS add_trusted_domain(const char *domain_name, + return NT_STATUS_INVALID_PARAMETER; + } + +- if (!is_allowed_domain(domain_name)) { ++ if (secure_channel_type == SEC_CHAN_NULL && !is_allowed_domain(domain_name)) { + return NT_STATUS_NO_SUCH_DOMAIN; + } + +-- +2.33.1 + diff --git a/samba.spec b/samba.spec index 4817ea7..dd53d8c 100644 --- a/samba.spec +++ b/samba.spec @@ -129,7 +129,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 0 +%global baserelease 1 %global samba_version 4.15.2 %global talloc_version 2.3.3 @@ -201,6 +201,7 @@ Source201: README.downgrade Patch0: samba-s4u.patch Patch1: samba-ctdb-etcd-reclock.patch Patch2: samba-4.15.1-winexe.patch +Patch3: samba-4.15-fix-winbind-no-trusted-domain.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -4092,6 +4093,10 @@ fi %endif %changelog +* Thu Nov 11 2021 Guenther Deschner - 4.15.2-1 +- Fix winbind trusted domain regression +- related: #2021716 + * Tue Nov 09 2021 Guenther Deschner - 4.15.2-0 - Update to Samba 4.15.2 - resolves: #2019660, #2021711 - Security fixes for CVE-2016-2124 From af2d47413b17c4354ed476811001ae8e6de7d8c4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 11 Nov 2021 16:01:38 +0100 Subject: [PATCH 154/425] Fix logfile handling Guenther --- samba-4.15-logfile.patch | 981 +++++++++++++++++++++++++++++++++++++++ samba.spec | 2 + 2 files changed, 983 insertions(+) create mode 100644 samba-4.15-logfile.patch diff --git a/samba-4.15-logfile.patch b/samba-4.15-logfile.patch new file mode 100644 index 0000000..6300639 --- /dev/null +++ b/samba-4.15-logfile.patch @@ -0,0 +1,981 @@ +From 96d6bd4feb27b9b003aac44ef2ab7ef0a288272d Mon Sep 17 00:00:00 2001 +From: Ralph Boehme +Date: Wed, 10 Nov 2021 20:18:07 +0100 +Subject: [PATCH 1/8] source3: move lib/substitute.c functions out of proto.h + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897 + +Signed-off-by: Ralph Boehme +--- + source3/auth/auth_generic.c | 1 + + source3/auth/auth_ntlmssp.c | 1 + + source3/auth/auth_util.c | 1 + + source3/include/proto.h | 33 ----------- + source3/lib/substitute.c | 1 + + source3/lib/substitute.h | 63 +++++++++++++++++++++ + source3/modules/vfs_expand_msdfs.c | 1 + + source3/modules/vfs_full_audit.c | 1 + + source3/modules/vfs_recycle.c | 1 + + source3/modules/vfs_unityed_media.c | 1 + + source3/modules/vfs_virusfilter_utils.c | 1 + + source3/nmbd/nmbd.c | 1 + + source3/nmbd/nmbd_synclists.c | 1 + + source3/param/loadparm.c | 1 + + source3/passdb/passdb.c | 1 + + source3/passdb/pdb_ldap.c | 1 + + source3/printing/print_generic.c | 1 + + source3/printing/printing.c | 1 + + source3/rpc_server/lsa/srv_lsa_nt.c | 1 + + source3/rpc_server/netlogon/srv_netlog_nt.c | 1 + + source3/rpc_server/srvsvc/srv_srvsvc_nt.c | 1 + + source3/smbd/ipc.c | 1 + + source3/smbd/lanman.c | 1 + + source3/smbd/message.c | 1 + + source3/smbd/msdfs.c | 1 + + source3/smbd/process.c | 1 + + source3/smbd/reply.c | 1 + + source3/smbd/server.c | 1 + + source3/smbd/service.c | 1 + + source3/smbd/sesssetup.c | 1 + + source3/smbd/share_access.c | 1 + + source3/smbd/smb2_server.c | 1 + + source3/smbd/smb2_sesssetup.c | 1 + + source3/smbd/trans2.c | 1 + + source3/smbd/uid.c | 1 + + source3/torture/torture.c | 1 + + source3/utils/net_sam.c | 1 + + source3/winbindd/wb_getpwsid.c | 1 + + source3/winbindd/winbindd.c | 1 + + 39 files changed, 100 insertions(+), 33 deletions(-) + create mode 100644 source3/lib/substitute.h + +diff --git a/source3/auth/auth_generic.c b/source3/auth/auth_generic.c +index fc7a7549e8e..ff51307e43a 100644 +--- a/source3/auth/auth_generic.c ++++ b/source3/auth/auth_generic.c +@@ -36,6 +36,7 @@ + #include "auth/credentials/credentials.h" + #include "lib/param/loadparm.h" + #include "librpc/gen_ndr/dcerpc.h" ++#include "source3/lib/substitute.h" + + static NTSTATUS auth3_generate_session_info_pac(struct auth4_context *auth_ctx, + TALLOC_CTX *mem_ctx, +diff --git a/source3/auth/auth_ntlmssp.c b/source3/auth/auth_ntlmssp.c +index 676aa9d892c..f2deca09aa6 100644 +--- a/source3/auth/auth_ntlmssp.c ++++ b/source3/auth/auth_ntlmssp.c +@@ -25,6 +25,7 @@ + #include "auth.h" + #include "libcli/security/security.h" + #include "lib/util/tevent_ntstatus.h" ++#include "source3/lib/substitute.h" + + NTSTATUS auth3_generate_session_info(struct auth4_context *auth_context, + TALLOC_CTX *mem_ctx, +diff --git a/source3/auth/auth_util.c b/source3/auth/auth_util.c +index dec854d85c3..4527dedc49d 100644 +--- a/source3/auth/auth_util.c ++++ b/source3/auth/auth_util.c +@@ -38,6 +38,7 @@ + #include "rpc_client/util_netlogon.h" + #include "source4/auth/auth.h" + #include "auth/auth_util.h" ++#include "source3/lib/substitute.h" + + #undef DBGC_CLASS + #define DBGC_CLASS DBGC_AUTH +diff --git a/source3/include/proto.h b/source3/include/proto.h +index eb45179aebb..a96c2c8d110 100644 +--- a/source3/include/proto.h ++++ b/source3/include/proto.h +@@ -139,39 +139,6 @@ int smbrun_no_sanitize(const char *cmd, int *outfd, char * const *env); + int smbrun(const char *cmd, int *outfd, char * const *env); + int smbrunsecret(const char *cmd, const char *secret); + +-/* The following definitions come from lib/substitute.c */ +- +-bool set_local_machine_name(const char *local_name, bool perm); +-const char *get_local_machine_name(void); +-bool set_remote_machine_name(const char *remote_name, bool perm); +-const char *get_remote_machine_name(void); +-void sub_set_smb_name(const char *name); +-void set_current_user_info(const char *smb_name, const char *unix_name, +- const char *domain); +-void sub_set_socket_ids(const char *peeraddr, const char *peername, +- const char *sockaddr); +-const char *get_current_username(void); +-void standard_sub_basic(const char *smb_name, const char *domain_name, +- char *str, size_t len); +-char *talloc_sub_basic(TALLOC_CTX *mem_ctx, const char *smb_name, +- const char *domain_name, const char *str); +-char *talloc_sub_specified(TALLOC_CTX *mem_ctx, +- const char *input_string, +- const char *username, +- const char *grpname, +- const char *domain, +- uid_t uid, +- gid_t gid); +-char *talloc_sub_advanced(TALLOC_CTX *mem_ctx, +- const char *servicename, const char *user, +- const char *connectpath, gid_t gid, +- const char *str); +-char *talloc_sub_full(TALLOC_CTX *mem_ctx, +- const char *servicename, const char *user, +- const char *connectpath, gid_t gid, +- const char *smb_name, const char *domain_name, +- const char *str); +- + /* The following definitions come from lib/sysquotas.c */ + + int sys_get_quota(const char *path, enum SMB_QUOTA_TYPE qtype, unid_t id, SMB_DISK_QUOTA *dp); +diff --git a/source3/lib/substitute.c b/source3/lib/substitute.c +index b98a0acf1cb..a941b89f82a 100644 +--- a/source3/lib/substitute.c ++++ b/source3/lib/substitute.c +@@ -20,6 +20,7 @@ + + + #include "includes.h" ++#include "substitute.h" + #include "system/passwd.h" + #include "secrets.h" + #include "auth.h" +diff --git a/source3/lib/substitute.h b/source3/lib/substitute.h +new file mode 100644 +index 00000000000..2056d163dd7 +--- /dev/null ++++ b/source3/lib/substitute.h +@@ -0,0 +1,63 @@ ++/* ++ Unix SMB/CIFS implementation. ++ string substitution functions ++ Copyright (C) Andrew Tridgell 1992-2000 ++ Copyright (C) Gerald Carter 2006 ++ ++ This program is free software; you can redistribute it and/or modify ++ it under the terms of the GNU General Public License as published by ++ the Free Software Foundation; either version 3 of the License, or ++ (at your option) any later version. ++ ++ This program is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++ GNU General Public License for more details. ++ ++ You should have received a copy of the GNU General Public License ++ along with this program. If not, see . ++*/ ++ ++#ifndef SUBSTITUTE_H ++#define SUBSTITUTE_H ++ ++bool set_local_machine_name(const char *local_name, bool perm); ++const char *get_local_machine_name(void); ++bool set_remote_machine_name(const char *remote_name, bool perm); ++const char *get_remote_machine_name(void); ++void sub_set_socket_ids(const char *peeraddr, const char *peername, ++ const char *sockaddr); ++void set_current_user_info(const char *smb_name, ++ const char *unix_name, ++ const char *domain); ++const char *get_current_username(void); ++void standard_sub_basic(const char *smb_name, ++ const char *domain_name, ++ char *str, ++ size_t len); ++char *talloc_sub_basic(TALLOC_CTX *mem_ctx, ++ const char *smb_name, ++ const char *domain_name, ++ const char *str); ++char *talloc_sub_specified(TALLOC_CTX *mem_ctx, ++ const char *input_string, ++ const char *username, ++ const char *grpname, ++ const char *domain, ++ uid_t uid, ++ gid_t gid); ++char *talloc_sub_advanced(TALLOC_CTX *ctx, ++ const char *servicename, ++ const char *user, ++ const char *connectpath, ++ gid_t gid, ++ const char *str); ++char *talloc_sub_full(TALLOC_CTX *ctx, ++ const char *servicename, ++ const char *user, ++ const char *connectpath, ++ gid_t gid, ++ const char *smb_name, ++ const char *domain_name, ++ const char *str); ++#endif +diff --git a/source3/modules/vfs_expand_msdfs.c b/source3/modules/vfs_expand_msdfs.c +index 34e7051dca5..fe3c6f47462 100644 +--- a/source3/modules/vfs_expand_msdfs.c ++++ b/source3/modules/vfs_expand_msdfs.c +@@ -25,6 +25,7 @@ + #include "auth.h" + #include "../lib/tsocket/tsocket.h" + #include "msdfs.h" ++#include "source3/lib/substitute.h" + + #undef DBGC_CLASS + #define DBGC_CLASS DBGC_VFS +diff --git a/source3/modules/vfs_full_audit.c b/source3/modules/vfs_full_audit.c +index ceda99d4568..c8dbc8c07bb 100644 +--- a/source3/modules/vfs_full_audit.c ++++ b/source3/modules/vfs_full_audit.c +@@ -73,6 +73,7 @@ + #include "passdb/machine_sid.h" + #include "lib/util/tevent_ntstatus.h" + #include "lib/util/string_wrappers.h" ++#include "source3/lib/substitute.h" + + static int vfs_full_audit_debug_level = DBGC_VFS; + +diff --git a/source3/modules/vfs_recycle.c b/source3/modules/vfs_recycle.c +index 1c18f232c32..7cbc938a57c 100644 +--- a/source3/modules/vfs_recycle.c ++++ b/source3/modules/vfs_recycle.c +@@ -27,6 +27,7 @@ + #include "system/filesys.h" + #include "../librpc/gen_ndr/ndr_netlogon.h" + #include "auth.h" ++#include "source3/lib/substitute.h" + + #define ALLOC_CHECK(ptr, label) do { if ((ptr) == NULL) { DEBUG(0, ("recycle.bin: out of memory!\n")); errno = ENOMEM; goto label; } } while(0) + +diff --git a/source3/modules/vfs_unityed_media.c b/source3/modules/vfs_unityed_media.c +index 62a1456b996..fbd4d968172 100644 +--- a/source3/modules/vfs_unityed_media.c ++++ b/source3/modules/vfs_unityed_media.c +@@ -62,6 +62,7 @@ + #include "../lib/tsocket/tsocket.h" + #include "lib/util/smb_strtox.h" + #include ++#include "source3/lib/substitute.h" + + #define UM_PARAM_TYPE_NAME "unityed_media" + +diff --git a/source3/modules/vfs_virusfilter_utils.c b/source3/modules/vfs_virusfilter_utils.c +index c7f8089ffc7..b8b44eb203b 100644 +--- a/source3/modules/vfs_virusfilter_utils.c ++++ b/source3/modules/vfs_virusfilter_utils.c +@@ -25,6 +25,7 @@ struct iovec; + #include "lib/util/iov_buf.h" + #include + #include "lib/tsocket/tsocket.h" ++#include "source3/lib/substitute.h" + + int virusfilter_debug_class = DBGC_VFS; + +diff --git a/source3/nmbd/nmbd.c b/source3/nmbd/nmbd.c +index 44121e9915c..7470897587e 100644 +--- a/source3/nmbd/nmbd.c ++++ b/source3/nmbd/nmbd.c +@@ -29,6 +29,7 @@ + #include "util_cluster.h" + #include "lib/gencache.h" + #include "lib/global_contexts.h" ++#include "source3/lib/substitute.h" + + int ClientNMB = -1; + int ClientDGRAM = -1; +diff --git a/source3/nmbd/nmbd_synclists.c b/source3/nmbd/nmbd_synclists.c +index a65cbb87e0e..d291927fbc8 100644 +--- a/source3/nmbd/nmbd_synclists.c ++++ b/source3/nmbd/nmbd_synclists.c +@@ -33,6 +33,7 @@ + #include "libsmb/clirap.h" + #include "../libcli/smb/smbXcli_base.h" + #include "lib/util/string_wrappers.h" ++#include "source3/lib/substitute.h" + + struct sync_record { + struct sync_record *next, *prev; +diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c +index f54c08cc4a5..b56fd20e410 100644 +--- a/source3/param/loadparm.c ++++ b/source3/param/loadparm.c +@@ -76,6 +76,7 @@ + #include "lib/crypto/gnutls_helpers.h" + #include "lib/util/string_wrappers.h" + #include "auth/credentials/credentials.h" ++#include "source3/lib/substitute.h" + + #ifdef HAVE_SYS_SYSCTL_H + #include +diff --git a/source3/passdb/passdb.c b/source3/passdb/passdb.c +index 068c5a5ea70..863f260ea90 100644 +--- a/source3/passdb/passdb.c ++++ b/source3/passdb/passdb.c +@@ -33,6 +33,7 @@ + #include "auth/credentials/credentials.h" + #include "lib/param/param.h" + #include "lib/util/string_wrappers.h" ++#include "source3/lib/substitute.h" + + #undef DBGC_CLASS + #define DBGC_CLASS DBGC_PASSDB +diff --git a/source3/passdb/pdb_ldap.c b/source3/passdb/pdb_ldap.c +index e6d8a84c60f..93da28b1941 100644 +--- a/source3/passdb/pdb_ldap.c ++++ b/source3/passdb/pdb_ldap.c +@@ -56,6 +56,7 @@ + #include "lib/util_sid_passdb.h" + #include "lib/util/smb_strtox.h" + #include "lib/util/string_wrappers.h" ++#include "source3/lib/substitute.h" + + #undef DBGC_CLASS + #define DBGC_CLASS DBGC_PASSDB +diff --git a/source3/printing/print_generic.c b/source3/printing/print_generic.c +index 743c311bbd5..8798a4cf34a 100644 +--- a/source3/printing/print_generic.c ++++ b/source3/printing/print_generic.c +@@ -20,6 +20,7 @@ + #include "includes.h" + #include "printing.h" + #include "smbd/proto.h" ++#include "source3/lib/substitute.h" + + extern userdom_struct current_user_info; + +diff --git a/source3/printing/printing.c b/source3/printing/printing.c +index 499334df03f..67d798fbb21 100644 +--- a/source3/printing/printing.c ++++ b/source3/printing/printing.c +@@ -40,6 +40,7 @@ + #include "lib/util/string_wrappers.h" + #include "lib/global_contexts.h" + #include "source3/printing/rap_jobid.h" ++#include "source3/lib/substitute.h" + + extern userdom_struct current_user_info; + +diff --git a/source3/rpc_server/lsa/srv_lsa_nt.c b/source3/rpc_server/lsa/srv_lsa_nt.c +index d6d606ddeca..57f981cb358 100644 +--- a/source3/rpc_server/lsa/srv_lsa_nt.c ++++ b/source3/rpc_server/lsa/srv_lsa_nt.c +@@ -53,6 +53,7 @@ + #include "librpc/rpc/dcesrv_core.h" + #include "librpc/rpc/dcerpc_helper.h" + #include "lib/param/loadparm.h" ++#include "source3/lib/substitute.h" + + #include "lib/crypto/gnutls_helpers.h" + #include +diff --git a/source3/rpc_server/netlogon/srv_netlog_nt.c b/source3/rpc_server/netlogon/srv_netlog_nt.c +index eaacd8dbc6a..2906fa3f30f 100644 +--- a/source3/rpc_server/netlogon/srv_netlog_nt.c ++++ b/source3/rpc_server/netlogon/srv_netlog_nt.c +@@ -49,6 +49,7 @@ + #include "lib/param/param.h" + #include "libsmb/dsgetdcname.h" + #include "lib/util/util_str_escape.h" ++#include "source3/lib/substitute.h" + + extern userdom_struct current_user_info; + +diff --git a/source3/rpc_server/srvsvc/srv_srvsvc_nt.c b/source3/rpc_server/srvsvc/srv_srvsvc_nt.c +index 8576e9d2ce2..fc27a459634 100644 +--- a/source3/rpc_server/srvsvc/srv_srvsvc_nt.c ++++ b/source3/rpc_server/srvsvc/srv_srvsvc_nt.c +@@ -42,6 +42,7 @@ + #include "messages.h" + #include "serverid.h" + #include "lib/global_contexts.h" ++#include "source3/lib/substitute.h" + + extern const struct generic_mapping file_generic_mapping; + +diff --git a/source3/smbd/ipc.c b/source3/smbd/ipc.c +index f1c8ea0c2ed..cf3b7c91c22 100644 +--- a/source3/smbd/ipc.c ++++ b/source3/smbd/ipc.c +@@ -29,6 +29,7 @@ + #include "smbd/globals.h" + #include "smbprofile.h" + #include "rpc_server/srv_pipe_hnd.h" ++#include "source3/lib/substitute.h" + + #define NERR_notsupported 50 + +diff --git a/source3/smbd/lanman.c b/source3/smbd/lanman.c +index 9194113e768..eb8148753b9 100644 +--- a/source3/smbd/lanman.c ++++ b/source3/smbd/lanman.c +@@ -45,6 +45,7 @@ + #include "rpc_server/rpc_ncacn_np.h" + #include "lib/util/string_wrappers.h" + #include "source3/printing/rap_jobid.h" ++#include "source3/lib/substitute.h" + + #ifdef CHECK_TYPES + #undef CHECK_TYPES +diff --git a/source3/smbd/message.c b/source3/smbd/message.c +index b9728946889..7185bec1289 100644 +--- a/source3/smbd/message.c ++++ b/source3/smbd/message.c +@@ -27,6 +27,7 @@ + #include "smbd/smbd.h" + #include "smbd/globals.h" + #include "smbprofile.h" ++#include "source3/lib/substitute.h" + + extern userdom_struct current_user_info; + +diff --git a/source3/smbd/msdfs.c b/source3/smbd/msdfs.c +index 995ed815d90..fd002e98071 100644 +--- a/source3/smbd/msdfs.c ++++ b/source3/smbd/msdfs.c +@@ -34,6 +34,7 @@ + #include "librpc/gen_ndr/ndr_dfsblobs.h" + #include "lib/tsocket/tsocket.h" + #include "lib/global_contexts.h" ++#include "source3/lib/substitute.h" + + /********************************************************************** + Parse a DFS pathname of the form \hostname\service\reqpath +diff --git a/source3/smbd/process.c b/source3/smbd/process.c +index 03409742752..5015c143a04 100644 +--- a/source3/smbd/process.c ++++ b/source3/smbd/process.c +@@ -46,6 +46,7 @@ + #include "libcli/smb/smbXcli_base.h" + #include "lib/util/time_basic.h" + #include "smb1_utils.h" ++#include "source3/lib/substitute.h" + + /* Internal message queue for deferred opens. */ + struct pending_message_list { +diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c +index 042e7f2329e..f85d1122a07 100644 +--- a/source3/smbd/reply.c ++++ b/source3/smbd/reply.c +@@ -50,6 +50,7 @@ + #include "libcli/smb/smb2_posix.h" + #include "lib/util/string_wrappers.h" + #include "source3/printing/rap_jobid.h" ++#include "source3/lib/substitute.h" + + /**************************************************************************** + Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext +diff --git a/source3/smbd/server.c b/source3/smbd/server.c +index d7f5b4b73c0..d02ff1bd883 100644 +--- a/source3/smbd/server.c ++++ b/source3/smbd/server.c +@@ -60,6 +60,7 @@ + #include "rpc_server/fssd.h" + #include "rpc_server/mdssd.h" + #include "lib/global_contexts.h" ++#include "source3/lib/substitute.h" + + #ifdef CLUSTER_SUPPORT + #include "ctdb_protocol.h" +diff --git a/source3/smbd/service.c b/source3/smbd/service.c +index afdea38b016..ef7c14d92d0 100644 +--- a/source3/smbd/service.c ++++ b/source3/smbd/service.c +@@ -34,6 +34,7 @@ + #include "lib/afs/afs_funcs.h" + #include "lib/util_path.h" + #include "lib/util/string_wrappers.h" ++#include "source3/lib/substitute.h" + + bool canonicalize_connect_path(connection_struct *conn) + { +diff --git a/source3/smbd/sesssetup.c b/source3/smbd/sesssetup.c +index 2bd527ce80e..1705b8920b6 100644 +--- a/source3/smbd/sesssetup.c ++++ b/source3/smbd/sesssetup.c +@@ -34,6 +34,7 @@ + #include "auth/gensec/gensec.h" + #include "../libcli/smb/smb_signing.h" + #include "lib/util/string_wrappers.h" ++#include "source3/lib/substitute.h" + + /**************************************************************************** + Add the standard 'Samba' signature to the end of the session setup. +diff --git a/source3/smbd/share_access.c b/source3/smbd/share_access.c +index debe4fc6385..c44c4bd8c69 100644 +--- a/source3/smbd/share_access.c ++++ b/source3/smbd/share_access.c +@@ -23,6 +23,7 @@ + #include "../libcli/security/security.h" + #include "passdb/lookup_sid.h" + #include "auth.h" ++#include "source3/lib/substitute.h" + + /* + * We dropped NIS support in 2021, but need to keep configs working. +diff --git a/source3/smbd/smb2_server.c b/source3/smbd/smb2_server.c +index f359db0729d..f6b376e5a07 100644 +--- a/source3/smbd/smb2_server.c ++++ b/source3/smbd/smb2_server.c +@@ -33,6 +33,7 @@ + #include "lib/util/iov_buf.h" + #include "auth.h" + #include "libcli/smb/smbXcli_base.h" ++#include "source3/lib/substitute.h" + + #if defined(LINUX) + /* SIOCOUTQ TIOCOUTQ are the same */ +diff --git a/source3/smbd/smb2_sesssetup.c b/source3/smbd/smb2_sesssetup.c +index 38049e8535f..14b806bc007 100644 +--- a/source3/smbd/smb2_sesssetup.c ++++ b/source3/smbd/smb2_sesssetup.c +@@ -28,6 +28,7 @@ + #include "../lib/tsocket/tsocket.h" + #include "../libcli/security/security.h" + #include "../lib/util/tevent_ntstatus.h" ++#include "source3/lib/substitute.h" + + #include "lib/crypto/gnutls_helpers.h" + #include +diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c +index cd6b61429c5..a86ac3228e3 100644 +--- a/source3/smbd/trans2.c ++++ b/source3/smbd/trans2.c +@@ -45,6 +45,7 @@ + #include "smb1_utils.h" + #include "libcli/smb/smb2_posix.h" + #include "lib/util/string_wrappers.h" ++#include "source3/lib/substitute.h" + + #define DIR_ENTRY_SAFETY_MARGIN 4096 + +diff --git a/source3/smbd/uid.c b/source3/smbd/uid.c +index b0d7f21c200..52918c4f181 100644 +--- a/source3/smbd/uid.c ++++ b/source3/smbd/uid.c +@@ -26,6 +26,7 @@ + #include "passdb/lookup_sid.h" + #include "auth.h" + #include "../auth/auth_util.h" ++#include "source3/lib/substitute.h" + + /* what user is current? */ + extern struct current_user current_user; +diff --git a/source3/torture/torture.c b/source3/torture/torture.c +index 79a9c65073c..d3e0e3cf095 100644 +--- a/source3/torture/torture.c ++++ b/source3/torture/torture.c +@@ -51,6 +51,7 @@ + #include "lib/param/param.h" + #include "auth/gensec/gensec.h" + #include "lib/util/string_wrappers.h" ++#include "source3/lib/substitute.h" + + #include + #include +diff --git a/source3/utils/net_sam.c b/source3/utils/net_sam.c +index 6a2c6c861f9..17cc47b2ddd 100644 +--- a/source3/utils/net_sam.c ++++ b/source3/utils/net_sam.c +@@ -33,6 +33,7 @@ + #include "idmap.h" + #include "lib/util/smb_strtox.h" + #include "lib/util/string_wrappers.h" ++#include "source3/lib/substitute.h" + + /* + * Set a user's data +diff --git a/source3/winbindd/wb_getpwsid.c b/source3/winbindd/wb_getpwsid.c +index fb0351ec201..7f168bdda7a 100644 +--- a/source3/winbindd/wb_getpwsid.c ++++ b/source3/winbindd/wb_getpwsid.c +@@ -22,6 +22,7 @@ + #include "librpc/gen_ndr/ndr_winbind_c.h" + #include "../libcli/security/security.h" + #include "lib/util/string_wrappers.h" ++#include "source3/lib/substitute.h" + + struct wb_getpwsid_state { + struct tevent_context *ev; +diff --git a/source3/winbindd/winbindd.c b/source3/winbindd/winbindd.c +index 25d8b723010..290454619a4 100644 +--- a/source3/winbindd/winbindd.c ++++ b/source3/winbindd/winbindd.c +@@ -51,6 +51,7 @@ + #include "lib/gencache.h" + #include "rpc_server/rpc_config.h" + #include "lib/global_contexts.h" ++#include "source3/lib/substitute.h" + + #undef DBGC_CLASS + #define DBGC_CLASS DBGC_WINBIND +-- +2.33.1 + + +From 1184733a1628c1187a215956195ca806419db16d Mon Sep 17 00:00:00 2001 +From: Ralph Boehme +Date: Thu, 11 Nov 2021 05:23:09 +0100 +Subject: [PATCH 2/8] samba-bgqd: fix startup and logging + +Let samba-bgqd use the new POPT_COMMON_DAEMON infrastructure. + +The calls to setup_logging() can safely be removed as this is already taken care +of by samba_cmdline_init(). + +To avoid a logfile basename of ".log" when using "%m", we add a call to +set_remote_machine_name(). + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897 + +Signed-off-by: Ralph Boehme +--- + source3/printing/samba-bgqd.c | 35 ++++++++++------------------------- + 1 file changed, 10 insertions(+), 25 deletions(-) + +diff --git a/source3/printing/samba-bgqd.c b/source3/printing/samba-bgqd.c +index 8ac6ec525b2..2cd6a8e007a 100644 +--- a/source3/printing/samba-bgqd.c ++++ b/source3/printing/samba-bgqd.c +@@ -40,6 +40,7 @@ + #include "source3/lib/util_procid.h" + #include "source3/auth/proto.h" + #include "source3/printing/queue_process.h" ++#include "source3/lib/substitute.h" + + static void watch_handler(struct tevent_req *req) + { +@@ -235,6 +236,7 @@ static int closeall_except_fd_params( + + int main(int argc, const char *argv[]) + { ++ struct samba_cmdline_daemon_cfg *cmdline_daemon_cfg = NULL; + const struct loadparm_substitution *lp_sub = + loadparm_s3_global_substitution(); + const char *progname = getprogname(); +@@ -245,8 +247,6 @@ int main(int argc, const char *argv[]) + struct tevent_req *watch_req = NULL; + struct tevent_signal *sigterm_handler = NULL; + struct bq_state *bq = NULL; +- int foreground = 0; +- int no_process_group = 0; + int log_stdout = 0; + int ready_signal_fd = -1; + int watch_fd = -1; +@@ -259,21 +259,7 @@ int main(int argc, const char *argv[]) + struct poptOption long_options[] = { + POPT_AUTOHELP + POPT_COMMON_SAMBA +- { +- .longName = "foreground", +- .shortName = 'F', +- .argInfo = POPT_ARG_NONE, +- .arg = &foreground, +- .descrip = "Run daemon in foreground " +- "(for daemontools, etc.)", +- }, +- { +- .longName = "no-process-group", +- .shortName = '\0', +- .argInfo = POPT_ARG_NONE, +- .arg = &no_process_group, +- .descrip = "Don't create a new process group" , +- }, ++ POPT_COMMON_DAEMON + + /* + * File descriptor to write the PID of the helper +@@ -311,6 +297,7 @@ int main(int argc, const char *argv[]) + frame = talloc_stackframe(); + + umask(0); ++ set_remote_machine_name("smbd-bgqd", true); + + ok = samba_cmdline_init(frame, + SAMBA_CMDLINE_CONFIG_SERVER, +@@ -320,6 +307,8 @@ int main(int argc, const char *argv[]) + exit(ENOMEM); + } + ++ cmdline_daemon_cfg = samba_cmdline_get_daemon_cfg(); ++ + pc = samba_popt_get_context(progname, + argc, + argv, +@@ -340,16 +329,12 @@ int main(int argc, const char *argv[]) + + log_stdout = (debug_get_log_type() == DEBUG_STDOUT); + +- if (foreground) { ++ if (!cmdline_daemon_cfg->fork) { + daemon_status(progname, "Starting process ... "); + } else { +- become_daemon(true, no_process_group, log_stdout); +- } +- +- if (log_stdout) { +- setup_logging(progname, DEBUG_STDOUT); +- } else { +- setup_logging(progname, DEBUG_FILE); ++ become_daemon(true, ++ cmdline_daemon_cfg->no_process_group, ++ log_stdout); + } + + BlockSignals(true, SIGPIPE); +-- +2.33.1 + + +From 1a0a1ccbe888332ea134b16bfac0d0d011bf1f4c Mon Sep 17 00:00:00 2001 +From: Ralph Boehme +Date: Wed, 10 Nov 2021 18:27:08 +0100 +Subject: [PATCH 3/8] winbindd: remove is_default_dyn_LOGFILEBASE() logic + +Handling of -l commandline parameter is already implemented by lib/cmdline/. + +is_default_dyn_LOGFILEBASE() == true is the default case and this causes us to +temporarily overwrite the configured logfile with LOGFILEBASE/log.winbindd until +winbindd_reload_services_file() restores it. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897 + +Signed-off-by: Ralph Boehme +--- + source3/winbindd/winbindd.c | 9 --------- + 1 file changed, 9 deletions(-) + +diff --git a/source3/winbindd/winbindd.c b/source3/winbindd/winbindd.c +index 290454619a4..58c5ffbced4 100644 +--- a/source3/winbindd/winbindd.c ++++ b/source3/winbindd/winbindd.c +@@ -1717,15 +1717,6 @@ int main(int argc, const char **argv) + + poptFreeContext(pc); + +- if (is_default_dyn_LOGFILEBASE()) { +- char *lfile = NULL; +- if (asprintf(&lfile,"%s/log.winbindd", +- get_dyn_LOGFILEBASE()) > 0) { +- lp_set_logfile(lfile); +- SAFE_FREE(lfile); +- } +- } +- + reopen_logs(); + + DEBUG(0,("winbindd version %s started.\n", samba_version_string())); +-- +2.33.1 + + +From bcbf9fb6669933cc3dcf1f615d2885c542a08035 Mon Sep 17 00:00:00 2001 +From: Ralph Boehme +Date: Wed, 10 Nov 2021 14:13:11 +0100 +Subject: [PATCH 4/8] lib/debug: fix fd check before dup'ing to stderr + +Before I added per-class logfile and we had only one fd for the logfile the code +looked like this: + + /* Take over stderr to catch output into logs */ + if (state.fd > 0) { + if (dup2(state.fd, 2) == -1) { + /* Close stderr too, if dup2 can't point it - + at the logfile. There really isn't much + that can be done on such a fundamental + failure... */ + close_low_fd(2); + } + } + +In the current code the equivalent to state.fd is dbgc_config[DBGC_ALL].fd. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897 + +Signed-off-by: Ralph Boehme +--- + lib/util/debug.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/lib/util/debug.c b/lib/util/debug.c +index 4fd17679227..b271608621a 100644 +--- a/lib/util/debug.c ++++ b/lib/util/debug.c +@@ -1125,7 +1125,6 @@ bool reopen_logs_internal(void) + { + struct debug_backend *b = NULL; + mode_t oldumask; +- int new_fd = 0; + size_t i; + bool ok; + +@@ -1190,7 +1189,7 @@ bool reopen_logs_internal(void) + * If log file was opened or created successfully, take over stderr to + * catch output into logs. + */ +- if (new_fd != -1) { ++ if (dbgc_config[DBGC_ALL].fd > 0) { + if (dup2(dbgc_config[DBGC_ALL].fd, 2) == -1) { + /* Close stderr too, if dup2 can't point it - + at the logfile. There really isn't much +-- +2.33.1 + + +From 9f76bd48d87eb03c66dfe942b4a84e997a8fe8ba Mon Sep 17 00:00:00 2001 +From: Ralph Boehme +Date: Mon, 8 Nov 2021 19:41:50 +0100 +Subject: [PATCH 5/8] lib/debug: in debug_set_logfile() call + reopen_logs_internal() + +This simplifies the logging API for callers that typically would want to set +logging by just setup_logging() once without bothering that typically +configuration is loaded (via some lpcfg_load*() or lp_load*() varient) which +will only then pick up the configured logfile from smb.conf without actually +applying the new logifle to the logging subsytem. + +Therefor our daemons will additionally call reopen_logs() explicitly in their +startup code after config is loaded, eg + + setup_logging(getprogname(), DEBUG_FILE); + ... + lpcfg_load(lp_ctx, config_file); + ... + reopen_logs(); + +By calling reopen_logs_internal() implicitly from debug_set_logfile() there's no +need to call reopen_logs() explicitly anymore to apply the logfile. + +As reopen_logs() will also apply other logging configuration options, we have to +keep the explicit calls in the daemon code. But at least this allows consistent +logging setup wrt to the logfile in the new cmdline library. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897 + +Signed-off-by: Ralph Boehme +--- + lib/util/debug.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/lib/util/debug.c b/lib/util/debug.c +index b271608621a..171b5e15008 100644 +--- a/lib/util/debug.c ++++ b/lib/util/debug.c +@@ -1018,6 +1018,8 @@ void debug_set_logfile(const char *name) + } + TALLOC_FREE(dbgc_config[DBGC_ALL].logfile); + dbgc_config[DBGC_ALL].logfile = talloc_strdup(NULL, name); ++ ++ reopen_logs_internal(); + } + + static void debug_close_fd(int fd) +-- +2.33.1 + + +From b80911bc1a306cac479ee3feabdcea124946cdde Mon Sep 17 00:00:00 2001 +From: Ralph Boehme +Date: Mon, 8 Nov 2021 12:08:47 +0100 +Subject: [PATCH 6/8] lib/cmdline: fix indentation + +s/whitespace/tab/ + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897 + +Signed-off-by: Ralph Boehme +--- + lib/cmdline/cmdline_s3.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/cmdline/cmdline_s3.c b/lib/cmdline/cmdline_s3.c +index 1f8d9ed5eb5..639d403aed3 100644 +--- a/lib/cmdline/cmdline_s3.c ++++ b/lib/cmdline/cmdline_s3.c +@@ -55,7 +55,7 @@ static bool _samba_cmdline_load_config_s3(void) + case SAMBA_CMDLINE_CONFIG_CLIENT: + ok = lp_load_client(config_file); + break; +- case SAMBA_CMDLINE_CONFIG_SERVER: ++ case SAMBA_CMDLINE_CONFIG_SERVER: + { + const struct samba_cmdline_daemon_cfg *cmdline_daemon_cfg = + samba_cmdline_get_daemon_cfg(); +-- +2.33.1 + + +From a6b6b0b6e6dfcd2c8e2c2085d20cd16c51e3b379 Mon Sep 17 00:00:00 2001 +From: Ralph Boehme +Date: Mon, 8 Nov 2021 12:09:16 +0100 +Subject: [PATCH 7/8] lib/cmdline: remember config_type in samba_cmdline_init() + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897 + +Signed-off-by: Ralph Boehme +--- + lib/cmdline/cmdline_s4.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/lib/cmdline/cmdline_s4.c b/lib/cmdline/cmdline_s4.c +index 61c1b96ba8d..6ef6f59db49 100644 +--- a/lib/cmdline/cmdline_s4.c ++++ b/lib/cmdline/cmdline_s4.c +@@ -25,6 +25,7 @@ + #include "cmdline_private.h" + + static bool _require_smbconf; ++static enum samba_cmdline_config_type _config_type; + + static bool _samba_cmdline_load_config_s4(void) + { +@@ -81,6 +82,7 @@ bool samba_cmdline_init(TALLOC_CTX *mem_ctx, + return false; + } + _require_smbconf = require_smbconf; ++ _config_type = config_type; + + creds = cli_credentials_init(mem_ctx); + if (creds == NULL) { +-- +2.33.1 + + +From e1d6ab1b0dbd8ff30019edf804c4766b066db4b7 Mon Sep 17 00:00:00 2001 +From: Ralph Boehme +Date: Mon, 8 Nov 2021 12:09:43 +0100 +Subject: [PATCH 8/8] lib/cmdline: setup default file logging for servers + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897 +RN: samba process doesn't log to logfile + +Signed-off-by: Ralph Boehme +--- + lib/cmdline/cmdline_s4.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/lib/cmdline/cmdline_s4.c b/lib/cmdline/cmdline_s4.c +index 6ef6f59db49..29e9f34bbe2 100644 +--- a/lib/cmdline/cmdline_s4.c ++++ b/lib/cmdline/cmdline_s4.c +@@ -44,6 +44,20 @@ static bool _samba_cmdline_load_config_s4(void) + } + } + ++ switch (_config_type) { ++ case SAMBA_CMDLINE_CONFIG_SERVER: { ++ const struct samba_cmdline_daemon_cfg *cmdline_daemon_cfg = ++ samba_cmdline_get_daemon_cfg(); ++ ++ if (!cmdline_daemon_cfg->interactive) { ++ setup_logging(getprogname(), DEBUG_FILE); ++ } ++ break; ++ } ++ default: ++ break; ++ } ++ + config_file = get_dyn_CONFIGFILE(); + ok = lpcfg_load(lp_ctx, config_file); + if (!ok) { +-- +2.33.1 + diff --git a/samba.spec b/samba.spec index dd53d8c..334c508 100644 --- a/samba.spec +++ b/samba.spec @@ -202,6 +202,7 @@ Patch0: samba-s4u.patch Patch1: samba-ctdb-etcd-reclock.patch Patch2: samba-4.15.1-winexe.patch Patch3: samba-4.15-fix-winbind-no-trusted-domain.patch +Patch4: samba-4.15-logfile.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -4096,6 +4097,7 @@ fi * Thu Nov 11 2021 Guenther Deschner - 4.15.2-1 - Fix winbind trusted domain regression - related: #2021716 +- Fix logfile handling * Tue Nov 09 2021 Guenther Deschner - 4.15.2-0 - Update to Samba 4.15.2 From 2eedc4de19dac68faa251f684fb3104b299ca7a6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 11 Nov 2021 18:53:23 +0100 Subject: [PATCH 155/425] Fix smbclient -N failures in container setups Guenther --- samba-4.15.2-smbclient_anonymous.patch | 58 ++++++++++++++++++++++++++ samba.spec | 6 ++- 2 files changed, 62 insertions(+), 2 deletions(-) create mode 100644 samba-4.15.2-smbclient_anonymous.patch diff --git a/samba-4.15.2-smbclient_anonymous.patch b/samba-4.15.2-smbclient_anonymous.patch new file mode 100644 index 0000000..477ddef --- /dev/null +++ b/samba-4.15.2-smbclient_anonymous.patch @@ -0,0 +1,58 @@ +From 61fd63d70578043de9f3bff1c3267c499dbf50a0 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 10 Nov 2021 12:06:51 +0100 +Subject: [PATCH] auth:creds: Guess the username first via getpwuid(my_id) + +If we have a container, we often don't have USER or LOGNAME set. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14883 + +Tested-by: Anoop C S +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +(cherry picked from commit c28be4067463e582e378df402f812e510883d606) +--- + auth/credentials/credentials.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c +index 02a3cf3b354..c5a6ba6940c 100644 +--- a/auth/credentials/credentials.c ++++ b/auth/credentials/credentials.c +@@ -30,6 +30,7 @@ + #include "tevent.h" + #include "param/param.h" + #include "system/filesys.h" ++#include "system/passwd.h" + + /** + * Create a new credentials structure +@@ -1159,6 +1160,7 @@ _PUBLIC_ bool cli_credentials_guess(struct cli_credentials *cred, + { + const char *error_string; + const char *env = NULL; ++ struct passwd *pwd = NULL; + bool ok; + + if (lp_ctx != NULL) { +@@ -1168,6 +1170,17 @@ _PUBLIC_ bool cli_credentials_guess(struct cli_credentials *cred, + } + } + ++ pwd = getpwuid(getuid()); ++ if (pwd != NULL) { ++ size_t len = strlen(pwd->pw_name); ++ ++ if (len > 0 && len <= 1024) { ++ (void)cli_credentials_parse_string(cred, ++ pwd->pw_name, ++ CRED_GUESS_ENV); ++ } ++ } ++ + env = getenv("LOGNAME"); + if (env != NULL) { + size_t len = strlen(env); +-- +2.33.1 + diff --git a/samba.spec b/samba.spec index 334c508..3915d5a 100644 --- a/samba.spec +++ b/samba.spec @@ -129,7 +129,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 1 +%global baserelease 2 %global samba_version 4.15.2 %global talloc_version 2.3.3 @@ -203,6 +203,7 @@ Patch1: samba-ctdb-etcd-reclock.patch Patch2: samba-4.15.1-winexe.patch Patch3: samba-4.15-fix-winbind-no-trusted-domain.patch Patch4: samba-4.15-logfile.patch +Patch5: samba-4.15.2-smbclient_anonymous.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -4094,10 +4095,11 @@ fi %endif %changelog -* Thu Nov 11 2021 Guenther Deschner - 4.15.2-1 +* Thu Nov 11 2021 Guenther Deschner - 4.15.2-2 - Fix winbind trusted domain regression - related: #2021716 - Fix logfile handling +- Fix smbclient -N failures in container setups * Tue Nov 09 2021 Guenther Deschner - 4.15.2-0 - Update to Samba 4.15.2 From 2ee30bad8f6008e2d425d502b9004b6777992409 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Sat, 13 Nov 2021 00:15:32 +0100 Subject: [PATCH 156/425] Fix IPA DC schannel support Guenther --- samba-4.15-ipa-dc-schannel.patch | 45 ++++++++++++++++++++++++++++++++ samba.spec | 6 ++++- 2 files changed, 50 insertions(+), 1 deletion(-) create mode 100644 samba-4.15-ipa-dc-schannel.patch diff --git a/samba-4.15-ipa-dc-schannel.patch b/samba-4.15-ipa-dc-schannel.patch new file mode 100644 index 0000000..d315a5d --- /dev/null +++ b/samba-4.15-ipa-dc-schannel.patch @@ -0,0 +1,45 @@ +From 3fc4d1d3998f3956a84c855cb60a9dcb335e1f59 Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Fri, 12 Nov 2021 19:06:01 +0200 +Subject: [PATCH] IPA DC: add missing checks + +When introducing FreeIPA support, two places were forgotten: + + - schannel gensec module needs to be aware of IPA DC + - _lsa_QueryInfoPolicy should treat IPA DC as PDC + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14903 + +Signed-off-by: Alexander Bokovoy +--- + auth/gensec/schannel.c | 1 + + source3/rpc_server/lsa/srv_lsa_nt.c | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/auth/gensec/schannel.c b/auth/gensec/schannel.c +index 0cdae141ead..6ebbe8f3179 100644 +--- a/auth/gensec/schannel.c ++++ b/auth/gensec/schannel.c +@@ -1080,6 +1080,7 @@ static NTSTATUS schannel_server_start(struct gensec_security *gensec_security) + case ROLE_DOMAIN_BDC: + case ROLE_DOMAIN_PDC: + case ROLE_ACTIVE_DIRECTORY_DC: ++ case ROLE_IPA_DC: + return NT_STATUS_OK; + default: + return NT_STATUS_NOT_IMPLEMENTED; +diff --git a/source3/rpc_server/lsa/srv_lsa_nt.c b/source3/rpc_server/lsa/srv_lsa_nt.c +index 8d71b5252ab..ea92a22cbc9 100644 +--- a/source3/rpc_server/lsa/srv_lsa_nt.c ++++ b/source3/rpc_server/lsa/srv_lsa_nt.c +@@ -683,6 +683,7 @@ NTSTATUS _lsa_QueryInfoPolicy(struct pipes_struct *p, + switch (lp_server_role()) { + case ROLE_DOMAIN_PDC: + case ROLE_DOMAIN_BDC: ++ case ROLE_IPA_DC: + name = get_global_sam_name(); + sid = dom_sid_dup(p->mem_ctx, get_global_sam_sid()); + if (!sid) { +-- +2.33.1 + diff --git a/samba.spec b/samba.spec index 3915d5a..a5a3106 100644 --- a/samba.spec +++ b/samba.spec @@ -129,7 +129,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 2 +%global baserelease 3 %global samba_version 4.15.2 %global talloc_version 2.3.3 @@ -204,6 +204,7 @@ Patch2: samba-4.15.1-winexe.patch Patch3: samba-4.15-fix-winbind-no-trusted-domain.patch Patch4: samba-4.15-logfile.patch Patch5: samba-4.15.2-smbclient_anonymous.patch +Patch6: samba-4.15-ipa-dc-schannel.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -4095,6 +4096,9 @@ fi %endif %changelog +* Sat Nov 13 2021 Guenther Deschner - 4.15.2-3 +- Fix IPA DC schannel support + * Thu Nov 11 2021 Guenther Deschner - 4.15.2-2 - Fix winbind trusted domain regression - related: #2021716 From 6f2c200320d3753389181bb588a7661f0f84fadc Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 15 Nov 2021 11:14:50 +0100 Subject: [PATCH 157/425] Always build with quota support We want that the build fails, if we don't have quota support. --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index a5a3106..6c0c8b9 100644 --- a/samba.spec +++ b/samba.spec @@ -1149,6 +1149,7 @@ export LDFLAGS="%{__global_ldflags} -fuse-ld=gold" %endif --with-profiling-data \ --with-systemd \ + --with-quotas \ --systemd-install-services \ --with-systemddir=/usr/lib/systemd/system \ --systemd-smb-extra=%{_systemd_extra} \ From 73757dc8a31204cec0bd97133b79b731ad71ceb9 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 25 Nov 2021 14:58:29 +0100 Subject: [PATCH 158/425] Define _make_verbose in if it doesn't exits This is needed to build for RHEL8. --- samba.spec | 3 +++ 1 file changed, 3 insertions(+) diff --git a/samba.spec b/samba.spec index 6c0c8b9..01a887b 100644 --- a/samba.spec +++ b/samba.spec @@ -19,6 +19,9 @@ # ctdb is enabled by default, you can disable it with: --without clustering %bcond_without clustering +# Define _make_verbose if it doesn't exist (RHEL8) +%{!?_make_verbose:%define _make_verbose V=1 VERBOSE=1} + # Build with Active Directory Domain Controller support by default on Fedora %if 0%{?fedora} %bcond_without dc From a4093f41f0cc344f1ba9da3876ab0b54359c88ec Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 3 Dec 2021 13:53:38 +0100 Subject: [PATCH 159/425] Remove unneeded lmdb dependency for samba-tool if we don't have a DC --- samba.spec | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 01a887b..a1b91fe 100644 --- a/samba.spec +++ b/samba.spec @@ -493,8 +493,10 @@ Requires: libwbclient = %{samba_depver} Requires: python3-%{name} = %{samba_depver} # samba-tool needs tdbbackup Requires: tdb-tools -# samba-tool needs mdb_copy +%if %{with dc} +# samba-tool needs mdb_copy for domain backup or upgrade provision Requires: lmdb +%endif Provides: bundled(libreplace) From 6bc60bb396b4c95385735bfc26549342fd7db627 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Wed, 8 Dec 2021 17:57:04 +0100 Subject: [PATCH 160/425] Update to Samba 4.15.3 resolves: #2030382 pfilipen --- .gitignore | 2 + ...a-4.15-fix-winbind-no-trusted-domain.patch | 41 - samba-4.15-ipa-dc-schannel.patch | 45 - samba-4.15-logfile.patch | 981 ------------------ samba-4.15.1-winexe.patch | 61 -- samba-4.15.2-smbclient_anonymous.patch | 58 -- samba.spec | 15 +- sources | 4 +- 8 files changed, 12 insertions(+), 1195 deletions(-) delete mode 100644 samba-4.15-fix-winbind-no-trusted-domain.patch delete mode 100644 samba-4.15-ipa-dc-schannel.patch delete mode 100644 samba-4.15-logfile.patch delete mode 100644 samba-4.15.1-winexe.patch delete mode 100644 samba-4.15.2-smbclient_anonymous.patch diff --git a/.gitignore b/.gitignore index b2f1c52..23cef85 100644 --- a/.gitignore +++ b/.gitignore @@ -273,3 +273,5 @@ samba-3.6.0pre1.tar.gz /samba-4.15.1.tar.asc /samba-4.15.2.tar.xz /samba-4.15.2.tar.asc +/samba-4.15.3.tar.xz +/samba-4.15.3.tar.asc diff --git a/samba-4.15-fix-winbind-no-trusted-domain.patch b/samba-4.15-fix-winbind-no-trusted-domain.patch deleted file mode 100644 index 4924872..0000000 --- a/samba-4.15-fix-winbind-no-trusted-domain.patch +++ /dev/null @@ -1,41 +0,0 @@ -From 2edaf32b4204b9fe363c441c25b6989fe76911a4 Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Tue, 9 Nov 2021 20:50:20 +0100 -Subject: [PATCH] s3:winbindd: fix "allow trusted domains = no" regression - -add_trusted_domain() should only reject domains -based on is_allowed_domain(), which now also -checks "allow trusted domains = no", if we don't -have an explicit trust to the domain (SEC_CHAN_NULL). - -We use at least SEC_CHAN_LOCAL for local domains like -BUILTIN. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14899 - -Signed-off-by: Stefan Metzmacher - -Autobuild-User(master): Stefan Metzmacher -Autobuild-Date(master): Wed Nov 10 11:21:31 UTC 2021 on sn-devel-184 - -(cherry picked from commit a7f6c60cb037b4bc9eee276236539b8282213935) ---- - source3/winbindd/winbindd_util.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/source3/winbindd/winbindd_util.c b/source3/winbindd/winbindd_util.c -index 42ddbfd2f44..9d54e462c42 100644 ---- a/source3/winbindd/winbindd_util.c -+++ b/source3/winbindd/winbindd_util.c -@@ -134,7 +134,7 @@ static NTSTATUS add_trusted_domain(const char *domain_name, - return NT_STATUS_INVALID_PARAMETER; - } - -- if (!is_allowed_domain(domain_name)) { -+ if (secure_channel_type == SEC_CHAN_NULL && !is_allowed_domain(domain_name)) { - return NT_STATUS_NO_SUCH_DOMAIN; - } - --- -2.33.1 - diff --git a/samba-4.15-ipa-dc-schannel.patch b/samba-4.15-ipa-dc-schannel.patch deleted file mode 100644 index d315a5d..0000000 --- a/samba-4.15-ipa-dc-schannel.patch +++ /dev/null @@ -1,45 +0,0 @@ -From 3fc4d1d3998f3956a84c855cb60a9dcb335e1f59 Mon Sep 17 00:00:00 2001 -From: Alexander Bokovoy -Date: Fri, 12 Nov 2021 19:06:01 +0200 -Subject: [PATCH] IPA DC: add missing checks - -When introducing FreeIPA support, two places were forgotten: - - - schannel gensec module needs to be aware of IPA DC - - _lsa_QueryInfoPolicy should treat IPA DC as PDC - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14903 - -Signed-off-by: Alexander Bokovoy ---- - auth/gensec/schannel.c | 1 + - source3/rpc_server/lsa/srv_lsa_nt.c | 1 + - 2 files changed, 2 insertions(+) - -diff --git a/auth/gensec/schannel.c b/auth/gensec/schannel.c -index 0cdae141ead..6ebbe8f3179 100644 ---- a/auth/gensec/schannel.c -+++ b/auth/gensec/schannel.c -@@ -1080,6 +1080,7 @@ static NTSTATUS schannel_server_start(struct gensec_security *gensec_security) - case ROLE_DOMAIN_BDC: - case ROLE_DOMAIN_PDC: - case ROLE_ACTIVE_DIRECTORY_DC: -+ case ROLE_IPA_DC: - return NT_STATUS_OK; - default: - return NT_STATUS_NOT_IMPLEMENTED; -diff --git a/source3/rpc_server/lsa/srv_lsa_nt.c b/source3/rpc_server/lsa/srv_lsa_nt.c -index 8d71b5252ab..ea92a22cbc9 100644 ---- a/source3/rpc_server/lsa/srv_lsa_nt.c -+++ b/source3/rpc_server/lsa/srv_lsa_nt.c -@@ -683,6 +683,7 @@ NTSTATUS _lsa_QueryInfoPolicy(struct pipes_struct *p, - switch (lp_server_role()) { - case ROLE_DOMAIN_PDC: - case ROLE_DOMAIN_BDC: -+ case ROLE_IPA_DC: - name = get_global_sam_name(); - sid = dom_sid_dup(p->mem_ctx, get_global_sam_sid()); - if (!sid) { --- -2.33.1 - diff --git a/samba-4.15-logfile.patch b/samba-4.15-logfile.patch deleted file mode 100644 index 6300639..0000000 --- a/samba-4.15-logfile.patch +++ /dev/null @@ -1,981 +0,0 @@ -From 96d6bd4feb27b9b003aac44ef2ab7ef0a288272d Mon Sep 17 00:00:00 2001 -From: Ralph Boehme -Date: Wed, 10 Nov 2021 20:18:07 +0100 -Subject: [PATCH 1/8] source3: move lib/substitute.c functions out of proto.h - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897 - -Signed-off-by: Ralph Boehme ---- - source3/auth/auth_generic.c | 1 + - source3/auth/auth_ntlmssp.c | 1 + - source3/auth/auth_util.c | 1 + - source3/include/proto.h | 33 ----------- - source3/lib/substitute.c | 1 + - source3/lib/substitute.h | 63 +++++++++++++++++++++ - source3/modules/vfs_expand_msdfs.c | 1 + - source3/modules/vfs_full_audit.c | 1 + - source3/modules/vfs_recycle.c | 1 + - source3/modules/vfs_unityed_media.c | 1 + - source3/modules/vfs_virusfilter_utils.c | 1 + - source3/nmbd/nmbd.c | 1 + - source3/nmbd/nmbd_synclists.c | 1 + - source3/param/loadparm.c | 1 + - source3/passdb/passdb.c | 1 + - source3/passdb/pdb_ldap.c | 1 + - source3/printing/print_generic.c | 1 + - source3/printing/printing.c | 1 + - source3/rpc_server/lsa/srv_lsa_nt.c | 1 + - source3/rpc_server/netlogon/srv_netlog_nt.c | 1 + - source3/rpc_server/srvsvc/srv_srvsvc_nt.c | 1 + - source3/smbd/ipc.c | 1 + - source3/smbd/lanman.c | 1 + - source3/smbd/message.c | 1 + - source3/smbd/msdfs.c | 1 + - source3/smbd/process.c | 1 + - source3/smbd/reply.c | 1 + - source3/smbd/server.c | 1 + - source3/smbd/service.c | 1 + - source3/smbd/sesssetup.c | 1 + - source3/smbd/share_access.c | 1 + - source3/smbd/smb2_server.c | 1 + - source3/smbd/smb2_sesssetup.c | 1 + - source3/smbd/trans2.c | 1 + - source3/smbd/uid.c | 1 + - source3/torture/torture.c | 1 + - source3/utils/net_sam.c | 1 + - source3/winbindd/wb_getpwsid.c | 1 + - source3/winbindd/winbindd.c | 1 + - 39 files changed, 100 insertions(+), 33 deletions(-) - create mode 100644 source3/lib/substitute.h - -diff --git a/source3/auth/auth_generic.c b/source3/auth/auth_generic.c -index fc7a7549e8e..ff51307e43a 100644 ---- a/source3/auth/auth_generic.c -+++ b/source3/auth/auth_generic.c -@@ -36,6 +36,7 @@ - #include "auth/credentials/credentials.h" - #include "lib/param/loadparm.h" - #include "librpc/gen_ndr/dcerpc.h" -+#include "source3/lib/substitute.h" - - static NTSTATUS auth3_generate_session_info_pac(struct auth4_context *auth_ctx, - TALLOC_CTX *mem_ctx, -diff --git a/source3/auth/auth_ntlmssp.c b/source3/auth/auth_ntlmssp.c -index 676aa9d892c..f2deca09aa6 100644 ---- a/source3/auth/auth_ntlmssp.c -+++ b/source3/auth/auth_ntlmssp.c -@@ -25,6 +25,7 @@ - #include "auth.h" - #include "libcli/security/security.h" - #include "lib/util/tevent_ntstatus.h" -+#include "source3/lib/substitute.h" - - NTSTATUS auth3_generate_session_info(struct auth4_context *auth_context, - TALLOC_CTX *mem_ctx, -diff --git a/source3/auth/auth_util.c b/source3/auth/auth_util.c -index dec854d85c3..4527dedc49d 100644 ---- a/source3/auth/auth_util.c -+++ b/source3/auth/auth_util.c -@@ -38,6 +38,7 @@ - #include "rpc_client/util_netlogon.h" - #include "source4/auth/auth.h" - #include "auth/auth_util.h" -+#include "source3/lib/substitute.h" - - #undef DBGC_CLASS - #define DBGC_CLASS DBGC_AUTH -diff --git a/source3/include/proto.h b/source3/include/proto.h -index eb45179aebb..a96c2c8d110 100644 ---- a/source3/include/proto.h -+++ b/source3/include/proto.h -@@ -139,39 +139,6 @@ int smbrun_no_sanitize(const char *cmd, int *outfd, char * const *env); - int smbrun(const char *cmd, int *outfd, char * const *env); - int smbrunsecret(const char *cmd, const char *secret); - --/* The following definitions come from lib/substitute.c */ -- --bool set_local_machine_name(const char *local_name, bool perm); --const char *get_local_machine_name(void); --bool set_remote_machine_name(const char *remote_name, bool perm); --const char *get_remote_machine_name(void); --void sub_set_smb_name(const char *name); --void set_current_user_info(const char *smb_name, const char *unix_name, -- const char *domain); --void sub_set_socket_ids(const char *peeraddr, const char *peername, -- const char *sockaddr); --const char *get_current_username(void); --void standard_sub_basic(const char *smb_name, const char *domain_name, -- char *str, size_t len); --char *talloc_sub_basic(TALLOC_CTX *mem_ctx, const char *smb_name, -- const char *domain_name, const char *str); --char *talloc_sub_specified(TALLOC_CTX *mem_ctx, -- const char *input_string, -- const char *username, -- const char *grpname, -- const char *domain, -- uid_t uid, -- gid_t gid); --char *talloc_sub_advanced(TALLOC_CTX *mem_ctx, -- const char *servicename, const char *user, -- const char *connectpath, gid_t gid, -- const char *str); --char *talloc_sub_full(TALLOC_CTX *mem_ctx, -- const char *servicename, const char *user, -- const char *connectpath, gid_t gid, -- const char *smb_name, const char *domain_name, -- const char *str); -- - /* The following definitions come from lib/sysquotas.c */ - - int sys_get_quota(const char *path, enum SMB_QUOTA_TYPE qtype, unid_t id, SMB_DISK_QUOTA *dp); -diff --git a/source3/lib/substitute.c b/source3/lib/substitute.c -index b98a0acf1cb..a941b89f82a 100644 ---- a/source3/lib/substitute.c -+++ b/source3/lib/substitute.c -@@ -20,6 +20,7 @@ - - - #include "includes.h" -+#include "substitute.h" - #include "system/passwd.h" - #include "secrets.h" - #include "auth.h" -diff --git a/source3/lib/substitute.h b/source3/lib/substitute.h -new file mode 100644 -index 00000000000..2056d163dd7 ---- /dev/null -+++ b/source3/lib/substitute.h -@@ -0,0 +1,63 @@ -+/* -+ Unix SMB/CIFS implementation. -+ string substitution functions -+ Copyright (C) Andrew Tridgell 1992-2000 -+ Copyright (C) Gerald Carter 2006 -+ -+ This program is free software; you can redistribute it and/or modify -+ it under the terms of the GNU General Public License as published by -+ the Free Software Foundation; either version 3 of the License, or -+ (at your option) any later version. -+ -+ This program is distributed in the hope that it will be useful, -+ but WITHOUT ANY WARRANTY; without even the implied warranty of -+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ GNU General Public License for more details. -+ -+ You should have received a copy of the GNU General Public License -+ along with this program. If not, see . -+*/ -+ -+#ifndef SUBSTITUTE_H -+#define SUBSTITUTE_H -+ -+bool set_local_machine_name(const char *local_name, bool perm); -+const char *get_local_machine_name(void); -+bool set_remote_machine_name(const char *remote_name, bool perm); -+const char *get_remote_machine_name(void); -+void sub_set_socket_ids(const char *peeraddr, const char *peername, -+ const char *sockaddr); -+void set_current_user_info(const char *smb_name, -+ const char *unix_name, -+ const char *domain); -+const char *get_current_username(void); -+void standard_sub_basic(const char *smb_name, -+ const char *domain_name, -+ char *str, -+ size_t len); -+char *talloc_sub_basic(TALLOC_CTX *mem_ctx, -+ const char *smb_name, -+ const char *domain_name, -+ const char *str); -+char *talloc_sub_specified(TALLOC_CTX *mem_ctx, -+ const char *input_string, -+ const char *username, -+ const char *grpname, -+ const char *domain, -+ uid_t uid, -+ gid_t gid); -+char *talloc_sub_advanced(TALLOC_CTX *ctx, -+ const char *servicename, -+ const char *user, -+ const char *connectpath, -+ gid_t gid, -+ const char *str); -+char *talloc_sub_full(TALLOC_CTX *ctx, -+ const char *servicename, -+ const char *user, -+ const char *connectpath, -+ gid_t gid, -+ const char *smb_name, -+ const char *domain_name, -+ const char *str); -+#endif -diff --git a/source3/modules/vfs_expand_msdfs.c b/source3/modules/vfs_expand_msdfs.c -index 34e7051dca5..fe3c6f47462 100644 ---- a/source3/modules/vfs_expand_msdfs.c -+++ b/source3/modules/vfs_expand_msdfs.c -@@ -25,6 +25,7 @@ - #include "auth.h" - #include "../lib/tsocket/tsocket.h" - #include "msdfs.h" -+#include "source3/lib/substitute.h" - - #undef DBGC_CLASS - #define DBGC_CLASS DBGC_VFS -diff --git a/source3/modules/vfs_full_audit.c b/source3/modules/vfs_full_audit.c -index ceda99d4568..c8dbc8c07bb 100644 ---- a/source3/modules/vfs_full_audit.c -+++ b/source3/modules/vfs_full_audit.c -@@ -73,6 +73,7 @@ - #include "passdb/machine_sid.h" - #include "lib/util/tevent_ntstatus.h" - #include "lib/util/string_wrappers.h" -+#include "source3/lib/substitute.h" - - static int vfs_full_audit_debug_level = DBGC_VFS; - -diff --git a/source3/modules/vfs_recycle.c b/source3/modules/vfs_recycle.c -index 1c18f232c32..7cbc938a57c 100644 ---- a/source3/modules/vfs_recycle.c -+++ b/source3/modules/vfs_recycle.c -@@ -27,6 +27,7 @@ - #include "system/filesys.h" - #include "../librpc/gen_ndr/ndr_netlogon.h" - #include "auth.h" -+#include "source3/lib/substitute.h" - - #define ALLOC_CHECK(ptr, label) do { if ((ptr) == NULL) { DEBUG(0, ("recycle.bin: out of memory!\n")); errno = ENOMEM; goto label; } } while(0) - -diff --git a/source3/modules/vfs_unityed_media.c b/source3/modules/vfs_unityed_media.c -index 62a1456b996..fbd4d968172 100644 ---- a/source3/modules/vfs_unityed_media.c -+++ b/source3/modules/vfs_unityed_media.c -@@ -62,6 +62,7 @@ - #include "../lib/tsocket/tsocket.h" - #include "lib/util/smb_strtox.h" - #include -+#include "source3/lib/substitute.h" - - #define UM_PARAM_TYPE_NAME "unityed_media" - -diff --git a/source3/modules/vfs_virusfilter_utils.c b/source3/modules/vfs_virusfilter_utils.c -index c7f8089ffc7..b8b44eb203b 100644 ---- a/source3/modules/vfs_virusfilter_utils.c -+++ b/source3/modules/vfs_virusfilter_utils.c -@@ -25,6 +25,7 @@ struct iovec; - #include "lib/util/iov_buf.h" - #include - #include "lib/tsocket/tsocket.h" -+#include "source3/lib/substitute.h" - - int virusfilter_debug_class = DBGC_VFS; - -diff --git a/source3/nmbd/nmbd.c b/source3/nmbd/nmbd.c -index 44121e9915c..7470897587e 100644 ---- a/source3/nmbd/nmbd.c -+++ b/source3/nmbd/nmbd.c -@@ -29,6 +29,7 @@ - #include "util_cluster.h" - #include "lib/gencache.h" - #include "lib/global_contexts.h" -+#include "source3/lib/substitute.h" - - int ClientNMB = -1; - int ClientDGRAM = -1; -diff --git a/source3/nmbd/nmbd_synclists.c b/source3/nmbd/nmbd_synclists.c -index a65cbb87e0e..d291927fbc8 100644 ---- a/source3/nmbd/nmbd_synclists.c -+++ b/source3/nmbd/nmbd_synclists.c -@@ -33,6 +33,7 @@ - #include "libsmb/clirap.h" - #include "../libcli/smb/smbXcli_base.h" - #include "lib/util/string_wrappers.h" -+#include "source3/lib/substitute.h" - - struct sync_record { - struct sync_record *next, *prev; -diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c -index f54c08cc4a5..b56fd20e410 100644 ---- a/source3/param/loadparm.c -+++ b/source3/param/loadparm.c -@@ -76,6 +76,7 @@ - #include "lib/crypto/gnutls_helpers.h" - #include "lib/util/string_wrappers.h" - #include "auth/credentials/credentials.h" -+#include "source3/lib/substitute.h" - - #ifdef HAVE_SYS_SYSCTL_H - #include -diff --git a/source3/passdb/passdb.c b/source3/passdb/passdb.c -index 068c5a5ea70..863f260ea90 100644 ---- a/source3/passdb/passdb.c -+++ b/source3/passdb/passdb.c -@@ -33,6 +33,7 @@ - #include "auth/credentials/credentials.h" - #include "lib/param/param.h" - #include "lib/util/string_wrappers.h" -+#include "source3/lib/substitute.h" - - #undef DBGC_CLASS - #define DBGC_CLASS DBGC_PASSDB -diff --git a/source3/passdb/pdb_ldap.c b/source3/passdb/pdb_ldap.c -index e6d8a84c60f..93da28b1941 100644 ---- a/source3/passdb/pdb_ldap.c -+++ b/source3/passdb/pdb_ldap.c -@@ -56,6 +56,7 @@ - #include "lib/util_sid_passdb.h" - #include "lib/util/smb_strtox.h" - #include "lib/util/string_wrappers.h" -+#include "source3/lib/substitute.h" - - #undef DBGC_CLASS - #define DBGC_CLASS DBGC_PASSDB -diff --git a/source3/printing/print_generic.c b/source3/printing/print_generic.c -index 743c311bbd5..8798a4cf34a 100644 ---- a/source3/printing/print_generic.c -+++ b/source3/printing/print_generic.c -@@ -20,6 +20,7 @@ - #include "includes.h" - #include "printing.h" - #include "smbd/proto.h" -+#include "source3/lib/substitute.h" - - extern userdom_struct current_user_info; - -diff --git a/source3/printing/printing.c b/source3/printing/printing.c -index 499334df03f..67d798fbb21 100644 ---- a/source3/printing/printing.c -+++ b/source3/printing/printing.c -@@ -40,6 +40,7 @@ - #include "lib/util/string_wrappers.h" - #include "lib/global_contexts.h" - #include "source3/printing/rap_jobid.h" -+#include "source3/lib/substitute.h" - - extern userdom_struct current_user_info; - -diff --git a/source3/rpc_server/lsa/srv_lsa_nt.c b/source3/rpc_server/lsa/srv_lsa_nt.c -index d6d606ddeca..57f981cb358 100644 ---- a/source3/rpc_server/lsa/srv_lsa_nt.c -+++ b/source3/rpc_server/lsa/srv_lsa_nt.c -@@ -53,6 +53,7 @@ - #include "librpc/rpc/dcesrv_core.h" - #include "librpc/rpc/dcerpc_helper.h" - #include "lib/param/loadparm.h" -+#include "source3/lib/substitute.h" - - #include "lib/crypto/gnutls_helpers.h" - #include -diff --git a/source3/rpc_server/netlogon/srv_netlog_nt.c b/source3/rpc_server/netlogon/srv_netlog_nt.c -index eaacd8dbc6a..2906fa3f30f 100644 ---- a/source3/rpc_server/netlogon/srv_netlog_nt.c -+++ b/source3/rpc_server/netlogon/srv_netlog_nt.c -@@ -49,6 +49,7 @@ - #include "lib/param/param.h" - #include "libsmb/dsgetdcname.h" - #include "lib/util/util_str_escape.h" -+#include "source3/lib/substitute.h" - - extern userdom_struct current_user_info; - -diff --git a/source3/rpc_server/srvsvc/srv_srvsvc_nt.c b/source3/rpc_server/srvsvc/srv_srvsvc_nt.c -index 8576e9d2ce2..fc27a459634 100644 ---- a/source3/rpc_server/srvsvc/srv_srvsvc_nt.c -+++ b/source3/rpc_server/srvsvc/srv_srvsvc_nt.c -@@ -42,6 +42,7 @@ - #include "messages.h" - #include "serverid.h" - #include "lib/global_contexts.h" -+#include "source3/lib/substitute.h" - - extern const struct generic_mapping file_generic_mapping; - -diff --git a/source3/smbd/ipc.c b/source3/smbd/ipc.c -index f1c8ea0c2ed..cf3b7c91c22 100644 ---- a/source3/smbd/ipc.c -+++ b/source3/smbd/ipc.c -@@ -29,6 +29,7 @@ - #include "smbd/globals.h" - #include "smbprofile.h" - #include "rpc_server/srv_pipe_hnd.h" -+#include "source3/lib/substitute.h" - - #define NERR_notsupported 50 - -diff --git a/source3/smbd/lanman.c b/source3/smbd/lanman.c -index 9194113e768..eb8148753b9 100644 ---- a/source3/smbd/lanman.c -+++ b/source3/smbd/lanman.c -@@ -45,6 +45,7 @@ - #include "rpc_server/rpc_ncacn_np.h" - #include "lib/util/string_wrappers.h" - #include "source3/printing/rap_jobid.h" -+#include "source3/lib/substitute.h" - - #ifdef CHECK_TYPES - #undef CHECK_TYPES -diff --git a/source3/smbd/message.c b/source3/smbd/message.c -index b9728946889..7185bec1289 100644 ---- a/source3/smbd/message.c -+++ b/source3/smbd/message.c -@@ -27,6 +27,7 @@ - #include "smbd/smbd.h" - #include "smbd/globals.h" - #include "smbprofile.h" -+#include "source3/lib/substitute.h" - - extern userdom_struct current_user_info; - -diff --git a/source3/smbd/msdfs.c b/source3/smbd/msdfs.c -index 995ed815d90..fd002e98071 100644 ---- a/source3/smbd/msdfs.c -+++ b/source3/smbd/msdfs.c -@@ -34,6 +34,7 @@ - #include "librpc/gen_ndr/ndr_dfsblobs.h" - #include "lib/tsocket/tsocket.h" - #include "lib/global_contexts.h" -+#include "source3/lib/substitute.h" - - /********************************************************************** - Parse a DFS pathname of the form \hostname\service\reqpath -diff --git a/source3/smbd/process.c b/source3/smbd/process.c -index 03409742752..5015c143a04 100644 ---- a/source3/smbd/process.c -+++ b/source3/smbd/process.c -@@ -46,6 +46,7 @@ - #include "libcli/smb/smbXcli_base.h" - #include "lib/util/time_basic.h" - #include "smb1_utils.h" -+#include "source3/lib/substitute.h" - - /* Internal message queue for deferred opens. */ - struct pending_message_list { -diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c -index 042e7f2329e..f85d1122a07 100644 ---- a/source3/smbd/reply.c -+++ b/source3/smbd/reply.c -@@ -50,6 +50,7 @@ - #include "libcli/smb/smb2_posix.h" - #include "lib/util/string_wrappers.h" - #include "source3/printing/rap_jobid.h" -+#include "source3/lib/substitute.h" - - /**************************************************************************** - Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext -diff --git a/source3/smbd/server.c b/source3/smbd/server.c -index d7f5b4b73c0..d02ff1bd883 100644 ---- a/source3/smbd/server.c -+++ b/source3/smbd/server.c -@@ -60,6 +60,7 @@ - #include "rpc_server/fssd.h" - #include "rpc_server/mdssd.h" - #include "lib/global_contexts.h" -+#include "source3/lib/substitute.h" - - #ifdef CLUSTER_SUPPORT - #include "ctdb_protocol.h" -diff --git a/source3/smbd/service.c b/source3/smbd/service.c -index afdea38b016..ef7c14d92d0 100644 ---- a/source3/smbd/service.c -+++ b/source3/smbd/service.c -@@ -34,6 +34,7 @@ - #include "lib/afs/afs_funcs.h" - #include "lib/util_path.h" - #include "lib/util/string_wrappers.h" -+#include "source3/lib/substitute.h" - - bool canonicalize_connect_path(connection_struct *conn) - { -diff --git a/source3/smbd/sesssetup.c b/source3/smbd/sesssetup.c -index 2bd527ce80e..1705b8920b6 100644 ---- a/source3/smbd/sesssetup.c -+++ b/source3/smbd/sesssetup.c -@@ -34,6 +34,7 @@ - #include "auth/gensec/gensec.h" - #include "../libcli/smb/smb_signing.h" - #include "lib/util/string_wrappers.h" -+#include "source3/lib/substitute.h" - - /**************************************************************************** - Add the standard 'Samba' signature to the end of the session setup. -diff --git a/source3/smbd/share_access.c b/source3/smbd/share_access.c -index debe4fc6385..c44c4bd8c69 100644 ---- a/source3/smbd/share_access.c -+++ b/source3/smbd/share_access.c -@@ -23,6 +23,7 @@ - #include "../libcli/security/security.h" - #include "passdb/lookup_sid.h" - #include "auth.h" -+#include "source3/lib/substitute.h" - - /* - * We dropped NIS support in 2021, but need to keep configs working. -diff --git a/source3/smbd/smb2_server.c b/source3/smbd/smb2_server.c -index f359db0729d..f6b376e5a07 100644 ---- a/source3/smbd/smb2_server.c -+++ b/source3/smbd/smb2_server.c -@@ -33,6 +33,7 @@ - #include "lib/util/iov_buf.h" - #include "auth.h" - #include "libcli/smb/smbXcli_base.h" -+#include "source3/lib/substitute.h" - - #if defined(LINUX) - /* SIOCOUTQ TIOCOUTQ are the same */ -diff --git a/source3/smbd/smb2_sesssetup.c b/source3/smbd/smb2_sesssetup.c -index 38049e8535f..14b806bc007 100644 ---- a/source3/smbd/smb2_sesssetup.c -+++ b/source3/smbd/smb2_sesssetup.c -@@ -28,6 +28,7 @@ - #include "../lib/tsocket/tsocket.h" - #include "../libcli/security/security.h" - #include "../lib/util/tevent_ntstatus.h" -+#include "source3/lib/substitute.h" - - #include "lib/crypto/gnutls_helpers.h" - #include -diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c -index cd6b61429c5..a86ac3228e3 100644 ---- a/source3/smbd/trans2.c -+++ b/source3/smbd/trans2.c -@@ -45,6 +45,7 @@ - #include "smb1_utils.h" - #include "libcli/smb/smb2_posix.h" - #include "lib/util/string_wrappers.h" -+#include "source3/lib/substitute.h" - - #define DIR_ENTRY_SAFETY_MARGIN 4096 - -diff --git a/source3/smbd/uid.c b/source3/smbd/uid.c -index b0d7f21c200..52918c4f181 100644 ---- a/source3/smbd/uid.c -+++ b/source3/smbd/uid.c -@@ -26,6 +26,7 @@ - #include "passdb/lookup_sid.h" - #include "auth.h" - #include "../auth/auth_util.h" -+#include "source3/lib/substitute.h" - - /* what user is current? */ - extern struct current_user current_user; -diff --git a/source3/torture/torture.c b/source3/torture/torture.c -index 79a9c65073c..d3e0e3cf095 100644 ---- a/source3/torture/torture.c -+++ b/source3/torture/torture.c -@@ -51,6 +51,7 @@ - #include "lib/param/param.h" - #include "auth/gensec/gensec.h" - #include "lib/util/string_wrappers.h" -+#include "source3/lib/substitute.h" - - #include - #include -diff --git a/source3/utils/net_sam.c b/source3/utils/net_sam.c -index 6a2c6c861f9..17cc47b2ddd 100644 ---- a/source3/utils/net_sam.c -+++ b/source3/utils/net_sam.c -@@ -33,6 +33,7 @@ - #include "idmap.h" - #include "lib/util/smb_strtox.h" - #include "lib/util/string_wrappers.h" -+#include "source3/lib/substitute.h" - - /* - * Set a user's data -diff --git a/source3/winbindd/wb_getpwsid.c b/source3/winbindd/wb_getpwsid.c -index fb0351ec201..7f168bdda7a 100644 ---- a/source3/winbindd/wb_getpwsid.c -+++ b/source3/winbindd/wb_getpwsid.c -@@ -22,6 +22,7 @@ - #include "librpc/gen_ndr/ndr_winbind_c.h" - #include "../libcli/security/security.h" - #include "lib/util/string_wrappers.h" -+#include "source3/lib/substitute.h" - - struct wb_getpwsid_state { - struct tevent_context *ev; -diff --git a/source3/winbindd/winbindd.c b/source3/winbindd/winbindd.c -index 25d8b723010..290454619a4 100644 ---- a/source3/winbindd/winbindd.c -+++ b/source3/winbindd/winbindd.c -@@ -51,6 +51,7 @@ - #include "lib/gencache.h" - #include "rpc_server/rpc_config.h" - #include "lib/global_contexts.h" -+#include "source3/lib/substitute.h" - - #undef DBGC_CLASS - #define DBGC_CLASS DBGC_WINBIND --- -2.33.1 - - -From 1184733a1628c1187a215956195ca806419db16d Mon Sep 17 00:00:00 2001 -From: Ralph Boehme -Date: Thu, 11 Nov 2021 05:23:09 +0100 -Subject: [PATCH 2/8] samba-bgqd: fix startup and logging - -Let samba-bgqd use the new POPT_COMMON_DAEMON infrastructure. - -The calls to setup_logging() can safely be removed as this is already taken care -of by samba_cmdline_init(). - -To avoid a logfile basename of ".log" when using "%m", we add a call to -set_remote_machine_name(). - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897 - -Signed-off-by: Ralph Boehme ---- - source3/printing/samba-bgqd.c | 35 ++++++++++------------------------- - 1 file changed, 10 insertions(+), 25 deletions(-) - -diff --git a/source3/printing/samba-bgqd.c b/source3/printing/samba-bgqd.c -index 8ac6ec525b2..2cd6a8e007a 100644 ---- a/source3/printing/samba-bgqd.c -+++ b/source3/printing/samba-bgqd.c -@@ -40,6 +40,7 @@ - #include "source3/lib/util_procid.h" - #include "source3/auth/proto.h" - #include "source3/printing/queue_process.h" -+#include "source3/lib/substitute.h" - - static void watch_handler(struct tevent_req *req) - { -@@ -235,6 +236,7 @@ static int closeall_except_fd_params( - - int main(int argc, const char *argv[]) - { -+ struct samba_cmdline_daemon_cfg *cmdline_daemon_cfg = NULL; - const struct loadparm_substitution *lp_sub = - loadparm_s3_global_substitution(); - const char *progname = getprogname(); -@@ -245,8 +247,6 @@ int main(int argc, const char *argv[]) - struct tevent_req *watch_req = NULL; - struct tevent_signal *sigterm_handler = NULL; - struct bq_state *bq = NULL; -- int foreground = 0; -- int no_process_group = 0; - int log_stdout = 0; - int ready_signal_fd = -1; - int watch_fd = -1; -@@ -259,21 +259,7 @@ int main(int argc, const char *argv[]) - struct poptOption long_options[] = { - POPT_AUTOHELP - POPT_COMMON_SAMBA -- { -- .longName = "foreground", -- .shortName = 'F', -- .argInfo = POPT_ARG_NONE, -- .arg = &foreground, -- .descrip = "Run daemon in foreground " -- "(for daemontools, etc.)", -- }, -- { -- .longName = "no-process-group", -- .shortName = '\0', -- .argInfo = POPT_ARG_NONE, -- .arg = &no_process_group, -- .descrip = "Don't create a new process group" , -- }, -+ POPT_COMMON_DAEMON - - /* - * File descriptor to write the PID of the helper -@@ -311,6 +297,7 @@ int main(int argc, const char *argv[]) - frame = talloc_stackframe(); - - umask(0); -+ set_remote_machine_name("smbd-bgqd", true); - - ok = samba_cmdline_init(frame, - SAMBA_CMDLINE_CONFIG_SERVER, -@@ -320,6 +307,8 @@ int main(int argc, const char *argv[]) - exit(ENOMEM); - } - -+ cmdline_daemon_cfg = samba_cmdline_get_daemon_cfg(); -+ - pc = samba_popt_get_context(progname, - argc, - argv, -@@ -340,16 +329,12 @@ int main(int argc, const char *argv[]) - - log_stdout = (debug_get_log_type() == DEBUG_STDOUT); - -- if (foreground) { -+ if (!cmdline_daemon_cfg->fork) { - daemon_status(progname, "Starting process ... "); - } else { -- become_daemon(true, no_process_group, log_stdout); -- } -- -- if (log_stdout) { -- setup_logging(progname, DEBUG_STDOUT); -- } else { -- setup_logging(progname, DEBUG_FILE); -+ become_daemon(true, -+ cmdline_daemon_cfg->no_process_group, -+ log_stdout); - } - - BlockSignals(true, SIGPIPE); --- -2.33.1 - - -From 1a0a1ccbe888332ea134b16bfac0d0d011bf1f4c Mon Sep 17 00:00:00 2001 -From: Ralph Boehme -Date: Wed, 10 Nov 2021 18:27:08 +0100 -Subject: [PATCH 3/8] winbindd: remove is_default_dyn_LOGFILEBASE() logic - -Handling of -l commandline parameter is already implemented by lib/cmdline/. - -is_default_dyn_LOGFILEBASE() == true is the default case and this causes us to -temporarily overwrite the configured logfile with LOGFILEBASE/log.winbindd until -winbindd_reload_services_file() restores it. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897 - -Signed-off-by: Ralph Boehme ---- - source3/winbindd/winbindd.c | 9 --------- - 1 file changed, 9 deletions(-) - -diff --git a/source3/winbindd/winbindd.c b/source3/winbindd/winbindd.c -index 290454619a4..58c5ffbced4 100644 ---- a/source3/winbindd/winbindd.c -+++ b/source3/winbindd/winbindd.c -@@ -1717,15 +1717,6 @@ int main(int argc, const char **argv) - - poptFreeContext(pc); - -- if (is_default_dyn_LOGFILEBASE()) { -- char *lfile = NULL; -- if (asprintf(&lfile,"%s/log.winbindd", -- get_dyn_LOGFILEBASE()) > 0) { -- lp_set_logfile(lfile); -- SAFE_FREE(lfile); -- } -- } -- - reopen_logs(); - - DEBUG(0,("winbindd version %s started.\n", samba_version_string())); --- -2.33.1 - - -From bcbf9fb6669933cc3dcf1f615d2885c542a08035 Mon Sep 17 00:00:00 2001 -From: Ralph Boehme -Date: Wed, 10 Nov 2021 14:13:11 +0100 -Subject: [PATCH 4/8] lib/debug: fix fd check before dup'ing to stderr - -Before I added per-class logfile and we had only one fd for the logfile the code -looked like this: - - /* Take over stderr to catch output into logs */ - if (state.fd > 0) { - if (dup2(state.fd, 2) == -1) { - /* Close stderr too, if dup2 can't point it - - at the logfile. There really isn't much - that can be done on such a fundamental - failure... */ - close_low_fd(2); - } - } - -In the current code the equivalent to state.fd is dbgc_config[DBGC_ALL].fd. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897 - -Signed-off-by: Ralph Boehme ---- - lib/util/debug.c | 3 +-- - 1 file changed, 1 insertion(+), 2 deletions(-) - -diff --git a/lib/util/debug.c b/lib/util/debug.c -index 4fd17679227..b271608621a 100644 ---- a/lib/util/debug.c -+++ b/lib/util/debug.c -@@ -1125,7 +1125,6 @@ bool reopen_logs_internal(void) - { - struct debug_backend *b = NULL; - mode_t oldumask; -- int new_fd = 0; - size_t i; - bool ok; - -@@ -1190,7 +1189,7 @@ bool reopen_logs_internal(void) - * If log file was opened or created successfully, take over stderr to - * catch output into logs. - */ -- if (new_fd != -1) { -+ if (dbgc_config[DBGC_ALL].fd > 0) { - if (dup2(dbgc_config[DBGC_ALL].fd, 2) == -1) { - /* Close stderr too, if dup2 can't point it - - at the logfile. There really isn't much --- -2.33.1 - - -From 9f76bd48d87eb03c66dfe942b4a84e997a8fe8ba Mon Sep 17 00:00:00 2001 -From: Ralph Boehme -Date: Mon, 8 Nov 2021 19:41:50 +0100 -Subject: [PATCH 5/8] lib/debug: in debug_set_logfile() call - reopen_logs_internal() - -This simplifies the logging API for callers that typically would want to set -logging by just setup_logging() once without bothering that typically -configuration is loaded (via some lpcfg_load*() or lp_load*() varient) which -will only then pick up the configured logfile from smb.conf without actually -applying the new logifle to the logging subsytem. - -Therefor our daemons will additionally call reopen_logs() explicitly in their -startup code after config is loaded, eg - - setup_logging(getprogname(), DEBUG_FILE); - ... - lpcfg_load(lp_ctx, config_file); - ... - reopen_logs(); - -By calling reopen_logs_internal() implicitly from debug_set_logfile() there's no -need to call reopen_logs() explicitly anymore to apply the logfile. - -As reopen_logs() will also apply other logging configuration options, we have to -keep the explicit calls in the daemon code. But at least this allows consistent -logging setup wrt to the logfile in the new cmdline library. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897 - -Signed-off-by: Ralph Boehme ---- - lib/util/debug.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/lib/util/debug.c b/lib/util/debug.c -index b271608621a..171b5e15008 100644 ---- a/lib/util/debug.c -+++ b/lib/util/debug.c -@@ -1018,6 +1018,8 @@ void debug_set_logfile(const char *name) - } - TALLOC_FREE(dbgc_config[DBGC_ALL].logfile); - dbgc_config[DBGC_ALL].logfile = talloc_strdup(NULL, name); -+ -+ reopen_logs_internal(); - } - - static void debug_close_fd(int fd) --- -2.33.1 - - -From b80911bc1a306cac479ee3feabdcea124946cdde Mon Sep 17 00:00:00 2001 -From: Ralph Boehme -Date: Mon, 8 Nov 2021 12:08:47 +0100 -Subject: [PATCH 6/8] lib/cmdline: fix indentation - -s/whitespace/tab/ - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897 - -Signed-off-by: Ralph Boehme ---- - lib/cmdline/cmdline_s3.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/lib/cmdline/cmdline_s3.c b/lib/cmdline/cmdline_s3.c -index 1f8d9ed5eb5..639d403aed3 100644 ---- a/lib/cmdline/cmdline_s3.c -+++ b/lib/cmdline/cmdline_s3.c -@@ -55,7 +55,7 @@ static bool _samba_cmdline_load_config_s3(void) - case SAMBA_CMDLINE_CONFIG_CLIENT: - ok = lp_load_client(config_file); - break; -- case SAMBA_CMDLINE_CONFIG_SERVER: -+ case SAMBA_CMDLINE_CONFIG_SERVER: - { - const struct samba_cmdline_daemon_cfg *cmdline_daemon_cfg = - samba_cmdline_get_daemon_cfg(); --- -2.33.1 - - -From a6b6b0b6e6dfcd2c8e2c2085d20cd16c51e3b379 Mon Sep 17 00:00:00 2001 -From: Ralph Boehme -Date: Mon, 8 Nov 2021 12:09:16 +0100 -Subject: [PATCH 7/8] lib/cmdline: remember config_type in samba_cmdline_init() - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897 - -Signed-off-by: Ralph Boehme ---- - lib/cmdline/cmdline_s4.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/lib/cmdline/cmdline_s4.c b/lib/cmdline/cmdline_s4.c -index 61c1b96ba8d..6ef6f59db49 100644 ---- a/lib/cmdline/cmdline_s4.c -+++ b/lib/cmdline/cmdline_s4.c -@@ -25,6 +25,7 @@ - #include "cmdline_private.h" - - static bool _require_smbconf; -+static enum samba_cmdline_config_type _config_type; - - static bool _samba_cmdline_load_config_s4(void) - { -@@ -81,6 +82,7 @@ bool samba_cmdline_init(TALLOC_CTX *mem_ctx, - return false; - } - _require_smbconf = require_smbconf; -+ _config_type = config_type; - - creds = cli_credentials_init(mem_ctx); - if (creds == NULL) { --- -2.33.1 - - -From e1d6ab1b0dbd8ff30019edf804c4766b066db4b7 Mon Sep 17 00:00:00 2001 -From: Ralph Boehme -Date: Mon, 8 Nov 2021 12:09:43 +0100 -Subject: [PATCH 8/8] lib/cmdline: setup default file logging for servers - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897 -RN: samba process doesn't log to logfile - -Signed-off-by: Ralph Boehme ---- - lib/cmdline/cmdline_s4.c | 14 ++++++++++++++ - 1 file changed, 14 insertions(+) - -diff --git a/lib/cmdline/cmdline_s4.c b/lib/cmdline/cmdline_s4.c -index 6ef6f59db49..29e9f34bbe2 100644 ---- a/lib/cmdline/cmdline_s4.c -+++ b/lib/cmdline/cmdline_s4.c -@@ -44,6 +44,20 @@ static bool _samba_cmdline_load_config_s4(void) - } - } - -+ switch (_config_type) { -+ case SAMBA_CMDLINE_CONFIG_SERVER: { -+ const struct samba_cmdline_daemon_cfg *cmdline_daemon_cfg = -+ samba_cmdline_get_daemon_cfg(); -+ -+ if (!cmdline_daemon_cfg->interactive) { -+ setup_logging(getprogname(), DEBUG_FILE); -+ } -+ break; -+ } -+ default: -+ break; -+ } -+ - config_file = get_dyn_CONFIGFILE(); - ok = lpcfg_load(lp_ctx, config_file); - if (!ok) { --- -2.33.1 - diff --git a/samba-4.15.1-winexe.patch b/samba-4.15.1-winexe.patch deleted file mode 100644 index 38460b3..0000000 --- a/samba-4.15.1-winexe.patch +++ /dev/null @@ -1,61 +0,0 @@ -From 3d02bf10d7738fe604b524863764de3ca1faa081 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?G=C3=BCnther=20Deschner?= -Date: Thu, 4 Nov 2021 22:22:44 +0100 -Subject: [PATCH] s3-winexe: Fix winexe core dump (use-after-free) -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14893 - -Guenther - -Signed-off-by: Guenther Deschner -Reviewed-by: Andreas Schneider - -Autobuild-User(master): Günther Deschner -Autobuild-Date(master): Fri Nov 5 11:43:57 UTC 2021 on sn-devel-184 - -(cherry picked from commit e9495d2ed28a26899dc3dd77bdfe56e284980218) ---- - examples/winexe/winexe.c | 16 ++++++++++++---- - 1 file changed, 12 insertions(+), 4 deletions(-) - -diff --git a/examples/winexe/winexe.c b/examples/winexe/winexe.c -index 3e0813a4091..59fb9dbdebb 100644 ---- a/examples/winexe/winexe.c -+++ b/examples/winexe/winexe.c -@@ -220,8 +220,6 @@ static void parse_args(int argc, const char *argv[], - *port_str = '\0'; - } - -- poptFreeContext(pc); -- - if (options->runas == NULL && options->runas_file != NULL) { - struct cli_credentials *runas_cred; - const char *user; -@@ -253,9 +251,19 @@ static void parse_args(int argc, const char *argv[], - - options->credentials = samba_cmdline_get_creds(); - -- options->hostname = argv_new[0] + 2; -+ options->hostname = talloc_strdup(mem_ctx, argv_new[0] + 2); -+ if (options->hostname == NULL) { -+ DBG_ERR("Out of memory\n"); -+ exit(1); -+ } - options->port = port; -- options->cmd = argv_new[1]; -+ options->cmd = talloc_strdup(mem_ctx, argv_new[1]); -+ if (options->cmd == NULL) { -+ DBG_ERR("Out of memory\n"); -+ exit(1); -+ } -+ -+ poptFreeContext(pc); - - options->flags = flag_interactive; - if (flag_reinstall) { --- -2.33.1 - diff --git a/samba-4.15.2-smbclient_anonymous.patch b/samba-4.15.2-smbclient_anonymous.patch deleted file mode 100644 index 477ddef..0000000 --- a/samba-4.15.2-smbclient_anonymous.patch +++ /dev/null @@ -1,58 +0,0 @@ -From 61fd63d70578043de9f3bff1c3267c499dbf50a0 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Wed, 10 Nov 2021 12:06:51 +0100 -Subject: [PATCH] auth:creds: Guess the username first via getpwuid(my_id) - -If we have a container, we often don't have USER or LOGNAME set. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14883 - -Tested-by: Anoop C S -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher -(cherry picked from commit c28be4067463e582e378df402f812e510883d606) ---- - auth/credentials/credentials.c | 13 +++++++++++++ - 1 file changed, 13 insertions(+) - -diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c -index 02a3cf3b354..c5a6ba6940c 100644 ---- a/auth/credentials/credentials.c -+++ b/auth/credentials/credentials.c -@@ -30,6 +30,7 @@ - #include "tevent.h" - #include "param/param.h" - #include "system/filesys.h" -+#include "system/passwd.h" - - /** - * Create a new credentials structure -@@ -1159,6 +1160,7 @@ _PUBLIC_ bool cli_credentials_guess(struct cli_credentials *cred, - { - const char *error_string; - const char *env = NULL; -+ struct passwd *pwd = NULL; - bool ok; - - if (lp_ctx != NULL) { -@@ -1168,6 +1170,17 @@ _PUBLIC_ bool cli_credentials_guess(struct cli_credentials *cred, - } - } - -+ pwd = getpwuid(getuid()); -+ if (pwd != NULL) { -+ size_t len = strlen(pwd->pw_name); -+ -+ if (len > 0 && len <= 1024) { -+ (void)cli_credentials_parse_string(cred, -+ pwd->pw_name, -+ CRED_GUESS_ENV); -+ } -+ } -+ - env = getenv("LOGNAME"); - if (env != NULL) { - size_t len = strlen(env); --- -2.33.1 - diff --git a/samba.spec b/samba.spec index a1b91fe..9f40278 100644 --- a/samba.spec +++ b/samba.spec @@ -132,9 +132,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 3 +%global baserelease 0 -%global samba_version 4.15.2 +%global samba_version 4.15.3 %global talloc_version 2.3.3 %global tdb_version 1.4.4 %global tevent_version 0.11.0 @@ -203,11 +203,6 @@ Source201: README.downgrade Patch0: samba-s4u.patch Patch1: samba-ctdb-etcd-reclock.patch -Patch2: samba-4.15.1-winexe.patch -Patch3: samba-4.15-fix-winbind-no-trusted-domain.patch -Patch4: samba-4.15-logfile.patch -Patch5: samba-4.15.2-smbclient_anonymous.patch -Patch6: samba-4.15-ipa-dc-schannel.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -2934,6 +2929,7 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/spn_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/s4u_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_ccache.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/test_idmap_nss.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_ldap.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_min_domain_uid.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_rpc.*.pyc @@ -2957,6 +2953,7 @@ fi %{python3_sitearch}/samba/tests/krb5/simple_tests.py %{python3_sitearch}/samba/tests/krb5/spn_tests.py %{python3_sitearch}/samba/tests/krb5/test_ccache.py +%{python3_sitearch}/samba/tests/krb5/test_idmap_nss.py %{python3_sitearch}/samba/tests/krb5/test_ldap.py %{python3_sitearch}/samba/tests/krb5/test_min_domain_uid.py %{python3_sitearch}/samba/tests/krb5/test_rpc.py @@ -4102,6 +4099,10 @@ fi %endif %changelog +* Wed Dec 08 2021 Pavel Filipenský - 4.15.3-0 +- Update to Samba 4.15.3 +- resolves: #2030382 + * Sat Nov 13 2021 Guenther Deschner - 4.15.2-3 - Fix IPA DC schannel support diff --git a/sources b/sources index 0516493..4f508a2 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.15.2.tar.xz) = d9aaabbf45ba0293dbda137a21f04d5fa533be07c3826de816513d8e2ae0ef6e6109ce4045dd74bcd5375364f6de5fa8ace6ae4b3c419bfffe55fa2bfeeb0d5d -SHA512 (samba-4.15.2.tar.asc) = 732cc215c047988d4bce3d2ea981474f0cca44dd5a22030f49343aa3a37f6003bb84b116f7cdb0c8c4fd492354c107350f78101d7186fcb6027906ab1c92cf31 +SHA512 (samba-4.15.3.tar.xz) = c8bf3dd25a79e90bb01a8f74e1961ab5892a62a7a4556a42880911aeb4120b7645b91a20438f98652c1f870b7c699038b745565bcf5f4dba634ce400b5fbe167 +SHA512 (samba-4.15.3.tar.asc) = 9af712fdfd01e701b6a2f7e903c1d750b4697282b00b2b150d4e3014e70a09733910291b7e44abeefd0ce7ad393d500c338145a2a00638d9191777a90be8636c From 3314e8e15a3555de291c03e1f6d996ad6b732d30 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 9 Dec 2021 19:11:22 +0100 Subject: [PATCH 161/425] Add missing Requires --- samba.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/samba.spec b/samba.spec index 9f40278..186d651 100644 --- a/samba.spec +++ b/samba.spec @@ -606,6 +606,7 @@ Samba VFS module for Ceph distributed storage system integration. Summary: Samba VFS module for io_uring Requires: %{name} = %{samba_depver} Requires: %{name}-libs = %{samba_depver} +Requires: %{name}-client-libs = %{samba_depver} Provides: bundled(libreplace) @@ -942,6 +943,7 @@ necessary to communicate to the Winbind Daemon Summary: Samba Winexe Windows Binary License: GPLv3 Requires: %{name}-client-libs = %{samba_depver} +Requires: %{name}-common-libs = %{samba_depver} Provides: bundled(libreplace) From 8a81633e9ac9c806a0c8072daad5fd4ff2644b81 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Wed, 15 Dec 2021 12:33:50 +0100 Subject: [PATCH 162/425] Fix resolv_wrapper with glibc 2.34 resolves: #2019669 pfilipen --- samba-glibc-dns.patch | 64 +++++++++++++++++++++++++++++++++++++++++++ samba.spec | 7 ++++- 2 files changed, 70 insertions(+), 1 deletion(-) create mode 100644 samba-glibc-dns.patch diff --git a/samba-glibc-dns.patch b/samba-glibc-dns.patch new file mode 100644 index 0000000..c01d481 --- /dev/null +++ b/samba-glibc-dns.patch @@ -0,0 +1,64 @@ +From e556b4067e0c4036e20fc26523e3b4d6d5c6be42 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 7 Oct 2021 15:55:37 +0200 +Subject: [PATCH] waf: Fix resolv_wrapper with glibc 2.34 + +With glibc 2.34 we are not able to talk to the DNS server via socket_wrapper +anymore. The res_* symbols have been moved from libresolv to libc. We are not +able to intercept any traffic inside of libc. + +Signed-off-by: Andreas Schneider +Reviewed-by: Andreas Schneider +Reviewed-by: Alexander Bokovoy +--- + selftest/wscript | 2 +- + third_party/resolv_wrapper/wscript | 13 +++++++++++++ + 2 files changed, 14 insertions(+), 1 deletion(-) + +diff --git a/selftest/wscript b/selftest/wscript +index a6be06c2ae9..85d9338489a 100644 +--- a/selftest/wscript ++++ b/selftest/wscript +@@ -252,7 +252,7 @@ def cmd_testonly(opt): + if os.environ.get('USE_NAMESPACES') is None: + env.OPTIONS += " --socket_wrapper_so_path=" + CONFIG_GET(opt, 'LIBSOCKET_WRAPPER_SO_PATH') + +- if Utils.unversioned_sys_platform() in ('netbsd', 'openbsd', 'sunos'): ++ if not CONFIG_SET(opt, 'HAVE_RESOLV_CONF_SUPPORT'): + env.OPTIONS += " --use-dns-faking" + + if CONFIG_GET(opt, 'USING_SYSTEM_KRB5') and CONFIG_GET(opt, 'MIT_KDC_PATH'): +diff --git a/third_party/resolv_wrapper/wscript b/third_party/resolv_wrapper/wscript +index a7f18389b0f..7e369bd90b5 100644 +--- a/third_party/resolv_wrapper/wscript ++++ b/third_party/resolv_wrapper/wscript +@@ -1,6 +1,7 @@ + #!/usr/bin/env python + + import os ++from waflib import Logs + + VERSION="1.1.7" + +@@ -49,6 +50,18 @@ def configure(conf): + if conf.CONFIG_SET('HAVE_RES_NCLOSE'): + conf.DEFINE('HAVE_RES_NCLOSE_IN_LIBRESOLV', 1) + ++ # If we find res_nquery in libc, we can't do resolv.conf redirect ++ conf.CHECK_FUNCS('res_nquery __res_nquery') ++ if (conf.CONFIG_SET('HAVE_RES_NQUERY') ++ or conf.CONFIG_SET('HAVE___RES_NQUERY')): ++ Logs.warn("Detection for resolv_wrapper: " ++ "Only dns faking will be available") ++ else: ++ if conf.CHECK_FUNCS('res_nquery', lib='resolv'): ++ conf.DEFINE('HAVE_RESOLV_CONF_SUPPORT', 1) ++ if conf.CHECK_FUNCS('__res_nquery', lib='resolv'): ++ conf.DEFINE('HAVE_RESOLV_CONF_SUPPORT', 1) ++ + conf.CHECK_FUNCS_IN('res_init __res_init', 'resolv', checklibc=True) + conf.CHECK_FUNCS_IN('res_ninit __res_ninit', 'resolv', checklibc=True) + conf.CHECK_FUNCS_IN('res_close __res_close', 'resolv', checklibc=True) +-- +2.33.1 + diff --git a/samba.spec b/samba.spec index 186d651..21de1ec 100644 --- a/samba.spec +++ b/samba.spec @@ -132,7 +132,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 0 +%global baserelease 1 %global samba_version 4.15.3 %global talloc_version 2.3.3 @@ -203,6 +203,7 @@ Source201: README.downgrade Patch0: samba-s4u.patch Patch1: samba-ctdb-etcd-reclock.patch +Patch2: samba-glibc-dns.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -4101,6 +4102,10 @@ fi %endif %changelog +* Wed Dec 15 2021 Pavel Filipenský - 4.15.3-1 +- Fix resolv_wrapper with glibc 2.34 +- resolves: #2019669 + * Wed Dec 08 2021 Pavel Filipenský - 4.15.3-0 - Update to Samba 4.15.3 - resolves: #2030382 From 13dfbb0767d59816324735397c03f66bc5bbd4ae Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 10 Jan 2022 15:08:40 +0100 Subject: [PATCH 163/425] Require python3-pyasn1 >= 0.4.8 --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 21de1ec..ed14fa2 100644 --- a/samba.spec +++ b/samba.spec @@ -325,7 +325,7 @@ BuildRequires: python3-etcd # Add python3-iso8601 to avoid that the # version in Samba is being packaged BuildRequires: python3-iso8601 -BuildRequires: python3-pyasn1 +BuildRequires: python3-pyasn1 >= 0.4.8 BuildRequires: bind BuildRequires: krb5-server >= %{required_mit_krb5} From 6da37eb4caf55a03cb6fc1b3c2f01167a99c71ae Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Wed, 19 Jan 2022 20:49:26 +0100 Subject: [PATCH 164/425] Update to Samba 4.15.4 resolves: #2009673, #2039034 - Security fixes for CVE-2021-20316 resolves: #2042518 pfilipen --- .gitignore | 2 ++ samba.spec | 9 +++++++-- sources | 4 ++-- 3 files changed, 11 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 23cef85..2fc9487 100644 --- a/.gitignore +++ b/.gitignore @@ -275,3 +275,5 @@ samba-3.6.0pre1.tar.gz /samba-4.15.2.tar.asc /samba-4.15.3.tar.xz /samba-4.15.3.tar.asc +/samba-4.15.4.tar.xz +/samba-4.15.4.tar.asc diff --git a/samba.spec b/samba.spec index ed14fa2..b7a0cc7 100644 --- a/samba.spec +++ b/samba.spec @@ -132,9 +132,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 1 +%global baserelease 0 -%global samba_version 4.15.3 +%global samba_version 4.15.4 %global talloc_version 2.3.3 %global tdb_version 1.4.4 %global tevent_version 0.11.0 @@ -4102,6 +4102,11 @@ fi %endif %changelog +* Thu Jan 20 2022 Pavel Filipenský - 4.15.4-0 +- Update to Samba 4.15.4 +- resolves: #2009673, #2039034 - Security fixes for CVE-2021-20316 +- resolves: #2042518 + * Wed Dec 15 2021 Pavel Filipenský - 4.15.3-1 - Fix resolv_wrapper with glibc 2.34 - resolves: #2019669 diff --git a/sources b/sources index 4f508a2..343898f 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.15.3.tar.xz) = c8bf3dd25a79e90bb01a8f74e1961ab5892a62a7a4556a42880911aeb4120b7645b91a20438f98652c1f870b7c699038b745565bcf5f4dba634ce400b5fbe167 -SHA512 (samba-4.15.3.tar.asc) = 9af712fdfd01e701b6a2f7e903c1d750b4697282b00b2b150d4e3014e70a09733910291b7e44abeefd0ce7ad393d500c338145a2a00638d9191777a90be8636c +SHA512 (samba-4.15.4.tar.xz) = 19aa7edc55d545c42ba9c2d2bb987df63a825c5a1a6fa2a350d6bca41f04fde6f63b643f6e38d32f4d4067c24420e1ca62ef28dc285c70105ca78487e80ee2dc +SHA512 (samba-4.15.4.tar.asc) = 6878efc500f423e7061966954163ef3503e4ab43a527b370a3e26e6992bc9b6a3161e296800b6cd78d5e0d99ac7f1db249d52c2475d035973e2121bc67df6fab From c1f9bec1db866b6ca644f1fe143868e126703b8a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Fri, 21 Jan 2022 11:46:51 +0100 Subject: [PATCH 165/425] Switch off ld.gold --- samba.spec | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index b7a0cc7..2851bcc 100644 --- a/samba.spec +++ b/samba.spec @@ -1106,7 +1106,8 @@ xzcat %{SOURCE0} | gpgv2 --quiet --keyring %{SOURCE2} %{SOURCE1} - export python_LDFLAGS="$(echo %{__global_ldflags} | sed -e 's/-Wl,-z,defs//g')" # Use the gold linker -export LDFLAGS="%{__global_ldflags} -fuse-ld=gold" +# See https://bugzilla.redhat.com/show_bug.cgi?id=2043178 ; For f36 do not use ld.gold till it is fixed +#export LDFLAGS="%%{__global_ldflags} -fuse-ld=gold" %configure \ --enable-fhs \ From c8ac21e6f141f89c7aa2977048351c10c64efa47 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 25 Jan 2022 11:55:29 +0100 Subject: [PATCH 166/425] Update to Samba 4.16.0rc1 --- .gitignore | 2 + samba-ctdb-etcd-reclock.patch | 30 ------- samba-glibc-dns.patch | 64 --------------- samba-s4u.patch | 145 ++++++++++++++-------------------- samba.spec | 66 +++++++++++----- sources | 4 +- 6 files changed, 111 insertions(+), 200 deletions(-) delete mode 100644 samba-ctdb-etcd-reclock.patch delete mode 100644 samba-glibc-dns.patch diff --git a/.gitignore b/.gitignore index 2fc9487..a5d7ee7 100644 --- a/.gitignore +++ b/.gitignore @@ -277,3 +277,5 @@ samba-3.6.0pre1.tar.gz /samba-4.15.3.tar.asc /samba-4.15.4.tar.xz /samba-4.15.4.tar.asc +/samba-4.16.0rc1.tar.xz +/samba-4.16.0rc1.tar.asc diff --git a/samba-ctdb-etcd-reclock.patch b/samba-ctdb-etcd-reclock.patch deleted file mode 100644 index 2a55408..0000000 --- a/samba-ctdb-etcd-reclock.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 939aed0498269df3c1e012f3b68c314b583f25bd Mon Sep 17 00:00:00 2001 -From: Martin Schwenke -Date: Tue, 27 Apr 2021 15:46:14 +1000 -Subject: [PATCH] utils: Use Python 3 - -Due to the number of flake8 and pylint warnings it is unclear if the -source has Python 3 incompatibilities. These will be cleaned up in -subsequent commits. - -Signed-off-by: "L.P.H. van Belle" -Reviewed-by: Martin Schwenke -Reviewed-by: David Disseldorp -Reviewed-by: Jose A. Rivera ---- - ctdb/utils/etcd/ctdb_etcd_lock | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/ctdb/utils/etcd/ctdb_etcd_lock b/ctdb/utils/etcd/ctdb_etcd_lock -index 000c6bb7208..7f5194eff0a 100755 ---- a/ctdb/utils/etcd/ctdb_etcd_lock -+++ b/ctdb/utils/etcd/ctdb_etcd_lock -@@ -1,4 +1,4 @@ --#!/usr/bin/python -+#!/usr/bin/env python3 - # - # This program is free software: you can redistribute it and/or modify - # it under the terms of the GNU General Public License as published by --- -2.31.1 - diff --git a/samba-glibc-dns.patch b/samba-glibc-dns.patch deleted file mode 100644 index c01d481..0000000 --- a/samba-glibc-dns.patch +++ /dev/null @@ -1,64 +0,0 @@ -From e556b4067e0c4036e20fc26523e3b4d6d5c6be42 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Thu, 7 Oct 2021 15:55:37 +0200 -Subject: [PATCH] waf: Fix resolv_wrapper with glibc 2.34 - -With glibc 2.34 we are not able to talk to the DNS server via socket_wrapper -anymore. The res_* symbols have been moved from libresolv to libc. We are not -able to intercept any traffic inside of libc. - -Signed-off-by: Andreas Schneider -Reviewed-by: Andreas Schneider -Reviewed-by: Alexander Bokovoy ---- - selftest/wscript | 2 +- - third_party/resolv_wrapper/wscript | 13 +++++++++++++ - 2 files changed, 14 insertions(+), 1 deletion(-) - -diff --git a/selftest/wscript b/selftest/wscript -index a6be06c2ae9..85d9338489a 100644 ---- a/selftest/wscript -+++ b/selftest/wscript -@@ -252,7 +252,7 @@ def cmd_testonly(opt): - if os.environ.get('USE_NAMESPACES') is None: - env.OPTIONS += " --socket_wrapper_so_path=" + CONFIG_GET(opt, 'LIBSOCKET_WRAPPER_SO_PATH') - -- if Utils.unversioned_sys_platform() in ('netbsd', 'openbsd', 'sunos'): -+ if not CONFIG_SET(opt, 'HAVE_RESOLV_CONF_SUPPORT'): - env.OPTIONS += " --use-dns-faking" - - if CONFIG_GET(opt, 'USING_SYSTEM_KRB5') and CONFIG_GET(opt, 'MIT_KDC_PATH'): -diff --git a/third_party/resolv_wrapper/wscript b/third_party/resolv_wrapper/wscript -index a7f18389b0f..7e369bd90b5 100644 ---- a/third_party/resolv_wrapper/wscript -+++ b/third_party/resolv_wrapper/wscript -@@ -1,6 +1,7 @@ - #!/usr/bin/env python - - import os -+from waflib import Logs - - VERSION="1.1.7" - -@@ -49,6 +50,18 @@ def configure(conf): - if conf.CONFIG_SET('HAVE_RES_NCLOSE'): - conf.DEFINE('HAVE_RES_NCLOSE_IN_LIBRESOLV', 1) - -+ # If we find res_nquery in libc, we can't do resolv.conf redirect -+ conf.CHECK_FUNCS('res_nquery __res_nquery') -+ if (conf.CONFIG_SET('HAVE_RES_NQUERY') -+ or conf.CONFIG_SET('HAVE___RES_NQUERY')): -+ Logs.warn("Detection for resolv_wrapper: " -+ "Only dns faking will be available") -+ else: -+ if conf.CHECK_FUNCS('res_nquery', lib='resolv'): -+ conf.DEFINE('HAVE_RESOLV_CONF_SUPPORT', 1) -+ if conf.CHECK_FUNCS('__res_nquery', lib='resolv'): -+ conf.DEFINE('HAVE_RESOLV_CONF_SUPPORT', 1) -+ - conf.CHECK_FUNCS_IN('res_init __res_init', 'resolv', checklibc=True) - conf.CHECK_FUNCS_IN('res_ninit __res_ninit', 'resolv', checklibc=True) - conf.CHECK_FUNCS_IN('res_close __res_close', 'resolv', checklibc=True) --- -2.33.1 - diff --git a/samba-s4u.patch b/samba-s4u.patch index 8e84d96..f447b86 100644 --- a/samba-s4u.patch +++ b/samba-s4u.patch @@ -1,7 +1,7 @@ -From 0b196043f08ea4c025f19c4519175a3a73e1d185 Mon Sep 17 00:00:00 2001 +From 17eb98d3f8ebd0fe48e218bb03a3c0165b9b6e95 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Fri, 27 Sep 2019 18:25:03 +0300 -Subject: [PATCH 1/3] mit-kdc: add basic loacl realm S4U support +Subject: [PATCH 1/4] mit-kdc: add basic loacl realm S4U support Signed-off-by: Isaac Boukris Pair-Programmed-With: Andreas Schneider @@ -12,10 +12,10 @@ Pair-Programmed-With: Andreas Schneider 3 files changed, 71 insertions(+), 106 deletions(-) diff --git a/source4/kdc/mit-kdb/kdb_samba_policies.c b/source4/kdc/mit-kdb/kdb_samba_policies.c -index f35210669c2..b1c7c5dcc5e 100644 +index 793fe366c35..22534c09974 100644 --- a/source4/kdc/mit-kdb/kdb_samba_policies.c +++ b/source4/kdc/mit-kdb/kdb_samba_policies.c -@@ -195,13 +195,17 @@ static krb5_error_code ks_verify_pac(krb5_context context, +@@ -200,13 +200,17 @@ static krb5_error_code ks_verify_pac(krb5_context context, krb5_keyblock *krbtgt_key, krb5_timestamp authtime, krb5_authdata **tgt_auth_data, @@ -36,7 +36,7 @@ index f35210669c2..b1c7c5dcc5e 100644 mit_ctx = ks_get_context(context); if (mit_ctx == NULL) { -@@ -233,41 +237,43 @@ static krb5_error_code ks_verify_pac(krb5_context context, +@@ -238,41 +242,43 @@ static krb5_error_code ks_verify_pac(krb5_context context, code = krb5_pac_parse(context, authdata[0]->contents, authdata[0]->length, @@ -106,7 +106,7 @@ index f35210669c2..b1c7c5dcc5e 100644 if (code != 0) { goto done; } -@@ -275,17 +281,22 @@ static krb5_error_code ks_verify_pac(krb5_context context, +@@ -280,17 +286,22 @@ static krb5_error_code ks_verify_pac(krb5_context context, code = mit_samba_reget_pac(mit_ctx, context, flags, @@ -133,7 +133,7 @@ index f35210669c2..b1c7c5dcc5e 100644 return code; } -@@ -314,6 +325,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, +@@ -319,6 +330,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, krb5_authdata **pac_auth_data = NULL; krb5_authdata **authdata = NULL; krb5_boolean is_as_req; @@ -141,7 +141,7 @@ index f35210669c2..b1c7c5dcc5e 100644 krb5_error_code code; krb5_pac pac = NULL; krb5_data pac_data; -@@ -325,11 +337,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, +@@ -330,11 +342,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, krbtgt = krbtgt == NULL ? local_krbtgt : krbtgt; krbtgt_key = krbtgt_key == NULL ? local_krbtgt_key : krbtgt_key; @@ -153,7 +153,7 @@ index f35210669c2..b1c7c5dcc5e 100644 is_as_req = ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) != 0); /* -@@ -390,6 +397,16 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, +@@ -395,6 +402,16 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, ks_client_princ = client->princ; } @@ -170,7 +170,7 @@ index f35210669c2..b1c7c5dcc5e 100644 if (client_entry == NULL) { client_entry = client; } -@@ -454,7 +471,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, +@@ -469,7 +486,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, code = ks_verify_pac(context, flags, @@ -179,7 +179,7 @@ index f35210669c2..b1c7c5dcc5e 100644 client_entry, server, krbtgt, -@@ -494,7 +511,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, +@@ -515,7 +532,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, is_as_req ? "AS-REQ" : "TGS-REQ", client_name); code = krb5_pac_sign(context, pac, authtime, ks_client_princ, @@ -188,7 +188,7 @@ index f35210669c2..b1c7c5dcc5e 100644 if (code != 0) { DBG_ERR("krb5_pac_sign failed: %d\n", code); goto done; -@@ -520,12 +537,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, +@@ -541,12 +558,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, KRB5_AUTHDATA_IF_RELEVANT, authdata, signed_auth_data); @@ -201,7 +201,7 @@ index f35210669c2..b1c7c5dcc5e 100644 done: if (client_entry != NULL && client_entry != client) { ks_free_principal(context, client_entry); -@@ -551,32 +562,13 @@ krb5_error_code kdb_samba_db_check_allowed_to_delegate(krb5_context context, +@@ -572,32 +583,13 @@ krb5_error_code kdb_samba_db_check_allowed_to_delegate(krb5_context context, * server; -> delegating service * proxy; -> target principal */ @@ -236,10 +236,10 @@ index f35210669c2..b1c7c5dcc5e 100644 diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c -index 4239332f0d9..acc3cba6254 100644 +index 27b15828468..994dfed312b 100644 --- a/source4/kdc/mit_samba.c +++ b/source4/kdc/mit_samba.c -@@ -501,7 +501,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx, +@@ -517,7 +517,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx, krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, krb5_context context, int flags, @@ -247,7 +247,7 @@ index 4239332f0d9..acc3cba6254 100644 krb5_db_entry *client, krb5_db_entry *server, krb5_db_entry *krbtgt, -@@ -665,7 +664,7 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, +@@ -682,7 +681,7 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, context, *pac, server->princ, @@ -256,7 +256,7 @@ index 4239332f0d9..acc3cba6254 100644 deleg_blob); if (!NT_STATUS_IS_OK(nt_status)) { DEBUG(0, ("Update delegation info failed: %s\n", -@@ -987,41 +986,17 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx, +@@ -1004,41 +1003,17 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx, } int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx, @@ -309,10 +309,10 @@ index 4239332f0d9..acc3cba6254 100644 static krb5_error_code mit_samba_change_pwd_error(krb5_context context, diff --git a/source4/kdc/mit_samba.h b/source4/kdc/mit_samba.h -index 636c77ec97c..9cb00c9610e 100644 +index 4431e82a1b2..9370ab533af 100644 --- a/source4/kdc/mit_samba.h +++ b/source4/kdc/mit_samba.h -@@ -56,7 +56,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx, +@@ -57,7 +57,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx, krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, krb5_context context, int flags, @@ -320,7 +320,7 @@ index 636c77ec97c..9cb00c9610e 100644 krb5_db_entry *client, krb5_db_entry *server, krb5_db_entry *krbtgt, -@@ -73,9 +72,8 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx, +@@ -74,9 +73,8 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx, DATA_BLOB *e_data); int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx, @@ -336,10 +336,10 @@ index 636c77ec97c..9cb00c9610e 100644 2.33.1 -From 992d38fa35c01f2f0bdb39d387fa29e8eb8d3d37 Mon Sep 17 00:00:00 2001 +From f4fc23103f47b712baf3b4b0ebcb42d0f3f3fd42 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Fri, 27 Sep 2019 18:35:30 +0300 -Subject: [PATCH 2/3] krb5-mit: enable S4U client support for MIT build +Subject: [PATCH 2/4] krb5-mit: enable S4U client support for MIT build Signed-off-by: Isaac Boukris Pair-Programmed-With: Andreas Schneider @@ -350,10 +350,10 @@ Pair-Programmed-With: Andreas Schneider 3 files changed, 185 insertions(+), 13 deletions(-) diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c -index fff5b4e2a22..791b417d5ba 100644 +index 61d651b4d5f..462acec90b6 100644 --- a/lib/krb5_wrap/krb5_samba.c +++ b/lib/krb5_wrap/krb5_samba.c -@@ -2694,6 +2694,191 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx, +@@ -2699,6 +2699,191 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx, return 0; } @@ -546,7 +546,7 @@ index fff5b4e2a22..791b417d5ba 100644 #if !defined(HAVE_KRB5_MAKE_PRINCIPAL) && defined(HAVE_KRB5_BUILD_PRINCIPAL_ALLOC_VA) diff --git a/lib/krb5_wrap/krb5_samba.h b/lib/krb5_wrap/krb5_samba.h -index eab67f6d969..b5385c69a33 100644 +index a66b7465530..c8573f52bd9 100644 --- a/lib/krb5_wrap/krb5_samba.h +++ b/lib/krb5_wrap/krb5_samba.h @@ -252,7 +252,6 @@ krb5_error_code smb_krb5_kinit_password_ccache(krb5_context ctx, @@ -614,63 +614,20 @@ index 544d9d853cc..c14d8c72d8c 100644 2.33.1 -From f1951b501ca0fb3e613f04437c99dc1bbf204609 Mon Sep 17 00:00:00 2001 +From 48d73d552f2fbbdb07bd9aff4d0294883b70417f Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Sat, 19 Sep 2020 14:16:20 +0200 -Subject: [PATCH 3/3] wip: for canonicalization with new MIT kdc code +Subject: [PATCH 3/4] wip: for canonicalization with new MIT kdc code --- - source4/heimdal/lib/hdb/hdb.h | 1 + - source4/kdc/db-glue.c | 8 ++++++-- - source4/kdc/mit_samba.c | 3 +++ - source4/kdc/sdb.h | 1 + - 4 files changed, 11 insertions(+), 2 deletions(-) + source4/kdc/mit_samba.c | 3 +++ + 1 file changed, 3 insertions(+) -diff --git a/source4/heimdal/lib/hdb/hdb.h b/source4/heimdal/lib/hdb/hdb.h -index 5ef9d9565f3..dafaffc6c2d 100644 ---- a/source4/heimdal/lib/hdb/hdb.h -+++ b/source4/heimdal/lib/hdb/hdb.h -@@ -63,6 +63,7 @@ enum hdb_lockop{ HDB_RLOCK, HDB_WLOCK }; - #define HDB_F_ALL_KVNOS 2048 /* we want all the keys, live or not */ - #define HDB_F_FOR_AS_REQ 4096 /* fetch is for a AS REQ */ - #define HDB_F_FOR_TGS_REQ 8192 /* fetch is for a TGS REQ */ -+#define HDB_F_FORCE_CANON 16384 /* force canonicalition */ - - /* hdb_capability_flags */ - #define HDB_CAP_F_HANDLE_ENTERPRISE_PRINCIPAL 1 -diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c -index aff74f2ee71..d16b4c3329a 100644 ---- a/source4/kdc/db-glue.c -+++ b/source4/kdc/db-glue.c -@@ -916,17 +916,21 @@ static krb5_error_code samba_kdc_message2entry(krb5_context context, - } - } - -- } else if (ent_type == SAMBA_KDC_ENT_TYPE_ANY && principal == NULL) { -+ } else if (ent_type == SAMBA_KDC_ENT_TYPE_ANY && principal == NULL) { // was this supposed to be || ? - ret = smb_krb5_make_principal(context, &entry_ex->entry.principal, lpcfg_realm(lp_ctx), samAccountName, NULL); - if (ret) { - krb5_clear_error_message(context); - goto out; - } -- } else if ((flags & SDB_F_CANON) && (flags & SDB_F_FOR_AS_REQ)) { -+ } else if (((flags & SDB_F_CANON) && (flags & SDB_F_FOR_AS_REQ)) || (flags & SDB_F_FORCE_CANON)){ - /* - * SDB_F_CANON maps from the canonicalize flag in the - * packet, and has a different meaning between AS-REQ - * and TGS-REQ. We only change the principal in the AS-REQ case -+ * -+ * The SDB_F_FORCE_CANON if for the new MIT kdc code that wants -+ * the canonical name in all lookups, and takes care to canonicalize -+ * only when appropriate. - */ - ret = smb_krb5_make_principal(context, &entry_ex->entry.principal, lpcfg_realm(lp_ctx), samAccountName, NULL); - if (ret) { diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c -index acc3cba6254..f0b9df8b613 100644 +index 994dfed312b..9d039e5601b 100644 --- a/source4/kdc/mit_samba.c +++ b/source4/kdc/mit_samba.c -@@ -224,6 +224,9 @@ int mit_samba_get_principal(struct mit_samba_context *ctx, +@@ -232,6 +232,9 @@ int mit_samba_get_principal(struct mit_samba_context *ctx, if (kflags & KRB5_KDB_FLAG_CANONICALIZE) { sflags |= SDB_F_CANON; } @@ -680,18 +637,34 @@ index acc3cba6254..f0b9df8b613 100644 if (kflags & (KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY | KRB5_KDB_FLAG_INCLUDE_PAC)) { /* -diff --git a/source4/kdc/sdb.h b/source4/kdc/sdb.h -index c929acccce6..a9115ec23d7 100644 ---- a/source4/kdc/sdb.h -+++ b/source4/kdc/sdb.h -@@ -116,6 +116,7 @@ struct sdb_entry_ex { - #define SDB_F_KVNO_SPECIFIED 128 /* we want a particular KVNO */ - #define SDB_F_FOR_AS_REQ 4096 /* fetch is for a AS REQ */ - #define SDB_F_FOR_TGS_REQ 8192 /* fetch is for a TGS REQ */ -+#define SDB_F_FORCE_CANON 16384 /* force canonicalition */ - - void sdb_free_entry(struct sdb_entry_ex *e); - void free_sdb_entry(struct sdb_entry *s); +-- +2.33.1 + + +From f5f54026d151f6d899e8ff52d8829a2f9cf57f25 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 21 Dec 2021 12:17:11 +0100 +Subject: [PATCH 4/4] s4:kdc: Also cannoicalize krbtgt principals when + enforcing canonicalization + +Signed-off-by: Andreas Schneider +--- + source4/kdc/db-glue.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c +index 8d17038cfe6..77c0c0e4746 100644 +--- a/source4/kdc/db-glue.c ++++ b/source4/kdc/db-glue.c +@@ -946,7 +946,7 @@ static krb5_error_code samba_kdc_message2entry(krb5_context context, + if (ent_type == SAMBA_KDC_ENT_TYPE_KRBTGT) { + p->is_krbtgt = true; + +- if (flags & (SDB_F_CANON)) { ++ if (flags & (SDB_F_CANON|SDB_F_FORCE_CANON)) { + /* + * When requested to do so, ensure that the + * both realm values in the principal are set -- 2.33.1 diff --git a/samba.spec b/samba.spec index 2851bcc..dc8a9ab 100644 --- a/samba.spec +++ b/samba.spec @@ -134,13 +134,13 @@ %global baserelease 0 -%global samba_version 4.15.4 +%global samba_version 4.16.0 %global talloc_version 2.3.3 -%global tdb_version 1.4.4 +%global tdb_version 1.4.6 %global tevent_version 0.11.0 -%global ldb_version 2.4.1 +%global ldb_version 2.5.0 # This should be rc1 or nil -%global pre_release %nil +%global pre_release rc1 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -202,8 +202,6 @@ Source14: samba.pamd Source201: README.downgrade Patch0: samba-s4u.patch -Patch1: samba-ctdb-etcd-reclock.patch -Patch2: samba-glibc-dns.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -1614,11 +1612,21 @@ fi %{_libdir}/samba/vfs/nfs4acl_xattr.so %endif +%dir %{_libexecdir}/samba %{_libexecdir}/samba/samba-bgqd +%{_libexecdir}/samba/samba-dcerpcd +%{_libexecdir}/samba/rpcd_classic +%{_libexecdir}/samba/rpcd_epmapper +%{_libexecdir}/samba/rpcd_fsrvp +%{_libexecdir}/samba/rpcd_lsad +%{_libexecdir}/samba/rpcd_mdssvc +%{_libexecdir}/samba/rpcd_rpcecho +%{_libexecdir}/samba/rpcd_spoolss +%{_libexecdir}/samba/rpcd_winreg %dir %{_datadir}/samba -%dir %{_datadir}/samba/mdssvc -%{_datadir}/samba/mdssvc/elasticsearch_mappings.json +#%%dir %%{_datadir}/samba/mdssvc +#%%{_datadir}/samba/mdssvc/elasticsearch_mappings.json %{_unitdir}/nmb.service %{_unitdir}/smb.service @@ -1628,6 +1636,7 @@ fi %{_mandir}/man1/smbstatus.1* %{_mandir}/man8/eventlogadm.8* %{_mandir}/man8/samba-bgqd.8* +%{_mandir}/man8/samba-dcerpcd.8* %{_mandir}/man8/smbd.8* %{_mandir}/man8/nmbd.8* %{_mandir}/man8/vfs_acl_tdb.8* @@ -1642,6 +1651,7 @@ fi %{_mandir}/man8/vfs_crossrename.8* %{_mandir}/man8/vfs_default_quota.8* %{_mandir}/man8/vfs_dirsort.8* +%{_mandir}/man8/vfs_expand_msdfs.8* %{_mandir}/man8/vfs_extd_audit.8* %{_mandir}/man8/vfs_fake_perms.8* %{_mandir}/man8/vfs_fileid.8* @@ -1852,7 +1862,7 @@ fi %if %{without libwbclient} %{_libdir}/samba/libwbclient.so.* -%{_libdir}/samba/libwinbind-client-samba4.so +#%%{_libdir}/samba/libwinbind-client-samba4.so #endif without libwbclient %endif @@ -2232,6 +2242,9 @@ fi %{_libdir}/samba/libshares-samba4.so %{_libdir}/samba/libsmbpasswdparser-samba4.so %{_libdir}/samba/libxattr-tdb-samba4.so +%{_libdir}/samba/libREG-FULL-samba4.so +%{_libdir}/samba/libRPC-SERVER-LOOP-samba4.so +%{_libdir}/samba/libRPC-WORKER-samba4.so ### LIBSMBCLIENT %if %{with libsmbclient} @@ -2251,7 +2264,7 @@ fi %if %{with libwbclient} %files -n libwbclient %{_libdir}/samba/wbclient/libwbclient.so.* -%{_libdir}/samba/libwinbind-client-samba4.so +#%%{_libdir}/samba/libwinbind-client-samba4.so ### LIBWBCLIENT-DEVEL %files -n libwbclient-devel @@ -2322,7 +2335,11 @@ fi %{python3_sitearch}/samba/__pycache__/drs_utils.*.pyc %{python3_sitearch}/samba/__pycache__/getopt.*.pyc %{python3_sitearch}/samba/__pycache__/gpclass.*.pyc +%{python3_sitearch}/samba/__pycache__/gp_cert_auto_enroll_ext.*.pyc +%{python3_sitearch}/samba/__pycache__/gp_chromium_ext.*.pyc %{python3_sitearch}/samba/__pycache__/gp_ext_loader.*.pyc +%{python3_sitearch}/samba/__pycache__/gp_firefox_ext.*.pyc +%{python3_sitearch}/samba/__pycache__/gp_firewalld_ext.*.pyc %{python3_sitearch}/samba/__pycache__/gp_gnome_settings_ext.*.pyc %{python3_sitearch}/samba/__pycache__/gp_msgs_ext.*.pyc %{python3_sitearch}/samba/__pycache__/gp_scripts_ext.*.pyc @@ -2438,7 +2455,11 @@ fi %{python3_sitearch}/samba/emulate/__init__.py %{python3_sitearch}/samba/emulate/traffic.py %{python3_sitearch}/samba/emulate/traffic_packets.py +%{python3_sitearch}/samba/gp_cert_auto_enroll_ext.py +%{python3_sitearch}/samba/gp_chromium_ext.py %{python3_sitearch}/samba/gp_ext_loader.py +%{python3_sitearch}/samba/gp_firefox_ext.py +%{python3_sitearch}/samba/gp_firewalld_ext.py %{python3_sitearch}/samba/gp_msgs_ext.py %{python3_sitearch}/samba/gp_smb_conf_ext.py %{python3_sitearch}/samba/gp_sudoers_ext.py @@ -2755,6 +2776,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/smbd_base.*.pyc %{python3_sitearch}/samba/tests/__pycache__/smbd_fuzztest.*.pyc %{python3_sitearch}/samba/tests/__pycache__/source.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/source_chars.*.pyc %{python3_sitearch}/samba/tests/__pycache__/strings.*.pyc %{python3_sitearch}/samba/tests/__pycache__/subunitrun.*.pyc %{python3_sitearch}/samba/tests/__pycache__/tdb_util.*.pyc @@ -2924,14 +2946,15 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tgs_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/ms_kile_client_principal_lookup_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/pac_align_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/raw_testcase.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/rfc4120_constants.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/rfc4120_pyasn1.*.pyc -%{python3_sitearch}/samba/tests/krb5/__pycache__/rodc_tests*.pyc -%{python3_sitearch}/samba/tests/krb5/__pycache__/salt_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/rodc_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/simple_tests.*.pyc -%{python3_sitearch}/samba/tests/krb5/__pycache__/spn_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/s4u_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/salt_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/spn_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_ccache.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_idmap_nss.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_ldap.*.pyc @@ -2949,25 +2972,26 @@ fi %{python3_sitearch}/samba/tests/krb5/kdc_tests.py %{python3_sitearch}/samba/tests/krb5/kdc_tgs_tests.py %{python3_sitearch}/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py +%{python3_sitearch}/samba/tests/krb5/pac_align_tests.py %{python3_sitearch}/samba/tests/krb5/raw_testcase.py %{python3_sitearch}/samba/tests/krb5/rfc4120_constants.py %{python3_sitearch}/samba/tests/krb5/rfc4120_pyasn1.py %{python3_sitearch}/samba/tests/krb5/rodc_tests.py -%{python3_sitearch}/samba/tests/krb5/salt_tests.py %{python3_sitearch}/samba/tests/krb5/simple_tests.py -%{python3_sitearch}/samba/tests/krb5/spn_tests.py -%{python3_sitearch}/samba/tests/krb5/test_ccache.py %{python3_sitearch}/samba/tests/krb5/test_idmap_nss.py +%{python3_sitearch}/samba/tests/krb5/test_ccache.py %{python3_sitearch}/samba/tests/krb5/test_ldap.py %{python3_sitearch}/samba/tests/krb5/test_min_domain_uid.py %{python3_sitearch}/samba/tests/krb5/test_rpc.py %{python3_sitearch}/samba/tests/krb5/test_smb.py %{python3_sitearch}/samba/tests/krb5/s4u_tests.py +%{python3_sitearch}/samba/tests/krb5/salt_tests.py +%{python3_sitearch}/samba/tests/krb5/spn_tests.py %{python3_sitearch}/samba/tests/krb5/xrealm_tests.py %{python3_sitearch}/samba/tests/krb5_credentials.py %{python3_sitearch}/samba/tests/ldap_raw.py -%{python3_sitearch}/samba/tests/ldap_referrals.py %{python3_sitearch}/samba/tests/ldap_spn.py +%{python3_sitearch}/samba/tests/ldap_referrals.py %{python3_sitearch}/samba/tests/ldap_upn_sam_account.py %{python3_sitearch}/samba/tests/libsmb.py %{python3_sitearch}/samba/tests/loadparm.py @@ -3031,6 +3055,7 @@ fi %{python3_sitearch}/samba/tests/samba_tool/__pycache__/help.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/join.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/join_lmdb_size.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/join_member.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/ntacl.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/ou.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/passwordsettings.*.pyc @@ -3067,6 +3092,7 @@ fi %{python3_sitearch}/samba/tests/samba_tool/help.py %{python3_sitearch}/samba/tests/samba_tool/join.py %{python3_sitearch}/samba/tests/samba_tool/join_lmdb_size.py +%{python3_sitearch}/samba/tests/samba_tool/join_member.py %{python3_sitearch}/samba/tests/samba_tool/ntacl.py %{python3_sitearch}/samba/tests/samba_tool/ou.py %{python3_sitearch}/samba/tests/samba_tool/passwordsettings.py @@ -3098,6 +3124,7 @@ fi %{python3_sitearch}/samba/tests/smbd_base.py %{python3_sitearch}/samba/tests/smbd_fuzztest.py %{python3_sitearch}/samba/tests/source.py +%{python3_sitearch}/samba/tests/source_chars.py %{python3_sitearch}/samba/tests/strings.py %{python3_sitearch}/samba/tests/subunitrun.py %{python3_sitearch}/samba/tests/tdb_util.py @@ -3119,7 +3146,6 @@ fi %{_mandir}/man1/masktest.1* %{_mandir}/man1/ndrdump.1* %{_mandir}/man1/smbtorture.1* -%{_mandir}/man1/vfstest.1* %if %{with testsuite} # files to ignore in testsuite mode @@ -4103,6 +4129,10 @@ fi %endif %changelog +* Tue Jan 25 2022 Pavel Filipenský - 4.16.0rc1 +- Update to Samba 4.16.0rc1 +- resolves: #2042518 + * Thu Jan 20 2022 Pavel Filipenský - 4.15.4-0 - Update to Samba 4.15.4 - resolves: #2009673, #2039034 - Security fixes for CVE-2021-20316 diff --git a/sources b/sources index 343898f..5c60965 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.15.4.tar.xz) = 19aa7edc55d545c42ba9c2d2bb987df63a825c5a1a6fa2a350d6bca41f04fde6f63b643f6e38d32f4d4067c24420e1ca62ef28dc285c70105ca78487e80ee2dc -SHA512 (samba-4.15.4.tar.asc) = 6878efc500f423e7061966954163ef3503e4ab43a527b370a3e26e6992bc9b6a3161e296800b6cd78d5e0d99ac7f1db249d52c2475d035973e2121bc67df6fab +SHA512 (samba-4.16.0rc1.tar.asc) = 07aebb0d76834a1a56021d3a9004d6eefae8fb1426aabaca89c9df3572cbcb09dfc0c649c5e28e1844ce53dfd1e94cc828915df26e63268ce883045e4f3c3548 +SHA512 (samba-4.16.0rc1.tar.xz) = dd7711c998e6d33056d913af64ef33957badf09fb59ba21921f81676b96a939bbf491bfb1362d2625ba30d08526abc6c889376b4e1e439e266bd9b2e9864bcbc From b935fbcb7d1c7034132e7b87495ad8b7283e8c63 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Wed, 26 Jan 2022 10:30:59 +0100 Subject: [PATCH 167/425] vfs_cephfs on ppc64le is excluded till ceph is fixed on ppc64le --- samba.spec | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index dc8a9ab..c37413b 100644 --- a/samba.spec +++ b/samba.spec @@ -52,7 +52,9 @@ # Build vfs_ceph module and ctdb cepth mutex helper by default on 64bit Fedora %if 0%{?fedora} -%ifarch aarch64 ppc64le s390x x86_64 +# ppc64le excluded pending resolution of https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104172 +#%%ifarch aarch64 ppc64le s390x x86_64 +%ifarch aarch64 s390x x86_64 %bcond_without vfs_cephfs %bcond_without ceph_mutex %else @@ -4129,6 +4131,9 @@ fi %endif %changelog +* Wed Jan 26 2022 Pavel Filipenský - 4.16.0rc1 +- Exclude temporarily ceph on ppc64le to fix failing build + * Tue Jan 25 2022 Pavel Filipenský - 4.16.0rc1 - Update to Samba 4.16.0rc1 - resolves: #2042518 From fae36af2f385d1891ae40cf98b9cbba902ca8224 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 1 Feb 2022 08:05:40 +0100 Subject: [PATCH 168/425] Update to Samba 4.16.0rc2 resolves: #2046120, #2048566 - Security fixes for CVE-2021-44141 resolves: #2046146, #2048570 - Security fixes for CVE-2021-44142 resolves: #2046134, #2048568 - Security fixes for CVE-2022-0336 resolves: #2042518 pfilipen --- .gitignore | 2 ++ samba.spec | 11 +++++++++-- sources | 4 ++-- 3 files changed, 13 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index a5d7ee7..9cb3e5a 100644 --- a/.gitignore +++ b/.gitignore @@ -279,3 +279,5 @@ samba-3.6.0pre1.tar.gz /samba-4.15.4.tar.asc /samba-4.16.0rc1.tar.xz /samba-4.16.0rc1.tar.asc +/samba-4.16.0rc2.tar.xz +/samba-4.16.0rc2.tar.asc diff --git a/samba.spec b/samba.spec index c37413b..8e5bf1c 100644 --- a/samba.spec +++ b/samba.spec @@ -134,7 +134,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 0 +%global baserelease 1 %global samba_version 4.16.0 %global talloc_version 2.3.3 @@ -142,7 +142,7 @@ %global tevent_version 0.11.0 %global ldb_version 2.5.0 # This should be rc1 or nil -%global pre_release rc1 +%global pre_release rc2 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4131,6 +4131,13 @@ fi %endif %changelog +* Tue Feb 01 2022 Pavel Filipenský - 4.16.0rc2 +- Update to Samba 4.16.0rc2 +- resolves: #2046120, #2048566 - Security fixes for CVE-2021-44141 +- resolves: #2046146, #2048570 - Security fixes for CVE-2021-44142 +- resolves: #2046134, #2048568 - Security fixes for CVE-2022-0336 +- resolves: #2042518 + * Wed Jan 26 2022 Pavel Filipenský - 4.16.0rc1 - Exclude temporarily ceph on ppc64le to fix failing build diff --git a/sources b/sources index 5c60965..1877757 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.16.0rc1.tar.asc) = 07aebb0d76834a1a56021d3a9004d6eefae8fb1426aabaca89c9df3572cbcb09dfc0c649c5e28e1844ce53dfd1e94cc828915df26e63268ce883045e4f3c3548 -SHA512 (samba-4.16.0rc1.tar.xz) = dd7711c998e6d33056d913af64ef33957badf09fb59ba21921f81676b96a939bbf491bfb1362d2625ba30d08526abc6c889376b4e1e439e266bd9b2e9864bcbc +SHA512 (samba-4.16.0rc2.tar.asc) = ee4fd216f0ea6851c089e6ea0959638a5d62d403303b2a2a7a3e8cf97924969607fae0c520156c4076d41a6ccc52630364497c134ea547e950465a96b66532a1 +SHA512 (samba-4.16.0rc2.tar.xz) = 6b6326d4ae962a01f699a6cc144bac8847281fc85ae1a5d77c71be3f59630c7864832297a9369a5ff83bff0d0c80d03ebfecfdd5d706ec86fc400112ecd6f657 From 4ee87cc214717b18d6a58afa051a2847b1533a3c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 1 Feb 2022 11:13:21 +0100 Subject: [PATCH 169/425] Fix missing mdssvc/elasticsearch_mappings.json pfilipen --- samba.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index 8e5bf1c..2c2d272 100644 --- a/samba.spec +++ b/samba.spec @@ -1627,8 +1627,8 @@ fi %{_libexecdir}/samba/rpcd_winreg %dir %{_datadir}/samba -#%%dir %%{_datadir}/samba/mdssvc -#%%{_datadir}/samba/mdssvc/elasticsearch_mappings.json +%dir %{_datadir}/samba/mdssvc +%{_datadir}/samba/mdssvc/elasticsearch_mappings.json %{_unitdir}/nmb.service %{_unitdir}/smb.service From 626bbcbaaca2ba0370ef2685ad4bbcdad654616a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 2 Feb 2022 14:36:43 +0100 Subject: [PATCH 170/425] There is no such thing like .el9rhgs Guenther --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 2c2d272..2ed6b5c 100644 --- a/samba.spec +++ b/samba.spec @@ -71,7 +71,7 @@ # Build vfs_gluster module by default on 64bit Fedora %global is_rhgs 0 -%if "%{dist}" == ".el8rhgs" || "%{dist}" == ".el9rhgs" +%if "%{dist}" == ".el7rhgs" || "%{dist}" == ".el8rhgs" %global is_rhgs 1 %endif From 08f90048f540471456edc7b07b9fc9f022c115a0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 15 Feb 2022 08:57:37 +0100 Subject: [PATCH 171/425] Update to Samba 4.16.0rc3 resolves: #2042518 pfilipen --- .gitignore | 2 ++ samba.spec | 8 ++++++-- sources | 4 ++-- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 9cb3e5a..33ed91b 100644 --- a/.gitignore +++ b/.gitignore @@ -281,3 +281,5 @@ samba-3.6.0pre1.tar.gz /samba-4.16.0rc1.tar.asc /samba-4.16.0rc2.tar.xz /samba-4.16.0rc2.tar.asc +/samba-4.16.0rc3.tar.xz +/samba-4.16.0rc3.tar.asc diff --git a/samba.spec b/samba.spec index 2ed6b5c..2bb8381 100644 --- a/samba.spec +++ b/samba.spec @@ -134,7 +134,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 1 +%global baserelease 2 %global samba_version 4.16.0 %global talloc_version 2.3.3 @@ -142,7 +142,7 @@ %global tevent_version 0.11.0 %global ldb_version 2.5.0 # This should be rc1 or nil -%global pre_release rc2 +%global pre_release rc3 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4131,6 +4131,10 @@ fi %endif %changelog +* Tue Feb 15 2022 Pavel Filipenský - 4.16.0rc3 +- Update to Samba 4.16.0rc3 +- resolves: #2042518 + * Tue Feb 01 2022 Pavel Filipenský - 4.16.0rc2 - Update to Samba 4.16.0rc2 - resolves: #2046120, #2048566 - Security fixes for CVE-2021-44141 diff --git a/sources b/sources index 1877757..311b8ae 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.16.0rc2.tar.asc) = ee4fd216f0ea6851c089e6ea0959638a5d62d403303b2a2a7a3e8cf97924969607fae0c520156c4076d41a6ccc52630364497c134ea547e950465a96b66532a1 -SHA512 (samba-4.16.0rc2.tar.xz) = 6b6326d4ae962a01f699a6cc144bac8847281fc85ae1a5d77c71be3f59630c7864832297a9369a5ff83bff0d0c80d03ebfecfdd5d706ec86fc400112ecd6f657 +SHA512 (samba-4.16.0rc3.tar.xz) = 797153d362d5bcfe3678a7870dce13a6d4770c8c8165ba64caf30195321448b2f35e2c0f51554648f1d7dd5413e22727dd53d3c378fcd0985c4c297ab2ad4a52 +SHA512 (samba-4.16.0rc3.tar.asc) = 6f4d0e81e2c2e2aec2d0418ae56790dde315c5ebeea45b17195e82d463ca22c601c28d188b1bc37969bc9496f4a951d65fed0c6283886c1ee60bac4504e8fbf4 From 0d2a366cce93d0ff80036cbd0c95d545a654363b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 23 Feb 2022 11:49:53 +0100 Subject: [PATCH 172/425] Fix samba-tool on builds with samba-dc resolves: rhbz#2036443 --- samba.spec | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 2bb8381..a88b18f 100644 --- a/samba.spec +++ b/samba.spec @@ -134,7 +134,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 2 +%global baserelease 3 %global samba_version 4.16.0 %global talloc_version 2.3.3 @@ -490,6 +490,8 @@ Requires: python3-%{name} = %{samba_depver} # samba-tool needs tdbbackup Requires: tdb-tools %if %{with dc} +# samba-tool needs python3-samba-dc on a full build +Requires: python3-%{name}-dc = %{samba_depver} # samba-tool needs mdb_copy for domain backup or upgrade provision Requires: lmdb %endif @@ -4131,6 +4133,9 @@ fi %endif %changelog +* Wed Feb 23 2022 Andreas Schneider - 4.16.0-0.3.rc3 +- resolves: rhbz#2036443 - Fix samba-tool on builds with samba-dc + * Tue Feb 15 2022 Pavel Filipenský - 4.16.0rc3 - Update to Samba 4.16.0rc3 - resolves: #2042518 From 48556cdf371e795b468321f0b338f1e5fd46a473 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 1 Mar 2022 12:37:00 +0100 Subject: [PATCH 173/425] Update to Samba 4.16.0rc4 resolves: #2042518 pfilipen --- .gitignore | 2 ++ samba.spec | 8 ++++++-- sources | 4 ++-- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 33ed91b..9589b5f 100644 --- a/.gitignore +++ b/.gitignore @@ -283,3 +283,5 @@ samba-3.6.0pre1.tar.gz /samba-4.16.0rc2.tar.asc /samba-4.16.0rc3.tar.xz /samba-4.16.0rc3.tar.asc +/samba-4.16.0rc4.tar.xz +/samba-4.16.0rc4.tar.asc diff --git a/samba.spec b/samba.spec index a88b18f..97a4640 100644 --- a/samba.spec +++ b/samba.spec @@ -134,7 +134,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 3 +%global baserelease 4 %global samba_version 4.16.0 %global talloc_version 2.3.3 @@ -142,7 +142,7 @@ %global tevent_version 0.11.0 %global ldb_version 2.5.0 # This should be rc1 or nil -%global pre_release rc3 +%global pre_release rc4 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4133,6 +4133,10 @@ fi %endif %changelog +* Tue Mar 01 2022 Pavel Filipenský - 4.16.0-0.4.rc4 +- Update to Samba 4.16.0rc4 +- resolves: #2042518 + * Wed Feb 23 2022 Andreas Schneider - 4.16.0-0.3.rc3 - resolves: rhbz#2036443 - Fix samba-tool on builds with samba-dc diff --git a/sources b/sources index 311b8ae..fc0f4e5 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.16.0rc3.tar.xz) = 797153d362d5bcfe3678a7870dce13a6d4770c8c8165ba64caf30195321448b2f35e2c0f51554648f1d7dd5413e22727dd53d3c378fcd0985c4c297ab2ad4a52 -SHA512 (samba-4.16.0rc3.tar.asc) = 6f4d0e81e2c2e2aec2d0418ae56790dde315c5ebeea45b17195e82d463ca22c601c28d188b1bc37969bc9496f4a951d65fed0c6283886c1ee60bac4504e8fbf4 +SHA512 (samba-4.16.0rc4.tar.xz) = 7326c9690309eadff7fe01d914105e9cd7e225ba0cce57855e0ad308b35404a384519e383d279c26430eae796df46f1431a8b0b142c7a3c8c474f1977dd3e150 +SHA512 (samba-4.16.0rc4.tar.asc) = 5914d3108ed65fa5e9a68efefae5ca8da48cda4ca7b29c876b89d9c18d994a7dc11876c66cb7e011ad4a5c59650ec9511353a9b0eba7a19c0c56042c6cf734cd From da81e5cf5b0db127d4d5c18b6bc899b8f060445d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 9 Mar 2022 14:21:48 +0100 Subject: [PATCH 174/425] Update to Samba 4.16.0rc5 resolves: #2042518 Guenther --- .gitignore | 2 ++ samba.spec | 8 ++++++-- sources | 4 ++-- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 9589b5f..d7625b4 100644 --- a/.gitignore +++ b/.gitignore @@ -285,3 +285,5 @@ samba-3.6.0pre1.tar.gz /samba-4.16.0rc3.tar.asc /samba-4.16.0rc4.tar.xz /samba-4.16.0rc4.tar.asc +/samba-4.16.0rc5.tar.xz +/samba-4.16.0rc5.tar.asc diff --git a/samba.spec b/samba.spec index 97a4640..7046999 100644 --- a/samba.spec +++ b/samba.spec @@ -134,7 +134,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 4 +%global baserelease 5 %global samba_version 4.16.0 %global talloc_version 2.3.3 @@ -142,7 +142,7 @@ %global tevent_version 0.11.0 %global ldb_version 2.5.0 # This should be rc1 or nil -%global pre_release rc4 +%global pre_release rc5 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4133,6 +4133,10 @@ fi %endif %changelog +* Wed Mar 09 2022 Guenther Deschner - 4.16.0-0.5.rc5 +- Update to Samba 4.16.0rc5 +- resolves: #2042518 + * Tue Mar 01 2022 Pavel Filipenský - 4.16.0-0.4.rc4 - Update to Samba 4.16.0rc4 - resolves: #2042518 diff --git a/sources b/sources index fc0f4e5..b0b6528 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.16.0rc4.tar.xz) = 7326c9690309eadff7fe01d914105e9cd7e225ba0cce57855e0ad308b35404a384519e383d279c26430eae796df46f1431a8b0b142c7a3c8c474f1977dd3e150 -SHA512 (samba-4.16.0rc4.tar.asc) = 5914d3108ed65fa5e9a68efefae5ca8da48cda4ca7b29c876b89d9c18d994a7dc11876c66cb7e011ad4a5c59650ec9511353a9b0eba7a19c0c56042c6cf734cd +SHA512 (samba-4.16.0rc5.tar.xz) = 6d29f852613a46f23e95630b0b7236240155698e7a057953d4a7cb9de015b30c279e95fe084c2a0e448bab30df50789b8629a05bba1b1c8e2f6d8e9e4d3d56c6 +SHA512 (samba-4.16.0rc5.tar.asc) = f1448bf87a02e5207199358418138d48cc726425167adcd900c02c95bdbaa7692079c75f7db9df683b07fd83594d3a0b544c202c55a10ce368ca2747c34f1702 From d6e74e716fe343e297addf5e34986e18010cc1f8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 22 Mar 2022 10:27:37 +0100 Subject: [PATCH 175/425] Update to Samba 4.16.0 resolves: #2066290 Guenther --- .gitignore | 2 ++ samba.spec | 8 ++++++-- sources | 4 ++-- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index d7625b4..aa6195d 100644 --- a/.gitignore +++ b/.gitignore @@ -287,3 +287,5 @@ samba-3.6.0pre1.tar.gz /samba-4.16.0rc4.tar.asc /samba-4.16.0rc5.tar.xz /samba-4.16.0rc5.tar.asc +/samba-4.16.0.tar.xz +/samba-4.16.0.tar.asc diff --git a/samba.spec b/samba.spec index 7046999..56c7d74 100644 --- a/samba.spec +++ b/samba.spec @@ -134,7 +134,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 5 +%global baserelease 6 %global samba_version 4.16.0 %global talloc_version 2.3.3 @@ -142,7 +142,7 @@ %global tevent_version 0.11.0 %global ldb_version 2.5.0 # This should be rc1 or nil -%global pre_release rc5 +%global pre_release %nil %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4133,6 +4133,10 @@ fi %endif %changelog +* Tue Mar 22 2022 Guenther Deschner - 4.16.0-6 +- Update to Samba 4.16.0 +- resolves: #2066290 + * Wed Mar 09 2022 Guenther Deschner - 4.16.0-0.5.rc5 - Update to Samba 4.16.0rc5 - resolves: #2042518 diff --git a/sources b/sources index b0b6528..f23b12e 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.16.0rc5.tar.xz) = 6d29f852613a46f23e95630b0b7236240155698e7a057953d4a7cb9de015b30c279e95fe084c2a0e448bab30df50789b8629a05bba1b1c8e2f6d8e9e4d3d56c6 -SHA512 (samba-4.16.0rc5.tar.asc) = f1448bf87a02e5207199358418138d48cc726425167adcd900c02c95bdbaa7692079c75f7db9df683b07fd83594d3a0b544c202c55a10ce368ca2747c34f1702 +SHA512 (samba-4.16.0.tar.xz) = e824906f7c1e01e84c306967f6bc31ca7600851b8bd5998454a2f987483ec25dcf78b4fc1201bfe28d8bdc6f2533ab2c8a2f3dee938eba21c3bb8ad50aedaf24 +SHA512 (samba-4.16.0.tar.asc) = d3f5b0f2f338826348b723c646a254ecab87205aaa97d8b22ca37f7babd0e86382e709c8ee4820c9b11609bb6b8e4f3de9ae78ab664ad30260bb0f42ee75e5e1 From 92f6ae3986c2fd844d8705535fe5040a79f3e763 Mon Sep 17 00:00:00 2001 From: Sandro Mani Date: Fri, 25 Mar 2022 14:58:37 +0100 Subject: [PATCH 176/425] Rebuild with mingw-gcc-12 --- samba.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 56c7d74..e3a5d28 100644 --- a/samba.spec +++ b/samba.spec @@ -134,7 +134,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 6 +%global baserelease 7 %global samba_version 4.16.0 %global talloc_version 2.3.3 @@ -4133,6 +4133,9 @@ fi %endif %changelog +* Fri Mar 25 2022 Sandro Mani - 2:4.16.0-7 +- Rebuild with mingw-gcc-12 + * Tue Mar 22 2022 Guenther Deschner - 4.16.0-6 - Update to Samba 4.16.0 - resolves: #2066290 From 5533ff7a7cdc304b30f46d896c6e708449270406 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 4 Apr 2022 11:32:12 +0200 Subject: [PATCH 177/425] Make sure we do not build Heimdal or crypto code As we need to rely on GnuTLS for FIPS, remove heimdal and other unused crypto code to ensure we do not build it! --- samba-4.16-waf-crypto.patch | 77 +++++++++++++++++++++++++++++++++++++ samba.spec | 7 ++++ 2 files changed, 84 insertions(+) create mode 100644 samba-4.16-waf-crypto.patch diff --git a/samba-4.16-waf-crypto.patch b/samba-4.16-waf-crypto.patch new file mode 100644 index 0000000..337be97 --- /dev/null +++ b/samba-4.16-waf-crypto.patch @@ -0,0 +1,77 @@ +From 41d3efebcf6abab9119f9b0f97c86c1c48739fee Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Mon, 4 Apr 2022 11:24:04 +0200 +Subject: [PATCH 1/2] waf: Check for GnuTLS earlier + +As GnuTLS is an essential part we need to check for it early so we can react on +GnuTLS features in other wscripts. + +Signed-off-by: Andreas Schneider +--- + wscript | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/wscript b/wscript +index d8220b35095..5b85d9a1682 100644 +--- a/wscript ++++ b/wscript +@@ -189,6 +189,8 @@ def configure(conf): + conf.RECURSE('dynconfig') + conf.RECURSE('selftest') + ++ conf.PROCESS_SEPARATE_RULE('system_gnutls') ++ + conf.CHECK_CFG(package='zlib', minversion='1.2.3', + args='--cflags --libs', + mandatory=True) +@@ -297,8 +299,6 @@ def configure(conf): + if not conf.CONFIG_GET('KRB5_VENDOR'): + conf.PROCESS_SEPARATE_RULE('embedded_heimdal') + +- conf.PROCESS_SEPARATE_RULE('system_gnutls') +- + conf.RECURSE('source4/dsdb/samdb/ldb_modules') + conf.RECURSE('source4/ntvfs/sysdep') + conf.RECURSE('lib/util') +-- +2.35.1 + + +From 63701a28116afc1550c23cb5f7b9d6e366fd1270 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Mon, 4 Apr 2022 11:25:31 +0200 +Subject: [PATCH 2/2] third_party:waf: Do not recurse in aesni-intel if GnuTLS + provides the cipher + +Signed-off-by: Andreas Schneider +--- + third_party/wscript | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/third_party/wscript b/third_party/wscript +index 1f4bc1ce1d7..a17c15bcaa7 100644 +--- a/third_party/wscript ++++ b/third_party/wscript +@@ -5,7 +5,8 @@ from waflib import Options + def configure(conf): + conf.RECURSE('cmocka') + conf.RECURSE('popt') +- conf.RECURSE('aesni-intel') ++ if not conf.CONFIG_SET('HAVE_GNUTLS_AES_CMAC'): ++ conf.RECURSE('aesni-intel') + if conf.CONFIG_GET('ENABLE_SELFTEST'): + conf.RECURSE('socket_wrapper') + conf.RECURSE('nss_wrapper') +@@ -18,7 +19,8 @@ def configure(conf): + def build(bld): + bld.RECURSE('cmocka') + bld.RECURSE('popt') +- bld.RECURSE('aesni-intel') ++ if not bld.CONFIG_SET('HAVE_GNUTLS_AES_CMAC'): ++ bld.RECURSE('aesni-intel') + if bld.CONFIG_GET('SOCKET_WRAPPER'): + bld.RECURSE('socket_wrapper') + if bld.CONFIG_GET('NSS_WRAPPER'): +-- +2.35.1 + diff --git a/samba.spec b/samba.spec index e3a5d28..889a960 100644 --- a/samba.spec +++ b/samba.spec @@ -204,6 +204,8 @@ Source14: samba.pamd Source201: README.downgrade Patch0: samba-s4u.patch +# https://gitlab.com/samba-team/samba/-/merge_requests/2477 +Patch1: samba-4.16-waf-crypto.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -1062,6 +1064,11 @@ Support for using an existing CEPH cluster as a mutex helper for CTDB xzcat %{SOURCE0} | gpgv2 --quiet --keyring %{SOURCE2} %{SOURCE1} - %autosetup -n samba-%{version}%{pre_release} -p1 +# Ensure we rely on GnuTLS and do not build any other crypto code shipping with +# the sources. +rm -rf third_party/{aesni-intel,heimdal} +rm -f lib/crypto/{aes,rijndael}*.c + %build %if %{with includelibs} %global _talloc_lib ,talloc,pytalloc,pytalloc-util From 766f1be02d0d2a1fbedb9106cefe5222d2afe10b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Mon, 2 May 2022 13:16:49 +0200 Subject: [PATCH 178/425] Update to Samba 4.16.1 resolves: #2080915 pfilipen --- .gitignore | 2 ++ samba.spec | 10 +++++++--- sources | 4 ++-- 3 files changed, 11 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index aa6195d..f49bf1c 100644 --- a/.gitignore +++ b/.gitignore @@ -289,3 +289,5 @@ samba-3.6.0pre1.tar.gz /samba-4.16.0rc5.tar.asc /samba-4.16.0.tar.xz /samba-4.16.0.tar.asc +/samba-4.16.1.tar.xz +/samba-4.16.1.tar.asc diff --git a/samba.spec b/samba.spec index 889a960..03bea4b 100644 --- a/samba.spec +++ b/samba.spec @@ -134,12 +134,12 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 7 +%global baserelease 0 -%global samba_version 4.16.0 +%global samba_version 4.16.1 %global talloc_version 2.3.3 %global tdb_version 1.4.6 -%global tevent_version 0.11.0 +%global tevent_version 0.12.0 %global ldb_version 2.5.0 # This should be rc1 or nil %global pre_release %nil @@ -4140,6 +4140,10 @@ fi %endif %changelog +* Mon May 02 2022 Pavel Filipenský - 4.16.1-0 +- Update to Samba 4.16.1 +- resolves: #2080915 + * Fri Mar 25 2022 Sandro Mani - 2:4.16.0-7 - Rebuild with mingw-gcc-12 diff --git a/sources b/sources index f23b12e..f094ef6 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.16.0.tar.xz) = e824906f7c1e01e84c306967f6bc31ca7600851b8bd5998454a2f987483ec25dcf78b4fc1201bfe28d8bdc6f2533ab2c8a2f3dee938eba21c3bb8ad50aedaf24 -SHA512 (samba-4.16.0.tar.asc) = d3f5b0f2f338826348b723c646a254ecab87205aaa97d8b22ca37f7babd0e86382e709c8ee4820c9b11609bb6b8e4f3de9ae78ab664ad30260bb0f42ee75e5e1 +SHA512 (samba-4.16.1.tar.xz) = a6c54d5f8796b353fce1467a81293491fd2a1c221eba1271a4ee0b9020ff5137d5dba68c8de5e65ab127ab908a403a0b59102def1f675f26f0322a2f7bc41c6f +SHA512 (samba-4.16.1.tar.asc) = 71895a0626dce7fe42f0370190dd4b5f7eb5ce0359bacfe779642c5915a6290d8d4f841f3c258a774829a03fa59be6353863494d2f0cf6bc7640a98af7e928e8 From 93ea8c0806f141307d5bf807ededf8ccd7af61a3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 3 May 2022 13:08:58 +0200 Subject: [PATCH 179/425] Delete no longer needed comments pfilipen --- samba.spec | 2 -- 1 file changed, 2 deletions(-) diff --git a/samba.spec b/samba.spec index 03bea4b..5c50728 100644 --- a/samba.spec +++ b/samba.spec @@ -1873,7 +1873,6 @@ fi %if %{without libwbclient} %{_libdir}/samba/libwbclient.so.* -#%%{_libdir}/samba/libwinbind-client-samba4.so #endif without libwbclient %endif @@ -2275,7 +2274,6 @@ fi %if %{with libwbclient} %files -n libwbclient %{_libdir}/samba/wbclient/libwbclient.so.* -#%%{_libdir}/samba/libwinbind-client-samba4.so ### LIBWBCLIENT-DEVEL %files -n libwbclient-devel From bec19658c49c68ca4855b2b9a4671bca43bdc976 Mon Sep 17 00:00:00 2001 From: Tomas Popela Date: Thu, 5 May 2022 14:41:17 +0200 Subject: [PATCH 180/425] Don't require full systemd for tmp file handling in samba-common Otherwise the full systemd is being pulled into Fedora Flatpak runtime, but this change benefits other uses as well. --- samba.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index 5c50728..7570717 100644 --- a/samba.spec +++ b/samba.spec @@ -134,7 +134,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 0 +%global baserelease 1 %global samba_version 4.16.1 %global talloc_version 2.3.3 @@ -428,7 +428,7 @@ SMB/CIFS clients. Summary: Files used by both Samba servers and clients BuildArch: noarch -Requires(post): systemd +Requires(post): (systemd-standalone-tmpfiles or systemd) Recommends: logrotate Provides: samba4-common = %{samba_depver} @@ -4138,6 +4138,9 @@ fi %endif %changelog +* Thu May 05 2022 Tomas Popela - 4.16.1-1 +- Don't require full systemd for tmp files handling in samba-common + * Mon May 02 2022 Pavel Filipenský - 4.16.1-0 - Update to Samba 4.16.1 - resolves: #2080915 From 331fe971e651b8216fb241bdfbaa5c4e436a8a40 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 5 May 2022 19:45:16 +0200 Subject: [PATCH 181/425] Add .abignore file for abidiff abidiff complains: abidiff: failed to read input file /usr/lib/libdcerpc-samr.so.0.0.1 abidiff: could not find the debug info This is a grouping library which doesn't have any source code, so just ignore it with a suppression file (.abignore). Example for .abignore: https://sourceware.org/git/?p=libabigail.git;a=blob;f=default.abignore --- .abignore | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .abignore diff --git a/.abignore b/.abignore new file mode 100644 index 0000000..466d190 --- /dev/null +++ b/.abignore @@ -0,0 +1,5 @@ +################################################# +# This is a grouping library without any code +################################################# +[suppress_file] + file_name_regexp = libdcerpc-samr\\.so.* From 1fa286fd0092c420003157ea5679f52cdc7dc956 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Thu, 5 May 2022 16:48:23 +0200 Subject: [PATCH 182/425] rpminspect: ignore inet_ntoa() from /usr/lib*/samba/service/nbtd.so --- rpminspect.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/rpminspect.yaml b/rpminspect.yaml index 6de38d7..ff0361f 100644 --- a/rpminspect.yaml +++ b/rpminspect.yaml @@ -7,6 +7,7 @@ badfuncs: - /usr/lib*/libsmbconf.so.* - /usr/lib*/samba/libgse-samba4.so - /usr/lib*/samba/libsamba-sockets-samba4.so + - /usr/lib*/samba/service/nbtd.so - /usr/libexec/ctdb/smnotify - /usr/sbin/nmbd From 0b31575a45a5e679eda0818fb69b5bac73eeb580 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Fri, 6 May 2022 10:10:06 +0200 Subject: [PATCH 183/425] Update requires for packages pfilipen --- samba.spec | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 7570717..1bb5987 100644 --- a/samba.spec +++ b/samba.spec @@ -134,7 +134,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 1 +%global baserelease 2 %global samba_version 4.16.1 %global talloc_version 2.3.3 @@ -509,6 +509,8 @@ SMB/CIFS clients. %package dc Summary: Samba AD Domain Controller Requires: %{name} = %{samba_depver} +Requires: %{name}-client-libs = %{samba_depver} +Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-dc-provision = %{samba_depver} Requires: %{name}-dc-libs = %{samba_depver} @@ -549,6 +551,7 @@ The samba-dc-provision package provides files to setup a domain controller ### DC-LIBS %package dc-libs Summary: Samba AD Domain Controller Libraries +Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} @@ -564,9 +567,11 @@ link against the SMB, RPC and other protocols. ### DC-BIND %package dc-bind-dlz Summary: Bind DLZ module for Samba AD +Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-dc-libs = %{samba_depver} Requires: %{name}-dc = %{samba_depver} +Requires: %{name}-libs = %{samba_depver} Requires: bind Provides: bundled(libreplace) @@ -582,6 +587,9 @@ name server related details of Samba AD. Summary: Developer tools for Samba libraries Requires: %{name}-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} +%if %{with dc} +Requires: %{name}-dc-libs = %{samba_depver} +%endif Provides: samba4-devel = %{samba_depver} Obsoletes: samba4-devel < %{samba_depver} @@ -596,6 +604,7 @@ libraries in the Samba suite. %package vfs-cephfs Summary: Samba VFS module for Ceph distributed storage system Requires: %{name} = %{samba_depver} +Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Provides: bundled(libreplace) @@ -732,6 +741,9 @@ Requires: %{name} = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} +%if %{with dc} +Requires: %{name}-dc-libs = %{samba_depver} +%endif Requires: python3-talloc Requires: python3-tevent Requires: python3-tdb @@ -770,6 +782,8 @@ If you want to run full set of Samba tests, you need to install this package. %if %{with dc} || %{with testsuite} %package -n python3-samba-dc Summary: Samba Python libraries for Samba AD +Requires: %{name}-client-libs = %{samba_depver} +Requires: %{name}-dc-libs = %{samba_depver} Requires: python3-%{name} = %{samba_depver} %description -n python3-samba-dc @@ -1023,6 +1037,7 @@ and use CTDB instead. Summary: CTDB PCP pmda support Requires: ctdb = %{samba_depver} Requires: pcp-libs +Requires: %{name}-client-libs = %{samba_depver} %description -n ctdb-pcp-pmda Performance Co-Pilot (PCP) support for CTDB @@ -4138,6 +4153,9 @@ fi %endif %changelog +* Fri May 06 2022 Pavel Filipenský - 4.16.1-2 +- Update requires for packages + * Thu May 05 2022 Tomas Popela - 4.16.1-1 - Don't require full systemd for tmp files handling in samba-common From 737293fe2b3b533418023e02f513c3000499237c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Fri, 6 May 2022 14:31:07 +0200 Subject: [PATCH 184/425] Rename from .abignore to samba.abignore --- .abignore => samba.abignore | 0 samba.spec | 2 +- 2 files changed, 1 insertion(+), 1 deletion(-) rename .abignore => samba.abignore (100%) diff --git a/.abignore b/samba.abignore similarity index 100% rename from .abignore rename to samba.abignore diff --git a/samba.spec b/samba.spec index 1bb5987..c51bee7 100644 --- a/samba.spec +++ b/samba.spec @@ -134,7 +134,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 2 +%global baserelease 3 %global samba_version 4.16.1 %global talloc_version 2.3.3 From 1d4eb827d1f08ddcf91286372956f1497df5b854 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Fri, 6 May 2022 17:05:02 +0200 Subject: [PATCH 185/425] Fix samba.abignore --- samba.abignore | 2 +- samba.spec | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/samba.abignore b/samba.abignore index 466d190..718059d 100644 --- a/samba.abignore +++ b/samba.abignore @@ -2,4 +2,4 @@ # This is a grouping library without any code ################################################# [suppress_file] - file_name_regexp = libdcerpc-samr\\.so.* +file_name_regexp=.*libdcerpc-samr\\.so.* diff --git a/samba.spec b/samba.spec index c51bee7..ccfc60e 100644 --- a/samba.spec +++ b/samba.spec @@ -134,7 +134,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 3 +%global baserelease 4 %global samba_version 4.16.1 %global talloc_version 2.3.3 From 8ccc18dc1361299580b8312b86dfd6b3517c56ce Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Fri, 13 May 2022 09:04:45 +0200 Subject: [PATCH 186/425] Fix rpminspect abidiff pfilipen --- rpminspect.yaml | 3 +++ samba.spec | 6 +++++- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/rpminspect.yaml b/rpminspect.yaml index ff0361f..9c56e6c 100644 --- a/rpminspect.yaml +++ b/rpminspect.yaml @@ -15,3 +15,6 @@ runpath: allowed_paths: - /usr/lib/samba - /usr/lib64/samba + +abidiff: + suppression_file: samba.abignore diff --git a/samba.spec b/samba.spec index ccfc60e..7a3222e 100644 --- a/samba.spec +++ b/samba.spec @@ -134,7 +134,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 4 +%global baserelease 5 %global samba_version 4.16.1 %global talloc_version 2.3.3 @@ -200,6 +200,7 @@ Source11: smb.conf.vendor Source12: smb.conf.example Source13: pam_winbind.conf Source14: samba.pamd +Source15: samba.abignore Source201: README.downgrade @@ -4153,6 +4154,9 @@ fi %endif %changelog +* Fri May 13 2022 Pavel Filipenský - 4.16.1-5 +- Fix rpminspect abidiff + * Fri May 06 2022 Pavel Filipenský - 4.16.1-2 - Update requires for packages From 035f4717ddb752b240bb38e1fd63f12ac9b365cf Mon Sep 17 00:00:00 2001 From: Jitka Plesnikova Date: Tue, 31 May 2022 08:15:08 +0200 Subject: [PATCH 187/425] Perl 5.36 rebuild --- samba.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 7a3222e..ce1cb45 100644 --- a/samba.spec +++ b/samba.spec @@ -134,7 +134,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 5 +%global baserelease 6 %global samba_version 4.16.1 %global talloc_version 2.3.3 @@ -4154,6 +4154,9 @@ fi %endif %changelog +* Tue May 31 2022 Jitka Plesnikova - 2:4.16.1-6 +- Perl 5.36 rebuild + * Fri May 13 2022 Pavel Filipenský - 4.16.1-5 - Fix rpminspect abidiff From ae63a4dca115771bcaf260215ba638649e1f1af5 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 7 Jun 2022 15:39:57 +0200 Subject: [PATCH 188/425] Drop zlib from bundled libraries as we don't have a copy anymore --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index ce1cb45..1b9bed3 100644 --- a/samba.spec +++ b/samba.spec @@ -1099,7 +1099,7 @@ rm -f lib/crypto/{aes,rijndael}*.c #endif with includelibs %endif -%global _samba_libraries !zlib,!popt%{_talloc_lib}%{_tevent_lib}%{_tdb_lib}%{_ldb_lib} +%global _samba_libraries !popt%{_talloc_lib}%{_tevent_lib}%{_tdb_lib}%{_ldb_lib} %global _samba_idmap_modules idmap_ad,idmap_rid,idmap_ldap,idmap_hash,idmap_tdb2 %global _samba_pdb_modules pdb_tdbsam,pdb_ldap,pdb_smbpasswd,pdb_wbc_sam,pdb_samba4 From dfb88d92d46ca96b2a5802105f68972dd94c5d53 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 8 Jun 2022 11:25:43 +0200 Subject: [PATCH 189/425] Remove weak dependency for logrotate for CentOS/RHEL resolves: rhbz#2093833 --- samba.spec | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/samba.spec b/samba.spec index 1b9bed3..6c1c103 100644 --- a/samba.spec +++ b/samba.spec @@ -430,7 +430,9 @@ Summary: Files used by both Samba servers and clients BuildArch: noarch Requires(post): (systemd-standalone-tmpfiles or systemd) +%if 0%{?fedora} Recommends: logrotate +%endif Provides: samba4-common = %{samba_depver} Obsoletes: samba4-common < %{samba_depver} @@ -4154,6 +4156,9 @@ fi %endif %changelog +* Wed Jun 08 2022 Andreas Schneider - 4.16.1-7 +- resolves: rhbz#2093833 - Remove weak dependency for logrotate for CentOS/RHEL + * Tue May 31 2022 Jitka Plesnikova - 2:4.16.1-6 - Perl 5.36 rebuild From 85e1d4b7c6207bfbc334bb77487ec447d62756dc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 13 Jun 2022 12:42:08 +0200 Subject: [PATCH 190/425] Update to Samba 4.16.2 resolves: #2096167 Guenther --- .gitignore | 2 ++ samba.spec | 10 +++++++--- sources | 4 ++-- 3 files changed, 11 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index f49bf1c..18704d2 100644 --- a/.gitignore +++ b/.gitignore @@ -291,3 +291,5 @@ samba-3.6.0pre1.tar.gz /samba-4.16.0.tar.asc /samba-4.16.1.tar.xz /samba-4.16.1.tar.asc +/samba-4.16.2.tar.xz +/samba-4.16.2.tar.asc diff --git a/samba.spec b/samba.spec index 6c1c103..e7fef22 100644 --- a/samba.spec +++ b/samba.spec @@ -134,13 +134,13 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 6 +%global baserelease 0 -%global samba_version 4.16.1 +%global samba_version 4.16.2 %global talloc_version 2.3.3 %global tdb_version 1.4.6 %global tevent_version 0.12.0 -%global ldb_version 2.5.0 +%global ldb_version 2.5.1 # This should be rc1 or nil %global pre_release %nil @@ -4156,6 +4156,10 @@ fi %endif %changelog +* Mon Jun 13 2022 Guenther Deschner - 4.16.2-0 +- Update to Samba 4.16.2 +- resolves: #2096167 + * Wed Jun 08 2022 Andreas Schneider - 4.16.1-7 - resolves: rhbz#2093833 - Remove weak dependency for logrotate for CentOS/RHEL diff --git a/sources b/sources index f094ef6..f34d266 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.16.1.tar.xz) = a6c54d5f8796b353fce1467a81293491fd2a1c221eba1271a4ee0b9020ff5137d5dba68c8de5e65ab127ab908a403a0b59102def1f675f26f0322a2f7bc41c6f -SHA512 (samba-4.16.1.tar.asc) = 71895a0626dce7fe42f0370190dd4b5f7eb5ce0359bacfe779642c5915a6290d8d4f841f3c258a774829a03fa59be6353863494d2f0cf6bc7640a98af7e928e8 +SHA512 (samba-4.16.2.tar.xz) = f29a49b119b55db063bf69a6df57fd29667bb3ee7a22f3af7ea9cafa88b05ce21cae11464de073c1f0c963e46b571c94a5ccaed3f364f851fe8a4b5d5064e794 +SHA512 (samba-4.16.2.tar.asc) = bb22bb3da89bffdc213ed240204f8f801291db4ee0df73aa814e222355da5f774997a7a4f0a0685743a660bb4540e4b168dc2d3cd00bc22b9735caf140a3bfa0 From 58b6aadb0f9ad00ae65a959d3a98a553f45c55af Mon Sep 17 00:00:00 2001 From: Python Maint Date: Wed, 15 Jun 2022 18:06:15 +0200 Subject: [PATCH 191/425] Rebuilt for Python 3.11 --- samba.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index e7fef22..55ef9e5 100644 --- a/samba.spec +++ b/samba.spec @@ -134,7 +134,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 0 +%global baserelease 1 %global samba_version 4.16.2 %global talloc_version 2.3.3 @@ -4156,6 +4156,9 @@ fi %endif %changelog +* Wed Jun 15 2022 Python Maint - 2:4.16.2-1 +- Rebuilt for Python 3.11 + * Mon Jun 13 2022 Guenther Deschner - 4.16.2-0 - Update to Samba 4.16.2 - resolves: #2096167 From 33e4d192980f56233c4f2cf82c0480887330cf95 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 24 Jun 2022 07:30:58 +0200 Subject: [PATCH 192/425] Fix BR with includelibs --- samba.spec | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 55ef9e5..18d9b97 100644 --- a/samba.spec +++ b/samba.spec @@ -365,12 +365,18 @@ BuildRequires: lmdb-devel %if %{with dc} || %{with testsuite} BuildRequires: bind BuildRequires: krb5-server >= %{required_mit_krb5} -BuildRequires: ldb-tools BuildRequires: python3-gpg BuildRequires: python3-markdown BuildRequires: python3-setproctitle BuildRequires: python3-cryptography + +%if %{without includelibs} BuildRequires: tdb-tools +BuildRequires: ldb-tools +#endif without includelibs +%endif + +#endif with dc || with testsuite %endif # filter out perl requirements pulled in from examples in the docdir. From 9a15eb02f24c5a90e5aa4fce0f377823a0c44651 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 18 Jul 2022 17:37:37 +0200 Subject: [PATCH 193/425] Update to version 4.16.3 --- .gitignore | 2 ++ samba.spec | 6 +++++- sources | 4 ++-- 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 18704d2..b916f33 100644 --- a/.gitignore +++ b/.gitignore @@ -293,3 +293,5 @@ samba-3.6.0pre1.tar.gz /samba-4.16.1.tar.asc /samba-4.16.2.tar.xz /samba-4.16.2.tar.asc +/samba-4.16.3.tar.xz +/samba-4.16.3.tar.asc diff --git a/samba.spec b/samba.spec index 18d9b97..5647e47 100644 --- a/samba.spec +++ b/samba.spec @@ -136,7 +136,7 @@ %global baserelease 1 -%global samba_version 4.16.2 +%global samba_version 4.16.3 %global talloc_version 2.3.3 %global tdb_version 1.4.6 %global tevent_version 0.12.0 @@ -2104,6 +2104,7 @@ fi %{_libdir}/samba/bind9/dlz_bind9_12.so %{_libdir}/samba/bind9/dlz_bind9_14.so %{_libdir}/samba/bind9/dlz_bind9_16.so +%{_libdir}/samba/bind9/dlz_bind9_18.so #endif with dc %endif @@ -4162,6 +4163,9 @@ fi %endif %changelog +* Mon Jul 18 2022 Andreas Schneider - 4.16.3-1 +- Update to version 4.16.3 + * Wed Jun 15 2022 Python Maint - 2:4.16.2-1 - Rebuilt for Python 3.11 diff --git a/sources b/sources index f34d266..433dbb4 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.16.2.tar.xz) = f29a49b119b55db063bf69a6df57fd29667bb3ee7a22f3af7ea9cafa88b05ce21cae11464de073c1f0c963e46b571c94a5ccaed3f364f851fe8a4b5d5064e794 -SHA512 (samba-4.16.2.tar.asc) = bb22bb3da89bffdc213ed240204f8f801291db4ee0df73aa814e222355da5f774997a7a4f0a0685743a660bb4540e4b168dc2d3cd00bc22b9735caf140a3bfa0 +SHA512 (samba-4.16.3.tar.xz) = aa11e65e52f57fd940d6b381fff7bac77bf94b421c1980b3731b36b815d27b6218f3192a7a8a1b9c7d27f80e381c9a7c8b7a0f76a2ec6cfad6b8748bbfd958cc +SHA512 (samba-4.16.3.tar.asc) = 98f07c312263e3ff4594fa1204184f15212f0c4771d45b349ab48981caefaa94aa7ae5223922d1cbaac9f423554b7a5c4107cb3a3599041cf38af6f665a9289a From 8939f84a48d5d770f53a791b7c15e55c78c36464 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 23 Jul 2022 07:57:26 +0000 Subject: [PATCH 194/425] Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- samba.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 5647e47..45a80e5 100644 --- a/samba.spec +++ b/samba.spec @@ -134,7 +134,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 1 +%global baserelease 2 %global samba_version 4.16.3 %global talloc_version 2.3.3 @@ -4163,6 +4163,9 @@ fi %endif %changelog +* Sat Jul 23 2022 Fedora Release Engineering - 2:4.16.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + * Mon Jul 18 2022 Andreas Schneider - 4.16.3-1 - Update to version 4.16.3 From b41f002876d4edc137a6dd73737d3eceaf285909 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 27 Jul 2022 14:36:13 +0200 Subject: [PATCH 195/425] Update to version 4.16.4 resolves: #2111490 resolves: #2108196, #2111729 - Security fixes for CVE-2022-32742 resolves: #2108205, #2111731 - Security fixes for CVE-2022-32744 resolves: #2108211, #2111732 - Security fixes for CVE-2022-32745 resolves: #2108215, #2111734 - Security fixes for CVE-2022-32746 Guenther --- .gitignore | 2 ++ samba-mount_h.patch | 36 ++++++++++++++++++++++++++++ samba-s4u.patch | 58 ++++++++++++--------------------------------- samba.spec | 17 ++++++++++--- sources | 4 ++-- 5 files changed, 69 insertions(+), 48 deletions(-) create mode 100644 samba-mount_h.patch diff --git a/.gitignore b/.gitignore index b916f33..477e1dc 100644 --- a/.gitignore +++ b/.gitignore @@ -295,3 +295,5 @@ samba-3.6.0pre1.tar.gz /samba-4.16.2.tar.asc /samba-4.16.3.tar.xz /samba-4.16.3.tar.asc +/samba-4.16.4.tar.xz +/samba-4.16.4.tar.asc diff --git a/samba-mount_h.patch b/samba-mount_h.patch new file mode 100644 index 0000000..9b3ead2 --- /dev/null +++ b/samba-mount_h.patch @@ -0,0 +1,36 @@ +From 37b1f282d1b549063d2fca07caca812292be1d3b Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Fri, 29 Jul 2022 10:08:24 +0200 +Subject: [PATCH] lib:replace: Remove from filesys.h + +You need to be careful if you include or +at least since glibc 2.36. + +Details at: +https://sourceware.org/glibc/wiki/Release/2.36#Usage_of_.3Clinux.2Fmount.h.3E_and_.3Csys.2Fmount.h.3E + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15132 + +Signed-off-by: Andreas Schneider +--- + lib/replace/system/filesys.h | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/lib/replace/system/filesys.h b/lib/replace/system/filesys.h +index 034e5d5886c..190c6b90f93 100644 +--- a/lib/replace/system/filesys.h ++++ b/lib/replace/system/filesys.h +@@ -36,10 +36,6 @@ + #include + #endif + +-#ifdef HAVE_SYS_MOUNT_H +-#include +-#endif +- + #ifdef HAVE_MNTENT_H + #include + #endif +-- +2.37.1 + diff --git a/samba-s4u.patch b/samba-s4u.patch index f447b86..5d3cb55 100644 --- a/samba-s4u.patch +++ b/samba-s4u.patch @@ -1,7 +1,7 @@ -From 17eb98d3f8ebd0fe48e218bb03a3c0165b9b6e95 Mon Sep 17 00:00:00 2001 +From 5d7ec9a00b6f4c6768c606d37d235415f2006445 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Fri, 27 Sep 2019 18:25:03 +0300 -Subject: [PATCH 1/4] mit-kdc: add basic loacl realm S4U support +Subject: [PATCH 1/3] mit-kdc: add basic loacl realm S4U support Signed-off-by: Isaac Boukris Pair-Programmed-With: Andreas Schneider @@ -236,7 +236,7 @@ index 793fe366c35..22534c09974 100644 diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c -index 27b15828468..994dfed312b 100644 +index cb72b5de294..03c2c2ea1de 100644 --- a/source4/kdc/mit_samba.c +++ b/source4/kdc/mit_samba.c @@ -517,7 +517,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx, @@ -247,7 +247,7 @@ index 27b15828468..994dfed312b 100644 krb5_db_entry *client, krb5_db_entry *server, krb5_db_entry *krbtgt, -@@ -682,7 +681,7 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, +@@ -689,7 +688,7 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, context, *pac, server->princ, @@ -256,7 +256,7 @@ index 27b15828468..994dfed312b 100644 deleg_blob); if (!NT_STATUS_IS_OK(nt_status)) { DEBUG(0, ("Update delegation info failed: %s\n", -@@ -1004,41 +1003,17 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx, +@@ -1081,41 +1080,17 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx, } int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx, @@ -333,13 +333,13 @@ index 4431e82a1b2..9370ab533af 100644 int mit_samba_kpasswd_change_password(struct mit_samba_context *ctx, char *pwd, -- -2.33.1 +2.37.1 -From f4fc23103f47b712baf3b4b0ebcb42d0f3f3fd42 Mon Sep 17 00:00:00 2001 +From 325912375cf54743ab8ea557172a72b870002e9f Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Fri, 27 Sep 2019 18:35:30 +0300 -Subject: [PATCH 2/4] krb5-mit: enable S4U client support for MIT build +Subject: [PATCH 2/3] krb5-mit: enable S4U client support for MIT build Signed-off-by: Isaac Boukris Pair-Programmed-With: Andreas Schneider @@ -350,10 +350,10 @@ Pair-Programmed-With: Andreas Schneider 3 files changed, 185 insertions(+), 13 deletions(-) diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c -index 61d651b4d5f..462acec90b6 100644 +index 4321f07ca09..3fd95e47fca 100644 --- a/lib/krb5_wrap/krb5_samba.c +++ b/lib/krb5_wrap/krb5_samba.c -@@ -2699,6 +2699,191 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx, +@@ -2702,6 +2702,191 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx, return 0; } @@ -611,20 +611,20 @@ index 544d9d853cc..c14d8c72d8c 100644 ret = smb_krb5_kinit_password_ccache(smb_krb5_context->krb5_context, ccache, -- -2.33.1 +2.37.1 -From 48d73d552f2fbbdb07bd9aff4d0294883b70417f Mon Sep 17 00:00:00 2001 +From a5713b1558192f24348f7794da84bf65cf78e6ec Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Sat, 19 Sep 2020 14:16:20 +0200 -Subject: [PATCH 3/4] wip: for canonicalization with new MIT kdc code +Subject: [PATCH 3/3] wip: for canonicalization with new MIT kdc code --- source4/kdc/mit_samba.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c -index 994dfed312b..9d039e5601b 100644 +index 03c2c2ea1de..30fade56531 100644 --- a/source4/kdc/mit_samba.c +++ b/source4/kdc/mit_samba.c @@ -232,6 +232,9 @@ int mit_samba_get_principal(struct mit_samba_context *ctx, @@ -638,33 +638,5 @@ index 994dfed312b..9d039e5601b 100644 KRB5_KDB_FLAG_INCLUDE_PAC)) { /* -- -2.33.1 - - -From f5f54026d151f6d899e8ff52d8829a2f9cf57f25 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Tue, 21 Dec 2021 12:17:11 +0100 -Subject: [PATCH 4/4] s4:kdc: Also cannoicalize krbtgt principals when - enforcing canonicalization - -Signed-off-by: Andreas Schneider ---- - source4/kdc/db-glue.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c -index 8d17038cfe6..77c0c0e4746 100644 ---- a/source4/kdc/db-glue.c -+++ b/source4/kdc/db-glue.c -@@ -946,7 +946,7 @@ static krb5_error_code samba_kdc_message2entry(krb5_context context, - if (ent_type == SAMBA_KDC_ENT_TYPE_KRBTGT) { - p->is_krbtgt = true; - -- if (flags & (SDB_F_CANON)) { -+ if (flags & (SDB_F_CANON|SDB_F_FORCE_CANON)) { - /* - * When requested to do so, ensure that the - * both realm values in the principal are set --- -2.33.1 +2.37.1 diff --git a/samba.spec b/samba.spec index 45a80e5..54c3317 100644 --- a/samba.spec +++ b/samba.spec @@ -134,13 +134,13 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 2 +%global baserelease 0 -%global samba_version 4.16.3 +%global samba_version 4.16.4 %global talloc_version 2.3.3 %global tdb_version 1.4.6 %global tevent_version 0.12.0 -%global ldb_version 2.5.1 +%global ldb_version 2.5.2 # This should be rc1 or nil %global pre_release %nil @@ -207,6 +207,8 @@ Source201: README.downgrade Patch0: samba-s4u.patch # https://gitlab.com/samba-team/samba/-/merge_requests/2477 Patch1: samba-4.16-waf-crypto.patch +# https://gitlab.com/samba-team/samba/-/merge_requests/2647 +Patch2: samba-mount_h.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -2979,6 +2981,7 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_base_test.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tgs_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/kpasswd_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/ms_kile_client_principal_lookup_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/pac_align_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/raw_testcase.*.pyc @@ -3005,6 +3008,7 @@ fi %{python3_sitearch}/samba/tests/krb5/kdc_base_test.py %{python3_sitearch}/samba/tests/krb5/kdc_tests.py %{python3_sitearch}/samba/tests/krb5/kdc_tgs_tests.py +%{python3_sitearch}/samba/tests/krb5/kpasswd_tests.py %{python3_sitearch}/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py %{python3_sitearch}/samba/tests/krb5/pac_align_tests.py %{python3_sitearch}/samba/tests/krb5/raw_testcase.py @@ -4163,6 +4167,13 @@ fi %endif %changelog +* Wed Jul 27 2022 Guenther Deschner - 4.16.4-0 +- resolves: #2111490 - Update to version 4.16.4 +- resolves: #2108196, #2111729 - Security fixes for CVE-2022-32742 +- resolves: #2108205, #2111731 - Security fixes for CVE-2022-32744 +- resolves: #2108211, #2111732 - Security fixes for CVE-2022-32745 +- resolves: #2108215, #2111734 - Security fixes for CVE-2022-32746 + * Sat Jul 23 2022 Fedora Release Engineering - 2:4.16.3-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild diff --git a/sources b/sources index 433dbb4..851386b 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.16.3.tar.xz) = aa11e65e52f57fd940d6b381fff7bac77bf94b421c1980b3731b36b815d27b6218f3192a7a8a1b9c7d27f80e381c9a7c8b7a0f76a2ec6cfad6b8748bbfd958cc -SHA512 (samba-4.16.3.tar.asc) = 98f07c312263e3ff4594fa1204184f15212f0c4771d45b349ab48981caefaa94aa7ae5223922d1cbaac9f423554b7a5c4107cb3a3599041cf38af6f665a9289a +SHA512 (samba-4.16.4.tar.xz) = 263c33f202462c50ba9205232cc59f17eef6526bbe97cc1c6be6606e5e2fa8e235f24693da5ef00106ed126c5e2e1d83e2cfc0d2a690303ac94a8737e6760e95 +SHA512 (samba-4.16.4.tar.asc) = aec1d0dc15169dfa0f68776cff083b8a9ecfeb348d20cde02e236eda3548e1df13f6df3e9275ede6e8fdc6193b2fd304d2f493507b49f5877dbb6b7181d90367 From a74bd638b7842dfeaf48a1890db083d32c00a956 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Franti=C5=A1ek=20Zatloukal?= Date: Mon, 1 Aug 2022 15:10:39 +0200 Subject: [PATCH 196/425] Rebuilt for ICU 71.1 --- samba.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 54c3317..e915388 100644 --- a/samba.spec +++ b/samba.spec @@ -134,7 +134,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 0 +%global baserelease 1 %global samba_version 4.16.4 %global talloc_version 2.3.3 @@ -4167,6 +4167,9 @@ fi %endif %changelog +* Mon Aug 01 2022 Frantisek Zatloukal - 2:4.16.4-1 +- Rebuilt for ICU 71.1 + * Wed Jul 27 2022 Guenther Deschner - 4.16.4-0 - resolves: #2111490 - Update to version 4.16.4 - resolves: #2108196, #2111729 - Security fixes for CVE-2022-32742 From 8380904ad81171eb3f8bd2841bd4070f1efc91a3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 8 Aug 2022 22:32:54 +0200 Subject: [PATCH 197/425] Update to version 4.17.0rc1 resolves: #2116503 Guenther --- .gitignore | 2 + samba-4.16-waf-crypto.patch | 77 ----- samba-mount_h.patch | 36 -- samba-s4u.patch | 642 ------------------------------------ samba.spec | 140 ++++---- sources | 4 +- 6 files changed, 84 insertions(+), 817 deletions(-) delete mode 100644 samba-4.16-waf-crypto.patch delete mode 100644 samba-mount_h.patch delete mode 100644 samba-s4u.patch diff --git a/.gitignore b/.gitignore index 477e1dc..cb83d82 100644 --- a/.gitignore +++ b/.gitignore @@ -297,3 +297,5 @@ samba-3.6.0pre1.tar.gz /samba-4.16.3.tar.asc /samba-4.16.4.tar.xz /samba-4.16.4.tar.asc +/samba-4.17.0rc1.tar.xz +/samba-4.17.0rc1.tar.asc diff --git a/samba-4.16-waf-crypto.patch b/samba-4.16-waf-crypto.patch deleted file mode 100644 index 337be97..0000000 --- a/samba-4.16-waf-crypto.patch +++ /dev/null @@ -1,77 +0,0 @@ -From 41d3efebcf6abab9119f9b0f97c86c1c48739fee Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Mon, 4 Apr 2022 11:24:04 +0200 -Subject: [PATCH 1/2] waf: Check for GnuTLS earlier - -As GnuTLS is an essential part we need to check for it early so we can react on -GnuTLS features in other wscripts. - -Signed-off-by: Andreas Schneider ---- - wscript | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/wscript b/wscript -index d8220b35095..5b85d9a1682 100644 ---- a/wscript -+++ b/wscript -@@ -189,6 +189,8 @@ def configure(conf): - conf.RECURSE('dynconfig') - conf.RECURSE('selftest') - -+ conf.PROCESS_SEPARATE_RULE('system_gnutls') -+ - conf.CHECK_CFG(package='zlib', minversion='1.2.3', - args='--cflags --libs', - mandatory=True) -@@ -297,8 +299,6 @@ def configure(conf): - if not conf.CONFIG_GET('KRB5_VENDOR'): - conf.PROCESS_SEPARATE_RULE('embedded_heimdal') - -- conf.PROCESS_SEPARATE_RULE('system_gnutls') -- - conf.RECURSE('source4/dsdb/samdb/ldb_modules') - conf.RECURSE('source4/ntvfs/sysdep') - conf.RECURSE('lib/util') --- -2.35.1 - - -From 63701a28116afc1550c23cb5f7b9d6e366fd1270 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Mon, 4 Apr 2022 11:25:31 +0200 -Subject: [PATCH 2/2] third_party:waf: Do not recurse in aesni-intel if GnuTLS - provides the cipher - -Signed-off-by: Andreas Schneider ---- - third_party/wscript | 6 ++++-- - 1 file changed, 4 insertions(+), 2 deletions(-) - -diff --git a/third_party/wscript b/third_party/wscript -index 1f4bc1ce1d7..a17c15bcaa7 100644 ---- a/third_party/wscript -+++ b/third_party/wscript -@@ -5,7 +5,8 @@ from waflib import Options - def configure(conf): - conf.RECURSE('cmocka') - conf.RECURSE('popt') -- conf.RECURSE('aesni-intel') -+ if not conf.CONFIG_SET('HAVE_GNUTLS_AES_CMAC'): -+ conf.RECURSE('aesni-intel') - if conf.CONFIG_GET('ENABLE_SELFTEST'): - conf.RECURSE('socket_wrapper') - conf.RECURSE('nss_wrapper') -@@ -18,7 +19,8 @@ def configure(conf): - def build(bld): - bld.RECURSE('cmocka') - bld.RECURSE('popt') -- bld.RECURSE('aesni-intel') -+ if not bld.CONFIG_SET('HAVE_GNUTLS_AES_CMAC'): -+ bld.RECURSE('aesni-intel') - if bld.CONFIG_GET('SOCKET_WRAPPER'): - bld.RECURSE('socket_wrapper') - if bld.CONFIG_GET('NSS_WRAPPER'): --- -2.35.1 - diff --git a/samba-mount_h.patch b/samba-mount_h.patch deleted file mode 100644 index 9b3ead2..0000000 --- a/samba-mount_h.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 37b1f282d1b549063d2fca07caca812292be1d3b Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Fri, 29 Jul 2022 10:08:24 +0200 -Subject: [PATCH] lib:replace: Remove from filesys.h - -You need to be careful if you include or -at least since glibc 2.36. - -Details at: -https://sourceware.org/glibc/wiki/Release/2.36#Usage_of_.3Clinux.2Fmount.h.3E_and_.3Csys.2Fmount.h.3E - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15132 - -Signed-off-by: Andreas Schneider ---- - lib/replace/system/filesys.h | 4 ---- - 1 file changed, 4 deletions(-) - -diff --git a/lib/replace/system/filesys.h b/lib/replace/system/filesys.h -index 034e5d5886c..190c6b90f93 100644 ---- a/lib/replace/system/filesys.h -+++ b/lib/replace/system/filesys.h -@@ -36,10 +36,6 @@ - #include - #endif - --#ifdef HAVE_SYS_MOUNT_H --#include --#endif -- - #ifdef HAVE_MNTENT_H - #include - #endif --- -2.37.1 - diff --git a/samba-s4u.patch b/samba-s4u.patch deleted file mode 100644 index 5d3cb55..0000000 --- a/samba-s4u.patch +++ /dev/null @@ -1,642 +0,0 @@ -From 5d7ec9a00b6f4c6768c606d37d235415f2006445 Mon Sep 17 00:00:00 2001 -From: Isaac Boukris -Date: Fri, 27 Sep 2019 18:25:03 +0300 -Subject: [PATCH 1/3] mit-kdc: add basic loacl realm S4U support - -Signed-off-by: Isaac Boukris -Pair-Programmed-With: Andreas Schneider ---- - source4/kdc/mit-kdb/kdb_samba_policies.c | 124 +++++++++++------------ - source4/kdc/mit_samba.c | 47 ++------- - source4/kdc/mit_samba.h | 6 +- - 3 files changed, 71 insertions(+), 106 deletions(-) - -diff --git a/source4/kdc/mit-kdb/kdb_samba_policies.c b/source4/kdc/mit-kdb/kdb_samba_policies.c -index 793fe366c35..22534c09974 100644 ---- a/source4/kdc/mit-kdb/kdb_samba_policies.c -+++ b/source4/kdc/mit-kdb/kdb_samba_policies.c -@@ -200,13 +200,17 @@ static krb5_error_code ks_verify_pac(krb5_context context, - krb5_keyblock *krbtgt_key, - krb5_timestamp authtime, - krb5_authdata **tgt_auth_data, -- krb5_pac *pac) -+ krb5_pac *out_pac) - { - struct mit_samba_context *mit_ctx; - krb5_authdata **authdata = NULL; -- krb5_pac ipac = NULL; -- DATA_BLOB logon_data = { NULL, 0 }; -+ krb5_keyblock *header_server_key = NULL; -+ krb5_key_data *impersonator_kd = NULL; -+ krb5_keyblock impersonator_key = {0}; - krb5_error_code code; -+ krb5_pac pac; -+ -+ *out_pac = NULL; - - mit_ctx = ks_get_context(context); - if (mit_ctx == NULL) { -@@ -238,41 +242,43 @@ static krb5_error_code ks_verify_pac(krb5_context context, - code = krb5_pac_parse(context, - authdata[0]->contents, - authdata[0]->length, -- &ipac); -+ &pac); - if (code != 0) { - goto done; - } - -- /* TODO: verify this is correct -- * -- * In the constrained delegation case, the PAC is from a service -- * ticket rather than a TGT; we must verify the server and KDC -- * signatures to assert that the server did not forge the PAC. -+ /* -+ * For constrained delegation in MIT version < 1.18 we aren't provided -+ * with the 2nd ticket server key to verify the PAC. -+ * We can workaround that by fetching the key from the client db entry, -+ * which is the impersonator account in that version. -+ * TODO: use the provided entry in the new 1.18 version. - */ - if (flags & KRB5_KDB_FLAG_CONSTRAINED_DELEGATION) { -- code = krb5_pac_verify(context, -- ipac, -- authtime, -- client_princ, -- server_key, -- krbtgt_key); -+ /* The impersonator must be local. */ -+ if (client == NULL) { -+ code = KRB5KDC_ERR_BADOPTION; -+ goto done; -+ } -+ /* Fetch and decrypt 2nd ticket server's current key. */ -+ code = krb5_dbe_find_enctype(context, client, -1, -1, 0, -+ &impersonator_kd); -+ if (code != 0) { -+ goto done; -+ } -+ code = krb5_dbe_decrypt_key_data(context, NULL, -+ impersonator_kd, -+ &impersonator_key, NULL); -+ if (code != 0) { -+ goto done; -+ } -+ header_server_key = &impersonator_key; - } else { -- code = krb5_pac_verify(context, -- ipac, -- authtime, -- client_princ, -- krbtgt_key, -- NULL); -- } -- if (code != 0) { -- goto done; -+ header_server_key = krbtgt_key; - } - -- /* check and update PAC */ -- code = krb5_pac_parse(context, -- authdata[0]->contents, -- authdata[0]->length, -- pac); -+ code = krb5_pac_verify(context, pac, authtime, client_princ, -+ header_server_key, NULL); - if (code != 0) { - goto done; - } -@@ -280,17 +286,22 @@ static krb5_error_code ks_verify_pac(krb5_context context, - code = mit_samba_reget_pac(mit_ctx, - context, - flags, -- client_princ, - client, - server, - krbtgt, - krbtgt_key, -- pac); -+ &pac); -+ if (code != 0) { -+ goto done; -+ } -+ -+ *out_pac = pac; -+ pac = NULL; - - done: -+ krb5_free_keyblock_contents(context, &impersonator_key); - krb5_free_authdata(context, authdata); -- krb5_pac_free(context, ipac); -- free(logon_data.data); -+ krb5_pac_free(context, pac); - - return code; - } -@@ -319,6 +330,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - krb5_authdata **pac_auth_data = NULL; - krb5_authdata **authdata = NULL; - krb5_boolean is_as_req; -+ krb5_const_principal pac_client; - krb5_error_code code; - krb5_pac pac = NULL; - krb5_data pac_data; -@@ -330,11 +342,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - krbtgt = krbtgt == NULL ? local_krbtgt : krbtgt; - krbtgt_key = krbtgt_key == NULL ? local_krbtgt_key : krbtgt_key; - -- /* FIXME: We don't support S4U yet */ -- if (flags & KRB5_KDB_FLAGS_S4U) { -- return KRB5_KDB_DBTYPE_NOSUP; -- } -- - is_as_req = ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) != 0); - - /* -@@ -395,6 +402,16 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - ks_client_princ = client->princ; - } - -+ /* In protocol transition, we are currently not provided with the tgt -+ * client name to verify the PAC, we could probably skip the name -+ * verification and just verify the signatures, but since we don't -+ * support cross-realm nor aliases, we can just use server->princ */ -+ if (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION) { -+ pac_client = server->princ; -+ } else { -+ pac_client = ks_client_princ; -+ } -+ - if (client_entry == NULL) { - client_entry = client; - } -@@ -469,7 +486,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - - code = ks_verify_pac(context, - flags, -- ks_client_princ, -+ pac_client, - client_entry, - server, - krbtgt, -@@ -515,7 +532,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - is_as_req ? "AS-REQ" : "TGS-REQ", - client_name); - code = krb5_pac_sign(context, pac, authtime, ks_client_princ, -- server_key, krbtgt_key, &pac_data); -+ server_key, krbtgt_key, &pac_data); - if (code != 0) { - DBG_ERR("krb5_pac_sign failed: %d\n", code); - goto done; -@@ -541,12 +558,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - KRB5_AUTHDATA_IF_RELEVANT, - authdata, - signed_auth_data); -- if (code != 0) { -- goto done; -- } -- -- code = 0; -- - done: - if (client_entry != NULL && client_entry != client) { - ks_free_principal(context, client_entry); -@@ -572,32 +583,13 @@ krb5_error_code kdb_samba_db_check_allowed_to_delegate(krb5_context context, - * server; -> delegating service - * proxy; -> target principal - */ -- krb5_db_entry *delegating_service = discard_const_p(krb5_db_entry, server); -- -- char *target_name = NULL; -- bool is_enterprise; -- krb5_error_code code; - - mit_ctx = ks_get_context(context); - if (mit_ctx == NULL) { - return KRB5_KDB_DBNOTINITED; - } - -- code = krb5_unparse_name(context, proxy, &target_name); -- if (code) { -- goto done; -- } -- -- is_enterprise = (proxy->type == KRB5_NT_ENTERPRISE_PRINCIPAL); -- -- code = mit_samba_check_s4u2proxy(mit_ctx, -- delegating_service, -- target_name, -- is_enterprise); -- --done: -- free(target_name); -- return code; -+ return mit_samba_check_s4u2proxy(mit_ctx, server, proxy); - } - - -diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c -index cb72b5de294..03c2c2ea1de 100644 ---- a/source4/kdc/mit_samba.c -+++ b/source4/kdc/mit_samba.c -@@ -517,7 +517,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx, - krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, - krb5_context context, - int flags, -- krb5_const_principal client_principal, - krb5_db_entry *client, - krb5_db_entry *server, - krb5_db_entry *krbtgt, -@@ -689,7 +688,7 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, - context, - *pac, - server->princ, -- discard_const(client_principal), -+ client->princ, - deleg_blob); - if (!NT_STATUS_IS_OK(nt_status)) { - DEBUG(0, ("Update delegation info failed: %s\n", -@@ -1081,41 +1080,17 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx, - } - - int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx, -- krb5_db_entry *kentry, -- const char *target_name, -- bool is_nt_enterprise_name) -+ const krb5_db_entry *server, -+ krb5_const_principal target_principal) - { --#if 1 -- /* -- * This is disabled because mit_samba_update_pac_data() does not handle -- * S4U_DELEGATION_INFO -- */ -- -- return KRB5KDC_ERR_BADOPTION; --#else -- krb5_principal target_principal; -- int flags = 0; -- int ret; -- -- if (is_nt_enterprise_name) { -- flags = KRB5_PRINCIPAL_PARSE_ENTERPRISE; -- } -- -- ret = krb5_parse_name_flags(ctx->context, target_name, -- flags, &target_principal); -- if (ret) { -- return ret; -- } -- -- ret = samba_kdc_check_s4u2proxy(ctx->context, -- ctx->db_ctx, -- skdc_entry, -- target_principal); -- -- krb5_free_principal(ctx->context, target_principal); -- -- return ret; --#endif -+ struct samba_kdc_entry *server_skdc_entry = -+ talloc_get_type_abort(server->e_data, -+ struct samba_kdc_entry); -+ -+ return samba_kdc_check_s4u2proxy(ctx->context, -+ ctx->db_ctx, -+ server_skdc_entry, -+ target_principal); - } - - static krb5_error_code mit_samba_change_pwd_error(krb5_context context, -diff --git a/source4/kdc/mit_samba.h b/source4/kdc/mit_samba.h -index 4431e82a1b2..9370ab533af 100644 ---- a/source4/kdc/mit_samba.h -+++ b/source4/kdc/mit_samba.h -@@ -57,7 +57,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx, - krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, - krb5_context context, - int flags, -- krb5_const_principal client_principal, - krb5_db_entry *client, - krb5_db_entry *server, - krb5_db_entry *krbtgt, -@@ -74,9 +73,8 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx, - DATA_BLOB *e_data); - - int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx, -- krb5_db_entry *kentry, -- const char *target_name, -- bool is_nt_enterprise_name); -+ const krb5_db_entry *server, -+ krb5_const_principal target_principal); - - int mit_samba_kpasswd_change_password(struct mit_samba_context *ctx, - char *pwd, --- -2.37.1 - - -From 325912375cf54743ab8ea557172a72b870002e9f Mon Sep 17 00:00:00 2001 -From: Isaac Boukris -Date: Fri, 27 Sep 2019 18:35:30 +0300 -Subject: [PATCH 2/3] krb5-mit: enable S4U client support for MIT build - -Signed-off-by: Isaac Boukris -Pair-Programmed-With: Andreas Schneider ---- - lib/krb5_wrap/krb5_samba.c | 185 ++++++++++++++++++++++++++ - lib/krb5_wrap/krb5_samba.h | 2 - - source4/auth/kerberos/kerberos_util.c | 11 -- - 3 files changed, 185 insertions(+), 13 deletions(-) - -diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c -index 4321f07ca09..3fd95e47fca 100644 ---- a/lib/krb5_wrap/krb5_samba.c -+++ b/lib/krb5_wrap/krb5_samba.c -@@ -2702,6 +2702,191 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx, - - return 0; - } -+ -+#else /* MIT */ -+ -+static bool princ_compare_no_dollar(krb5_context ctx, -+ krb5_principal a, -+ krb5_principal b) -+{ -+ bool cmp; -+ krb5_principal mod = NULL; -+ -+ if (a->length == 1 && b->length == 1 && -+ a->data[0].length != 0 && b->data[0].length != 0 && -+ a->data[0].data[a->data[0].length -1] != -+ b->data[0].data[b->data[0].length -1]) { -+ if (a->data[0].data[a->data[0].length -1] == '$') { -+ mod = a; -+ mod->data[0].length--; -+ } else if (b->data[0].data[b->data[0].length -1] == '$') { -+ mod = b; -+ mod->data[0].length--; -+ } -+ } -+ -+ cmp = krb5_principal_compare_flags(ctx, a, b, -+ KRB5_PRINCIPAL_COMPARE_CASEFOLD); -+ -+ if (mod != NULL) { -+ mod->data[0].length++; -+ } -+ -+ return cmp; -+} -+ -+krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx, -+ krb5_ccache store_cc, -+ krb5_principal init_principal, -+ const char *init_password, -+ krb5_principal impersonate_principal, -+ const char *self_service, -+ const char *target_service, -+ krb5_get_init_creds_opt *krb_options, -+ time_t *expire_time, -+ time_t *kdc_time) -+{ -+ krb5_error_code code; -+ krb5_principal self_princ = NULL; -+ krb5_principal target_princ = NULL; -+ krb5_creds *store_creds; -+ krb5_creds *s4u2self_creds = NULL; -+ krb5_creds *s4u2proxy_creds = NULL; -+ krb5_creds init_creds = {0}; -+ krb5_creds mcreds = {0}; -+ krb5_flags options = KRB5_GC_NO_STORE; -+ krb5_ccache tmp_cc; -+ bool s4u2proxy; -+ -+ code = krb5_cc_new_unique(ctx, "MEMORY", NULL, &tmp_cc); -+ if (code != 0) { -+ return code; -+ } -+ -+ code = krb5_get_init_creds_password(ctx, &init_creds, -+ init_principal, -+ init_password, -+ NULL, NULL, -+ 0, -+ NULL, -+ krb_options); -+ if (code != 0) { -+ goto done; -+ } -+ -+ code = krb5_cc_initialize(ctx, tmp_cc, init_creds.client); -+ if (code != 0) { -+ goto done; -+ } -+ -+ code = krb5_cc_store_cred(ctx, tmp_cc, &init_creds); -+ if (code != 0) { -+ goto done; -+ } -+ -+ /* -+ * Check if we also need S4U2Proxy or if S4U2Self is -+ * enough in order to get a ticket for the target. -+ */ -+ if (target_service == NULL) { -+ s4u2proxy = false; -+ } else if (strcmp(target_service, self_service) == 0) { -+ s4u2proxy = false; -+ } else { -+ s4u2proxy = true; -+ } -+ -+ code = krb5_parse_name(ctx, self_service, &self_princ); -+ if (code != 0) { -+ goto done; -+ } -+ -+ /* MIT lacks aliases support in S4U, for S4U2Self we require the tgt -+ * client and the request server to be the same principal name. */ -+ if (!princ_compare_no_dollar(ctx, init_creds.client, self_princ)) { -+ code = KRB5KDC_ERR_PADATA_TYPE_NOSUPP; -+ goto done; -+ } -+ -+ mcreds.client = impersonate_principal; -+ mcreds.server = init_creds.client; -+ -+ code = krb5_get_credentials_for_user(ctx, options, tmp_cc, &mcreds, -+ NULL, &s4u2self_creds); -+ if (code != 0) { -+ goto done; -+ } -+ -+ if (s4u2proxy) { -+ code = krb5_parse_name(ctx, target_service, &target_princ); -+ if (code != 0) { -+ goto done; -+ } -+ -+ mcreds.client = init_creds.client; -+ mcreds.server = target_princ; -+ mcreds.second_ticket = s4u2self_creds->ticket; -+ -+ code = krb5_get_credentials(ctx, options | -+ KRB5_GC_CONSTRAINED_DELEGATION, -+ tmp_cc, &mcreds, &s4u2proxy_creds); -+ if (code != 0) { -+ goto done; -+ } -+ -+ /* Check KDC support of S4U2Proxy extension */ -+ if (!krb5_principal_compare(ctx, s4u2self_creds->client, -+ s4u2proxy_creds->client)) { -+ code = KRB5KDC_ERR_PADATA_TYPE_NOSUPP; -+ goto done; -+ } -+ -+ store_creds = s4u2proxy_creds; -+ } else { -+ store_creds = s4u2self_creds;; -+ -+ /* We need to save the ticket with the requested server name -+ * or the caller won't be able to find it in cache. */ -+ if (!krb5_principal_compare(ctx, self_princ, -+ store_creds->server)) { -+ krb5_free_principal(ctx, store_creds->server); -+ store_creds->server = NULL; -+ code = krb5_copy_principal(ctx, self_princ, -+ &store_creds->server); -+ if (code != 0) { -+ goto done; -+ } -+ } -+ } -+ -+ code = krb5_cc_initialize(ctx, store_cc, store_creds->client); -+ if (code != 0) { -+ goto done; -+ } -+ -+ code = krb5_cc_store_cred(ctx, store_cc, store_creds); -+ if (code != 0) { -+ goto done; -+ } -+ -+ if (expire_time) { -+ *expire_time = (time_t) store_creds->times.endtime; -+ } -+ -+ if (kdc_time) { -+ *kdc_time = (time_t) store_creds->times.starttime; -+ } -+ -+done: -+ krb5_cc_destroy(ctx, tmp_cc); -+ krb5_free_cred_contents(ctx, &init_creds); -+ krb5_free_creds(ctx, s4u2self_creds); -+ krb5_free_creds(ctx, s4u2proxy_creds); -+ krb5_free_principal(ctx, self_princ); -+ krb5_free_principal(ctx, target_princ); -+ -+ return code; -+} - #endif - - #if !defined(HAVE_KRB5_MAKE_PRINCIPAL) && defined(HAVE_KRB5_BUILD_PRINCIPAL_ALLOC_VA) -diff --git a/lib/krb5_wrap/krb5_samba.h b/lib/krb5_wrap/krb5_samba.h -index a66b7465530..c8573f52bd9 100644 ---- a/lib/krb5_wrap/krb5_samba.h -+++ b/lib/krb5_wrap/krb5_samba.h -@@ -252,7 +252,6 @@ krb5_error_code smb_krb5_kinit_password_ccache(krb5_context ctx, - krb5_get_init_creds_opt *krb_options, - time_t *expire_time, - time_t *kdc_time); --#ifdef SAMBA4_USES_HEIMDAL - krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx, - krb5_ccache store_cc, - krb5_principal init_principal, -@@ -263,7 +262,6 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx, - krb5_get_init_creds_opt *krb_options, - time_t *expire_time, - time_t *kdc_time); --#endif - - #if defined(HAVE_KRB5_MAKE_PRINCIPAL) - #define smb_krb5_make_principal krb5_make_principal -diff --git a/source4/auth/kerberos/kerberos_util.c b/source4/auth/kerberos/kerberos_util.c -index 544d9d853cc..c14d8c72d8c 100644 ---- a/source4/auth/kerberos/kerberos_util.c -+++ b/source4/auth/kerberos/kerberos_util.c -@@ -234,9 +234,7 @@ done: - { - krb5_error_code ret; - const char *password; --#ifdef SAMBA4_USES_HEIMDAL - const char *self_service; --#endif - const char *target_service; - time_t kdc_time = 0; - krb5_principal princ; -@@ -268,9 +266,7 @@ done: - return ret; - } - --#ifdef SAMBA4_USES_HEIMDAL - self_service = cli_credentials_get_self_service(credentials); --#endif - target_service = cli_credentials_get_target_service(credentials); - - password = cli_credentials_get_password(credentials); -@@ -331,7 +327,6 @@ done: - #endif - if (password) { - if (impersonate_principal) { --#ifdef SAMBA4_USES_HEIMDAL - ret = smb_krb5_kinit_s4u2_ccache(smb_krb5_context->krb5_context, - ccache, - princ, -@@ -342,12 +337,6 @@ done: - krb_options, - NULL, - &kdc_time); --#else -- talloc_free(mem_ctx); -- (*error_string) = "INTERNAL error: s4u2 ops " -- "are not supported with MIT build yet"; -- return EINVAL; --#endif - } else { - ret = smb_krb5_kinit_password_ccache(smb_krb5_context->krb5_context, - ccache, --- -2.37.1 - - -From a5713b1558192f24348f7794da84bf65cf78e6ec Mon Sep 17 00:00:00 2001 -From: Isaac Boukris -Date: Sat, 19 Sep 2020 14:16:20 +0200 -Subject: [PATCH 3/3] wip: for canonicalization with new MIT kdc code - ---- - source4/kdc/mit_samba.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c -index 03c2c2ea1de..30fade56531 100644 ---- a/source4/kdc/mit_samba.c -+++ b/source4/kdc/mit_samba.c -@@ -232,6 +232,9 @@ int mit_samba_get_principal(struct mit_samba_context *ctx, - if (kflags & KRB5_KDB_FLAG_CANONICALIZE) { - sflags |= SDB_F_CANON; - } -+#if KRB5_KDB_API_VERSION >= 10 -+ sflags |= SDB_F_FORCE_CANON; -+#endif - if (kflags & (KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY | - KRB5_KDB_FLAG_INCLUDE_PAC)) { - /* --- -2.37.1 - diff --git a/samba.spec b/samba.spec index e915388..e4029cc 100644 --- a/samba.spec +++ b/samba.spec @@ -134,15 +134,15 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 1 +%global baserelease 0 -%global samba_version 4.16.4 -%global talloc_version 2.3.3 -%global tdb_version 1.4.6 -%global tevent_version 0.12.0 -%global ldb_version 2.5.2 +%global samba_version 4.17.0 +%global talloc_version 2.3.4 +%global tdb_version 1.4.7 +%global tevent_version 0.13.0 +%global ldb_version 2.6.1 # This should be rc1 or nil -%global pre_release %nil +%global pre_release rc1 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -204,12 +204,6 @@ Source15: samba.abignore Source201: README.downgrade -Patch0: samba-s4u.patch -# https://gitlab.com/samba-team/samba/-/merge_requests/2477 -Patch1: samba-4.16-waf-crypto.patch -# https://gitlab.com/samba-team/samba/-/merge_requests/2647 -Patch2: samba-mount_h.patch - Requires(pre): /usr/sbin/groupadd Requires(post): systemd Requires(preun): systemd @@ -1194,6 +1188,9 @@ export python_LDFLAGS="$(echo %{__global_ldflags} | sed -e 's/-Wl,-z,defs//g')" --systemd-smb-extra=%{_systemd_extra} \ --systemd-nmb-extra=%{_systemd_extra} \ --systemd-winbind-extra=%{_systemd_extra} \ +%if %{with clustering} + --systemd-ctdb-extra=%{_systemd_extra} \ +%endif --systemd-samba-extra=%{_systemd_extra} # Do not use %%make_build, make is just a wrapper around waf in Samba! @@ -1279,10 +1276,6 @@ install -m 0644 ctdb/config/ctdb.conf %{buildroot}%{_sysconfdir}/ctdb/ctdb.conf install -m 0644 %{SOURCE201} packaging/README.downgrade -%if %{with clustering} -install -m 0644 ctdb/config/ctdb.service %{buildroot}%{_unitdir} -%endif - # NetworkManager online/offline script install -d -m 0755 %{buildroot}%{_prefix}/lib/NetworkManager/dispatcher.d/ install -m 0755 packaging/NetworkManager/30-winbind-systemd \ @@ -2370,18 +2363,6 @@ fi %{python3_sitearch}/samba/__pycache__/dnsresolver.*.pyc %{python3_sitearch}/samba/__pycache__/drs_utils.*.pyc %{python3_sitearch}/samba/__pycache__/getopt.*.pyc -%{python3_sitearch}/samba/__pycache__/gpclass.*.pyc -%{python3_sitearch}/samba/__pycache__/gp_cert_auto_enroll_ext.*.pyc -%{python3_sitearch}/samba/__pycache__/gp_chromium_ext.*.pyc -%{python3_sitearch}/samba/__pycache__/gp_ext_loader.*.pyc -%{python3_sitearch}/samba/__pycache__/gp_firefox_ext.*.pyc -%{python3_sitearch}/samba/__pycache__/gp_firewalld_ext.*.pyc -%{python3_sitearch}/samba/__pycache__/gp_gnome_settings_ext.*.pyc -%{python3_sitearch}/samba/__pycache__/gp_msgs_ext.*.pyc -%{python3_sitearch}/samba/__pycache__/gp_scripts_ext.*.pyc -%{python3_sitearch}/samba/__pycache__/gp_sec_ext.*.pyc -%{python3_sitearch}/samba/__pycache__/gp_smb_conf_ext.*.pyc -%{python3_sitearch}/samba/__pycache__/gp_sudoers_ext.*.pyc %{python3_sitearch}/samba/__pycache__/graph.*.pyc %{python3_sitearch}/samba/__pycache__/hostconfig.*.pyc %{python3_sitearch}/samba/__pycache__/idmap.*.pyc @@ -2399,14 +2380,6 @@ fi %{python3_sitearch}/samba/__pycache__/trust_utils.*.pyc %{python3_sitearch}/samba/__pycache__/upgrade.*.pyc %{python3_sitearch}/samba/__pycache__/upgradehelpers.*.pyc -%{python3_sitearch}/samba/__pycache__/vgp_access_ext.*.pyc -%{python3_sitearch}/samba/__pycache__/vgp_files_ext.*.pyc -%{python3_sitearch}/samba/__pycache__/vgp_issue_ext.*.pyc -%{python3_sitearch}/samba/__pycache__/vgp_motd_ext.*.pyc -%{python3_sitearch}/samba/__pycache__/vgp_openssh_ext.*.pyc -%{python3_sitearch}/samba/__pycache__/vgp_startup_scripts_ext.*.pyc -%{python3_sitearch}/samba/__pycache__/vgp_sudoers_ext.*.pyc -%{python3_sitearch}/samba/__pycache__/vgp_symlink_ext.*.pyc %{python3_sitearch}/samba/__pycache__/xattr.*.pyc %{python3_sitearch}/samba/_glue.*.so %{python3_sitearch}/samba/_ldb.*.so @@ -2468,11 +2441,6 @@ fi %{python3_sitearch}/samba/dsdb_dns.*.so %{python3_sitearch}/samba/gensec.*.so %{python3_sitearch}/samba/getopt.py -%{python3_sitearch}/samba/gpclass.py -%{python3_sitearch}/samba/gp_gnome_settings_ext.py -%{python3_sitearch}/samba/gp_scripts_ext.py -%{python3_sitearch}/samba/gp_sec_ext.py -%{python3_sitearch}/samba/gpo.*.so %{python3_sitearch}/samba/graph.py %{python3_sitearch}/samba/hostconfig.py %{python3_sitearch}/samba/idmap.py @@ -2491,14 +2459,57 @@ fi %{python3_sitearch}/samba/emulate/__init__.py %{python3_sitearch}/samba/emulate/traffic.py %{python3_sitearch}/samba/emulate/traffic_packets.py -%{python3_sitearch}/samba/gp_cert_auto_enroll_ext.py -%{python3_sitearch}/samba/gp_chromium_ext.py -%{python3_sitearch}/samba/gp_ext_loader.py -%{python3_sitearch}/samba/gp_firefox_ext.py -%{python3_sitearch}/samba/gp_firewalld_ext.py -%{python3_sitearch}/samba/gp_msgs_ext.py -%{python3_sitearch}/samba/gp_smb_conf_ext.py -%{python3_sitearch}/samba/gp_sudoers_ext.py +%dir %{python3_sitearch}/samba/gp +%dir %{python3_sitearch}/samba/gp/__pycache__ +%{python3_sitearch}/samba/gp/__pycache__/gpclass.*.pyc +%{python3_sitearch}/samba/gp/__pycache__/gp_centrify_crontab_ext.*.pyc +%{python3_sitearch}/samba/gp/__pycache__/gp_centrify_sudoers_ext.*.pyc +%{python3_sitearch}/samba/gp/__pycache__/gp_cert_auto_enroll_ext.*.pyc +%{python3_sitearch}/samba/gp/__pycache__/gp_chromium_ext.*.pyc +%{python3_sitearch}/samba/gp/__pycache__/gp_ext_loader.*.pyc +%{python3_sitearch}/samba/gp/__pycache__/gp_firefox_ext.*.pyc +%{python3_sitearch}/samba/gp/__pycache__/gp_firewalld_ext.*.pyc +%{python3_sitearch}/samba/gp/__pycache__/gp_gnome_settings_ext.*.pyc +%{python3_sitearch}/samba/gp/__pycache__/gp_msgs_ext.*.pyc +%{python3_sitearch}/samba/gp/__pycache__/gp_scripts_ext.*.pyc +%{python3_sitearch}/samba/gp/__pycache__/gp_sec_ext.*.pyc +%{python3_sitearch}/samba/gp/__pycache__/gp_smb_conf_ext.*.pyc +%{python3_sitearch}/samba/gp/__pycache__/gp_sudoers_ext.*.pyc +%{python3_sitearch}/samba/gp/__pycache__/vgp_access_ext.*.pyc +%{python3_sitearch}/samba/gp/__pycache__/vgp_files_ext.*.pyc +%{python3_sitearch}/samba/gp/__pycache__/vgp_issue_ext.*.pyc +%{python3_sitearch}/samba/gp/__pycache__/vgp_motd_ext.*.pyc +%{python3_sitearch}/samba/gp/__pycache__/vgp_openssh_ext.*.pyc +%{python3_sitearch}/samba/gp/__pycache__/vgp_startup_scripts_ext.*.pyc +%{python3_sitearch}/samba/gp/__pycache__/vgp_sudoers_ext.*.pyc +%{python3_sitearch}/samba/gp/__pycache__/vgp_symlink_ext.*.pyc +%{python3_sitearch}/samba/gp/gpclass.py +%{python3_sitearch}/samba/gp/gp_gnome_settings_ext.py +%{python3_sitearch}/samba/gp/gp_scripts_ext.py +%{python3_sitearch}/samba/gp/gp_sec_ext.py +%{python3_sitearch}/samba/gp/gp_centrify_crontab_ext.py +%{python3_sitearch}/samba/gp/gp_centrify_sudoers_ext.py +%{python3_sitearch}/samba/gp/gp_cert_auto_enroll_ext.py +%{python3_sitearch}/samba/gp/gp_chromium_ext.py +%{python3_sitearch}/samba/gp/gp_ext_loader.py +%{python3_sitearch}/samba/gp/gp_firefox_ext.py +%{python3_sitearch}/samba/gp/gp_firewalld_ext.py +%{python3_sitearch}/samba/gp/gp_msgs_ext.py +%{python3_sitearch}/samba/gp/gp_smb_conf_ext.py +%{python3_sitearch}/samba/gp/gp_sudoers_ext.py +%dir %{python3_sitearch}/samba/gp/util +%dir %{python3_sitearch}/samba/gp/util/__pycache__ +%{python3_sitearch}/samba/gp/util/__pycache__/logging.*.pyc +%{python3_sitearch}/samba/gp/util/logging.py +%{python3_sitearch}/samba/gp/vgp_access_ext.py +%{python3_sitearch}/samba/gp/vgp_files_ext.py +%{python3_sitearch}/samba/gp/vgp_issue_ext.py +%{python3_sitearch}/samba/gp/vgp_motd_ext.py +%{python3_sitearch}/samba/gp/vgp_openssh_ext.py +%{python3_sitearch}/samba/gp/vgp_startup_scripts_ext.py +%{python3_sitearch}/samba/gp/vgp_sudoers_ext.py +%{python3_sitearch}/samba/gp/vgp_symlink_ext.py +%{python3_sitearch}/samba/gpo.*.so %dir %{python3_sitearch}/samba/gp_parse %{python3_sitearch}/samba/gp_parse/__init__.py %dir %{python3_sitearch}/samba/gp_parse/__pycache__ @@ -2593,9 +2604,11 @@ fi %{python3_sitearch}/samba/samba3/mdscli.*.so %{python3_sitearch}/samba/samba3/param.*.so %{python3_sitearch}/samba/samba3/passdb.*.so +%{python3_sitearch}/samba/samba3/smbconf.*.so %{python3_sitearch}/samba/samba3/smbd.*.so %{python3_sitearch}/samba/sd_utils.py %{python3_sitearch}/samba/sites.py +%{python3_sitearch}/samba/smbconf.*.so %{python3_sitearch}/samba/subnets.py %dir %{python3_sitearch}/samba/subunit %{python3_sitearch}/samba/subunit/__init__.py @@ -2607,14 +2620,6 @@ fi %{python3_sitearch}/samba/trust_utils.py %{python3_sitearch}/samba/upgrade.py %{python3_sitearch}/samba/upgradehelpers.py -%{python3_sitearch}/samba/vgp_access_ext.py -%{python3_sitearch}/samba/vgp_files_ext.py -%{python3_sitearch}/samba/vgp_issue_ext.py -%{python3_sitearch}/samba/vgp_motd_ext.py -%{python3_sitearch}/samba/vgp_openssh_ext.py -%{python3_sitearch}/samba/vgp_startup_scripts_ext.py -%{python3_sitearch}/samba/vgp_sudoers_ext.py -%{python3_sitearch}/samba/vgp_symlink_ext.py %{python3_sitearch}/samba/werror.*.so %{python3_sitearch}/samba/xattr.py %{python3_sitearch}/samba/xattr_native.*.so @@ -2760,6 +2765,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/ldap_spn.*.pyc %{python3_sitearch}/samba/tests/__pycache__/ldap_upn_sam_account.*.pyc %{python3_sitearch}/samba/tests/__pycache__/loadparm.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/logfiles.*.pyc %{python3_sitearch}/samba/tests/__pycache__/libsmb.*.pyc %{python3_sitearch}/samba/tests/__pycache__/lsa_string.*.pyc %{python3_sitearch}/samba/tests/__pycache__/messaging.*.pyc @@ -2777,6 +2783,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/ntlm_auth_krb5.*.pyc %{python3_sitearch}/samba/tests/__pycache__/pam_winbind.*.pyc %{python3_sitearch}/samba/tests/__pycache__/pam_winbind_chauthtok.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/pam_winbind_setcred.*.pyc %{python3_sitearch}/samba/tests/__pycache__/pam_winbind_warn_pwd_expire.*.pyc %{python3_sitearch}/samba/tests/__pycache__/param.*.pyc %{python3_sitearch}/samba/tests/__pycache__/password_hash.*.pyc @@ -2807,7 +2814,9 @@ fi %{python3_sitearch}/samba/tests/__pycache__/sddl.*.pyc %{python3_sitearch}/samba/tests/__pycache__/security.*.pyc %{python3_sitearch}/samba/tests/__pycache__/segfault.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/sid_strings.*.pyc %{python3_sitearch}/samba/tests/__pycache__/smb.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/smbconf.*.pyc %{python3_sitearch}/samba/tests/__pycache__/smb-notify.*.pyc %{python3_sitearch}/samba/tests/__pycache__/smbd_base.*.pyc %{python3_sitearch}/samba/tests/__pycache__/smbd_fuzztest.*.pyc @@ -2842,6 +2851,7 @@ fi %{python3_sitearch}/samba/tests/blackbox/__pycache__/downgradedatabase.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/mdsearch.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/ndrdump.*.pyc +%{python3_sitearch}/samba/tests/blackbox/__pycache__/netads_dns.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/netads_json.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/samba_dnsupdate.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/smbcacls.*.pyc @@ -2858,6 +2868,7 @@ fi %{python3_sitearch}/samba/tests/blackbox/downgradedatabase.py %{python3_sitearch}/samba/tests/blackbox/mdsearch.py %{python3_sitearch}/samba/tests/blackbox/ndrdump.py +%{python3_sitearch}/samba/tests/blackbox/netads_dns.py %{python3_sitearch}/samba/tests/blackbox/netads_json.py %{python3_sitearch}/samba/tests/blackbox/samba_dnsupdate.py %{python3_sitearch}/samba/tests/blackbox/smbcacls.py @@ -2983,7 +2994,9 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tgs_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kpasswd_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/ms_kile_client_principal_lookup_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/nt_hash_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/pac_align_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/protected_users_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/raw_testcase.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/rfc4120_constants.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/rfc4120_pyasn1.*.pyc @@ -3010,7 +3023,9 @@ fi %{python3_sitearch}/samba/tests/krb5/kdc_tgs_tests.py %{python3_sitearch}/samba/tests/krb5/kpasswd_tests.py %{python3_sitearch}/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py +%{python3_sitearch}/samba/tests/krb5/nt_hash_tests.py %{python3_sitearch}/samba/tests/krb5/pac_align_tests.py +%{python3_sitearch}/samba/tests/krb5/protected_users_tests.py %{python3_sitearch}/samba/tests/krb5/raw_testcase.py %{python3_sitearch}/samba/tests/krb5/rfc4120_constants.py %{python3_sitearch}/samba/tests/krb5/rfc4120_pyasn1.py @@ -3033,6 +3048,7 @@ fi %{python3_sitearch}/samba/tests/ldap_upn_sam_account.py %{python3_sitearch}/samba/tests/libsmb.py %{python3_sitearch}/samba/tests/loadparm.py +%{python3_sitearch}/samba/tests/logfiles.py %{python3_sitearch}/samba/tests/lsa_string.py %{python3_sitearch}/samba/tests/messaging.py %{python3_sitearch}/samba/tests/ndr.py @@ -3049,6 +3065,7 @@ fi %{python3_sitearch}/samba/tests/ntlm_auth_krb5.py %{python3_sitearch}/samba/tests/pam_winbind.py %{python3_sitearch}/samba/tests/pam_winbind_chauthtok.py +%{python3_sitearch}/samba/tests/pam_winbind_setcred.py %{python3_sitearch}/samba/tests/pam_winbind_warn_pwd_expire.py %{python3_sitearch}/samba/tests/param.py %{python3_sitearch}/samba/tests/password_hash.py @@ -3157,7 +3174,9 @@ fi %{python3_sitearch}/samba/tests/sddl.py %{python3_sitearch}/samba/tests/security.py %{python3_sitearch}/samba/tests/segfault.py +%{python3_sitearch}/samba/tests/sid_strings.py %{python3_sitearch}/samba/tests/smb.py +%{python3_sitearch}/samba/tests/smbconf.py %{python3_sitearch}/samba/tests/smb-notify.py %{python3_sitearch}/samba/tests/smbd_base.py %{python3_sitearch}/samba/tests/smbd_fuzztest.py @@ -3278,7 +3297,6 @@ fi %config(noreplace) %{_sysconfdir}/ctdb/nfs-checks.d/50.rquotad.check %{_sbindir}/ctdbd -%{_sbindir}/ctdbd_wrapper %{_bindir}/ctdb %{_bindir}/ctdb_diagnostics %{_bindir}/ltdbtool @@ -3311,7 +3329,6 @@ fi %{_mandir}/man1/onnode.1.gz %{_mandir}/man1/ltdbtool.1.gz %{_mandir}/man1/ping_pong.1.gz -%{_mandir}/man1/ctdbd_wrapper.1.gz %{_mandir}/man5/ctdb.conf.5.gz %{_mandir}/man5/ctdb-script.options.5.gz %{_mandir}/man5/ctdb.sysconfig.5.gz @@ -4167,6 +4184,9 @@ fi %endif %changelog +* Mon Aug 08 2022 Guenther Deschner - 4.17.0rc1-0 +- resolves: #2116503 - Update to version 4.17.0rc1 + * Mon Aug 01 2022 Frantisek Zatloukal - 2:4.16.4-1 - Rebuilt for ICU 71.1 diff --git a/sources b/sources index 851386b..70773ab 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.16.4.tar.xz) = 263c33f202462c50ba9205232cc59f17eef6526bbe97cc1c6be6606e5e2fa8e235f24693da5ef00106ed126c5e2e1d83e2cfc0d2a690303ac94a8737e6760e95 -SHA512 (samba-4.16.4.tar.asc) = aec1d0dc15169dfa0f68776cff083b8a9ecfeb348d20cde02e236eda3548e1df13f6df3e9275ede6e8fdc6193b2fd304d2f493507b49f5877dbb6b7181d90367 +SHA512 (samba-4.17.0rc1.tar.xz) = e3ba692d9f8dd7e8c4d853b69a1fed2bdc1946610f62ec789018320ad666022aa07f52b80e8f3012d8a6de9373c2fc31f5c5758859eabe7e48b4f9f1b6aa302b +SHA512 (samba-4.17.0rc1.tar.asc) = 2df0e15af5e60f7baa4415bf1f086dd266256a34ceb57e21cec5656b45d95bb801ad42c87f8910b1a97f3b0b9a90fd21519b78eaa5a1a842a1464d97ce9e283c From ce3b414c6d93cb268671b6c95f037ae1f07afe63 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Aug 2022 13:14:01 +0200 Subject: [PATCH 198/425] Regroup variables for version definitions --- samba.spec | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/samba.spec b/samba.spec index e4029cc..ac642e2 100644 --- a/samba.spec +++ b/samba.spec @@ -134,14 +134,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 0 - %global samba_version 4.17.0 -%global talloc_version 2.3.4 -%global tdb_version 1.4.7 -%global tevent_version 0.13.0 -%global ldb_version 2.6.1 -# This should be rc1 or nil +%global baserelease 0 +# This should be rc1 or %%nil %global pre_release rc1 %global samba_release %{baserelease} @@ -149,6 +144,13 @@ %global samba_release 0.%{baserelease}.%{pre_release} %endif +%global talloc_version 2.3.4 +%global tdb_version 1.4.7 +%global tevent_version 0.13.0 +%global ldb_version 2.6.1 + +%global required_mit_krb5 1.19 + # This is a network daemon, do a hardened build # Enables PIE and full RELRO protection %global _hardened_build 1 @@ -165,8 +167,6 @@ %global libwbc_alternatives_suffix -64 %endif -%global required_mit_krb5 1.19 - %global _systemd_extra "Environment=KRB5CCNAME=FILE:/run/samba/krb5cc_samba" Name: samba From 9c2239737959211cf9edbdb20666cd61b83e15a4 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 11 Aug 2022 16:10:41 +0200 Subject: [PATCH 199/425] Make sure we detect if SO version numbers of public libraries change. --- samba.spec | 67 ++++++++++++++++++++++++++++++++++++++---------------- 1 file changed, 47 insertions(+), 20 deletions(-) diff --git a/samba.spec b/samba.spec index ac642e2..c803220 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.0 -%global baserelease 0 +%global baserelease 1 # This should be rc1 or %%nil %global pre_release rc1 @@ -144,6 +144,30 @@ %global samba_release 0.%{baserelease}.%{pre_release} %endif + +# If one of those versions change, we need to make sure we rebuilt or adapt +# projects comsuming those. This is e.g. sssd, openchange, evolution-mapi, ... +%global libdcerpc_binding_so_version 0 +%global libdcerpc_server_core_so_version 0 +%global libdcerpc_so_version 0 +%global libndr_krb5pac_so_version 0 +%global libndr_nbt_so_version 0 +%global libndr_so_version 3 +%global libndr_standard_so_version 0 +%global libnetapi_so_version 1 +%global libsamba_credentials_so_version 1 +%global libsamba_errors_so_version 1 +%global libsamba_hostconfig_so_version 0 +%global libsamba_passdb_so_version 0 +%global libsamba_util_so_version 0 +%global libsamdb_so_version 0 +%global libsmbconf_so_version 0 +%global libsmbldap_so_version 2 +%global libtevent_util_so_version 0 + +%global libsmbclient_so_version 0 +%global libwbclient_so_version 0 + %global talloc_version 2.3.4 %global tdb_version 1.4.7 %global tevent_version 0.13.0 @@ -1791,23 +1815,23 @@ fi ### CLIENT-LIBS %files client-libs -%{_libdir}/libdcerpc-binding.so.* -%{_libdir}/libdcerpc-server-core.so.* -%{_libdir}/libdcerpc.so.* -%{_libdir}/libndr-krb5pac.so.* -%{_libdir}/libndr-nbt.so.* -%{_libdir}/libndr-standard.so.* -%{_libdir}/libndr.so.* -%{_libdir}/libnetapi.so.* -%{_libdir}/libsamba-credentials.so.* -%{_libdir}/libsamba-errors.so.* -%{_libdir}/libsamba-hostconfig.so.* -%{_libdir}/libsamba-passdb.so.* -%{_libdir}/libsamba-util.so.* -%{_libdir}/libsamdb.so.* -%{_libdir}/libsmbconf.so.* -%{_libdir}/libsmbldap.so.* -%{_libdir}/libtevent-util.so.* +%{_libdir}/libdcerpc-binding.so.%{libdcerpc_binding_so_version}* +%{_libdir}/libdcerpc-server-core.so.%{libdcerpc_server_core_so_version}* +%{_libdir}/libdcerpc.so.%{libdcerpc_so_version}* +%{_libdir}/libndr-krb5pac.so.%{libndr_krb5pac_so_version}* +%{_libdir}/libndr-nbt.so.%{libndr_nbt_so_version}* +%{_libdir}/libndr-standard.so.%{libndr_standard_so_version}* +%{_libdir}/libndr.so.%{libndr_so_version}* +%{_libdir}/libnetapi.so.%{libnetapi_so_version}* +%{_libdir}/libsamba-credentials.so.%{libsamba_credentials_so_version}* +%{_libdir}/libsamba-errors.so.%{libsamba_errors_so_version}* +%{_libdir}/libsamba-hostconfig.so.%{libsamba_hostconfig_so_version}* +%{_libdir}/libsamba-passdb.so.%{libsamba_passdb_so_version}* +%{_libdir}/libsamba-util.so.%{libsamba_util_so_version}* +%{_libdir}/libsamdb.so.%{libsamdb_so_version}* +%{_libdir}/libsmbconf.so.%{libsmbconf_so_version}* +%{_libdir}/libsmbldap.so.%{libsmbldap_so_version}* +%{_libdir}/libtevent-util.so.%{libtevent_util_so_version}* %dir %{_libdir}/samba %{_libdir}/samba/libCHARSET3-samba4.so @@ -1896,7 +1920,7 @@ fi %endif %if %{without libsmbclient} -%{_libdir}/samba/libsmbclient.so.* +%{_libdir}/samba/libsmbclient.so.%{libsmbclient_so_version}* %{_mandir}/man7/libsmbclient.7* #endif without libsmbclient %endif @@ -2293,7 +2317,7 @@ fi ### LIBWBCLIENT %if %{with libwbclient} %files -n libwbclient -%{_libdir}/samba/wbclient/libwbclient.so.* +%{_libdir}/samba/wbclient/libwbclient.so.%{libwbclient_so_version}* ### LIBWBCLIENT-DEVEL %files -n libwbclient-devel @@ -4184,6 +4208,9 @@ fi %endif %changelog +* Wed Aug 10 2022 Andreas Schneider - 4.17.0rc1-1 +- Make sure we detect if SO version numbers of public libraries change. + * Mon Aug 08 2022 Guenther Deschner - 4.17.0rc1-0 - resolves: #2116503 - Update to version 4.17.0rc1 From 9f943749c7a60e9e6b3142ed08f50515d06cca8d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 17 Aug 2022 10:50:03 +0200 Subject: [PATCH 200/425] Update to version 4.17.0rc2 resolves: #2118818 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index cb83d82..aa5ec6b 100644 --- a/.gitignore +++ b/.gitignore @@ -299,3 +299,5 @@ samba-3.6.0pre1.tar.gz /samba-4.16.4.tar.asc /samba-4.17.0rc1.tar.xz /samba-4.17.0rc1.tar.asc +/samba-4.17.0rc2.tar.xz +/samba-4.17.0rc2.tar.asc diff --git a/samba.spec b/samba.spec index c803220..925bcc1 100644 --- a/samba.spec +++ b/samba.spec @@ -135,9 +135,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.0 -%global baserelease 1 +%global baserelease 2 # This should be rc1 or %%nil -%global pre_release rc1 +%global pre_release rc2 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4208,6 +4208,9 @@ fi %endif %changelog +* Wed Aug 17 2022 Guenther Deschner - 4.17.0rc2-2 +- resolves: #2118818 - Update to version 4.17.0rc2 + * Wed Aug 10 2022 Andreas Schneider - 4.17.0rc1-1 - Make sure we detect if SO version numbers of public libraries change. diff --git a/sources b/sources index 70773ab..c7679e2 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.17.0rc1.tar.xz) = e3ba692d9f8dd7e8c4d853b69a1fed2bdc1946610f62ec789018320ad666022aa07f52b80e8f3012d8a6de9373c2fc31f5c5758859eabe7e48b4f9f1b6aa302b -SHA512 (samba-4.17.0rc1.tar.asc) = 2df0e15af5e60f7baa4415bf1f086dd266256a34ceb57e21cec5656b45d95bb801ad42c87f8910b1a97f3b0b9a90fd21519b78eaa5a1a842a1464d97ce9e283c +SHA512 (samba-4.17.0rc2.tar.xz) = cacdfff9f04eb584769045262e3bfc51c32f11f1fde8c25d30fb65ab19af98d7e4742b9eb519241954d252d2f921d784b70411e1bcaa04c31482e4f6bcee4a8c +SHA512 (samba-4.17.0rc2.tar.asc) = 3ad03e22726b3e7313be273ed1523c679237824f97788ab307cdf1b2219d5fabb021530c42cdbb10ed92cdfa7753d83a00ab9533047eeaec674b7043c70279d4 From ffcfd9ef88ba6cdc3f54480f217a60bad11bc79e Mon Sep 17 00:00:00 2001 From: Kalev Lember Date: Thu, 18 Aug 2022 17:11:07 +0200 Subject: [PATCH 201/425] Avoid requiring systemd as per updated packaging guidelines There is no need to require systemd for the systemd scriptlets as systemd correctly handles reloading depending on the transaction ordering (even if systemd is installed _after_ the package that installs the unit file). --- samba.spec | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/samba.spec b/samba.spec index 925bcc1..8d092a3 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.0 -%global baserelease 2 +%global baserelease 3 # This should be rc1 or %%nil %global pre_release rc2 @@ -229,9 +229,6 @@ Source15: samba.abignore Source201: README.downgrade Requires(pre): /usr/sbin/groupadd -Requires(post): systemd -Requires(preun): systemd -Requires(postun): systemd Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} @@ -4208,6 +4205,9 @@ fi %endif %changelog +* Thu Aug 18 2022 Kalev Lember - 2:4.17.0-0.3.rc2 +- Avoid requiring systemd as per updated packaging guidelines + * Wed Aug 17 2022 Guenther Deschner - 4.17.0rc2-2 - resolves: #2118818 - Update to version 4.17.0rc2 From 63377a1809b91147e204d74cc28d26c9fec4b745 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 18 Aug 2022 14:57:13 +0200 Subject: [PATCH 202/425] Split out a samba-ldb-ldap-modules subpackage --- samba.spec | 23 ++++++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 8d092a3..26dc09e 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.0 -%global baserelease 3 +%global baserelease 4 # This should be rc1 or %%nil %global pre_release rc2 @@ -509,6 +509,7 @@ Summary: Tools for Samba servers and clients Requires: samba-common-libs = %{samba_depver} Requires: samba-client-libs = %{samba_depver} Requires: samba-libs = %{samba_depver} +Requires: samba-ldb-ldap-modules = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} %endif @@ -537,6 +538,7 @@ Summary: Samba AD Domain Controller Requires: %{name} = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-common-tools = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-dc-provision = %{samba_depver} Requires: %{name}-dc-libs = %{samba_depver} @@ -693,6 +695,15 @@ If you need Kerberos for print jobs to a printer connection to cups via the SMB backend, then you need to install that package. It will allow cups to access the Kerberos credentials cache of the user issuing the print job. +### LDB-LDAP-MODULES +%package ldb-ldap-modules +Summary: Samba ldap modules for ldb +Requires: %{name}-client-libs = %{samba_depver} + +%description ldb-ldap-modules +This package contains the ldb ldap modules required by samba-tool and +samba-gpupdate. + ### LIBS %package libs Summary: Samba libraries @@ -2026,10 +2037,8 @@ fi %{_libdir}/samba/ldb/extended_dn_out.so %{_libdir}/samba/ldb/extended_dn_store.so %{_libdir}/samba/ldb/group_audit_log.so -%{_libdir}/samba/ldb/ildap.so %{_libdir}/samba/ldb/instancetype.so %{_libdir}/samba/ldb/lazy_commit.so -%{_libdir}/samba/ldb/ldbsamba_extensions.so %{_libdir}/samba/ldb/linked_attributes.so %{_libdir}/samba/ldb/new_partition.so %{_libdir}/samba/ldb/objectclass.so @@ -2281,6 +2290,11 @@ fi %attr(0700,root,root) %{_libexecdir}/samba/smbspool_krb5_wrapper %{_mandir}/man8/smbspool_krb5_wrapper.8* +### LDB-LDAP-MODULES +%files ldb-ldap-modules +%{_libdir}/samba/ldb/ldbsamba_extensions.so +%{_libdir}/samba/ldb/ildap.so + ### LIBS %files libs %{_libdir}/libdcerpc-samr.so.* @@ -4205,6 +4219,9 @@ fi %endif %changelog +* Fri Aug 19 2022 Andreas Schneider - 4.17.0-0.4.rc2 +- Split out a samba-ldb-ldap-modules subpackage + * Thu Aug 18 2022 Kalev Lember - 2:4.17.0-0.3.rc2 - Avoid requiring systemd as per updated packaging guidelines From b6eef47cea9072f1585604d2274c790e069485f7 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 19 Aug 2022 12:47:14 +0200 Subject: [PATCH 203/425] Create a samba-gpupdate sub-package for GPO client support --- samba.spec | 30 +++++++++++++++++++++++++++--- 1 file changed, 27 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 26dc09e..b3e0f64 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.0 -%global baserelease 4 +%global baserelease 5 # This should be rc1 or %%nil %global pre_release rc2 @@ -680,6 +680,22 @@ Provides: bundled(libreplace) Samba VFS module for GlusterFS integration. %endif +### GPUPDATE +%if %{with dc} +%package gpupdate +Summary: Samba GPO support for clients +Requires: cepces +Requires: certmonger +Requires: %{name}-ldb-ldap-modules = %{samba_depver} +Requires: python3-%{name} = %{samba_depver} + +%description gpupdate +This package provides the samba-gpupdate tool to apply Group Policy Objects +(GPO) on Samba clients. + +# /with dc +%endif + ### KRB5-PRINTING %package krb5-printing Summary: Samba CUPS backend for printing with Kerberos @@ -2012,7 +2028,6 @@ fi %{_sbindir}/samba %{_sbindir}/samba_dnsupdate %{_sbindir}/samba_downgrade_db -%{_sbindir}/samba-gpupdate %{_sbindir}/samba_kcc %{_sbindir}/samba_spnupdate %{_sbindir}/samba_upgradedns @@ -2073,7 +2088,6 @@ fi %dir /var/lib/samba/sysvol %{_mandir}/man8/samba.8* %{_mandir}/man8/samba_downgrade_db.8* -%{_mandir}/man8/samba-gpupdate.8* %dir %{_datadir}/samba/admx %{_datadir}/samba/admx/samba.admx %dir %{_datadir}/samba/admx/en-US @@ -2285,6 +2299,13 @@ fi %{_mandir}/man8/vfs_glusterfs.8* %endif +### GPUPDATE +%if %{with dc} +%files gpupdate +%{_mandir}/man8/samba-gpupdate.8* +%{_sbindir}/samba-gpupdate +%endif + ### KRB5-PRINTING %files krb5-printing %attr(0700,root,root) %{_libexecdir}/samba/smbspool_krb5_wrapper @@ -4219,6 +4240,9 @@ fi %endif %changelog +* Fri Aug 19 2022 Andreas Schneider - 4.17.0-0.5.rc2 +- Create a samba-gpupdate sub-package for GPO client support + * Fri Aug 19 2022 Andreas Schneider - 4.17.0-0.4.rc2 - Split out a samba-ldb-ldap-modules subpackage From 040a14f0398ca1b32209d64706c10f2bd64c98b8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 23 Aug 2022 21:10:48 +0200 Subject: [PATCH 204/425] Update to version 4.17.0rc3 resolves: #2118818 --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index aa5ec6b..de42e3e 100644 --- a/.gitignore +++ b/.gitignore @@ -301,3 +301,5 @@ samba-3.6.0pre1.tar.gz /samba-4.17.0rc1.tar.asc /samba-4.17.0rc2.tar.xz /samba-4.17.0rc2.tar.asc +/samba-4.17.0rc3.tar.asc +/samba-4.17.0rc3.tar.xz diff --git a/samba.spec b/samba.spec index b3e0f64..040b0ed 100644 --- a/samba.spec +++ b/samba.spec @@ -135,9 +135,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.0 -%global baserelease 5 +%global baserelease 6 # This should be rc1 or %%nil -%global pre_release rc2 +%global pre_release rc3 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4240,6 +4240,9 @@ fi %endif %changelog +* Tue Aug 23 2022 Pavel Filipenský - 4.17.0-0.6.rc3 +- resolves: #2118818 - Update to version 4.17.0rc3 + * Fri Aug 19 2022 Andreas Schneider - 4.17.0-0.5.rc2 - Create a samba-gpupdate sub-package for GPO client support diff --git a/sources b/sources index c7679e2..1f83a1a 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.17.0rc2.tar.xz) = cacdfff9f04eb584769045262e3bfc51c32f11f1fde8c25d30fb65ab19af98d7e4742b9eb519241954d252d2f921d784b70411e1bcaa04c31482e4f6bcee4a8c -SHA512 (samba-4.17.0rc2.tar.asc) = 3ad03e22726b3e7313be273ed1523c679237824f97788ab307cdf1b2219d5fabb021530c42cdbb10ed92cdfa7753d83a00ab9533047eeaec674b7043c70279d4 +SHA512 (samba-4.17.0rc3.tar.asc) = af105c471e7404044b1cb5658dfb0479db09d49967e20f35e121fc2f9b71a2bbd7d61ee0a048502b36319f59e3e79cef838082393cf816dfc079b9dcb6cd18bd +SHA512 (samba-4.17.0rc3.tar.xz) = 545a31318fc9ebcf2b327fd98a96f2ce131c6f3e0e66e3b5d4d8cd939f21b66f0ba354867507411d462407af4aa2a1c2bf7f366604e14752e5d1206ecf5c6731 From 57b6ce7d3c41fe0e88fbacfaf3322d9312fb3abe Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 25 Aug 2022 08:17:04 +0200 Subject: [PATCH 205/425] python3-samba package should not require the samba package --- samba.spec | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 040b0ed..c79b092 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.0 -%global baserelease 6 +%global baserelease 7 # This should be rc1 or %%nil %global pre_release rc3 @@ -790,7 +790,6 @@ library. ### PYTHON3 %package -n python3-%{name} Summary: Samba Python3 libraries -Requires: %{name} = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} @@ -1993,7 +1992,7 @@ fi %{_mandir}/man5/smbpasswd.5* %{_mandir}/man7/samba.7* -### COMMON-libs +### COMMON-LIBS %files common-libs # common libraries %{_libdir}/samba/libcmdline-samba4.so @@ -4240,6 +4239,9 @@ fi %endif %changelog +* Thu Aug 25 2022 Andreas Schneider - 4.17.0-0.7.rc3 +- python3-samba package should not require the samba package + * Tue Aug 23 2022 Pavel Filipenský - 4.17.0-0.6.rc3 - resolves: #2118818 - Update to version 4.17.0rc3 From c6f208e111128fa5e3f6ec1e2f92694e5db7d160 Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Thu, 25 Aug 2022 09:58:00 -0700 Subject: [PATCH 206/425] Rebuild with no changes to fix F37 update grouping --- samba.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index c79b092..5e5be1d 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.0 -%global baserelease 7 +%global baserelease 8 # This should be rc1 or %%nil %global pre_release rc3 @@ -4239,6 +4239,9 @@ fi %endif %changelog +* Thu Aug 25 2022 Adam Williamson - 4.17.0-0.8.rc3 +- Rebuild with no changes to fix F37 update grouping + * Thu Aug 25 2022 Andreas Schneider - 4.17.0-0.7.rc3 - python3-samba package should not require the samba package From 949729550873ed9682d137df5f5d10a14160eb88 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 31 Aug 2022 10:51:49 +0200 Subject: [PATCH 207/425] Update to version 4.17.0rc4 resolves: #2118818 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index de42e3e..ea31b28 100644 --- a/.gitignore +++ b/.gitignore @@ -303,3 +303,5 @@ samba-3.6.0pre1.tar.gz /samba-4.17.0rc2.tar.asc /samba-4.17.0rc3.tar.asc /samba-4.17.0rc3.tar.xz +/samba-4.17.0rc4.tar.xz +/samba-4.17.0rc4.tar.asc diff --git a/samba.spec b/samba.spec index 5e5be1d..c444309 100644 --- a/samba.spec +++ b/samba.spec @@ -135,9 +135,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.0 -%global baserelease 8 +%global baserelease 9 # This should be rc1 or %%nil -%global pre_release rc3 +%global pre_release rc4 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4239,6 +4239,9 @@ fi %endif %changelog +* Wed Aug 31 2022 Guenther Deschner - 4.17.0-0.9.rc4 +- resolves: #2118818 - Update to version 4.17.0rc4 + * Thu Aug 25 2022 Adam Williamson - 4.17.0-0.8.rc3 - Rebuild with no changes to fix F37 update grouping diff --git a/sources b/sources index 1f83a1a..f1969c9 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.17.0rc3.tar.asc) = af105c471e7404044b1cb5658dfb0479db09d49967e20f35e121fc2f9b71a2bbd7d61ee0a048502b36319f59e3e79cef838082393cf816dfc079b9dcb6cd18bd -SHA512 (samba-4.17.0rc3.tar.xz) = 545a31318fc9ebcf2b327fd98a96f2ce131c6f3e0e66e3b5d4d8cd939f21b66f0ba354867507411d462407af4aa2a1c2bf7f366604e14752e5d1206ecf5c6731 +SHA512 (samba-4.17.0rc4.tar.xz) = 0181f6250e8f542904d91f38eb69285e432b7da12cf970bff0f6a548ad76b2ec533d454b487023c5918359f5278789edc440e1cff9a7fb78b5cc2b93bb7f7f9d +SHA512 (samba-4.17.0rc4.tar.asc) = 60b4f06cf82d3d71dddcad216bc3329356e424d32db17d881d734069c0743266c764b931dc60b630afb0698629a0b5ab83b364ef85275e265d5240101be540ea From 8fd6f2abb9362b579fff11c5e313762bd05382a4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 6 Sep 2022 18:49:00 +0200 Subject: [PATCH 208/425] Update to version 4.17.0rc5 resolves: #2118818 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index ea31b28..349a42d 100644 --- a/.gitignore +++ b/.gitignore @@ -305,3 +305,5 @@ samba-3.6.0pre1.tar.gz /samba-4.17.0rc3.tar.xz /samba-4.17.0rc4.tar.xz /samba-4.17.0rc4.tar.asc +/samba-4.17.0rc5.tar.xz +/samba-4.17.0rc5.tar.asc diff --git a/samba.spec b/samba.spec index c444309..dd21f72 100644 --- a/samba.spec +++ b/samba.spec @@ -135,9 +135,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.0 -%global baserelease 9 +%global baserelease 10 # This should be rc1 or %%nil -%global pre_release rc4 +%global pre_release rc5 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4239,6 +4239,9 @@ fi %endif %changelog +* Tue Sep 06 2022 Guenther Deschner - 4.17.0-0.10.rc5 +- resolves: #2118818 - Update to version 4.17.0rc5 + * Wed Aug 31 2022 Guenther Deschner - 4.17.0-0.9.rc4 - resolves: #2118818 - Update to version 4.17.0rc4 diff --git a/sources b/sources index f1969c9..8211f68 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.17.0rc4.tar.xz) = 0181f6250e8f542904d91f38eb69285e432b7da12cf970bff0f6a548ad76b2ec533d454b487023c5918359f5278789edc440e1cff9a7fb78b5cc2b93bb7f7f9d -SHA512 (samba-4.17.0rc4.tar.asc) = 60b4f06cf82d3d71dddcad216bc3329356e424d32db17d881d734069c0743266c764b931dc60b630afb0698629a0b5ab83b364ef85275e265d5240101be540ea +SHA512 (samba-4.17.0rc5.tar.xz) = b3f0467ac03aa1ec20b430eb6a2a52f1608bc476f226f11dc174957e0d9d8532aec7b26a4330f48d6277efb09b5f9ebb879945513f346861b0e08c2b9d05517f +SHA512 (samba-4.17.0rc5.tar.asc) = c1cd83b0dd912a112aad88a7599141bd41450755a628fee372f841ef949ac14002d47242a65e1602b6f2b53bd97a7a02043c91b340858caddc2b6561e5e14ede From d041102422b0cb3e32d219c74f2a7a37f010f4cc Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 13 Sep 2022 10:14:02 +0200 Subject: [PATCH 209/425] Split out libnetapi(-devel) sub-packages resolves: rhbz#2093656 --- samba.spec | 42 +++++++++++++++++++++++++++++++++++++----- 1 file changed, 37 insertions(+), 5 deletions(-) diff --git a/samba.spec b/samba.spec index dd21f72..0ddeb5b 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.0 -%global baserelease 10 +%global baserelease 11 # This should be rc1 or %%nil %global pre_release rc5 @@ -236,6 +236,7 @@ Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-common-tools = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} +Requires: libnetapi = %{samba_depver} %if %{with libwbclient} Requires(post): libwbclient = %{samba_depver} Requires: libwbclient = %{samba_depver} @@ -510,6 +511,7 @@ Requires: samba-common-libs = %{samba_depver} Requires: samba-client-libs = %{samba_depver} Requires: samba-libs = %{samba_depver} Requires: samba-ldb-ldap-modules = %{samba_depver} +Requires: libnetapi = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} %endif @@ -618,6 +620,7 @@ Requires: %{name}-client-libs = %{samba_depver} %if %{with dc} Requires: %{name}-dc-libs = %{samba_depver} %endif +Requires: libnetapi = %{samba_depver} Provides: samba4-devel = %{samba_depver} Obsoletes: samba4-devel < %{samba_depver} @@ -738,6 +741,25 @@ Provides: bundled(libreplace) The %{name}-libs package contains the libraries needed by programs that link against the SMB, RPC and other protocols provided by the Samba suite. +### LIBNETAPI +%package -n libnetapi +Summary: The NETAPI library +Requires(pre): %{name}-common = %{samba_depver} +Requires: %{name}-common = %{samba_depver} +Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-client-libs = %{samba_depver} + +%description -n libnetapi +This contains the NETAPI library from the Samba suite. + +%package -n libnetapi-devel +Summary: Developer tools for the NETAPI library +Requires: libnetapi = %{samba_depver} + +%description -n libnetapi-devel +The libnetapi-devel package contains the header files and libraries needed to +develop programs that link against the NETAPI library in the Samba suite. + ### LIBSMBCLIENT %if %{with libsmbclient} %package -n libsmbclient @@ -874,6 +896,7 @@ Requires: %{name}-test-libs = %{samba_depver} Requires: %{name}-dc-libs = %{samba_depver} %endif Requires: %{name}-libs = %{samba_depver} +Requires: libnetapi = %{samba_depver} %if %{with libsmbclient} Requires: libsmbclient = %{samba_depver} %endif @@ -1845,7 +1868,6 @@ fi %{_libdir}/libndr-nbt.so.%{libndr_nbt_so_version}* %{_libdir}/libndr-standard.so.%{libndr_standard_so_version}* %{_libdir}/libndr.so.%{libndr_so_version}* -%{_libdir}/libnetapi.so.%{libnetapi_so_version}* %{_libdir}/libsamba-credentials.so.%{libsamba_credentials_so_version}* %{_libdir}/libsamba-errors.so.%{libsamba_errors_so_version}* %{_libdir}/libsamba-hostconfig.so.%{libsamba_hostconfig_so_version}* @@ -2196,7 +2218,6 @@ fi %{_includedir}/samba-4.0/ndr/ndr_krb5pac.h %{_includedir}/samba-4.0/ndr/ndr_svcctl.h %{_includedir}/samba-4.0/ndr/ndr_nbt.h -%{_includedir}/samba-4.0/netapi.h %{_includedir}/samba-4.0/param.h %{_includedir}/samba-4.0/passdb.h %{_includedir}/samba-4.0/policy.h @@ -2237,7 +2258,6 @@ fi %{_libdir}/libndr-nbt.so %{_libdir}/libndr-standard.so %{_libdir}/libndr.so -%{_libdir}/libnetapi.so %{_libdir}/libsamba-credentials.so %{_libdir}/libsamba-errors.so %{_libdir}/libsamba-hostconfig.so @@ -2251,7 +2271,6 @@ fi %{_libdir}/pkgconfig/ndr_krb5pac.pc %{_libdir}/pkgconfig/ndr_nbt.pc %{_libdir}/pkgconfig/ndr_standard.pc -%{_libdir}/pkgconfig/netapi.pc %{_libdir}/pkgconfig/samba-credentials.pc %{_libdir}/pkgconfig/samba-hostconfig.pc %{_libdir}/pkgconfig/samba-util.pc @@ -2331,6 +2350,16 @@ fi %{_libdir}/samba/libRPC-SERVER-LOOP-samba4.so %{_libdir}/samba/libRPC-WORKER-samba4.so +### LIBNETAPI +%files -n libnetapi +%{_libdir}/libnetapi.so.%{libnetapi_so_version}* + +### LIBNETAPI-DEVEL +%files -n libnetapi-devel +%{_includedir}/samba-4.0/netapi.h +%{_libdir}/libnetapi.so +%{_libdir}/pkgconfig/netapi.pc + ### LIBSMBCLIENT %if %{with libsmbclient} %files -n libsmbclient @@ -4239,6 +4268,9 @@ fi %endif %changelog +* Tue Sep 13 2022 Andreas Schneider - 4.17.0-0.11.rc5 +- resolves: rhbz#2093656 - Split out libnetapi(-devel) sub-packages + * Tue Sep 06 2022 Guenther Deschner - 4.17.0-0.10.rc5 - resolves: #2118818 - Update to version 4.17.0rc5 From ca4228ea9f031d3763d4ba159512d17ef8ffebe0 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 13 Sep 2022 10:25:22 +0200 Subject: [PATCH 210/425] Add samba-usershare package resolves: rhbz#2096405 --- samba.spec | 25 ++++++++++++++++++++++++- smb.conf.vendor | 3 +++ usershares.conf.vendor | 3 +++ 3 files changed, 30 insertions(+), 1 deletion(-) create mode 100644 usershares.conf.vendor diff --git a/samba.spec b/samba.spec index 0ddeb5b..a919391 100644 --- a/samba.spec +++ b/samba.spec @@ -224,9 +224,10 @@ Source11: smb.conf.vendor Source12: smb.conf.example Source13: pam_winbind.conf Source14: samba.pamd -Source15: samba.abignore +Source15: usershares.conf.vendor Source201: README.downgrade +Source202: samba.abignore Requires(pre): /usr/sbin/groupadd @@ -933,6 +934,17 @@ Provides: bundled(libreplace) %description test-libs %{name}-test-libs provides libraries required by the testing tools. +### USERSHARES +%package usershares +Summary: Provides support for non-root user shares +Requires: %{name} = %{samba_depver} +Requires: %{name}-common-tools = %{samba_depver} + +%description usershares +Installing this package will provide a configuration file, group and +directories to support non-root user shares. You can configure them +as a user using the `net usershare` command. + ### WINBIND %package winbind Summary: Samba winbind @@ -1284,6 +1296,7 @@ install -d -m 0755 %{buildroot}/var/lib/samba/lock install -d -m 0755 %{buildroot}/var/lib/samba/private install -d -m 0755 %{buildroot}/var/lib/samba/scripts install -d -m 0755 %{buildroot}/var/lib/samba/sysvol +install -d -m 0755 %{buildroot}/var/lib/samba/usershares install -d -m 0755 %{buildroot}/var/lib/samba/winbindd_privileged install -d -m 0755 %{buildroot}/var/log/samba/old install -d -m 0755 %{buildroot}/run/samba @@ -1311,6 +1324,7 @@ install -m 0644 %{SOURCE10} %{buildroot}%{_sysconfdir}/logrotate.d/samba install -m 0644 %{SOURCE11} %{buildroot}%{_sysconfdir}/samba/smb.conf install -m 0644 %{SOURCE12} %{buildroot}%{_sysconfdir}/samba/smb.conf.example +install -m 0644 %{SOURCE15} %{buildroot}%{_sysconfdir}/samba/usershares.conf install -d -m 0755 %{buildroot}%{_sysconfdir}/security install -m 0644 %{SOURCE13} %{buildroot}%{_sysconfdir}/security/pam_winbind.conf @@ -1603,6 +1617,9 @@ fi %ldconfig_scriptlets test +%pre usershares +getent group usershares >/dev/null || groupadd -r usershares || : + %pre winbind /usr/sbin/groupadd -g 88 wbpriv >/dev/null 2>&1 || : @@ -3303,6 +3320,11 @@ fi %{_libdir}/samba/libdsdb-module-samba4.so %endif +### USERSHARES +%files usershares +%config(noreplace) %{_sysconfdir}/samba/usershares.conf +%attr(1770,root,usershares) %dir /var/lib/samba/usershares + ### WINBIND %files winbind %{_libdir}/samba/idmap @@ -4270,6 +4292,7 @@ fi %changelog * Tue Sep 13 2022 Andreas Schneider - 4.17.0-0.11.rc5 - resolves: rhbz#2093656 - Split out libnetapi(-devel) sub-packages +- resolves: rhbz#2096405 - Add samba-usershare package * Tue Sep 06 2022 Guenther Deschner - 4.17.0-0.10.rc5 - resolves: #2118818 - Update to version 4.17.0rc5 diff --git a/smb.conf.vendor b/smb.conf.vendor index 32441aa..e45384d 100644 --- a/smb.conf.vendor +++ b/smb.conf.vendor @@ -18,6 +18,9 @@ load printers = yes cups options = raw + # Install samba-usershares package for support + include = /etc/samba/usershares.conf + [homes] comment = Home Directories valid users = %S, %D%w%S diff --git a/usershares.conf.vendor b/usershares.conf.vendor new file mode 100644 index 0000000..38a7885 --- /dev/null +++ b/usershares.conf.vendor @@ -0,0 +1,3 @@ +[global] + usershare max shares = 100 + usershare allow guests = yes From 473cc2b5a41bb28b21bc07300b0780c974048311 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 30 Aug 2022 13:49:37 +0200 Subject: [PATCH 211/425] Update to version 4.17.0 resolves: rhbz#2118818 - Update to version 4.17.0 resolves: rhbz#2121138 - Fix CVE-2022-32743 resolves: rhbz#2122650 - Fix CVE-2022-1615 --- .gitignore | 2 ++ samba.spec | 9 +++++++-- sources | 4 ++-- 3 files changed, 11 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 349a42d..b6891e1 100644 --- a/.gitignore +++ b/.gitignore @@ -307,3 +307,5 @@ samba-3.6.0pre1.tar.gz /samba-4.17.0rc4.tar.asc /samba-4.17.0rc5.tar.xz /samba-4.17.0rc5.tar.asc +/samba-4.17.0.tar.xz +/samba-4.17.0.tar.asc diff --git a/samba.spec b/samba.spec index a919391..0c751a9 100644 --- a/samba.spec +++ b/samba.spec @@ -135,9 +135,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.0 -%global baserelease 11 +%global baserelease 1 # This should be rc1 or %%nil -%global pre_release rc5 +%global pre_release %nil %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4290,6 +4290,11 @@ fi %endif %changelog +* Tue Sep 13 2022 Andreas Schneider - 4.17.0-1 +- resolves: rhbz#2118818 - Update to version 4.17.0 +- resolves: rhbz#2121138 - Fix CVE-2022-32743 +- resolves: rhbz#2122650 - Fix CVE-2022-1615 + * Tue Sep 13 2022 Andreas Schneider - 4.17.0-0.11.rc5 - resolves: rhbz#2093656 - Split out libnetapi(-devel) sub-packages - resolves: rhbz#2096405 - Add samba-usershare package diff --git a/sources b/sources index 8211f68..85be74a 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.17.0rc5.tar.xz) = b3f0467ac03aa1ec20b430eb6a2a52f1608bc476f226f11dc174957e0d9d8532aec7b26a4330f48d6277efb09b5f9ebb879945513f346861b0e08c2b9d05517f -SHA512 (samba-4.17.0rc5.tar.asc) = c1cd83b0dd912a112aad88a7599141bd41450755a628fee372f841ef949ac14002d47242a65e1602b6f2b53bd97a7a02043c91b340858caddc2b6561e5e14ede +SHA512 (samba-4.17.0.tar.xz) = 3d2f2ea37cb1acadd1abef6a321b9bcc552daa8d734ae1e48cb9dd07ae95d7fc22ea34f026bb6dddf09fad8cb0a38cd43ccf16e5d966e21f2499d0da5d77973f +SHA512 (samba-4.17.0.tar.asc) = f07912eb373cb93e95ed7ea08cdd456fc977c7383eab093d2e3476bde59b871b1fce2dc075e5a940861d07646e4f459384e37a9b20f9e9d11b4c3785c8dec2c7 From ea9a21adf05bc28a6e05e45cb224ca3cd3c3df5d Mon Sep 17 00:00:00 2001 From: Anoop C S Date: Wed, 14 Sep 2022 16:10:01 +0530 Subject: [PATCH 212/425] Do not remove ldb-ldap-modules files from buildroot New sub-package samba-ldb-ldap-modules requires corresponding files to be present in buildroot irrespective of whether DC components are enabled or not in the build process. Therefore refrain from removing those from the buildroot. --- samba.spec | 2 -- 1 file changed, 2 deletions(-) diff --git a/samba.spec b/samba.spec index 0c751a9..c2ac924 100644 --- a/samba.spec +++ b/samba.spec @@ -1377,8 +1377,6 @@ for i in \ %{_mandir}/man8/samba.8 \ %{_mandir}/man8/samba_downgrade_db.8 \ %{_mandir}/man8/samba-gpupdate.8 \ - %{_libdir}/samba/ldb/ildap.so \ - %{_libdir}/samba/ldb/ldbsamba_extensions.so \ %{_unitdir}/samba.service \ %{python3_sitearch}/samba/dcerpc/dnsserver.*.so \ %{python3_sitearch}/samba/dnsserver.py \ From d54cbd1fbf85a76b8fd56f8c46669fd170fbe547 Mon Sep 17 00:00:00 2001 From: Troy Dawson Date: Tue, 27 Sep 2022 18:18:24 +0000 Subject: [PATCH 213/425] add BuildRequires: systemd-rpm-macros Although the spec requires systemd-rpm-macros for macros such as %{_unitdir} it was only getting pulled in as a dependency of other packages. Dependencies have changed, and systemd-rpm-macros is no longer getting pulled in. Add the BuildRequires so we always get it. Signed-off-by: Troy Dawson tdawson@redhat.com --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index c2ac924..61457fd 100644 --- a/samba.spec +++ b/samba.spec @@ -311,6 +311,7 @@ BuildRequires: readline-devel BuildRequires: rpcgen BuildRequires: rpcsvc-proto-devel BuildRequires: sed +BuildRequires: systemd-rpm-macros BuildRequires: libtasn1-devel # We need asn1Parser BuildRequires: libtasn1-tools From 93ae555a841585d369e18cc22469d0a345c9e0d4 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 5 Oct 2022 11:37:23 +0200 Subject: [PATCH 214/425] Move group creation logic to sysusers.d fragment --- samba-systemd-sysusers.conf | 2 ++ samba-usershares-systemd-sysusers.conf | 2 ++ samba.spec | 21 ++++++++++++++++++++- 3 files changed, 24 insertions(+), 1 deletion(-) create mode 100644 samba-systemd-sysusers.conf create mode 100644 samba-usershares-systemd-sysusers.conf diff --git a/samba-systemd-sysusers.conf b/samba-systemd-sysusers.conf new file mode 100644 index 0000000..60ad7a5 --- /dev/null +++ b/samba-systemd-sysusers.conf @@ -0,0 +1,2 @@ +#Type Name ID +g printadmin - diff --git a/samba-usershares-systemd-sysusers.conf b/samba-usershares-systemd-sysusers.conf new file mode 100644 index 0000000..33f8fcb --- /dev/null +++ b/samba-usershares-systemd-sysusers.conf @@ -0,0 +1,2 @@ +#Type Name ID +g usershares - diff --git a/samba.spec b/samba.spec index 61457fd..d938ac8 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.0 -%global baserelease 1 +%global baserelease 2 # This should be rc1 or %%nil %global pre_release %nil @@ -225,6 +225,8 @@ Source12: smb.conf.example Source13: pam_winbind.conf Source14: samba.pamd Source15: usershares.conf.vendor +Source16: samba-systemd-sysusers.conf +Source17: samba-usershares-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore @@ -1348,6 +1350,10 @@ echo "d /run/samba 755 root root" > %{buildroot}%{_tmpfilesdir}/samba.conf echo "d /run/ctdb 755 root root" > %{buildroot}%{_tmpfilesdir}/ctdb.conf %endif +install -d -m 0755 %{buildroot}%{_sysusersdir} +install -m 0644 %{SOURCE16} %{buildroot}%{_sysusersdir}/samba.conf +install -m 0644 %{SOURCE17} %{buildroot}%{_sysusersdir}/samba-usershares.conf + install -d -m 0755 %{buildroot}%{_sysconfdir}/sysconfig install -m 0644 packaging/systemd/samba.sysconfig %{buildroot}%{_sysconfdir}/sysconfig/samba %if %{with clustering} @@ -1508,7 +1514,11 @@ export WINBINDD_DONT_LOG_STDOUT=1 %systemd_postun_with_restart nmb.service %pre common +%if 0%{?fedora} || 0%{?rhel} > 8 +%sysusers_create_compat %{SOURCE16} +%else getent group printadmin >/dev/null || groupadd -r printadmin || : +%endif %post common %{?ldconfig} @@ -1617,7 +1627,11 @@ fi %ldconfig_scriptlets test %pre usershares +%if 0%{?fedora} || 0%{?rhel} > 8 +%sysusers_create_compat %{SOURCE17} +%else getent group usershares >/dev/null || groupadd -r usershares || : +%endif %pre winbind /usr/sbin/groupadd -g 88 wbpriv >/dev/null 2>&1 || : @@ -2011,6 +2025,7 @@ fi ### COMMON %files common %{_tmpfilesdir}/samba.conf +%{_sysusersdir}/samba.conf %dir %{_sysconfdir}/logrotate.d/ %config(noreplace) %{_sysconfdir}/logrotate.d/samba %attr(0700,root,root) %dir /var/log/samba @@ -3323,6 +3338,7 @@ fi %files usershares %config(noreplace) %{_sysconfdir}/samba/usershares.conf %attr(1770,root,usershares) %dir /var/lib/samba/usershares +%{_sysusersdir}/samba-usershares.conf ### WINBIND %files winbind @@ -4289,6 +4305,9 @@ fi %endif %changelog +* Wed Oct 05 2022 Andreas Schneider - 4.17.0-2 +- Move group creation logic to sysusers.d fragment + * Tue Sep 13 2022 Andreas Schneider - 4.17.0-1 - resolves: rhbz#2118818 - Update to version 4.17.0 - resolves: rhbz#2121138 - Fix CVE-2022-32743 From 593cdb59632041ad6cc3e80b8203fbd4e85d9a9d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Wed, 19 Oct 2022 15:55:11 +0200 Subject: [PATCH 215/425] Update to version 4.17.1 resolves: rhbz#2127301 - Permission denied calling SMBC_getatr when file not exists resolves: rhbz#2133818 - rpcclient 4.17.0 unable to resolve server hostname --- .gitignore | 2 ++ samba.spec | 11 +++++++++-- sources | 4 ++-- 3 files changed, 13 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index b6891e1..af251a8 100644 --- a/.gitignore +++ b/.gitignore @@ -309,3 +309,5 @@ samba-3.6.0pre1.tar.gz /samba-4.17.0rc5.tar.asc /samba-4.17.0.tar.xz /samba-4.17.0.tar.asc +/samba-4.17.1.tar.xz +/samba-4.17.1.tar.asc diff --git a/samba.spec b/samba.spec index d938ac8..ce5de41 100644 --- a/samba.spec +++ b/samba.spec @@ -134,8 +134,8 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.17.0 -%global baserelease 2 +%global samba_version 4.17.1 +%global baserelease 1 # This should be rc1 or %%nil %global pre_release %nil @@ -3108,6 +3108,7 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tgs_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kpasswd_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/lockout_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/ms_kile_client_principal_lookup_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/nt_hash_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/pac_align_tests.*.pyc @@ -3137,6 +3138,7 @@ fi %{python3_sitearch}/samba/tests/krb5/kdc_tests.py %{python3_sitearch}/samba/tests/krb5/kdc_tgs_tests.py %{python3_sitearch}/samba/tests/krb5/kpasswd_tests.py +%{python3_sitearch}/samba/tests/krb5/lockout_tests.py %{python3_sitearch}/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py %{python3_sitearch}/samba/tests/krb5/nt_hash_tests.py %{python3_sitearch}/samba/tests/krb5/pac_align_tests.py @@ -4305,6 +4307,11 @@ fi %endif %changelog +* Wed Oct 19 2022 Pavel Filipenský - 4.17.1-1 +- Update to version 4.17.1 +- resolves: rhbz#2127301 - Permission denied calling SMBC_getatr when file not exists +- resolves: rhbz#2133818 - rpcclient 4.17.0 unable to resolve server hostname + * Wed Oct 05 2022 Andreas Schneider - 4.17.0-2 - Move group creation logic to sysusers.d fragment diff --git a/sources b/sources index 85be74a..f1afe23 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.17.0.tar.xz) = 3d2f2ea37cb1acadd1abef6a321b9bcc552daa8d734ae1e48cb9dd07ae95d7fc22ea34f026bb6dddf09fad8cb0a38cd43ccf16e5d966e21f2499d0da5d77973f -SHA512 (samba-4.17.0.tar.asc) = f07912eb373cb93e95ed7ea08cdd456fc977c7383eab093d2e3476bde59b871b1fce2dc075e5a940861d07646e4f459384e37a9b20f9e9d11b4c3785c8dec2c7 +SHA512 (samba-4.17.1.tar.xz) = fd1dd3059c484b550cfc694b14b32bb509c4e0b0e209e15b4ddc98ceba4bee8b4d94c5a488a98f75cafaf1d36dde912d738b6f79cba8bf14037c314ad9bfe4b9 +SHA512 (samba-4.17.1.tar.asc) = 921eec6894195d68922ef86c0c9d741cee17f98e7381f4e8ee99a8fe8168f569cb094b73a4e4094070f9b3ea677cf2db670dba55191fe8b417aa85b804f1fe03 From 5175b7717873da52775dd86c9654612640ed4f9b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 24 Oct 2022 16:58:29 +0200 Subject: [PATCH 216/425] Add missing dependency for wbinfo used by ctdb scripts --- samba.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index ce5de41..3114aa8 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.1 -%global baserelease 1 +%global baserelease 2 # This should be rc1 or %%nil %global pre_release %nil @@ -1067,6 +1067,7 @@ Summary: A Clustered Database based on Samba's Trivial Database (TDB) Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} +Requires: %{name}-winbind-clients = %{samba_depver} Requires: coreutils # for ps and killall @@ -4307,6 +4308,9 @@ fi %endif %changelog +* Mon Oct 24 2022 Andreas Schneider - 4.17.1-2 +- Add missing dependency for wbinfo used by ctdb scripts + * Wed Oct 19 2022 Pavel Filipenský - 4.17.1-1 - Update to version 4.17.1 - resolves: rhbz#2127301 - Permission denied calling SMBC_getatr when file not exists From 9f35dd7b526d75eda23c181eb4cb1a99e3dc3e1a Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 25 Oct 2022 13:15:13 +0200 Subject: [PATCH 217/425] Update to version 4.17.2 --- .gitignore | 2 + samba-4.17-fix-changeuserpassword4.patch | 540 +++++++++++++++++++++++ samba.spec | 11 +- sources | 4 +- 4 files changed, 554 insertions(+), 3 deletions(-) create mode 100644 samba-4.17-fix-changeuserpassword4.patch diff --git a/.gitignore b/.gitignore index af251a8..3dd6a6b 100644 --- a/.gitignore +++ b/.gitignore @@ -311,3 +311,5 @@ samba-3.6.0pre1.tar.gz /samba-4.17.0.tar.asc /samba-4.17.1.tar.xz /samba-4.17.1.tar.asc +/samba-4.17.2.tar.xz +/samba-4.17.2.tar.asc diff --git a/samba-4.17-fix-changeuserpassword4.patch b/samba-4.17-fix-changeuserpassword4.patch new file mode 100644 index 0000000..7f1b482 --- /dev/null +++ b/samba-4.17-fix-changeuserpassword4.patch @@ -0,0 +1,540 @@ +From a3e3d05f35d6082ea48450060b39084e3d0e4056 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Mon, 10 Oct 2022 15:15:20 +0200 +Subject: [PATCH 1/5] s3:librpc: Improve GSE error message + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15206 + +Signed-off-by: Andreas Schneider +Reviewed-by: Noel Power +--- + source3/librpc/crypto/gse.c | 21 +++++++++++++++++++-- + 1 file changed, 19 insertions(+), 2 deletions(-) + +diff --git a/source3/librpc/crypto/gse.c b/source3/librpc/crypto/gse.c +index c50a8a036df..c2cac7abf82 100644 +--- a/source3/librpc/crypto/gse.c ++++ b/source3/librpc/crypto/gse.c +@@ -546,11 +546,28 @@ init_sec_context_done: + goto done; + case GSS_S_FAILURE: + switch (gss_min) { +- case (OM_uint32)KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN: +- DBG_NOTICE("Server principal not found\n"); ++ case (OM_uint32)KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN: { ++ gss_buffer_desc name_token = { ++ .length = 0, ++ }; ++ ++ gss_maj = gss_display_name(&gss_min, ++ gse_ctx->server_name, ++ &name_token, ++ NULL); ++ if (gss_maj == GSS_S_COMPLETE) { ++ DBG_NOTICE("Server principal %.*s not found\n", ++ (int)name_token.length, ++ (char *)name_token.value); ++ gss_release_buffer(&gss_maj, &name_token); ++ } else { ++ DBG_NOTICE("Server principal not found\n"); ++ } ++ + /* Make SPNEGO ignore us, we can't go any further here */ + status = NT_STATUS_INVALID_PARAMETER; + goto done; ++ } + case (OM_uint32)KRB5KRB_AP_ERR_TKT_EXPIRED: + DBG_NOTICE("Ticket expired\n"); + /* Make SPNEGO ignore us, we can't go any further here */ +-- +2.37.3 + + +From d2e2e9acd717e45806f1b19378e09f39c8fe3da8 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Fri, 7 Oct 2022 14:35:15 +0200 +Subject: [PATCH 2/5] s3:rpcclient: Pass salt down to + init_samr_CryptPasswordAES() + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15206 + +Signed-off-by: Andreas Schneider +Reviewed-by: Noel Power +--- + source3/rpc_client/init_samr.c | 15 ++++----------- + source3/rpc_client/init_samr.h | 1 + + source3/rpcclient/cmd_samr.c | 8 ++++++++ + source4/libnet/libnet_passwd.c | 13 +++++++------ + source4/torture/rpc/samr.c | 27 +++++++++++++++++++++++++++ + 5 files changed, 47 insertions(+), 17 deletions(-) + +diff --git a/source3/rpc_client/init_samr.c b/source3/rpc_client/init_samr.c +index 68f42b602b3..52fa2f90d6e 100644 +--- a/source3/rpc_client/init_samr.c ++++ b/source3/rpc_client/init_samr.c +@@ -79,6 +79,7 @@ NTSTATUS init_samr_CryptPassword(const char *pwd, + + NTSTATUS init_samr_CryptPasswordAES(TALLOC_CTX *mem_ctx, + const char *password, ++ DATA_BLOB *salt, + DATA_BLOB *session_key, + struct samr_EncryptedPasswordAES *ppwd_buf) + { +@@ -87,12 +88,6 @@ NTSTATUS init_samr_CryptPasswordAES(TALLOC_CTX *mem_ctx, + .data = pw_data, + .length = sizeof(pw_data), + }; +- size_t iv_size = gnutls_cipher_get_iv_size(GNUTLS_CIPHER_AES_256_CBC); +- uint8_t iv_data[iv_size]; +- DATA_BLOB iv = { +- .data = iv_data, +- .length = iv_size, +- }; + DATA_BLOB ciphertext = data_blob_null; + NTSTATUS status = NT_STATUS_UNSUCCESSFUL; + bool ok; +@@ -101,8 +96,6 @@ NTSTATUS init_samr_CryptPasswordAES(TALLOC_CTX *mem_ctx, + return NT_STATUS_INVALID_PARAMETER; + } + +- generate_nonce_buffer(iv.data, iv.length); +- + ok = encode_pwd_buffer514_from_str(pw_data, password, STR_UNICODE); + if (!ok) { + return NT_STATUS_INTERNAL_ERROR; +@@ -114,7 +107,7 @@ NTSTATUS init_samr_CryptPasswordAES(TALLOC_CTX *mem_ctx, + session_key, + &samr_aes256_enc_key_salt, + &samr_aes256_mac_key_salt, +- &iv, ++ salt, + &ciphertext, + ppwd_buf->auth_data); + BURN_DATA(pw_data); +@@ -126,8 +119,8 @@ NTSTATUS init_samr_CryptPasswordAES(TALLOC_CTX *mem_ctx, + ppwd_buf->cipher = ciphertext.data; + ppwd_buf->PBKDF2Iterations = 0; + +- SMB_ASSERT(iv.length == sizeof(ppwd_buf->salt)); +- memcpy(ppwd_buf->salt, iv.data, iv.length); ++ SMB_ASSERT(salt->length == sizeof(ppwd_buf->salt)); ++ memcpy(ppwd_buf->salt, salt->data, salt->length); + + return NT_STATUS_OK; + } +diff --git a/source3/rpc_client/init_samr.h b/source3/rpc_client/init_samr.h +index 940534e7168..71b4c0e573d 100644 +--- a/source3/rpc_client/init_samr.h ++++ b/source3/rpc_client/init_samr.h +@@ -47,6 +47,7 @@ NTSTATUS init_samr_CryptPassword(const char *pwd, + */ + NTSTATUS init_samr_CryptPasswordAES(TALLOC_CTX *mem_ctx, + const char *password, ++ DATA_BLOB *salt, + DATA_BLOB *session_key, + struct samr_EncryptedPasswordAES *ppwd_buf); + +diff --git a/source3/rpcclient/cmd_samr.c b/source3/rpcclient/cmd_samr.c +index 9ccd2f78a8d..8106ca90cf2 100644 +--- a/source3/rpcclient/cmd_samr.c ++++ b/source3/rpcclient/cmd_samr.c +@@ -3172,6 +3172,11 @@ static NTSTATUS cmd_samr_setuserinfo_int(struct rpc_pipe_client *cli, + uint8_t nt_hash[16]; + uint8_t lm_hash[16]; + DATA_BLOB session_key; ++ uint8_t salt_data[16]; ++ DATA_BLOB salt = { ++ .data = salt_data, ++ .length = sizeof(salt_data), ++ }; + uint8_t password_expired = 0; + struct dcerpc_binding_handle *b = cli->binding_handle; + TALLOC_CTX *frame = NULL; +@@ -3198,6 +3203,8 @@ static NTSTATUS cmd_samr_setuserinfo_int(struct rpc_pipe_client *cli, + goto done; + } + ++ generate_nonce_buffer(salt.data, salt.length); ++ + switch(level) { + case 18: + case 21: +@@ -3220,6 +3227,7 @@ static NTSTATUS cmd_samr_setuserinfo_int(struct rpc_pipe_client *cli, + case 31: + status = init_samr_CryptPasswordAES(frame, + param, ++ &salt, + &session_key, + &pwd_buf_aes); + if (!NT_STATUS_IS_OK(status)) { +diff --git a/source4/libnet/libnet_passwd.c b/source4/libnet/libnet_passwd.c +index 4f662110e55..a1672104824 100644 +--- a/source4/libnet/libnet_passwd.c ++++ b/source4/libnet/libnet_passwd.c +@@ -57,13 +57,13 @@ static NTSTATUS libnet_ChangePassword_samr_aes(TALLOC_CTX *mem_ctx, + struct samr_EncryptedPasswordAES pwd_buf = { + .cipher_len = 0 + }; +- DATA_BLOB iv = { ++ DATA_BLOB salt = { + .data = pwd_buf.salt, + .length = sizeof(pwd_buf.salt), + }; +- gnutls_datum_t iv_datum = { +- .data = iv.data, +- .size = iv.length, ++ gnutls_datum_t salt_datum = { ++ .data = pwd_buf.salt, ++ .size = sizeof(pwd_buf.salt), + }; + uint64_t pbkdf2_iterations = generate_random_u64_range(5000, 1000000); + NTSTATUS status; +@@ -71,11 +71,11 @@ static NTSTATUS libnet_ChangePassword_samr_aes(TALLOC_CTX *mem_ctx, + + E_md4hash(old_password, old_nt_key_data); + +- generate_nonce_buffer(iv.data, iv.length); ++ generate_nonce_buffer(salt.data, salt.length); + + rc = gnutls_pbkdf2(GNUTLS_MAC_SHA512, + &old_nt_key, +- &iv_datum, ++ &salt_datum, + pbkdf2_iterations, + cek.data, + cek.length); +@@ -86,6 +86,7 @@ static NTSTATUS libnet_ChangePassword_samr_aes(TALLOC_CTX *mem_ctx, + + status = init_samr_CryptPasswordAES(mem_ctx, + new_password, ++ &salt, + &cek, + &pwd_buf); + data_blob_clear(&cek); +diff --git a/source4/torture/rpc/samr.c b/source4/torture/rpc/samr.c +index de354659067..0b1880efa18 100644 +--- a/source4/torture/rpc/samr.c ++++ b/source4/torture/rpc/samr.c +@@ -783,6 +783,11 @@ static bool test_SetUserPass_32(struct dcerpc_pipe *p, struct torture_context *t + struct samr_SetUserInfo s; + union samr_UserInfo u; + DATA_BLOB session_key; ++ uint8_t salt_data[16]; ++ DATA_BLOB salt = { ++ .data = salt_data, ++ .length = sizeof(salt_data), ++ }; + char *newpass = NULL; + struct dcerpc_binding_handle *b = p->binding_handle; + struct samr_GetUserPwInfo pwp; +@@ -818,8 +823,11 @@ static bool test_SetUserPass_32(struct dcerpc_pipe *p, struct torture_context *t + return false; + } + ++ generate_nonce_buffer(salt.data, salt.length); ++ + status = init_samr_CryptPasswordAES(tctx, + newpass, ++ &salt, + &session_key, + &u.info32.password); + torture_assert_ntstatus_ok(tctx, +@@ -852,6 +860,7 @@ static bool test_SetUserPass_32(struct dcerpc_pipe *p, struct torture_context *t + + status = init_samr_CryptPasswordAES(tctx, + newpass, ++ &salt, + &session_key, + &u.info32.password); + torture_assert_ntstatus_ok(tctx, +@@ -896,6 +905,11 @@ static bool test_SetUserPass_31(struct dcerpc_pipe *p, struct torture_context *t + union samr_UserInfo u; + bool ret = true; + DATA_BLOB session_key; ++ uint8_t salt_data[16]; ++ DATA_BLOB salt = { ++ .data = salt_data, ++ .length = sizeof(salt_data), ++ }; + char *newpass; + struct dcerpc_binding_handle *b = p->binding_handle; + struct samr_GetUserPwInfo pwp; +@@ -931,8 +945,11 @@ static bool test_SetUserPass_31(struct dcerpc_pipe *p, struct torture_context *t + return false; + } + ++ generate_nonce_buffer(salt.data, salt.length); ++ + status = init_samr_CryptPasswordAES(tctx, + newpass, ++ &salt, + &session_key, + &u.info31.password); + torture_assert_ntstatus_ok(tctx, +@@ -959,6 +976,7 @@ static bool test_SetUserPass_31(struct dcerpc_pipe *p, struct torture_context *t + + status = init_samr_CryptPasswordAES(tctx, + newpass, ++ &salt, + &session_key, + &u.info31.password); + torture_assert_ntstatus_ok(tctx, +@@ -1381,6 +1399,11 @@ static bool test_SetUserPass_level_ex(struct dcerpc_pipe *p, + union samr_UserInfo u; + bool ret = true; + DATA_BLOB session_key; ++ uint8_t salt_data[16]; ++ DATA_BLOB salt = { ++ .data = salt_data, ++ .length = sizeof(salt_data), ++ }; + char *newpass; + struct dcerpc_binding_handle *b = p->binding_handle; + struct samr_GetUserPwInfo pwp; +@@ -1490,6 +1513,8 @@ static bool test_SetUserPass_level_ex(struct dcerpc_pipe *p, + return false; + } + ++ generate_nonce_buffer(salt.data, salt.length); ++ + switch (level) { + case 18: + { +@@ -1561,6 +1586,7 @@ static bool test_SetUserPass_level_ex(struct dcerpc_pipe *p, + case 31: + status = init_samr_CryptPasswordAES(tctx, + newpass, ++ &salt, + &session_key, + &u.info31.password); + +@@ -1568,6 +1594,7 @@ static bool test_SetUserPass_level_ex(struct dcerpc_pipe *p, + case 32: + status = init_samr_CryptPasswordAES(tctx, + newpass, ++ &salt, + &session_key, + &u.info32.password); + +-- +2.37.3 + + +From 1d630363c9b2497266e418aad89c55d5b51a63ad Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Mon, 17 Oct 2022 09:02:28 +0200 +Subject: [PATCH 3/5] s4:libnet: If we successfully changed the password we are + done + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15206 + +Signed-off-by: Andreas Schneider +Reviewed-by: Noel Power +--- + source4/libnet/libnet_passwd.c | 32 ++++++++++++++++++-------------- + 1 file changed, 18 insertions(+), 14 deletions(-) + +diff --git a/source4/libnet/libnet_passwd.c b/source4/libnet/libnet_passwd.c +index a1672104824..b17614bcd97 100644 +--- a/source4/libnet/libnet_passwd.c ++++ b/source4/libnet/libnet_passwd.c +@@ -101,7 +101,7 @@ static NTSTATUS libnet_ChangePassword_samr_aes(TALLOC_CTX *mem_ctx, + r.in.password = &pwd_buf; + + status = dcerpc_samr_ChangePasswordUser4_r(h, mem_ctx, &r); +- if (NT_STATUS_IS_OK(status)) { ++ if (!NT_STATUS_IS_OK(status)) { + goto done; + } + if (!NT_STATUS_IS_OK(r.out.result)) { +@@ -112,6 +112,7 @@ static NTSTATUS libnet_ChangePassword_samr_aes(TALLOC_CTX *mem_ctx, + account->string, + nt_errstr(status)); + status = r.out.result; ++ goto done; + } + + done: +@@ -424,20 +425,23 @@ static NTSTATUS libnet_ChangePassword_samr(struct libnet_context *ctx, TALLOC_CT + r->samr.in.oldpassword, + r->samr.in.newpassword, + &(r->samr.out.error_string)); +- if (!NT_STATUS_IS_OK(status)) { +- if (NT_STATUS_EQUAL(status, +- NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE) || +- NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED) || +- NT_STATUS_EQUAL(status, NT_STATUS_NOT_IMPLEMENTED)) { +- /* +- * Don't fallback to RC4 based SAMR if weak crypto is not +- * allowed. +- */ +- if (lpcfg_weak_crypto(ctx->lp_ctx) == +- SAMBA_WEAK_CRYPTO_DISALLOWED) { +- goto disconnect; +- } ++ if (NT_STATUS_IS_OK(status)) { ++ goto disconnect; ++ } else if (NT_STATUS_EQUAL(status, ++ NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE) || ++ NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED) || ++ NT_STATUS_EQUAL(status, NT_STATUS_NOT_IMPLEMENTED)) { ++ /* ++ * Don't fallback to RC4 based SAMR if weak crypto is not ++ * allowed. ++ */ ++ if (lpcfg_weak_crypto(ctx->lp_ctx) == ++ SAMBA_WEAK_CRYPTO_DISALLOWED) { ++ goto disconnect; + } ++ } else { ++ /* libnet_ChangePassword_samr_aes is implemented and failed */ ++ goto disconnect; + } + + status = libnet_ChangePassword_samr_rc4( +-- +2.37.3 + + +From 9a4a169ab34641afb87e7f81708c9a72b321879e Mon Sep 17 00:00:00 2001 +From: Noel Power +Date: Fri, 21 Oct 2022 17:40:36 +0100 +Subject: [PATCH 4/5] s4/rpc_server/sambr: don't mutate the return of + samdb_set_password_aes + +prior to this commit return of samdb_set_password_aes was set to +NT_STATUS_WRONG_PASSWORD on failure. Useful status that should be +returned such as NT_STATUS_PASSWORD_RESTRICTION are swallowed here +otherwise (and in this case can be partially responsible for failures +in test samba.tests.auth_log_pass_change (with later gnutls) + +Signed-off-by: Noel Power +Reviewed-by: Andreas Schneider +--- + source4/rpc_server/samr/samr_password.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/source4/rpc_server/samr/samr_password.c b/source4/rpc_server/samr/samr_password.c +index 4691f9a47a9..b581be6361c 100644 +--- a/source4/rpc_server/samr/samr_password.c ++++ b/source4/rpc_server/samr/samr_password.c +@@ -250,7 +250,6 @@ NTSTATUS dcesrv_samr_ChangePasswordUser4(struct dcesrv_call_state *dce_call, + + if (!NT_STATUS_IS_OK(status)) { + ldb_transaction_cancel(sam_ctx); +- status = NT_STATUS_WRONG_PASSWORD; + goto done; + } + +-- +2.37.3 + + +From b8b36ecba0f22dbc203c12627ebd629c2437c635 Mon Sep 17 00:00:00 2001 +From: Noel Power +Date: Fri, 21 Oct 2022 17:14:44 +0100 +Subject: [PATCH 5/5] python/samba/tests: fix samba.tests.auth_log_pass_change + for later gnutls + +later gnutls that support GNUTLS_PBKDF2 currently fail, +we need to conditionally switch test data to reflect use of +'samr_ChangePasswordUser3' or 'samr_ChangePasswordUser4' +depending on whether GNUTLS_PBKDF2 is supported or not + +Signed-off-by: Noel Power +Reviewed-by: Andreas Schneider +--- + python/samba/tests/auth_log_pass_change.py | 20 ++++++++++++++++---- + source4/selftest/tests.py | 9 ++++++--- + 2 files changed, 22 insertions(+), 7 deletions(-) + +diff --git a/python/samba/tests/auth_log_pass_change.py b/python/samba/tests/auth_log_pass_change.py +index 972af2158dd..1ca46c586b3 100644 +--- a/python/samba/tests/auth_log_pass_change.py ++++ b/python/samba/tests/auth_log_pass_change.py +@@ -72,6 +72,18 @@ class AuthLogPassChangeTests(samba.tests.auth_log_base.AuthLogTestBase): + + # discard any auth log messages for the password setup + self.discardMessages() ++ gnutls_pbkdf2_support = samba.tests.env_get_var_value( ++ 'GNUTLS_PBKDF2_SUPPORT', ++ allow_missing=True) ++ if gnutls_pbkdf2_support is None: ++ gnutls_pbkdf2_support = '0' ++ self.gnutls_pbkdf2_support = bool(int(gnutls_pbkdf2_support)) ++ ++ def _authDescription(self): ++ if self.gnutls_pbkdf2_support: ++ return "samr_ChangePasswordUser4" ++ else: ++ return "samr_ChangePasswordUser3" + + def tearDown(self): + super(AuthLogPassChangeTests, self).tearDown() +@@ -83,7 +95,7 @@ class AuthLogPassChangeTests(samba.tests.auth_log_base.AuthLogTestBase): + (msg["Authentication"]["serviceDescription"] == + "SAMR Password Change") and + (msg["Authentication"]["authDescription"] == +- "samr_ChangePasswordUser3") and ++ self._authDescription()) and + (msg["Authentication"]["eventId"] == + EVT_ID_SUCCESSFUL_LOGON) and + (msg["Authentication"]["logonType"] == +@@ -109,7 +121,7 @@ class AuthLogPassChangeTests(samba.tests.auth_log_base.AuthLogTestBase): + (msg["Authentication"]["serviceDescription"] == + "SAMR Password Change") and + (msg["Authentication"]["authDescription"] == +- "samr_ChangePasswordUser3") and ++ self._authDescription()) and + (msg["Authentication"]["eventId"] == + EVT_ID_UNSUCCESSFUL_LOGON) and + (msg["Authentication"]["logonType"] == +@@ -141,7 +153,7 @@ class AuthLogPassChangeTests(samba.tests.auth_log_base.AuthLogTestBase): + (msg["Authentication"]["serviceDescription"] == + "SAMR Password Change") and + (msg["Authentication"]["authDescription"] == +- "samr_ChangePasswordUser3") and ++ self._authDescription()) and + (msg["Authentication"]["eventId"] == + EVT_ID_UNSUCCESSFUL_LOGON) and + (msg["Authentication"]["logonType"] == +@@ -174,7 +186,7 @@ class AuthLogPassChangeTests(samba.tests.auth_log_base.AuthLogTestBase): + (msg["Authentication"]["serviceDescription"] == + "SAMR Password Change") and + (msg["Authentication"]["authDescription"] == +- "samr_ChangePasswordUser3") and ++ self._authDescription()) and + (msg["Authentication"]["eventId"] == + EVT_ID_UNSUCCESSFUL_LOGON) and + (msg["Authentication"]["logonType"] == +diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py +index a803d4704ea..c92105586a7 100755 +--- a/source4/selftest/tests.py ++++ b/source4/selftest/tests.py +@@ -1094,9 +1094,11 @@ if have_heimdal_support: + environ={'CLIENT_IP': '10.53.57.11', + 'SOCKET_WRAPPER_DEFAULT_IFACE': 11}) + planoldpythontestsuite("ad_dc_smb1", "samba.tests.auth_log_pass_change", +- extra_args=['-U"$USERNAME%$PASSWORD"']) ++ extra_args=['-U"$USERNAME%$PASSWORD"'], ++ environ={'GNUTLS_PBKDF2_SUPPORT': gnutls_pbkdf2_support}) + planoldpythontestsuite("ad_dc_ntvfs", "samba.tests.auth_log_pass_change", +- extra_args=['-U"$USERNAME%$PASSWORD"']) ++ extra_args=['-U"$USERNAME%$PASSWORD"'], ++ environ={'GNUTLS_PBKDF2_SUPPORT': gnutls_pbkdf2_support}) + + # these tests use a NCA local RPC connection, so always run on the + # :local testenv, and so don't need to fake a client connection +@@ -1113,7 +1115,8 @@ if have_heimdal_support: + "samba.tests.auth_log_winbind", + extra_args=['-U"$DC_USERNAME%$DC_PASSWORD"']) + planoldpythontestsuite("ad_dc", "samba.tests.audit_log_pass_change", +- extra_args=['-U"$USERNAME%$PASSWORD"']) ++ extra_args=['-U"$USERNAME%$PASSWORD"'], ++ environ={'GNUTLS_PBKDF2_SUPPORT': gnutls_pbkdf2_support}) + planoldpythontestsuite("ad_dc", "samba.tests.audit_log_dsdb", + extra_args=['-U"$USERNAME%$PASSWORD"']) + planoldpythontestsuite("ad_dc", "samba.tests.group_audit", +-- +2.37.3 + diff --git a/samba.spec b/samba.spec index 3114aa8..7b7411c 100644 --- a/samba.spec +++ b/samba.spec @@ -134,7 +134,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.17.1 +%global samba_version 4.17.2 %global baserelease 2 # This should be rc1 or %%nil %global pre_release %nil @@ -1167,7 +1167,11 @@ Support for using an existing CEPH cluster as a mutex helper for CTDB %prep +%if 0%{?fedora} || 0%{?rhel} >= 9 +xzcat %{SOURCE0} | %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data=- +%else xzcat %{SOURCE0} | gpgv2 --quiet --keyring %{SOURCE2} %{SOURCE1} - +%endif %autosetup -n samba-%{version}%{pre_release} -p1 # Ensure we rely on GnuTLS and do not build any other crypto code shipping with @@ -4308,6 +4312,11 @@ fi %endif %changelog +* Tue Oct 25 2022 Andreas Schneider - 4.17.2-1 +- Update to version 4.17.2 +- Fix CVE-2022-3592: A malicious client can use a symlink to escape the + exported + * Mon Oct 24 2022 Andreas Schneider - 4.17.1-2 - Add missing dependency for wbinfo used by ctdb scripts diff --git a/sources b/sources index f1afe23..7e71a49 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.17.1.tar.xz) = fd1dd3059c484b550cfc694b14b32bb509c4e0b0e209e15b4ddc98ceba4bee8b4d94c5a488a98f75cafaf1d36dde912d738b6f79cba8bf14037c314ad9bfe4b9 -SHA512 (samba-4.17.1.tar.asc) = 921eec6894195d68922ef86c0c9d741cee17f98e7381f4e8ee99a8fe8168f569cb094b73a4e4094070f9b3ea677cf2db670dba55191fe8b417aa85b804f1fe03 +SHA512 (samba-4.17.2.tar.xz) = 6450deb75ee0b0a6a8e814f62e71973fe4d3e04050a3af42d1c6a3fb3603f0b2b02fa2b86e9a2309f1141a7f2d4ddc32ec4f51457f3c6d735fd19c9750254e31 +SHA512 (samba-4.17.2.tar.asc) = 0cb78e234e812d853ea2e795dbd2dba13bdd45e484a206ecaa54fb353e5d55697bb4cddc5d6e46bf43fa6d5bbcc32d62324dc907d0d122f99bcb3c220ab7d1ef From eaa90f47190b8d6d911791883a77a4c691f9da54 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 26 Oct 2022 11:31:30 +0200 Subject: [PATCH 218/425] Add missing require for libcmdline from samba-common-libs --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index 7b7411c..95f8160 100644 --- a/samba.spec +++ b/samba.spec @@ -722,6 +722,7 @@ the Kerberos credentials cache of the user issuing the print job. %package ldb-ldap-modules Summary: Samba ldap modules for ldb Requires: %{name}-client-libs = %{samba_depver} +Requires: %{name}-common-libs = %{samba_depver} %description ldb-ldap-modules This package contains the ldb ldap modules required by samba-tool and From cc1c088518319f44f53100bb6b435daf8f4e9daf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Wed, 2 Nov 2022 15:56:16 +0100 Subject: [PATCH 219/425] Always add epoch to samba_depver to fix osci.brew-build.rpmdeplint.functional --- samba.spec | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/samba.spec b/samba.spec index 95f8160..7e1931f 100644 --- a/samba.spec +++ b/samba.spec @@ -197,17 +197,13 @@ Name: samba Version: %{samba_version} Release: %{samba_release}%{?dist} -%if 0%{?rhel} -Epoch: 0 -%else +%if 0%{?fedora} Epoch: 2 +%else +Epoch: 0 %endif -%if 0%{?epoch} > 0 %global samba_depver %{epoch}:%{version}-%{release} -%else -%global samba_depver %{version}-%{release} -%endif Summary: Server and Client software to interoperate with Windows machines License: GPLv3+ and LGPLv3+ @@ -4313,6 +4309,9 @@ fi %endif %changelog +* Wed Nov 02 2022 Pavel Filipenský - 4.17.2-1 +- Always add epoch to samba_depver to fix osci.brew-build.rpmdeplint.functional + * Tue Oct 25 2022 Andreas Schneider - 4.17.2-1 - Update to version 4.17.2 - Fix CVE-2022-3592: A malicious client can use a symlink to escape the From 3fcbe364b29d8a7cf37fdf06d564e258498af1f6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 15 Nov 2022 18:39:46 +0100 Subject: [PATCH 220/425] Update to version 4.17.3 resolves: #2142959 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 3dd6a6b..de0b909 100644 --- a/.gitignore +++ b/.gitignore @@ -313,3 +313,5 @@ samba-3.6.0pre1.tar.gz /samba-4.17.1.tar.asc /samba-4.17.2.tar.xz /samba-4.17.2.tar.asc +/samba-4.17.3.tar.xz +/samba-4.17.3.tar.asc diff --git a/samba.spec b/samba.spec index 7e1931f..d6948ad 100644 --- a/samba.spec +++ b/samba.spec @@ -134,8 +134,8 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.17.2 -%global baserelease 2 +%global samba_version 4.17.3 +%global baserelease 0 # This should be rc1 or %%nil %global pre_release %nil @@ -4309,6 +4309,9 @@ fi %endif %changelog +* Tue Nov 15 2022 Guenther Deschner - 4.17.3-0 +- resolves: #2142959 - Update to version 4.17.3 + * Wed Nov 02 2022 Pavel Filipenský - 4.17.2-1 - Always add epoch to samba_depver to fix osci.brew-build.rpmdeplint.functional diff --git a/sources b/sources index 7e71a49..663dead 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.17.2.tar.xz) = 6450deb75ee0b0a6a8e814f62e71973fe4d3e04050a3af42d1c6a3fb3603f0b2b02fa2b86e9a2309f1141a7f2d4ddc32ec4f51457f3c6d735fd19c9750254e31 -SHA512 (samba-4.17.2.tar.asc) = 0cb78e234e812d853ea2e795dbd2dba13bdd45e484a206ecaa54fb353e5d55697bb4cddc5d6e46bf43fa6d5bbcc32d62324dc907d0d122f99bcb3c220ab7d1ef +SHA512 (samba-4.17.3.tar.xz) = e346460ab53a5ed1f534992e21bb53c790fa4ba50752f0cf31d46fb96d138e4723a0171705ef8bf4ce3354960ddacc5a82b75975b06dcbe3224a09951174a5e7 +SHA512 (samba-4.17.3.tar.asc) = 814976c76a43b46fe67bd9a904fe3846104680446dfaf5759989a60ce1a088adb264c0bf67eccf9634fe84b3eb7ac1b8dbd020fcabf5e586c1773a2edad86306 From 441bd49ffc16fb145531c2ee71c7c68fa834e56f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 16 Nov 2022 00:50:27 +0100 Subject: [PATCH 221/425] Security fixes for CVE-2022-42898 resolves: #2140960, #2143117 Guenther --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index d6948ad..d04f6e9 100644 --- a/samba.spec +++ b/samba.spec @@ -4311,6 +4311,7 @@ fi %changelog * Tue Nov 15 2022 Guenther Deschner - 4.17.3-0 - resolves: #2142959 - Update to version 4.17.3 +- resolves: #2140960, #2143117 - Security fixes for CVE-2022-42898 * Wed Nov 02 2022 Pavel Filipenský - 4.17.2-1 - Always add epoch to samba_depver to fix osci.brew-build.rpmdeplint.functional From 14cc94aae154c42623f6260a9ae472d173ae0e58 Mon Sep 17 00:00:00 2001 From: Florian Weimer Date: Mon, 21 Nov 2022 15:28:44 +0100 Subject: [PATCH 222/425] Memoize python3_sitearch for faster RPM spec file processing This greatly speeds up the creation of source RPMs, among other things. --- samba.spec | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/samba.spec b/samba.spec index d04f6e9..6bfb75c 100644 --- a/samba.spec +++ b/samba.spec @@ -193,6 +193,10 @@ %global _systemd_extra "Environment=KRB5CCNAME=FILE:/run/samba/krb5cc_samba" +# Make a copy of this variable to prevent repeated evaluation of the +# embedded shell command. +%global python3_sitearch %{python3_sitearch} + Name: samba Version: %{samba_version} Release: %{samba_release}%{?dist} From c7d395b20cfa9799afc54565451607c25907abbb Mon Sep 17 00:00:00 2001 From: Florian Weimer Date: Mon, 21 Nov 2022 15:44:40 +0100 Subject: [PATCH 223/425] Avoid recursive python3_sitearch expansion even if undefined Fixes an error during SRPM construction if not enough dependencies are installed (e.g., during the first build stage in mock): error: /builddir/build/SPECS/samba.spec: line 2478: Too many levels of recursion in macro expansion. It is likely caused by recursive macro declaration. --- samba.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index 6bfb75c..b8ffdac 100644 --- a/samba.spec +++ b/samba.spec @@ -194,8 +194,8 @@ %global _systemd_extra "Environment=KRB5CCNAME=FILE:/run/samba/krb5cc_samba" # Make a copy of this variable to prevent repeated evaluation of the -# embedded shell command. -%global python3_sitearch %{python3_sitearch} +# embedded shell command. Avoid recursive macro definition if undefined. +%{?python3_sitearch: %global python3_sitearch %{python3_sitearch}} Name: samba Version: %{samba_version} From 22ec3a0a0d740ffe16f1d4013dbea9ff5aa24106 Mon Sep 17 00:00:00 2001 From: Florian Weimer Date: Wed, 23 Nov 2022 15:20:50 +0100 Subject: [PATCH 224/425] Remove C89-specific language constructs from configure checks Fix feature detection for major/minor macros. Related to: --- samba-sysmacros.patch | 31 +++++++++++++++++++++++ samba-waf18.patch | 23 +++++++++++++++++ samba-wscript-c99.patch | 55 +++++++++++++++++++++++++++++++++++++++++ samba.spec | 9 ++++++- 4 files changed, 117 insertions(+), 1 deletion(-) create mode 100644 samba-sysmacros.patch create mode 100644 samba-waf18.patch create mode 100644 samba-wscript-c99.patch diff --git a/samba-sysmacros.patch b/samba-sysmacros.patch new file mode 100644 index 0000000..60f0489 --- /dev/null +++ b/samba-sysmacros.patch @@ -0,0 +1,31 @@ +source3/wscript: Fix detection of major/minor macros + +These macros are only available via as of glibc +commit e16deca62e16f645213dffd4ecd1153c37765f17 ("[BZ #19239] Don't +include sys/sysmacros.h from sys/types.h."), which went into +glibc 2.28. + +This is different from the usual C99 cleanups because it changes +the configure check result with existing compilers that usually +accept implicit function declarations. + +Submitted upstream: + +diff --git a/source3/wscript b/source3/wscript +index 22be17a1a6fd1126..ca27deaa54381446 100644 +--- a/source3/wscript ++++ b/source3/wscript +@@ -603,11 +603,11 @@ msg.msg_accrightslen = sizeof(fd); + conf.CHECK_HEADERS('asm/types.h') + + conf.CHECK_CODE('dev_t dev; int i = major(dev); return 0', "HAVE_DEVICE_MAJOR_FN", +- headers='unistd.h sys/types.h', ++ headers='sys/sysmacros.h unistd.h sys/types.h', + msg="Checking for major macro") + + conf.CHECK_CODE('dev_t dev; int i = minor(dev); return 0', "HAVE_DEVICE_MINOR_FN", +- headers='unistd.h sys/types.h', ++ headers='sys/sysmacros.h unistd.h sys/types.h', + msg="Checking for minor macro") + + conf.CHECK_STRUCTURE_MEMBER('struct dirent', 'd_off', diff --git a/samba-waf18.patch b/samba-waf18.patch new file mode 100644 index 0000000..84dcf7a --- /dev/null +++ b/samba-waf18.patch @@ -0,0 +1,23 @@ +Avoid calling lib_func without a prototype. + +This commit mirrors the change in commit f4c0a750d4adebcf2342a44e85f04526c34 +("WAF: Fix detection of linker features") +to buildtools/wafsamba/samba_conftests.py. It fixes the check for rpath +support with compilers in strict C99 mode. + +Submitted upstream: + +diff --git a/buildtools/wafsamba/samba_waf18.py b/buildtools/wafsamba/samba_waf18.py +index e2a078bd3a05fd78..cfdceea14ca4b706 100644 +--- a/buildtools/wafsamba/samba_waf18.py ++++ b/buildtools/wafsamba/samba_waf18.py +@@ -209,7 +209,8 @@ def CHECK_LIBRARY_SUPPORT(conf, rpath=False, version_script=False, msg=None): + lib_node.parent.mkdir() + lib_node.write('int lib_func(void) { return 42; }\n', 'w') + main_node = bld.srcnode.make_node('main.c') +- main_node.write('int main(void) {return !(lib_func() == 42);}', 'w') ++ main_node.write('int lib_func(void);\n' ++ 'int main(void) {return !(lib_func() == 42);}', 'w') + linkflags = [] + if version_script: + script = bld.srcnode.make_node('ldscript') diff --git a/samba-wscript-c99.patch b/samba-wscript-c99.patch new file mode 100644 index 0000000..11457cf --- /dev/null +++ b/samba-wscript-c99.patch @@ -0,0 +1,55 @@ +source3/wscript: Remove implict int and implicit function declarations + +This should fix the remaining C89isms in these configure checks. + +Submitted upstream: + +diff --git a/source3/wscript b/source3/wscript +index ca27deaa54381446..e77cd127e600f8c2 100644 +--- a/source3/wscript ++++ b/source3/wscript +@@ -1314,7 +1314,7 @@ syscall(SYS_initgroups, 16, NULL, NULL, 0); + + if conf.CHECK_CODE(''' + #include +-main() { ++int main() { + struct tm *tm; + if (sizeof(time_t) == 8) { + time_t max_time = 0x7fffffffffffffffll; +@@ -1345,7 +1345,7 @@ main() { + #if defined(HAVE_SYS_SYSMACROS_H) + #include + #endif +-main() { dev_t dev = makedev(1,2); return 0; } ++int main() { dev_t dev = makedev(1,2); return 0; } + ''', + 'HAVE_MAKEDEV', + addmain=False, +@@ -1355,12 +1355,13 @@ main() { dev_t dev = makedev(1,2); return 0; } + #include + #include + #include ++#include + + void exit_on_core(int ignored) { + exit(1); + } + +-main() { ++int main() { + char *newpath; + signal(SIGSEGV, exit_on_core); + newpath = realpath("/tmp", NULL); +@@ -1517,9 +1518,9 @@ main() { + # Check for getcwd allowing a NULL arg. + conf.CHECK_CODE(''' + #include +-main() { ++int main() { + char *s = getcwd(NULL,0); +- exit(s != NULL ? 0 : 1); ++ return s != NULL ? 0 : 1; + }''', 'GETCWD_TAKES_NULL', addmain=False, execute=True, + msg="getcwd takes a NULL argument") + diff --git a/samba.spec b/samba.spec index b8ffdac..888d783 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.3 -%global baserelease 0 +%global baserelease 1 # This should be rc1 or %%nil %global pre_release %nil @@ -230,6 +230,9 @@ Source17: samba-usershares-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore +Patch0: samba-waf18.patch +Patch1: samba-sysmacros.patch +Patch2: samba-wscript-c99.patch Requires(pre): /usr/sbin/groupadd @@ -4313,6 +4316,10 @@ fi %endif %changelog +* Mon Nov 21 2022 Florian Weimer - 2:4.17.3-%{baserelease} +- Remove C89-specific language constructs from configure checks +- Fix feature detection for major/minor macros + * Tue Nov 15 2022 Guenther Deschner - 4.17.3-0 - resolves: #2142959 - Update to version 4.17.3 - resolves: #2140960, #2143117 - Security fixes for CVE-2022-42898 From 8b52c1b03324c6e7eaa3393334b0b43529ddb4f1 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Thu, 1 Dec 2022 18:39:07 +0200 Subject: [PATCH 225/425] Rebuild against krb5 1.20.1 Signed-off-by: Alexander Bokovoy --- samba.spec | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 888d783..9647aca 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.3 -%global baserelease 1 +%global baserelease 2 # This should be rc1 or %%nil %global pre_release %nil @@ -173,7 +173,7 @@ %global tevent_version 0.13.0 %global ldb_version 2.6.1 -%global required_mit_krb5 1.19 +%global required_mit_krb5 1.20.1 # This is a network daemon, do a hardened build # Enables PIE and full RELRO protection @@ -4316,7 +4316,10 @@ fi %endif %changelog -* Mon Nov 21 2022 Florian Weimer - 2:4.17.3-%{baserelease} +* Thu Dec 1 2022 Alexander Bokovoy - 2:4.17.3-2 +- Rebuild against krb5 1.20.1, new KDB interface + +* Mon Nov 21 2022 Florian Weimer - 2:4.17.3-1 - Remove C89-specific language constructs from configure checks - Fix feature detection for major/minor macros From 92dd9596a21fb4a9c5455062a0ef0b5d64216cbe Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 16 Dec 2022 12:47:28 +0100 Subject: [PATCH 226/425] Update to version 4.17.4 resolves: #2153906 resolves: #2154362, #2154363 - Security fixes for CVE-2022-38023 resolves: #2154303, #2154304 - Security fixes for CVE-2022-37966 resolves: #2154320, #2154322 - Security fixes for CVE-2022-37967 Guenther --- .gitignore | 2 ++ samba.spec | 12 ++++++++++-- sources | 4 ++-- 3 files changed, 14 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index de0b909..fe25028 100644 --- a/.gitignore +++ b/.gitignore @@ -315,3 +315,5 @@ samba-3.6.0pre1.tar.gz /samba-4.17.2.tar.asc /samba-4.17.3.tar.xz /samba-4.17.3.tar.asc +/samba-4.17.4.tar.xz +/samba-4.17.4.tar.asc diff --git a/samba.spec b/samba.spec index 9647aca..7f02e43 100644 --- a/samba.spec +++ b/samba.spec @@ -134,8 +134,8 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.17.3 -%global baserelease 2 +%global samba_version 4.17.4 +%global baserelease 0 # This should be rc1 or %%nil %global pre_release %nil @@ -3111,6 +3111,7 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/as_canonicalization_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/as_req_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/compatability_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/etype_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/fast_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kcrypto.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_base_test.*.pyc @@ -3141,6 +3142,7 @@ fi %{python3_sitearch}/samba/tests/krb5/as_canonicalization_tests.py %{python3_sitearch}/samba/tests/krb5/as_req_tests.py %{python3_sitearch}/samba/tests/krb5/compatability_tests.py +%{python3_sitearch}/samba/tests/krb5/etype_tests.py %{python3_sitearch}/samba/tests/krb5/fast_tests.py %{python3_sitearch}/samba/tests/krb5/kcrypto.py %{python3_sitearch}/samba/tests/krb5/kdc_base_test.py @@ -4316,6 +4318,12 @@ fi %endif %changelog +* Fri Dec 16 2022 Guenther Deschner - 4.17.4-0 +- resolves: #2153906 - Update to version 4.17.4 +- resolves: #2154362, #2154363 - Security fixes for CVE-2022-38023 +- resolves: #2154303, #2154304 - Security fixes for CVE-2022-37966 +- resolves: #2154320, #2154322 - Security fixes for CVE-2022-37967 + * Thu Dec 1 2022 Alexander Bokovoy - 2:4.17.3-2 - Rebuild against krb5 1.20.1, new KDB interface diff --git a/sources b/sources index 663dead..523fbd2 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.17.3.tar.xz) = e346460ab53a5ed1f534992e21bb53c790fa4ba50752f0cf31d46fb96d138e4723a0171705ef8bf4ce3354960ddacc5a82b75975b06dcbe3224a09951174a5e7 -SHA512 (samba-4.17.3.tar.asc) = 814976c76a43b46fe67bd9a904fe3846104680446dfaf5759989a60ce1a088adb264c0bf67eccf9634fe84b3eb7ac1b8dbd020fcabf5e586c1773a2edad86306 +SHA512 (samba-4.17.4.tar.xz) = ffbde223ae324b6c0c779df75c926b09b77289f0ea4a6b6668d1bd758b621b3ed8ccdc4d101e6b153d1359c185b46d4baef5a7854dbc3864debbfa4696fa6bc8 +SHA512 (samba-4.17.4.tar.asc) = f69613c148453c57e83ba2bae45a316c19f80f9cceeab81a099d896e2dc578536175aa2278f85cf9e4899c8310a4eafeb1bfe365da16dd63195ffd099d6b6a6c From 874e260cc99e0adbbd55862b99ee5bbed63dbade Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Mon, 19 Dec 2022 10:22:17 +0100 Subject: [PATCH 227/425] Move libpac and libauth4 to dc-libs This allows us to not install the samba and samba-dc packages. They are not needed for domain member which just want to have samba-winbind related packages installed. --- samba.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index 7f02e43..55bd4b6 100644 --- a/samba.spec +++ b/samba.spec @@ -2096,7 +2096,6 @@ fi %{_libdir}/krb5/plugins/kdb/samba.so %{_libdir}/samba/auth/samba4.so -%{_libdir}/samba/libpac-samba4.so %dir %{_libdir}/samba/gensec %{_libdir}/samba/gensec/krb5.so %{_libdir}/samba/ldb/acl.so @@ -2160,7 +2159,9 @@ fi ### DC-LIBS %files dc-libs +%{_libdir}/samba/libauth4-samba4.so %{_libdir}/samba/libdb-glue-samba4.so +%{_libdir}/samba/libpac-samba4.so %{_libdir}/samba/libprocess-model-samba4.so %{_libdir}/samba/libservice-samba4.so @@ -2379,7 +2380,6 @@ fi %{_libdir}/libdcerpc-samr.so.* %{_libdir}/samba/libLIBWBCLIENT-OLD-samba4.so -%{_libdir}/samba/libauth4-samba4.so %{_libdir}/samba/libauth-unix-token-samba4.so %{_libdir}/samba/libdcerpc-samba4.so %{_libdir}/samba/libdnsserver-common-samba4.so From 0f08e77cfce41103cb16c3ad54fa6c30602077a6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Wed, 14 Dec 2022 14:26:12 +0100 Subject: [PATCH 228/425] Create a new 'samba-dcerpc' sub-package for DCERPC services --- samba.spec | 46 +++++++++++++++++++++++++++++++++++----------- 1 file changed, 35 insertions(+), 11 deletions(-) diff --git a/samba.spec b/samba.spec index 55bd4b6..fc44fd0 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.4 -%global baserelease 0 +%global baserelease 1 # This should be rc1 or %%nil %global pre_release %nil @@ -242,6 +242,7 @@ Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-common-tools = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} +Requires: %{name}-dcerpc = %{samba_depver} Requires: libnetapi = %{samba_depver} %if %{with libwbclient} Requires(post): libwbclient = %{samba_depver} @@ -540,6 +541,20 @@ Provides: bundled(libreplace) The samba-common-tools package contains tools for Samba servers and SMB/CIFS clients. +### RPC +%package dcerpc +Summary: DCE RPC binaries +Requires: samba-common-libs = %{samba_depver} +Requires: samba-client-libs = %{samba_depver} +Requires: samba-libs = %{samba_depver} +Requires: libnetapi = %{samba_depver} +%if %{with libwbclient} +Requires: libwbclient = %{samba_depver} +%endif + +%description dcerpc +The samba-dcerpc package contains binaries that serve DCERPC over named pipes. + ### DC %if %{with dc} || %{with testsuite} %package dc @@ -970,6 +985,7 @@ Requires: %{name}-winbind-modules = %{samba_depver} Requires(post): libwbclient = %{samba_depver} Requires: libwbclient = %{samba_depver} %endif +Requires: %{name}-dcerpc = %{samba_depver} Provides: samba4-winbind = %{samba_depver} Obsoletes: samba4-winbind < %{samba_depver} @@ -1753,15 +1769,6 @@ fi %dir %{_libexecdir}/samba %{_libexecdir}/samba/samba-bgqd -%{_libexecdir}/samba/samba-dcerpcd -%{_libexecdir}/samba/rpcd_classic -%{_libexecdir}/samba/rpcd_epmapper -%{_libexecdir}/samba/rpcd_fsrvp -%{_libexecdir}/samba/rpcd_lsad -%{_libexecdir}/samba/rpcd_mdssvc -%{_libexecdir}/samba/rpcd_rpcecho -%{_libexecdir}/samba/rpcd_spoolss -%{_libexecdir}/samba/rpcd_winreg %dir %{_datadir}/samba %dir %{_datadir}/samba/mdssvc @@ -1775,7 +1782,6 @@ fi %{_mandir}/man1/smbstatus.1* %{_mandir}/man8/eventlogadm.8* %{_mandir}/man8/samba-bgqd.8* -%{_mandir}/man8/samba-dcerpcd.8* %{_mandir}/man8/smbd.8* %{_mandir}/man8/nmbd.8* %{_mandir}/man8/vfs_acl_tdb.8* @@ -2082,6 +2088,20 @@ fi %{_mandir}/man8/samba-tool.8* %{_mandir}/man8/smbpasswd.8* +### RPC +%files dcerpc +%dir %{_libexecdir}/samba +%{_libexecdir}/samba/samba-dcerpcd +%{_libexecdir}/samba/rpcd_classic +%{_libexecdir}/samba/rpcd_epmapper +%{_libexecdir}/samba/rpcd_fsrvp +%{_libexecdir}/samba/rpcd_lsad +%{_libexecdir}/samba/rpcd_mdssvc +%{_libexecdir}/samba/rpcd_rpcecho +%{_libexecdir}/samba/rpcd_spoolss +%{_libexecdir}/samba/rpcd_winreg +%{_mandir}/man8/samba-dcerpcd.8* + ### DC %if %{with dc} || %{with testsuite} %files dc @@ -4318,6 +4338,10 @@ fi %endif %changelog +* Mon Dec 19 2022 Pavel Filipenský - 4.17.4-1 +- Create a samba-dcerpc sub-package +- Fix package installation without samba and samba-dc package + * Fri Dec 16 2022 Guenther Deschner - 4.17.4-0 - resolves: #2153906 - Update to version 4.17.4 - resolves: #2154362, #2154363 - Security fixes for CVE-2022-38023 From 5471a3e692cdc97e783a0c4e0f7035f668e9aafe Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 20 Dec 2022 11:01:45 +0100 Subject: [PATCH 229/425] Fix '--without dc' build: delete libauth4-samba4.so --- samba.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index fc44fd0..c2d174f 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.4 -%global baserelease 1 +%global baserelease 2 # This should be rc1 or %%nil %global pre_release %nil @@ -1403,6 +1403,7 @@ touch %{buildroot}%{_libdir}/krb5/plugins/libkrb5/winbind_krb5_locator.so %if %{without dc} && %{without testsuite} for i in \ + %{_libdir}/samba/libauth4-samba4.so \ %{_libdir}/samba/libdfs-server-ad-samba4.so \ %{_libdir}/samba/libdsdb-garbage-collect-tombstones-samba4.so \ %{_libdir}/samba/libscavenge-dns-records-samba4.so \ @@ -4338,6 +4339,9 @@ fi %endif %changelog +* Tue Dec 20 2022 Pavel Filipenský - 4.17.4-2 +- Fix '--without dc' build: delete libauth4-samba4.so + * Mon Dec 19 2022 Pavel Filipenský - 4.17.4-1 - Create a samba-dcerpc sub-package - Fix package installation without samba and samba-dc package From c3203becc0c86b581548b5335bf5ffc69c54e144 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Thu, 22 Dec 2022 15:06:03 +0100 Subject: [PATCH 230/425] Create package dc-libs also for 'non-dc' build --- samba.spec | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/samba.spec b/samba.spec index c2d174f..b35ee2f 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.4 -%global baserelease 2 +%global baserelease 3 # This should be rc1 or %%nil %global pre_release %nil @@ -600,6 +600,9 @@ BuildArch: noarch %description dc-provision The samba-dc-provision package provides files to setup a domain controller +#endif with dc || with testsuite +%endif + ### DC-LIBS %package dc-libs Summary: Samba AD Domain Controller Libraries @@ -616,6 +619,7 @@ Provides: bundled(libreplace) The %{name}-dc-libs package contains the libraries needed by the DC to link against the SMB, RPC and other protocols. +%if %{with dc} || %{with testsuite} ### DC-BIND %package dc-bind-dlz Summary: Bind DLZ module for Samba AD @@ -838,9 +842,7 @@ Summary: Samba Python3 libraries Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} -%if %{with dc} Requires: %{name}-dc-libs = %{samba_depver} -%endif Requires: python3-talloc Requires: python3-tevent Requires: python3-tdb @@ -1403,7 +1405,6 @@ touch %{buildroot}%{_libdir}/krb5/plugins/libkrb5/winbind_krb5_locator.so %if %{without dc} && %{without testsuite} for i in \ - %{_libdir}/samba/libauth4-samba4.so \ %{_libdir}/samba/libdfs-server-ad-samba4.so \ %{_libdir}/samba/libdsdb-garbage-collect-tombstones-samba4.so \ %{_libdir}/samba/libscavenge-dns-records-samba4.so \ @@ -2178,9 +2179,13 @@ fi %license source4/setup/ad-schema/licence.txt %{_datadir}/samba/setup +#endif with dc || with testsuite +%endif ### DC-LIBS %files dc-libs %{_libdir}/samba/libauth4-samba4.so + +%if %{with dc} || %{with testsuite} %{_libdir}/samba/libdb-glue-samba4.so %{_libdir}/samba/libpac-samba4.so %{_libdir}/samba/libprocess-model-samba4.so @@ -4339,6 +4344,9 @@ fi %endif %changelog +* Thu Dec 22 2022 Pavel Filipenský - 4.17.4-3 +- Create package dc-libs also for 'non-dc build' + * Tue Dec 20 2022 Pavel Filipenský - 4.17.4-2 - Fix '--without dc' build: delete libauth4-samba4.so From c22466881ad38245c1068f2a0f5446deb7974a72 Mon Sep 17 00:00:00 2001 From: Pete Walter Date: Sat, 31 Dec 2022 03:19:18 +0000 Subject: [PATCH 231/425] Rebuild for ICU 72 --- samba.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index b35ee2f..4da54ae 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.4 -%global baserelease 3 +%global baserelease 4 # This should be rc1 or %%nil %global pre_release %nil @@ -4344,6 +4344,9 @@ fi %endif %changelog +* Sat Dec 31 2022 Pete Walter - 2:4.17.4-4 +- Rebuild for ICU 72 + * Thu Dec 22 2022 Pavel Filipenský - 4.17.4-3 - Create package dc-libs also for 'non-dc build' From 127f68766f3ca009d1cc1b04fb7668381194677b Mon Sep 17 00:00:00 2001 From: Jitka Plesnikova Date: Fri, 13 Jan 2023 21:13:35 +0100 Subject: [PATCH 232/425] Remove perl(MODULE_COMPAT), it will be replaced by generators --- samba.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/samba.spec b/samba.spec index 4da54ae..96ab611 100644 --- a/samba.spec +++ b/samba.spec @@ -896,7 +896,6 @@ Summary: Perl IDL compiler Requires: perl-interpreter Requires: perl(FindBin) Requires: perl(Parse::Yapp) -Requires: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version)) BuildArch: noarch Provides: samba4-pidl = %{samba_depver} From d5d42cde4f39f2b218c06e92bcd958efdcd664fc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 19 Jan 2023 13:10:25 +0100 Subject: [PATCH 233/425] Update to version 4.18.0rc1 resolves: #2162097 Guenther --- .gitignore | 2 ++ samba-sysmacros.patch | 31 --------------------- samba-waf18.patch | 23 --------------- samba-wscript-c99.patch | 55 ------------------------------------ samba.spec | 62 ++++++++++++++++++++++++++++++----------- sources | 4 +-- 6 files changed, 49 insertions(+), 128 deletions(-) delete mode 100644 samba-sysmacros.patch delete mode 100644 samba-waf18.patch delete mode 100644 samba-wscript-c99.patch diff --git a/.gitignore b/.gitignore index fe25028..9d549cd 100644 --- a/.gitignore +++ b/.gitignore @@ -317,3 +317,5 @@ samba-3.6.0pre1.tar.gz /samba-4.17.3.tar.asc /samba-4.17.4.tar.xz /samba-4.17.4.tar.asc +/samba-4.18.0rc1.tar.xz +/samba-4.18.0rc1.tar.asc diff --git a/samba-sysmacros.patch b/samba-sysmacros.patch deleted file mode 100644 index 60f0489..0000000 --- a/samba-sysmacros.patch +++ /dev/null @@ -1,31 +0,0 @@ -source3/wscript: Fix detection of major/minor macros - -These macros are only available via as of glibc -commit e16deca62e16f645213dffd4ecd1153c37765f17 ("[BZ #19239] Don't -include sys/sysmacros.h from sys/types.h."), which went into -glibc 2.28. - -This is different from the usual C99 cleanups because it changes -the configure check result with existing compilers that usually -accept implicit function declarations. - -Submitted upstream: - -diff --git a/source3/wscript b/source3/wscript -index 22be17a1a6fd1126..ca27deaa54381446 100644 ---- a/source3/wscript -+++ b/source3/wscript -@@ -603,11 +603,11 @@ msg.msg_accrightslen = sizeof(fd); - conf.CHECK_HEADERS('asm/types.h') - - conf.CHECK_CODE('dev_t dev; int i = major(dev); return 0', "HAVE_DEVICE_MAJOR_FN", -- headers='unistd.h sys/types.h', -+ headers='sys/sysmacros.h unistd.h sys/types.h', - msg="Checking for major macro") - - conf.CHECK_CODE('dev_t dev; int i = minor(dev); return 0', "HAVE_DEVICE_MINOR_FN", -- headers='unistd.h sys/types.h', -+ headers='sys/sysmacros.h unistd.h sys/types.h', - msg="Checking for minor macro") - - conf.CHECK_STRUCTURE_MEMBER('struct dirent', 'd_off', diff --git a/samba-waf18.patch b/samba-waf18.patch deleted file mode 100644 index 84dcf7a..0000000 --- a/samba-waf18.patch +++ /dev/null @@ -1,23 +0,0 @@ -Avoid calling lib_func without a prototype. - -This commit mirrors the change in commit f4c0a750d4adebcf2342a44e85f04526c34 -("WAF: Fix detection of linker features") -to buildtools/wafsamba/samba_conftests.py. It fixes the check for rpath -support with compilers in strict C99 mode. - -Submitted upstream: - -diff --git a/buildtools/wafsamba/samba_waf18.py b/buildtools/wafsamba/samba_waf18.py -index e2a078bd3a05fd78..cfdceea14ca4b706 100644 ---- a/buildtools/wafsamba/samba_waf18.py -+++ b/buildtools/wafsamba/samba_waf18.py -@@ -209,7 +209,8 @@ def CHECK_LIBRARY_SUPPORT(conf, rpath=False, version_script=False, msg=None): - lib_node.parent.mkdir() - lib_node.write('int lib_func(void) { return 42; }\n', 'w') - main_node = bld.srcnode.make_node('main.c') -- main_node.write('int main(void) {return !(lib_func() == 42);}', 'w') -+ main_node.write('int lib_func(void);\n' -+ 'int main(void) {return !(lib_func() == 42);}', 'w') - linkflags = [] - if version_script: - script = bld.srcnode.make_node('ldscript') diff --git a/samba-wscript-c99.patch b/samba-wscript-c99.patch deleted file mode 100644 index 11457cf..0000000 --- a/samba-wscript-c99.patch +++ /dev/null @@ -1,55 +0,0 @@ -source3/wscript: Remove implict int and implicit function declarations - -This should fix the remaining C89isms in these configure checks. - -Submitted upstream: - -diff --git a/source3/wscript b/source3/wscript -index ca27deaa54381446..e77cd127e600f8c2 100644 ---- a/source3/wscript -+++ b/source3/wscript -@@ -1314,7 +1314,7 @@ syscall(SYS_initgroups, 16, NULL, NULL, 0); - - if conf.CHECK_CODE(''' - #include --main() { -+int main() { - struct tm *tm; - if (sizeof(time_t) == 8) { - time_t max_time = 0x7fffffffffffffffll; -@@ -1345,7 +1345,7 @@ main() { - #if defined(HAVE_SYS_SYSMACROS_H) - #include - #endif --main() { dev_t dev = makedev(1,2); return 0; } -+int main() { dev_t dev = makedev(1,2); return 0; } - ''', - 'HAVE_MAKEDEV', - addmain=False, -@@ -1355,12 +1355,13 @@ main() { dev_t dev = makedev(1,2); return 0; } - #include - #include - #include -+#include - - void exit_on_core(int ignored) { - exit(1); - } - --main() { -+int main() { - char *newpath; - signal(SIGSEGV, exit_on_core); - newpath = realpath("/tmp", NULL); -@@ -1517,9 +1518,9 @@ main() { - # Check for getcwd allowing a NULL arg. - conf.CHECK_CODE(''' - #include --main() { -+int main() { - char *s = getcwd(NULL,0); -- exit(s != NULL ? 0 : 1); -+ return s != NULL ? 0 : 1; - }''', 'GETCWD_TAKES_NULL', addmain=False, execute=True, - msg="getcwd takes a NULL argument") - diff --git a/samba.spec b/samba.spec index 96ab611..9928d27 100644 --- a/samba.spec +++ b/samba.spec @@ -134,10 +134,10 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.17.4 -%global baserelease 4 +%global samba_version 4.18.0 +%global baserelease 1 # This should be rc1 or %%nil -%global pre_release %nil +%global pre_release rc1 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -168,10 +168,10 @@ %global libsmbclient_so_version 0 %global libwbclient_so_version 0 -%global talloc_version 2.3.4 -%global tdb_version 1.4.7 -%global tevent_version 0.13.0 -%global ldb_version 2.6.1 +%global talloc_version 2.4.0 +%global tdb_version 1.4.8 +%global tevent_version 0.14.0 +%global ldb_version 2.7.0 %global required_mit_krb5 1.20.1 @@ -185,7 +185,7 @@ # https://src.fedoraproject.org/rpms/redhat-rpm-config/blob/master/f/buildflags.md %undefine _strict_symbol_defs_build -%global libwbc_alternatives_version 0.15 +%global libwbc_alternatives_version 0.16 %global libwbc_alternatives_suffix %nil %if 0%{?__isa_bits} == 64 %global libwbc_alternatives_suffix -64 @@ -230,9 +230,6 @@ Source17: samba-usershares-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore -Patch0: samba-waf18.patch -Patch1: samba-sysmacros.patch -Patch2: samba-wscript-c99.patch Requires(pre): /usr/sbin/groupadd @@ -2018,10 +2015,9 @@ fi %if %{with includelibs} %{_libdir}/samba/libldb-*.so -%{_libdir}/samba/libldb.so.* -%{_libdir}/samba/libtalloc.so.* -%{_libdir}/samba/libtdb.so.* -%{_libdir}/samba/libtevent.so.* +%{_libdir}/samba/libtalloc-samba4.so +%{_libdir}/samba/libtdb-samba4.so +%{_libdir}/samba/libtevent-samba4.so %{_libdir}/samba/ldb/asq.so %{_libdir}/samba/ldb/ldb.so @@ -2170,9 +2166,13 @@ fi %{_mandir}/man8/samba.8* %{_mandir}/man8/samba_downgrade_db.8* %dir %{_datadir}/samba/admx +%{_datadir}/samba/admx/GNOME_Settings.admx %{_datadir}/samba/admx/samba.admx %dir %{_datadir}/samba/admx/en-US +%{_datadir}/samba/admx/en-US/GNOME_Settings.adml %{_datadir}/samba/admx/en-US/samba.adml +%dir %{_datadir}/samba/admx/ru-RU +%{_datadir}/samba/admx/ru-RU/GNOME_Settings.adml %files dc-provision %license source4/setup/ad-schema/licence.txt @@ -2250,6 +2250,7 @@ fi %{_includedir}/samba-4.0/domain_credentials.h %{_includedir}/samba-4.0/gen_ndr/atsvc.h %{_includedir}/samba-4.0/gen_ndr/auth.h +%{_includedir}/samba-4.0/gen_ndr/claims.h %{_includedir}/samba-4.0/gen_ndr/dcerpc.h %{_includedir}/samba-4.0/gen_ndr/krb5pac.h %{_includedir}/samba-4.0/gen_ndr/lsa.h @@ -2410,6 +2411,7 @@ fi %{_libdir}/samba/libdnsserver-common-samba4.so %{_libdir}/samba/libshares-samba4.so %{_libdir}/samba/libsmbpasswdparser-samba4.so +%{_libdir}/samba/libstable-sort-samba4.so %{_libdir}/samba/libxattr-tdb-samba4.so %{_libdir}/samba/libREG-FULL-samba4.so %{_libdir}/samba/libRPC-SERVER-LOOP-samba4.so @@ -2522,6 +2524,7 @@ fi %{python3_sitearch}/samba/__pycache__/ms_schema.*.pyc %{python3_sitearch}/samba/__pycache__/ndr.*.pyc %{python3_sitearch}/samba/__pycache__/ntacls.*.pyc +%{python3_sitearch}/samba/__pycache__/safe_tarfile.*.pyc %{python3_sitearch}/samba/__pycache__/sd_utils.*.pyc %{python3_sitearch}/samba/__pycache__/sites.*.pyc %{python3_sitearch}/samba/__pycache__/subnets.*.pyc @@ -2537,6 +2540,7 @@ fi %{python3_sitearch}/samba/dbchecker.py %{python3_sitearch}/samba/colour.py %{python3_sitearch}/samba/common.py +%{python3_sitearch}/samba/compression.*.so %{python3_sitearch}/samba/credentials.*.so %{python3_sitearch}/samba/crypto.*.so %dir %{python3_sitearch}/samba/dcerpc @@ -2546,6 +2550,7 @@ fi %{python3_sitearch}/samba/dcerpc/atsvc.*.so %{python3_sitearch}/samba/dcerpc/auth.*.so %{python3_sitearch}/samba/dcerpc/base.*.so +%{python3_sitearch}/samba/dcerpc/claims.*.so %{python3_sitearch}/samba/dcerpc/dcerpc.*.so %{python3_sitearch}/samba/dcerpc/dfs.*.so %{python3_sitearch}/samba/dcerpc/dns.*.so @@ -2742,7 +2747,9 @@ fi %{python3_sitearch}/samba/param.*.so %{python3_sitearch}/samba/policy.*.so %{python3_sitearch}/samba/registry.*.so +%{python3_sitearch}/samba/reparse_symlink.*.so %{python3_sitearch}/samba/security.*.so +%{python3_sitearch}/samba/safe_tarfile.py %dir %{python3_sitearch}/samba/samba3 %{python3_sitearch}/samba/samba3/__init__.py %dir %{python3_sitearch}/samba/samba3/__pycache__ @@ -2778,8 +2785,8 @@ fi %{_libdir}/samba/libsamba-python.cpython*.so %if %{with includelibs} -%{_libdir}/samba/libpyldb-util.cpython*.so.* -%{_libdir}/samba/libpytalloc-util.cpython*.so.* +%{_libdir}/samba/libpyldb-util.cpython*.so +%{_libdir}/samba/libpytalloc-util.cpython*.so %{python3_sitearch}/__pycache__/_ldb_text*.pyc %{python3_sitearch}/__pycache__/_tdb_text*.pyc @@ -2876,6 +2883,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/auth_log_winbind.*.pyc %{python3_sitearch}/samba/tests/__pycache__/common.*.pyc %{python3_sitearch}/samba/tests/__pycache__/complex_expressions.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/compression.*.pyc %{python3_sitearch}/samba/tests/__pycache__/core.*.pyc %{python3_sitearch}/samba/tests/__pycache__/credentials.*.pyc %{python3_sitearch}/samba/tests/__pycache__/cred_opt.*.pyc @@ -2916,6 +2924,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/loadparm.*.pyc %{python3_sitearch}/samba/tests/__pycache__/logfiles.*.pyc %{python3_sitearch}/samba/tests/__pycache__/libsmb.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/libsmb-basic.*.pyc %{python3_sitearch}/samba/tests/__pycache__/lsa_string.*.pyc %{python3_sitearch}/samba/tests/__pycache__/messaging.*.pyc %{python3_sitearch}/samba/tests/__pycache__/ndr.*.pyc @@ -2950,12 +2959,14 @@ fi %{python3_sitearch}/samba/tests/__pycache__/pso.*.pyc %{python3_sitearch}/samba/tests/__pycache__/py_credentials.*.pyc %{python3_sitearch}/samba/tests/__pycache__/registry.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/reparsepoints.*.pyc %{python3_sitearch}/samba/tests/__pycache__/s3idmapdb.*.pyc %{python3_sitearch}/samba/tests/__pycache__/s3param.*.pyc %{python3_sitearch}/samba/tests/__pycache__/s3passdb.*.pyc %{python3_sitearch}/samba/tests/__pycache__/s3registry.*.pyc %{python3_sitearch}/samba/tests/__pycache__/s3windb.*.pyc %{python3_sitearch}/samba/tests/__pycache__/s3_net_join.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/safe_tarfile.*.pyc %{python3_sitearch}/samba/tests/__pycache__/samba_upgradedns_lmdb.*.pyc %{python3_sitearch}/samba/tests/__pycache__/samba3sam.*.pyc %{python3_sitearch}/samba/tests/__pycache__/samdb.*.pyc @@ -2965,6 +2976,9 @@ fi %{python3_sitearch}/samba/tests/__pycache__/segfault.*.pyc %{python3_sitearch}/samba/tests/__pycache__/sid_strings.*.pyc %{python3_sitearch}/samba/tests/__pycache__/smb.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/smb1posix.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/smb2symlink.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/smb3unix.*.pyc %{python3_sitearch}/samba/tests/__pycache__/smbconf.*.pyc %{python3_sitearch}/samba/tests/__pycache__/smb-notify.*.pyc %{python3_sitearch}/samba/tests/__pycache__/smbd_base.*.pyc @@ -3030,6 +3044,7 @@ fi %{python3_sitearch}/samba/tests/blackbox/traffic_replay.py %{python3_sitearch}/samba/tests/blackbox/traffic_summary.py %{python3_sitearch}/samba/tests/common.py +%{python3_sitearch}/samba/tests/compression.py %{python3_sitearch}/samba/tests/complex_expressions.py %{python3_sitearch}/samba/tests/core.py %{python3_sitearch}/samba/tests/credentials.py @@ -3135,9 +3150,11 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/alias_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/as_canonicalization_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/as_req_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/claims_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/compatability_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/etype_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/fast_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/group_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kcrypto.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_base_test.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tests.*.pyc @@ -3166,9 +3183,11 @@ fi %{python3_sitearch}/samba/tests/krb5/alias_tests.py %{python3_sitearch}/samba/tests/krb5/as_canonicalization_tests.py %{python3_sitearch}/samba/tests/krb5/as_req_tests.py +%{python3_sitearch}/samba/tests/krb5/claims_tests.py %{python3_sitearch}/samba/tests/krb5/compatability_tests.py %{python3_sitearch}/samba/tests/krb5/etype_tests.py %{python3_sitearch}/samba/tests/krb5/fast_tests.py +%{python3_sitearch}/samba/tests/krb5/group_tests.py %{python3_sitearch}/samba/tests/krb5/kcrypto.py %{python3_sitearch}/samba/tests/krb5/kdc_base_test.py %{python3_sitearch}/samba/tests/krb5/kdc_tests.py @@ -3200,6 +3219,7 @@ fi %{python3_sitearch}/samba/tests/ldap_referrals.py %{python3_sitearch}/samba/tests/ldap_upn_sam_account.py %{python3_sitearch}/samba/tests/libsmb.py +%{python3_sitearch}/samba/tests/libsmb-basic.py %{python3_sitearch}/samba/tests/loadparm.py %{python3_sitearch}/samba/tests/logfiles.py %{python3_sitearch}/samba/tests/lsa_string.py @@ -3236,12 +3256,14 @@ fi %{python3_sitearch}/samba/tests/pso.py %{python3_sitearch}/samba/tests/py_credentials.py %{python3_sitearch}/samba/tests/registry.py +%{python3_sitearch}/samba/tests/reparsepoints.py %{python3_sitearch}/samba/tests/s3idmapdb.py %{python3_sitearch}/samba/tests/s3param.py %{python3_sitearch}/samba/tests/s3passdb.py %{python3_sitearch}/samba/tests/s3registry.py %{python3_sitearch}/samba/tests/s3windb.py %{python3_sitearch}/samba/tests/s3_net_join.py +%{python3_sitearch}/samba/tests/safe_tarfile.py %{python3_sitearch}/samba/tests/samba3sam.py %{python3_sitearch}/samba/tests/samba_upgradedns_lmdb.py %dir %{python3_sitearch}/samba/tests/samba_tool @@ -3329,6 +3351,9 @@ fi %{python3_sitearch}/samba/tests/segfault.py %{python3_sitearch}/samba/tests/sid_strings.py %{python3_sitearch}/samba/tests/smb.py +%{python3_sitearch}/samba/tests/smb1posix.py +%{python3_sitearch}/samba/tests/smb2symlink.py +%{python3_sitearch}/samba/tests/smb3unix.py %{python3_sitearch}/samba/tests/smbconf.py %{python3_sitearch}/samba/tests/smb-notify.py %{python3_sitearch}/samba/tests/smbd_base.py @@ -4343,6 +4368,9 @@ fi %endif %changelog +* Thu Jan 19 2023 Guenther Deschner - 4.18.0rc1 +- resolves: #2162097 - Update to version 4.18.0rc1 + * Sat Dec 31 2022 Pete Walter - 2:4.17.4-4 - Rebuild for ICU 72 diff --git a/sources b/sources index 523fbd2..0fd95b9 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.17.4.tar.xz) = ffbde223ae324b6c0c779df75c926b09b77289f0ea4a6b6668d1bd758b621b3ed8ccdc4d101e6b153d1359c185b46d4baef5a7854dbc3864debbfa4696fa6bc8 -SHA512 (samba-4.17.4.tar.asc) = f69613c148453c57e83ba2bae45a316c19f80f9cceeab81a099d896e2dc578536175aa2278f85cf9e4899c8310a4eafeb1bfe365da16dd63195ffd099d6b6a6c +SHA512 (samba-4.18.0rc1.tar.xz) = 1ceb0bef12766b079a73b2a517bb3ceb3a16d0c0383b0cabb8052d4e74663226870894f8b0065ec9852934359c08828d851739824f617c93d9d89816a03d0aa1 +SHA512 (samba-4.18.0rc1.tar.asc) = 987c6f7845e34d9e688beba15abb26f876299310bbfb79b6734d570b24741fec0482facd59c5c2aae6618782cb0b804aa230dad54eb1bd3f379289615b6e991c From fe7442c100e37957595f4f69b2b1e59f74aad093 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 21 Jan 2023 02:35:44 +0000 Subject: [PATCH 234/425] Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- samba.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 9928d27..2544c07 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.0 -%global baserelease 1 +%global baserelease 2 # This should be rc1 or %%nil %global pre_release rc1 @@ -4368,6 +4368,9 @@ fi %endif %changelog +* Sat Jan 21 2023 Fedora Release Engineering - 2:4.18.0-0.2.rc1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + * Thu Jan 19 2023 Guenther Deschner - 4.18.0rc1 - resolves: #2162097 - Update to version 4.18.0rc1 From 08e07cb8554d2de6a7f9af35f6e49a0cd5485692 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 23 Jan 2023 07:24:09 +0100 Subject: [PATCH 235/425] Use mold linker on Fedora >= 37 This makes compilation of Samba a lot faster. --- samba.spec | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 2544c07..5122f0a 100644 --- a/samba.spec +++ b/samba.spec @@ -324,6 +324,10 @@ BuildRequires: zlib-devel >= 1.2.3 BuildRequires: pkgconfig(libsystemd) +%if 0%{?fedora} >= 37 +BuildRequires: mold +%endif + %if %{with vfs_glusterfs} BuildRequires: glusterfs-api-devel >= 3.4.0.16 BuildRequires: glusterfs-devel >= 3.4.0.16 @@ -1242,9 +1246,13 @@ rm -f lib/crypto/{aes,rijndael}*.c # TODO: resolve underlinked python modules export python_LDFLAGS="$(echo %{__global_ldflags} | sed -e 's/-Wl,-z,defs//g')" -# Use the gold linker -# See https://bugzilla.redhat.com/show_bug.cgi?id=2043178 ; For f36 do not use ld.gold till it is fixed -#export LDFLAGS="%%{__global_ldflags} -fuse-ld=gold" +# Use the mold linker +%if 0%{?fedora} >= 37 +export LDFLAGS="%{__global_ldflags} -fuse-ld=mold" +export python_LDFLAGS="$(echo ${LDFLAGS} | sed -e 's/-Wl,-z,defs//g')" +%else +export python_LDFLAGS="$(echo %{__global_ldflags} | sed -e 's/-Wl,-z,defs//g')" +%endif %configure \ --enable-fhs \ From 3134f7f1d6fae745005ff0e580c7d216534d063a Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 23 Jan 2023 15:12:38 +0100 Subject: [PATCH 236/425] Use python3-dateutil instead of python3-iso8601 We don't have iso8601 in third_party/ anymore. --- samba.spec | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-) diff --git a/samba.spec b/samba.spec index 5122f0a..673fa12 100644 --- a/samba.spec +++ b/samba.spec @@ -352,9 +352,6 @@ BuildRequires: python3-etcd %endif %if %{with dc} || %{with testsuite} -# Add python3-iso8601 to avoid that the -# version in Samba is being packaged -BuildRequires: python3-iso8601 BuildRequires: python3-pyasn1 >= 0.4.8 BuildRequires: bind @@ -392,6 +389,11 @@ BuildRequires: lmdb-devel %if %{with dc} || %{with testsuite} BuildRequires: bind BuildRequires: krb5-server >= %{required_mit_krb5} +%if 0%{?fedora} || 0%{rhel} >= 9 +BuildRequires: python3-dateutil +%else +BuildRequires: python3-iso8601 +%endif BuildRequires: python3-gpg BuildRequires: python3-markdown BuildRequires: python3-setproctitle @@ -1456,12 +1458,6 @@ for i in \ %{python3_sitearch}/samba/remove_dc.py \ %{python3_sitearch}/samba/samdb.py \ %{python3_sitearch}/samba/schema.py \ - %{python3_sitearch}/samba/third_party/iso8601/__init__.py \ - %{python3_sitearch}/samba/third_party/iso8601/__pycache__/__init__.*.pyc \ - %{python3_sitearch}/samba/third_party/iso8601/__pycache__/iso8601.*.pyc \ - %{python3_sitearch}/samba/third_party/iso8601/__pycache__/test_iso8601.*.pyc \ - %{python3_sitearch}/samba/third_party/iso8601/iso8601.py \ - %{python3_sitearch}/samba/third_party/iso8601/test_iso8601.py \ %{python3_sitearch}/samba/uptodateness.py \ %{_sbindir}/samba-gpupdate \ ; do From d5a1366d2a2c288e26304937323ed9f65ed34448 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 23 Jan 2023 15:13:10 +0100 Subject: [PATCH 237/425] Remove duplicate code --- samba.spec | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/samba.spec b/samba.spec index 673fa12..ecc4f40 100644 --- a/samba.spec +++ b/samba.spec @@ -351,14 +351,6 @@ BuildRequires: librados-devel BuildRequires: python3-etcd %endif -%if %{with dc} || %{with testsuite} -BuildRequires: python3-pyasn1 >= 0.4.8 - -BuildRequires: bind -BuildRequires: krb5-server >= %{required_mit_krb5} -#endif with dc -%endif - # pidl requirements BuildRequires: perl(ExtUtils::MakeMaker) BuildRequires: perl(FindBin) @@ -396,6 +388,7 @@ BuildRequires: python3-iso8601 %endif BuildRequires: python3-gpg BuildRequires: python3-markdown +BuildRequires: python3-pyasn1 >= 0.4.8 BuildRequires: python3-setproctitle BuildRequires: python3-cryptography From 6320734465512e2358b49ab16af28f196562964d Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 23 Jan 2023 15:13:36 +0100 Subject: [PATCH 238/425] Add missing python requirements for python3-samba --- samba.spec | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/samba.spec b/samba.spec index ecc4f40..cd4360b 100644 --- a/samba.spec +++ b/samba.spec @@ -306,8 +306,10 @@ BuildRequires: perl-generators BuildRequires: perl(Archive::Tar) BuildRequires: perl(Test::More) BuildRequires: popt-devel +BuildRequires: python3-cryptography BuildRequires: python3-devel BuildRequires: python3-dns +BuildRequires: python3-requests BuildRequires: python3-setuptools BuildRequires: quota-devel BuildRequires: readline-devel @@ -390,7 +392,6 @@ BuildRequires: python3-gpg BuildRequires: python3-markdown BuildRequires: python3-pyasn1 >= 0.4.8 BuildRequires: python3-setproctitle -BuildRequires: python3-cryptography %if %{without includelibs} BuildRequires: tdb-tools @@ -839,11 +840,13 @@ Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-dc-libs = %{samba_depver} -Requires: python3-talloc -Requires: python3-tevent -Requires: python3-tdb -Requires: python3-ldb +Requires: python3-cryptography Requires: python3-dns +Requires: python3-ldb +Requires: python3-requests +Requires: python3-talloc +Requires: python3-tdb +Requires: python3-tevent %if %{with libsmbclient} Requires: libsmbclient = %{samba_depver} %endif From 3937d0fbabf0d51dbe51c52c0607e99fcb4d1529 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 24 Jan 2023 08:59:00 +0100 Subject: [PATCH 239/425] Fix typo --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index cd4360b..b28f27a 100644 --- a/samba.spec +++ b/samba.spec @@ -383,7 +383,7 @@ BuildRequires: lmdb-devel %if %{with dc} || %{with testsuite} BuildRequires: bind BuildRequires: krb5-server >= %{required_mit_krb5} -%if 0%{?fedora} || 0%{rhel} >= 9 +%if 0%{?fedora} || 0%{?rhel} >= 9 BuildRequires: python3-dateutil %else BuildRequires: python3-iso8601 From 574391dda64fcbbf5625baaaf3684e3e09627951 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 31 Jan 2023 21:59:37 +0100 Subject: [PATCH 240/425] rpminspect: Avoid "Missing: .debug_info" libdcerpc-samr is a grouping library without .debug_info. See source4/librpc/wscript_build. There is an empty source list for bld.SAMBA_LIBRARY('dcerpc-samr' --- rpminspect.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/rpminspect.yaml b/rpminspect.yaml index 9c56e6c..4c2edfa 100644 --- a/rpminspect.yaml +++ b/rpminspect.yaml @@ -18,3 +18,7 @@ runpath: abidiff: suppression_file: samba.abignore + +debuginfo: + ignore: + - /usr/lib*/libdcerpc-samr.so.* From 36c4a399ca4be7a83cfc45cc1f6a8ec0dae2cdc5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 2 Feb 2023 14:47:10 +0100 Subject: [PATCH 241/425] Update to version 4.18.0rc2 resolves: #2166416 Guenther --- .gitignore | 2 ++ samba.spec | 9 ++++++--- sources | 4 ++-- 3 files changed, 10 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 9d549cd..1b867fd 100644 --- a/.gitignore +++ b/.gitignore @@ -319,3 +319,5 @@ samba-3.6.0pre1.tar.gz /samba-4.17.4.tar.asc /samba-4.18.0rc1.tar.xz /samba-4.18.0rc1.tar.asc +/samba-4.18.0rc2.tar.xz +/samba-4.18.0rc2.tar.asc diff --git a/samba.spec b/samba.spec index b28f27a..562f5a2 100644 --- a/samba.spec +++ b/samba.spec @@ -135,9 +135,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.0 -%global baserelease 2 +%global baserelease 3 # This should be rc1 or %%nil -%global pre_release rc1 +%global pre_release rc2 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4368,10 +4368,13 @@ fi %endif %changelog +* Thu Feb 02 2023 Guenther Deschner - 4.18.0rc2-3 +- resolves: #2166416 - Update to version 4.18.0rc2 + * Sat Jan 21 2023 Fedora Release Engineering - 2:4.18.0-0.2.rc1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild -* Thu Jan 19 2023 Guenther Deschner - 4.18.0rc1 +* Thu Jan 19 2023 Guenther Deschner - 4.18.0rc1-0 - resolves: #2162097 - Update to version 4.18.0rc1 * Sat Dec 31 2022 Pete Walter - 2:4.17.4-4 diff --git a/sources b/sources index 0fd95b9..760bff2 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.18.0rc1.tar.xz) = 1ceb0bef12766b079a73b2a517bb3ceb3a16d0c0383b0cabb8052d4e74663226870894f8b0065ec9852934359c08828d851739824f617c93d9d89816a03d0aa1 -SHA512 (samba-4.18.0rc1.tar.asc) = 987c6f7845e34d9e688beba15abb26f876299310bbfb79b6734d570b24741fec0482facd59c5c2aae6618782cb0b804aa230dad54eb1bd3f379289615b6e991c +SHA512 (samba-4.18.0rc2.tar.xz) = 1467ee97c5861e7306d2bf96c0c600404212d9b241cc28e5fb649f8297bdb3bb86a774cb78ccfc82a70f7b715eff7eb0de9dc3563ba0300c6a069d9609fbdef4 +SHA512 (samba-4.18.0rc2.tar.asc) = 557eec6485669b172b16fd5032750d8cfa8058d1615316d7e539924d561d7d7e7d0990bcf62f96d0ec467c8fc5e59c0bb8ea1a963396055b6af8659e166073cd From 5704b04d6966871afdac7015a692544a19583bb4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Fri, 10 Feb 2023 20:55:16 +0100 Subject: [PATCH 242/425] Fix samba-tool dependencies on non-dc builds It has two steps: - Build python3-samba-dc also for non-dc builds - Require python3-samba-dc from common-tools also for non-dc builds --- samba.spec | 56 +++++------------------------------------------------- 1 file changed, 5 insertions(+), 51 deletions(-) diff --git a/samba.spec b/samba.spec index 562f5a2..8a4a574 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.0 -%global baserelease 3 +%global baserelease 4 # This should be rc1 or %%nil %global pre_release rc2 @@ -525,9 +525,9 @@ Requires: libwbclient = %{samba_depver} Requires: python3-%{name} = %{samba_depver} # samba-tool needs tdbbackup Requires: tdb-tools -%if %{with dc} -# samba-tool needs python3-samba-dc on a full build +# samba-tool needs python3-samba-dc also on non-dc build Requires: python3-%{name}-dc = %{samba_depver} +%if %{with dc} # samba-tool needs mdb_copy for domain backup or upgrade provision Requires: lmdb %endif @@ -877,7 +877,6 @@ Requires: %{name}-libs = %{samba_depver} The python3-%{name}-test package contains the Python libraries used by the test suite of Samba. If you want to run full set of Samba tests, you need to install this package. -%if %{with dc} || %{with testsuite} %package -n python3-samba-dc Summary: Samba Python libraries for Samba AD Requires: %{name}-client-libs = %{samba_depver} @@ -887,7 +886,6 @@ Requires: python3-%{name} = %{samba_depver} %description -n python3-samba-dc The python3-%{name}-dc package contains the Python libraries needed by programs to manage Samba AD. -%endif ### PIDL %package pidl @@ -1407,54 +1405,10 @@ touch %{buildroot}%{_libdir}/krb5/plugins/libkrb5/winbind_krb5_locator.so %if %{without dc} && %{without testsuite} for i in \ - %{_libdir}/samba/libdfs-server-ad-samba4.so \ - %{_libdir}/samba/libdsdb-garbage-collect-tombstones-samba4.so \ - %{_libdir}/samba/libscavenge-dns-records-samba4.so \ %{_mandir}/man8/samba.8 \ %{_mandir}/man8/samba_downgrade_db.8 \ %{_mandir}/man8/samba-gpupdate.8 \ %{_unitdir}/samba.service \ - %{python3_sitearch}/samba/dcerpc/dnsserver.*.so \ - %{python3_sitearch}/samba/dnsserver.py \ - %{python3_sitearch}/samba/domain_update.py \ - %{python3_sitearch}/samba/forest_update.py \ - %{python3_sitearch}/samba/kcc/__init__.py \ - %{python3_sitearch}/samba/kcc/debug.py \ - %{python3_sitearch}/samba/kcc/graph.py \ - %{python3_sitearch}/samba/kcc/graph_utils.py \ - %{python3_sitearch}/samba/kcc/kcc_utils.py \ - %{python3_sitearch}/samba/kcc/ldif_import_export.py \ - %{python3_sitearch}/samba/kcc/__pycache__/__init__.*.pyc \ - %{python3_sitearch}/samba/kcc/__pycache__/debug.*.pyc \ - %{python3_sitearch}/samba/kcc/__pycache__/graph.*.pyc \ - %{python3_sitearch}/samba/kcc/__pycache__/graph_utils.*.pyc \ - %{python3_sitearch}/samba/kcc/__pycache__/kcc_utils.*.pyc \ - %{python3_sitearch}/samba/kcc/__pycache__/ldif_import_export.*.pyc \ - %{python3_sitearch}/samba/ms_forest_updates_markdown.py \ - %{python3_sitearch}/samba/ms_schema_markdown.py \ - %{python3_sitearch}/samba/provision/__init__.py \ - %{python3_sitearch}/samba/provision/backend.py \ - %{python3_sitearch}/samba/provision/common.py \ - %{python3_sitearch}/samba/provision/kerberos_implementation.py \ - %{python3_sitearch}/samba/provision/kerberos.py \ - %{python3_sitearch}/samba/provision/sambadns.py \ - %{python3_sitearch}/samba/provision/__pycache__/__init__.*.pyc \ - %{python3_sitearch}/samba/provision/__pycache__/backend.*.pyc \ - %{python3_sitearch}/samba/provision/__pycache__/common.*.pyc \ - %{python3_sitearch}/samba/provision/__pycache__/kerberos_implementation.*.pyc \ - %{python3_sitearch}/samba/provision/__pycache__/kerberos.*.pyc \ - %{python3_sitearch}/samba/provision/__pycache__/sambadns.*.pyc \ - %{python3_sitearch}/samba/__pycache__/domain_update.*.pyc \ - %{python3_sitearch}/samba/__pycache__/forest_update.*.pyc \ - %{python3_sitearch}/samba/__pycache__/ms_forest_updates_markdown.*.pyc \ - %{python3_sitearch}/samba/__pycache__/ms_schema_markdown.*.pyc \ - %{python3_sitearch}/samba/__pycache__/remove_dc.*.pyc \ - %{python3_sitearch}/samba/__pycache__/schema.*.pyc \ - %{python3_sitearch}/samba/__pycache__/uptodateness.*.pyc \ - %{python3_sitearch}/samba/remove_dc.py \ - %{python3_sitearch}/samba/samdb.py \ - %{python3_sitearch}/samba/schema.py \ - %{python3_sitearch}/samba/uptodateness.py \ %{_sbindir}/samba-gpupdate \ ; do rm -f %{buildroot}$i @@ -2805,7 +2759,6 @@ fi %{_libdir}/libsamba-policy.*.so %{_libdir}/pkgconfig/samba-policy.*.pc -%if %{with dc} || %{with testsuite} %files -n python3-%{name}-dc %{python3_sitearch}/samba/samdb.py %{python3_sitearch}/samba/schema.py @@ -2821,7 +2774,9 @@ fi %{python3_sitearch}/samba/__pycache__/uptodateness.*.pyc %{python3_sitearch}/samba/dcerpc/dnsserver.*.so +%if %{with dc} || %{with testsuite} %{python3_sitearch}/samba/dckeytab.*.so +%endif %{python3_sitearch}/samba/domain_update.py %{python3_sitearch}/samba/forest_update.py %{python3_sitearch}/samba/ms_forest_updates_markdown.py @@ -2862,7 +2817,6 @@ fi %{python3_sitearch}/samba/remove_dc.py %{python3_sitearch}/samba/uptodateness.py -%endif %files -n python3-%{name}-test %dir %{python3_sitearch}/samba/tests From 0a8a75e9d8a7c72e8752b18f8e382e538e859307 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Mon, 13 Feb 2023 11:54:42 +0100 Subject: [PATCH 243/425] Create samba-tools package for samba-tool. Avoids installation of many python3 pkgs on a simple file server. --- samba.spec | 29 ++++++++++++++++++++--------- 1 file changed, 20 insertions(+), 9 deletions(-) diff --git a/samba.spec b/samba.spec index 8a4a574..a97807f 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.0 -%global baserelease 4 +%global baserelease 5 # This should be rc1 or %%nil %global pre_release rc2 @@ -511,7 +511,7 @@ SMB/CIFS clients. ### COMMON-TOOLS %package common-tools -Summary: Tools for Samba servers and clients +Summary: Tools for Samba clients Requires: samba-common-libs = %{samba_depver} Requires: samba-client-libs = %{samba_depver} Requires: samba-libs = %{samba_depver} @@ -521,6 +521,14 @@ Requires: libnetapi = %{samba_depver} Requires: libwbclient = %{samba_depver} %endif +Provides: bundled(libreplace) + +%description common-tools +The samba-common-tools package contains tools for SMB/CIFS clients. + +### SAMBA-TOOLS +%package tools +Summary: Tools for Samba servers # samba-tool needs python3-samba Requires: python3-%{name} = %{samba_depver} # samba-tool needs tdbbackup @@ -532,11 +540,9 @@ Requires: python3-%{name}-dc = %{samba_depver} Requires: lmdb %endif -Provides: bundled(libreplace) - -%description common-tools -The samba-common-tools package contains tools for Samba servers and -SMB/CIFS clients. +%description tools +The samba-tools package contains tools for Samba servers +and for GPO management on domain members. ### RPC %package dcerpc @@ -978,6 +984,7 @@ Requires(post): %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires(post): %{name}-libs = %{samba_depver} Requires: %{name}-winbind-modules = %{samba_depver} +Recommends: %{name}-tools = %{samba_depver} %if %{with libwbclient} Requires(post): libwbclient = %{samba_depver} @@ -2023,11 +2030,11 @@ fi %{_libdir}/samba/pdb/smbpasswd.so %{_libdir}/samba/pdb/tdbsam.so +### COMMON-TOOLS %files common-tools %{_bindir}/net %{_bindir}/pdbedit %{_bindir}/profiles -%{_bindir}/samba-tool %{_bindir}/smbcontrol %{_bindir}/smbpasswd %{_bindir}/testparm @@ -2036,9 +2043,13 @@ fi %{_mandir}/man1/testparm.1* %{_mandir}/man8/net.8* %{_mandir}/man8/pdbedit.8* -%{_mandir}/man8/samba-tool.8* %{_mandir}/man8/smbpasswd.8* +### TOOLS +%files tools +%{_bindir}/samba-tool +%{_mandir}/man8/samba-tool.8* + ### RPC %files dcerpc %dir %{_libexecdir}/samba From 4b6c2a6e524a3508bc58fd1f76c4f4016a87f9c4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Mon, 13 Feb 2023 16:57:39 +0100 Subject: [PATCH 244/425] Add changelog entry --- samba.spec | 3 +++ 1 file changed, 3 insertions(+) diff --git a/samba.spec b/samba.spec index a97807f..db13cda 100644 --- a/samba.spec +++ b/samba.spec @@ -4333,6 +4333,9 @@ fi %endif %changelog +* Mon Feb 13 2023 Pavel Filipenský - 4.18.0rc2-5 +- Create package samba-tools, move there samba-tool binary + * Thu Feb 02 2023 Guenther Deschner - 4.18.0rc2-3 - resolves: #2166416 - Update to version 4.18.0rc2 From b4642ddce5df19bfdc2352b83975d2db3902481f Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 16 Feb 2023 09:11:52 +0100 Subject: [PATCH 245/425] Fix samba-tool dependencies --- samba.spec | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index db13cda..43cf5f8 100644 --- a/samba.spec +++ b/samba.spec @@ -531,13 +531,12 @@ The samba-common-tools package contains tools for SMB/CIFS clients. Summary: Tools for Samba servers # samba-tool needs python3-samba Requires: python3-%{name} = %{samba_depver} -# samba-tool needs tdbbackup -Requires: tdb-tools # samba-tool needs python3-samba-dc also on non-dc build Requires: python3-%{name}-dc = %{samba_depver} %if %{with dc} -# samba-tool needs mdb_copy for domain backup or upgrade provision +# samba-tool needs mdb_copy and tdbackup for domain backup or upgrade provision Requires: lmdb +Requires: tdb-tools %endif %description tools From 479c5d099f092a05560a2617e85cebe3a8e45224 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 16 Feb 2023 09:13:28 +0100 Subject: [PATCH 246/425] Add missing Requires for samba-tool on samba-dc --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index 43cf5f8..ed73df4 100644 --- a/samba.spec +++ b/samba.spec @@ -565,6 +565,7 @@ Requires: %{name} = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-common-tools = %{samba_depver} +Requires: %{name}-tools = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-dc-provision = %{samba_depver} Requires: %{name}-dc-libs = %{samba_depver} From 90edcb757a1f56653c2fa7028d3ea1b19caff778 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 15 Feb 2023 16:47:35 +0100 Subject: [PATCH 247/425] Update to version 4.18.0rc3 resolves: #2166416 Guenther --- .gitignore | 2 ++ samba.spec | 11 +++++++---- sources | 4 ++-- 3 files changed, 11 insertions(+), 6 deletions(-) diff --git a/.gitignore b/.gitignore index 1b867fd..f55b1d8 100644 --- a/.gitignore +++ b/.gitignore @@ -321,3 +321,5 @@ samba-3.6.0pre1.tar.gz /samba-4.18.0rc1.tar.asc /samba-4.18.0rc2.tar.xz /samba-4.18.0rc2.tar.asc +/samba-4.18.0rc3.tar.xz +/samba-4.18.0rc3.tar.asc diff --git a/samba.spec b/samba.spec index ed73df4..acc7c4a 100644 --- a/samba.spec +++ b/samba.spec @@ -135,9 +135,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.0 -%global baserelease 5 +%global baserelease 6 # This should be rc1 or %%nil -%global pre_release rc2 +%global pre_release rc3 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -170,8 +170,8 @@ %global talloc_version 2.4.0 %global tdb_version 1.4.8 -%global tevent_version 0.14.0 -%global ldb_version 2.7.0 +%global tevent_version 0.14.1 +%global ldb_version 2.7.1 %global required_mit_krb5 1.20.1 @@ -4333,6 +4333,9 @@ fi %endif %changelog +* Wed Feb 15 2023 Guenther Deschner - 4.18.0rc3-6 +- resolves: #2166416 - Update to version 4.18.0rc3 + * Mon Feb 13 2023 Pavel Filipenský - 4.18.0rc2-5 - Create package samba-tools, move there samba-tool binary diff --git a/sources b/sources index 760bff2..bc6a0db 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.18.0rc2.tar.xz) = 1467ee97c5861e7306d2bf96c0c600404212d9b241cc28e5fb649f8297bdb3bb86a774cb78ccfc82a70f7b715eff7eb0de9dc3563ba0300c6a069d9609fbdef4 -SHA512 (samba-4.18.0rc2.tar.asc) = 557eec6485669b172b16fd5032750d8cfa8058d1615316d7e539924d561d7d7e7d0990bcf62f96d0ec467c8fc5e59c0bb8ea1a963396055b6af8659e166073cd +SHA512 (samba-4.18.0rc3.tar.xz) = ebcb183e4e823a6f4c7d6d483d4efd1e6da8cf5bce1d685bba7c80c7d2392ed909ab8fc14dd7f74aa10c0d1ad1e96830413bb001b4c8add8ee70f073175aab81 +SHA512 (samba-4.18.0rc3.tar.asc) = 178959b7e361655037534fd3d11648c7b5636e65547d85d2b8090a1e79a7580ac61ff35553aff1054b6031f49ad48096538a49e26f714d3ea10c493303910b91 From 101d3c387f6932a566ac3442820db085eb6c79e4 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 21 Feb 2023 14:26:16 +0100 Subject: [PATCH 248/425] Remove obsolete patch --- samba-4.17-fix-changeuserpassword4.patch | 540 ----------------------- 1 file changed, 540 deletions(-) delete mode 100644 samba-4.17-fix-changeuserpassword4.patch diff --git a/samba-4.17-fix-changeuserpassword4.patch b/samba-4.17-fix-changeuserpassword4.patch deleted file mode 100644 index 7f1b482..0000000 --- a/samba-4.17-fix-changeuserpassword4.patch +++ /dev/null @@ -1,540 +0,0 @@ -From a3e3d05f35d6082ea48450060b39084e3d0e4056 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Mon, 10 Oct 2022 15:15:20 +0200 -Subject: [PATCH 1/5] s3:librpc: Improve GSE error message - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15206 - -Signed-off-by: Andreas Schneider -Reviewed-by: Noel Power ---- - source3/librpc/crypto/gse.c | 21 +++++++++++++++++++-- - 1 file changed, 19 insertions(+), 2 deletions(-) - -diff --git a/source3/librpc/crypto/gse.c b/source3/librpc/crypto/gse.c -index c50a8a036df..c2cac7abf82 100644 ---- a/source3/librpc/crypto/gse.c -+++ b/source3/librpc/crypto/gse.c -@@ -546,11 +546,28 @@ init_sec_context_done: - goto done; - case GSS_S_FAILURE: - switch (gss_min) { -- case (OM_uint32)KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN: -- DBG_NOTICE("Server principal not found\n"); -+ case (OM_uint32)KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN: { -+ gss_buffer_desc name_token = { -+ .length = 0, -+ }; -+ -+ gss_maj = gss_display_name(&gss_min, -+ gse_ctx->server_name, -+ &name_token, -+ NULL); -+ if (gss_maj == GSS_S_COMPLETE) { -+ DBG_NOTICE("Server principal %.*s not found\n", -+ (int)name_token.length, -+ (char *)name_token.value); -+ gss_release_buffer(&gss_maj, &name_token); -+ } else { -+ DBG_NOTICE("Server principal not found\n"); -+ } -+ - /* Make SPNEGO ignore us, we can't go any further here */ - status = NT_STATUS_INVALID_PARAMETER; - goto done; -+ } - case (OM_uint32)KRB5KRB_AP_ERR_TKT_EXPIRED: - DBG_NOTICE("Ticket expired\n"); - /* Make SPNEGO ignore us, we can't go any further here */ --- -2.37.3 - - -From d2e2e9acd717e45806f1b19378e09f39c8fe3da8 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Fri, 7 Oct 2022 14:35:15 +0200 -Subject: [PATCH 2/5] s3:rpcclient: Pass salt down to - init_samr_CryptPasswordAES() - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15206 - -Signed-off-by: Andreas Schneider -Reviewed-by: Noel Power ---- - source3/rpc_client/init_samr.c | 15 ++++----------- - source3/rpc_client/init_samr.h | 1 + - source3/rpcclient/cmd_samr.c | 8 ++++++++ - source4/libnet/libnet_passwd.c | 13 +++++++------ - source4/torture/rpc/samr.c | 27 +++++++++++++++++++++++++++ - 5 files changed, 47 insertions(+), 17 deletions(-) - -diff --git a/source3/rpc_client/init_samr.c b/source3/rpc_client/init_samr.c -index 68f42b602b3..52fa2f90d6e 100644 ---- a/source3/rpc_client/init_samr.c -+++ b/source3/rpc_client/init_samr.c -@@ -79,6 +79,7 @@ NTSTATUS init_samr_CryptPassword(const char *pwd, - - NTSTATUS init_samr_CryptPasswordAES(TALLOC_CTX *mem_ctx, - const char *password, -+ DATA_BLOB *salt, - DATA_BLOB *session_key, - struct samr_EncryptedPasswordAES *ppwd_buf) - { -@@ -87,12 +88,6 @@ NTSTATUS init_samr_CryptPasswordAES(TALLOC_CTX *mem_ctx, - .data = pw_data, - .length = sizeof(pw_data), - }; -- size_t iv_size = gnutls_cipher_get_iv_size(GNUTLS_CIPHER_AES_256_CBC); -- uint8_t iv_data[iv_size]; -- DATA_BLOB iv = { -- .data = iv_data, -- .length = iv_size, -- }; - DATA_BLOB ciphertext = data_blob_null; - NTSTATUS status = NT_STATUS_UNSUCCESSFUL; - bool ok; -@@ -101,8 +96,6 @@ NTSTATUS init_samr_CryptPasswordAES(TALLOC_CTX *mem_ctx, - return NT_STATUS_INVALID_PARAMETER; - } - -- generate_nonce_buffer(iv.data, iv.length); -- - ok = encode_pwd_buffer514_from_str(pw_data, password, STR_UNICODE); - if (!ok) { - return NT_STATUS_INTERNAL_ERROR; -@@ -114,7 +107,7 @@ NTSTATUS init_samr_CryptPasswordAES(TALLOC_CTX *mem_ctx, - session_key, - &samr_aes256_enc_key_salt, - &samr_aes256_mac_key_salt, -- &iv, -+ salt, - &ciphertext, - ppwd_buf->auth_data); - BURN_DATA(pw_data); -@@ -126,8 +119,8 @@ NTSTATUS init_samr_CryptPasswordAES(TALLOC_CTX *mem_ctx, - ppwd_buf->cipher = ciphertext.data; - ppwd_buf->PBKDF2Iterations = 0; - -- SMB_ASSERT(iv.length == sizeof(ppwd_buf->salt)); -- memcpy(ppwd_buf->salt, iv.data, iv.length); -+ SMB_ASSERT(salt->length == sizeof(ppwd_buf->salt)); -+ memcpy(ppwd_buf->salt, salt->data, salt->length); - - return NT_STATUS_OK; - } -diff --git a/source3/rpc_client/init_samr.h b/source3/rpc_client/init_samr.h -index 940534e7168..71b4c0e573d 100644 ---- a/source3/rpc_client/init_samr.h -+++ b/source3/rpc_client/init_samr.h -@@ -47,6 +47,7 @@ NTSTATUS init_samr_CryptPassword(const char *pwd, - */ - NTSTATUS init_samr_CryptPasswordAES(TALLOC_CTX *mem_ctx, - const char *password, -+ DATA_BLOB *salt, - DATA_BLOB *session_key, - struct samr_EncryptedPasswordAES *ppwd_buf); - -diff --git a/source3/rpcclient/cmd_samr.c b/source3/rpcclient/cmd_samr.c -index 9ccd2f78a8d..8106ca90cf2 100644 ---- a/source3/rpcclient/cmd_samr.c -+++ b/source3/rpcclient/cmd_samr.c -@@ -3172,6 +3172,11 @@ static NTSTATUS cmd_samr_setuserinfo_int(struct rpc_pipe_client *cli, - uint8_t nt_hash[16]; - uint8_t lm_hash[16]; - DATA_BLOB session_key; -+ uint8_t salt_data[16]; -+ DATA_BLOB salt = { -+ .data = salt_data, -+ .length = sizeof(salt_data), -+ }; - uint8_t password_expired = 0; - struct dcerpc_binding_handle *b = cli->binding_handle; - TALLOC_CTX *frame = NULL; -@@ -3198,6 +3203,8 @@ static NTSTATUS cmd_samr_setuserinfo_int(struct rpc_pipe_client *cli, - goto done; - } - -+ generate_nonce_buffer(salt.data, salt.length); -+ - switch(level) { - case 18: - case 21: -@@ -3220,6 +3227,7 @@ static NTSTATUS cmd_samr_setuserinfo_int(struct rpc_pipe_client *cli, - case 31: - status = init_samr_CryptPasswordAES(frame, - param, -+ &salt, - &session_key, - &pwd_buf_aes); - if (!NT_STATUS_IS_OK(status)) { -diff --git a/source4/libnet/libnet_passwd.c b/source4/libnet/libnet_passwd.c -index 4f662110e55..a1672104824 100644 ---- a/source4/libnet/libnet_passwd.c -+++ b/source4/libnet/libnet_passwd.c -@@ -57,13 +57,13 @@ static NTSTATUS libnet_ChangePassword_samr_aes(TALLOC_CTX *mem_ctx, - struct samr_EncryptedPasswordAES pwd_buf = { - .cipher_len = 0 - }; -- DATA_BLOB iv = { -+ DATA_BLOB salt = { - .data = pwd_buf.salt, - .length = sizeof(pwd_buf.salt), - }; -- gnutls_datum_t iv_datum = { -- .data = iv.data, -- .size = iv.length, -+ gnutls_datum_t salt_datum = { -+ .data = pwd_buf.salt, -+ .size = sizeof(pwd_buf.salt), - }; - uint64_t pbkdf2_iterations = generate_random_u64_range(5000, 1000000); - NTSTATUS status; -@@ -71,11 +71,11 @@ static NTSTATUS libnet_ChangePassword_samr_aes(TALLOC_CTX *mem_ctx, - - E_md4hash(old_password, old_nt_key_data); - -- generate_nonce_buffer(iv.data, iv.length); -+ generate_nonce_buffer(salt.data, salt.length); - - rc = gnutls_pbkdf2(GNUTLS_MAC_SHA512, - &old_nt_key, -- &iv_datum, -+ &salt_datum, - pbkdf2_iterations, - cek.data, - cek.length); -@@ -86,6 +86,7 @@ static NTSTATUS libnet_ChangePassword_samr_aes(TALLOC_CTX *mem_ctx, - - status = init_samr_CryptPasswordAES(mem_ctx, - new_password, -+ &salt, - &cek, - &pwd_buf); - data_blob_clear(&cek); -diff --git a/source4/torture/rpc/samr.c b/source4/torture/rpc/samr.c -index de354659067..0b1880efa18 100644 ---- a/source4/torture/rpc/samr.c -+++ b/source4/torture/rpc/samr.c -@@ -783,6 +783,11 @@ static bool test_SetUserPass_32(struct dcerpc_pipe *p, struct torture_context *t - struct samr_SetUserInfo s; - union samr_UserInfo u; - DATA_BLOB session_key; -+ uint8_t salt_data[16]; -+ DATA_BLOB salt = { -+ .data = salt_data, -+ .length = sizeof(salt_data), -+ }; - char *newpass = NULL; - struct dcerpc_binding_handle *b = p->binding_handle; - struct samr_GetUserPwInfo pwp; -@@ -818,8 +823,11 @@ static bool test_SetUserPass_32(struct dcerpc_pipe *p, struct torture_context *t - return false; - } - -+ generate_nonce_buffer(salt.data, salt.length); -+ - status = init_samr_CryptPasswordAES(tctx, - newpass, -+ &salt, - &session_key, - &u.info32.password); - torture_assert_ntstatus_ok(tctx, -@@ -852,6 +860,7 @@ static bool test_SetUserPass_32(struct dcerpc_pipe *p, struct torture_context *t - - status = init_samr_CryptPasswordAES(tctx, - newpass, -+ &salt, - &session_key, - &u.info32.password); - torture_assert_ntstatus_ok(tctx, -@@ -896,6 +905,11 @@ static bool test_SetUserPass_31(struct dcerpc_pipe *p, struct torture_context *t - union samr_UserInfo u; - bool ret = true; - DATA_BLOB session_key; -+ uint8_t salt_data[16]; -+ DATA_BLOB salt = { -+ .data = salt_data, -+ .length = sizeof(salt_data), -+ }; - char *newpass; - struct dcerpc_binding_handle *b = p->binding_handle; - struct samr_GetUserPwInfo pwp; -@@ -931,8 +945,11 @@ static bool test_SetUserPass_31(struct dcerpc_pipe *p, struct torture_context *t - return false; - } - -+ generate_nonce_buffer(salt.data, salt.length); -+ - status = init_samr_CryptPasswordAES(tctx, - newpass, -+ &salt, - &session_key, - &u.info31.password); - torture_assert_ntstatus_ok(tctx, -@@ -959,6 +976,7 @@ static bool test_SetUserPass_31(struct dcerpc_pipe *p, struct torture_context *t - - status = init_samr_CryptPasswordAES(tctx, - newpass, -+ &salt, - &session_key, - &u.info31.password); - torture_assert_ntstatus_ok(tctx, -@@ -1381,6 +1399,11 @@ static bool test_SetUserPass_level_ex(struct dcerpc_pipe *p, - union samr_UserInfo u; - bool ret = true; - DATA_BLOB session_key; -+ uint8_t salt_data[16]; -+ DATA_BLOB salt = { -+ .data = salt_data, -+ .length = sizeof(salt_data), -+ }; - char *newpass; - struct dcerpc_binding_handle *b = p->binding_handle; - struct samr_GetUserPwInfo pwp; -@@ -1490,6 +1513,8 @@ static bool test_SetUserPass_level_ex(struct dcerpc_pipe *p, - return false; - } - -+ generate_nonce_buffer(salt.data, salt.length); -+ - switch (level) { - case 18: - { -@@ -1561,6 +1586,7 @@ static bool test_SetUserPass_level_ex(struct dcerpc_pipe *p, - case 31: - status = init_samr_CryptPasswordAES(tctx, - newpass, -+ &salt, - &session_key, - &u.info31.password); - -@@ -1568,6 +1594,7 @@ static bool test_SetUserPass_level_ex(struct dcerpc_pipe *p, - case 32: - status = init_samr_CryptPasswordAES(tctx, - newpass, -+ &salt, - &session_key, - &u.info32.password); - --- -2.37.3 - - -From 1d630363c9b2497266e418aad89c55d5b51a63ad Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Mon, 17 Oct 2022 09:02:28 +0200 -Subject: [PATCH 3/5] s4:libnet: If we successfully changed the password we are - done - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15206 - -Signed-off-by: Andreas Schneider -Reviewed-by: Noel Power ---- - source4/libnet/libnet_passwd.c | 32 ++++++++++++++++++-------------- - 1 file changed, 18 insertions(+), 14 deletions(-) - -diff --git a/source4/libnet/libnet_passwd.c b/source4/libnet/libnet_passwd.c -index a1672104824..b17614bcd97 100644 ---- a/source4/libnet/libnet_passwd.c -+++ b/source4/libnet/libnet_passwd.c -@@ -101,7 +101,7 @@ static NTSTATUS libnet_ChangePassword_samr_aes(TALLOC_CTX *mem_ctx, - r.in.password = &pwd_buf; - - status = dcerpc_samr_ChangePasswordUser4_r(h, mem_ctx, &r); -- if (NT_STATUS_IS_OK(status)) { -+ if (!NT_STATUS_IS_OK(status)) { - goto done; - } - if (!NT_STATUS_IS_OK(r.out.result)) { -@@ -112,6 +112,7 @@ static NTSTATUS libnet_ChangePassword_samr_aes(TALLOC_CTX *mem_ctx, - account->string, - nt_errstr(status)); - status = r.out.result; -+ goto done; - } - - done: -@@ -424,20 +425,23 @@ static NTSTATUS libnet_ChangePassword_samr(struct libnet_context *ctx, TALLOC_CT - r->samr.in.oldpassword, - r->samr.in.newpassword, - &(r->samr.out.error_string)); -- if (!NT_STATUS_IS_OK(status)) { -- if (NT_STATUS_EQUAL(status, -- NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE) || -- NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED) || -- NT_STATUS_EQUAL(status, NT_STATUS_NOT_IMPLEMENTED)) { -- /* -- * Don't fallback to RC4 based SAMR if weak crypto is not -- * allowed. -- */ -- if (lpcfg_weak_crypto(ctx->lp_ctx) == -- SAMBA_WEAK_CRYPTO_DISALLOWED) { -- goto disconnect; -- } -+ if (NT_STATUS_IS_OK(status)) { -+ goto disconnect; -+ } else if (NT_STATUS_EQUAL(status, -+ NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE) || -+ NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED) || -+ NT_STATUS_EQUAL(status, NT_STATUS_NOT_IMPLEMENTED)) { -+ /* -+ * Don't fallback to RC4 based SAMR if weak crypto is not -+ * allowed. -+ */ -+ if (lpcfg_weak_crypto(ctx->lp_ctx) == -+ SAMBA_WEAK_CRYPTO_DISALLOWED) { -+ goto disconnect; - } -+ } else { -+ /* libnet_ChangePassword_samr_aes is implemented and failed */ -+ goto disconnect; - } - - status = libnet_ChangePassword_samr_rc4( --- -2.37.3 - - -From 9a4a169ab34641afb87e7f81708c9a72b321879e Mon Sep 17 00:00:00 2001 -From: Noel Power -Date: Fri, 21 Oct 2022 17:40:36 +0100 -Subject: [PATCH 4/5] s4/rpc_server/sambr: don't mutate the return of - samdb_set_password_aes - -prior to this commit return of samdb_set_password_aes was set to -NT_STATUS_WRONG_PASSWORD on failure. Useful status that should be -returned such as NT_STATUS_PASSWORD_RESTRICTION are swallowed here -otherwise (and in this case can be partially responsible for failures -in test samba.tests.auth_log_pass_change (with later gnutls) - -Signed-off-by: Noel Power -Reviewed-by: Andreas Schneider ---- - source4/rpc_server/samr/samr_password.c | 1 - - 1 file changed, 1 deletion(-) - -diff --git a/source4/rpc_server/samr/samr_password.c b/source4/rpc_server/samr/samr_password.c -index 4691f9a47a9..b581be6361c 100644 ---- a/source4/rpc_server/samr/samr_password.c -+++ b/source4/rpc_server/samr/samr_password.c -@@ -250,7 +250,6 @@ NTSTATUS dcesrv_samr_ChangePasswordUser4(struct dcesrv_call_state *dce_call, - - if (!NT_STATUS_IS_OK(status)) { - ldb_transaction_cancel(sam_ctx); -- status = NT_STATUS_WRONG_PASSWORD; - goto done; - } - --- -2.37.3 - - -From b8b36ecba0f22dbc203c12627ebd629c2437c635 Mon Sep 17 00:00:00 2001 -From: Noel Power -Date: Fri, 21 Oct 2022 17:14:44 +0100 -Subject: [PATCH 5/5] python/samba/tests: fix samba.tests.auth_log_pass_change - for later gnutls - -later gnutls that support GNUTLS_PBKDF2 currently fail, -we need to conditionally switch test data to reflect use of -'samr_ChangePasswordUser3' or 'samr_ChangePasswordUser4' -depending on whether GNUTLS_PBKDF2 is supported or not - -Signed-off-by: Noel Power -Reviewed-by: Andreas Schneider ---- - python/samba/tests/auth_log_pass_change.py | 20 ++++++++++++++++---- - source4/selftest/tests.py | 9 ++++++--- - 2 files changed, 22 insertions(+), 7 deletions(-) - -diff --git a/python/samba/tests/auth_log_pass_change.py b/python/samba/tests/auth_log_pass_change.py -index 972af2158dd..1ca46c586b3 100644 ---- a/python/samba/tests/auth_log_pass_change.py -+++ b/python/samba/tests/auth_log_pass_change.py -@@ -72,6 +72,18 @@ class AuthLogPassChangeTests(samba.tests.auth_log_base.AuthLogTestBase): - - # discard any auth log messages for the password setup - self.discardMessages() -+ gnutls_pbkdf2_support = samba.tests.env_get_var_value( -+ 'GNUTLS_PBKDF2_SUPPORT', -+ allow_missing=True) -+ if gnutls_pbkdf2_support is None: -+ gnutls_pbkdf2_support = '0' -+ self.gnutls_pbkdf2_support = bool(int(gnutls_pbkdf2_support)) -+ -+ def _authDescription(self): -+ if self.gnutls_pbkdf2_support: -+ return "samr_ChangePasswordUser4" -+ else: -+ return "samr_ChangePasswordUser3" - - def tearDown(self): - super(AuthLogPassChangeTests, self).tearDown() -@@ -83,7 +95,7 @@ class AuthLogPassChangeTests(samba.tests.auth_log_base.AuthLogTestBase): - (msg["Authentication"]["serviceDescription"] == - "SAMR Password Change") and - (msg["Authentication"]["authDescription"] == -- "samr_ChangePasswordUser3") and -+ self._authDescription()) and - (msg["Authentication"]["eventId"] == - EVT_ID_SUCCESSFUL_LOGON) and - (msg["Authentication"]["logonType"] == -@@ -109,7 +121,7 @@ class AuthLogPassChangeTests(samba.tests.auth_log_base.AuthLogTestBase): - (msg["Authentication"]["serviceDescription"] == - "SAMR Password Change") and - (msg["Authentication"]["authDescription"] == -- "samr_ChangePasswordUser3") and -+ self._authDescription()) and - (msg["Authentication"]["eventId"] == - EVT_ID_UNSUCCESSFUL_LOGON) and - (msg["Authentication"]["logonType"] == -@@ -141,7 +153,7 @@ class AuthLogPassChangeTests(samba.tests.auth_log_base.AuthLogTestBase): - (msg["Authentication"]["serviceDescription"] == - "SAMR Password Change") and - (msg["Authentication"]["authDescription"] == -- "samr_ChangePasswordUser3") and -+ self._authDescription()) and - (msg["Authentication"]["eventId"] == - EVT_ID_UNSUCCESSFUL_LOGON) and - (msg["Authentication"]["logonType"] == -@@ -174,7 +186,7 @@ class AuthLogPassChangeTests(samba.tests.auth_log_base.AuthLogTestBase): - (msg["Authentication"]["serviceDescription"] == - "SAMR Password Change") and - (msg["Authentication"]["authDescription"] == -- "samr_ChangePasswordUser3") and -+ self._authDescription()) and - (msg["Authentication"]["eventId"] == - EVT_ID_UNSUCCESSFUL_LOGON) and - (msg["Authentication"]["logonType"] == -diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py -index a803d4704ea..c92105586a7 100755 ---- a/source4/selftest/tests.py -+++ b/source4/selftest/tests.py -@@ -1094,9 +1094,11 @@ if have_heimdal_support: - environ={'CLIENT_IP': '10.53.57.11', - 'SOCKET_WRAPPER_DEFAULT_IFACE': 11}) - planoldpythontestsuite("ad_dc_smb1", "samba.tests.auth_log_pass_change", -- extra_args=['-U"$USERNAME%$PASSWORD"']) -+ extra_args=['-U"$USERNAME%$PASSWORD"'], -+ environ={'GNUTLS_PBKDF2_SUPPORT': gnutls_pbkdf2_support}) - planoldpythontestsuite("ad_dc_ntvfs", "samba.tests.auth_log_pass_change", -- extra_args=['-U"$USERNAME%$PASSWORD"']) -+ extra_args=['-U"$USERNAME%$PASSWORD"'], -+ environ={'GNUTLS_PBKDF2_SUPPORT': gnutls_pbkdf2_support}) - - # these tests use a NCA local RPC connection, so always run on the - # :local testenv, and so don't need to fake a client connection -@@ -1113,7 +1115,8 @@ if have_heimdal_support: - "samba.tests.auth_log_winbind", - extra_args=['-U"$DC_USERNAME%$DC_PASSWORD"']) - planoldpythontestsuite("ad_dc", "samba.tests.audit_log_pass_change", -- extra_args=['-U"$USERNAME%$PASSWORD"']) -+ extra_args=['-U"$USERNAME%$PASSWORD"'], -+ environ={'GNUTLS_PBKDF2_SUPPORT': gnutls_pbkdf2_support}) - planoldpythontestsuite("ad_dc", "samba.tests.audit_log_dsdb", - extra_args=['-U"$USERNAME%$PASSWORD"']) - planoldpythontestsuite("ad_dc", "samba.tests.group_audit", --- -2.37.3 - From 73705701f1ebfd5363748b7c60098080fb0fffa7 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 23 Feb 2023 15:15:37 +0100 Subject: [PATCH 249/425] Update License to SPDX expressions https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_1 --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index acc7c4a..dd624f4 100644 --- a/samba.spec +++ b/samba.spec @@ -210,7 +210,7 @@ Epoch: 0 %global samba_depver %{epoch}:%{version}-%{release} Summary: Server and Client software to interoperate with Windows machines -License: GPLv3+ and LGPLv3+ +License: GPL-3.0-or-later AND LGPL-3.0-or-later URL: https://www.samba.org # This is a xz recompressed file of https://ftp.samba.org/pub/samba/samba-%%{version}%%{pre_release}.tar.gz From 1348920d6f81e65d43f76f284c6f703825ddf131 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Thu, 23 Feb 2023 15:18:11 +0100 Subject: [PATCH 250/425] SPDX migration --- samba.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index dd624f4..bb6ffa4 100644 --- a/samba.spec +++ b/samba.spec @@ -1075,7 +1075,7 @@ necessary to communicate to the Winbind Daemon %if %{with winexe} %package winexe Summary: Samba Winexe Windows Binary -License: GPLv3 +License: GPL-3.0-only Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} @@ -4333,6 +4333,9 @@ fi %endif %changelog +* Thu Feb 23 2023 Pavel Filipenský - 4.18.0-0.6.rc3 +- SPDX migration + * Wed Feb 15 2023 Guenther Deschner - 4.18.0rc3-6 - resolves: #2166416 - Update to version 4.18.0rc3 From 435e4d9b7b1d59ce130eb826cbc8519b2f228042 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 28 Feb 2023 07:55:19 +0100 Subject: [PATCH 251/425] Add missing Requires for glibc-gconv-extra resolves: #2173619 --- samba.spec | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/samba.spec b/samba.spec index bb6ffa4..8264d44 100644 --- a/samba.spec +++ b/samba.spec @@ -270,6 +270,7 @@ Provides: bundled(libreplace) BuildRequires: make BuildRequires: gcc +BuildRequires: glibc-gconv-extra BuildRequires: avahi-devel BuildRequires: bison BuildRequires: cups-devel @@ -448,6 +449,8 @@ Requires: %{name}-common-libs = %{samba_depver} Requires: libwbclient = %{samba_depver} %endif Requires: krb5-libs >= %{required_mit_krb5} +# This is needed for charset conversion +Requires: glibc-gconv-extra %description client-libs The samba-client-libs package contains internal libraries needed by the @@ -4333,6 +4336,9 @@ fi %endif %changelog +* Tue Feb 28 2023 Andreas Schneider - 4.18.0-0.7.rc3 +- resolves: #2173619 - Add missing Requires for glibc-gconv-extra + * Thu Feb 23 2023 Pavel Filipenský - 4.18.0-0.6.rc3 - SPDX migration From b42ebb0a8458bd7d267f757cef8cc4a666b0b7c8 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 28 Feb 2023 07:59:18 +0100 Subject: [PATCH 252/425] Bump baserelease --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 8264d44..3ac9b33 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.0 -%global baserelease 6 +%global baserelease 7 # This should be rc1 or %%nil %global pre_release rc3 From c7734163fa9bc728aa50395c1a62294041ddc61e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 1 Mar 2023 15:38:16 +0100 Subject: [PATCH 253/425] Update to version 4.18.0rc4 resolves: #2174415 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index f55b1d8..dcf49fc 100644 --- a/.gitignore +++ b/.gitignore @@ -323,3 +323,5 @@ samba-3.6.0pre1.tar.gz /samba-4.18.0rc2.tar.asc /samba-4.18.0rc3.tar.xz /samba-4.18.0rc3.tar.asc +/samba-4.18.0rc4.tar.xz +/samba-4.18.0rc4.tar.asc diff --git a/samba.spec b/samba.spec index 3ac9b33..4873a25 100644 --- a/samba.spec +++ b/samba.spec @@ -135,9 +135,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.0 -%global baserelease 7 +%global baserelease 8 # This should be rc1 or %%nil -%global pre_release rc3 +%global pre_release rc4 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4336,6 +4336,9 @@ fi %endif %changelog +* Wed Mar 01 2023 Guenther Deschner - 4.18.0rc4-8 +- resolves: #2174415 - Update to version 4.18.0rc4 + * Tue Feb 28 2023 Andreas Schneider - 4.18.0-0.7.rc3 - resolves: #2173619 - Add missing Requires for glibc-gconv-extra diff --git a/sources b/sources index bc6a0db..f683831 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.18.0rc3.tar.xz) = ebcb183e4e823a6f4c7d6d483d4efd1e6da8cf5bce1d685bba7c80c7d2392ed909ab8fc14dd7f74aa10c0d1ad1e96830413bb001b4c8add8ee70f073175aab81 -SHA512 (samba-4.18.0rc3.tar.asc) = 178959b7e361655037534fd3d11648c7b5636e65547d85d2b8090a1e79a7580ac61ff35553aff1054b6031f49ad48096538a49e26f714d3ea10c493303910b91 +SHA512 (samba-4.18.0rc4.tar.xz) = f0231ffaecc4264766d5bd8569fc7ca7c8821f31999931b4d94d4228955221567a14cf9df8cda9a2bf833f375b0a9b414ec3a804e2ca9f5088ef60e982f775fa +SHA512 (samba-4.18.0rc4.tar.asc) = 343b61f33381d026a724faf0f06110b5fa173f626db2e5263ad991ca97bcc1314aa2124694dda4e7f1aca31b8f7bcb3fd20222b42aad20b51a3579cdba194303 From daa78093426a2548212b154155ccdab362015be5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 8 Mar 2023 14:20:08 +0100 Subject: [PATCH 254/425] Update to version 4.18.0 resolves: #2176469 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index dcf49fc..550a6cc 100644 --- a/.gitignore +++ b/.gitignore @@ -325,3 +325,5 @@ samba-3.6.0pre1.tar.gz /samba-4.18.0rc3.tar.asc /samba-4.18.0rc4.tar.xz /samba-4.18.0rc4.tar.asc +/samba-4.18.0.tar.xz +/samba-4.18.0.tar.asc diff --git a/samba.spec b/samba.spec index 4873a25..147a02c 100644 --- a/samba.spec +++ b/samba.spec @@ -135,9 +135,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.0 -%global baserelease 8 +%global baserelease 9 # This should be rc1 or %%nil -%global pre_release rc4 +%global pre_release %nil %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4336,6 +4336,9 @@ fi %endif %changelog +* Wed Mar 08 2023 Guenther Deschner - 4.18.0-9 +- resolves: #2176469 - Update to version 4.18.0 + * Wed Mar 01 2023 Guenther Deschner - 4.18.0rc4-8 - resolves: #2174415 - Update to version 4.18.0rc4 diff --git a/sources b/sources index f683831..588b398 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.18.0rc4.tar.xz) = f0231ffaecc4264766d5bd8569fc7ca7c8821f31999931b4d94d4228955221567a14cf9df8cda9a2bf833f375b0a9b414ec3a804e2ca9f5088ef60e982f775fa -SHA512 (samba-4.18.0rc4.tar.asc) = 343b61f33381d026a724faf0f06110b5fa173f626db2e5263ad991ca97bcc1314aa2124694dda4e7f1aca31b8f7bcb3fd20222b42aad20b51a3579cdba194303 +SHA512 (samba-4.18.0.tar.xz) = bb4947335bd1fc501c29a62b413a9c3a1bbaf162d6965a4b2eeb65bf74363c300234b5c73d09e826e596989cd8afdee41b2470647bfdf8f7c42b998e7d367a64 +SHA512 (samba-4.18.0.tar.asc) = 1a478fd0e863e6b6874b703e04f449872b4d581e4c32c853ee4111bc94d1addcf3047331a288e8115a20d9ea22d8e04aade918e8623bd3d08d5122baf4ef0f3d From 32b29ac6e94d78c8fa427730e33d72c49a14ef9c Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 10 Mar 2023 10:32:14 +0100 Subject: [PATCH 255/425] Add missing Requires for python3-gpg to samba-tools --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index 147a02c..2fe7b27 100644 --- a/samba.spec +++ b/samba.spec @@ -540,6 +540,7 @@ Requires: python3-%{name}-dc = %{samba_depver} # samba-tool needs mdb_copy and tdbackup for domain backup or upgrade provision Requires: lmdb Requires: tdb-tools +Requires: python3-gpg %endif %description tools From 7ffc94f1bab091dfe0afa3dc20ff5e566c540ae6 Mon Sep 17 00:00:00 2001 From: Kalev Lember Date: Fri, 17 Mar 2023 21:07:11 +0100 Subject: [PATCH 256/425] Move libstable-sort-samba4.so to samba-client-libs subpackage libndr-samba-samba4.so that's already in -client-libs subpackage links with libstable-sort-samba4.so, which means that we need to put both in -client-libs to avoid -client-libs suddenly starting to depend on -libs. --- samba.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index 2fe7b27..a07392f 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.0 -%global baserelease 9 +%global baserelease 10 # This should be rc1 or %%nil %global pre_release %nil @@ -1955,6 +1955,7 @@ fi %{_libdir}/samba/libsmbd-base-samba4.so %{_libdir}/samba/libsmbd-shim-samba4.so %{_libdir}/samba/libsmbldaphelper-samba4.so +%{_libdir}/samba/libstable-sort-samba4.so %{_libdir}/samba/libsys-rw-samba4.so %{_libdir}/samba/libsocket-blocking-samba4.so %{_libdir}/samba/libtalloc-report-printf-samba4.so @@ -2380,7 +2381,6 @@ fi %{_libdir}/samba/libdnsserver-common-samba4.so %{_libdir}/samba/libshares-samba4.so %{_libdir}/samba/libsmbpasswdparser-samba4.so -%{_libdir}/samba/libstable-sort-samba4.so %{_libdir}/samba/libxattr-tdb-samba4.so %{_libdir}/samba/libREG-FULL-samba4.so %{_libdir}/samba/libRPC-SERVER-LOOP-samba4.so @@ -4337,6 +4337,9 @@ fi %endif %changelog +* Fri Mar 17 2023 Kalev Lember - 4.18.0-10 +- Move libstable-sort-samba4.so to samba-client-libs subpackage + * Wed Mar 08 2023 Guenther Deschner - 4.18.0-9 - resolves: #2176469 - Update to version 4.18.0 From d336264f645a03c8139d264ff2d4b51bcdeeb68a Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 21 Mar 2023 11:01:43 +0100 Subject: [PATCH 257/425] Fix file list --- samba.spec | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) diff --git a/samba.spec b/samba.spec index a07392f..1afb2a4 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.0 -%global baserelease 10 +%global baserelease 11 # This should be rc1 or %%nil %global pre_release %nil @@ -3656,7 +3656,6 @@ fi %{_datadir}/ctdb/tests/INTEGRATION/simple/basics.005.process_exists.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/basics.010.statistics.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/basics.011.statistics_reset.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.002.recmaster_yield.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.010.getrelock.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.012.reclock_command.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.015.reclock_remove_lock.sh @@ -3793,10 +3792,6 @@ fi %{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.init.007.sh %{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.init.008.sh %{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.init.009.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.setup.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.setup.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.setup.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.setup.004.sh %{_datadir}/ctdb/tests/UNIT/eventscripts/01.reclock.init.001.sh %{_datadir}/ctdb/tests/UNIT/eventscripts/01.reclock.init.002.sh %{_datadir}/ctdb/tests/UNIT/eventscripts/01.reclock.init.003.sh @@ -4071,7 +4066,6 @@ fi %{_datadir}/ctdb/tests/UNIT/onnode/stubs/ssh %dir %{_datadir}/ctdb/tests/UNIT/shellcheck %{_datadir}/ctdb/tests/UNIT/shellcheck/base_scripts.sh -%{_datadir}/ctdb/tests/UNIT/shellcheck/ctdbd_wrapper.sh %{_datadir}/ctdb/tests/UNIT/shellcheck/ctdb_helpers.sh %{_datadir}/ctdb/tests/UNIT/shellcheck/event_scripts.sh %{_datadir}/ctdb/tests/UNIT/shellcheck/functions.sh @@ -4242,8 +4236,6 @@ fi %{_datadir}/ctdb/tests/UNIT/tool/ctdb.pstore.001.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.ptrans.001.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.readkey.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.recmaster.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.recmaster.002.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.recover.001.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.001.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.002.sh @@ -4337,6 +4329,9 @@ fi %endif %changelog +* Tue Mar 21 2023 Andreas Schneider - 4.18.0-11 +- Fix file list + * Fri Mar 17 2023 Kalev Lember - 4.18.0-10 - Move libstable-sort-samba4.so to samba-client-libs subpackage From e5cb35effe6d98ed90a998d035318c6d2717ba45 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 21 Mar 2023 15:20:25 +0100 Subject: [PATCH 258/425] Fix ctdb file lists when built with test suite enabled --- samba.spec | 51 +++++++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 45 insertions(+), 6 deletions(-) diff --git a/samba.spec b/samba.spec index 1afb2a4..a417bf6 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.0 -%global baserelease 11 +%global baserelease 12 # This should be rc1 or %%nil %global pre_release %nil @@ -3352,6 +3352,7 @@ fi %{_mandir}/man1/smbtorture.1* %if %{with testsuite} +%{_mandir}/man1/vfstest.1* # files to ignore in testsuite mode %{_libdir}/samba/libnss-wrapper.so %{_libdir}/samba/libsocket-wrapper.so @@ -3569,7 +3570,10 @@ fi %{_libexecdir}/ctdb/tests/sock_io_test %{_libexecdir}/ctdb/tests/srvid_test %{_libexecdir}/ctdb/tests/system_socket_test +%{_libexecdir}/ctdb/tests/tmon_ping_test +%{_libexecdir}/ctdb/tests/tmon_test %{_libexecdir}/ctdb/tests/transaction_loop +%{_libexecdir}/ctdb/tests/tunable_test %{_libexecdir}/ctdb/tests/tunnel_cmd %{_libexecdir}/ctdb/tests/tunnel_test %{_libexecdir}/ctdb/tests/update_record @@ -3656,12 +3660,19 @@ fi %{_datadir}/ctdb/tests/INTEGRATION/simple/basics.005.process_exists.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/basics.010.statistics.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/basics.011.statistics_reset.sh +%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.001.stop_leader_yield.sh +%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.002.ban_leader_yield.sh +%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.003.capability_leader_yield.sh +%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.006.stop_leader_yield_no_lock.sh +%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.007.ban_leader_yield_no_lock.sh +%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.008.capability_leader_yield_no_lock.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.010.getrelock.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.012.reclock_command.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.015.reclock_remove_lock.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.016.reclock_move_lock_dir.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.020.message_ring.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.021.tunnel_ring.sh +%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.030.node_stall_leader_timeout.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.090.unreachable.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.091.version_check.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/debug.001.getdebug.sh @@ -3687,6 +3698,7 @@ fi %{_datadir}/ctdb/tests/UNIT/cunit/cmdline_test_001.sh %{_datadir}/ctdb/tests/UNIT/cunit/comm_test_001.sh %{_datadir}/ctdb/tests/UNIT/cunit/comm_test_002.sh +%{_datadir}/ctdb/tests/UNIT/cunit/conf_test_001.sh %{_datadir}/ctdb/tests/UNIT/cunit/config_test_001.sh %{_datadir}/ctdb/tests/UNIT/cunit/config_test_002.sh %{_datadir}/ctdb/tests/UNIT/cunit/config_test_003.sh @@ -3694,7 +3706,6 @@ fi %{_datadir}/ctdb/tests/UNIT/cunit/config_test_005.sh %{_datadir}/ctdb/tests/UNIT/cunit/config_test_006.sh %{_datadir}/ctdb/tests/UNIT/cunit/config_test_007.sh -%{_datadir}/ctdb/tests/UNIT/cunit/conf_test_001.sh %{_datadir}/ctdb/tests/UNIT/cunit/ctdb_io_test_001.sh %{_datadir}/ctdb/tests/UNIT/cunit/db_hash_test_001.sh %{_datadir}/ctdb/tests/UNIT/cunit/event_protocol_test_001.sh @@ -3722,6 +3733,9 @@ fi %{_datadir}/ctdb/tests/UNIT/cunit/system_socket_test_001.sh %{_datadir}/ctdb/tests/UNIT/cunit/system_socket_test_002.sh %{_datadir}/ctdb/tests/UNIT/cunit/system_socket_test_003.sh +%{_datadir}/ctdb/tests/UNIT/cunit/tmon_test_001.sh +%{_datadir}/ctdb/tests/UNIT/cunit/tmon_test_002.sh +%{_datadir}/ctdb/tests/UNIT/cunit/tunable_test_001.sh %dir %{_datadir}/ctdb/tests/UNIT/eventd %dir %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/ctdb.conf @@ -3968,6 +3982,22 @@ fi %{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.shutdown.002.sh %{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.startup.001.sh %{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.startup.002.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.001.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.002.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.003.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.004.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.005.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.006.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.007.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.008.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.021.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.022.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.023.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.024.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.025.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.026.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.027.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.028.sh %dir %{_datadir}/ctdb/tests/UNIT/eventscripts/etc %dir %{_datadir}/ctdb/tests/UNIT/eventscripts/etc-ctdb %{_datadir}/ctdb/tests/UNIT/eventscripts/etc-ctdb/public_addresses @@ -3997,6 +4027,7 @@ fi %{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/50.samba.sh %{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/60.nfs.sh %{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/91.lvs.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/debug_locks.sh %{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/local.sh %{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/statd-callout.sh %{_datadir}/ctdb/tests/UNIT/eventscripts/statd-callout.001.sh @@ -4016,6 +4047,7 @@ fi %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/df %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ethtool %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/exportfs +%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/gstack %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/id %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ip %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ip6tables @@ -4024,21 +4056,24 @@ fi %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/kill %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/killall %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/multipath -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/nfsconf %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/net +%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/nfs-fake-callout +%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/nfsconf %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/pidof %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/pkill %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ps %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/rm -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/rpcinfo %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/rpc.lockd %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/rpc.mountd %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/rpc.rquotad %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/rpc.statd +%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/rpcinfo %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/service %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/sleep %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/smnotify %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ss +%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/stat +%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/tdb_mutex_check %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/tdbdump %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/tdbtool %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/testparm @@ -4200,6 +4235,8 @@ fi %{_datadir}/ctdb/tests/UNIT/tool/ctdb.ipinfo.001.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.ipinfo.002.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.ipinfo.003.sh +%{_datadir}/ctdb/tests/UNIT/tool/ctdb.leader.001.sh +%{_datadir}/ctdb/tests/UNIT/tool/ctdb.leader.002.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.listnodes.001.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.listnodes.002.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.listvars.001.sh @@ -4227,6 +4264,7 @@ fi %{_datadir}/ctdb/tests/UNIT/tool/ctdb.nodestatus.004.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.nodestatus.005.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.nodestatus.006.sh +%{_datadir}/ctdb/tests/UNIT/tool/ctdb.nodestatus.007.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.pdelete.001.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.ping.001.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.pnn.001.sh @@ -4277,6 +4315,7 @@ fi %{_datadir}/ctdb/tests/UNIT/tool/ctdb.setvar.002.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.status.001.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.status.002.sh +%{_datadir}/ctdb/tests/UNIT/tool/ctdb.status.003.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.stop.001.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.stop.002.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.stop.003.sh @@ -4329,8 +4368,8 @@ fi %endif %changelog -* Tue Mar 21 2023 Andreas Schneider - 4.18.0-11 -- Fix file list +* Tue Mar 21 2023 Andreas Schneider - 4.18.0-12 +- Fix ctdb file lists when built with test suite enabled * Fri Mar 17 2023 Kalev Lember - 4.18.0-10 - Move libstable-sort-samba4.so to samba-client-libs subpackage From 8d52163b673aeac4019a67b31374418667209335 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 28 Mar 2023 09:01:24 +0200 Subject: [PATCH 259/425] Add missing Requires for bind-utils samba_dnsupdate uses nsupdate from bind-utils --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index a417bf6..6778147 100644 --- a/samba.spec +++ b/samba.spec @@ -590,6 +590,7 @@ Requires: python3-setproctitle Requires: python3-%{name} = %{samba_depver} Requires: python3-%{name}-dc = %{samba_depver} Requires: krb5-server >= %{required_mit_krb5} +Requires: bind-utils Provides: samba4-dc = %{samba_depver} Obsoletes: samba4-dc < %{samba_depver} From 6126e39c511547f7d90e44e368dc7423f577329f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 29 Mar 2023 16:12:36 +0200 Subject: [PATCH 260/425] Update to version 4.18.1 resolves: #2182787 - Update to version 4.18.1 resolves: #2182772, #2182773 - Security fixes for CVE-2023-0225 resolves: #2182774, #2182775 - Security fixes for CVE-2023-0922 resolves: #2182776, #2182777 - Security fixes for CVE-2023-0614 Guenther --- .gitignore | 2 ++ samba.spec | 12 +++++++++--- sources | 4 ++-- 3 files changed, 13 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 550a6cc..53a513a 100644 --- a/.gitignore +++ b/.gitignore @@ -327,3 +327,5 @@ samba-3.6.0pre1.tar.gz /samba-4.18.0rc4.tar.asc /samba-4.18.0.tar.xz /samba-4.18.0.tar.asc +/samba-4.18.1.tar.xz +/samba-4.18.1.tar.asc diff --git a/samba.spec b/samba.spec index 6778147..35177de 100644 --- a/samba.spec +++ b/samba.spec @@ -134,8 +134,8 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.18.0 -%global baserelease 12 +%global samba_version 4.18.1 +%global baserelease 0 # This should be rc1 or %%nil %global pre_release %nil @@ -171,7 +171,7 @@ %global talloc_version 2.4.0 %global tdb_version 1.4.8 %global tevent_version 0.14.1 -%global ldb_version 2.7.1 +%global ldb_version 2.7.2 %global required_mit_krb5 1.20.1 @@ -4369,6 +4369,12 @@ fi %endif %changelog +* Wed Mar 29 2023 Guenther Deschner - 4.18.1-0 +- resolves: #2182787 - Update to version 4.18.1 +- resolves: #2182772, #2182773 - Security fixes for CVE-2023-0225 +- resolves: #2182774, #2182775 - Security fixes for CVE-2023-0922 +- resolves: #2182776, #2182777 - Security fixes for CVE-2023-0614 + * Tue Mar 21 2023 Andreas Schneider - 4.18.0-12 - Fix ctdb file lists when built with test suite enabled diff --git a/sources b/sources index 588b398..3681b3c 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.18.0.tar.xz) = bb4947335bd1fc501c29a62b413a9c3a1bbaf162d6965a4b2eeb65bf74363c300234b5c73d09e826e596989cd8afdee41b2470647bfdf8f7c42b998e7d367a64 -SHA512 (samba-4.18.0.tar.asc) = 1a478fd0e863e6b6874b703e04f449872b4d581e4c32c853ee4111bc94d1addcf3047331a288e8115a20d9ea22d8e04aade918e8623bd3d08d5122baf4ef0f3d +SHA512 (samba-4.18.1.tar.xz) = 110c6c110277337d714c3636a060895a4c01f118f639a978dc71de18285a8fea3e9071c846dbadbd0a1e3f9fe3e2208ecb0065b007fafeb96f8746a1d691be35 +SHA512 (samba-4.18.1.tar.asc) = 0eb125d8ff20c08e42d18fe2d04467b8ee6ab8fe80cce381697fb09d56200873fa63e6eeb6fd9cdfcee457668feed68c0967d7141b0cc040e0e28a9606518a58 From a6fcf14600dc332871538a5fe4ebec01131d7c63 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 19 Apr 2023 14:34:42 +0200 Subject: [PATCH 261/425] Update to version 4.18.2 resolves: #2187991 Guenther --- .gitignore | 2 ++ samba.spec | 5 ++++- sources | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 53a513a..c09c477 100644 --- a/.gitignore +++ b/.gitignore @@ -329,3 +329,5 @@ samba-3.6.0pre1.tar.gz /samba-4.18.0.tar.asc /samba-4.18.1.tar.xz /samba-4.18.1.tar.asc +/samba-4.18.2.tar.xz +/samba-4.18.2.tar.asc diff --git a/samba.spec b/samba.spec index 35177de..bb144fb 100644 --- a/samba.spec +++ b/samba.spec @@ -134,7 +134,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.18.1 +%global samba_version 4.18.2 %global baserelease 0 # This should be rc1 or %%nil %global pre_release %nil @@ -4369,6 +4369,9 @@ fi %endif %changelog +* Wed Apr 19 2023 Guenther Deschner - 4.18.2-0 +- resolves: #2187991 - Update to version 4.18.2 + * Wed Mar 29 2023 Guenther Deschner - 4.18.1-0 - resolves: #2182787 - Update to version 4.18.1 - resolves: #2182772, #2182773 - Security fixes for CVE-2023-0225 diff --git a/sources b/sources index 3681b3c..4111daa 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.18.1.tar.xz) = 110c6c110277337d714c3636a060895a4c01f118f639a978dc71de18285a8fea3e9071c846dbadbd0a1e3f9fe3e2208ecb0065b007fafeb96f8746a1d691be35 -SHA512 (samba-4.18.1.tar.asc) = 0eb125d8ff20c08e42d18fe2d04467b8ee6ab8fe80cce381697fb09d56200873fa63e6eeb6fd9cdfcee457668feed68c0967d7141b0cc040e0e28a9606518a58 +SHA512 (samba-4.18.2.tar.xz) = edb2e9b7faa25243c8434f08885aa92a7f55cb218d141892f595b1319e8ccb8f0e978b0ab37537a9290fa2721f7cc186f3f66a732c22cb6fecb3056027618693 +SHA512 (samba-4.18.2.tar.asc) = 0f718b12da5e6cc7c770e58cc415b62a3a4226ab93d72fc6e3315af2cc925e17a23b1d168c252b375a8520df24d6fed64730a2585bcac8259dc8c724edc463fb From 5caa412c6bc9729457ed36c16f8d3218cd4ac5c5 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 28 Mar 2023 09:55:56 +0200 Subject: [PATCH 262/425] Add support for mock ccache plugin --- samba.spec | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/samba.spec b/samba.spec index bb144fb..bffef92 100644 --- a/samba.spec +++ b/samba.spec @@ -1262,6 +1262,13 @@ export python_LDFLAGS="$(echo ${LDFLAGS} | sed -e 's/-Wl,-z,defs//g')" export python_LDFLAGS="$(echo %{__global_ldflags} | sed -e 's/-Wl,-z,defs//g')" %endif +# Add support for mock ccache plugin +CCACHE="$(command -v ccache)" +if [ -n "${CCACHE}" ]; then + ${CCACHE} -s + export CC="${CCACHE} gcc" +fi + %configure \ --enable-fhs \ --with-piddir=/run \ From dc949bd3c8a45a97253aa30a8dc8081bd7f374bf Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 20 Apr 2023 14:38:04 +0200 Subject: [PATCH 263/425] Let samba-winbind just suggest samba-tool --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index bffef92..48dfc41 100644 --- a/samba.spec +++ b/samba.spec @@ -989,7 +989,7 @@ Requires(post): %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires(post): %{name}-libs = %{samba_depver} Requires: %{name}-winbind-modules = %{samba_depver} -Recommends: %{name}-tools = %{samba_depver} +Suggests: %{name}-tools = %{samba_depver} %if %{with libwbclient} Requires(post): libwbclient = %{samba_depver} From a79fd33b58027a5883eb1056023c4d529b701766 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 5 May 2023 13:53:47 +0200 Subject: [PATCH 264/425] Fix ccache support --- samba.spec | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index 48dfc41..29f9447 100644 --- a/samba.spec +++ b/samba.spec @@ -2,7 +2,7 @@ # # To build and run the tests use: # -# fedpkg local --with testsuite +# fedpkg mockbuild --with testsuite # or # rpmbuild --rebuild --with testsuite samba.src.rpm # @@ -10,12 +10,15 @@ # Build with internal talloc, tevent, tdb and ldb. # -# fedpkg local --with=testsuite --with=includelibs +# fedpkg mockbuild --with=testsuite --with=includelibs # or # rpmbuild --rebuild --with=testsuite --with=includelibs samba.src.rpm # %bcond_with includelibs +# fedpkg mockbuild --with=ccache +%bcond_with ccache + # ctdb is enabled by default, you can disable it with: --without clustering %bcond_without clustering @@ -1263,11 +1266,13 @@ export python_LDFLAGS="$(echo %{__global_ldflags} | sed -e 's/-Wl,-z,defs//g')" %endif # Add support for mock ccache plugin +%if %{with ccache} CCACHE="$(command -v ccache)" if [ -n "${CCACHE}" ]; then ${CCACHE} -s export CC="${CCACHE} gcc" fi +%endif %configure \ --enable-fhs \ From 41c4c700067073cf41c389a730c5927865e900e0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 1 Jun 2023 10:45:55 +0200 Subject: [PATCH 265/425] Update to version 4.18.3 resolves: #2211453 Guenther --- .gitignore | 2 ++ samba.spec | 5 ++++- sources | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index c09c477..b8bc24c 100644 --- a/.gitignore +++ b/.gitignore @@ -331,3 +331,5 @@ samba-3.6.0pre1.tar.gz /samba-4.18.1.tar.asc /samba-4.18.2.tar.xz /samba-4.18.2.tar.asc +/samba-4.18.3.tar.xz +/samba-4.18.3.tar.asc diff --git a/samba.spec b/samba.spec index 29f9447..2a7e336 100644 --- a/samba.spec +++ b/samba.spec @@ -137,7 +137,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.18.2 +%global samba_version 4.18.3 %global baserelease 0 # This should be rc1 or %%nil %global pre_release %nil @@ -4381,6 +4381,9 @@ fi %endif %changelog +* Thu Jun 01 2023 Guenther Deschner - 4.18.3-0 +- resolves: #2211453 - Update to version 4.18.3 + * Wed Apr 19 2023 Guenther Deschner - 4.18.2-0 - resolves: #2187991 - Update to version 4.18.2 diff --git a/sources b/sources index 4111daa..f7f8e3a 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.18.2.tar.xz) = edb2e9b7faa25243c8434f08885aa92a7f55cb218d141892f595b1319e8ccb8f0e978b0ab37537a9290fa2721f7cc186f3f66a732c22cb6fecb3056027618693 -SHA512 (samba-4.18.2.tar.asc) = 0f718b12da5e6cc7c770e58cc415b62a3a4226ab93d72fc6e3315af2cc925e17a23b1d168c252b375a8520df24d6fed64730a2585bcac8259dc8c724edc463fb +SHA512 (samba-4.18.3.tar.xz) = 792d32d9d0ca61b1a2216709b24e31195ad7c695bfbb42d4b61734c3d801b4dbf984da586b6736f184708c53599db82f36a593444af9321d87005d2a1656418d +SHA512 (samba-4.18.3.tar.asc) = e3197a55f6ea7104ee22572dc559c9a0909513f445389121ac703d7273c6cb260ea715134a10a01e05505c16937a8919f0bd6a095187bf8b338229c07ece3fe2 From 8210a6cc4c8c2fd3739d03b65ffbbd2824fe1b5a Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 15 Jun 2023 10:21:23 +0200 Subject: [PATCH 266/425] logrotate: Also cover mit_kdc.log resolves: rhbz#2203539 --- samba.logrotate | 2 +- samba.spec | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.logrotate b/samba.logrotate index 40f85aa..43bef68 100644 --- a/samba.logrotate +++ b/samba.logrotate @@ -1,4 +1,4 @@ -/var/log/samba/log.* { +/var/log/samba/*log* { compress dateext maxage 365 diff --git a/samba.spec b/samba.spec index 2a7e336..164a7ea 100644 --- a/samba.spec +++ b/samba.spec @@ -4381,6 +4381,9 @@ fi %endif %changelog +* Thu Jun 15 2023 Andreas Schneider - 4.18.3-1 +- resolves: #2203539 - Also cover mit_kdc.log by logrotate + * Thu Jun 01 2023 Guenther Deschner - 4.18.3-0 - resolves: #2211453 - Update to version 4.18.3 From f5d2701706ace8d556f28b3e16164f2f96a15e55 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 15 Jun 2023 12:32:01 +0200 Subject: [PATCH 267/425] Bump baserelease Forgotten in previous commit. --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 164a7ea..3d07db7 100644 --- a/samba.spec +++ b/samba.spec @@ -138,7 +138,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.3 -%global baserelease 0 +%global baserelease 1 # This should be rc1 or %%nil %global pre_release %nil From 15cfaa7346d46007a86267807697524bc6afd9b8 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Thu, 15 Jun 2023 13:18:39 +0200 Subject: [PATCH 268/425] Rebuilt for Python 3.12 --- samba.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 3d07db7..4f99a85 100644 --- a/samba.spec +++ b/samba.spec @@ -138,7 +138,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.3 -%global baserelease 1 +%global baserelease 2 # This should be rc1 or %%nil %global pre_release %nil @@ -4381,6 +4381,9 @@ fi %endif %changelog +* Thu Jun 15 2023 Python Maint - 2:4.18.3-2 +- Rebuilt for Python 3.12 + * Thu Jun 15 2023 Andreas Schneider - 4.18.3-1 - resolves: #2203539 - Also cover mit_kdc.log by logrotate From efe3dd0ab17750ab1da30ddc180ac7f83b143595 Mon Sep 17 00:00:00 2001 From: "FeRD (Frank Dana)" Date: Sat, 17 Jun 2023 11:18:44 -0400 Subject: [PATCH 269/425] =?UTF-8?q?Remove=20=C2=AE=20symbol=20from=20winex?= =?UTF-8?q?e's=20description?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 4f99a85..e6ea486 100644 --- a/samba.spec +++ b/samba.spec @@ -1090,7 +1090,7 @@ Requires: %{name}-common-libs = %{samba_depver} Provides: bundled(libreplace) %description winexe -Winexe is a Remote Windows®-command executor +Winexe is a Remote Windows-command executor %endif ### CTDB From 7f3a842050130d8f8a375333438113a1aad7a86b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 23 Jun 2023 10:45:43 +0200 Subject: [PATCH 270/425] Fix libwbclient package upgrades resolves: rhbz#2211577 --- samba.spec | 71 +++++++++--------------------------------------------- 1 file changed, 12 insertions(+), 59 deletions(-) diff --git a/samba.spec b/samba.spec index e6ea486..4bb5af5 100644 --- a/samba.spec +++ b/samba.spec @@ -138,7 +138,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.3 -%global baserelease 2 +%global baserelease 3 # This should be rc1 or %%nil %global pre_release %nil @@ -829,6 +829,7 @@ suite. %package -n libwbclient Summary: The winbind client library Requires: %{name}-client-libs = %{samba_depver} +Conflicts: sssd-libwbclient %description -n libwbclient The libwbclient package contains the winbind client library from the Samba @@ -837,6 +838,7 @@ suite. %package -n libwbclient-devel Summary: Developer tools for the winbind library Requires: libwbclient = %{samba_depver} +Conflicts: sssd-libwbclient-devel Provides: samba-winbind-devel = %{samba_depver} Obsoletes: samba-winbind-devel < %{samba_depver} @@ -1359,17 +1361,6 @@ install -d -m 0755 %{buildroot}/%{_libdir}/samba install -d -m 0755 %{buildroot}/%{_libdir}/samba/ldb install -d -m 0755 %{buildroot}/%{_libdir}/pkgconfig -# Move libwbclient.so* into private directory, it cannot be just libdir/samba -# because samba uses rpath with this directory. -install -d -m 0755 %{buildroot}/%{_libdir}/samba/wbclient -mv %{buildroot}/%{_libdir}/libwbclient.so* %{buildroot}/%{_libdir}/samba/wbclient -if [ ! -f %{buildroot}/%{_libdir}/samba/wbclient/libwbclient.so.%{libwbc_alternatives_version} ] -then - echo "Expected libwbclient version not found, please check if version has changed." - exit -1 -fi - - touch %{buildroot}%{_libexecdir}/samba/cups_backend_smb # Install other stuff @@ -1576,52 +1567,11 @@ fi %endif %if %{with libwbclient} -%posttrans -n libwbclient -# It has to be posttrans here to make sure all files of a previous version -# without alternatives support are removed -%{_sbindir}/update-alternatives \ - --install \ - %{_libdir}/libwbclient.so.%{libwbc_alternatives_version} \ - libwbclient.so.%{libwbc_alternatives_version}%{libwbc_alternatives_suffix} \ - %{_libdir}/samba/wbclient/libwbclient.so.%{libwbc_alternatives_version} \ - 10 +%pre -n libwbclient +rm -rf %{_libdir}/samba/wbclient/ +rm -f /etc/alternatives/libwbclient.so* +rm -f /var/lib/alternatives/libwbclient.so* %{?ldconfig} - -%preun -n libwbclient -if [ $1 -eq 0 ]; then - %{_sbindir}/update-alternatives \ - --remove \ - libwbclient.so.%{libwbc_alternatives_version}%{libwbc_alternatives_suffix} \ - %{_libdir}/samba/wbclient/libwbclient.so.%{libwbc_alternatives_version} -fi -/sbin/ldconfig - -%posttrans -n libwbclient-devel -%{_sbindir}/update-alternatives \ - --install %{_libdir}/libwbclient.so \ - libwbclient.so%{libwbc_alternatives_suffix} \ - %{_libdir}/samba/wbclient/libwbclient.so \ - 10 - -%preun -n libwbclient-devel -# alternatives checks if the file which should be removed is a link or not, but -# not if it points to the /etc/alternatives directory or to some other place. -# When downgrading to a version where alternatives is not used and -# libwbclient.so is a link and not a file it will be removed. The following -# check removes the alternatives files manually if that is the case. -if [ $1 -eq 0 ]; then - if [ "`readlink %{_libdir}/libwbclient.so`" == "libwbclient.so.%{libwbc_alternatives_version}" ]; then - /bin/rm -f \ - /etc/alternatives/libwbclient.so%{libwbc_alternatives_suffix} \ - /var/lib/alternatives/libwbclient.so%{libwbc_alternatives_suffix} 2> /dev/null - else - %{_sbindir}/update-alternatives \ - --remove \ - libwbclient.so%{libwbc_alternatives_suffix} \ - %{_libdir}/samba/wbclient/libwbclient.so - fi -fi - #endif {with libwbclient} %endif @@ -2426,12 +2376,12 @@ fi ### LIBWBCLIENT %if %{with libwbclient} %files -n libwbclient -%{_libdir}/samba/wbclient/libwbclient.so.%{libwbclient_so_version}* +%{_libdir}/libwbclient.so.%{libwbclient_so_version}* ### LIBWBCLIENT-DEVEL %files -n libwbclient-devel %{_includedir}/samba-4.0/wbclient.h -%{_libdir}/samba/wbclient/libwbclient.so +%{_libdir}/libwbclient.so %{_libdir}/pkgconfig/wbclient.pc #endif {with libwbclient} %endif @@ -4381,6 +4331,9 @@ fi %endif %changelog +* Fri Jun 23 2023 Andreas Schneider - 4.18.3-3 +- resolves: rhbz#2211577 - Fix libwbclient package upgrades + * Thu Jun 15 2023 Python Maint - 2:4.18.3-2 - Rebuilt for Python 3.12 From c3a5a6aedeaa7ca1894abd44e9fc508cd3cf45ae Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Mon, 26 Jun 2023 01:02:08 +0200 Subject: [PATCH 271/425] Only run libwbclient %pre on upgrade, not fresh install This seems to be breaking live image build tests because the script is running before `rm` is installed. I do not know why it didn't fail the tests run *on the update itself*, but it's now causing tests of subsequent updates to fail, which is a problem. Probably an ordering issue. AFAIK, this script is meant to clean up stuff from earlier versions of the package, so it's not relevant on fresh installs, and we can just skip it and avoid any problems in the fresh install case. --- samba.spec | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/samba.spec b/samba.spec index 4bb5af5..f53f676 100644 --- a/samba.spec +++ b/samba.spec @@ -138,7 +138,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.3 -%global baserelease 3 +%global baserelease 4 # This should be rc1 or %%nil %global pre_release %nil @@ -1568,9 +1568,11 @@ fi %if %{with libwbclient} %pre -n libwbclient -rm -rf %{_libdir}/samba/wbclient/ -rm -f /etc/alternatives/libwbclient.so* -rm -f /var/lib/alternatives/libwbclient.so* +if [ $1 -gt 1 ] ; then + rm -rf %{_libdir}/samba/wbclient/ + rm -f /etc/alternatives/libwbclient.so* + rm -f /var/lib/alternatives/libwbclient.so* +fi %{?ldconfig} #endif {with libwbclient} %endif @@ -4331,6 +4333,9 @@ fi %endif %changelog +* Mon Jun 26 2023 Adam Williamson - 4.18.3-4 +- Only run libwbclient %pre on upgrade, not fresh install + * Fri Jun 23 2023 Andreas Schneider - 4.18.3-3 - resolves: rhbz#2211577 - Fix libwbclient package upgrades From f3b66c42cad2c923c84fe9144f5e7148b0f70188 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Mon, 26 Jun 2023 12:27:58 +0200 Subject: [PATCH 272/425] Rebuilt for Python 3.12 --- samba.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index f53f676..65003fc 100644 --- a/samba.spec +++ b/samba.spec @@ -138,7 +138,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.3 -%global baserelease 4 +%global baserelease 5 # This should be rc1 or %%nil %global pre_release %nil @@ -4333,6 +4333,9 @@ fi %endif %changelog +* Mon Jun 26 2023 Python Maint - 2:4.18.3-5 +- Rebuilt for Python 3.12 + * Mon Jun 26 2023 Adam Williamson - 4.18.3-4 - Only run libwbclient %pre on upgrade, not fresh install From ac8caa023eb94155b94b3bdf62b698aaefdf5ec4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 5 Jul 2023 14:10:53 +0200 Subject: [PATCH 273/425] Update to version 4.18.4 resolves: #2219799 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index b8bc24c..1849014 100644 --- a/.gitignore +++ b/.gitignore @@ -333,3 +333,5 @@ samba-3.6.0pre1.tar.gz /samba-4.18.2.tar.asc /samba-4.18.3.tar.xz /samba-4.18.3.tar.asc +/samba-4.18.4.tar.xz +/samba-4.18.4.tar.asc diff --git a/samba.spec b/samba.spec index 65003fc..843858c 100644 --- a/samba.spec +++ b/samba.spec @@ -137,8 +137,8 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.18.3 -%global baserelease 5 +%global samba_version 4.18.4 +%global baserelease 0 # This should be rc1 or %%nil %global pre_release %nil @@ -4333,6 +4333,9 @@ fi %endif %changelog +* Wed Jul 05 2023 Guenther Deschner - 4.18.4-0 +- resolves: #2219799 - Update to version 4.18.4 + * Mon Jun 26 2023 Python Maint - 2:4.18.3-5 - Rebuilt for Python 3.12 diff --git a/sources b/sources index f7f8e3a..e1b7b1c 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.18.3.tar.xz) = 792d32d9d0ca61b1a2216709b24e31195ad7c695bfbb42d4b61734c3d801b4dbf984da586b6736f184708c53599db82f36a593444af9321d87005d2a1656418d -SHA512 (samba-4.18.3.tar.asc) = e3197a55f6ea7104ee22572dc559c9a0909513f445389121ac703d7273c6cb260ea715134a10a01e05505c16937a8919f0bd6a095187bf8b338229c07ece3fe2 +SHA512 (samba-4.18.4.tar.xz) = 9b9ed3111e8c1f8fbb990e2cf78bdd00bbe03e79247ec87a3ee51744acfbc6692f110dc88ccb1049b7d9c6aaa8fd6ba3ab4acd7ad0480dbb9df8b61980c0da83 +SHA512 (samba-4.18.4.tar.asc) = bc13d14b8da6a05494a79b8a8fb35fc27670f7ab8609eaeb3f3df49dd04bdb1389e77c2d571db5efcdd85532971c423eb977d46c2a5cbee3daadd6c6eca721ec From 3948e24a266dfda8efffb05e21a6746505c6139f Mon Sep 17 00:00:00 2001 From: Python Maint Date: Wed, 5 Jul 2023 18:27:08 +0200 Subject: [PATCH 274/425] Rebuilt for Python 3.12 --- samba.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 843858c..236f59c 100644 --- a/samba.spec +++ b/samba.spec @@ -138,7 +138,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.4 -%global baserelease 0 +%global baserelease 1 # This should be rc1 or %%nil %global pre_release %nil @@ -4333,6 +4333,9 @@ fi %endif %changelog +* Wed Jul 05 2023 Python Maint - 2:4.18.4-1 +- Rebuilt for Python 3.12 + * Wed Jul 05 2023 Guenther Deschner - 4.18.4-0 - resolves: #2219799 - Update to version 4.18.4 From a38fba05622f8ab17d6d9c2dc50e6a2ddfbcabfe Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Franti=C5=A1ek=20Zatloukal?= Date: Tue, 11 Jul 2023 22:21:49 +0200 Subject: [PATCH 275/425] Rebuilt for ICU 73.2 --- samba.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 236f59c..103ef04 100644 --- a/samba.spec +++ b/samba.spec @@ -138,7 +138,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.4 -%global baserelease 1 +%global baserelease 2 # This should be rc1 or %%nil %global pre_release %nil @@ -4333,6 +4333,9 @@ fi %endif %changelog +* Tue Jul 11 2023 František Zatloukal - 2:4.18.4-2 +- Rebuilt for ICU 73.2 + * Wed Jul 05 2023 Python Maint - 2:4.18.4-1 - Rebuilt for Python 3.12 From 64ef2ec2d2cc5d47909984b72d2a0f7df902215e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Sat, 15 Jul 2023 15:17:52 +0200 Subject: [PATCH 276/425] Fix netlogon LogonGetCapabilities level 2 error handling resolves: #2223091 Guenther --- master-netlogongetcaps.patch | 351 +++++++++++++++++++++++++++++++++++ samba.spec | 7 +- 2 files changed, 357 insertions(+), 1 deletion(-) create mode 100644 master-netlogongetcaps.patch diff --git a/master-netlogongetcaps.patch b/master-netlogongetcaps.patch new file mode 100644 index 0000000..dd0f6b1 --- /dev/null +++ b/master-netlogongetcaps.patch @@ -0,0 +1,351 @@ +From 5f87888ed53320538cf773d64868390d8641a40e Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Sat, 15 Jul 2023 17:20:32 +0200 +Subject: [PATCH 1/4] netlogon.idl: add support for netr_LogonGetCapabilities + response level 2 + +We don't have any documentation about this yet, but tests against +a Windows Server 2022 patched with KB5028166 revealed that +the response for query_level=2 is exactly the same as +for querey_level=1. + +Until we know the reason for query_level=2 we won't +use it as client nor support it in the server, but +we want ndrdump to work. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15418 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Andrew Bartlett +--- + librpc/idl/netlogon.idl | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/librpc/idl/netlogon.idl b/librpc/idl/netlogon.idl +index 48a8c8f9310..85dd73ee7e4 100644 +--- a/librpc/idl/netlogon.idl ++++ b/librpc/idl/netlogon.idl +@@ -1236,6 +1236,7 @@ interface netlogon + /* Function 0x15 */ + typedef [switch_type(uint32)] union { + [case(1)] netr_NegotiateFlags server_capabilities; ++ [case(2)] netr_NegotiateFlags server_capabilities; + } netr_Capabilities; + + NTSTATUS netr_LogonGetCapabilities( +-- +2.41.0 + + +From 404ce08e9088968311c714e756f5d58ce2cef715 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Sat, 15 Jul 2023 17:25:05 +0200 +Subject: [PATCH 2/4] s4:torture/rpc: let rpc.schannel also check + netr_LogonGetCapabilities with different levels + +The important change it that we expect DCERPC_NCA_S_FAULT_INVALID_TAG +for unsupported query_levels, we allow it to work with servers +with or without support for query_level=2. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15418 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Andrew Bartlett +--- + .../knownfail.d/netr_LogonGetCapabilities | 3 + + source4/torture/rpc/netlogon.c | 77 ++++++++++++++++++- + 2 files changed, 79 insertions(+), 1 deletion(-) + create mode 100644 selftest/knownfail.d/netr_LogonGetCapabilities + +diff --git a/selftest/knownfail.d/netr_LogonGetCapabilities b/selftest/knownfail.d/netr_LogonGetCapabilities +new file mode 100644 +index 00000000000..30aadf3bb9d +--- /dev/null ++++ b/selftest/knownfail.d/netr_LogonGetCapabilities +@@ -0,0 +1,3 @@ ++^samba3.rpc.schannel.*\.schannel\(nt4_dc ++^samba3.rpc.schannel.*\.schannel\(ad_dc ++^samba4.rpc.schannel.*\.schannel\(ad_dc +diff --git a/source4/torture/rpc/netlogon.c b/source4/torture/rpc/netlogon.c +index 1f068eb7826..a3d190f13dd 100644 +--- a/source4/torture/rpc/netlogon.c ++++ b/source4/torture/rpc/netlogon.c +@@ -2056,8 +2056,47 @@ bool test_netlogon_capabilities(struct dcerpc_pipe *p, struct torture_context *t + r.out.capabilities = &capabilities; + r.out.return_authenticator = &return_auth; + +- torture_comment(tctx, "Testing LogonGetCapabilities\n"); ++ torture_comment(tctx, "Testing LogonGetCapabilities with query_level=0\n"); + ++ r.in.query_level = 0; ++ ZERO_STRUCT(return_auth); ++ ++ /* ++ * we need to operate on a temporary copy of creds ++ * because dcerpc_netr_LogonGetCapabilities with ++ * an unknown query level returns DCERPC_NCA_S_FAULT_INVALID_TAG ++ * => NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE ++ * without looking a the authenticator. ++ */ ++ tmp_creds = *creds; ++ netlogon_creds_client_authenticator(&tmp_creds, &auth); ++ ++ status = dcerpc_netr_LogonGetCapabilities_r(b, tctx, &r); ++ torture_assert_ntstatus_equal(tctx, status, NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE, ++ "LogonGetCapabilities query_level=0 failed"); ++ ++ torture_comment(tctx, "Testing LogonGetCapabilities with query_level=3\n"); ++ ++ r.in.query_level = 3; ++ ZERO_STRUCT(return_auth); ++ ++ /* ++ * we need to operate on a temporary copy of creds ++ * because dcerpc_netr_LogonGetCapabilities with ++ * an unknown query level returns DCERPC_NCA_S_FAULT_INVALID_TAG ++ * => NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE ++ * without looking a the authenticator. ++ */ ++ tmp_creds = *creds; ++ netlogon_creds_client_authenticator(&tmp_creds, &auth); ++ ++ status = dcerpc_netr_LogonGetCapabilities_r(b, tctx, &r); ++ torture_assert_ntstatus_equal(tctx, status, NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE, ++ "LogonGetCapabilities query_level=0 failed"); ++ ++ torture_comment(tctx, "Testing LogonGetCapabilities with query_level=1\n"); ++ ++ r.in.query_level = 1; + ZERO_STRUCT(return_auth); + + /* +@@ -2077,6 +2116,42 @@ bool test_netlogon_capabilities(struct dcerpc_pipe *p, struct torture_context *t + + *creds = tmp_creds; + ++ torture_assert(tctx, netlogon_creds_client_check(creds, ++ &r.out.return_authenticator->cred), ++ "Credential chaining failed"); ++ ++ torture_assert_int_equal(tctx, creds->negotiate_flags, ++ capabilities.server_capabilities, ++ "negotiate flags"); ++ ++ torture_comment(tctx, "Testing LogonGetCapabilities with query_level=2\n"); ++ ++ r.in.query_level = 2; ++ ZERO_STRUCT(return_auth); ++ ++ /* ++ * we need to operate on a temporary copy of creds ++ * because dcerpc_netr_LogonGetCapabilities with ++ * an query level 2 may returns DCERPC_NCA_S_FAULT_INVALID_TAG ++ * => NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE ++ * without looking a the authenticator. ++ */ ++ tmp_creds = *creds; ++ netlogon_creds_client_authenticator(&tmp_creds, &auth); ++ ++ status = dcerpc_netr_LogonGetCapabilities_r(b, tctx, &r); ++ if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE)) { ++ /* ++ * an server without KB5028166 returns ++ * DCERPC_NCA_S_FAULT_INVALID_TAG => ++ * NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE ++ */ ++ return true; ++ } ++ torture_assert_ntstatus_ok(tctx, status, "LogonGetCapabilities query_level=2 failed"); ++ ++ *creds = tmp_creds; ++ + torture_assert(tctx, netlogon_creds_client_check(creds, + &r.out.return_authenticator->cred), + "Credential chaining failed"); +-- +2.41.0 + + +From d5f1097b6220676d56ed5fc6707acf667b704518 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Sat, 15 Jul 2023 16:11:48 +0200 +Subject: [PATCH 3/4] s4:rpc_server:netlogon: generate FAULT_INVALID_TAG for + invalid netr_LogonGetCapabilities levels + +This is important as Windows clients with KB5028166 seem to +call netr_LogonGetCapabilities with query_level=2 after +a call with query_level=1. + +An unpatched Windows Server returns DCERPC_NCA_S_FAULT_INVALID_TAG +for query_level values other than 1. +While Samba tries to return NT_STATUS_NOT_SUPPORTED, but +later fails to marshall the response, which results +in DCERPC_FAULT_BAD_STUB_DATA instead. + +Because we don't have any documentation for level 2 yet, +we just try to behave like an unpatched server and +generate DCERPC_NCA_S_FAULT_INVALID_TAG instead of +DCERPC_FAULT_BAD_STUB_DATA. +Which allows patched Windows clients to keep working +against a Samba DC. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15418 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Andrew Bartlett +--- + .../knownfail.d/netr_LogonGetCapabilities | 2 -- + source4/rpc_server/netlogon/dcerpc_netlogon.c | 28 ++++++++++++++++--- + 2 files changed, 24 insertions(+), 6 deletions(-) + +diff --git a/selftest/knownfail.d/netr_LogonGetCapabilities b/selftest/knownfail.d/netr_LogonGetCapabilities +index 30aadf3bb9d..99c7ac711ed 100644 +--- a/selftest/knownfail.d/netr_LogonGetCapabilities ++++ b/selftest/knownfail.d/netr_LogonGetCapabilities +@@ -1,3 +1 @@ + ^samba3.rpc.schannel.*\.schannel\(nt4_dc +-^samba3.rpc.schannel.*\.schannel\(ad_dc +-^samba4.rpc.schannel.*\.schannel\(ad_dc +diff --git a/source4/rpc_server/netlogon/dcerpc_netlogon.c b/source4/rpc_server/netlogon/dcerpc_netlogon.c +index 6ccba65d3bf..dc2167f08b2 100644 +--- a/source4/rpc_server/netlogon/dcerpc_netlogon.c ++++ b/source4/rpc_server/netlogon/dcerpc_netlogon.c +@@ -2364,6 +2364,30 @@ static NTSTATUS dcesrv_netr_LogonGetCapabilities(struct dcesrv_call_state *dce_c + struct netlogon_creds_CredentialState *creds; + NTSTATUS status; + ++ switch (r->in.query_level) { ++ case 1: ++ break; ++ case 2: ++ /* ++ * Until we know the details behind KB5028166 ++ * just return DCERPC_NCA_S_FAULT_INVALID_TAG ++ * like an unpatched Windows Server. ++ */ ++ FALL_THROUGH; ++ default: ++ /* ++ * There would not be a way to marshall the ++ * the response. Which would mean our final ++ * ndr_push would fail an we would return ++ * an RPC-level fault with DCERPC_FAULT_BAD_STUB_DATA. ++ * ++ * But it's important to match a Windows server ++ * especially before KB5028166, see also our bug #15418 ++ * Otherwise Windows client would stop talking to us. ++ */ ++ DCESRV_FAULT(DCERPC_NCA_S_FAULT_INVALID_TAG); ++ } ++ + status = dcesrv_netr_creds_server_step_check(dce_call, + mem_ctx, + r->in.computer_name, +@@ -2375,10 +2399,6 @@ static NTSTATUS dcesrv_netr_LogonGetCapabilities(struct dcesrv_call_state *dce_c + } + NT_STATUS_NOT_OK_RETURN(status); + +- if (r->in.query_level != 1) { +- return NT_STATUS_NOT_SUPPORTED; +- } +- + r->out.capabilities->server_capabilities = creds->negotiate_flags; + + return NT_STATUS_OK; +-- +2.41.0 + + +From dfeabce44fbb78083fbbb2aa634fc4172cf83db9 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Sat, 15 Jul 2023 16:11:48 +0200 +Subject: [PATCH 4/4] s3:rpc_server:netlogon: generate FAULT_INVALID_TAG for + invalid netr_LogonGetCapabilities levels + +This is important as Windows clients with KB5028166 seem to +call netr_LogonGetCapabilities with query_level=2 after +a call with query_level=1. + +An unpatched Windows Server returns DCERPC_NCA_S_FAULT_INVALID_TAG +for query_level values other than 1. +While Samba tries to return NT_STATUS_NOT_SUPPORTED, but +later fails to marshall the response, which results +in DCERPC_FAULT_BAD_STUB_DATA instead. + +Because we don't have any documentation for level 2 yet, +we just try to behave like an unpatched server and +generate DCERPC_NCA_S_FAULT_INVALID_TAG instead of +DCERPC_FAULT_BAD_STUB_DATA. +Which allows patched Windows clients to keep working +against a Samba DC. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15418 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Andrew Bartlett + +Autobuild-User(master): Stefan Metzmacher +Autobuild-Date(master): Mon Jul 17 07:35:09 UTC 2023 on atb-devel-224 +--- + .../knownfail.d/netr_LogonGetCapabilities | 1 - + source3/rpc_server/netlogon/srv_netlog_nt.c | 29 ++++++++++++++++--- + 2 files changed, 25 insertions(+), 5 deletions(-) + delete mode 100644 selftest/knownfail.d/netr_LogonGetCapabilities + +diff --git a/selftest/knownfail.d/netr_LogonGetCapabilities b/selftest/knownfail.d/netr_LogonGetCapabilities +deleted file mode 100644 +index 99c7ac711ed..00000000000 +--- a/selftest/knownfail.d/netr_LogonGetCapabilities ++++ /dev/null +@@ -1 +0,0 @@ +-^samba3.rpc.schannel.*\.schannel\(nt4_dc +diff --git a/source3/rpc_server/netlogon/srv_netlog_nt.c b/source3/rpc_server/netlogon/srv_netlog_nt.c +index 3ba58e61206..e8aa14167fc 100644 +--- a/source3/rpc_server/netlogon/srv_netlog_nt.c ++++ b/source3/rpc_server/netlogon/srv_netlog_nt.c +@@ -2284,6 +2284,31 @@ NTSTATUS _netr_LogonGetCapabilities(struct pipes_struct *p, + struct netlogon_creds_CredentialState *creds; + NTSTATUS status; + ++ switch (r->in.query_level) { ++ case 1: ++ break; ++ case 2: ++ /* ++ * Until we know the details behind KB5028166 ++ * just return DCERPC_NCA_S_FAULT_INVALID_TAG ++ * like an unpatched Windows Server. ++ */ ++ FALL_THROUGH; ++ default: ++ /* ++ * There would not be a way to marshall the ++ * the response. Which would mean our final ++ * ndr_push would fail an we would return ++ * an RPC-level fault with DCERPC_FAULT_BAD_STUB_DATA. ++ * ++ * But it's important to match a Windows server ++ * especially before KB5028166, see also our bug #15418 ++ * Otherwise Windows client would stop talking to us. ++ */ ++ p->fault_state = DCERPC_NCA_S_FAULT_INVALID_TAG; ++ return NT_STATUS_NOT_SUPPORTED; ++ } ++ + become_root(); + status = dcesrv_netr_creds_server_step_check(p->dce_call, + p->mem_ctx, +@@ -2296,10 +2321,6 @@ NTSTATUS _netr_LogonGetCapabilities(struct pipes_struct *p, + return status; + } + +- if (r->in.query_level != 1) { +- return NT_STATUS_NOT_SUPPORTED; +- } +- + r->out.capabilities->server_capabilities = creds->negotiate_flags; + + return NT_STATUS_OK; +-- +2.41.0 + diff --git a/samba.spec b/samba.spec index 103ef04..4bbddfc 100644 --- a/samba.spec +++ b/samba.spec @@ -138,7 +138,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.4 -%global baserelease 2 +%global baserelease 3 # This should be rc1 or %%nil %global pre_release %nil @@ -234,6 +234,8 @@ Source17: samba-usershares-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore +Patch0: master-netlogongetcaps.patch + Requires(pre): /usr/sbin/groupadd Requires(pre): %{name}-common = %{samba_depver} @@ -4333,6 +4335,9 @@ fi %endif %changelog +* Sat Jul 15 2023 Guenther Deschner - 4.18.4-3 +- resolves: #2223091 - Fix netlogon LogonGetCapabilities level 2 error handling + * Tue Jul 11 2023 František Zatloukal - 2:4.18.4-2 - Rebuilt for ICU 73.2 From 9ae16cc49b17e71c781ae5b4e2493fac4a6120aa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 20 Jul 2023 10:21:05 +0200 Subject: [PATCH 277/425] Update to version 4.18.5 resolves: #2224040 Security fix for CVE-2022-2127 resolves: #2222791, #2224254 Security fix for CVE-2023-3347 resolves: #2222792, #2224255 Security fix for CVE-2023-34966 resolves: #2222793, #2224253 Security fix for CVE-2023-34967 resolves: #2222794, #2224252 Security fix for CVE-2023-34968 resolves: #2222795, #2224250 Guenther --- .gitignore | 2 + master-netlogongetcaps.patch | 351 ----------------------------------- samba.spec | 14 +- sources | 4 +- 4 files changed, 14 insertions(+), 357 deletions(-) delete mode 100644 master-netlogongetcaps.patch diff --git a/.gitignore b/.gitignore index 1849014..7d7069f 100644 --- a/.gitignore +++ b/.gitignore @@ -335,3 +335,5 @@ samba-3.6.0pre1.tar.gz /samba-4.18.3.tar.asc /samba-4.18.4.tar.xz /samba-4.18.4.tar.asc +/samba-4.18.5.tar.xz +/samba-4.18.5.tar.asc diff --git a/master-netlogongetcaps.patch b/master-netlogongetcaps.patch deleted file mode 100644 index dd0f6b1..0000000 --- a/master-netlogongetcaps.patch +++ /dev/null @@ -1,351 +0,0 @@ -From 5f87888ed53320538cf773d64868390d8641a40e Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Sat, 15 Jul 2023 17:20:32 +0200 -Subject: [PATCH 1/4] netlogon.idl: add support for netr_LogonGetCapabilities - response level 2 - -We don't have any documentation about this yet, but tests against -a Windows Server 2022 patched with KB5028166 revealed that -the response for query_level=2 is exactly the same as -for querey_level=1. - -Until we know the reason for query_level=2 we won't -use it as client nor support it in the server, but -we want ndrdump to work. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15418 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Andrew Bartlett ---- - librpc/idl/netlogon.idl | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/librpc/idl/netlogon.idl b/librpc/idl/netlogon.idl -index 48a8c8f9310..85dd73ee7e4 100644 ---- a/librpc/idl/netlogon.idl -+++ b/librpc/idl/netlogon.idl -@@ -1236,6 +1236,7 @@ interface netlogon - /* Function 0x15 */ - typedef [switch_type(uint32)] union { - [case(1)] netr_NegotiateFlags server_capabilities; -+ [case(2)] netr_NegotiateFlags server_capabilities; - } netr_Capabilities; - - NTSTATUS netr_LogonGetCapabilities( --- -2.41.0 - - -From 404ce08e9088968311c714e756f5d58ce2cef715 Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Sat, 15 Jul 2023 17:25:05 +0200 -Subject: [PATCH 2/4] s4:torture/rpc: let rpc.schannel also check - netr_LogonGetCapabilities with different levels - -The important change it that we expect DCERPC_NCA_S_FAULT_INVALID_TAG -for unsupported query_levels, we allow it to work with servers -with or without support for query_level=2. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15418 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Andrew Bartlett ---- - .../knownfail.d/netr_LogonGetCapabilities | 3 + - source4/torture/rpc/netlogon.c | 77 ++++++++++++++++++- - 2 files changed, 79 insertions(+), 1 deletion(-) - create mode 100644 selftest/knownfail.d/netr_LogonGetCapabilities - -diff --git a/selftest/knownfail.d/netr_LogonGetCapabilities b/selftest/knownfail.d/netr_LogonGetCapabilities -new file mode 100644 -index 00000000000..30aadf3bb9d ---- /dev/null -+++ b/selftest/knownfail.d/netr_LogonGetCapabilities -@@ -0,0 +1,3 @@ -+^samba3.rpc.schannel.*\.schannel\(nt4_dc -+^samba3.rpc.schannel.*\.schannel\(ad_dc -+^samba4.rpc.schannel.*\.schannel\(ad_dc -diff --git a/source4/torture/rpc/netlogon.c b/source4/torture/rpc/netlogon.c -index 1f068eb7826..a3d190f13dd 100644 ---- a/source4/torture/rpc/netlogon.c -+++ b/source4/torture/rpc/netlogon.c -@@ -2056,8 +2056,47 @@ bool test_netlogon_capabilities(struct dcerpc_pipe *p, struct torture_context *t - r.out.capabilities = &capabilities; - r.out.return_authenticator = &return_auth; - -- torture_comment(tctx, "Testing LogonGetCapabilities\n"); -+ torture_comment(tctx, "Testing LogonGetCapabilities with query_level=0\n"); - -+ r.in.query_level = 0; -+ ZERO_STRUCT(return_auth); -+ -+ /* -+ * we need to operate on a temporary copy of creds -+ * because dcerpc_netr_LogonGetCapabilities with -+ * an unknown query level returns DCERPC_NCA_S_FAULT_INVALID_TAG -+ * => NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE -+ * without looking a the authenticator. -+ */ -+ tmp_creds = *creds; -+ netlogon_creds_client_authenticator(&tmp_creds, &auth); -+ -+ status = dcerpc_netr_LogonGetCapabilities_r(b, tctx, &r); -+ torture_assert_ntstatus_equal(tctx, status, NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE, -+ "LogonGetCapabilities query_level=0 failed"); -+ -+ torture_comment(tctx, "Testing LogonGetCapabilities with query_level=3\n"); -+ -+ r.in.query_level = 3; -+ ZERO_STRUCT(return_auth); -+ -+ /* -+ * we need to operate on a temporary copy of creds -+ * because dcerpc_netr_LogonGetCapabilities with -+ * an unknown query level returns DCERPC_NCA_S_FAULT_INVALID_TAG -+ * => NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE -+ * without looking a the authenticator. -+ */ -+ tmp_creds = *creds; -+ netlogon_creds_client_authenticator(&tmp_creds, &auth); -+ -+ status = dcerpc_netr_LogonGetCapabilities_r(b, tctx, &r); -+ torture_assert_ntstatus_equal(tctx, status, NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE, -+ "LogonGetCapabilities query_level=0 failed"); -+ -+ torture_comment(tctx, "Testing LogonGetCapabilities with query_level=1\n"); -+ -+ r.in.query_level = 1; - ZERO_STRUCT(return_auth); - - /* -@@ -2077,6 +2116,42 @@ bool test_netlogon_capabilities(struct dcerpc_pipe *p, struct torture_context *t - - *creds = tmp_creds; - -+ torture_assert(tctx, netlogon_creds_client_check(creds, -+ &r.out.return_authenticator->cred), -+ "Credential chaining failed"); -+ -+ torture_assert_int_equal(tctx, creds->negotiate_flags, -+ capabilities.server_capabilities, -+ "negotiate flags"); -+ -+ torture_comment(tctx, "Testing LogonGetCapabilities with query_level=2\n"); -+ -+ r.in.query_level = 2; -+ ZERO_STRUCT(return_auth); -+ -+ /* -+ * we need to operate on a temporary copy of creds -+ * because dcerpc_netr_LogonGetCapabilities with -+ * an query level 2 may returns DCERPC_NCA_S_FAULT_INVALID_TAG -+ * => NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE -+ * without looking a the authenticator. -+ */ -+ tmp_creds = *creds; -+ netlogon_creds_client_authenticator(&tmp_creds, &auth); -+ -+ status = dcerpc_netr_LogonGetCapabilities_r(b, tctx, &r); -+ if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE)) { -+ /* -+ * an server without KB5028166 returns -+ * DCERPC_NCA_S_FAULT_INVALID_TAG => -+ * NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE -+ */ -+ return true; -+ } -+ torture_assert_ntstatus_ok(tctx, status, "LogonGetCapabilities query_level=2 failed"); -+ -+ *creds = tmp_creds; -+ - torture_assert(tctx, netlogon_creds_client_check(creds, - &r.out.return_authenticator->cred), - "Credential chaining failed"); --- -2.41.0 - - -From d5f1097b6220676d56ed5fc6707acf667b704518 Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Sat, 15 Jul 2023 16:11:48 +0200 -Subject: [PATCH 3/4] s4:rpc_server:netlogon: generate FAULT_INVALID_TAG for - invalid netr_LogonGetCapabilities levels - -This is important as Windows clients with KB5028166 seem to -call netr_LogonGetCapabilities with query_level=2 after -a call with query_level=1. - -An unpatched Windows Server returns DCERPC_NCA_S_FAULT_INVALID_TAG -for query_level values other than 1. -While Samba tries to return NT_STATUS_NOT_SUPPORTED, but -later fails to marshall the response, which results -in DCERPC_FAULT_BAD_STUB_DATA instead. - -Because we don't have any documentation for level 2 yet, -we just try to behave like an unpatched server and -generate DCERPC_NCA_S_FAULT_INVALID_TAG instead of -DCERPC_FAULT_BAD_STUB_DATA. -Which allows patched Windows clients to keep working -against a Samba DC. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15418 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Andrew Bartlett ---- - .../knownfail.d/netr_LogonGetCapabilities | 2 -- - source4/rpc_server/netlogon/dcerpc_netlogon.c | 28 ++++++++++++++++--- - 2 files changed, 24 insertions(+), 6 deletions(-) - -diff --git a/selftest/knownfail.d/netr_LogonGetCapabilities b/selftest/knownfail.d/netr_LogonGetCapabilities -index 30aadf3bb9d..99c7ac711ed 100644 ---- a/selftest/knownfail.d/netr_LogonGetCapabilities -+++ b/selftest/knownfail.d/netr_LogonGetCapabilities -@@ -1,3 +1 @@ - ^samba3.rpc.schannel.*\.schannel\(nt4_dc --^samba3.rpc.schannel.*\.schannel\(ad_dc --^samba4.rpc.schannel.*\.schannel\(ad_dc -diff --git a/source4/rpc_server/netlogon/dcerpc_netlogon.c b/source4/rpc_server/netlogon/dcerpc_netlogon.c -index 6ccba65d3bf..dc2167f08b2 100644 ---- a/source4/rpc_server/netlogon/dcerpc_netlogon.c -+++ b/source4/rpc_server/netlogon/dcerpc_netlogon.c -@@ -2364,6 +2364,30 @@ static NTSTATUS dcesrv_netr_LogonGetCapabilities(struct dcesrv_call_state *dce_c - struct netlogon_creds_CredentialState *creds; - NTSTATUS status; - -+ switch (r->in.query_level) { -+ case 1: -+ break; -+ case 2: -+ /* -+ * Until we know the details behind KB5028166 -+ * just return DCERPC_NCA_S_FAULT_INVALID_TAG -+ * like an unpatched Windows Server. -+ */ -+ FALL_THROUGH; -+ default: -+ /* -+ * There would not be a way to marshall the -+ * the response. Which would mean our final -+ * ndr_push would fail an we would return -+ * an RPC-level fault with DCERPC_FAULT_BAD_STUB_DATA. -+ * -+ * But it's important to match a Windows server -+ * especially before KB5028166, see also our bug #15418 -+ * Otherwise Windows client would stop talking to us. -+ */ -+ DCESRV_FAULT(DCERPC_NCA_S_FAULT_INVALID_TAG); -+ } -+ - status = dcesrv_netr_creds_server_step_check(dce_call, - mem_ctx, - r->in.computer_name, -@@ -2375,10 +2399,6 @@ static NTSTATUS dcesrv_netr_LogonGetCapabilities(struct dcesrv_call_state *dce_c - } - NT_STATUS_NOT_OK_RETURN(status); - -- if (r->in.query_level != 1) { -- return NT_STATUS_NOT_SUPPORTED; -- } -- - r->out.capabilities->server_capabilities = creds->negotiate_flags; - - return NT_STATUS_OK; --- -2.41.0 - - -From dfeabce44fbb78083fbbb2aa634fc4172cf83db9 Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Sat, 15 Jul 2023 16:11:48 +0200 -Subject: [PATCH 4/4] s3:rpc_server:netlogon: generate FAULT_INVALID_TAG for - invalid netr_LogonGetCapabilities levels - -This is important as Windows clients with KB5028166 seem to -call netr_LogonGetCapabilities with query_level=2 after -a call with query_level=1. - -An unpatched Windows Server returns DCERPC_NCA_S_FAULT_INVALID_TAG -for query_level values other than 1. -While Samba tries to return NT_STATUS_NOT_SUPPORTED, but -later fails to marshall the response, which results -in DCERPC_FAULT_BAD_STUB_DATA instead. - -Because we don't have any documentation for level 2 yet, -we just try to behave like an unpatched server and -generate DCERPC_NCA_S_FAULT_INVALID_TAG instead of -DCERPC_FAULT_BAD_STUB_DATA. -Which allows patched Windows clients to keep working -against a Samba DC. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15418 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Andrew Bartlett - -Autobuild-User(master): Stefan Metzmacher -Autobuild-Date(master): Mon Jul 17 07:35:09 UTC 2023 on atb-devel-224 ---- - .../knownfail.d/netr_LogonGetCapabilities | 1 - - source3/rpc_server/netlogon/srv_netlog_nt.c | 29 ++++++++++++++++--- - 2 files changed, 25 insertions(+), 5 deletions(-) - delete mode 100644 selftest/knownfail.d/netr_LogonGetCapabilities - -diff --git a/selftest/knownfail.d/netr_LogonGetCapabilities b/selftest/knownfail.d/netr_LogonGetCapabilities -deleted file mode 100644 -index 99c7ac711ed..00000000000 ---- a/selftest/knownfail.d/netr_LogonGetCapabilities -+++ /dev/null -@@ -1 +0,0 @@ --^samba3.rpc.schannel.*\.schannel\(nt4_dc -diff --git a/source3/rpc_server/netlogon/srv_netlog_nt.c b/source3/rpc_server/netlogon/srv_netlog_nt.c -index 3ba58e61206..e8aa14167fc 100644 ---- a/source3/rpc_server/netlogon/srv_netlog_nt.c -+++ b/source3/rpc_server/netlogon/srv_netlog_nt.c -@@ -2284,6 +2284,31 @@ NTSTATUS _netr_LogonGetCapabilities(struct pipes_struct *p, - struct netlogon_creds_CredentialState *creds; - NTSTATUS status; - -+ switch (r->in.query_level) { -+ case 1: -+ break; -+ case 2: -+ /* -+ * Until we know the details behind KB5028166 -+ * just return DCERPC_NCA_S_FAULT_INVALID_TAG -+ * like an unpatched Windows Server. -+ */ -+ FALL_THROUGH; -+ default: -+ /* -+ * There would not be a way to marshall the -+ * the response. Which would mean our final -+ * ndr_push would fail an we would return -+ * an RPC-level fault with DCERPC_FAULT_BAD_STUB_DATA. -+ * -+ * But it's important to match a Windows server -+ * especially before KB5028166, see also our bug #15418 -+ * Otherwise Windows client would stop talking to us. -+ */ -+ p->fault_state = DCERPC_NCA_S_FAULT_INVALID_TAG; -+ return NT_STATUS_NOT_SUPPORTED; -+ } -+ - become_root(); - status = dcesrv_netr_creds_server_step_check(p->dce_call, - p->mem_ctx, -@@ -2296,10 +2321,6 @@ NTSTATUS _netr_LogonGetCapabilities(struct pipes_struct *p, - return status; - } - -- if (r->in.query_level != 1) { -- return NT_STATUS_NOT_SUPPORTED; -- } -- - r->out.capabilities->server_capabilities = creds->negotiate_flags; - - return NT_STATUS_OK; --- -2.41.0 - diff --git a/samba.spec b/samba.spec index 4bbddfc..115d603 100644 --- a/samba.spec +++ b/samba.spec @@ -137,8 +137,8 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.18.4 -%global baserelease 3 +%global samba_version 4.18.5 +%global baserelease 0 # This should be rc1 or %%nil %global pre_release %nil @@ -234,8 +234,6 @@ Source17: samba-usershares-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore -Patch0: master-netlogongetcaps.patch - Requires(pre): /usr/sbin/groupadd Requires(pre): %{name}-common = %{samba_depver} @@ -4335,6 +4333,14 @@ fi %endif %changelog +* Thu Jul 20 2023 Guenther Deschner - 4.18.5-0 +- resolves: #2224040 - Update to version 4.18.5 +- resolves: #2222791, #2224254 - Security fix for CVE-2022-2127 +- resolves: #2222792, #2224255 - Security fix for CVE-2023-3347 +- resolves: #2222793, #2224253 - Security fix for CVE-2023-34966 +- resolves: #2222794, #2224252 - Security fix for CVE-2023-34967 +- resolves: #2222795, #2224250 - Security fix for CVE-2023-34968 + * Sat Jul 15 2023 Guenther Deschner - 4.18.4-3 - resolves: #2223091 - Fix netlogon LogonGetCapabilities level 2 error handling diff --git a/sources b/sources index e1b7b1c..d77b19c 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.18.4.tar.xz) = 9b9ed3111e8c1f8fbb990e2cf78bdd00bbe03e79247ec87a3ee51744acfbc6692f110dc88ccb1049b7d9c6aaa8fd6ba3ab4acd7ad0480dbb9df8b61980c0da83 -SHA512 (samba-4.18.4.tar.asc) = bc13d14b8da6a05494a79b8a8fb35fc27670f7ab8609eaeb3f3df49dd04bdb1389e77c2d571db5efcdd85532971c423eb977d46c2a5cbee3daadd6c6eca721ec +SHA512 (samba-4.18.5.tar.xz) = 3e405731813d5b0937e6c16938c6dcf8e182dafd29010dc75711afc397a63ee459fda04e78ff24e31fa0efd213e25a7e6c214a5bdf82d4d0f0123f2c6a8ebdd6 +SHA512 (samba-4.18.5.tar.asc) = 29b541a95dc565e541526a9aeecff5d4df4e7df38c5c00ec8cc848b13c683c0d0c7dee442ab1a2d03e0f88b960cec7fb5a2cb8ea44c53ce29c858f5a058e7f84 From ef6e3a1cfe3e80c77abdec5f34baa0c141224156 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 7 Aug 2023 00:27:40 +0200 Subject: [PATCH 278/425] Update to version 4.19.0rc1 resolves: #2227246 Guenther --- .gitignore | 2 + samba.spec | 140 ++++++++++++++++++++++++++++++++++++++++++++++++----- sources | 4 +- 3 files changed, 133 insertions(+), 13 deletions(-) diff --git a/.gitignore b/.gitignore index 7d7069f..bea983c 100644 --- a/.gitignore +++ b/.gitignore @@ -337,3 +337,5 @@ samba-3.6.0pre1.tar.gz /samba-4.18.4.tar.asc /samba-4.18.5.tar.xz /samba-4.18.5.tar.asc +/samba-4.19.0rc1.tar.xz +/samba-4.19.0rc1.tar.asc diff --git a/samba.spec b/samba.spec index 115d603..b4cc800 100644 --- a/samba.spec +++ b/samba.spec @@ -137,10 +137,10 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.18.5 +%global samba_version 4.19.0 %global baserelease 0 # This should be rc1 or %%nil -%global pre_release %nil +%global pre_release rc1 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -171,10 +171,10 @@ %global libsmbclient_so_version 0 %global libwbclient_so_version 0 -%global talloc_version 2.4.0 -%global tdb_version 1.4.8 -%global tevent_version 0.14.1 -%global ldb_version 2.7.2 +%global talloc_version 2.4.1 +%global tdb_version 1.4.9 +%global tevent_version 0.15.0 +%global ldb_version 2.8.0 %global required_mit_krb5 1.20.1 @@ -1798,7 +1798,6 @@ fi %{_mandir}/man1/smbclient.1* %{_mandir}/man1/smbcquotas.1* %{_mandir}/man1/smbget.1* -%{_mandir}/man5/smbgetrc.5* %{_mandir}/man1/smbtar.1* %{_mandir}/man1/smbtree.1* %{_mandir}/man7/traffic_learner.7.* @@ -1856,10 +1855,12 @@ fi %{_libdir}/samba/libMESSAGING-SEND-samba4.so %{_libdir}/samba/libMESSAGING-samba4.so %{_libdir}/samba/libaddns-samba4.so +%{_libdir}/samba/libad-claims-samba4.so %{_libdir}/samba/libads-samba4.so %{_libdir}/samba/libasn1util-samba4.so %{_libdir}/samba/libauth-samba4.so %{_libdir}/samba/libauthkrb5-samba4.so +%{_libdir}/samba/libauthn-policy-util-samba4.so %{_libdir}/samba/libcli-cldap-samba4.so %{_libdir}/samba/libcli-ldap-common-samba4.so %{_libdir}/samba/libcli-ldap-samba4.so @@ -2005,10 +2006,12 @@ fi %{_bindir}/net %{_bindir}/pdbedit %{_bindir}/profiles +%{_bindir}/samba-log-parser %{_bindir}/smbcontrol %{_bindir}/smbpasswd %{_bindir}/testparm %{_mandir}/man1/profiles.1* +%{_mandir}/man1/samba-log-parser.1* %{_mandir}/man1/smbcontrol.1* %{_mandir}/man1/testparm.1* %{_mandir}/man8/net.8* @@ -2447,6 +2450,7 @@ fi %{python3_sitearch}/samba/__pycache__/descriptor.*.pyc %{python3_sitearch}/samba/__pycache__/dnsresolver.*.pyc %{python3_sitearch}/samba/__pycache__/drs_utils.*.pyc +%{python3_sitearch}/samba/__pycache__/functional_level.*.pyc %{python3_sitearch}/samba/__pycache__/getopt.*.pyc %{python3_sitearch}/samba/__pycache__/graph.*.pyc %{python3_sitearch}/samba/__pycache__/hostconfig.*.pyc @@ -2458,6 +2462,7 @@ fi %{python3_sitearch}/samba/__pycache__/ms_schema.*.pyc %{python3_sitearch}/samba/__pycache__/ndr.*.pyc %{python3_sitearch}/samba/__pycache__/ntacls.*.pyc +%{python3_sitearch}/samba/__pycache__/policies.*.pyc %{python3_sitearch}/samba/__pycache__/safe_tarfile.*.pyc %{python3_sitearch}/samba/__pycache__/sd_utils.*.pyc %{python3_sitearch}/samba/__pycache__/sites.*.pyc @@ -2527,6 +2532,7 @@ fi %{python3_sitearch}/samba/drs_utils.py %{python3_sitearch}/samba/dsdb.*.so %{python3_sitearch}/samba/dsdb_dns.*.so +%{python3_sitearch}/samba/functional_level.py %{python3_sitearch}/samba/gensec.*.so %{python3_sitearch}/samba/getopt.py %{python3_sitearch}/samba/graph.py @@ -2549,6 +2555,8 @@ fi %{python3_sitearch}/samba/emulate/traffic_packets.py %dir %{python3_sitearch}/samba/gp %dir %{python3_sitearch}/samba/gp/__pycache__ +%{python3_sitearch}/samba/gp/__init__.py +%{python3_sitearch}/samba/gp/__pycache__/__init__.*.pyc %{python3_sitearch}/samba/gp/__pycache__/gpclass.*.pyc %{python3_sitearch}/samba/gp/__pycache__/gp_centrify_crontab_ext.*.pyc %{python3_sitearch}/samba/gp/__pycache__/gp_centrify_sudoers_ext.*.pyc @@ -2627,12 +2635,12 @@ fi %{python3_sitearch}/samba/netcmd/__pycache__/dbcheck.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/delegation.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/dns.*.pyc -%{python3_sitearch}/samba/netcmd/__pycache__/domain.*.pyc -%{python3_sitearch}/samba/netcmd/__pycache__/domain_backup.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/drs.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/dsacl.*.pyc +%{python3_sitearch}/samba/netcmd/__pycache__/encoders.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/forest.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/fsmo.*.pyc +%{python3_sitearch}/samba/netcmd/__pycache__/gpcommon.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/gpo.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/group.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/ldapcmp.*.pyc @@ -2648,19 +2656,102 @@ fi %{python3_sitearch}/samba/netcmd/__pycache__/spn.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/testparm.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/user.*.pyc +%{python3_sitearch}/samba/netcmd/__pycache__/validators.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/visualize.*.pyc %{python3_sitearch}/samba/netcmd/common.py %{python3_sitearch}/samba/netcmd/computer.py %{python3_sitearch}/samba/netcmd/contact.py %{python3_sitearch}/samba/netcmd/dbcheck.py %{python3_sitearch}/samba/netcmd/delegation.py +%dir %{python3_sitearch}/samba/netcmd/domain +%{python3_sitearch}/samba/netcmd/domain/__init__.py +%dir %{python3_sitearch}/samba/netcmd/domain/__pycache__ +%{python3_sitearch}/samba/netcmd/domain/__pycache__/__init__.*.pyc +%{python3_sitearch}/samba/netcmd/domain/__pycache__/backup.*.pyc +%{python3_sitearch}/samba/netcmd/domain/__pycache__/classicupgrade.*.pyc +%{python3_sitearch}/samba/netcmd/domain/__pycache__/common.*.pyc +%{python3_sitearch}/samba/netcmd/domain/__pycache__/dcpromo.*.pyc +%{python3_sitearch}/samba/netcmd/domain/__pycache__/demote.*.pyc +%{python3_sitearch}/samba/netcmd/domain/__pycache__/functional_prep.*.pyc +%{python3_sitearch}/samba/netcmd/domain/__pycache__/info.*.pyc +%{python3_sitearch}/samba/netcmd/domain/__pycache__/join.*.pyc +%{python3_sitearch}/samba/netcmd/domain/__pycache__/keytab.*.pyc +%{python3_sitearch}/samba/netcmd/domain/__pycache__/leave.*.pyc +%{python3_sitearch}/samba/netcmd/domain/__pycache__/level.*.pyc +%{python3_sitearch}/samba/netcmd/domain/__pycache__/passwordsettings.*.pyc +%{python3_sitearch}/samba/netcmd/domain/__pycache__/provision.*.pyc +%{python3_sitearch}/samba/netcmd/domain/__pycache__/samba3upgrade.*.pyc +%{python3_sitearch}/samba/netcmd/domain/__pycache__/schemaupgrade.*.pyc +%{python3_sitearch}/samba/netcmd/domain/__pycache__/tombstones.*.pyc +%{python3_sitearch}/samba/netcmd/domain/__pycache__/trust.*.pyc +%dir %{python3_sitearch}/samba/netcmd/domain/auth +%{python3_sitearch}/samba/netcmd/domain/auth/__init__.py +%dir %{python3_sitearch}/samba/netcmd/domain/auth/__pycache__ +%{python3_sitearch}/samba/netcmd/domain/auth/__pycache__/__init__.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/__pycache__/policy.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/__pycache__/silo.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/__pycache__/silo_member.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/policy.py +%{python3_sitearch}/samba/netcmd/domain/auth/silo.py +%{python3_sitearch}/samba/netcmd/domain/auth/silo_member.py +%{python3_sitearch}/samba/netcmd/domain/backup.py +%dir %{python3_sitearch}/samba/netcmd/domain/claim +%{python3_sitearch}/samba/netcmd/domain/claim/__init__.py +%dir %{python3_sitearch}/samba/netcmd/domain/claim/__pycache__ +%{python3_sitearch}/samba/netcmd/domain/claim/__pycache__/__init__.*.pyc +%{python3_sitearch}/samba/netcmd/domain/claim/__pycache__/claim_type.*.pyc +%{python3_sitearch}/samba/netcmd/domain/claim/__pycache__/value_type.*.pyc +%{python3_sitearch}/samba/netcmd/domain/claim/claim_type.py +%{python3_sitearch}/samba/netcmd/domain/claim/value_type.py +%{python3_sitearch}/samba/netcmd/domain/classicupgrade.py +%{python3_sitearch}/samba/netcmd/domain/common.py +%{python3_sitearch}/samba/netcmd/domain/dcpromo.py +%{python3_sitearch}/samba/netcmd/domain/demote.py +%{python3_sitearch}/samba/netcmd/domain/functional_prep.py +%{python3_sitearch}/samba/netcmd/domain/info.py +%{python3_sitearch}/samba/netcmd/domain/join.py +%{python3_sitearch}/samba/netcmd/domain/keytab.py +%{python3_sitearch}/samba/netcmd/domain/leave.py +%{python3_sitearch}/samba/netcmd/domain/level.py +%dir %{python3_sitearch}/samba/netcmd/domain/models +%{python3_sitearch}/samba/netcmd/domain/models/__init__.py +%dir %{python3_sitearch}/samba/netcmd/domain/models/__pycache__ +%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/__init__.*.pyc +%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/auth_policy.*.pyc +%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/auth_silo.*.pyc +%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/claim_type.*.pyc +%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/exceptions.*.pyc +%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/fields.*.pyc +%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/model.*.pyc +%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/schema.*.pyc +%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/site.*.pyc +%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/subnet.*.pyc +%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/user.*.pyc +%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/value_type.*.pyc +%{python3_sitearch}/samba/netcmd/domain/models/auth_policy.py +%{python3_sitearch}/samba/netcmd/domain/models/auth_silo.py +%{python3_sitearch}/samba/netcmd/domain/models/claim_type.py +%{python3_sitearch}/samba/netcmd/domain/models/exceptions.py +%{python3_sitearch}/samba/netcmd/domain/models/fields.py +%{python3_sitearch}/samba/netcmd/domain/models/model.py +%{python3_sitearch}/samba/netcmd/domain/models/schema.py +%{python3_sitearch}/samba/netcmd/domain/models/site.py +%{python3_sitearch}/samba/netcmd/domain/models/subnet.py +%{python3_sitearch}/samba/netcmd/domain/models/user.py +%{python3_sitearch}/samba/netcmd/domain/models/value_type.py +%{python3_sitearch}/samba/netcmd/domain/passwordsettings.py +%{python3_sitearch}/samba/netcmd/domain/provision.py +%{python3_sitearch}/samba/netcmd/domain/samba3upgrade.py +%{python3_sitearch}/samba/netcmd/domain/schemaupgrade.py +%{python3_sitearch}/samba/netcmd/domain/tombstones.py +%{python3_sitearch}/samba/netcmd/domain/trust.py %{python3_sitearch}/samba/netcmd/dns.py -%{python3_sitearch}/samba/netcmd/domain.py -%{python3_sitearch}/samba/netcmd/domain_backup.py %{python3_sitearch}/samba/netcmd/drs.py %{python3_sitearch}/samba/netcmd/dsacl.py +%{python3_sitearch}/samba/netcmd/encoders.py %{python3_sitearch}/samba/netcmd/forest.py %{python3_sitearch}/samba/netcmd/fsmo.py +%{python3_sitearch}/samba/netcmd/gpcommon.py %{python3_sitearch}/samba/netcmd/gpo.py %{python3_sitearch}/samba/netcmd/group.py %{python3_sitearch}/samba/netcmd/ldapcmp.py @@ -2676,9 +2767,11 @@ fi %{python3_sitearch}/samba/netcmd/spn.py %{python3_sitearch}/samba/netcmd/testparm.py %{python3_sitearch}/samba/netcmd/user.py +%{python3_sitearch}/samba/netcmd/validators.py %{python3_sitearch}/samba/netcmd/visualize.py %{python3_sitearch}/samba/ntacls.py %{python3_sitearch}/samba/param.*.so +%{python3_sitearch}/samba/policies.py %{python3_sitearch}/samba/policy.*.so %{python3_sitearch}/samba/registry.*.so %{python3_sitearch}/samba/reparse_symlink.*.so @@ -2855,6 +2948,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/ldap_referrals.*.pyc %{python3_sitearch}/samba/tests/__pycache__/ldap_spn.*.pyc %{python3_sitearch}/samba/tests/__pycache__/ldap_upn_sam_account.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/ldap_whoami.*.pyc %{python3_sitearch}/samba/tests/__pycache__/loadparm.*.pyc %{python3_sitearch}/samba/tests/__pycache__/logfiles.*.pyc %{python3_sitearch}/samba/tests/__pycache__/libsmb.*.pyc @@ -2902,6 +2996,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/s3_net_join.*.pyc %{python3_sitearch}/samba/tests/__pycache__/safe_tarfile.*.pyc %{python3_sitearch}/samba/tests/__pycache__/samba_upgradedns_lmdb.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/samba_startup_fl_change.*.pyc %{python3_sitearch}/samba/tests/__pycache__/samba3sam.*.pyc %{python3_sitearch}/samba/tests/__pycache__/samdb.*.pyc %{python3_sitearch}/samba/tests/__pycache__/samdb_api.*.pyc @@ -3084,8 +3179,11 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/alias_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/as_canonicalization_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/as_req_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/authn_policy_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/claims_in_pac.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/claims_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/compatability_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/device_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/etype_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/fast_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/group_tests.*.pyc @@ -3098,6 +3196,7 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/ms_kile_client_principal_lookup_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/nt_hash_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/pac_align_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/pkinit_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/protected_users_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/raw_testcase.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/rfc4120_constants.*.pyc @@ -3117,8 +3216,11 @@ fi %{python3_sitearch}/samba/tests/krb5/alias_tests.py %{python3_sitearch}/samba/tests/krb5/as_canonicalization_tests.py %{python3_sitearch}/samba/tests/krb5/as_req_tests.py +%{python3_sitearch}/samba/tests/krb5/authn_policy_tests.py +%{python3_sitearch}/samba/tests/krb5/claims_in_pac.py %{python3_sitearch}/samba/tests/krb5/claims_tests.py %{python3_sitearch}/samba/tests/krb5/compatability_tests.py +%{python3_sitearch}/samba/tests/krb5/device_tests.py %{python3_sitearch}/samba/tests/krb5/etype_tests.py %{python3_sitearch}/samba/tests/krb5/fast_tests.py %{python3_sitearch}/samba/tests/krb5/group_tests.py @@ -3131,6 +3233,7 @@ fi %{python3_sitearch}/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py %{python3_sitearch}/samba/tests/krb5/nt_hash_tests.py %{python3_sitearch}/samba/tests/krb5/pac_align_tests.py +%{python3_sitearch}/samba/tests/krb5/pkinit_tests.py %{python3_sitearch}/samba/tests/krb5/protected_users_tests.py %{python3_sitearch}/samba/tests/krb5/raw_testcase.py %{python3_sitearch}/samba/tests/krb5/rfc4120_constants.py @@ -3152,6 +3255,7 @@ fi %{python3_sitearch}/samba/tests/ldap_spn.py %{python3_sitearch}/samba/tests/ldap_referrals.py %{python3_sitearch}/samba/tests/ldap_upn_sam_account.py +%{python3_sitearch}/samba/tests/ldap_whoami.py %{python3_sitearch}/samba/tests/libsmb.py %{python3_sitearch}/samba/tests/libsmb-basic.py %{python3_sitearch}/samba/tests/loadparm.py @@ -3199,6 +3303,7 @@ fi %{python3_sitearch}/samba/tests/s3_net_join.py %{python3_sitearch}/samba/tests/safe_tarfile.py %{python3_sitearch}/samba/tests/samba3sam.py +%{python3_sitearch}/samba/tests/samba_startup_fl_change.py %{python3_sitearch}/samba/tests/samba_upgradedns_lmdb.py %dir %{python3_sitearch}/samba/tests/samba_tool %{python3_sitearch}/samba/tests/samba_tool/__init__.py @@ -3209,6 +3314,11 @@ fi %{python3_sitearch}/samba/tests/samba_tool/__pycache__/contact.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/demote.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/dnscmd.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/domain_auth_base.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/domain_auth_policy.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/domain_auth_silo.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/domain_claim.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/domain_models.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/drs_clone_dc_data_lmdb_size.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/dsacl.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/forest.*.pyc @@ -3246,6 +3356,11 @@ fi %{python3_sitearch}/samba/tests/samba_tool/contact.py %{python3_sitearch}/samba/tests/samba_tool/demote.py %{python3_sitearch}/samba/tests/samba_tool/dnscmd.py +%{python3_sitearch}/samba/tests/samba_tool/domain_auth_base.py +%{python3_sitearch}/samba/tests/samba_tool/domain_auth_policy.py +%{python3_sitearch}/samba/tests/samba_tool/domain_auth_silo.py +%{python3_sitearch}/samba/tests/samba_tool/domain_claim.py +%{python3_sitearch}/samba/tests/samba_tool/domain_models.py %{python3_sitearch}/samba/tests/samba_tool/drs_clone_dc_data_lmdb_size.py %{python3_sitearch}/samba/tests/samba_tool/dsacl.py %{python3_sitearch}/samba/tests/samba_tool/forest.py @@ -4333,6 +4448,9 @@ fi %endif %changelog +* Mon Aug 07 2023 Guenther Deschner - 4.19.0rc1-0 +- resolves: #2227246 - Update to version 4.19.0rc1 + * Thu Jul 20 2023 Guenther Deschner - 4.18.5-0 - resolves: #2224040 - Update to version 4.18.5 - resolves: #2222791, #2224254 - Security fix for CVE-2022-2127 diff --git a/sources b/sources index d77b19c..4600e2c 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.18.5.tar.xz) = 3e405731813d5b0937e6c16938c6dcf8e182dafd29010dc75711afc397a63ee459fda04e78ff24e31fa0efd213e25a7e6c214a5bdf82d4d0f0123f2c6a8ebdd6 -SHA512 (samba-4.18.5.tar.asc) = 29b541a95dc565e541526a9aeecff5d4df4e7df38c5c00ec8cc848b13c683c0d0c7dee442ab1a2d03e0f88b960cec7fb5a2cb8ea44c53ce29c858f5a058e7f84 +SHA512 (samba-4.19.0rc1.tar.xz) = ba1b7616843cd6157e845b48b03260e36474159c7c9dbdd1a131fe158bf737928df9d4233a61ca5168ef582912807c4ada9a642124221385217ddbd8eb10995a +SHA512 (samba-4.19.0rc1.tar.asc) = 1b1f7389f3638d0c6892dbe0c708ad15032e9a88a7c55a8f74e93d39191d3079c1305c40568a67bb68f293a1677e28b2445b7ef347bf541f1e6cf2301907d994 From 9602a07a36b5fbe33eca0c55c883b1a163ac2f64 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 8 Aug 2023 11:06:00 +0200 Subject: [PATCH 279/425] Update to version 4.19.0rc2 resolves: #2227246 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index bea983c..0b30322 100644 --- a/.gitignore +++ b/.gitignore @@ -339,3 +339,5 @@ samba-3.6.0pre1.tar.gz /samba-4.18.5.tar.asc /samba-4.19.0rc1.tar.xz /samba-4.19.0rc1.tar.asc +/samba-4.19.0rc2.tar.xz +/samba-4.19.0rc2.tar.asc diff --git a/samba.spec b/samba.spec index b4cc800..7b550f2 100644 --- a/samba.spec +++ b/samba.spec @@ -138,9 +138,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.19.0 -%global baserelease 0 +%global baserelease 1 # This should be rc1 or %%nil -%global pre_release rc1 +%global pre_release rc2 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4448,6 +4448,9 @@ fi %endif %changelog +* Tue Aug 08 2023 Guenther Deschner - 4.19.0rc2-1 +- resolves: #2227246 - Update to version 4.19.0rc2 + * Mon Aug 07 2023 Guenther Deschner - 4.19.0rc1-0 - resolves: #2227246 - Update to version 4.19.0rc1 diff --git a/sources b/sources index 4600e2c..66da186 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.19.0rc1.tar.xz) = ba1b7616843cd6157e845b48b03260e36474159c7c9dbdd1a131fe158bf737928df9d4233a61ca5168ef582912807c4ada9a642124221385217ddbd8eb10995a -SHA512 (samba-4.19.0rc1.tar.asc) = 1b1f7389f3638d0c6892dbe0c708ad15032e9a88a7c55a8f74e93d39191d3079c1305c40568a67bb68f293a1677e28b2445b7ef347bf541f1e6cf2301907d994 +SHA512 (samba-4.19.0rc2.tar.xz) = ef521a17a8d407432fe5b74fbbdeb6f61ade04488378591741603935154f975ea7f5ccdbfe11a6dc3a05f3e5e1d767d0cf7c9a82cfb6252d145845f7110ecca7 +SHA512 (samba-4.19.0rc2.tar.asc) = e8b2f909da5aefa65c03a02295638168adc9182d7ab930805ca83f03a3c5f5800c2ee7b4a66c3d1cee09fec3e78eb6df634e64ee945fb4b018780b19e3239170 From dc22ad5bd221318a8234264c80aa9146a82475fb Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Tue, 15 Aug 2023 13:08:22 -0700 Subject: [PATCH 280/425] python3-samba-dc requires python3-markdown now --- samba.spec | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 7b550f2..635f24b 100644 --- a/samba.spec +++ b/samba.spec @@ -138,7 +138,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.19.0 -%global baserelease 1 +%global baserelease 2 # This should be rc1 or %%nil %global pre_release rc2 @@ -898,6 +898,8 @@ Summary: Samba Python libraries for Samba AD Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-dc-libs = %{samba_depver} Requires: python3-%{name} = %{samba_depver} +# for ms_forest_updates_markdown.py and ms_schema_markdown.py +Requires: python3-markdown %description -n python3-samba-dc The python3-%{name}-dc package contains the Python libraries needed by programs @@ -4448,10 +4450,13 @@ fi %endif %changelog -* Tue Aug 08 2023 Guenther Deschner - 4.19.0rc2-1 +* Tue Aug 15 2023 Adam Williamson - 4.19.0-0.2.rc2 +- python3-samba-dc requires python3-markdown now + +* Tue Aug 08 2023 Guenther Deschner - 4.19.0-0.1.rc2 - resolves: #2227246 - Update to version 4.19.0rc2 -* Mon Aug 07 2023 Guenther Deschner - 4.19.0rc1-0 +* Mon Aug 07 2023 Guenther Deschner - 4.19.0-0.0.rc1 - resolves: #2227246 - Update to version 4.19.0rc1 * Thu Jul 20 2023 Guenther Deschner - 4.18.5-0 From 070d655da4015e4585c108220da59db7013af485 Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Wed, 16 Aug 2023 01:48:56 -0400 Subject: [PATCH 281/425] Move ad-claims and authn-policy-util to dc-libs These libraries depend on libdsdb-module and are only built if DC is enabled (and therefore not for RHEL). --- samba.spec | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 635f24b..65cd11d 100644 --- a/samba.spec +++ b/samba.spec @@ -138,7 +138,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.19.0 -%global baserelease 2 +%global baserelease 3 # This should be rc1 or %%nil %global pre_release rc2 @@ -1857,12 +1857,10 @@ fi %{_libdir}/samba/libMESSAGING-SEND-samba4.so %{_libdir}/samba/libMESSAGING-samba4.so %{_libdir}/samba/libaddns-samba4.so -%{_libdir}/samba/libad-claims-samba4.so %{_libdir}/samba/libads-samba4.so %{_libdir}/samba/libasn1util-samba4.so %{_libdir}/samba/libauth-samba4.so %{_libdir}/samba/libauthkrb5-samba4.so -%{_libdir}/samba/libauthn-policy-util-samba4.so %{_libdir}/samba/libcli-cldap-samba4.so %{_libdir}/samba/libcli-ldap-common-samba4.so %{_libdir}/samba/libcli-ldap-samba4.so @@ -2157,6 +2155,8 @@ fi %endif %{_libdir}/libdcerpc-server.so.* +%{_libdir}/samba/libad-claims-samba4.so +%{_libdir}/samba/libauthn-policy-util-samba4.so %{_libdir}/samba/libdsdb-module-samba4.so %{_libdir}/samba/libdsdb-garbage-collect-tombstones-samba4.so %{_libdir}/samba/libscavenge-dns-records-samba4.so @@ -4450,6 +4450,9 @@ fi %endif %changelog +* Wed Aug 16 2023 Yaakov Selkowitz - 2:4.19.0-0.3.rc2 +- Move ad-claims and authn-policy-util to dc-libs + * Tue Aug 15 2023 Adam Williamson - 4.19.0-0.2.rc2 - python3-samba-dc requires python3-markdown now From 7837b083f245cf91f37c9ba9673c80801b5dc8a0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 18 Aug 2023 15:27:59 +0200 Subject: [PATCH 282/425] Update to version 4.19.0rc3 resolves: #2232744 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 0b30322..e848165 100644 --- a/.gitignore +++ b/.gitignore @@ -341,3 +341,5 @@ samba-3.6.0pre1.tar.gz /samba-4.19.0rc1.tar.asc /samba-4.19.0rc2.tar.xz /samba-4.19.0rc2.tar.asc +/samba-4.19.0rc3.tar.xz +/samba-4.19.0rc3.tar.asc diff --git a/samba.spec b/samba.spec index 65cd11d..bdb65eb 100644 --- a/samba.spec +++ b/samba.spec @@ -138,9 +138,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.19.0 -%global baserelease 3 +%global baserelease 4 # This should be rc1 or %%nil -%global pre_release rc2 +%global pre_release rc3 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4450,6 +4450,9 @@ fi %endif %changelog +* Fri Aug 18 2023 Guenther Deschner - 4.19.0-0.4.rc3 +- resolves: #2232744 - Update to version 4.19.0rc3 + * Wed Aug 16 2023 Yaakov Selkowitz - 2:4.19.0-0.3.rc2 - Move ad-claims and authn-policy-util to dc-libs diff --git a/sources b/sources index 66da186..4795247 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.19.0rc2.tar.xz) = ef521a17a8d407432fe5b74fbbdeb6f61ade04488378591741603935154f975ea7f5ccdbfe11a6dc3a05f3e5e1d767d0cf7c9a82cfb6252d145845f7110ecca7 -SHA512 (samba-4.19.0rc2.tar.asc) = e8b2f909da5aefa65c03a02295638168adc9182d7ab930805ca83f03a3c5f5800c2ee7b4a66c3d1cee09fec3e78eb6df634e64ee945fb4b018780b19e3239170 +SHA512 (samba-4.19.0rc3.tar.xz) = 0304e09b7c6a1afab3d0e3a206a7204a784d9c82e3d77e5174c585b45b193165fa4ccaa7b931cd92210fcd8e4e58b16eb913e3cf507b4e28e646a6ff0dd9c83d +SHA512 (samba-4.19.0rc3.tar.asc) = 3ada9012744d63e41472e4683eef991e7565fec07116cf476f7cb8b573b6171bf68f8fe55127857c216db92ce1e8e5ba52dfb93ef66c927798b5495ba0ecc6f5 From 38db6815581db7214d926bd9bf1f261716e171eb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 28 Aug 2023 16:59:29 +0200 Subject: [PATCH 283/425] Update to version 4.19.0rc4 resolves: #2232744 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index e848165..8607d71 100644 --- a/.gitignore +++ b/.gitignore @@ -343,3 +343,5 @@ samba-3.6.0pre1.tar.gz /samba-4.19.0rc2.tar.asc /samba-4.19.0rc3.tar.xz /samba-4.19.0rc3.tar.asc +/samba-4.19.0rc4.tar.xz +/samba-4.19.0rc4.tar.asc diff --git a/samba.spec b/samba.spec index bdb65eb..a760de9 100644 --- a/samba.spec +++ b/samba.spec @@ -138,9 +138,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.19.0 -%global baserelease 4 +%global baserelease 5 # This should be rc1 or %%nil -%global pre_release rc3 +%global pre_release rc4 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4450,6 +4450,9 @@ fi %endif %changelog +* Mon Aug 28 2023 Guenther Deschner - 4.19.0-0.5.rc4 +- resolves: #2232744 - Update to version 4.19.0rc4 + * Fri Aug 18 2023 Guenther Deschner - 4.19.0-0.4.rc3 - resolves: #2232744 - Update to version 4.19.0rc3 diff --git a/sources b/sources index 4795247..3a0c8fe 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.19.0rc3.tar.xz) = 0304e09b7c6a1afab3d0e3a206a7204a784d9c82e3d77e5174c585b45b193165fa4ccaa7b931cd92210fcd8e4e58b16eb913e3cf507b4e28e646a6ff0dd9c83d -SHA512 (samba-4.19.0rc3.tar.asc) = 3ada9012744d63e41472e4683eef991e7565fec07116cf476f7cb8b573b6171bf68f8fe55127857c216db92ce1e8e5ba52dfb93ef66c927798b5495ba0ecc6f5 +SHA512 (samba-4.19.0rc4.tar.xz) = 5215127dab4f9a4a5cacfb1d6e236f37e6625552995690a20f1d01533d30858204a25bc4e9839e9f15f1585b3fc403e2bf6f1b4b1a89a1fd4d9f72b3026d5691 +SHA512 (samba-4.19.0rc4.tar.asc) = 9cc262fefae703d56740d3878ed3863c42d1c005c994adcbd4538ed3704cb89e882955869690c126089bffd3948e259f20382bee4ee8326d2c386c5843153aea From 43d90c91754455ff88e7d5d28c80ce4fff706456 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 4 Sep 2023 15:20:35 +0200 Subject: [PATCH 284/425] Update to version 4.19.0 resolves: #2237259 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 8607d71..279c4a2 100644 --- a/.gitignore +++ b/.gitignore @@ -345,3 +345,5 @@ samba-3.6.0pre1.tar.gz /samba-4.19.0rc3.tar.asc /samba-4.19.0rc4.tar.xz /samba-4.19.0rc4.tar.asc +/samba-4.19.0.tar.xz +/samba-4.19.0.tar.asc diff --git a/samba.spec b/samba.spec index a760de9..1bef008 100644 --- a/samba.spec +++ b/samba.spec @@ -138,9 +138,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.19.0 -%global baserelease 5 +%global baserelease 1 # This should be rc1 or %%nil -%global pre_release rc4 +%global pre_release %nil %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4450,6 +4450,9 @@ fi %endif %changelog +* Mon Sep 04 2023 Guenther Deschner - 4.19.0-1 +- resolves: #2237259 - Update to version 4.19.0 + * Mon Aug 28 2023 Guenther Deschner - 4.19.0-0.5.rc4 - resolves: #2232744 - Update to version 4.19.0rc4 diff --git a/sources b/sources index 3a0c8fe..a802550 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.19.0rc4.tar.xz) = 5215127dab4f9a4a5cacfb1d6e236f37e6625552995690a20f1d01533d30858204a25bc4e9839e9f15f1585b3fc403e2bf6f1b4b1a89a1fd4d9f72b3026d5691 -SHA512 (samba-4.19.0rc4.tar.asc) = 9cc262fefae703d56740d3878ed3863c42d1c005c994adcbd4538ed3704cb89e882955869690c126089bffd3948e259f20382bee4ee8326d2c386c5843153aea +SHA512 (samba-4.19.0.tar.xz) = a82347b496bb092ced6e4a25e5405ce0c5da40b0a4363e1e5f0cc295c7693d863bcd8d30b0da6d2a99c5525dc01e3a65c524ca832dc6d7e055f2c0ab264f7ae6 +SHA512 (samba-4.19.0.tar.asc) = 75dda279cc07db2a3a79fd4abd99db9383ca5d008d586c3ef168ef317857218c69e2589dbc3f4fcec2f3237d8f6dc72b034ba96268bfdc31a742937a8d92c22d From a1a3c76fb57477d09ea21884a3bdc8b54470bda9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 10 Oct 2023 17:18:12 +0200 Subject: [PATCH 285/425] Update to version 4.19.1 resolves: #2243073 resolves: #2241881, #2243228: Security fix for CVE-2023-3961 resolves: #2241882, #2243231: Security fix for CVE-2023-4091 resolves: #2241883, #2243230: Security fix for CVE-2023-4154 resolves: #2241884, #2243229: Security fix for CVE-2023-42669 resolves: #2241885, #2243232: Security fix for CVE-2023-42670 Guenther --- .gitignore | 2 ++ samba.spec | 11 +++++++++-- sources | 4 ++-- 3 files changed, 13 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 279c4a2..56c8116 100644 --- a/.gitignore +++ b/.gitignore @@ -347,3 +347,5 @@ samba-3.6.0pre1.tar.gz /samba-4.19.0rc4.tar.asc /samba-4.19.0.tar.xz /samba-4.19.0.tar.asc +/samba-4.19.1.tar.xz +/samba-4.19.1.tar.asc diff --git a/samba.spec b/samba.spec index 1bef008..fdc5e01 100644 --- a/samba.spec +++ b/samba.spec @@ -137,7 +137,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.19.0 +%global samba_version 4.19.1 %global baserelease 1 # This should be rc1 or %%nil %global pre_release %nil @@ -2032,7 +2032,6 @@ fi %{_libexecdir}/samba/rpcd_fsrvp %{_libexecdir}/samba/rpcd_lsad %{_libexecdir}/samba/rpcd_mdssvc -%{_libexecdir}/samba/rpcd_rpcecho %{_libexecdir}/samba/rpcd_spoolss %{_libexecdir}/samba/rpcd_winreg %{_mandir}/man8/samba-dcerpcd.8* @@ -4450,6 +4449,14 @@ fi %endif %changelog +* Tue Oct 10 2023 Guenther Deschner - 4.19.1-1 +- resolves: #2243073 - Update to version 4.19.1 +- resolves: #2241881, #2243228: Security fix for CVE-2023-3961 +- resolves: #2241882, #2243231: Security fix for CVE-2023-4091 +- resolves: #2241883, #2243230: Security fix for CVE-2023-4154 +- resolves: #2241884, #2243229: Security fix for CVE-2023-42669 +- resolves: #2241885, #2243232: Security fix for CVE-2023-42670 + * Mon Sep 04 2023 Guenther Deschner - 4.19.0-1 - resolves: #2237259 - Update to version 4.19.0 diff --git a/sources b/sources index a802550..5b09a26 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.19.0.tar.xz) = a82347b496bb092ced6e4a25e5405ce0c5da40b0a4363e1e5f0cc295c7693d863bcd8d30b0da6d2a99c5525dc01e3a65c524ca832dc6d7e055f2c0ab264f7ae6 -SHA512 (samba-4.19.0.tar.asc) = 75dda279cc07db2a3a79fd4abd99db9383ca5d008d586c3ef168ef317857218c69e2589dbc3f4fcec2f3237d8f6dc72b034ba96268bfdc31a742937a8d92c22d +SHA512 (samba-4.19.1.tar.xz) = a96dc8b0fc1b11b92a15c57a10982327f837e79e641e317a098809c4f9b7007d19efdaad307e8349f1dcdb1dc30d38053721dc59eccd6c238856933a27f59335 +SHA512 (samba-4.19.1.tar.asc) = 28ae534aca182f3bb3c0bd85d79af729f7b3fbde4efd6b86c1e5ddd91e3e45e3c3dde223fdede1d9e55e617c5d8309fc018d869e697323503f24edc0b5b5ca4e From 00b32c417221ac19923d06ebaaa6451c7d2ef46d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 13 Oct 2023 11:43:02 +0200 Subject: [PATCH 286/425] When built with testsuite rpcd_echo is built as well Guenther --- samba.spec | 3 +++ 1 file changed, 3 insertions(+) diff --git a/samba.spec b/samba.spec index fdc5e01..803492a 100644 --- a/samba.spec +++ b/samba.spec @@ -2032,6 +2032,9 @@ fi %{_libexecdir}/samba/rpcd_fsrvp %{_libexecdir}/samba/rpcd_lsad %{_libexecdir}/samba/rpcd_mdssvc +%if %{with testsuite} +%{_libexecdir}/samba/rpcd_rpcecho +%endif %{_libexecdir}/samba/rpcd_spoolss %{_libexecdir}/samba/rpcd_winreg %{_mandir}/man8/samba-dcerpcd.8* From 9996023e42ea80f823c5a70199984386077107f7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 16 Oct 2023 18:00:00 +0200 Subject: [PATCH 287/425] Update to version 4.19.2 resolves: #2244496 Guenther --- .gitignore | 2 ++ samba.spec | 5 ++++- sources | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 56c8116..3b6f4d1 100644 --- a/.gitignore +++ b/.gitignore @@ -349,3 +349,5 @@ samba-3.6.0pre1.tar.gz /samba-4.19.0.tar.asc /samba-4.19.1.tar.xz /samba-4.19.1.tar.asc +/samba-4.19.2.tar.xz +/samba-4.19.2.tar.asc diff --git a/samba.spec b/samba.spec index 803492a..50aeb4b 100644 --- a/samba.spec +++ b/samba.spec @@ -137,7 +137,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.19.1 +%global samba_version 4.19.2 %global baserelease 1 # This should be rc1 or %%nil %global pre_release %nil @@ -4452,6 +4452,9 @@ fi %endif %changelog +* Mon Oct 16 2023 Guenther Deschner - 4.19.2-1 +- resolves: #2244496 - Update to version 4.19.2 + * Tue Oct 10 2023 Guenther Deschner - 4.19.1-1 - resolves: #2243073 - Update to version 4.19.1 - resolves: #2241881, #2243228: Security fix for CVE-2023-3961 diff --git a/sources b/sources index 5b09a26..952ec2b 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.19.1.tar.xz) = a96dc8b0fc1b11b92a15c57a10982327f837e79e641e317a098809c4f9b7007d19efdaad307e8349f1dcdb1dc30d38053721dc59eccd6c238856933a27f59335 -SHA512 (samba-4.19.1.tar.asc) = 28ae534aca182f3bb3c0bd85d79af729f7b3fbde4efd6b86c1e5ddd91e3e45e3c3dde223fdede1d9e55e617c5d8309fc018d869e697323503f24edc0b5b5ca4e +SHA512 (samba-4.19.2.tar.xz) = 5b959aa9b276a306ecde99aa8a9ad30e335a7de21d89148d45ccf85ab2027aed31471b379683e5add4436a26cd878a238c7a82df1e0ebf28fc62bcdbc8c5c3ec +SHA512 (samba-4.19.2.tar.asc) = 998985d0c0d64e5c0c8dea8ddc43be366a3f9f4d4720010d2cbc5a4b72d023aaad7c0c46b010a594404047101c82c2068d5ea04887287b2b8c57efd84b7803e6 From 4f9b4790325bc1b889412c073716f46ebc4d7bb0 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 15 Nov 2023 10:37:35 +0100 Subject: [PATCH 288/425] Package samba-gpupdate also for RHEL9 --- samba.spec | 25 +++++++++++++++++++------ 1 file changed, 19 insertions(+), 6 deletions(-) diff --git a/samba.spec b/samba.spec index 50aeb4b..6b42dad 100644 --- a/samba.spec +++ b/samba.spec @@ -135,10 +135,16 @@ %bcond_with etcd_mutex %endif +%if 0%{?fedora} || 0%{?rhel} >= 9 +%bcond_without gpupdate +%else +%bcond_with gpupdate +%endif + %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.19.2 -%global baserelease 1 +%global baserelease 2 # This should be rc1 or %%nil %global pre_release %nil @@ -721,7 +727,7 @@ Samba VFS module for GlusterFS integration. %endif ### GPUPDATE -%if %{with dc} +%if %{with gpupdate} %package gpupdate Summary: Samba GPO support for clients Requires: cepces @@ -733,7 +739,7 @@ Requires: python3-%{name} = %{samba_depver} This package provides the samba-gpupdate tool to apply Group Policy Objects (GPO) on Samba clients. -# /with dc +#endif with gpupdate %endif ### KRB5-PRINTING @@ -1424,14 +1430,17 @@ touch %{buildroot}%{_libdir}/krb5/plugins/libkrb5/winbind_krb5_locator.so for i in \ %{_mandir}/man8/samba.8 \ %{_mandir}/man8/samba_downgrade_db.8 \ - %{_mandir}/man8/samba-gpupdate.8 \ %{_unitdir}/samba.service \ - %{_sbindir}/samba-gpupdate \ ; do rm -f %{buildroot}$i done %endif +%if %{without gpupdate} +rm -f %{_sbindir}/samba-gpupdate +rm -f %{_mandir}/man8/samba-gpupdate.8 +%endif + %if %{without vfs_glusterfs} rm -f %{buildroot}%{_mandir}/man8/vfs_glusterfs.8* %endif @@ -2327,10 +2336,11 @@ fi %endif ### GPUPDATE -%if %{with dc} +%if %{with gpupdate} %files gpupdate %{_mandir}/man8/samba-gpupdate.8* %{_sbindir}/samba-gpupdate +#endif with gpupdate %endif ### KRB5-PRINTING @@ -4452,6 +4462,9 @@ fi %endif %changelog +* Wed Nov 15 2023 Andreas Schneider - 4.19.2-2 +- Package samba-gpupdate also for RHEL9 + * Mon Oct 16 2023 Guenther Deschner - 4.19.2-1 - resolves: #2244496 - Update to version 4.19.2 From c92b2eb22b4b71488a8619cbe9d8a5b73b9b8be2 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 15 Nov 2023 14:38:09 +0100 Subject: [PATCH 289/425] Do not use mold on i686, support for it has been dropped --- samba.spec | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 6b42dad..bb7d1eb 100644 --- a/samba.spec +++ b/samba.spec @@ -336,9 +336,11 @@ BuildRequires: zlib-devel >= 1.2.3 BuildRequires: pkgconfig(libsystemd) +%ifnarch i686 %if 0%{?fedora} >= 37 BuildRequires: mold %endif +%endif %if %{with vfs_glusterfs} BuildRequires: glusterfs-api-devel >= 3.4.0.16 @@ -1267,12 +1269,16 @@ rm -f lib/crypto/{aes,rijndael}*.c # TODO: resolve underlinked python modules export python_LDFLAGS="$(echo %{__global_ldflags} | sed -e 's/-Wl,-z,defs//g')" -# Use the mold linker +# Use the mold linker if possible +export python_LDFLAGS="$(echo %{__global_ldflags} | sed -e 's/-Wl,-z,defs//g')" + +%ifnarch i686 %if 0%{?fedora} >= 37 export LDFLAGS="%{__global_ldflags} -fuse-ld=mold" export python_LDFLAGS="$(echo ${LDFLAGS} | sed -e 's/-Wl,-z,defs//g')" -%else -export python_LDFLAGS="$(echo %{__global_ldflags} | sed -e 's/-Wl,-z,defs//g')" +#endif fedora >= 37 +%endif +#endif narch i686 %endif # Add support for mock ccache plugin From 601c5e7cbbaccce1a8c88322dad8b6edb03785ed Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Sun, 19 Nov 2023 12:47:18 +0100 Subject: [PATCH 290/425] Fix the 'without gpupdate' uninstalled file removal --- samba.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index bb7d1eb..33b38b6 100644 --- a/samba.spec +++ b/samba.spec @@ -1443,8 +1443,8 @@ done %endif %if %{without gpupdate} -rm -f %{_sbindir}/samba-gpupdate -rm -f %{_mandir}/man8/samba-gpupdate.8 +rm -f %{buildroot}%{_sbindir}/samba-gpupdate +rm -f %{buildroot}%{_mandir}/man8/samba-gpupdate.8* %endif %if %{without vfs_glusterfs} From 9e2c1829db848e685f97cdc0cfb10a0abf694630 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 27 Nov 2023 15:15:58 +0100 Subject: [PATCH 291/425] Update to Samba 4.19.3 resolves: #2251766 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 3b6f4d1..ed08576 100644 --- a/.gitignore +++ b/.gitignore @@ -351,3 +351,5 @@ samba-3.6.0pre1.tar.gz /samba-4.19.1.tar.asc /samba-4.19.2.tar.xz /samba-4.19.2.tar.asc +/samba-4.19.3.tar.xz +/samba-4.19.3.tar.asc diff --git a/samba.spec b/samba.spec index 33b38b6..aa7fe25 100644 --- a/samba.spec +++ b/samba.spec @@ -143,8 +143,8 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.19.2 -%global baserelease 2 +%global samba_version 4.19.3 +%global baserelease 1 # This should be rc1 or %%nil %global pre_release %nil @@ -4468,6 +4468,9 @@ fi %endif %changelog +* Mon Nov 27 2023 Guenther Deschner - 4.19.3-1 +- resolves: #2251766 - Update to version 4.19.3 + * Wed Nov 15 2023 Andreas Schneider - 4.19.2-2 - Package samba-gpupdate also for RHEL9 diff --git a/sources b/sources index 952ec2b..a0453a0 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.19.2.tar.xz) = 5b959aa9b276a306ecde99aa8a9ad30e335a7de21d89148d45ccf85ab2027aed31471b379683e5add4436a26cd878a238c7a82df1e0ebf28fc62bcdbc8c5c3ec -SHA512 (samba-4.19.2.tar.asc) = 998985d0c0d64e5c0c8dea8ddc43be366a3f9f4d4720010d2cbc5a4b72d023aaad7c0c46b010a594404047101c82c2068d5ea04887287b2b8c57efd84b7803e6 +SHA512 (samba-4.19.3.tar.xz) = c222d11c2b196c02ce99a5d6b806df5b9dbfdc50f0d5de43723cf75af69e0fb8ec06d9fbd9a4ca8be03f3ff39a8e5422464afb9279816d3350308045350245a3 +SHA512 (samba-4.19.3.tar.asc) = 76692b6eced6ecbbb49dea21e895ee4486aa09118a53b9a113ba0679063c6052333789156abe30b9d4ee11527743c2334eb49c055421c2cf6b347df18f6afb03 From 93059a0a6a3e5c5df282344a04f9b11caa6583df Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 28 Nov 2023 13:33:44 +0100 Subject: [PATCH 292/425] Disable ctdb-pcp build for i686 for Fedora performance-co-pilot is no longer supported on i686 in Fedora Rawhide/40 Guenther --- samba.spec | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index aa7fe25..716441d 100644 --- a/samba.spec +++ b/samba.spec @@ -121,9 +121,12 @@ #endif fedora || rhel >= 8 %endif -# Build the ctdb-pcp-pmda package by default on Fedora +# Build the ctdb-pcp-pmda package by default on Fedora, except for i686 where +# pcp is no longer supported %if 0%{?fedora} +%ifnarch i686 %bcond_without pcp_pmda +%endif %else %bcond_with pcp_pmda %endif @@ -144,7 +147,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.19.3 -%global baserelease 1 +%global baserelease 2 # This should be rc1 or %%nil %global pre_release %nil @@ -4468,6 +4471,9 @@ fi %endif %changelog +* Tue Nov 28 2023 Guenther Deschner - 4.19.3-2 +- Disable performance co-pilot support for i686 + * Mon Nov 27 2023 Guenther Deschner - 4.19.3-1 - resolves: #2251766 - Update to version 4.19.3 From 448b9a166115ea9ecb25d4108192f4ae6bd3e1d5 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 13 Dec 2023 10:01:58 +0100 Subject: [PATCH 293/425] Add missing BuildRequires for cepces We should install for building what we require during runtime. --- samba.spec | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/samba.spec b/samba.spec index 716441d..41e3bb8 100644 --- a/samba.spec +++ b/samba.spec @@ -368,6 +368,10 @@ BuildRequires: librados-devel BuildRequires: python3-etcd %endif +%if %{with gpupdate} +BuildRequires: cepces +%endif + # pidl requirements BuildRequires: perl(ExtUtils::MakeMaker) BuildRequires: perl(FindBin) From 6a716d5e7ee5135f67c81d086cb2acde6833c28f Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 8 Jan 2024 17:30:42 +0100 Subject: [PATCH 294/425] Add missing dependencies for samba-gpupdate --- samba.spec | 3 +++ 1 file changed, 3 insertions(+) diff --git a/samba.spec b/samba.spec index 41e3bb8..06bc5f1 100644 --- a/samba.spec +++ b/samba.spec @@ -740,9 +740,12 @@ Samba VFS module for GlusterFS integration. %package gpupdate Summary: Samba GPO support for clients Requires: cepces +Requires: cepces-certmonger Requires: certmonger Requires: %{name}-ldb-ldap-modules = %{samba_depver} Requires: python3-%{name} = %{samba_depver} +# samba-tool needs python3-samba-dc also on non-dc build +Requires: python3-%{name}-dc = %{samba_depver} %description gpupdate This package provides the samba-gpupdate tool to apply Group Policy Objects From 95272cbe7670bd7d736e51fde74150cc49b7ce07 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 8 Jan 2024 16:34:43 +0100 Subject: [PATCH 295/425] Update to version 4.19.4 resolves: #2257287 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index ed08576..347f3eb 100644 --- a/.gitignore +++ b/.gitignore @@ -353,3 +353,5 @@ samba-3.6.0pre1.tar.gz /samba-4.19.2.tar.asc /samba-4.19.3.tar.xz /samba-4.19.3.tar.asc +/samba-4.19.4.tar.xz +/samba-4.19.4.tar.asc diff --git a/samba.spec b/samba.spec index 06bc5f1..9cce836 100644 --- a/samba.spec +++ b/samba.spec @@ -146,8 +146,8 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.19.3 -%global baserelease 2 +%global samba_version 4.19.4 +%global baserelease 1 # This should be rc1 or %%nil %global pre_release %nil @@ -4478,6 +4478,9 @@ fi %endif %changelog +* Mon Jan 08 2024 Guenther Deschner - 4.19.4-1 +- resolves: #2257287 - Update to version 4.19.4 + * Tue Nov 28 2023 Guenther Deschner - 4.19.3-2 - Disable performance co-pilot support for i686 diff --git a/sources b/sources index a0453a0..ed14bdd 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.19.3.tar.xz) = c222d11c2b196c02ce99a5d6b806df5b9dbfdc50f0d5de43723cf75af69e0fb8ec06d9fbd9a4ca8be03f3ff39a8e5422464afb9279816d3350308045350245a3 -SHA512 (samba-4.19.3.tar.asc) = 76692b6eced6ecbbb49dea21e895ee4486aa09118a53b9a113ba0679063c6052333789156abe30b9d4ee11527743c2334eb49c055421c2cf6b347df18f6afb03 +SHA512 (samba-4.19.4.tar.xz) = 3d2899e4a3b8bcb77befc29c4af66d3ac858b7f7a0dbbb66a8bc210cd88d9cde3e11361334a5cce650318473134ec8b134148bfa4af4d51f555de33eff395029 +SHA512 (samba-4.19.4.tar.asc) = 11bc51407d1464339817d7568f5d5bb059c19a05b49c6a1307d7425d289acb617ecd3e633e3736bdaa94947a7b3630d6cdb7ed6fe59d52556234c549eca8172a From f245ed7ba22cd3c5fbe9c3a603e182c5ff2baaa5 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 9 Jan 2024 09:51:38 +0100 Subject: [PATCH 296/425] Create winbind groups using systemd Also drop creating groups with groupadd entirely. resolves: rhbz#2256326 --- samba-winbind-systemd-sysusers.conf | 2 ++ samba.spec | 21 ++++++++++----------- 2 files changed, 12 insertions(+), 11 deletions(-) create mode 100644 samba-winbind-systemd-sysusers.conf diff --git a/samba-winbind-systemd-sysusers.conf b/samba-winbind-systemd-sysusers.conf new file mode 100644 index 0000000..7ccc216 --- /dev/null +++ b/samba-winbind-systemd-sysusers.conf @@ -0,0 +1,2 @@ +#Type Name ID +g wbpriv 88 diff --git a/samba.spec b/samba.spec index 9cce836..b96f57c 100644 --- a/samba.spec +++ b/samba.spec @@ -239,12 +239,11 @@ Source14: samba.pamd Source15: usershares.conf.vendor Source16: samba-systemd-sysusers.conf Source17: samba-usershares-systemd-sysusers.conf +Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore -Requires(pre): /usr/sbin/groupadd - Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} @@ -1419,6 +1418,7 @@ echo "d /run/ctdb 755 root root" > %{buildroot}%{_tmpfilesdir}/ctdb.conf install -d -m 0755 %{buildroot}%{_sysusersdir} install -m 0644 %{SOURCE16} %{buildroot}%{_sysusersdir}/samba.conf install -m 0644 %{SOURCE17} %{buildroot}%{_sysusersdir}/samba-usershares.conf +install -m 0644 %{SOURCE18} %{buildroot}%{_sysusersdir}/samba-winbind.conf install -d -m 0755 %{buildroot}%{_sysconfdir}/sysconfig install -m 0644 packaging/systemd/samba.sysconfig %{buildroot}%{_sysconfdir}/sysconfig/samba @@ -1533,11 +1533,8 @@ export WINBINDD_DONT_LOG_STDOUT=1 %systemd_postun_with_restart nmb.service %pre common -%if 0%{?fedora} || 0%{?rhel} > 8 +# This creates the group 'printadmin' %sysusers_create_compat %{SOURCE16} -%else -getent group printadmin >/dev/null || groupadd -r printadmin || : -%endif %post common %{?ldconfig} @@ -1607,14 +1604,12 @@ fi %ldconfig_scriptlets test %pre usershares -%if 0%{?fedora} || 0%{?rhel} > 8 +# This creates the group 'usershares' %sysusers_create_compat %{SOURCE17} -%else -getent group usershares >/dev/null || groupadd -r usershares || : -%endif %pre winbind -/usr/sbin/groupadd -g 88 wbpriv >/dev/null 2>&1 || : +# This creates the group 'wbpriv' +%sysusers_create_compat %{SOURCE18} %post winbind %systemd_post winbind.service @@ -3490,6 +3485,7 @@ fi %{_libdir}/samba/libnss-info-samba4.so %{_libdir}/samba/libidmap-samba4.so %{_sbindir}/winbindd +%{_sysusersdir}/samba-winbind.conf %attr(750,root,wbpriv) %dir /var/lib/samba/winbindd_privileged %{_unitdir}/winbind.service %{_prefix}/lib/NetworkManager @@ -4478,6 +4474,9 @@ fi %endif %changelog +* Tue Jan 09 2024 Andreas Schneider - 4.19.4-2 +- resolves: rhbz#2256326 - Create all groups using systemd + * Mon Jan 08 2024 Guenther Deschner - 4.19.4-1 - resolves: #2257287 - Update to version 4.19.4 From 368799d573a8948346d3ab4d397a2ac0cb3fe2cf Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 9 Jan 2024 13:07:37 +0100 Subject: [PATCH 297/425] Bump release number --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index b96f57c..7f9da2f 100644 --- a/samba.spec +++ b/samba.spec @@ -147,7 +147,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.19.4 -%global baserelease 1 +%global baserelease 2 # This should be rc1 or %%nil %global pre_release %nil From 2c97dc253a4c71201cea3b4e97e9fe9ba60c4310 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jan 2024 13:16:55 +0100 Subject: [PATCH 298/425] Remove unused globals libwbc_alternatives_* --- samba.spec | 6 ------ 1 file changed, 6 deletions(-) diff --git a/samba.spec b/samba.spec index 7f9da2f..e1437ee 100644 --- a/samba.spec +++ b/samba.spec @@ -197,12 +197,6 @@ # https://src.fedoraproject.org/rpms/redhat-rpm-config/blob/master/f/buildflags.md %undefine _strict_symbol_defs_build -%global libwbc_alternatives_version 0.16 -%global libwbc_alternatives_suffix %nil -%if 0%{?__isa_bits} == 64 -%global libwbc_alternatives_suffix -64 -%endif - %global _systemd_extra "Environment=KRB5CCNAME=FILE:/run/samba/krb5cc_samba" # Make a copy of this variable to prevent repeated evaluation of the From cbf258a1156a147cd12efe5937732db4b0be74a0 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 16 Jan 2024 12:22:50 +0100 Subject: [PATCH 299/425] Fix samba-gpupdate on Fedora/RHEL --- samba-4.19-fix-gpupdate-rhel-fedora.patch | 638 ++++++++++++++++++++++ samba-4.19-fix-gpupdate-site-aware.patch | 61 +++ samba.spec | 8 +- 3 files changed, 706 insertions(+), 1 deletion(-) create mode 100644 samba-4.19-fix-gpupdate-rhel-fedora.patch create mode 100644 samba-4.19-fix-gpupdate-site-aware.patch diff --git a/samba-4.19-fix-gpupdate-rhel-fedora.patch b/samba-4.19-fix-gpupdate-rhel-fedora.patch new file mode 100644 index 0000000..6381e0a --- /dev/null +++ b/samba-4.19-fix-gpupdate-rhel-fedora.patch @@ -0,0 +1,638 @@ +From 549b5fe579fc15d63b71b1cc8a0ebf4e4869171b Mon Sep 17 00:00:00 2001 +From: Gabriel Nagy +Date: Thu, 17 Aug 2023 01:05:54 +0300 +Subject: [PATCH 1/9] gp: Support more global trust directories + +In addition to the SUSE global trust directory, add support for RHEL and +Debian-based distributions (including Ubuntu). + +To determine the correct directory to use, we iterate over the variants +and stop at the first which is a directory. + +In case none is found, fallback to the first option which will produce a +warning as it did previously. + +Signed-off-by: Gabriel Nagy +Reviewed-by: Joseph Sutton +Reviewed-by: David Mulder +(cherry picked from commit a1b285e485c0b5a8747499bdbbb9f3f4fc025b2f) +--- + python/samba/gp/gp_cert_auto_enroll_ext.py | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/python/samba/gp/gp_cert_auto_enroll_ext.py b/python/samba/gp/gp_cert_auto_enroll_ext.py +index 312c8ddf467..1b90ab46e90 100644 +--- a/python/samba/gp/gp_cert_auto_enroll_ext.py ++++ b/python/samba/gp/gp_cert_auto_enroll_ext.py +@@ -45,10 +45,12 @@ cert_wrap = b""" + -----BEGIN CERTIFICATE----- + %s + -----END CERTIFICATE-----""" +-global_trust_dir = '/etc/pki/trust/anchors' + endpoint_re = '(https|HTTPS)://(?P[a-zA-Z0-9.-]+)/ADPolicyProvider' + \ + '_CEP_(?P[a-zA-Z]+)/service.svc/CEP' + ++global_trust_dirs = ['/etc/pki/trust/anchors', # SUSE ++ '/etc/pki/ca-trust/source/anchors', # RHEL/Fedora ++ '/usr/local/share/ca-certificates'] # Debian/Ubuntu + + def octet_string_to_objectGUID(data): + """Convert an octet string to an objectGUID.""" +@@ -249,12 +251,20 @@ def getca(ca, url, trust_dir): + return root_certs + + ++def find_global_trust_dir(): ++ """Return the global trust dir using known paths from various Linux distros.""" ++ for trust_dir in global_trust_dirs: ++ if os.path.isdir(trust_dir): ++ return trust_dir ++ return global_trust_dirs[0] ++ + def cert_enroll(ca, ldb, trust_dir, private_dir, auth='Kerberos'): + """Install the root certificate chain.""" + data = dict({'files': [], 'templates': []}, **ca) + url = 'http://%s/CertSrv/mscep/mscep.dll/pkiclient.exe?' % ca['hostname'] + root_certs = getca(ca, url, trust_dir) + data['files'].extend(root_certs) ++ global_trust_dir = find_global_trust_dir() + for src in root_certs: + # Symlink the certs to global trust dir + dst = os.path.join(global_trust_dir, os.path.basename(src)) +-- +2.43.0 + + +From c624a1e9b1d09fe2bb3f9778cb616230e57168a8 Mon Sep 17 00:00:00 2001 +From: Gabriel Nagy +Date: Thu, 17 Aug 2023 01:09:28 +0300 +Subject: [PATCH 2/9] gp: Support update-ca-trust helper + +This is used on RHEL/Fedora instead of update-ca-certificates. They +behave similarly so it's enough to change the command name. + +Signed-off-by: Gabriel Nagy +Reviewed-by: Joseph Sutton +Reviewed-by: David Mulder +(cherry picked from commit fa80d1d86439749c44e60cf9075e84dc9ed3c268) +--- + python/samba/gp/gp_cert_auto_enroll_ext.py | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/python/samba/gp/gp_cert_auto_enroll_ext.py b/python/samba/gp/gp_cert_auto_enroll_ext.py +index 1b90ab46e90..cefdafa21b2 100644 +--- a/python/samba/gp/gp_cert_auto_enroll_ext.py ++++ b/python/samba/gp/gp_cert_auto_enroll_ext.py +@@ -258,6 +258,10 @@ def find_global_trust_dir(): + return trust_dir + return global_trust_dirs[0] + ++def update_ca_command(): ++ """Return the command to update the CA trust store.""" ++ return which('update-ca-certificates') or which('update-ca-trust') ++ + def cert_enroll(ca, ldb, trust_dir, private_dir, auth='Kerberos'): + """Install the root certificate chain.""" + data = dict({'files': [], 'templates': []}, **ca) +@@ -283,7 +287,7 @@ def cert_enroll(ca, ldb, trust_dir, private_dir, auth='Kerberos'): + # already exists. Ignore the FileExistsError. Preserve the + # existing symlink in the unapply data. + data['files'].append(dst) +- update = which('update-ca-certificates') ++ update = update_ca_command() + if update is not None: + Popen([update]).wait() + # Setup Certificate Auto Enrollment +-- +2.43.0 + + +From 086406ca457cc17e15001fb44802276ada068679 Mon Sep 17 00:00:00 2001 +From: Gabriel Nagy +Date: Fri, 11 Aug 2023 18:46:42 +0300 +Subject: [PATCH 3/9] gp: Change root cert extension suffix + +On Ubuntu, certificates must end in '.crt' in order to be considered by +the `update-ca-certificates` helper. + +Signed-off-by: Gabriel Nagy +Reviewed-by: Joseph Sutton +Reviewed-by: David Mulder +(cherry picked from commit bce3a89204545dcab5fb39a712590f6e166f997b) +--- + python/samba/gp/gp_cert_auto_enroll_ext.py | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/python/samba/gp/gp_cert_auto_enroll_ext.py b/python/samba/gp/gp_cert_auto_enroll_ext.py +index cefdafa21b2..c562722906b 100644 +--- a/python/samba/gp/gp_cert_auto_enroll_ext.py ++++ b/python/samba/gp/gp_cert_auto_enroll_ext.py +@@ -241,7 +241,8 @@ def getca(ca, url, trust_dir): + certs = load_der_pkcs7_certificates(r.content) + for i in range(0, len(certs)): + cert = certs[i].public_bytes(Encoding.PEM) +- dest = '%s.%d' % (root_cert, i) ++ filename, extension = root_cert.rsplit('.', 1) ++ dest = '%s.%d.%s' % (filename, i, extension) + with open(dest, 'wb') as w: + w.write(cert) + root_certs.append(dest) +-- +2.43.0 + + +From c57c32020cc9017191b8c8657ebabe00d552a6e3 Mon Sep 17 00:00:00 2001 +From: Gabriel Nagy +Date: Fri, 18 Aug 2023 17:06:43 +0300 +Subject: [PATCH 4/9] gp: Test with binary content for certificate data + +This fails all GPO-related tests that call `gpupdate --rsop`. + +Signed-off-by: Gabriel Nagy +Reviewed-by: Joseph Sutton +Reviewed-by: David Mulder +(cherry picked from commit 1ef722cf66f9ec99f52939f1cfca031c5fe1ad70) +--- + python/samba/tests/gpo.py | 8 ++++---- + selftest/knownfail.d/gpo | 13 +++++++++++++ + 2 files changed, 17 insertions(+), 4 deletions(-) + create mode 100644 selftest/knownfail.d/gpo + +diff --git a/python/samba/tests/gpo.py b/python/samba/tests/gpo.py +index e4b75cc62a4..963f873f755 100644 +--- a/python/samba/tests/gpo.py ++++ b/python/samba/tests/gpo.py +@@ -6783,14 +6783,14 @@ class GPOTests(tests.TestCase): + ldb.add({'dn': certa_dn, + 'objectClass': 'certificationAuthority', + 'authorityRevocationList': ['XXX'], +- 'cACertificate': 'XXX', ++ 'cACertificate': b'0\x82\x03u0\x82\x02]\xa0\x03\x02\x01\x02\x02\x10I', + 'certificateRevocationList': ['XXX'], + }) + # Write the dummy pKIEnrollmentService + enroll_dn = 'CN=%s,CN=Enrollment Services,%s' % (ca_cn, confdn) + ldb.add({'dn': enroll_dn, + 'objectClass': 'pKIEnrollmentService', +- 'cACertificate': 'XXXX', ++ 'cACertificate': b'0\x82\x03u0\x82\x02]\xa0\x03\x02\x01\x02\x02\x10I', + 'certificateTemplates': ['Machine'], + 'dNSHostName': hostname, + }) +@@ -7201,14 +7201,14 @@ class GPOTests(tests.TestCase): + ldb.add({'dn': certa_dn, + 'objectClass': 'certificationAuthority', + 'authorityRevocationList': ['XXX'], +- 'cACertificate': 'XXX', ++ 'cACertificate': b'0\x82\x03u0\x82\x02]\xa0\x03\x02\x01\x02\x02\x10I', + 'certificateRevocationList': ['XXX'], + }) + # Write the dummy pKIEnrollmentService + enroll_dn = 'CN=%s,CN=Enrollment Services,%s' % (ca_cn, confdn) + ldb.add({'dn': enroll_dn, + 'objectClass': 'pKIEnrollmentService', +- 'cACertificate': 'XXXX', ++ 'cACertificate': b'0\x82\x03u0\x82\x02]\xa0\x03\x02\x01\x02\x02\x10I', + 'certificateTemplates': ['Machine'], + 'dNSHostName': hostname, + }) +diff --git a/selftest/knownfail.d/gpo b/selftest/knownfail.d/gpo +new file mode 100644 +index 00000000000..0aad59607c2 +--- /dev/null ++++ b/selftest/knownfail.d/gpo +@@ -0,0 +1,13 @@ ++^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_user_centrify_crontab_ext ++^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_user_scripts_ext ++^samba.tests.gpo.samba.tests.gpo.GPOTests.test_rsop ++^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_access ++^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_files ++^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_issue ++^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_motd ++^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_openssh ++^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_startup_scripts ++^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_sudoers ++^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_symlink ++^samba.tests.gpo.samba.tests.gpo.GPOTests.test_advanced_gp_cert_auto_enroll_ext ++^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_cert_auto_enroll_ext +-- +2.43.0 + + +From c53b2994fd13f4c74cee891e725a4558cdb06b2d Mon Sep 17 00:00:00 2001 +From: Gabriel Nagy +Date: Wed, 16 Aug 2023 12:20:11 +0300 +Subject: [PATCH 5/9] gp: Convert CA certificates to base64 + +I don't know whether this applies universally, but in our case the +contents of `es['cACertificate'][0]` are binary, so cleanly converting +to a string fails with the following: + +'utf-8' codec can't decode byte 0x82 in position 1: invalid start byte + +We found a fix to be encoding the certificate to base64 when +constructing the CA list. + +Section 4.4.5.2 of MS-CAESO also suggests that the content of +`cACertificate` is binary (OCTET string). + +Signed-off-by: Gabriel Nagy +Reviewed-by: Joseph Sutton +Reviewed-by: David Mulder +(cherry picked from commit 157335ee93eb866f9b6a47486a5668d6e76aced5) +--- + python/samba/gp/gp_cert_auto_enroll_ext.py | 5 ++--- + selftest/knownfail.d/gpo | 13 ------------- + 2 files changed, 2 insertions(+), 16 deletions(-) + delete mode 100644 selftest/knownfail.d/gpo + +diff --git a/python/samba/gp/gp_cert_auto_enroll_ext.py b/python/samba/gp/gp_cert_auto_enroll_ext.py +index c562722906b..c8b5368c16a 100644 +--- a/python/samba/gp/gp_cert_auto_enroll_ext.py ++++ b/python/samba/gp/gp_cert_auto_enroll_ext.py +@@ -158,7 +158,7 @@ def fetch_certification_authorities(ldb): + for es in res: + data = { 'name': get_string(es['cn'][0]), + 'hostname': get_string(es['dNSHostName'][0]), +- 'cACertificate': get_string(es['cACertificate'][0]) ++ 'cACertificate': get_string(base64.b64encode(es['cACertificate'][0])) + } + result.append(data) + return result +@@ -176,8 +176,7 @@ def fetch_template_attrs(ldb, name, attrs=None): + return {'msPKI-Minimal-Key-Size': ['2048']} + + def format_root_cert(cert): +- cert = base64.b64encode(cert.encode()) +- return cert_wrap % re.sub(b"(.{64})", b"\\1\n", cert, 0, re.DOTALL) ++ return cert_wrap % re.sub(b"(.{64})", b"\\1\n", cert.encode(), 0, re.DOTALL) + + def find_cepces_submit(): + certmonger_dirs = [os.environ.get("PATH"), '/usr/lib/certmonger', +diff --git a/selftest/knownfail.d/gpo b/selftest/knownfail.d/gpo +deleted file mode 100644 +index 0aad59607c2..00000000000 +--- a/selftest/knownfail.d/gpo ++++ /dev/null +@@ -1,13 +0,0 @@ +-^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_user_centrify_crontab_ext +-^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_user_scripts_ext +-^samba.tests.gpo.samba.tests.gpo.GPOTests.test_rsop +-^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_access +-^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_files +-^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_issue +-^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_motd +-^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_openssh +-^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_startup_scripts +-^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_sudoers +-^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_symlink +-^samba.tests.gpo.samba.tests.gpo.GPOTests.test_advanced_gp_cert_auto_enroll_ext +-^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_cert_auto_enroll_ext +-- +2.43.0 + + +From fd13702a9cd6475a14113de87ccad6588d2d443b Mon Sep 17 00:00:00 2001 +From: Gabriel Nagy +Date: Fri, 18 Aug 2023 17:16:23 +0300 +Subject: [PATCH 6/9] gp: Test adding new cert templates enforces changes + +Ensure that cepces-submit reporting additional templates and re-applying +will enforce the updated policy. + +Signed-off-by: Gabriel Nagy +Reviewed-by: Joseph Sutton +Reviewed-by: David Mulder +(cherry picked from commit 2d6943a864405f324c467e8c3464c31ac08457b0) +--- + python/samba/tests/bin/cepces-submit | 3 +- + python/samba/tests/gpo.py | 48 ++++++++++++++++++++++++++++ + selftest/knownfail.d/gpo | 2 ++ + 3 files changed, 52 insertions(+), 1 deletion(-) + create mode 100644 selftest/knownfail.d/gpo + +diff --git a/python/samba/tests/bin/cepces-submit b/python/samba/tests/bin/cepces-submit +index 668682a9f58..de63164692b 100755 +--- a/python/samba/tests/bin/cepces-submit ++++ b/python/samba/tests/bin/cepces-submit +@@ -14,4 +14,5 @@ if __name__ == "__main__": + assert opts.auth == 'Kerberos' + if 'CERTMONGER_OPERATION' in os.environ and \ + os.environ['CERTMONGER_OPERATION'] == 'GET-SUPPORTED-TEMPLATES': +- print('Machine') # Report a Machine template ++ templates = os.environ.get('CEPCES_SUBMIT_SUPPORTED_TEMPLATES', 'Machine').split(',') ++ print('\n'.join(templates)) # Report the requested templates +diff --git a/python/samba/tests/gpo.py b/python/samba/tests/gpo.py +index 963f873f755..e75c411bde7 100644 +--- a/python/samba/tests/gpo.py ++++ b/python/samba/tests/gpo.py +@@ -6812,6 +6812,23 @@ class GPOTests(tests.TestCase): + self.assertTrue(os.path.exists(machine_crt), + 'Machine key was not generated') + ++ # Subsequent apply should react to new certificate templates ++ os.environ['CEPCES_SUBMIT_SUPPORTED_TEMPLATES'] = 'Machine,Workstation' ++ self.addCleanup(os.environ.pop, 'CEPCES_SUBMIT_SUPPORTED_TEMPLATES') ++ ext.process_group_policy([], gpos, dname, dname) ++ self.assertTrue(os.path.exists(ca_crt), ++ 'Root CA certificate was not requested') ++ self.assertTrue(os.path.exists(machine_crt), ++ 'Machine certificate was not requested') ++ self.assertTrue(os.path.exists(machine_crt), ++ 'Machine key was not generated') ++ workstation_crt = os.path.join(dname, '%s.Workstation.crt' % ca_cn) ++ self.assertTrue(os.path.exists(workstation_crt), ++ 'Workstation certificate was not requested') ++ workstation_key = os.path.join(dname, '%s.Workstation.key' % ca_cn) ++ self.assertTrue(os.path.exists(workstation_crt), ++ 'Workstation key was not generated') ++ + # Verify RSOP does not fail + ext.rsop([g for g in gpos if g.name == guid][0]) + +@@ -6829,11 +6846,17 @@ class GPOTests(tests.TestCase): + 'Machine certificate was not removed') + self.assertFalse(os.path.exists(machine_crt), + 'Machine key was not removed') ++ self.assertFalse(os.path.exists(workstation_crt), ++ 'Workstation certificate was not removed') ++ self.assertFalse(os.path.exists(workstation_crt), ++ 'Workstation key was not removed') + out, _ = Popen(['getcert', 'list-cas'], stdout=PIPE).communicate() + self.assertNotIn(get_bytes(ca_cn), out, 'CA was not removed') + out, _ = Popen(['getcert', 'list'], stdout=PIPE).communicate() + self.assertNotIn(b'Machine', out, + 'Machine certificate not removed') ++ self.assertNotIn(b'Workstation', out, ++ 'Workstation certificate not removed') + + # Remove the dummy CA, pKIEnrollmentService, and pKICertificateTemplate + ldb.delete(certa_dn) +@@ -7233,6 +7256,25 @@ class GPOTests(tests.TestCase): + self.assertTrue(os.path.exists(machine_crt), + 'Machine key was not generated') + ++ # Subsequent apply should react to new certificate templates ++ os.environ['CEPCES_SUBMIT_SUPPORTED_TEMPLATES'] = 'Machine,Workstation' ++ self.addCleanup(os.environ.pop, 'CEPCES_SUBMIT_SUPPORTED_TEMPLATES') ++ ext.process_group_policy([], gpos, dname, dname) ++ for ca in ca_list: ++ self.assertTrue(os.path.exists(ca_crt), ++ 'Root CA certificate was not requested') ++ self.assertTrue(os.path.exists(machine_crt), ++ 'Machine certificate was not requested') ++ self.assertTrue(os.path.exists(machine_crt), ++ 'Machine key was not generated') ++ ++ workstation_crt = os.path.join(dname, '%s.Workstation.crt' % ca) ++ self.assertTrue(os.path.exists(workstation_crt), ++ 'Workstation certificate was not requested') ++ workstation_key = os.path.join(dname, '%s.Workstation.key' % ca) ++ self.assertTrue(os.path.exists(workstation_crt), ++ 'Workstation key was not generated') ++ + # Verify RSOP does not fail + ext.rsop([g for g in gpos if g.name == guid][0]) + +@@ -7250,12 +7292,18 @@ class GPOTests(tests.TestCase): + 'Machine certificate was not removed') + self.assertFalse(os.path.exists(machine_crt), + 'Machine key was not removed') ++ self.assertFalse(os.path.exists(workstation_crt), ++ 'Workstation certificate was not removed') ++ self.assertFalse(os.path.exists(workstation_crt), ++ 'Workstation key was not removed') + out, _ = Popen(['getcert', 'list-cas'], stdout=PIPE).communicate() + for ca in ca_list: + self.assertNotIn(get_bytes(ca), out, 'CA was not removed') + out, _ = Popen(['getcert', 'list'], stdout=PIPE).communicate() + self.assertNotIn(b'Machine', out, + 'Machine certificate not removed') ++ self.assertNotIn(b'Workstation', out, ++ 'Workstation certificate not removed') + + # Remove the dummy CA, pKIEnrollmentService, and pKICertificateTemplate + ldb.delete(certa_dn) +diff --git a/selftest/knownfail.d/gpo b/selftest/knownfail.d/gpo +new file mode 100644 +index 00000000000..4edc1dce730 +--- /dev/null ++++ b/selftest/knownfail.d/gpo +@@ -0,0 +1,2 @@ ++^samba.tests.gpo.samba.tests.gpo.GPOTests.test_advanced_gp_cert_auto_enroll_ext ++^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_cert_auto_enroll_ext +-- +2.43.0 + + +From 4578c6664ab6eac476ee10afae4a1a95b3b63272 Mon Sep 17 00:00:00 2001 +From: Gabriel Nagy +Date: Wed, 16 Aug 2023 12:37:17 +0300 +Subject: [PATCH 7/9] gp: Template changes should invalidate cache + +If certificate templates are added or removed, the autoenroll extension +should react to this and reapply the policy. Previously this wasn't +taken into account. + +Signed-off-by: Gabriel Nagy +Reviewed-by: Joseph Sutton +Reviewed-by: David Mulder +(cherry picked from commit 2a6ae997f2464b12b72b5314fa80d9784fb0f6c1) +--- + python/samba/gp/gp_cert_auto_enroll_ext.py | 15 ++++++++++----- + selftest/knownfail.d/gpo | 2 -- + 2 files changed, 10 insertions(+), 7 deletions(-) + delete mode 100644 selftest/knownfail.d/gpo + +diff --git a/python/samba/gp/gp_cert_auto_enroll_ext.py b/python/samba/gp/gp_cert_auto_enroll_ext.py +index c8b5368c16a..8233713e8ad 100644 +--- a/python/samba/gp/gp_cert_auto_enroll_ext.py ++++ b/python/samba/gp/gp_cert_auto_enroll_ext.py +@@ -262,6 +262,11 @@ def update_ca_command(): + """Return the command to update the CA trust store.""" + return which('update-ca-certificates') or which('update-ca-trust') + ++def changed(new_data, old_data): ++ """Return True if any key present in both dicts has changed.""" ++ return any((new_data[k] != old_data[k] if k in old_data else False) \ ++ for k in new_data.keys()) ++ + def cert_enroll(ca, ldb, trust_dir, private_dir, auth='Kerberos'): + """Install the root certificate chain.""" + data = dict({'files': [], 'templates': []}, **ca) +@@ -351,12 +356,12 @@ class gp_cert_auto_enroll_ext(gp_pol_ext, gp_applier): + # If the policy has changed, unapply, then apply new policy + old_val = self.cache_get_attribute_value(guid, attribute) + old_data = json.loads(old_val) if old_val is not None else {} +- if all([(ca[k] == old_data[k] if k in old_data else False) \ +- for k in ca.keys()]) or \ +- self.cache_get_apply_state() == GPOSTATE.ENFORCE: ++ templates = ['%s.%s' % (ca['name'], t.decode()) for t in get_supported_templates(ca['hostname'])] ++ new_data = { 'templates': templates, **ca } ++ if changed(new_data, old_data) or self.cache_get_apply_state() == GPOSTATE.ENFORCE: + self.unapply(guid, attribute, old_val) +- # If policy is already applied, skip application +- if old_val is not None and \ ++ # If policy is already applied and unchanged, skip application ++ if old_val is not None and not changed(new_data, old_data) and \ + self.cache_get_apply_state() != GPOSTATE.ENFORCE: + return + +diff --git a/selftest/knownfail.d/gpo b/selftest/knownfail.d/gpo +deleted file mode 100644 +index 4edc1dce730..00000000000 +--- a/selftest/knownfail.d/gpo ++++ /dev/null +@@ -1,2 +0,0 @@ +-^samba.tests.gpo.samba.tests.gpo.GPOTests.test_advanced_gp_cert_auto_enroll_ext +-^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_cert_auto_enroll_ext +-- +2.43.0 + + +From 2d641b736b42f7623955f251ad354439b954159d Mon Sep 17 00:00:00 2001 +From: Gabriel Nagy +Date: Fri, 18 Aug 2023 17:26:59 +0300 +Subject: [PATCH 8/9] gp: Test disabled enrollment unapplies policy + +For this we need to stage a Registry.pol file with certificate +autoenrollment enabled, but with checkboxes unticked. + +Signed-off-by: Gabriel Nagy +Reviewed-by: Joseph Sutton +Reviewed-by: David Mulder +(cherry picked from commit ee814f7707a8ddef2657212cd6d31799501b7bb3) +--- + python/samba/tests/gpo.py | 54 +++++++++++++++++++++++++++++++++++++++ + selftest/knownfail.d/gpo | 1 + + 2 files changed, 55 insertions(+) + create mode 100644 selftest/knownfail.d/gpo + +diff --git a/python/samba/tests/gpo.py b/python/samba/tests/gpo.py +index e75c411bde7..580f3568de8 100644 +--- a/python/samba/tests/gpo.py ++++ b/python/samba/tests/gpo.py +@@ -281,6 +281,28 @@ b""" + + """ + ++auto_enroll_unchecked_reg_pol = \ ++b""" ++ ++ ++ ++ Software\Policies\Microsoft\Cryptography\AutoEnrollment ++ AEPolicy ++ 0 ++ ++ ++ Software\Policies\Microsoft\Cryptography\AutoEnrollment ++ OfflineExpirationPercent ++ 10 ++ ++ ++ Software\Policies\Microsoft\Cryptography\AutoEnrollment ++ OfflineExpirationStoreNames ++ MY ++ ++ ++""" ++ + advanced_enroll_reg_pol = \ + b""" + +@@ -6836,6 +6858,38 @@ class GPOTests(tests.TestCase): + ret = rsop(self.lp) + self.assertEqual(ret, 0, 'gpupdate --rsop failed!') + ++ # Remove policy by staging pol file with auto-enroll unchecked ++ parser.load_xml(etree.fromstring(auto_enroll_unchecked_reg_pol.strip())) ++ ret = stage_file(reg_pol, ndr_pack(parser.pol_file)) ++ self.assertTrue(ret, 'Could not create the target %s' % reg_pol) ++ ext.process_group_policy([], gpos, dname, dname) ++ self.assertFalse(os.path.exists(ca_crt), ++ 'Root CA certificate was not removed') ++ self.assertFalse(os.path.exists(machine_crt), ++ 'Machine certificate was not removed') ++ self.assertFalse(os.path.exists(machine_crt), ++ 'Machine key was not removed') ++ self.assertFalse(os.path.exists(workstation_crt), ++ 'Workstation certificate was not removed') ++ self.assertFalse(os.path.exists(workstation_crt), ++ 'Workstation key was not removed') ++ ++ # Reapply policy by staging the enabled pol file ++ parser.load_xml(etree.fromstring(auto_enroll_reg_pol.strip())) ++ ret = stage_file(reg_pol, ndr_pack(parser.pol_file)) ++ self.assertTrue(ret, 'Could not create the target %s' % reg_pol) ++ ext.process_group_policy([], gpos, dname, dname) ++ self.assertTrue(os.path.exists(ca_crt), ++ 'Root CA certificate was not requested') ++ self.assertTrue(os.path.exists(machine_crt), ++ 'Machine certificate was not requested') ++ self.assertTrue(os.path.exists(machine_crt), ++ 'Machine key was not generated') ++ self.assertTrue(os.path.exists(workstation_crt), ++ 'Workstation certificate was not requested') ++ self.assertTrue(os.path.exists(workstation_crt), ++ 'Workstation key was not generated') ++ + # Remove policy + gp_db = store.get_gplog(machine_creds.get_username()) + del_gpos = get_deleted_gpos_list(gp_db, []) +diff --git a/selftest/knownfail.d/gpo b/selftest/knownfail.d/gpo +new file mode 100644 +index 00000000000..83bc9f0ac1f +--- /dev/null ++++ b/selftest/knownfail.d/gpo +@@ -0,0 +1 @@ ++^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_cert_auto_enroll_ext +-- +2.43.0 + + +From e5588f8800899894388284468b9e25463d3c3e6c Mon Sep 17 00:00:00 2001 +From: Gabriel Nagy +Date: Wed, 16 Aug 2023 12:33:59 +0300 +Subject: [PATCH 9/9] gp: Send list of keys instead of dict to remove + +`cache_get_all_attribute_values` returns a dict whereas we need to pass +a list of keys to `remove`. These will be interpolated in the gpdb search. + +Signed-off-by: Gabriel Nagy +Reviewed-by: Joseph Sutton +Reviewed-by: David Mulder + +Autobuild-User(master): Andrew Bartlett +Autobuild-Date(master): Mon Aug 28 03:01:22 UTC 2023 on atb-devel-224 + +(cherry picked from commit 7dc181757c76b881ceaf1915ebb0bfbcf5aca83a) +--- + python/samba/gp/gp_cert_auto_enroll_ext.py | 2 +- + selftest/knownfail.d/gpo | 1 - + 2 files changed, 1 insertion(+), 2 deletions(-) + delete mode 100644 selftest/knownfail.d/gpo + +diff --git a/python/samba/gp/gp_cert_auto_enroll_ext.py b/python/samba/gp/gp_cert_auto_enroll_ext.py +index 8233713e8ad..64c35782ae8 100644 +--- a/python/samba/gp/gp_cert_auto_enroll_ext.py ++++ b/python/samba/gp/gp_cert_auto_enroll_ext.py +@@ -415,7 +415,7 @@ class gp_cert_auto_enroll_ext(gp_pol_ext, gp_applier): + # remove any existing policy + ca_attrs = \ + self.cache_get_all_attribute_values(gpo.name) +- self.clean(gpo.name, remove=ca_attrs) ++ self.clean(gpo.name, remove=list(ca_attrs.keys())) + + def __read_cep_data(self, guid, ldb, end_point_information, + trust_dir, private_dir): +diff --git a/selftest/knownfail.d/gpo b/selftest/knownfail.d/gpo +deleted file mode 100644 +index 83bc9f0ac1f..00000000000 +--- a/selftest/knownfail.d/gpo ++++ /dev/null +@@ -1 +0,0 @@ +-^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_cert_auto_enroll_ext +-- +2.43.0 + diff --git a/samba-4.19-fix-gpupdate-site-aware.patch b/samba-4.19-fix-gpupdate-site-aware.patch new file mode 100644 index 0000000..3354bb0 --- /dev/null +++ b/samba-4.19-fix-gpupdate-site-aware.patch @@ -0,0 +1,61 @@ +From 372b8f15ccf37c491f43ec7ab81be692ff0fcfed Mon Sep 17 00:00:00 2001 +From: David Mulder +Date: Fri, 5 Jan 2024 08:47:07 -0700 +Subject: [PATCH] WIP: gp: Skip site GP list if no site is found + +[MS-GPOL] 3.2.5.1.4 Site Search says if the site +search returns ERROR_NO_SITENAME, the GP site +search should be skipped. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15548 + +Signed-off-by: David Mulder +--- + python/samba/gp/gpclass.py | 30 ++++++++++++++++++------------ + 1 file changed, 18 insertions(+), 12 deletions(-) + +diff --git a/python/samba/gp/gpclass.py b/python/samba/gp/gpclass.py +index b7a0dcb0ed5..26c2386847e 100644 +--- a/python/samba/gp/gpclass.py ++++ b/python/samba/gp/gpclass.py +@@ -896,19 +896,25 @@ def get_gpo_list(dc_hostname, creds, lp, username): + + # (S)ite + if gpo_list_machine: +- site_dn = site_dn_for_machine(samdb, dc_hostname, lp, creds, username) +- + try: +- log.debug("get_gpo_list: query SITE: [%s] for GPOs" % site_dn) +- gp_link = get_gpo_link(samdb, site_dn) +- except ldb.LdbError as e: +- (enum, estr) = e.args +- log.debug(estr) +- else: +- add_gplink_to_gpo_list(samdb, gpo_list, forced_gpo_list, +- site_dn, gp_link, +- gpo.GP_LINK_SITE, +- add_only_forced_gpos, token) ++ site_dn = site_dn_for_machine(samdb, dc_hostname, lp, creds, username) ++ ++ try: ++ log.debug("get_gpo_list: query SITE: [%s] for GPOs" % site_dn) ++ gp_link = get_gpo_link(samdb, site_dn) ++ except ldb.LdbError as e: ++ (enum, estr) = e.args ++ log.debug(estr) ++ else: ++ add_gplink_to_gpo_list(samdb, gpo_list, forced_gpo_list, ++ site_dn, gp_link, ++ gpo.GP_LINK_SITE, ++ add_only_forced_gpos, token) ++ except ldb.LdbError: ++ # [MS-GPOL] 3.2.5.1.4 Site Search: If the method returns ++ # ERROR_NO_SITENAME, the remainder of this message MUST be skipped ++ # and the protocol sequence MUST continue at GPO Search ++ pass + + # (L)ocal + gpo_list.insert(0, gpo.GROUP_POLICY_OBJECT("Local Policy", +-- +GitLab + diff --git a/samba.spec b/samba.spec index e1437ee..8dce900 100644 --- a/samba.spec +++ b/samba.spec @@ -147,7 +147,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.19.4 -%global baserelease 2 +%global baserelease 3 # This should be rc1 or %%nil %global pre_release %nil @@ -238,6 +238,9 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore +Patch0: samba-4.19-fix-gpupdate-rhel-fedora.patch +Patch1: samba-4.19-fix-gpupdate-site-aware.patch + Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} @@ -4468,6 +4471,9 @@ fi %endif %changelog +* Tue Jan 16 2024 Andreas Schneider - 4.29.4-3 +- Fix samba-gpupdate on Fedora/RHEL + * Tue Jan 09 2024 Andreas Schneider - 4.19.4-2 - resolves: rhbz#2256326 - Create all groups using systemd From a0149239aa31a7f0083e05c8e2e46ec25b6f17f0 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 27 Jan 2024 02:03:30 +0000 Subject: [PATCH 300/425] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- samba.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 8dce900..136e8e3 100644 --- a/samba.spec +++ b/samba.spec @@ -147,7 +147,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.19.4 -%global baserelease 3 +%global baserelease 4 # This should be rc1 or %%nil %global pre_release %nil @@ -4471,6 +4471,9 @@ fi %endif %changelog +* Sat Jan 27 2024 Fedora Release Engineering - 2:4.19.4-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Tue Jan 16 2024 Andreas Schneider - 4.29.4-3 - Fix samba-gpupdate on Fedora/RHEL From fc5ba481784bccd717ed4961113dea7b2c2a7d5a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 29 Jan 2024 19:39:19 +0100 Subject: [PATCH 301/425] Update to version 4.20.0rc1 resolves: #2260895 Guenther --- .gitignore | 2 + samba-4.19-fix-gpupdate-rhel-fedora.patch | 638 ---------------------- samba-4.19-fix-gpupdate-site-aware.patch | 61 --- samba.spec | 375 ++++++++----- sources | 4 +- 5 files changed, 251 insertions(+), 829 deletions(-) delete mode 100644 samba-4.19-fix-gpupdate-rhel-fedora.patch delete mode 100644 samba-4.19-fix-gpupdate-site-aware.patch diff --git a/.gitignore b/.gitignore index 347f3eb..9a1363f 100644 --- a/.gitignore +++ b/.gitignore @@ -355,3 +355,5 @@ samba-3.6.0pre1.tar.gz /samba-4.19.3.tar.asc /samba-4.19.4.tar.xz /samba-4.19.4.tar.asc +/samba-4.20.0rc1.tar.xz +/samba-4.20.0rc1.tar.asc diff --git a/samba-4.19-fix-gpupdate-rhel-fedora.patch b/samba-4.19-fix-gpupdate-rhel-fedora.patch deleted file mode 100644 index 6381e0a..0000000 --- a/samba-4.19-fix-gpupdate-rhel-fedora.patch +++ /dev/null @@ -1,638 +0,0 @@ -From 549b5fe579fc15d63b71b1cc8a0ebf4e4869171b Mon Sep 17 00:00:00 2001 -From: Gabriel Nagy -Date: Thu, 17 Aug 2023 01:05:54 +0300 -Subject: [PATCH 1/9] gp: Support more global trust directories - -In addition to the SUSE global trust directory, add support for RHEL and -Debian-based distributions (including Ubuntu). - -To determine the correct directory to use, we iterate over the variants -and stop at the first which is a directory. - -In case none is found, fallback to the first option which will produce a -warning as it did previously. - -Signed-off-by: Gabriel Nagy -Reviewed-by: Joseph Sutton -Reviewed-by: David Mulder -(cherry picked from commit a1b285e485c0b5a8747499bdbbb9f3f4fc025b2f) ---- - python/samba/gp/gp_cert_auto_enroll_ext.py | 12 +++++++++++- - 1 file changed, 11 insertions(+), 1 deletion(-) - -diff --git a/python/samba/gp/gp_cert_auto_enroll_ext.py b/python/samba/gp/gp_cert_auto_enroll_ext.py -index 312c8ddf467..1b90ab46e90 100644 ---- a/python/samba/gp/gp_cert_auto_enroll_ext.py -+++ b/python/samba/gp/gp_cert_auto_enroll_ext.py -@@ -45,10 +45,12 @@ cert_wrap = b""" - -----BEGIN CERTIFICATE----- - %s - -----END CERTIFICATE-----""" --global_trust_dir = '/etc/pki/trust/anchors' - endpoint_re = '(https|HTTPS)://(?P[a-zA-Z0-9.-]+)/ADPolicyProvider' + \ - '_CEP_(?P[a-zA-Z]+)/service.svc/CEP' - -+global_trust_dirs = ['/etc/pki/trust/anchors', # SUSE -+ '/etc/pki/ca-trust/source/anchors', # RHEL/Fedora -+ '/usr/local/share/ca-certificates'] # Debian/Ubuntu - - def octet_string_to_objectGUID(data): - """Convert an octet string to an objectGUID.""" -@@ -249,12 +251,20 @@ def getca(ca, url, trust_dir): - return root_certs - - -+def find_global_trust_dir(): -+ """Return the global trust dir using known paths from various Linux distros.""" -+ for trust_dir in global_trust_dirs: -+ if os.path.isdir(trust_dir): -+ return trust_dir -+ return global_trust_dirs[0] -+ - def cert_enroll(ca, ldb, trust_dir, private_dir, auth='Kerberos'): - """Install the root certificate chain.""" - data = dict({'files': [], 'templates': []}, **ca) - url = 'http://%s/CertSrv/mscep/mscep.dll/pkiclient.exe?' % ca['hostname'] - root_certs = getca(ca, url, trust_dir) - data['files'].extend(root_certs) -+ global_trust_dir = find_global_trust_dir() - for src in root_certs: - # Symlink the certs to global trust dir - dst = os.path.join(global_trust_dir, os.path.basename(src)) --- -2.43.0 - - -From c624a1e9b1d09fe2bb3f9778cb616230e57168a8 Mon Sep 17 00:00:00 2001 -From: Gabriel Nagy -Date: Thu, 17 Aug 2023 01:09:28 +0300 -Subject: [PATCH 2/9] gp: Support update-ca-trust helper - -This is used on RHEL/Fedora instead of update-ca-certificates. They -behave similarly so it's enough to change the command name. - -Signed-off-by: Gabriel Nagy -Reviewed-by: Joseph Sutton -Reviewed-by: David Mulder -(cherry picked from commit fa80d1d86439749c44e60cf9075e84dc9ed3c268) ---- - python/samba/gp/gp_cert_auto_enroll_ext.py | 6 +++++- - 1 file changed, 5 insertions(+), 1 deletion(-) - -diff --git a/python/samba/gp/gp_cert_auto_enroll_ext.py b/python/samba/gp/gp_cert_auto_enroll_ext.py -index 1b90ab46e90..cefdafa21b2 100644 ---- a/python/samba/gp/gp_cert_auto_enroll_ext.py -+++ b/python/samba/gp/gp_cert_auto_enroll_ext.py -@@ -258,6 +258,10 @@ def find_global_trust_dir(): - return trust_dir - return global_trust_dirs[0] - -+def update_ca_command(): -+ """Return the command to update the CA trust store.""" -+ return which('update-ca-certificates') or which('update-ca-trust') -+ - def cert_enroll(ca, ldb, trust_dir, private_dir, auth='Kerberos'): - """Install the root certificate chain.""" - data = dict({'files': [], 'templates': []}, **ca) -@@ -283,7 +287,7 @@ def cert_enroll(ca, ldb, trust_dir, private_dir, auth='Kerberos'): - # already exists. Ignore the FileExistsError. Preserve the - # existing symlink in the unapply data. - data['files'].append(dst) -- update = which('update-ca-certificates') -+ update = update_ca_command() - if update is not None: - Popen([update]).wait() - # Setup Certificate Auto Enrollment --- -2.43.0 - - -From 086406ca457cc17e15001fb44802276ada068679 Mon Sep 17 00:00:00 2001 -From: Gabriel Nagy -Date: Fri, 11 Aug 2023 18:46:42 +0300 -Subject: [PATCH 3/9] gp: Change root cert extension suffix - -On Ubuntu, certificates must end in '.crt' in order to be considered by -the `update-ca-certificates` helper. - -Signed-off-by: Gabriel Nagy -Reviewed-by: Joseph Sutton -Reviewed-by: David Mulder -(cherry picked from commit bce3a89204545dcab5fb39a712590f6e166f997b) ---- - python/samba/gp/gp_cert_auto_enroll_ext.py | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/python/samba/gp/gp_cert_auto_enroll_ext.py b/python/samba/gp/gp_cert_auto_enroll_ext.py -index cefdafa21b2..c562722906b 100644 ---- a/python/samba/gp/gp_cert_auto_enroll_ext.py -+++ b/python/samba/gp/gp_cert_auto_enroll_ext.py -@@ -241,7 +241,8 @@ def getca(ca, url, trust_dir): - certs = load_der_pkcs7_certificates(r.content) - for i in range(0, len(certs)): - cert = certs[i].public_bytes(Encoding.PEM) -- dest = '%s.%d' % (root_cert, i) -+ filename, extension = root_cert.rsplit('.', 1) -+ dest = '%s.%d.%s' % (filename, i, extension) - with open(dest, 'wb') as w: - w.write(cert) - root_certs.append(dest) --- -2.43.0 - - -From c57c32020cc9017191b8c8657ebabe00d552a6e3 Mon Sep 17 00:00:00 2001 -From: Gabriel Nagy -Date: Fri, 18 Aug 2023 17:06:43 +0300 -Subject: [PATCH 4/9] gp: Test with binary content for certificate data - -This fails all GPO-related tests that call `gpupdate --rsop`. - -Signed-off-by: Gabriel Nagy -Reviewed-by: Joseph Sutton -Reviewed-by: David Mulder -(cherry picked from commit 1ef722cf66f9ec99f52939f1cfca031c5fe1ad70) ---- - python/samba/tests/gpo.py | 8 ++++---- - selftest/knownfail.d/gpo | 13 +++++++++++++ - 2 files changed, 17 insertions(+), 4 deletions(-) - create mode 100644 selftest/knownfail.d/gpo - -diff --git a/python/samba/tests/gpo.py b/python/samba/tests/gpo.py -index e4b75cc62a4..963f873f755 100644 ---- a/python/samba/tests/gpo.py -+++ b/python/samba/tests/gpo.py -@@ -6783,14 +6783,14 @@ class GPOTests(tests.TestCase): - ldb.add({'dn': certa_dn, - 'objectClass': 'certificationAuthority', - 'authorityRevocationList': ['XXX'], -- 'cACertificate': 'XXX', -+ 'cACertificate': b'0\x82\x03u0\x82\x02]\xa0\x03\x02\x01\x02\x02\x10I', - 'certificateRevocationList': ['XXX'], - }) - # Write the dummy pKIEnrollmentService - enroll_dn = 'CN=%s,CN=Enrollment Services,%s' % (ca_cn, confdn) - ldb.add({'dn': enroll_dn, - 'objectClass': 'pKIEnrollmentService', -- 'cACertificate': 'XXXX', -+ 'cACertificate': b'0\x82\x03u0\x82\x02]\xa0\x03\x02\x01\x02\x02\x10I', - 'certificateTemplates': ['Machine'], - 'dNSHostName': hostname, - }) -@@ -7201,14 +7201,14 @@ class GPOTests(tests.TestCase): - ldb.add({'dn': certa_dn, - 'objectClass': 'certificationAuthority', - 'authorityRevocationList': ['XXX'], -- 'cACertificate': 'XXX', -+ 'cACertificate': b'0\x82\x03u0\x82\x02]\xa0\x03\x02\x01\x02\x02\x10I', - 'certificateRevocationList': ['XXX'], - }) - # Write the dummy pKIEnrollmentService - enroll_dn = 'CN=%s,CN=Enrollment Services,%s' % (ca_cn, confdn) - ldb.add({'dn': enroll_dn, - 'objectClass': 'pKIEnrollmentService', -- 'cACertificate': 'XXXX', -+ 'cACertificate': b'0\x82\x03u0\x82\x02]\xa0\x03\x02\x01\x02\x02\x10I', - 'certificateTemplates': ['Machine'], - 'dNSHostName': hostname, - }) -diff --git a/selftest/knownfail.d/gpo b/selftest/knownfail.d/gpo -new file mode 100644 -index 00000000000..0aad59607c2 ---- /dev/null -+++ b/selftest/knownfail.d/gpo -@@ -0,0 +1,13 @@ -+^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_user_centrify_crontab_ext -+^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_user_scripts_ext -+^samba.tests.gpo.samba.tests.gpo.GPOTests.test_rsop -+^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_access -+^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_files -+^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_issue -+^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_motd -+^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_openssh -+^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_startup_scripts -+^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_sudoers -+^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_symlink -+^samba.tests.gpo.samba.tests.gpo.GPOTests.test_advanced_gp_cert_auto_enroll_ext -+^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_cert_auto_enroll_ext --- -2.43.0 - - -From c53b2994fd13f4c74cee891e725a4558cdb06b2d Mon Sep 17 00:00:00 2001 -From: Gabriel Nagy -Date: Wed, 16 Aug 2023 12:20:11 +0300 -Subject: [PATCH 5/9] gp: Convert CA certificates to base64 - -I don't know whether this applies universally, but in our case the -contents of `es['cACertificate'][0]` are binary, so cleanly converting -to a string fails with the following: - -'utf-8' codec can't decode byte 0x82 in position 1: invalid start byte - -We found a fix to be encoding the certificate to base64 when -constructing the CA list. - -Section 4.4.5.2 of MS-CAESO also suggests that the content of -`cACertificate` is binary (OCTET string). - -Signed-off-by: Gabriel Nagy -Reviewed-by: Joseph Sutton -Reviewed-by: David Mulder -(cherry picked from commit 157335ee93eb866f9b6a47486a5668d6e76aced5) ---- - python/samba/gp/gp_cert_auto_enroll_ext.py | 5 ++--- - selftest/knownfail.d/gpo | 13 ------------- - 2 files changed, 2 insertions(+), 16 deletions(-) - delete mode 100644 selftest/knownfail.d/gpo - -diff --git a/python/samba/gp/gp_cert_auto_enroll_ext.py b/python/samba/gp/gp_cert_auto_enroll_ext.py -index c562722906b..c8b5368c16a 100644 ---- a/python/samba/gp/gp_cert_auto_enroll_ext.py -+++ b/python/samba/gp/gp_cert_auto_enroll_ext.py -@@ -158,7 +158,7 @@ def fetch_certification_authorities(ldb): - for es in res: - data = { 'name': get_string(es['cn'][0]), - 'hostname': get_string(es['dNSHostName'][0]), -- 'cACertificate': get_string(es['cACertificate'][0]) -+ 'cACertificate': get_string(base64.b64encode(es['cACertificate'][0])) - } - result.append(data) - return result -@@ -176,8 +176,7 @@ def fetch_template_attrs(ldb, name, attrs=None): - return {'msPKI-Minimal-Key-Size': ['2048']} - - def format_root_cert(cert): -- cert = base64.b64encode(cert.encode()) -- return cert_wrap % re.sub(b"(.{64})", b"\\1\n", cert, 0, re.DOTALL) -+ return cert_wrap % re.sub(b"(.{64})", b"\\1\n", cert.encode(), 0, re.DOTALL) - - def find_cepces_submit(): - certmonger_dirs = [os.environ.get("PATH"), '/usr/lib/certmonger', -diff --git a/selftest/knownfail.d/gpo b/selftest/knownfail.d/gpo -deleted file mode 100644 -index 0aad59607c2..00000000000 ---- a/selftest/knownfail.d/gpo -+++ /dev/null -@@ -1,13 +0,0 @@ --^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_user_centrify_crontab_ext --^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_user_scripts_ext --^samba.tests.gpo.samba.tests.gpo.GPOTests.test_rsop --^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_access --^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_files --^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_issue --^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_motd --^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_openssh --^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_startup_scripts --^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_sudoers --^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_symlink --^samba.tests.gpo.samba.tests.gpo.GPOTests.test_advanced_gp_cert_auto_enroll_ext --^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_cert_auto_enroll_ext --- -2.43.0 - - -From fd13702a9cd6475a14113de87ccad6588d2d443b Mon Sep 17 00:00:00 2001 -From: Gabriel Nagy -Date: Fri, 18 Aug 2023 17:16:23 +0300 -Subject: [PATCH 6/9] gp: Test adding new cert templates enforces changes - -Ensure that cepces-submit reporting additional templates and re-applying -will enforce the updated policy. - -Signed-off-by: Gabriel Nagy -Reviewed-by: Joseph Sutton -Reviewed-by: David Mulder -(cherry picked from commit 2d6943a864405f324c467e8c3464c31ac08457b0) ---- - python/samba/tests/bin/cepces-submit | 3 +- - python/samba/tests/gpo.py | 48 ++++++++++++++++++++++++++++ - selftest/knownfail.d/gpo | 2 ++ - 3 files changed, 52 insertions(+), 1 deletion(-) - create mode 100644 selftest/knownfail.d/gpo - -diff --git a/python/samba/tests/bin/cepces-submit b/python/samba/tests/bin/cepces-submit -index 668682a9f58..de63164692b 100755 ---- a/python/samba/tests/bin/cepces-submit -+++ b/python/samba/tests/bin/cepces-submit -@@ -14,4 +14,5 @@ if __name__ == "__main__": - assert opts.auth == 'Kerberos' - if 'CERTMONGER_OPERATION' in os.environ and \ - os.environ['CERTMONGER_OPERATION'] == 'GET-SUPPORTED-TEMPLATES': -- print('Machine') # Report a Machine template -+ templates = os.environ.get('CEPCES_SUBMIT_SUPPORTED_TEMPLATES', 'Machine').split(',') -+ print('\n'.join(templates)) # Report the requested templates -diff --git a/python/samba/tests/gpo.py b/python/samba/tests/gpo.py -index 963f873f755..e75c411bde7 100644 ---- a/python/samba/tests/gpo.py -+++ b/python/samba/tests/gpo.py -@@ -6812,6 +6812,23 @@ class GPOTests(tests.TestCase): - self.assertTrue(os.path.exists(machine_crt), - 'Machine key was not generated') - -+ # Subsequent apply should react to new certificate templates -+ os.environ['CEPCES_SUBMIT_SUPPORTED_TEMPLATES'] = 'Machine,Workstation' -+ self.addCleanup(os.environ.pop, 'CEPCES_SUBMIT_SUPPORTED_TEMPLATES') -+ ext.process_group_policy([], gpos, dname, dname) -+ self.assertTrue(os.path.exists(ca_crt), -+ 'Root CA certificate was not requested') -+ self.assertTrue(os.path.exists(machine_crt), -+ 'Machine certificate was not requested') -+ self.assertTrue(os.path.exists(machine_crt), -+ 'Machine key was not generated') -+ workstation_crt = os.path.join(dname, '%s.Workstation.crt' % ca_cn) -+ self.assertTrue(os.path.exists(workstation_crt), -+ 'Workstation certificate was not requested') -+ workstation_key = os.path.join(dname, '%s.Workstation.key' % ca_cn) -+ self.assertTrue(os.path.exists(workstation_crt), -+ 'Workstation key was not generated') -+ - # Verify RSOP does not fail - ext.rsop([g for g in gpos if g.name == guid][0]) - -@@ -6829,11 +6846,17 @@ class GPOTests(tests.TestCase): - 'Machine certificate was not removed') - self.assertFalse(os.path.exists(machine_crt), - 'Machine key was not removed') -+ self.assertFalse(os.path.exists(workstation_crt), -+ 'Workstation certificate was not removed') -+ self.assertFalse(os.path.exists(workstation_crt), -+ 'Workstation key was not removed') - out, _ = Popen(['getcert', 'list-cas'], stdout=PIPE).communicate() - self.assertNotIn(get_bytes(ca_cn), out, 'CA was not removed') - out, _ = Popen(['getcert', 'list'], stdout=PIPE).communicate() - self.assertNotIn(b'Machine', out, - 'Machine certificate not removed') -+ self.assertNotIn(b'Workstation', out, -+ 'Workstation certificate not removed') - - # Remove the dummy CA, pKIEnrollmentService, and pKICertificateTemplate - ldb.delete(certa_dn) -@@ -7233,6 +7256,25 @@ class GPOTests(tests.TestCase): - self.assertTrue(os.path.exists(machine_crt), - 'Machine key was not generated') - -+ # Subsequent apply should react to new certificate templates -+ os.environ['CEPCES_SUBMIT_SUPPORTED_TEMPLATES'] = 'Machine,Workstation' -+ self.addCleanup(os.environ.pop, 'CEPCES_SUBMIT_SUPPORTED_TEMPLATES') -+ ext.process_group_policy([], gpos, dname, dname) -+ for ca in ca_list: -+ self.assertTrue(os.path.exists(ca_crt), -+ 'Root CA certificate was not requested') -+ self.assertTrue(os.path.exists(machine_crt), -+ 'Machine certificate was not requested') -+ self.assertTrue(os.path.exists(machine_crt), -+ 'Machine key was not generated') -+ -+ workstation_crt = os.path.join(dname, '%s.Workstation.crt' % ca) -+ self.assertTrue(os.path.exists(workstation_crt), -+ 'Workstation certificate was not requested') -+ workstation_key = os.path.join(dname, '%s.Workstation.key' % ca) -+ self.assertTrue(os.path.exists(workstation_crt), -+ 'Workstation key was not generated') -+ - # Verify RSOP does not fail - ext.rsop([g for g in gpos if g.name == guid][0]) - -@@ -7250,12 +7292,18 @@ class GPOTests(tests.TestCase): - 'Machine certificate was not removed') - self.assertFalse(os.path.exists(machine_crt), - 'Machine key was not removed') -+ self.assertFalse(os.path.exists(workstation_crt), -+ 'Workstation certificate was not removed') -+ self.assertFalse(os.path.exists(workstation_crt), -+ 'Workstation key was not removed') - out, _ = Popen(['getcert', 'list-cas'], stdout=PIPE).communicate() - for ca in ca_list: - self.assertNotIn(get_bytes(ca), out, 'CA was not removed') - out, _ = Popen(['getcert', 'list'], stdout=PIPE).communicate() - self.assertNotIn(b'Machine', out, - 'Machine certificate not removed') -+ self.assertNotIn(b'Workstation', out, -+ 'Workstation certificate not removed') - - # Remove the dummy CA, pKIEnrollmentService, and pKICertificateTemplate - ldb.delete(certa_dn) -diff --git a/selftest/knownfail.d/gpo b/selftest/knownfail.d/gpo -new file mode 100644 -index 00000000000..4edc1dce730 ---- /dev/null -+++ b/selftest/knownfail.d/gpo -@@ -0,0 +1,2 @@ -+^samba.tests.gpo.samba.tests.gpo.GPOTests.test_advanced_gp_cert_auto_enroll_ext -+^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_cert_auto_enroll_ext --- -2.43.0 - - -From 4578c6664ab6eac476ee10afae4a1a95b3b63272 Mon Sep 17 00:00:00 2001 -From: Gabriel Nagy -Date: Wed, 16 Aug 2023 12:37:17 +0300 -Subject: [PATCH 7/9] gp: Template changes should invalidate cache - -If certificate templates are added or removed, the autoenroll extension -should react to this and reapply the policy. Previously this wasn't -taken into account. - -Signed-off-by: Gabriel Nagy -Reviewed-by: Joseph Sutton -Reviewed-by: David Mulder -(cherry picked from commit 2a6ae997f2464b12b72b5314fa80d9784fb0f6c1) ---- - python/samba/gp/gp_cert_auto_enroll_ext.py | 15 ++++++++++----- - selftest/knownfail.d/gpo | 2 -- - 2 files changed, 10 insertions(+), 7 deletions(-) - delete mode 100644 selftest/knownfail.d/gpo - -diff --git a/python/samba/gp/gp_cert_auto_enroll_ext.py b/python/samba/gp/gp_cert_auto_enroll_ext.py -index c8b5368c16a..8233713e8ad 100644 ---- a/python/samba/gp/gp_cert_auto_enroll_ext.py -+++ b/python/samba/gp/gp_cert_auto_enroll_ext.py -@@ -262,6 +262,11 @@ def update_ca_command(): - """Return the command to update the CA trust store.""" - return which('update-ca-certificates') or which('update-ca-trust') - -+def changed(new_data, old_data): -+ """Return True if any key present in both dicts has changed.""" -+ return any((new_data[k] != old_data[k] if k in old_data else False) \ -+ for k in new_data.keys()) -+ - def cert_enroll(ca, ldb, trust_dir, private_dir, auth='Kerberos'): - """Install the root certificate chain.""" - data = dict({'files': [], 'templates': []}, **ca) -@@ -351,12 +356,12 @@ class gp_cert_auto_enroll_ext(gp_pol_ext, gp_applier): - # If the policy has changed, unapply, then apply new policy - old_val = self.cache_get_attribute_value(guid, attribute) - old_data = json.loads(old_val) if old_val is not None else {} -- if all([(ca[k] == old_data[k] if k in old_data else False) \ -- for k in ca.keys()]) or \ -- self.cache_get_apply_state() == GPOSTATE.ENFORCE: -+ templates = ['%s.%s' % (ca['name'], t.decode()) for t in get_supported_templates(ca['hostname'])] -+ new_data = { 'templates': templates, **ca } -+ if changed(new_data, old_data) or self.cache_get_apply_state() == GPOSTATE.ENFORCE: - self.unapply(guid, attribute, old_val) -- # If policy is already applied, skip application -- if old_val is not None and \ -+ # If policy is already applied and unchanged, skip application -+ if old_val is not None and not changed(new_data, old_data) and \ - self.cache_get_apply_state() != GPOSTATE.ENFORCE: - return - -diff --git a/selftest/knownfail.d/gpo b/selftest/knownfail.d/gpo -deleted file mode 100644 -index 4edc1dce730..00000000000 ---- a/selftest/knownfail.d/gpo -+++ /dev/null -@@ -1,2 +0,0 @@ --^samba.tests.gpo.samba.tests.gpo.GPOTests.test_advanced_gp_cert_auto_enroll_ext --^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_cert_auto_enroll_ext --- -2.43.0 - - -From 2d641b736b42f7623955f251ad354439b954159d Mon Sep 17 00:00:00 2001 -From: Gabriel Nagy -Date: Fri, 18 Aug 2023 17:26:59 +0300 -Subject: [PATCH 8/9] gp: Test disabled enrollment unapplies policy - -For this we need to stage a Registry.pol file with certificate -autoenrollment enabled, but with checkboxes unticked. - -Signed-off-by: Gabriel Nagy -Reviewed-by: Joseph Sutton -Reviewed-by: David Mulder -(cherry picked from commit ee814f7707a8ddef2657212cd6d31799501b7bb3) ---- - python/samba/tests/gpo.py | 54 +++++++++++++++++++++++++++++++++++++++ - selftest/knownfail.d/gpo | 1 + - 2 files changed, 55 insertions(+) - create mode 100644 selftest/knownfail.d/gpo - -diff --git a/python/samba/tests/gpo.py b/python/samba/tests/gpo.py -index e75c411bde7..580f3568de8 100644 ---- a/python/samba/tests/gpo.py -+++ b/python/samba/tests/gpo.py -@@ -281,6 +281,28 @@ b""" - - """ - -+auto_enroll_unchecked_reg_pol = \ -+b""" -+ -+ -+ -+ Software\Policies\Microsoft\Cryptography\AutoEnrollment -+ AEPolicy -+ 0 -+ -+ -+ Software\Policies\Microsoft\Cryptography\AutoEnrollment -+ OfflineExpirationPercent -+ 10 -+ -+ -+ Software\Policies\Microsoft\Cryptography\AutoEnrollment -+ OfflineExpirationStoreNames -+ MY -+ -+ -+""" -+ - advanced_enroll_reg_pol = \ - b""" - -@@ -6836,6 +6858,38 @@ class GPOTests(tests.TestCase): - ret = rsop(self.lp) - self.assertEqual(ret, 0, 'gpupdate --rsop failed!') - -+ # Remove policy by staging pol file with auto-enroll unchecked -+ parser.load_xml(etree.fromstring(auto_enroll_unchecked_reg_pol.strip())) -+ ret = stage_file(reg_pol, ndr_pack(parser.pol_file)) -+ self.assertTrue(ret, 'Could not create the target %s' % reg_pol) -+ ext.process_group_policy([], gpos, dname, dname) -+ self.assertFalse(os.path.exists(ca_crt), -+ 'Root CA certificate was not removed') -+ self.assertFalse(os.path.exists(machine_crt), -+ 'Machine certificate was not removed') -+ self.assertFalse(os.path.exists(machine_crt), -+ 'Machine key was not removed') -+ self.assertFalse(os.path.exists(workstation_crt), -+ 'Workstation certificate was not removed') -+ self.assertFalse(os.path.exists(workstation_crt), -+ 'Workstation key was not removed') -+ -+ # Reapply policy by staging the enabled pol file -+ parser.load_xml(etree.fromstring(auto_enroll_reg_pol.strip())) -+ ret = stage_file(reg_pol, ndr_pack(parser.pol_file)) -+ self.assertTrue(ret, 'Could not create the target %s' % reg_pol) -+ ext.process_group_policy([], gpos, dname, dname) -+ self.assertTrue(os.path.exists(ca_crt), -+ 'Root CA certificate was not requested') -+ self.assertTrue(os.path.exists(machine_crt), -+ 'Machine certificate was not requested') -+ self.assertTrue(os.path.exists(machine_crt), -+ 'Machine key was not generated') -+ self.assertTrue(os.path.exists(workstation_crt), -+ 'Workstation certificate was not requested') -+ self.assertTrue(os.path.exists(workstation_crt), -+ 'Workstation key was not generated') -+ - # Remove policy - gp_db = store.get_gplog(machine_creds.get_username()) - del_gpos = get_deleted_gpos_list(gp_db, []) -diff --git a/selftest/knownfail.d/gpo b/selftest/knownfail.d/gpo -new file mode 100644 -index 00000000000..83bc9f0ac1f ---- /dev/null -+++ b/selftest/knownfail.d/gpo -@@ -0,0 +1 @@ -+^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_cert_auto_enroll_ext --- -2.43.0 - - -From e5588f8800899894388284468b9e25463d3c3e6c Mon Sep 17 00:00:00 2001 -From: Gabriel Nagy -Date: Wed, 16 Aug 2023 12:33:59 +0300 -Subject: [PATCH 9/9] gp: Send list of keys instead of dict to remove - -`cache_get_all_attribute_values` returns a dict whereas we need to pass -a list of keys to `remove`. These will be interpolated in the gpdb search. - -Signed-off-by: Gabriel Nagy -Reviewed-by: Joseph Sutton -Reviewed-by: David Mulder - -Autobuild-User(master): Andrew Bartlett -Autobuild-Date(master): Mon Aug 28 03:01:22 UTC 2023 on atb-devel-224 - -(cherry picked from commit 7dc181757c76b881ceaf1915ebb0bfbcf5aca83a) ---- - python/samba/gp/gp_cert_auto_enroll_ext.py | 2 +- - selftest/knownfail.d/gpo | 1 - - 2 files changed, 1 insertion(+), 2 deletions(-) - delete mode 100644 selftest/knownfail.d/gpo - -diff --git a/python/samba/gp/gp_cert_auto_enroll_ext.py b/python/samba/gp/gp_cert_auto_enroll_ext.py -index 8233713e8ad..64c35782ae8 100644 ---- a/python/samba/gp/gp_cert_auto_enroll_ext.py -+++ b/python/samba/gp/gp_cert_auto_enroll_ext.py -@@ -415,7 +415,7 @@ class gp_cert_auto_enroll_ext(gp_pol_ext, gp_applier): - # remove any existing policy - ca_attrs = \ - self.cache_get_all_attribute_values(gpo.name) -- self.clean(gpo.name, remove=ca_attrs) -+ self.clean(gpo.name, remove=list(ca_attrs.keys())) - - def __read_cep_data(self, guid, ldb, end_point_information, - trust_dir, private_dir): -diff --git a/selftest/knownfail.d/gpo b/selftest/knownfail.d/gpo -deleted file mode 100644 -index 83bc9f0ac1f..00000000000 ---- a/selftest/knownfail.d/gpo -+++ /dev/null -@@ -1 +0,0 @@ --^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_cert_auto_enroll_ext --- -2.43.0 - diff --git a/samba-4.19-fix-gpupdate-site-aware.patch b/samba-4.19-fix-gpupdate-site-aware.patch deleted file mode 100644 index 3354bb0..0000000 --- a/samba-4.19-fix-gpupdate-site-aware.patch +++ /dev/null @@ -1,61 +0,0 @@ -From 372b8f15ccf37c491f43ec7ab81be692ff0fcfed Mon Sep 17 00:00:00 2001 -From: David Mulder -Date: Fri, 5 Jan 2024 08:47:07 -0700 -Subject: [PATCH] WIP: gp: Skip site GP list if no site is found - -[MS-GPOL] 3.2.5.1.4 Site Search says if the site -search returns ERROR_NO_SITENAME, the GP site -search should be skipped. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15548 - -Signed-off-by: David Mulder ---- - python/samba/gp/gpclass.py | 30 ++++++++++++++++++------------ - 1 file changed, 18 insertions(+), 12 deletions(-) - -diff --git a/python/samba/gp/gpclass.py b/python/samba/gp/gpclass.py -index b7a0dcb0ed5..26c2386847e 100644 ---- a/python/samba/gp/gpclass.py -+++ b/python/samba/gp/gpclass.py -@@ -896,19 +896,25 @@ def get_gpo_list(dc_hostname, creds, lp, username): - - # (S)ite - if gpo_list_machine: -- site_dn = site_dn_for_machine(samdb, dc_hostname, lp, creds, username) -- - try: -- log.debug("get_gpo_list: query SITE: [%s] for GPOs" % site_dn) -- gp_link = get_gpo_link(samdb, site_dn) -- except ldb.LdbError as e: -- (enum, estr) = e.args -- log.debug(estr) -- else: -- add_gplink_to_gpo_list(samdb, gpo_list, forced_gpo_list, -- site_dn, gp_link, -- gpo.GP_LINK_SITE, -- add_only_forced_gpos, token) -+ site_dn = site_dn_for_machine(samdb, dc_hostname, lp, creds, username) -+ -+ try: -+ log.debug("get_gpo_list: query SITE: [%s] for GPOs" % site_dn) -+ gp_link = get_gpo_link(samdb, site_dn) -+ except ldb.LdbError as e: -+ (enum, estr) = e.args -+ log.debug(estr) -+ else: -+ add_gplink_to_gpo_list(samdb, gpo_list, forced_gpo_list, -+ site_dn, gp_link, -+ gpo.GP_LINK_SITE, -+ add_only_forced_gpos, token) -+ except ldb.LdbError: -+ # [MS-GPOL] 3.2.5.1.4 Site Search: If the method returns -+ # ERROR_NO_SITENAME, the remainder of this message MUST be skipped -+ # and the protocol sequence MUST continue at GPO Search -+ pass - - # (L)ocal - gpo_list.insert(0, gpo.GROUP_POLICY_OBJECT("Local Policy", --- -GitLab - diff --git a/samba.spec b/samba.spec index 136e8e3..e55167e 100644 --- a/samba.spec +++ b/samba.spec @@ -146,10 +146,10 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.19.4 -%global baserelease 4 +%global samba_version 4.20.0 +%global baserelease 1 # This should be rc1 or %%nil -%global pre_release %nil +%global pre_release rc1 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -164,7 +164,7 @@ %global libdcerpc_so_version 0 %global libndr_krb5pac_so_version 0 %global libndr_nbt_so_version 0 -%global libndr_so_version 3 +%global libndr_so_version 4 %global libndr_standard_so_version 0 %global libnetapi_so_version 1 %global libsamba_credentials_so_version 1 @@ -180,10 +180,10 @@ %global libsmbclient_so_version 0 %global libwbclient_so_version 0 -%global talloc_version 2.4.1 -%global tdb_version 1.4.9 -%global tevent_version 0.15.0 -%global ldb_version 2.8.0 +%global talloc_version 2.4.2 +%global tdb_version 1.4.10 +%global tevent_version 0.16.1 +%global ldb_version 2.9.0 %global required_mit_krb5 1.20.1 @@ -238,9 +238,6 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore -Patch0: samba-4.19-fix-gpupdate-rhel-fedora.patch -Patch1: samba-4.19-fix-gpupdate-site-aware.patch - Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} @@ -1660,8 +1657,8 @@ fi %{_sbindir}/nmbd %{_sbindir}/smbd %if %{with dc} || %{with testsuite} -# This is only used by vfs_dfs_samba4 -%{_libdir}/samba/libdfs-server-ad-samba4.so +# This is only used by vfs_dfs_samba-private +%{_libdir}/samba/libdfs-server-ad-private-samba.so %endif %dir %{_libdir}/samba/auth %{_libdir}/samba/auth/unix.so @@ -1799,6 +1796,7 @@ fi %{_bindir}/smbspool %{_bindir}/smbtar %{_bindir}/smbtree +%{_bindir}/wspsearch %dir %{_libexecdir}/samba %ghost %{_libexecdir}/samba/cups_backend_smb %{_mandir}/man1/dbwrap_tool.1* @@ -1870,86 +1868,86 @@ fi %{_libdir}/libtevent-util.so.%{libtevent_util_so_version}* %dir %{_libdir}/samba -%{_libdir}/samba/libCHARSET3-samba4.so -%{_libdir}/samba/libMESSAGING-SEND-samba4.so -%{_libdir}/samba/libMESSAGING-samba4.so -%{_libdir}/samba/libaddns-samba4.so -%{_libdir}/samba/libads-samba4.so -%{_libdir}/samba/libasn1util-samba4.so -%{_libdir}/samba/libauth-samba4.so -%{_libdir}/samba/libauthkrb5-samba4.so -%{_libdir}/samba/libcli-cldap-samba4.so -%{_libdir}/samba/libcli-ldap-common-samba4.so -%{_libdir}/samba/libcli-ldap-samba4.so -%{_libdir}/samba/libcli-nbt-samba4.so -%{_libdir}/samba/libcli-smb-common-samba4.so -%{_libdir}/samba/libcli-spoolss-samba4.so -%{_libdir}/samba/libcliauth-samba4.so -%{_libdir}/samba/libclidns-samba4.so -%{_libdir}/samba/libcluster-samba4.so -%{_libdir}/samba/libcmdline-contexts-samba4.so -%{_libdir}/samba/libcommon-auth-samba4.so -%{_libdir}/samba/libctdb-event-client-samba4.so -%{_libdir}/samba/libdbwrap-samba4.so -%{_libdir}/samba/libdcerpc-pkt-auth-samba4.so -%{_libdir}/samba/libdcerpc-samba-samba4.so -%{_libdir}/samba/libevents-samba4.so -%{_libdir}/samba/libflag-mapping-samba4.so -%{_libdir}/samba/libgenrand-samba4.so -%{_libdir}/samba/libgensec-samba4.so -%{_libdir}/samba/libgpext-samba4.so -%{_libdir}/samba/libgpo-samba4.so -%{_libdir}/samba/libgse-samba4.so -%{_libdir}/samba/libhttp-samba4.so -%{_libdir}/samba/libinterfaces-samba4.so -%{_libdir}/samba/libiov-buf-samba4.so -%{_libdir}/samba/libkrb5samba-samba4.so -%{_libdir}/samba/libldbsamba-samba4.so -%{_libdir}/samba/liblibcli-lsa3-samba4.so -%{_libdir}/samba/liblibcli-netlogon3-samba4.so -%{_libdir}/samba/liblibsmb-samba4.so -%{_libdir}/samba/libmessages-dgm-samba4.so -%{_libdir}/samba/libmessages-util-samba4.so -%{_libdir}/samba/libmscat-samba4.so -%{_libdir}/samba/libmsghdr-samba4.so -%{_libdir}/samba/libmsrpc3-samba4.so -%{_libdir}/samba/libndr-samba-samba4.so -%{_libdir}/samba/libndr-samba4.so -%{_libdir}/samba/libnet-keytab-samba4.so -%{_libdir}/samba/libnetif-samba4.so -%{_libdir}/samba/libnpa-tstream-samba4.so -%{_libdir}/samba/libposix-eadb-samba4.so -%{_libdir}/samba/libprinter-driver-samba4.so -%{_libdir}/samba/libprinting-migrate-samba4.so -%{_libdir}/samba/libreplace-samba4.so -%{_libdir}/samba/libregistry-samba4.so -%{_libdir}/samba/libsamba-cluster-support-samba4.so -%{_libdir}/samba/libsamba-debug-samba4.so -%{_libdir}/samba/libsamba-modules-samba4.so -%{_libdir}/samba/libsamba-security-samba4.so -%{_libdir}/samba/libsamba-sockets-samba4.so -%{_libdir}/samba/libsamba3-util-samba4.so -%{_libdir}/samba/libsamdb-common-samba4.so -%{_libdir}/samba/libsecrets3-samba4.so -%{_libdir}/samba/libserver-id-db-samba4.so -%{_libdir}/samba/libserver-role-samba4.so -%{_libdir}/samba/libsmb-transport-samba4.so -%{_libdir}/samba/libsmbclient-raw-samba4.so -%{_libdir}/samba/libsmbd-base-samba4.so -%{_libdir}/samba/libsmbd-shim-samba4.so -%{_libdir}/samba/libsmbldaphelper-samba4.so -%{_libdir}/samba/libstable-sort-samba4.so -%{_libdir}/samba/libsys-rw-samba4.so -%{_libdir}/samba/libsocket-blocking-samba4.so -%{_libdir}/samba/libtalloc-report-printf-samba4.so -%{_libdir}/samba/libtalloc-report-samba4.so -%{_libdir}/samba/libtdb-wrap-samba4.so -%{_libdir}/samba/libtime-basic-samba4.so -%{_libdir}/samba/libtorture-samba4.so -%{_libdir}/samba/libtrusts-util-samba4.so -%{_libdir}/samba/libutil-reg-samba4.so -%{_libdir}/samba/libutil-setid-samba4.so -%{_libdir}/samba/libutil-tdb-samba4.so +%{_libdir}/samba/libCHARSET3-private-samba.so +%{_libdir}/samba/libMESSAGING-SEND-private-samba.so +%{_libdir}/samba/libMESSAGING-private-samba.so +%{_libdir}/samba/libaddns-private-samba.so +%{_libdir}/samba/libads-private-samba.so +%{_libdir}/samba/libasn1util-private-samba.so +%{_libdir}/samba/libauth-private-samba.so +%{_libdir}/samba/libauthkrb5-private-samba.so +%{_libdir}/samba/libcli-cldap-private-samba.so +%{_libdir}/samba/libcli-ldap-common-private-samba.so +%{_libdir}/samba/libcli-ldap-private-samba.so +%{_libdir}/samba/libcli-nbt-private-samba.so +%{_libdir}/samba/libcli-smb-common-private-samba.so +%{_libdir}/samba/libcli-spoolss-private-samba.so +%{_libdir}/samba/libcliauth-private-samba.so +%{_libdir}/samba/libclidns-private-samba.so +%{_libdir}/samba/libcluster-private-samba.so +%{_libdir}/samba/libcmdline-contexts-private-samba.so +%{_libdir}/samba/libcommon-auth-private-samba.so +%{_libdir}/samba/libctdb-event-client-private-samba.so +%{_libdir}/samba/libdbwrap-private-samba.so +%{_libdir}/samba/libdcerpc-pkt-auth-private-samba.so +%{_libdir}/samba/libdcerpc-samba-private-samba.so +%{_libdir}/samba/libevents-private-samba.so +%{_libdir}/samba/libflag-mapping-private-samba.so +%{_libdir}/samba/libgenrand-private-samba.so +%{_libdir}/samba/libgensec-private-samba.so +%{_libdir}/samba/libgpext-private-samba.so +%{_libdir}/samba/libgpo-private-samba.so +%{_libdir}/samba/libgse-private-samba.so +%{_libdir}/samba/libhttp-private-samba.so +%{_libdir}/samba/libinterfaces-private-samba.so +%{_libdir}/samba/libiov-buf-private-samba.so +%{_libdir}/samba/libkrb5samba-private-samba.so +%{_libdir}/samba/libldbsamba-private-samba.so +%{_libdir}/samba/liblibcli-lsa3-private-samba.so +%{_libdir}/samba/liblibcli-netlogon3-private-samba.so +%{_libdir}/samba/liblibsmb-private-samba.so +%{_libdir}/samba/libmessages-dgm-private-samba.so +%{_libdir}/samba/libmessages-util-private-samba.so +%{_libdir}/samba/libmscat-private-samba.so +%{_libdir}/samba/libmsghdr-private-samba.so +%{_libdir}/samba/libmsrpc3-private-samba.so +%{_libdir}/samba/libndr-samba-private-samba.so +%{_libdir}/samba/libndr-samba4-private-samba.so +%{_libdir}/samba/libnet-keytab-private-samba.so +%{_libdir}/samba/libnetif-private-samba.so +%{_libdir}/samba/libnpa-tstream-private-samba.so +%{_libdir}/samba/libposix-eadb-private-samba.so +%{_libdir}/samba/libprinter-driver-private-samba.so +%{_libdir}/samba/libprinting-migrate-private-samba.so +%{_libdir}/samba/libreplace-private-samba.so +%{_libdir}/samba/libregistry-private-samba.so +%{_libdir}/samba/libsamba-cluster-support-private-samba.so +%{_libdir}/samba/libsamba-debug-private-samba.so +%{_libdir}/samba/libsamba-modules-private-samba.so +%{_libdir}/samba/libsamba-security-private-samba.so +%{_libdir}/samba/libsamba-sockets-private-samba.so +%{_libdir}/samba/libsamba3-util-private-samba.so +%{_libdir}/samba/libsamdb-common-private-samba.so +%{_libdir}/samba/libsecrets3-private-samba.so +%{_libdir}/samba/libserver-id-db-private-samba.so +%{_libdir}/samba/libserver-role-private-samba.so +%{_libdir}/samba/libsmb-transport-private-samba.so +%{_libdir}/samba/libsmbclient-raw-private-samba.so +%{_libdir}/samba/libsmbd-base-private-samba.so +%{_libdir}/samba/libsmbd-shim-private-samba.so +%{_libdir}/samba/libsmbldaphelper-private-samba.so +%{_libdir}/samba/libstable-sort-private-samba.so +%{_libdir}/samba/libsys-rw-private-samba.so +%{_libdir}/samba/libsocket-blocking-private-samba.so +%{_libdir}/samba/libtalloc-report-printf-private-samba.so +%{_libdir}/samba/libtalloc-report-private-samba.so +%{_libdir}/samba/libtdb-wrap-private-samba.so +%{_libdir}/samba/libtime-basic-private-samba.so +%{_libdir}/samba/libtorture-private-samba.so +%{_libdir}/samba/libtrusts-util-private-samba.so +%{_libdir}/samba/libutil-reg-private-samba.so +%{_libdir}/samba/libutil-setid-private-samba.so +%{_libdir}/samba/libutil-tdb-private-samba.so %if %{without libwbclient} %{_libdir}/samba/libwbclient.so.* @@ -1964,9 +1962,9 @@ fi %if %{with includelibs} %{_libdir}/samba/libldb-*.so -%{_libdir}/samba/libtalloc-samba4.so -%{_libdir}/samba/libtdb-samba4.so -%{_libdir}/samba/libtevent-samba4.so +%{_libdir}/samba/libtalloc-private-samba.so +%{_libdir}/samba/libtdb-private-samba.so +%{_libdir}/samba/libtevent-private-samba.so %{_libdir}/samba/ldb/asq.so %{_libdir}/samba/ldb/ldb.so @@ -2009,7 +2007,7 @@ fi ### COMMON-LIBS %files common-libs # common libraries -%{_libdir}/samba/libcmdline-samba4.so +%{_libdir}/samba/libcmdline-private-samba.so %dir %{_libdir}/samba/ldb @@ -2054,6 +2052,7 @@ fi %endif %{_libexecdir}/samba/rpcd_spoolss %{_libexecdir}/samba/rpcd_winreg +%{_libexecdir}/samba/rpcd_witness %{_mandir}/man8/samba-dcerpcd.8* ### DC @@ -2139,16 +2138,16 @@ fi %endif ### DC-LIBS %files dc-libs -%{_libdir}/samba/libauth4-samba4.so +%{_libdir}/samba/libauth4-private-samba.so %if %{with dc} || %{with testsuite} -%{_libdir}/samba/libdb-glue-samba4.so -%{_libdir}/samba/libpac-samba4.so -%{_libdir}/samba/libprocess-model-samba4.so -%{_libdir}/samba/libservice-samba4.so +%{_libdir}/samba/libdb-glue-private-samba.so +%{_libdir}/samba/libpac-private-samba.so +%{_libdir}/samba/libprocess-model-private-samba.so +%{_libdir}/samba/libservice-private-samba.so %if %{with testsuite} -%{_libdir}/samba/libntvfs-samba4.so +%{_libdir}/samba/libntvfs-private-samba.so %endif %dir %{_libdir}/samba/process_model @@ -2174,11 +2173,11 @@ fi %endif %{_libdir}/libdcerpc-server.so.* -%{_libdir}/samba/libad-claims-samba4.so -%{_libdir}/samba/libauthn-policy-util-samba4.so -%{_libdir}/samba/libdsdb-module-samba4.so -%{_libdir}/samba/libdsdb-garbage-collect-tombstones-samba4.so -%{_libdir}/samba/libscavenge-dns-records-samba4.so +%{_libdir}/samba/libad-claims-private-samba.so +%{_libdir}/samba/libauthn-policy-util-private-samba.so +%{_libdir}/samba/libdsdb-module-private-samba.so +%{_libdir}/samba/libdsdb-garbage-collect-tombstones-private-samba.so +%{_libdir}/samba/libscavenge-dns-records-private-samba.so ### DC-BIND %files dc-bind-dlz @@ -2252,6 +2251,7 @@ fi %{_includedir}/samba-4.0/samba/version.h %{_includedir}/samba-4.0/share.h %{_includedir}/samba-4.0/smb2_lease_struct.h +%{_includedir}/samba-4.0/smb3posix.h %{_includedir}/samba-4.0/smbconf.h %{_includedir}/samba-4.0/smb_ldap.h %{_includedir}/samba-4.0/smbldap.h @@ -2365,16 +2365,16 @@ fi %files libs %{_libdir}/libdcerpc-samr.so.* -%{_libdir}/samba/libLIBWBCLIENT-OLD-samba4.so -%{_libdir}/samba/libauth-unix-token-samba4.so -%{_libdir}/samba/libdcerpc-samba4.so -%{_libdir}/samba/libdnsserver-common-samba4.so -%{_libdir}/samba/libshares-samba4.so -%{_libdir}/samba/libsmbpasswdparser-samba4.so -%{_libdir}/samba/libxattr-tdb-samba4.so -%{_libdir}/samba/libREG-FULL-samba4.so -%{_libdir}/samba/libRPC-SERVER-LOOP-samba4.so -%{_libdir}/samba/libRPC-WORKER-samba4.so +%{_libdir}/samba/libLIBWBCLIENT-OLD-private-samba.so +%{_libdir}/samba/libauth-unix-token-private-samba.so +%{_libdir}/samba/libdcerpc-samba4-private-samba.so +%{_libdir}/samba/libdnsserver-common-private-samba.so +%{_libdir}/samba/libshares-private-samba.so +%{_libdir}/samba/libsmbpasswdparser-private-samba.so +%{_libdir}/samba/libxattr-tdb-private-samba.so +%{_libdir}/samba/libREG-FULL-private-samba.so +%{_libdir}/samba/libRPC-SERVER-LOOP-private-samba.so +%{_libdir}/samba/libRPC-WORKER-private-samba.so ### LIBNETAPI %files -n libnetapi @@ -2474,6 +2474,7 @@ fi %{python3_sitearch}/samba/__pycache__/drs_utils.*.pyc %{python3_sitearch}/samba/__pycache__/functional_level.*.pyc %{python3_sitearch}/samba/__pycache__/getopt.*.pyc +%{python3_sitearch}/samba/__pycache__/gkdi.*.pyc %{python3_sitearch}/samba/__pycache__/graph.*.pyc %{python3_sitearch}/samba/__pycache__/hostconfig.*.pyc %{python3_sitearch}/samba/__pycache__/idmap.*.pyc @@ -2484,6 +2485,7 @@ fi %{python3_sitearch}/samba/__pycache__/ms_schema.*.pyc %{python3_sitearch}/samba/__pycache__/ndr.*.pyc %{python3_sitearch}/samba/__pycache__/ntacls.*.pyc +%{python3_sitearch}/samba/__pycache__/nt_time.*.pyc %{python3_sitearch}/samba/__pycache__/policies.*.pyc %{python3_sitearch}/samba/__pycache__/safe_tarfile.*.pyc %{python3_sitearch}/samba/__pycache__/sd_utils.*.pyc @@ -2512,6 +2514,7 @@ fi %{python3_sitearch}/samba/dcerpc/auth.*.so %{python3_sitearch}/samba/dcerpc/base.*.so %{python3_sitearch}/samba/dcerpc/claims.*.so +%{python3_sitearch}/samba/dcerpc/conditional_ace.*.so %{python3_sitearch}/samba/dcerpc/dcerpc.*.so %{python3_sitearch}/samba/dcerpc/dfs.*.so %{python3_sitearch}/samba/dcerpc/dns.*.so @@ -2520,6 +2523,8 @@ fi %{python3_sitearch}/samba/dcerpc/drsuapi.*.so %{python3_sitearch}/samba/dcerpc/echo.*.so %{python3_sitearch}/samba/dcerpc/epmapper.*.so +%{python3_sitearch}/samba/dcerpc/gkdi.*.so +%{python3_sitearch}/samba/dcerpc/gmsa.*.so %{python3_sitearch}/samba/dcerpc/idmap.*.so %{python3_sitearch}/samba/dcerpc/initshutdown.*.so %{python3_sitearch}/samba/dcerpc/irpc.*.so @@ -2538,6 +2543,8 @@ fi %{python3_sitearch}/samba/dcerpc/security.*.so %{python3_sitearch}/samba/dcerpc/server_id.*.so %{python3_sitearch}/samba/dcerpc/smb_acl.*.so +%{python3_sitearch}/samba/dcerpc/smb3posix.*.so +%{python3_sitearch}/samba/dcerpc/smbXsrv.*.so %{python3_sitearch}/samba/dcerpc/spoolss.*.so %{python3_sitearch}/samba/dcerpc/srvsvc.*.so %{python3_sitearch}/samba/dcerpc/svcctl.*.so @@ -2557,6 +2564,7 @@ fi %{python3_sitearch}/samba/functional_level.py %{python3_sitearch}/samba/gensec.*.so %{python3_sitearch}/samba/getopt.py +%{python3_sitearch}/samba/gkdi.py %{python3_sitearch}/samba/graph.py %{python3_sitearch}/samba/hostconfig.py %{python3_sitearch}/samba/idmap.py @@ -2583,6 +2591,7 @@ fi %{python3_sitearch}/samba/gp/__pycache__/gp_centrify_crontab_ext.*.pyc %{python3_sitearch}/samba/gp/__pycache__/gp_centrify_sudoers_ext.*.pyc %{python3_sitearch}/samba/gp/__pycache__/gp_cert_auto_enroll_ext.*.pyc +%{python3_sitearch}/samba/gp/__pycache__/gp_drive_maps_ext.*.pyc %{python3_sitearch}/samba/gp/__pycache__/gp_chromium_ext.*.pyc %{python3_sitearch}/samba/gp/__pycache__/gp_ext_loader.*.pyc %{python3_sitearch}/samba/gp/__pycache__/gp_firefox_ext.*.pyc @@ -2608,6 +2617,7 @@ fi %{python3_sitearch}/samba/gp/gp_centrify_crontab_ext.py %{python3_sitearch}/samba/gp/gp_centrify_sudoers_ext.py %{python3_sitearch}/samba/gp/gp_cert_auto_enroll_ext.py +%{python3_sitearch}/samba/gp/gp_drive_maps_ext.py %{python3_sitearch}/samba/gp/gp_chromium_ext.py %{python3_sitearch}/samba/gp/gp_ext_loader.py %{python3_sitearch}/samba/gp/gp_firefox_ext.py @@ -2642,6 +2652,7 @@ fi %{python3_sitearch}/samba/gp_parse/gp_inf.py %{python3_sitearch}/samba/gp_parse/gp_ini.py %{python3_sitearch}/samba/gp_parse/gp_pol.py +%{python3_sitearch}/samba/hresult.*.so %{python3_sitearch}/samba/logger.py %{python3_sitearch}/samba/mdb_util.py %{python3_sitearch}/samba/ms_display_specifiers.py @@ -2673,11 +2684,11 @@ fi %{python3_sitearch}/samba/netcmd/__pycache__/processes.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/pso.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/rodc.*.pyc +%{python3_sitearch}/samba/netcmd/__pycache__/shell.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/schema.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/sites.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/spn.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/testparm.*.pyc -%{python3_sitearch}/samba/netcmd/__pycache__/user.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/validators.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/visualize.*.pyc %{python3_sitearch}/samba/netcmd/common.py @@ -2744,7 +2755,9 @@ fi %{python3_sitearch}/samba/netcmd/domain/models/__pycache__/claim_type.*.pyc %{python3_sitearch}/samba/netcmd/domain/models/__pycache__/exceptions.*.pyc %{python3_sitearch}/samba/netcmd/domain/models/__pycache__/fields.*.pyc +%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/group.*.pyc %{python3_sitearch}/samba/netcmd/domain/models/__pycache__/model.*.pyc +%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/query.*.pyc %{python3_sitearch}/samba/netcmd/domain/models/__pycache__/schema.*.pyc %{python3_sitearch}/samba/netcmd/domain/models/__pycache__/site.*.pyc %{python3_sitearch}/samba/netcmd/domain/models/__pycache__/subnet.*.pyc @@ -2755,7 +2768,9 @@ fi %{python3_sitearch}/samba/netcmd/domain/models/claim_type.py %{python3_sitearch}/samba/netcmd/domain/models/exceptions.py %{python3_sitearch}/samba/netcmd/domain/models/fields.py +%{python3_sitearch}/samba/netcmd/domain/models/group.py %{python3_sitearch}/samba/netcmd/domain/models/model.py +%{python3_sitearch}/samba/netcmd/domain/models/query.py %{python3_sitearch}/samba/netcmd/domain/models/schema.py %{python3_sitearch}/samba/netcmd/domain/models/site.py %{python3_sitearch}/samba/netcmd/domain/models/subnet.py @@ -2785,13 +2800,72 @@ fi %{python3_sitearch}/samba/netcmd/pso.py %{python3_sitearch}/samba/netcmd/rodc.py %{python3_sitearch}/samba/netcmd/schema.py +%{python3_sitearch}/samba/netcmd/shell.py %{python3_sitearch}/samba/netcmd/sites.py %{python3_sitearch}/samba/netcmd/spn.py %{python3_sitearch}/samba/netcmd/testparm.py -%{python3_sitearch}/samba/netcmd/user.py +%dir %{python3_sitearch}/samba/netcmd/user +%{python3_sitearch}/samba/netcmd/user/__init__.py +%{python3_sitearch}/samba/netcmd/user/add.py +%{python3_sitearch}/samba/netcmd/user/add_unix_attrs.py +%dir %{python3_sitearch}/samba/netcmd/user/auth +%{python3_sitearch}/samba/netcmd/user/auth/__init__.py +%{python3_sitearch}/samba/netcmd/user/auth/policy.py +%dir %{python3_sitearch}/samba/netcmd/user/auth/__pycache__ +%{python3_sitearch}/samba/netcmd/user/auth/__pycache__/__init__.*.pyc +%{python3_sitearch}/samba/netcmd/user/auth/__pycache__/policy.*.pyc +%{python3_sitearch}/samba/netcmd/user/auth/__pycache__/silo.*.pyc +%{python3_sitearch}/samba/netcmd/user/auth/silo.py +%{python3_sitearch}/samba/netcmd/user/delete.py +%{python3_sitearch}/samba/netcmd/user/disable.py +%{python3_sitearch}/samba/netcmd/user/edit.py +%{python3_sitearch}/samba/netcmd/user/enable.py +%{python3_sitearch}/samba/netcmd/user/getgroups.py +%{python3_sitearch}/samba/netcmd/user/list.py +%{python3_sitearch}/samba/netcmd/user/move.py +%{python3_sitearch}/samba/netcmd/user/password.py +%dir %{python3_sitearch}/samba/netcmd/user/__pycache__ +%{python3_sitearch}/samba/netcmd/user/__pycache__/__init__.*.pyc +%{python3_sitearch}/samba/netcmd/user/__pycache__/add.*.pyc +%{python3_sitearch}/samba/netcmd/user/__pycache__/add_unix_attrs.*.pyc +%{python3_sitearch}/samba/netcmd/user/__pycache__/delete.*.pyc +%{python3_sitearch}/samba/netcmd/user/__pycache__/disable.*.pyc +%{python3_sitearch}/samba/netcmd/user/__pycache__/edit.*.pyc +%{python3_sitearch}/samba/netcmd/user/__pycache__/enable.*.pyc +%{python3_sitearch}/samba/netcmd/user/__pycache__/getgroups.*.pyc +%{python3_sitearch}/samba/netcmd/user/__pycache__/list.*.pyc +%{python3_sitearch}/samba/netcmd/user/__pycache__/move.*.pyc +%{python3_sitearch}/samba/netcmd/user/__pycache__/password.*.pyc +%{python3_sitearch}/samba/netcmd/user/__pycache__/rename.*.pyc +%{python3_sitearch}/samba/netcmd/user/__pycache__/sensitive.*.pyc +%{python3_sitearch}/samba/netcmd/user/__pycache__/setexpiry.*.pyc +%{python3_sitearch}/samba/netcmd/user/__pycache__/setpassword.*.pyc +%{python3_sitearch}/samba/netcmd/user/__pycache__/setprimarygroup.*.pyc +%{python3_sitearch}/samba/netcmd/user/__pycache__/unlock.*.pyc +%dir %{python3_sitearch}/samba/netcmd/user/readpasswords +%{python3_sitearch}/samba/netcmd/user/readpasswords/common.py +%{python3_sitearch}/samba/netcmd/user/readpasswords/get_kerberos_ticket.py +%{python3_sitearch}/samba/netcmd/user/readpasswords/getpassword.py +%{python3_sitearch}/samba/netcmd/user/readpasswords/__init__.py +%dir %{python3_sitearch}/samba/netcmd/user/readpasswords/__pycache__ +%{python3_sitearch}/samba/netcmd/user/readpasswords/__pycache__/__init__.*.pyc +%{python3_sitearch}/samba/netcmd/user/readpasswords/__pycache__/common.*.pyc +%{python3_sitearch}/samba/netcmd/user/readpasswords/__pycache__/get_kerberos_ticket.*.pyc +%{python3_sitearch}/samba/netcmd/user/readpasswords/__pycache__/getpassword.*.pyc +%{python3_sitearch}/samba/netcmd/user/readpasswords/__pycache__/show.*.pyc +%{python3_sitearch}/samba/netcmd/user/readpasswords/__pycache__/syncpasswords.*.pyc +%{python3_sitearch}/samba/netcmd/user/readpasswords/show.py +%{python3_sitearch}/samba/netcmd/user/readpasswords/syncpasswords.py +%{python3_sitearch}/samba/netcmd/user/rename.py +%{python3_sitearch}/samba/netcmd/user/sensitive.py +%{python3_sitearch}/samba/netcmd/user/setexpiry.py +%{python3_sitearch}/samba/netcmd/user/setpassword.py +%{python3_sitearch}/samba/netcmd/user/setprimarygroup.py +%{python3_sitearch}/samba/netcmd/user/unlock.py %{python3_sitearch}/samba/netcmd/validators.py %{python3_sitearch}/samba/netcmd/visualize.py %{python3_sitearch}/samba/ntacls.py +%{python3_sitearch}/samba/nt_time.py %{python3_sitearch}/samba/param.*.so %{python3_sitearch}/samba/policies.py %{python3_sitearch}/samba/policy.*.so @@ -2933,6 +3007,9 @@ fi %{python3_sitearch}/samba/tests/__pycache__/common.*.pyc %{python3_sitearch}/samba/tests/__pycache__/complex_expressions.*.pyc %{python3_sitearch}/samba/tests/__pycache__/compression.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/conditional_ace_assembler.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/conditional_ace_bytes.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/conditional_ace_claims.*.pyc %{python3_sitearch}/samba/tests/__pycache__/core.*.pyc %{python3_sitearch}/samba/tests/__pycache__/credentials.*.pyc %{python3_sitearch}/samba/tests/__pycache__/cred_opt.*.pyc @@ -2957,6 +3034,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/gensec.*.pyc %{python3_sitearch}/samba/tests/__pycache__/get_opt.*.pyc %{python3_sitearch}/samba/tests/__pycache__/getdcname.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/gkdi.*.pyc %{python3_sitearch}/samba/tests/__pycache__/glue.*.pyc %{python3_sitearch}/samba/tests/__pycache__/gpo.*.pyc %{python3_sitearch}/samba/tests/__pycache__/gpo_member.*.pyc @@ -2977,7 +3055,6 @@ fi %{python3_sitearch}/samba/tests/__pycache__/libsmb-basic.*.pyc %{python3_sitearch}/samba/tests/__pycache__/lsa_string.*.pyc %{python3_sitearch}/samba/tests/__pycache__/messaging.*.pyc -%{python3_sitearch}/samba/tests/__pycache__/ndr.*.pyc %{python3_sitearch}/samba/tests/__pycache__/netbios.*.pyc %{python3_sitearch}/samba/tests/__pycache__/netcmd.*.pyc %{python3_sitearch}/samba/tests/__pycache__/net_join_no_spnego.*.pyc @@ -3023,7 +3100,9 @@ fi %{python3_sitearch}/samba/tests/__pycache__/samdb.*.pyc %{python3_sitearch}/samba/tests/__pycache__/samdb_api.*.pyc %{python3_sitearch}/samba/tests/__pycache__/sddl.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/sddl_conditional_ace.*.pyc %{python3_sitearch}/samba/tests/__pycache__/security.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/security_descriptors.*.pyc %{python3_sitearch}/samba/tests/__pycache__/segfault.*.pyc %{python3_sitearch}/samba/tests/__pycache__/sid_strings.*.pyc %{python3_sitearch}/samba/tests/__pycache__/smb.*.pyc @@ -3039,6 +3118,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/strings.*.pyc %{python3_sitearch}/samba/tests/__pycache__/subunitrun.*.pyc %{python3_sitearch}/samba/tests/__pycache__/tdb_util.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/token_factory.*.pyc %{python3_sitearch}/samba/tests/__pycache__/upgrade.*.pyc %{python3_sitearch}/samba/tests/__pycache__/upgradeprovision.*.pyc %{python3_sitearch}/samba/tests/__pycache__/upgradeprovisionneeddc.*.pyc @@ -3062,16 +3142,19 @@ fi %{python3_sitearch}/samba/tests/blackbox/__pycache__/__init__.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/bug13653.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/check_output.*.pyc +%{python3_sitearch}/samba/tests/blackbox/__pycache__/claims.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/downgradedatabase.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/mdsearch.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/ndrdump.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/netads_dns.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/netads_json.*.pyc +%{python3_sitearch}/samba/tests/blackbox/__pycache__/rpcd_witness_samba_only.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/samba_dnsupdate.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/smbcacls.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/smbcacls_basic.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/smbcacls_dfs_propagate_inherit.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/smbcacls_propagate_inhertance.*.pyc +%{python3_sitearch}/samba/tests/blackbox/__pycache__/smbcacls_save_restore.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/smbcontrol.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/smbcontrol_process.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/traffic_learner.*.pyc @@ -3079,16 +3162,19 @@ fi %{python3_sitearch}/samba/tests/blackbox/__pycache__/traffic_summary.*.pyc %{python3_sitearch}/samba/tests/blackbox/bug13653.py %{python3_sitearch}/samba/tests/blackbox/check_output.py +%{python3_sitearch}/samba/tests/blackbox/claims.py %{python3_sitearch}/samba/tests/blackbox/downgradedatabase.py %{python3_sitearch}/samba/tests/blackbox/mdsearch.py %{python3_sitearch}/samba/tests/blackbox/ndrdump.py %{python3_sitearch}/samba/tests/blackbox/netads_dns.py %{python3_sitearch}/samba/tests/blackbox/netads_json.py +%{python3_sitearch}/samba/tests/blackbox/rpcd_witness_samba_only.py %{python3_sitearch}/samba/tests/blackbox/samba_dnsupdate.py %{python3_sitearch}/samba/tests/blackbox/smbcacls.py %{python3_sitearch}/samba/tests/blackbox/smbcacls_basic.py %{python3_sitearch}/samba/tests/blackbox/smbcacls_dfs_propagate_inherit.py %{python3_sitearch}/samba/tests/blackbox/smbcacls_propagate_inhertance.py +%{python3_sitearch}/samba/tests/blackbox/smbcacls_save_restore.py %{python3_sitearch}/samba/tests/blackbox/smbcontrol.py %{python3_sitearch}/samba/tests/blackbox/smbcontrol_process.py %{python3_sitearch}/samba/tests/blackbox/traffic_learner.py @@ -3097,6 +3183,9 @@ fi %{python3_sitearch}/samba/tests/common.py %{python3_sitearch}/samba/tests/compression.py %{python3_sitearch}/samba/tests/complex_expressions.py +%{python3_sitearch}/samba/tests/conditional_ace_assembler.py +%{python3_sitearch}/samba/tests/conditional_ace_bytes.py +%{python3_sitearch}/samba/tests/conditional_ace_claims.py %{python3_sitearch}/samba/tests/core.py %{python3_sitearch}/samba/tests/credentials.py %{python3_sitearch}/samba/tests/cred_opt.py @@ -3176,6 +3265,7 @@ fi %{python3_sitearch}/samba/tests/gensec.py %{python3_sitearch}/samba/tests/getdcname.py %{python3_sitearch}/samba/tests/get_opt.py +%{python3_sitearch}/samba/tests/gkdi.py %{python3_sitearch}/samba/tests/glue.py %{python3_sitearch}/samba/tests/gpo.py %{python3_sitearch}/samba/tests/gpo_member.py @@ -3205,14 +3295,17 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/claims_in_pac.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/claims_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/compatability_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/conditional_ace_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/device_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/etype_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/fast_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/gkdi_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/group_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kcrypto.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_base_test.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tgs_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tgt_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kpasswd_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/lockout_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/ms_kile_client_principal_lookup_tests.*.pyc @@ -3223,6 +3316,7 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/raw_testcase.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/rfc4120_constants.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/rfc4120_pyasn1.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/rfc4120_pyasn1_generated.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/rodc_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/simple_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/s4u_tests.*.pyc @@ -3242,14 +3336,17 @@ fi %{python3_sitearch}/samba/tests/krb5/claims_in_pac.py %{python3_sitearch}/samba/tests/krb5/claims_tests.py %{python3_sitearch}/samba/tests/krb5/compatability_tests.py +%{python3_sitearch}/samba/tests/krb5/conditional_ace_tests.py %{python3_sitearch}/samba/tests/krb5/device_tests.py %{python3_sitearch}/samba/tests/krb5/etype_tests.py %{python3_sitearch}/samba/tests/krb5/fast_tests.py +%{python3_sitearch}/samba/tests/krb5/gkdi_tests.py %{python3_sitearch}/samba/tests/krb5/group_tests.py %{python3_sitearch}/samba/tests/krb5/kcrypto.py %{python3_sitearch}/samba/tests/krb5/kdc_base_test.py %{python3_sitearch}/samba/tests/krb5/kdc_tests.py %{python3_sitearch}/samba/tests/krb5/kdc_tgs_tests.py +%{python3_sitearch}/samba/tests/krb5/kdc_tgt_tests.py %{python3_sitearch}/samba/tests/krb5/kpasswd_tests.py %{python3_sitearch}/samba/tests/krb5/lockout_tests.py %{python3_sitearch}/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py @@ -3260,6 +3357,7 @@ fi %{python3_sitearch}/samba/tests/krb5/raw_testcase.py %{python3_sitearch}/samba/tests/krb5/rfc4120_constants.py %{python3_sitearch}/samba/tests/krb5/rfc4120_pyasn1.py +%{python3_sitearch}/samba/tests/krb5/rfc4120_pyasn1_generated.py %{python3_sitearch}/samba/tests/krb5/rodc_tests.py %{python3_sitearch}/samba/tests/krb5/simple_tests.py %{python3_sitearch}/samba/tests/krb5/test_idmap_nss.py @@ -3284,7 +3382,14 @@ fi %{python3_sitearch}/samba/tests/logfiles.py %{python3_sitearch}/samba/tests/lsa_string.py %{python3_sitearch}/samba/tests/messaging.py -%{python3_sitearch}/samba/tests/ndr.py +%dir %{python3_sitearch}/samba/tests/ndr +%{python3_sitearch}/samba/tests/ndr/gkdi.py +%{python3_sitearch}/samba/tests/ndr/gmsa.py +%dir %{python3_sitearch}/samba/tests/ndr/__pycache__ +%{python3_sitearch}/samba/tests/ndr/__pycache__/gkdi.*.pyc +%{python3_sitearch}/samba/tests/ndr/__pycache__/gmsa.*.pyc +%{python3_sitearch}/samba/tests/ndr/__pycache__/wbint.*.pyc +%{python3_sitearch}/samba/tests/ndr/wbint.py %{python3_sitearch}/samba/tests/netbios.py %{python3_sitearch}/samba/tests/netcmd.py %{python3_sitearch}/samba/tests/net_join_no_spnego.py @@ -3336,7 +3441,6 @@ fi %{python3_sitearch}/samba/tests/samba_tool/__pycache__/contact.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/demote.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/dnscmd.*.pyc -%{python3_sitearch}/samba/tests/samba_tool/__pycache__/domain_auth_base.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/domain_auth_policy.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/domain_auth_silo.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/domain_claim.*.pyc @@ -3362,10 +3466,15 @@ fi %{python3_sitearch}/samba/tests/samba_tool/__pycache__/provision_userPassword_crypt.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/rodc.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/schema.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/silo_base.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/sites.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/timecmd.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/user.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_auth_policy.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_auth_silo.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_check_password_script.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_get_kerberos_ticket.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_getpassword_gmsa.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_virtualCryptSHA.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_virtualCryptSHA_base.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_virtualCryptSHA_gpg.*.pyc @@ -3378,7 +3487,6 @@ fi %{python3_sitearch}/samba/tests/samba_tool/contact.py %{python3_sitearch}/samba/tests/samba_tool/demote.py %{python3_sitearch}/samba/tests/samba_tool/dnscmd.py -%{python3_sitearch}/samba/tests/samba_tool/domain_auth_base.py %{python3_sitearch}/samba/tests/samba_tool/domain_auth_policy.py %{python3_sitearch}/samba/tests/samba_tool/domain_auth_silo.py %{python3_sitearch}/samba/tests/samba_tool/domain_claim.py @@ -3404,10 +3512,15 @@ fi %{python3_sitearch}/samba/tests/samba_tool/provision_userPassword_crypt.py %{python3_sitearch}/samba/tests/samba_tool/rodc.py %{python3_sitearch}/samba/tests/samba_tool/schema.py +%{python3_sitearch}/samba/tests/samba_tool/silo_base.py %{python3_sitearch}/samba/tests/samba_tool/sites.py %{python3_sitearch}/samba/tests/samba_tool/timecmd.py %{python3_sitearch}/samba/tests/samba_tool/user.py +%{python3_sitearch}/samba/tests/samba_tool/user_auth_policy.py +%{python3_sitearch}/samba/tests/samba_tool/user_auth_silo.py %{python3_sitearch}/samba/tests/samba_tool/user_check_password_script.py +%{python3_sitearch}/samba/tests/samba_tool/user_get_kerberos_ticket.py +%{python3_sitearch}/samba/tests/samba_tool/user_getpassword_gmsa.py %{python3_sitearch}/samba/tests/samba_tool/user_virtualCryptSHA.py %{python3_sitearch}/samba/tests/samba_tool/user_virtualCryptSHA_base.py %{python3_sitearch}/samba/tests/samba_tool/user_virtualCryptSHA_gpg.py @@ -3418,7 +3531,9 @@ fi %{python3_sitearch}/samba/tests/samdb.py %{python3_sitearch}/samba/tests/samdb_api.py %{python3_sitearch}/samba/tests/sddl.py +%{python3_sitearch}/samba/tests/sddl_conditional_ace.py %{python3_sitearch}/samba/tests/security.py +%{python3_sitearch}/samba/tests/security_descriptors.py %{python3_sitearch}/samba/tests/segfault.py %{python3_sitearch}/samba/tests/sid_strings.py %{python3_sitearch}/samba/tests/smb.py @@ -3434,6 +3549,7 @@ fi %{python3_sitearch}/samba/tests/strings.py %{python3_sitearch}/samba/tests/subunitrun.py %{python3_sitearch}/samba/tests/tdb_util.py +%{python3_sitearch}/samba/tests/token_factory.py %{python3_sitearch}/samba/tests/upgrade.py %{python3_sitearch}/samba/tests/upgradeprovision.py %{python3_sitearch}/samba/tests/upgradeprovisionneeddc.py @@ -3464,9 +3580,9 @@ fi ### TEST-LIBS %files test-libs %if %{with dc} || %{with testsuite} -%{_libdir}/samba/libdlz-bind9-for-torture-samba4.so +%{_libdir}/samba/libdlz-bind9-for-torture-private-samba.so %else -%{_libdir}/samba/libdsdb-module-samba4.so +%{_libdir}/samba/libdsdb-module-private-samba.so %endif ### USERSHARES @@ -3479,8 +3595,8 @@ fi %files winbind %{_libdir}/samba/idmap %{_libdir}/samba/nss_info -%{_libdir}/samba/libnss-info-samba4.so -%{_libdir}/samba/libidmap-samba4.so +%{_libdir}/samba/libnss-info-private-samba.so +%{_libdir}/samba/libidmap-private-samba.so %{_sbindir}/winbindd %{_sysusersdir}/samba-winbind.conf %attr(750,root,wbpriv) %dir /var/lib/samba/winbindd_privileged @@ -4471,6 +4587,9 @@ fi %endif %changelog +* Mon Jan 29 2024 Guenther Deschner - 4.20.0rc1-1 +- resolves: #2260895 - Update to version 4.20.0rc1 + * Sat Jan 27 2024 Fedora Release Engineering - 2:4.19.4-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild diff --git a/sources b/sources index ed14bdd..a412569 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.19.4.tar.xz) = 3d2899e4a3b8bcb77befc29c4af66d3ac858b7f7a0dbbb66a8bc210cd88d9cde3e11361334a5cce650318473134ec8b134148bfa4af4d51f555de33eff395029 -SHA512 (samba-4.19.4.tar.asc) = 11bc51407d1464339817d7568f5d5bb059c19a05b49c6a1307d7425d289acb617ecd3e633e3736bdaa94947a7b3630d6cdb7ed6fe59d52556234c549eca8172a +SHA512 (samba-4.20.0rc1.tar.xz) = aec30327572403ab1a8fccd0e702da3939e57120a99dfadfb0b81cf997abf40a004dd682da81ea7284909e7e321db2ead6c397d654b2cff853dc9758ba5bbd52 +SHA512 (samba-4.20.0rc1.tar.asc) = 15e5c4be7eca42ffff0d3b98ab73e57b0a095f43848907a46c16a238c4a1d0d634f6a8cfb0d9c012fd7aa53052b9cdcbba19293a5d75d37f58da9f8b185ea615 From cd3cf3831b22b47aa07e563469b64d8437679afc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 1 Feb 2024 07:59:36 +0100 Subject: [PATCH 302/425] Fix typo Guenther --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index e55167e..b973fb1 100644 --- a/samba.spec +++ b/samba.spec @@ -1657,7 +1657,7 @@ fi %{_sbindir}/nmbd %{_sbindir}/smbd %if %{with dc} || %{with testsuite} -# This is only used by vfs_dfs_samba-private +# This is only used by vfs_dfs_samba4 %{_libdir}/samba/libdfs-server-ad-private-samba.so %endif %dir %{_libdir}/samba/auth From 885a433df05b4f0b0ba2df53954ebd187664d414 Mon Sep 17 00:00:00 2001 From: Pete Walter Date: Thu, 1 Feb 2024 11:15:57 +0000 Subject: [PATCH 303/425] Rebuild for ICU 74 --- samba.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index b973fb1..bd2361d 100644 --- a/samba.spec +++ b/samba.spec @@ -147,7 +147,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.20.0 -%global baserelease 1 +%global baserelease 2 # This should be rc1 or %%nil %global pre_release rc1 @@ -4587,6 +4587,9 @@ fi %endif %changelog +* Thu Feb 01 2024 Pete Walter - 2:4.20.0-0.2.rc1 +- Rebuild for ICU 74 + * Mon Jan 29 2024 Guenther Deschner - 4.20.0rc1-1 - resolves: #2260895 - Update to version 4.20.0rc1 From 691752e56b4fdb9ed25bb852ccf9f9f336aa1c5e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 9 Feb 2024 09:27:06 +0100 Subject: [PATCH 304/425] Require cepces >= 0.3.8 --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index bd2361d..2bea379 100644 --- a/samba.spec +++ b/samba.spec @@ -362,7 +362,7 @@ BuildRequires: python3-etcd %endif %if %{with gpupdate} -BuildRequires: cepces +BuildRequires: cepces >= 0.3.8 %endif # pidl requirements From 86c73e995b99fa5f36f5ea42c0e73dc8940ad157 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 9 Feb 2024 09:29:46 +0100 Subject: [PATCH 305/425] The AES crypto code has been removed We use GnuTLS for everything now. --- samba.spec | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/samba.spec b/samba.spec index 2bea379..9d25bad 100644 --- a/samba.spec +++ b/samba.spec @@ -1222,10 +1222,8 @@ xzcat %{SOURCE0} | gpgv2 --quiet --keyring %{SOURCE2} %{SOURCE1} - %endif %autosetup -n samba-%{version}%{pre_release} -p1 -# Ensure we rely on GnuTLS and do not build any other crypto code shipping with -# the sources. -rm -rf third_party/{aesni-intel,heimdal} -rm -f lib/crypto/{aes,rijndael}*.c +# Make sure we do not build with heimdal code +rm -rfv third_party/heimdal %build %if %{with includelibs} From 3a7dad4a24b041084f570dc533f769f9af7c69fb Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 9 Feb 2024 16:32:58 +0100 Subject: [PATCH 306/425] Require cepces-certmonger This is the package providing cepces-submit required by samba-gpupdate. It will install all the other required packages. --- samba.spec | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index 9d25bad..82db994 100644 --- a/samba.spec +++ b/samba.spec @@ -362,7 +362,7 @@ BuildRequires: python3-etcd %endif %if %{with gpupdate} -BuildRequires: cepces >= 0.3.8 +BuildRequires: cepces-certmonger >= 0.3.8 %endif # pidl requirements @@ -732,7 +732,6 @@ Samba VFS module for GlusterFS integration. %if %{with gpupdate} %package gpupdate Summary: Samba GPO support for clients -Requires: cepces Requires: cepces-certmonger Requires: certmonger Requires: %{name}-ldb-ldap-modules = %{samba_depver} From 9a35124520905271d85148c5234f870a01bf5ea6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 12 Feb 2024 15:25:15 +0100 Subject: [PATCH 307/425] Update to version 4.20.0rc2 resolves: #2263874 Guenther --- .gitignore | 2 ++ samba.spec | 8 ++++++-- sources | 4 ++-- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 9a1363f..e9a49b4 100644 --- a/.gitignore +++ b/.gitignore @@ -357,3 +357,5 @@ samba-3.6.0pre1.tar.gz /samba-4.19.4.tar.asc /samba-4.20.0rc1.tar.xz /samba-4.20.0rc1.tar.asc +/samba-4.20.0rc2.tar.xz +/samba-4.20.0rc2.tar.asc diff --git a/samba.spec b/samba.spec index 82db994..fba5f6b 100644 --- a/samba.spec +++ b/samba.spec @@ -147,9 +147,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.20.0 -%global baserelease 2 +%global baserelease 3 # This should be rc1 or %%nil -%global pre_release rc1 +%global pre_release rc2 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -1814,6 +1814,7 @@ fi %{_mandir}/man1/smbget.1* %{_mandir}/man1/smbtar.1* %{_mandir}/man1/smbtree.1* +%{_mandir}/man1/wspsearch.1* %{_mandir}/man7/traffic_learner.7.* %{_mandir}/man7/traffic_replay.7.* %{_mandir}/man8/cifsdd.8.* @@ -4584,6 +4585,9 @@ fi %endif %changelog +* Mon Feb 12 2024 Guenther Deschner - 4.20.0rc2-3 +- resolves: #2263874 - Update to version 4.20.0rc2 + * Thu Feb 01 2024 Pete Walter - 2:4.20.0-0.2.rc1 - Rebuild for ICU 74 diff --git a/sources b/sources index a412569..8acf952 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.20.0rc1.tar.xz) = aec30327572403ab1a8fccd0e702da3939e57120a99dfadfb0b81cf997abf40a004dd682da81ea7284909e7e321db2ead6c397d654b2cff853dc9758ba5bbd52 -SHA512 (samba-4.20.0rc1.tar.asc) = 15e5c4be7eca42ffff0d3b98ab73e57b0a095f43848907a46c16a238c4a1d0d634f6a8cfb0d9c012fd7aa53052b9cdcbba19293a5d75d37f58da9f8b185ea615 +SHA512 (samba-4.20.0rc2.tar.xz) = 787fd7fcffcff4a6722c07c0e853c48121dd031ff401a2f9c6faae1e4a378f217cb2d1a7c4dc6eed220597516a1878b802996f88e4156a2c0e7c924b90234123 +SHA512 (samba-4.20.0rc2.tar.asc) = 97e6d6af3b5ae17119206fb89135875496f66c38dfbd5c62882cbc87dfa70b48b96f2b0b64d32956fa64f1e76108a0e790aa602e4dee5731117e9a27874e2dcb From 81028e3aa95658623fa2bcbb545e21597d9331f9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 26 Feb 2024 12:53:11 +0100 Subject: [PATCH 308/425] Update to version 4.20.0rc3 resolves: #2266039 Guenther --- .gitignore | 2 ++ samba.spec | 8 ++++++-- sources | 4 ++-- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index e9a49b4..cc41ee4 100644 --- a/.gitignore +++ b/.gitignore @@ -359,3 +359,5 @@ samba-3.6.0pre1.tar.gz /samba-4.20.0rc1.tar.asc /samba-4.20.0rc2.tar.xz /samba-4.20.0rc2.tar.asc +/samba-4.20.0rc3.tar.xz +/samba-4.20.0rc3.tar.asc diff --git a/samba.spec b/samba.spec index fba5f6b..c28c81f 100644 --- a/samba.spec +++ b/samba.spec @@ -147,9 +147,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.20.0 -%global baserelease 3 +%global baserelease 4 # This should be rc1 or %%nil -%global pre_release rc2 +%global pre_release rc3 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -3726,6 +3726,7 @@ fi %{_datadir}/ctdb/events/legacy/31.clamd.script %{_datadir}/ctdb/events/legacy/40.vsftpd.script %{_datadir}/ctdb/events/legacy/41.httpd.script +%{_datadir}/ctdb/events/legacy/47.samba-dcerpcd.script %{_datadir}/ctdb/events/legacy/48.netbios.script %{_datadir}/ctdb/events/legacy/49.winbind.script %{_datadir}/ctdb/events/legacy/50.samba.script @@ -4585,6 +4586,9 @@ fi %endif %changelog +* Mon Feb 26 2024 Guenther Deschner - 4.20.0rc3-4 +- resolves: #2266039 - Update to version 4.20.0rc3 + * Mon Feb 12 2024 Guenther Deschner - 4.20.0rc2-3 - resolves: #2263874 - Update to version 4.20.0rc2 diff --git a/sources b/sources index 8acf952..a7e977a 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.20.0rc2.tar.xz) = 787fd7fcffcff4a6722c07c0e853c48121dd031ff401a2f9c6faae1e4a378f217cb2d1a7c4dc6eed220597516a1878b802996f88e4156a2c0e7c924b90234123 -SHA512 (samba-4.20.0rc2.tar.asc) = 97e6d6af3b5ae17119206fb89135875496f66c38dfbd5c62882cbc87dfa70b48b96f2b0b64d32956fa64f1e76108a0e790aa602e4dee5731117e9a27874e2dcb +SHA512 (samba-4.20.0rc3.tar.xz) = 0268bb96e3aed0e639b82e87d823c11040139e7b62d0e9482dd09190f3e89945f31c0a4ad512f8d9741cda5e038bb3aab2d511e4f56b3667ab0d8a465f767ddc +SHA512 (samba-4.20.0rc3.tar.asc) = 3b65768562239455b0c4df5a3ae2a94ffdc7d9e8003d07d5d51760beb1e62fc0c51421687fd082cf072ad995ef46a937b76326d80e731ab5ae836659d3c8d5bd From 8fa9d9ff95c9cc0764fe6dce2b2369078771a2e0 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 5 Mar 2024 13:54:33 +0100 Subject: [PATCH 309/425] Silence warnings when upgrading libwbclient --- samba.spec | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index c28c81f..cfa8a53 100644 --- a/samba.spec +++ b/samba.spec @@ -1584,9 +1584,9 @@ fi %if %{with libwbclient} %pre -n libwbclient if [ $1 -gt 1 ] ; then - rm -rf %{_libdir}/samba/wbclient/ - rm -f /etc/alternatives/libwbclient.so* - rm -f /var/lib/alternatives/libwbclient.so* + rm -rf %{_libdir}/samba/wbclient/ 2>/dev/null + rm -f /etc/alternatives/libwbclient.so* 2>/dev/null + rm -f /var/lib/alternatives/libwbclient.so* 2>/dev/null fi %{?ldconfig} #endif {with libwbclient} From 05916b6f9c054887756847a157152115fcc91481 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 11 Mar 2024 18:39:03 +0100 Subject: [PATCH 310/425] Update to version 4.20.0rc4 resolves: #2269037 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index cc41ee4..7ac496a 100644 --- a/.gitignore +++ b/.gitignore @@ -361,3 +361,5 @@ samba-3.6.0pre1.tar.gz /samba-4.20.0rc2.tar.asc /samba-4.20.0rc3.tar.xz /samba-4.20.0rc3.tar.asc +/samba-4.20.0rc4.tar.xz +/samba-4.20.0rc4.tar.asc diff --git a/samba.spec b/samba.spec index cfa8a53..92cedc5 100644 --- a/samba.spec +++ b/samba.spec @@ -147,9 +147,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.20.0 -%global baserelease 4 +%global baserelease 5 # This should be rc1 or %%nil -%global pre_release rc3 +%global pre_release rc4 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4586,6 +4586,9 @@ fi %endif %changelog +* Mon Mar 11 2024 Guenther Deschner - 4.20.0rc4-5 +- resolves: #2269037 - Update to version 4.20.0rc4 + * Mon Feb 26 2024 Guenther Deschner - 4.20.0rc3-4 - resolves: #2266039 - Update to version 4.20.0rc3 diff --git a/sources b/sources index a7e977a..baa2190 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.20.0rc3.tar.xz) = 0268bb96e3aed0e639b82e87d823c11040139e7b62d0e9482dd09190f3e89945f31c0a4ad512f8d9741cda5e038bb3aab2d511e4f56b3667ab0d8a465f767ddc -SHA512 (samba-4.20.0rc3.tar.asc) = 3b65768562239455b0c4df5a3ae2a94ffdc7d9e8003d07d5d51760beb1e62fc0c51421687fd082cf072ad995ef46a937b76326d80e731ab5ae836659d3c8d5bd +SHA512 (samba-4.20.0rc4.tar.xz) = c4f7e36a88ec7021277ceb5d68ef7d3a01dd4bfe1301441172751903e8c998bc8ed7ca7684524c7ae5f925aa7382c0ff89badf738be9fcccf714ee3b5c38026f +SHA512 (samba-4.20.0rc4.tar.asc) = 2344e451ffc13f5173a611ccb9babd72bd954581417dbbefe47c2bda36ec99db040bf5e74508f99335b43b2e1ab96ca690dbac3da0c5fe3fef872c789192797f From eccf82df8a11503db4a56bc4eb15bb0f0d828162 Mon Sep 17 00:00:00 2001 From: David Abdurachmanov Date: Thu, 11 Jan 2024 12:26:29 +0200 Subject: [PATCH 311/425] Add support for riscv64 Signed-off-by: David Abdurachmanov --- samba.spec | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/samba.spec b/samba.spec index 92cedc5..1d24fa0 100644 --- a/samba.spec +++ b/samba.spec @@ -57,7 +57,7 @@ # ppc64le excluded pending resolution of https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104172 #%%ifarch aarch64 ppc64le s390x x86_64 -%ifarch aarch64 s390x x86_64 +%ifarch aarch64 s390x x86_64 riscv64 %bcond_without vfs_cephfs %bcond_without ceph_mutex %else @@ -80,7 +80,7 @@ %if 0%{?fedora} -%ifarch aarch64 ppc64le s390x x86_64 +%ifarch aarch64 ppc64le s390x x86_64 riscv64 %bcond_without vfs_glusterfs %else %bcond_with vfs_glusterfs @@ -109,7 +109,7 @@ # Build vfs_io_uring module by default on 64bit Fedora %if 0%{?fedora} || 0%{?rhel} >= 8 -%ifarch aarch64 ppc64le s390x x86_64 +%ifarch aarch64 ppc64le s390x x86_64 riscv64 %bcond_without vfs_io_uring %else %bcond_with vfs_io_uring @@ -332,7 +332,7 @@ BuildRequires: zlib-devel >= 1.2.3 BuildRequires: pkgconfig(libsystemd) -%ifnarch i686 +%ifnarch i686 riscv64 %if 0%{?fedora} >= 37 BuildRequires: mold %endif @@ -1272,7 +1272,7 @@ export python_LDFLAGS="$(echo %{__global_ldflags} | sed -e 's/-Wl,-z,defs//g')" # Use the mold linker if possible export python_LDFLAGS="$(echo %{__global_ldflags} | sed -e 's/-Wl,-z,defs//g')" -%ifnarch i686 +%ifnarch i686 riscv64 %if 0%{?fedora} >= 37 export LDFLAGS="%{__global_ldflags} -fuse-ld=mold" export python_LDFLAGS="$(echo ${LDFLAGS} | sed -e 's/-Wl,-z,defs//g')" From a5c93245d3dcfed1a9c51811279d56cabdcf3c46 Mon Sep 17 00:00:00 2001 From: "Richard W.M. Jones" Date: Tue, 12 Mar 2024 20:39:26 +0000 Subject: [PATCH 312/425] Bump and rebuild package (for riscv64) --- samba.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 1d24fa0..ace1d28 100644 --- a/samba.spec +++ b/samba.spec @@ -147,7 +147,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.20.0 -%global baserelease 5 +%global baserelease 6 # This should be rc1 or %%nil %global pre_release rc4 @@ -4586,6 +4586,9 @@ fi %endif %changelog +* Tue Mar 12 2024 Richard W.M. Jones - 2:4.20.0-0.6.rc4 +- Bump and rebuild package (for riscv64) + * Mon Mar 11 2024 Guenther Deschner - 4.20.0rc4-5 - resolves: #2269037 - Update to version 4.20.0rc4 From 129e39f982f572af1919eb0f0b3ab5080cfb17e5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 27 Mar 2024 19:02:19 +0100 Subject: [PATCH 313/425] Update to version 4.20.0 resolves: #2271916 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 7ac496a..78d239a 100644 --- a/.gitignore +++ b/.gitignore @@ -363,3 +363,5 @@ samba-3.6.0pre1.tar.gz /samba-4.20.0rc3.tar.asc /samba-4.20.0rc4.tar.xz /samba-4.20.0rc4.tar.asc +/samba-4.20.0.tar.xz +/samba-4.20.0.tar.asc diff --git a/samba.spec b/samba.spec index ace1d28..cf7e67b 100644 --- a/samba.spec +++ b/samba.spec @@ -147,9 +147,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.20.0 -%global baserelease 6 +%global baserelease 7 # This should be rc1 or %%nil -%global pre_release rc4 +%global pre_release %nil %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4586,6 +4586,9 @@ fi %endif %changelog +* Wed Mar 27 2024 Guenther Deschner - 4.20.0-7 +- resolves: #2271916 - Update to version 4.20.0 + * Tue Mar 12 2024 Richard W.M. Jones - 2:4.20.0-0.6.rc4 - Bump and rebuild package (for riscv64) diff --git a/sources b/sources index baa2190..bb5e796 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.20.0rc4.tar.xz) = c4f7e36a88ec7021277ceb5d68ef7d3a01dd4bfe1301441172751903e8c998bc8ed7ca7684524c7ae5f925aa7382c0ff89badf738be9fcccf714ee3b5c38026f -SHA512 (samba-4.20.0rc4.tar.asc) = 2344e451ffc13f5173a611ccb9babd72bd954581417dbbefe47c2bda36ec99db040bf5e74508f99335b43b2e1ab96ca690dbac3da0c5fe3fef872c789192797f +SHA512 (samba-4.20.0.tar.xz) = af706b95fbf0f690b1ca6f97c704fa2ab994617c1b94b16c9e83cfba72d6d1e020f1e2225d658629f97bdc3500f91aacfed417605d4806f38eab54ee5999e6af +SHA512 (samba-4.20.0.tar.asc) = e435c68b276e06a469cf8f9a275c6d09987c17b2e42fc0ac8dd74420073bc644598ece464721c71d20d99b4e5d6ec0bdbfa85d45ee46415d25806b336dc4278c From a194b836ce22677e4b8f9b9f69d6798ee798ae44 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 30 Apr 2024 15:56:01 +0200 Subject: [PATCH 314/425] rpminspect.yaml: update badfuncs with new library names --- rpminspect.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/rpminspect.yaml b/rpminspect.yaml index 4c2edfa..75d7856 100644 --- a/rpminspect.yaml +++ b/rpminspect.yaml @@ -5,8 +5,8 @@ badfuncs: - /usr/bin/smbtorture - /usr/lib*/libndr.so.* - /usr/lib*/libsmbconf.so.* - - /usr/lib*/samba/libgse-samba4.so - - /usr/lib*/samba/libsamba-sockets-samba4.so + - /usr/lib*/samba/libgse-private-samba.so + - /usr/lib*/samba/libsamba-sockets-private-samba.so - /usr/lib*/samba/service/nbtd.so - /usr/libexec/ctdb/smnotify - /usr/sbin/nmbd From 058c9e46a835f08b4fc623007a8870cbd39180e3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 9 May 2024 17:28:42 +0200 Subject: [PATCH 315/425] Update to version 4.20.1 resolves: #2279780 Guenther --- .gitignore | 2 ++ samba.spec | 15 +++++++++++++-- sources | 4 ++-- 3 files changed, 17 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 78d239a..fd0792f 100644 --- a/.gitignore +++ b/.gitignore @@ -365,3 +365,5 @@ samba-3.6.0pre1.tar.gz /samba-4.20.0rc4.tar.asc /samba-4.20.0.tar.xz /samba-4.20.0.tar.asc +/samba-4.20.1.tar.xz +/samba-4.20.1.tar.asc diff --git a/samba.spec b/samba.spec index cf7e67b..72558fd 100644 --- a/samba.spec +++ b/samba.spec @@ -146,8 +146,8 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.20.0 -%global baserelease 7 +%global samba_version 4.20.1 +%global baserelease 1 # This should be rc1 or %%nil %global pre_release %nil @@ -1512,14 +1512,17 @@ export WINBINDD_DONT_LOG_STDOUT=1 %endif %post +%systemd_post samba-bgqd.service %systemd_post smb.service %systemd_post nmb.service %preun +%systemd_preun samba-bgqd.service %systemd_preun smb.service %systemd_preun nmb.service %postun +%systemd_postun_with_restart samba-bgqd.service %systemd_postun_with_restart smb.service %systemd_postun_with_restart nmb.service @@ -1717,6 +1720,7 @@ fi %{_unitdir}/nmb.service %{_unitdir}/smb.service +%{_unitdir}/samba-bgqd.service %dir %{_sysconfdir}/openldap/schema %config %{_sysconfdir}/openldap/schema/samba.schema %config(noreplace) %{_sysconfdir}/pam.d/samba @@ -3142,6 +3146,8 @@ fi %{python3_sitearch}/samba/tests/blackbox/__pycache__/check_output.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/claims.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/downgradedatabase.*.pyc +%{python3_sitearch}/samba/tests/blackbox/__pycache__/http_chunk.*.pyc +%{python3_sitearch}/samba/tests/blackbox/__pycache__/http_content.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/mdsearch.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/ndrdump.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/netads_dns.*.pyc @@ -3162,6 +3168,8 @@ fi %{python3_sitearch}/samba/tests/blackbox/check_output.py %{python3_sitearch}/samba/tests/blackbox/claims.py %{python3_sitearch}/samba/tests/blackbox/downgradedatabase.py +%{python3_sitearch}/samba/tests/blackbox/http_chunk.py +%{python3_sitearch}/samba/tests/blackbox/http_content.py %{python3_sitearch}/samba/tests/blackbox/mdsearch.py %{python3_sitearch}/samba/tests/blackbox/ndrdump.py %{python3_sitearch}/samba/tests/blackbox/netads_dns.py @@ -4586,6 +4594,9 @@ fi %endif %changelog +* Wed May 08 2024 Guenther Deschner - 4.20.1-1 +- resolves: #2279780 - Update to version 4.20.1 + * Wed Mar 27 2024 Guenther Deschner - 4.20.0-7 - resolves: #2271916 - Update to version 4.20.0 diff --git a/sources b/sources index bb5e796..cfeeed8 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.20.0.tar.xz) = af706b95fbf0f690b1ca6f97c704fa2ab994617c1b94b16c9e83cfba72d6d1e020f1e2225d658629f97bdc3500f91aacfed417605d4806f38eab54ee5999e6af -SHA512 (samba-4.20.0.tar.asc) = e435c68b276e06a469cf8f9a275c6d09987c17b2e42fc0ac8dd74420073bc644598ece464721c71d20d99b4e5d6ec0bdbfa85d45ee46415d25806b336dc4278c +SHA512 (samba-4.20.1.tar.xz) = 7cef945833516b305a2eb6bd4717cc4e8d895575e6dcf7a47d80fa1859847adeb4a9f32814bafdd5c732ce63d793ca168b7f4e0bdda89c56f10d1595ea45b5c0 +SHA512 (samba-4.20.1.tar.asc) = 5ce9f0e4358c1ff5ce991204aaf72e1dfe431ba2686d12f1668b15c7b48247666ecbf6354acbadbcf5e77e657ef93bc07fab0ff7ed7b8a7588f5bcc7bf6facef From 857301aa5c1f05db69eb9452d23f98d149110798 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 21 May 2024 14:12:37 +0200 Subject: [PATCH 316/425] Convert to %autorelease and %autochangelog [skip changelog] --- changelog | 3039 +++++++++++++++++++++++++++++++++++++++++++++++++++ samba.spec | 3055 +--------------------------------------------------- 2 files changed, 3048 insertions(+), 3046 deletions(-) create mode 100644 changelog diff --git a/changelog b/changelog new file mode 100644 index 0000000..680c54c --- /dev/null +++ b/changelog @@ -0,0 +1,3039 @@ +* Wed May 08 2024 Guenther Deschner - 4.20.1-1 +- resolves: #2279780 - Update to version 4.20.1 + +* Wed Mar 27 2024 Guenther Deschner - 4.20.0-7 +- resolves: #2271916 - Update to version 4.20.0 + +* Tue Mar 12 2024 Richard W.M. Jones - 2:4.20.0-0.6.rc4 +- Bump and rebuild package (for riscv64) + +* Mon Mar 11 2024 Guenther Deschner - 4.20.0rc4-5 +- resolves: #2269037 - Update to version 4.20.0rc4 + +* Mon Feb 26 2024 Guenther Deschner - 4.20.0rc3-4 +- resolves: #2266039 - Update to version 4.20.0rc3 + +* Mon Feb 12 2024 Guenther Deschner - 4.20.0rc2-3 +- resolves: #2263874 - Update to version 4.20.0rc2 + +* Thu Feb 01 2024 Pete Walter - 2:4.20.0-0.2.rc1 +- Rebuild for ICU 74 + +* Mon Jan 29 2024 Guenther Deschner - 4.20.0rc1-1 +- resolves: #2260895 - Update to version 4.20.0rc1 + +* Sat Jan 27 2024 Fedora Release Engineering - 2:4.19.4-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Tue Jan 16 2024 Andreas Schneider - 4.29.4-3 +- Fix samba-gpupdate on Fedora/RHEL + +* Tue Jan 09 2024 Andreas Schneider - 4.19.4-2 +- resolves: rhbz#2256326 - Create all groups using systemd + +* Mon Jan 08 2024 Guenther Deschner - 4.19.4-1 +- resolves: #2257287 - Update to version 4.19.4 + +* Tue Nov 28 2023 Guenther Deschner - 4.19.3-2 +- Disable performance co-pilot support for i686 + +* Mon Nov 27 2023 Guenther Deschner - 4.19.3-1 +- resolves: #2251766 - Update to version 4.19.3 + +* Wed Nov 15 2023 Andreas Schneider - 4.19.2-2 +- Package samba-gpupdate also for RHEL9 + +* Mon Oct 16 2023 Guenther Deschner - 4.19.2-1 +- resolves: #2244496 - Update to version 4.19.2 + +* Tue Oct 10 2023 Guenther Deschner - 4.19.1-1 +- resolves: #2243073 - Update to version 4.19.1 +- resolves: #2241881, #2243228: Security fix for CVE-2023-3961 +- resolves: #2241882, #2243231: Security fix for CVE-2023-4091 +- resolves: #2241883, #2243230: Security fix for CVE-2023-4154 +- resolves: #2241884, #2243229: Security fix for CVE-2023-42669 +- resolves: #2241885, #2243232: Security fix for CVE-2023-42670 + +* Mon Sep 04 2023 Guenther Deschner - 4.19.0-1 +- resolves: #2237259 - Update to version 4.19.0 + +* Mon Aug 28 2023 Guenther Deschner - 4.19.0-0.5.rc4 +- resolves: #2232744 - Update to version 4.19.0rc4 + +* Fri Aug 18 2023 Guenther Deschner - 4.19.0-0.4.rc3 +- resolves: #2232744 - Update to version 4.19.0rc3 + +* Wed Aug 16 2023 Yaakov Selkowitz - 2:4.19.0-0.3.rc2 +- Move ad-claims and authn-policy-util to dc-libs + +* Tue Aug 15 2023 Adam Williamson - 4.19.0-0.2.rc2 +- python3-samba-dc requires python3-markdown now + +* Tue Aug 08 2023 Guenther Deschner - 4.19.0-0.1.rc2 +- resolves: #2227246 - Update to version 4.19.0rc2 + +* Mon Aug 07 2023 Guenther Deschner - 4.19.0-0.0.rc1 +- resolves: #2227246 - Update to version 4.19.0rc1 + +* Thu Jul 20 2023 Guenther Deschner - 4.18.5-0 +- resolves: #2224040 - Update to version 4.18.5 +- resolves: #2222791, #2224254 - Security fix for CVE-2022-2127 +- resolves: #2222792, #2224255 - Security fix for CVE-2023-3347 +- resolves: #2222793, #2224253 - Security fix for CVE-2023-34966 +- resolves: #2222794, #2224252 - Security fix for CVE-2023-34967 +- resolves: #2222795, #2224250 - Security fix for CVE-2023-34968 + +* Sat Jul 15 2023 Guenther Deschner - 4.18.4-3 +- resolves: #2223091 - Fix netlogon LogonGetCapabilities level 2 error handling + +* Tue Jul 11 2023 František Zatloukal - 2:4.18.4-2 +- Rebuilt for ICU 73.2 + +* Wed Jul 05 2023 Python Maint - 2:4.18.4-1 +- Rebuilt for Python 3.12 + +* Wed Jul 05 2023 Guenther Deschner - 4.18.4-0 +- resolves: #2219799 - Update to version 4.18.4 + +* Mon Jun 26 2023 Python Maint - 2:4.18.3-5 +- Rebuilt for Python 3.12 + +* Mon Jun 26 2023 Adam Williamson - 4.18.3-4 +- Only run libwbclient %pre on upgrade, not fresh install + +* Fri Jun 23 2023 Andreas Schneider - 4.18.3-3 +- resolves: rhbz#2211577 - Fix libwbclient package upgrades + +* Thu Jun 15 2023 Python Maint - 2:4.18.3-2 +- Rebuilt for Python 3.12 + +* Thu Jun 15 2023 Andreas Schneider - 4.18.3-1 +- resolves: #2203539 - Also cover mit_kdc.log by logrotate + +* Thu Jun 01 2023 Guenther Deschner - 4.18.3-0 +- resolves: #2211453 - Update to version 4.18.3 + +* Wed Apr 19 2023 Guenther Deschner - 4.18.2-0 +- resolves: #2187991 - Update to version 4.18.2 + +* Wed Mar 29 2023 Guenther Deschner - 4.18.1-0 +- resolves: #2182787 - Update to version 4.18.1 +- resolves: #2182772, #2182773 - Security fixes for CVE-2023-0225 +- resolves: #2182774, #2182775 - Security fixes for CVE-2023-0922 +- resolves: #2182776, #2182777 - Security fixes for CVE-2023-0614 + +* Tue Mar 21 2023 Andreas Schneider - 4.18.0-12 +- Fix ctdb file lists when built with test suite enabled + +* Fri Mar 17 2023 Kalev Lember - 4.18.0-10 +- Move libstable-sort-samba4.so to samba-client-libs subpackage + +* Wed Mar 08 2023 Guenther Deschner - 4.18.0-9 +- resolves: #2176469 - Update to version 4.18.0 + +* Wed Mar 01 2023 Guenther Deschner - 4.18.0rc4-8 +- resolves: #2174415 - Update to version 4.18.0rc4 + +* Tue Feb 28 2023 Andreas Schneider - 4.18.0-0.7.rc3 +- resolves: #2173619 - Add missing Requires for glibc-gconv-extra + +* Thu Feb 23 2023 Pavel Filipenský - 4.18.0-0.6.rc3 +- SPDX migration + +* Wed Feb 15 2023 Guenther Deschner - 4.18.0rc3-6 +- resolves: #2166416 - Update to version 4.18.0rc3 + +* Mon Feb 13 2023 Pavel Filipenský - 4.18.0rc2-5 +- Create package samba-tools, move there samba-tool binary + +* Thu Feb 02 2023 Guenther Deschner - 4.18.0rc2-3 +- resolves: #2166416 - Update to version 4.18.0rc2 + +* Sat Jan 21 2023 Fedora Release Engineering - 2:4.18.0-0.2.rc1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + +* Thu Jan 19 2023 Guenther Deschner - 4.18.0rc1-0 +- resolves: #2162097 - Update to version 4.18.0rc1 + +* Sat Dec 31 2022 Pete Walter - 2:4.17.4-4 +- Rebuild for ICU 72 + +* Thu Dec 22 2022 Pavel Filipenský - 4.17.4-3 +- Create package dc-libs also for 'non-dc build' + +* Tue Dec 20 2022 Pavel Filipenský - 4.17.4-2 +- Fix '--without dc' build: delete libauth4-samba4.so + +* Mon Dec 19 2022 Pavel Filipenský - 4.17.4-1 +- Create a samba-dcerpc sub-package +- Fix package installation without samba and samba-dc package + +* Fri Dec 16 2022 Guenther Deschner - 4.17.4-0 +- resolves: #2153906 - Update to version 4.17.4 +- resolves: #2154362, #2154363 - Security fixes for CVE-2022-38023 +- resolves: #2154303, #2154304 - Security fixes for CVE-2022-37966 +- resolves: #2154320, #2154322 - Security fixes for CVE-2022-37967 + +* Thu Dec 1 2022 Alexander Bokovoy - 2:4.17.3-2 +- Rebuild against krb5 1.20.1, new KDB interface + +* Mon Nov 21 2022 Florian Weimer - 2:4.17.3-1 +- Remove C89-specific language constructs from configure checks +- Fix feature detection for major/minor macros + +* Tue Nov 15 2022 Guenther Deschner - 4.17.3-0 +- resolves: #2142959 - Update to version 4.17.3 +- resolves: #2140960, #2143117 - Security fixes for CVE-2022-42898 + +* Wed Nov 02 2022 Pavel Filipenský - 4.17.2-1 +- Always add epoch to samba_depver to fix osci.brew-build.rpmdeplint.functional + +* Tue Oct 25 2022 Andreas Schneider - 4.17.2-1 +- Update to version 4.17.2 +- Fix CVE-2022-3592: A malicious client can use a symlink to escape the + exported + +* Mon Oct 24 2022 Andreas Schneider - 4.17.1-2 +- Add missing dependency for wbinfo used by ctdb scripts + +* Wed Oct 19 2022 Pavel Filipenský - 4.17.1-1 +- Update to version 4.17.1 +- resolves: rhbz#2127301 - Permission denied calling SMBC_getatr when file not exists +- resolves: rhbz#2133818 - rpcclient 4.17.0 unable to resolve server hostname + +* Wed Oct 05 2022 Andreas Schneider - 4.17.0-2 +- Move group creation logic to sysusers.d fragment + +* Tue Sep 13 2022 Andreas Schneider - 4.17.0-1 +- resolves: rhbz#2118818 - Update to version 4.17.0 +- resolves: rhbz#2121138 - Fix CVE-2022-32743 +- resolves: rhbz#2122650 - Fix CVE-2022-1615 + +* Tue Sep 13 2022 Andreas Schneider - 4.17.0-0.11.rc5 +- resolves: rhbz#2093656 - Split out libnetapi(-devel) sub-packages +- resolves: rhbz#2096405 - Add samba-usershare package + +* Tue Sep 06 2022 Guenther Deschner - 4.17.0-0.10.rc5 +- resolves: #2118818 - Update to version 4.17.0rc5 + +* Wed Aug 31 2022 Guenther Deschner - 4.17.0-0.9.rc4 +- resolves: #2118818 - Update to version 4.17.0rc4 + +* Thu Aug 25 2022 Adam Williamson - 4.17.0-0.8.rc3 +- Rebuild with no changes to fix F37 update grouping + +* Thu Aug 25 2022 Andreas Schneider - 4.17.0-0.7.rc3 +- python3-samba package should not require the samba package + +* Tue Aug 23 2022 Pavel Filipenský - 4.17.0-0.6.rc3 +- resolves: #2118818 - Update to version 4.17.0rc3 + +* Fri Aug 19 2022 Andreas Schneider - 4.17.0-0.5.rc2 +- Create a samba-gpupdate sub-package for GPO client support + +* Fri Aug 19 2022 Andreas Schneider - 4.17.0-0.4.rc2 +- Split out a samba-ldb-ldap-modules subpackage + +* Thu Aug 18 2022 Kalev Lember - 2:4.17.0-0.3.rc2 +- Avoid requiring systemd as per updated packaging guidelines + +* Wed Aug 17 2022 Guenther Deschner - 4.17.0rc2-2 +- resolves: #2118818 - Update to version 4.17.0rc2 + +* Wed Aug 10 2022 Andreas Schneider - 4.17.0rc1-1 +- Make sure we detect if SO version numbers of public libraries change. + +* Mon Aug 08 2022 Guenther Deschner - 4.17.0rc1-0 +- resolves: #2116503 - Update to version 4.17.0rc1 + +* Mon Aug 01 2022 Frantisek Zatloukal - 2:4.16.4-1 +- Rebuilt for ICU 71.1 + +* Wed Jul 27 2022 Guenther Deschner - 4.16.4-0 +- resolves: #2111490 - Update to version 4.16.4 +- resolves: #2108196, #2111729 - Security fixes for CVE-2022-32742 +- resolves: #2108205, #2111731 - Security fixes for CVE-2022-32744 +- resolves: #2108211, #2111732 - Security fixes for CVE-2022-32745 +- resolves: #2108215, #2111734 - Security fixes for CVE-2022-32746 + +* Sat Jul 23 2022 Fedora Release Engineering - 2:4.16.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + +* Mon Jul 18 2022 Andreas Schneider - 4.16.3-1 +- Update to version 4.16.3 + +* Wed Jun 15 2022 Python Maint - 2:4.16.2-1 +- Rebuilt for Python 3.11 + +* Mon Jun 13 2022 Guenther Deschner - 4.16.2-0 +- Update to Samba 4.16.2 +- resolves: #2096167 + +* Wed Jun 08 2022 Andreas Schneider - 4.16.1-7 +- resolves: rhbz#2093833 - Remove weak dependency for logrotate for CentOS/RHEL + +* Tue May 31 2022 Jitka Plesnikova - 2:4.16.1-6 +- Perl 5.36 rebuild + +* Fri May 13 2022 Pavel Filipenský - 4.16.1-5 +- Fix rpminspect abidiff + +* Fri May 06 2022 Pavel Filipenský - 4.16.1-2 +- Update requires for packages + +* Thu May 05 2022 Tomas Popela - 4.16.1-1 +- Don't require full systemd for tmp files handling in samba-common + +* Mon May 02 2022 Pavel Filipenský - 4.16.1-0 +- Update to Samba 4.16.1 +- resolves: #2080915 + +* Fri Mar 25 2022 Sandro Mani - 2:4.16.0-7 +- Rebuild with mingw-gcc-12 + +* Tue Mar 22 2022 Guenther Deschner - 4.16.0-6 +- Update to Samba 4.16.0 +- resolves: #2066290 + +* Wed Mar 09 2022 Guenther Deschner - 4.16.0-0.5.rc5 +- Update to Samba 4.16.0rc5 +- resolves: #2042518 + +* Tue Mar 01 2022 Pavel Filipenský - 4.16.0-0.4.rc4 +- Update to Samba 4.16.0rc4 +- resolves: #2042518 + +* Wed Feb 23 2022 Andreas Schneider - 4.16.0-0.3.rc3 +- resolves: rhbz#2036443 - Fix samba-tool on builds with samba-dc + +* Tue Feb 15 2022 Pavel Filipenský - 4.16.0rc3 +- Update to Samba 4.16.0rc3 +- resolves: #2042518 + +* Tue Feb 01 2022 Pavel Filipenský - 4.16.0rc2 +- Update to Samba 4.16.0rc2 +- resolves: #2046120, #2048566 - Security fixes for CVE-2021-44141 +- resolves: #2046146, #2048570 - Security fixes for CVE-2021-44142 +- resolves: #2046134, #2048568 - Security fixes for CVE-2022-0336 +- resolves: #2042518 + +* Wed Jan 26 2022 Pavel Filipenský - 4.16.0rc1 +- Exclude temporarily ceph on ppc64le to fix failing build + +* Tue Jan 25 2022 Pavel Filipenský - 4.16.0rc1 +- Update to Samba 4.16.0rc1 +- resolves: #2042518 + +* Thu Jan 20 2022 Pavel Filipenský - 4.15.4-0 +- Update to Samba 4.15.4 +- resolves: #2009673, #2039034 - Security fixes for CVE-2021-20316 +- resolves: #2042518 + +* Wed Dec 15 2021 Pavel Filipenský - 4.15.3-1 +- Fix resolv_wrapper with glibc 2.34 +- resolves: #2019669 + +* Wed Dec 08 2021 Pavel Filipenský - 4.15.3-0 +- Update to Samba 4.15.3 +- resolves: #2030382 + +* Sat Nov 13 2021 Guenther Deschner - 4.15.2-3 +- Fix IPA DC schannel support + +* Thu Nov 11 2021 Guenther Deschner - 4.15.2-2 +- Fix winbind trusted domain regression +- related: #2021716 +- Fix logfile handling +- Fix smbclient -N failures in container setups + +* Tue Nov 09 2021 Guenther Deschner - 4.15.2-0 +- Update to Samba 4.15.2 +- resolves: #2019660, #2021711 - Security fixes for CVE-2016-2124 +- resolves: #2019672, #2021716 - Security fixes for CVE-2020-25717 +- resolves: #2019726, #2021718 - Security fixes for CVE-2020-25718 +- resolves: #2019732, #2021719 - Security fixes for CVE-2020-25719 +- resolves: #2021728, #2021729 - Security fixes for CVE-2020-25721 +- resolves: #2019764, #2021721 - Security fixes for CVE-2020-25722 +- resolves: #2021726, #2021727 - Security fixes for CVE-2021-3738 +- resolves: #2019666, #2021715 - Security fixes for CVE-2021-23192 +- resolves: #2021625 + +* Fri Nov 05 2021 Guenther Deschner - 4.15.1-1 +- Fix winexe core dump +- resolves: #2020376 + +* Wed Oct 27 2021 Guenther Deschner - 4.15.1-0 +- Update to Samba 4.15.1 +- resolves: #2017847 + +* Mon Sep 20 2021 Guenther Deschner - 4.15.0-13 +- Update to Samba 4.15.0 +- resolves: #2005817 + +* Mon Sep 13 2021 Guenther Deschner - 4.15.0-0.12.rc7 +- Update to Samba 4.15.0rc7 +- resolves: #2003740 + +* Thu Sep 09 2021 Guenther Deschner - 4.15.0-0.11.rc6 +- Update to Samba 4.15.0rc6 +- resolves: #2002546 + +* Tue Sep 07 2021 Guenther Deschner - 4.15.0-0.10.rc5 +- Update to Samba 4.15.0rc5 +- resolves: #2001827 + +* Wed Sep 01 2021 Guenther Deschner - 4.15.0-0.9.rc4 +- Update to Samba 4.15.0rc4 +- resolves: #2000079 + +* Thu Aug 26 2021 Guenther Deschner - 4.15.0-0.8.rc3 +- Update to Samba 4.15.0rc3 +- resolves: #1998024 + +* Wed Aug 25 2021 Guenther Deschner - 4.15.0-0.7.rc2 +- Add ceph and etcd mutex helpers for CTDB + +* Mon Aug 16 2021 Anoop C S - 4.15.0-0.6.rc2 +- Avoid removing PyDSDB library files from buildroot for non AD DC build + +* Fri Aug 13 2021 Adam Williamson - 4.15.0-0.5.rc2 +- Fix samba-common-tools dependency + +* Thu Aug 12 2021 Andreas Schneider - 4.15.0-0.4.rc2 +- Package samba-tool correctly + +* Mon Aug 09 2021 Guenther Deschner - 4.15.0-0.3.rc2 +- Update to Samba 4.15.0rc2 +- resolves: #1991634 + +* Fri Jul 23 2021 Fedora Release Engineering - 2:4.15.0-0.2.rc1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + +* Mon Jul 19 2021 Guenther Deschner - 4.15.0rc1-1 +- Fix ctdb-pcp-pmda install +- resolves: #1983369 + +* Thu Jul 15 2021 Guenther Deschner - 4.15.0rc1-0 +- Update to Samba 4.15.0rc1 +- resolves: #1982623 + +* Wed Jul 14 2021 Guenther Deschner - 4.14.6-1 +- Build with pcp-pmda support by default on Fedora +- resolves: #1552276 + +* Tue Jul 13 2021 Guenther Deschner - 4.14.6-0 +- Update to Samba 4.14.6 +- resolves: #1981764 + +* Thu Jun 24 2021 Andreas Schneider - 4.14.5-3 +- Create a subpackage for vfs-io-uring + +* Fri Jun 04 2021 Python Maint - 2:4.14.5-1 +- Rebuilt for Python 3.10 + +* Tue Jun 01 2021 Guenther Deschner - 4.14.5-0 +- Update to Samba 4.14.5 +- resolves: #1966456 + +* Fri May 21 2021 Jitka Plesnikova - 2:4.14.4-3 +- Perl 5.34 rebuild + +* Wed May 19 2021 Pete Walter - 2:4.14.4-2 +- Rebuild for ICU 69 + +* Tue May 18 2021 Andreas Schneider - 4.14.4-1 +- Fixed building with gcc 11.x +- Fixed quota support + +* Thu Apr 29 2021 Guenther Deschner - 4.14.4-0 +- Update to Samba 4.14.4 +- resolves: #1949442, #1955027 - Security fixes for CVE-2021-20254 +- resolves: #1955011 + +* Wed Apr 28 2021 Anoop C S - 4.14.3-2 +- resolves: #1954263 - wrong conditional build check of AD DC + +* Tue Apr 20 2021 Andreas Schneider - 4.14.3-1 +- resolves: #1942378 - Drop NIS support + +* Tue Apr 20 2021 Guenther Deschner - 4.14.3-0 +- Update to Samba 4.14.3 +- resolves: #1951531 + +* Mon Apr 19 2021 Michal Ambroz - 4.14.2-4 + - Added python3-ldb to BR + +* Mon Apr 19 2021 Andreas Schneider - 4.12.2-3 +- resolves: #1949295 - Remove findsmb script + +* Wed Apr 14 2021 Richard W.M. Jones - 2:4.14.2-2 +- Rebuild for updated liburing. + +* Wed Apr 07 2021 Alexander Bokovoy - 4.14.2-1 +- Fix memory leaks in RPC server +- resolves: #1946950 + +* Thu Mar 25 2021 Guenther Deschner - 4.14.2-0 +- Update to Samba 4.14.2 +- related: #1941400, #1942496 - Security fixes for CVE-2020-27840 +- related: #1941402, #1942497 - Security fixes for CVE-2021-20277 + +* Wed Mar 24 2021 Guenther Deschner - 4.14.1-0 +- Update to Samba 4.14.1 +- resolves: #1941400, #1942496 - Security fixes for CVE-2020-27840 +- resolves: #1941402, #1942497 - Security fixes for CVE-2021-20277 + +* Tue Mar 09 2021 Guenther Deschner - 4.14.0-3 +- Update to Samba 4.14.0 + +* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 2:4.14.0-0.0.rc4.2 +- Rebuilt for updated systemd-rpm-macros + See https://pagure.io/fesco/issue/2583. + +* Mon Mar 01 2021 Guenther Deschner - 4.14.0rc4-0 +- Update to Samba 4.14.0rc4 + +* Thu Feb 18 2021 Guenther Deschner - 4.14.0rc3-0 +- Update to Samba 4.14.0rc3 + +* Thu Feb 04 2021 Guenther Deschner - 4.14.0rc2-0 +- Update to Samba 4.14.0rc2 + +* Wed Jan 27 2021 Guenther Deschner - 4.14.0rc1-0 +- Update to Samba 4.14.0rc1 + +* Tue Jan 26 2021 Guenther Deschner - 4.13.4-0 +- Update to Samba 4.13.4 + +* Wed Dec 16 2020 Guenther Deschner - 4.13.3-1 +- Rebuild against krb5-1.19 +- Resolves: rhbz#1915928 + +* Tue Dec 15 2020 Guenther Deschner - 4.13.3-0 +- Update to Samba 4.13.3 + +* Wed Nov 25 2020 Alexander Bokovoy - 4.13.2-2 +- rhbz#1892745, rhbz#1900232: smbclient mget crashes (upstream bug 14517) +- Merge RHEL 8.4 patches: + - FIPS-related enhancements + - FreeIPA Global Catalog patches + +* Tue Nov 03 2020 Andreas Schneider - 4.13.2-1 +- Create a python3-samba-devel package to avoid unnessary dependencies + +* Tue Nov 03 2020 Guenther Deschner - 4.13.2-0 +- Update to Samba 4.13.2 + +* Thu Oct 29 2020 Guenther Deschner - 4.13.1-0 +- Update to Samba 4.13.1 +- resolves: #1892631, #1892634 - Security fixes for CVE-2020-14318 +- resolves: #1891685, #1892628 - Security fixes for CVE-2020-14323 +- resolves: #1892636, #1892640 - Security fixes for CVE-2020-14383 + +* Mon Oct 26 2020 Andreas Schneider - 4.13.0-14 +- Fixed dbcheck running in a release tarball +- Updated internal resolv_wrapper copy to verison 1.1.7 + +* Sun Oct 25 2020 Alexander Bokovoy - 4.13.0-13 +- Report 'samba' daemon status back to systemd +- Support dnspython 2.0.0 or later in samba_dnsupdate + +* Thu Oct 22 2020 Alexander Bokovoy - 4.13.0-12 +- Add preliminary support for S4U operations in Samba AD DC + resolves: #1836630 - Samba DC: Remote Desktop cannot access files +- Fix lookup_unix_user_name to allow lookup of realm-qualified users and groups + required for upcoming FreeIPA Global Catalog support + +* Tue Sep 22 2020 Guenther Deschner - 4.13.0-11 +- Update to Samba 4.13.0 + +* Fri Sep 18 2020 Guenther Deschner - 4.13.0rc6-10 +- Update to Samba 4.13.0rc6 +- resolves: #1879822, #1880703 - Security fixes for CVE-2020-1472 + +* Wed Sep 16 2020 Guenther Deschner - 4.13.0rc5-9 +- Update to Samba 4.13.0rc5 + +* Mon Sep 07 2020 Guenther Deschner - 4.13.0rc4-8 +- Update to Samba 4.13.0rc4 + +* Fri Aug 28 2020 Neal Gompa - 4.13.0rc3-6 +- Enable winexe by default everywhere + +* Fri Aug 28 2020 Guenther Deschner - 4.13.0rc3-5 +- Update to Samba 4.13.0rc3 + +* Fri Aug 14 2020 Guenther Deschner - 4.13.0rc2-4 +- Update to Samba 4.13.0rc2 + +* Wed Aug 12 2020 Andreas Schneider - 4.13.0rc1-3 +- resolves: #1865831 - Add missing /usr/lib64/samba/krb5 directory +- resolves: #1866989 - Remove obsolete python3-crypto dependency + +* Wed Jul 29 2020 Fedora Release Engineering - 2:4.13.0-0.2.rc1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Tue Jul 14 2020 Tom Stellard - 2:4.13.0-0.2.rc1 +- Use make macros + https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro + +* Tue Jul 14 2020 Andreas Schneider - 4.13.0rc1-1 +- Move mdssvc data files to correct package + +* Thu Jul 09 2020 Guenther Deschner - 4.13.0rc1-0 +- Update to Samba 4.13.0rc1 + +* Wed Jul 08 2020 Merlin Mathesius - 4.12.5-1 +- Remove nonexistent --without-winexe option from configure + +* Thu Jul 02 2020 Guenther Deschner - 4.12.5-0 +- Update to Samba 4.12.5 + +* Thu Jul 02 2020 Guenther Deschner - 4.12.4-0 +- Update to Samba 4.12.4 +- resolves: #1849489, #1853255 - Security fixes for CVE-2020-10730 +- resolves: #1849491, #1853256 - Security fixes for CVE-2020-10745 +- resolves: #1849509, #1853276 - Security fixes for CVE-2020-10760 +- resolves: #1851298, #1853259 - Security fixes for CVE-2020-14303 + +* Sat Jun 27 2020 Jitka Plesnikova - 2:4.12.3-1.1 +- Perl 5.32 re-rebuild updated packages + +* Thu Jun 25 2020 Guenther Deschner - 4.12.3-1 +- Add BuildRequires for python3-setuptools + +* Thu Jun 25 2020 Jitka Plesnikova - 2:4.12.3-0.4 +- Perl 5.32 rebuild + +* Tue May 26 2020 Miro Hrončok - 2:4.12.3-0.3 +- Rebuilt for Python 3.9 + +* Tue May 19 2020 Guenther Deschner - 4.12.3-0 +- Update to Samba 4.12.3 + +* Fri May 15 2020 Pete Walter - 2:4.12.2-1.2 +- Rebuild for ICU 67 + +* Wed May 13 2020 Guenther Deschner - 4.12.2-1 +- Add support for building the new experimental io_uring VFS module + +* Tue Apr 28 2020 Guenther Deschner - 4.12.2-0 +- Update to Samba 4.12.2 +- resolves: #1825731, #1828870 - Security fixes for CVE-2020-10700 +- resolves: #1825734, #1828872 - Security fixes for CVE-2020-10704 + +* Sun Apr 12 2020 Alexander Bokovoy - 4.12.1-1 +- Revert POSIX stat tuning in libsmbclient +- Resolves: rhbz#1801442 + +* Tue Apr 07 2020 Guenther Deschner - 4.12.1-0 +- Update to Samba 4.12.1 + +* Sat Mar 21 2020 Alexander Bokovoy - 4.12.0-6 +- Fix samba_requires_eq macro definition +- Resolves rhbz#1815739 + +* Tue Mar 10 2020 Guenther Deschner - 4.12.0-5 +- Add build requirement for perl-FindBin +- resolves: #1661213 - Add winexe subpackage for remote windows command execution + +* Tue Mar 03 2020 Guenther Deschner - 4.12.0-3 +- Update to Samba 4.12.0 + +* Wed Feb 26 2020 Guenther Deschner - 4.12.0rc4-2 +- Update to Samba 4.12.0rc4 + +* Wed Feb 19 2020 Guenther Deschner - 4.12.0rc3-2 +- Update to Samba 4.12.0rc3 + +* Tue Feb 04 2020 Guenther Deschner - 4.12.0rc2-2 +- Update to Samba 4.12.0rc2 + +* Thu Jan 30 2020 Fedora Release Engineering - 2:4.12.0-0.1.rc1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + +* Fri Jan 24 2020 Alexander Bokovoy - 4.12.0.rc1-1 +- Allow building against krb5 1.18 beta and require it for Rawhide + +* Wed Jan 22 2020 Guenther Deschner - 4.12.0rc1-0 +- Update to Samba 4.12.0rc1 + +* Tue Jan 21 2020 Guenther Deschner - 4.11.5-0 +- Update to Samba 4.11.5 +- resolves: #1791201, #1793405 - Security fixes for CVE-2019-14902 +- resolves: #1791207, #1793407 - Security fixes for CVE-2019-14907 +- resolves: #1791204, #1793406 - Security fixes for CVE-2019-19344 + +* Mon Dec 16 2019 Guenther Deschner - 4.11.4-0 +- Update to Samba 4.11.4 + +* Tue Dec 10 2019 Guenther Deschner - 4.11.3-0 +- Update to Samba 4.11.3 +- resolves: #1778586, #1781542 - Security fixes for CVE-2019-14861 +- resolves: #1778589, #1781545 - Security fixes for CVE-2019-14870 + +* Thu Dec 05 2019 Andreas Schneider - 4.11.2-2 +- Restart winbindd on samba-winbind package upgrade + +* Wed Nov 06 2019 Alexander Bokovoy - 4.11.2-1 +- Update DES removal patch + +* Tue Oct 29 2019 Guenther Deschner - 4.11.2-0 +- Update to Samba 4.11.2 +- resolves: #1763137, #1766558 - Security fixes for CVE-2019-10218 +- resolves: #1764126, #1766559 - Security fixes for CVE-2019-14833 + +* Sun Oct 27 2019 Alexander Bokovoy - 4.11.1-1 +- resolves: #1757071 - Deploy new samba DC fails + +* Fri Oct 18 2019 Guenther Deschner - 4.11.1-0 +- Update to Samba 4.11.1 + +* Tue Sep 17 2019 Guenther Deschner - 4.11.0-3 +- Update to Samba 4.11.0 + +* Wed Sep 11 2019 Guenther Deschner - 4.11.0rc4-2 +- Update to Samba 4.11.0rc4 + +* Tue Sep 03 2019 Guenther Deschner - 4.11.0rc3-2 +- Update to Samba 4.11.0rc3 +- resolves: #1746225, #1748308 - Security fixes for CVE-2019-10197 + +* Tue Aug 27 2019 Guenther Deschner - 4.11.0rc2-2 +- resolves: #1746014 - re-add pidl + +* Mon Aug 26 2019 Lubomir Rintel - 2:4.11.0-0.1.rc2 +- Move the NetworkManager dispatcher script out of /etc + +* Wed Aug 21 2019 Guenther Deschner - 4.11.0rc2-0 +- Update to Samba 4.11.0rc2 + +* Tue Aug 20 2019 Guenther Deschner - 4.11.0rc1-0 +- Update to Samba 4.11.0rc1 + +* Mon Aug 19 2019 Miro Hrončok - 2:4.10.6-1.1 +- Rebuilt for Python 3.8 + +* Fri Aug 16 2019 Alexander Bokovoy - 2:4.10.6-1 +- Fix Samba bug https://bugzilla.samba.org/show_bug.cgi?id=14091 +- Fixes: Windows systems cannot resolve IPA users and groups over LSA RPC + +* Fri Jul 26 2019 Fedora Release Engineering - 2:4.10.6-0.2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Mon Jul 08 2019 Guenther Deschner - 4.10.6-0 +- Update to Samba 4.10.6 + +* Mon Jul 01 2019 Guenther Deschner - 4.10.5-2 +- resolves: #1718113 - Avoid deprecated time.clock in wafsamba +- resolves: #1711638 - Update to latest waf version 2.0.17 + +* Thu Jun 20 2019 Guenther Deschner - 4.10.5-1 +- resolves: #1602824 - Make vfs_fruit operable with other remote VFS modules +- resolves: #1716455 - Avoid pathconf() in get_real_filename() VFS calls +- resolves: #1706090, #1700791 - Fix smbspool + +* Wed Jun 19 2019 Guenther Deschner - 4.10.5-0 +- Update to Samba 4.10.5 +- resolves: #1711816, #1721872 - Security fixes for CVE-2019-12435 +- resolves: #1711837, #1721873 - Security fixes for CVE-2019-12436 + +* Fri May 31 2019 Jitka Plesnikova - 2:4.10.4-1.1 +- Perl 5.30 rebuild + +* Tue May 28 2019 Guenther Deschner - 4.10.4-1 +- Add missing ctdb directories +- resolves: #1656777 + +* Wed May 22 2019 Guenther Deschner - 4.10.4-0 +- Update to Samba 4.10.4 + +* Tue May 14 2019 Guenther Deschner - 4.10.3-0 +- Update to Samba 4.10.3 +- resolves: #1705877, #1709679 - Security fixes for CVE-2018-16860 + +* Mon Apr 15 2019 Andreas Schneider - 4.10.2-1 +- resolves: #1699230 - Rebuild for MIT Kerberos soname bump of libkadm5srv + +* Mon Apr 08 2019 Guenther Deschner - 4.10.2-0 +- Update to Samba 4.10.2 +- resolves: #1689010, #1697718 - Security fixes for CVE-2019-3870 +- resolves: #1691518, #1697717 - Security fixes for CVE-2019-3880 + +* Wed Apr 03 2019 Guenther Deschner - 4.10.1-0 +- Update to Samba 4.10.1 + +* Mon Mar 25 2019 Andreas Schneider - 4.10.0-6 +- resolves: #1692347 - Add missing DC requirement for its python3 tools + +* Wed Mar 20 2019 Guenther Deschner - 4.10.0-5 +- Fix build failure (duplication during install) + +* Tue Mar 19 2019 Guenther Deschner - 4.10.0-4 +- Update to Samba 4.10.0 + +* Wed Mar 06 2019 Guenther Deschner - 4.10.0rc4-2 +- Update to Samba 4.10.0rc4 + +* Fri Feb 22 2019 Guenther Deschner - 4.10.0rc3-2 +- Update to Samba 4.10.0rc3 + +* Sun Feb 17 2019 Igor Gnatenko - 2:4.10.0-0.2.rc2.1 +- Rebuild for readline 8.0 + +* Thu Feb 14 2019 Andreas Schneider - 4.10.0rc2-2 +- resolves: #1672231 - Fix public NDR API + +* Tue Feb 12 2019 Guenther Deschner - 4.10.0rc2-1 +- resolves: #1674547 - Move samba.xattr modules out of python3 test package + +* Wed Feb 06 2019 Guenther Deschner - 4.10.0rc2-0 +- Update to Samba 4.10.0rc2 + +* Tue Jan 15 2019 Guenther Deschner - 4.10.0rc1-0 +- Update to Samba 4.10.0rc1 + +* Mon Jan 14 2019 Björn Esser - 2:4.9.4-0.1 +- Rebuilt for libcrypt.so.2 (#1666033) + +* Thu Dec 20 2018 Guenther Deschner - 4.9.4-0 +- Update to Samba 4.9.4 + +* Tue Nov 27 2018 Guenther Deschner - 4.9.3-0 +- Update to Samba 4.9.3 +- resolves: #1625449, #1654078 - Security fixes for CVE-2018-14629 +- resolves: #1642545, #1654082 - Security fixes for CVE-2018-16841 +- resolves: #1646377, #1654091 - Security fixes for CVE-2018-16851 +- resolves: #1646386, #1654092 - Security fixes for CVE-2018-16852 +- resolves: #1647246, #1654093 - Security fixes for CVE-2018-16853 +- resolves: #1649278, #1654095 - Security fixes for CVE-2018-16857 + +* Thu Nov 08 2018 Guenther Deschner - 4.9.2-0 +- Update to Samba 4.9.2 + +* Wed Sep 26 2018 Alexander Bokovoy - 4.9.1-2 +- Package ctdb/doc/examples + +* Mon Sep 24 2018 Andreas Schneider - 4.9.1-1 +- Update to Samba 4.9.1 + +* Thu Sep 13 2018 Guenther Deschner - 4.9.0-4 +- Update to Samba 4.9.0 + +* Thu Sep 06 2018 Andreas Schneider - 4.9.0rc5-3 +- Update to Samba 4.9.0rc5 + +* Wed Aug 29 2018 Guenther Deschner - 4.9.0rc4-3 +- Update to Samba 4.9.0rc4 + +* Thu Aug 16 2018 Andreas Schneider - 4.9.0rc3-3 +- Fix python3 packaging + +* Wed Aug 15 2018 Guenther Deschner - 4.9.0rc3-2 +- Update to Samba 4.9.0rc3 +- resolves: #1589651, #1617916 - Security fixes for CVE-2018-1139 +- resolves: #1580230, #1618613 - Security fixes for CVE-2018-1140 +- resolves: #1612805, #1618697 - Security fixes for CVE-2018-10858 +- resolves: #1610640, #1617910 - Security fixes for CVE-2018-10918 +- resolves: #1610645, #1617911 - Security fixes for CVE-2018-10919 + +* Wed Aug 01 2018 Andreas Schneider - 4.9.0rc2-2 +- Add some spec file cleanups + +* Wed Aug 01 2018 Guenther Deschner - 4.9.0rc2-0 +- Update to Samba 4.9.0rc2 + +* Thu Jul 12 2018 Guenther Deschner - 4.9.0rc1-0 +- Update to Samba 4.9.0rc1 + +* Thu Jul 12 2018 Alexander Bokovoy - 2:4.8.3-4.1 +- Scope to local __bss_start symbol (typo in a patch) +- Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1600035 + +* Thu Jul 12 2018 Alexander Bokovoy - 2:4.8.3-4 +- Change scope to local for symbols automatically added by upcoming binutils 2.31 +- Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1600035 + +* Wed Jul 11 2018 Alexander Bokovoy - 2:4.8.3-3 +- Rebuild Samba against binutils 2.30.90-2.fc29 +- Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1600035 +- Add explicit BuildRequires for gcc + +* Fri Jul 06 2018 Petr Pisar +- Perl 5.28 rebuild + +* Thu Jul 05 2018 Alexander Bokovoy - 2:4.8.3-2 +- Fix rawhide build by explicitly using /usr/bin/python2 + +* Tue Jul 03 2018 Petr Pisar +- Perl 5.28 rebuild + +* Mon Jul 02 2018 Miro Hrončok - 2:4.8.3-1.2 +- Rebuilt for Python 3.7 + +* Thu Jun 28 2018 Jitka Plesnikova - 2:4.8.3-1.1 +- Perl 5.28 rebuild + +* Tue Jun 26 2018 Andreas Schneider - 4.8.3-1 +- Update to Samba 4.8.3 +- Remove python(2|3)-subunit dependency + +* Tue Jun 19 2018 Miro Hrončok - 2:4.8.2-1.1 +- Rebuilt for Python 3.7 + +* Wed May 16 2018 Guenther Deschner - 4.8.2-0 +- Update to Samba 4.8.2 + +* Wed May 09 2018 Andreas Schneider - 4.8.1-1 +- resolves: #1574177 - Fix smbspool command line argument handling + +* Thu Apr 26 2018 Guenther Deschner - 4.8.1-0 +- Update to Samba 4.8.1 + +* Wed Mar 14 2018 Guenther Deschner - 4.8.0-7 +- resolves: #1554754, #1554756 - Security fixes for CVE-2018-1050 CVE-2018-1057 +- resolves: #1555112 - Update to Samba 4.8.0 + +* Tue Mar 13 2018 Andreas Schneider - 4.8.0rc4-6 +- resolves: #1552652 - Fix usage of nc in ctdb tests and only recommned it + +* Fri Mar 02 2018 Guenther Deschner - 4.8.0rc4-5 +- Update to Samba 4.8.0rc4 + +* Mon Feb 12 2018 Guenther Deschner - 4.8.0rc3-4 +- Update to Samba 4.8.0rc3 + +* Fri Feb 09 2018 Igor Gnatenko - 2:4.8.0-0.3.rc2.1 +- Escape macros in %%changelog + +* Fri Jan 26 2018 Guenther Deschner - 4.8.0rc2-3 +- Update to Samba 4.8.0rc2 + +* Sun Jan 21 2018 Björn Esser - 2:4.8.0-0.2.rc1 +- Explicitly BR: rpcsvc-proto-devel + +* Sat Jan 20 2018 Björn Esser - 2:4.8.0-0.1.rc1.1 +- Rebuilt for switch to libxcrypt + +* Mon Jan 15 2018 Guenther Deschner - 4.8.0rc1-1 +- Update to Samba 4.8.0rc1 + +* Mon Jan 08 2018 Andreas Schneider - 4.7.4-1 +- resolves: #1508092 - Add missing dependency for tdbbackup + +* Mon Dec 25 2017 Guenther Deschner - 4.7.4-0 +- Update to Samba 4.7.4 + +* Mon Dec 04 2017 Andreas Schneider - 4.7.3-3 +- resolves: #1520163 - Link libaesni-intel-samba4.so with -z noexecstack + +* Thu Nov 30 2017 Andreas Schneider - 4.7.3-2 +- Fix deamon startup with systemd + +* Thu Nov 23 2017 Bastien Nocera - 4.7.3-1 +- Enable AES acceleration on Intel compatible CPUs by default + +* Tue Nov 21 2017 Guenther Deschner - 4.7.3-0 +- Update to Samba 4.7.3 +- resolves: #1515692 - Security fix for CVE-2017-14746 and CVE-2017-15275 + +* Wed Nov 15 2017 Guenther Deschner - 4.7.2-0 +- resolves: #1513452 - Update to Samba 4.7.2 + +* Mon Nov 13 2017 Andreas Schneider - 4.7.1-2 +- Fix release number + +* Tue Nov 07 2017 Igor Gnatenko - 4.7.1-1 +- Remove old crufty coreutils requires + +* Thu Nov 02 2017 Guenther Deschner - 4.7.1-0 +- resolves: #1508871 - Update to Samba 4.7.1 + +* Mon Oct 30 2017 Alexander Bokovoy - 4.7.0-18 +- Force samba-dc to use the same libldb version as LDB modules compiled +- resolves: #1507420 - LDB / Samba module version mismatch + +* Fri Oct 27 2017 Andreas Schneider - 4.7.0-17 +- Move dsdb libs to python2-samba-dc + +* Thu Oct 26 2017 Andreas Schneider - 4.7.0-16 +- Create python[2|3]-samba-dc packages + +* Wed Oct 25 2017 Andreas Schneider - 4.7.0-15 +- related: #1499140 - Fix several dependency issues +- Fix building with MIT Kerberos 1.16 + +* Fri Oct 13 2017 Andreas Schneider - 4.7.0-14 +- resolves: #1499140 - Move libdfs-server-ad to the correct subpackage + +* Fri Oct 06 2017 Alexander Bokovoy - 4.7.0-13 +- Move /usr/lib{64,}/samba/libdsdb-garbage-collect-tombstones-samba4.so to samba-dc-libs +- Rebuild in rawhide against new krb5 1.16 and docbook-xml + +* Thu Sep 21 2017 Guenther Deschner - 4.7.0-12 +- Update to Samba 4.7.0 +- resolves: #1493441 - Security fix for CVE-2017-12150 CVE-2017-12151 CVE-2017-12163 + +* Sun Sep 17 2017 Guenther Deschner - 4.7.0-0.11.rc6 +- Update to Samba 4.7.0rc6 + +* Wed Sep 13 2017 Alexander Bokovoy - 4.7.0-0.11.rc5 +- resolves: #1491137 - dcerpc/__init__.py is not packaged for py3 + +* Tue Sep 12 2017 Andreas Schneider - 4.7.0-0.10.rc5 +- resolves: #1476175 - Create seperate package for bind_dlz module + +* Tue Aug 29 2017 Guenther Deschner - 4.7.0-0.9.rc5 +- Update to Samba 4.7.0rc5 + +* Tue Aug 08 2017 Andreas Schneider - 4.7.0-0.9.rc3 +- Add printadmin group for printer driver handling + +* Sun Jul 30 2017 Florian Weimer - 2:4.7.0-0.8.rc3.2 +- Rebuild with binutils fix for ppc64le (#1475636) + +* Thu Jul 27 2017 Fedora Release Engineering - 2:4.7.0-0.8.rc3.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild + +* Wed Jul 26 2017 Andreas Schneider - 4.7.0-0.8.rc3 +- resolves: #1301002 - Enable avahi support + +* Tue Jul 25 2017 Guenther Deschner - 4.7.0-0.7.rc3 +- Update to Samba 4.7.0rc3 + +* Mon Jul 24 2017 Andreas Schneider - 4.7.0-0.7.rc1 +- Rename samba-python to python2-samba +- Update build requirement for libcephfs + +* Thu Jul 20 2017 Alexander Bokovoy - 4.7.0-0.6.rc1 +- Use Python 2 explicitly for samba-tool and other Python-based tools +- Install samba.service as it is required for the AD DC case + +* Tue Jul 18 2017 Alexander Bokovoy - 4.7.0-0.5.rc1 +- Convert more rpc modules to python3 +- Explicitly specify Python artifacts in the spec to be able to catch unpackaged ones +- Split 'make test' Python code into separate python2-samba-test/python3-samba-test sub-packages +- Remove embedded python2-dns version, require python{2,3}-dns instead + +* Thu Jul 06 2017 Andreas Schneider - 4.7.0-0.4.rc1 +- Add python3 support +- Fix %%posttrans for libwbclient-devel + +* Thu Jul 06 2017 Andreas Schneider - 4.7.0-0.3.rc1 +- Do not install conflicting file _ldb_text.py + +* Wed Jul 05 2017 Andreas Schneider - 4.7.0-0.2.rc1 +- Fix requirement generation for shared libraries + +* Wed Jul 05 2017 Andreas Schneider - 4.7.0-0.1.rc1 +- Build Samba with Active Directory support! + +* Mon Jun 12 2017 Guenther Deschner - 4.7.0-0.0.rc1 +- Update to Samba 4.7.0rc1 + +* Mon Jun 12 2017 Guenther Deschner - 4.6.5-0 +- Update to Samba 4.6.5 + +* Sun Jun 04 2017 Jitka Plesnikova - 2:4.6.4-1.1 +- Perl 5.26 rebuild + +* Wed May 24 2017 Andreas Schneider - 4.6.4-1 +- #resolves: #1451486 - Add source tarball comment + +* Wed May 24 2017 Guenther Deschner - 4.6.4-0 +- Update to Samba 4.6.4 +- resolves: #1455050 - Security fix for CVE-2017-7494 + +* Tue Apr 25 2017 Guenther Deschner - 4.6.3-0 +- Update to Samba 4.6.3 + +* Fri Mar 31 2017 Guenther Deschner - 4.6.2-0 +- Update to Samba 4.6.2 +- related: #1435156 - Security fix for CVE-2017-2619 + +* Thu Mar 23 2017 Guenther Deschner - 4.6.1-0 +- Update to Samba 4.6.1 +- resolves: #1435156 - Security fix for CVE-2017-2619 + +* Wed Mar 15 2017 Alexander Bokovoy - 4.6.0-4 +- Export arcfour_crypt_blob to Python as samba.crypto.arcfour_encrypt +- Makes possible to run trust to AD in FreeIPA in FIPS mode + +* Fri Mar 10 2017 Alexander Bokovoy - 4.6.0-3 +- auth/credentials: Always set the the realm if we set the principal from the ccache +- resolves: #1430761 - credentials_crb5: use gss_acquire_cred for client-side GSSAPI use case + +* Thu Mar 09 2017 Alexander Bokovoy - 4.6.0-2 +- resolves: #1430761 - credentials_krb5: use gss_acquire_cred for client-side GSSAPI use case + +* Tue Mar 07 2017 Andreas Schneider - 4.6.0-1 +- Update to Samba 4.6.0 + +* Wed Mar 01 2017 Andreas Schneider - 4.6.0-0.3.rc4 +- Update to Samba 4.6.0rc4 + +* Tue Feb 14 2017 Andreas Schneider - 4.6.0-0.1.rc3 +- Update to Samba 4.6.0rc3 + +* Sat Feb 11 2017 Fedora Release Engineering - 4.6.0-0.1.rc2.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild + +* Fri Jan 27 2017 Guenther Deschner - 4.6.0-0.1.rc2 +- Update to Samba 4.6.0rc2 + +* Thu Jan 12 2017 Andreas Schneider - 4.6.0-0.1.rc1 +- resolves: #1319098 - Add missing Requires for pre-required packages + +* Thu Jan 05 2017 Guenther Deschner - 4.6.0-0.1.rc1 +- Update to Samba 4.6.0rc1 + +* Mon Dec 19 2016 Guenther Deschner - 4.5.3-0 +- Update to Samba 4.5.3 +- resolves: #1405984 - CVE-2016-2123,CVE-2016-2125 and CVE-2016-2126 + +* Wed Dec 07 2016 Guenther Deschner - 4.5.2-0 +- Update to Samba 4.5.2 + +* Mon Dec 05 2016 Rex Dieter - - +- rebuild (libldb) + +* Fri Nov 04 2016 Anoop C S - 4.5.1-1 +- Fix glfs_realpath allocation in vfs_glusterfs + +* Wed Oct 26 2016 Guenther Deschner - 4.5.1-0 +- Update to Samba 4.5.1 + +* Mon Oct 17 2016 Andreas Schneider - 4.5.0-3 +- resolves: 1375973 - Fix tevent incompatibility issue + +* Wed Sep 14 2016 Guenther Deschner - 4.5.0-2 +- Fix smbspool alternatives handling during samba-client uninstall + +* Wed Sep 07 2016 Guenther Deschner - 4.5.0-1 +- Update to Samba 4.5.0 + +* Mon Aug 29 2016 Guenther Deschner - 4.5.0rc3-0 +- Update to Samba 4.5.0rc3 + +* Mon Aug 15 2016 Guenther Deschner - 4.5.0rc2-0 +- Update to Samba 4.5.0rc2 + +* Thu Jul 28 2016 Guenther Deschner - 4.5.0rc1-0 +- Update to Samba 4.5.0rc1 + +* Tue Jul 19 2016 Fedora Release Engineering - 2:4.4.5-1.1 +- https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages + +* Thu Jul 07 2016 Guenther Deschner - 4.4.5-1 +- Update to Samba 4.4.5 +- resolves: #1353504 - CVE-2016-2119 + +* Thu Jun 23 2016 Guenther Deschner - 4.4.4-4 +- resolves: #1348899 - Import of samba.ntacls fails + +* Mon Jun 20 2016 Andreas Schneider - 4.4.4-3 +- resolves: #1337260 - Small fix to the example smb.conf file + +* Wed Jun 15 2016 Andreas Schneider - 4.4.4-2 +- Fix resolving trusted domain users on domain member + +* Tue Jun 07 2016 Guenther Deschner - 4.4.4-1 +- Update to Samba 4.4.4 +- resolves: #1343529 + +* Wed May 25 2016 Alexander Bokovoy - 2:4.4.3-2 +- Fix libsystemd patch (#1125086) so that it actually works + +* Mon May 23 2016 Zbigniew Jędrzejewski-Szmek - 2:4.4.3-1.2 +- Rebuild to drop libsystemd-daemon dependency (#1125086) + +* Sun May 15 2016 Jitka Plesnikova - 2:4.4.3-1.1 +- Perl 5.24 rebuild + +* Mon May 02 2016 Guenther Deschner - 4.4.3-1 +- Update to Samba 4.4.3 +- resolves: #1332178 + +* Tue Apr 12 2016 Guenther Deschner - 4.4.2-1 +- Update to Samba 4.4.2, fix badlock security bug +- resolves: #1326453 - CVE-2015-5370 +- resolves: #1326453 - CVE-2016-2110 +- resolves: #1326453 - CVE-2016-2111 +- resolves: #1326453 - CVE-2016-2112 +- resolves: #1326453 - CVE-2016-2113 +- resolves: #1326453 - CVE-2016-2114 +- resolves: #1326453 - CVE-2016-2115 +- resolves: #1326453 - CVE-2016-2118 + +* Tue Mar 22 2016 Guenther Deschner - 4.4.0-1 +- Update to Samba 4.4.0 + +* Wed Mar 16 2016 Guenther Deschner - 4.4.0-0.8.rc5 +- Update to Samba 4.4.0rc5 + +* Tue Mar 08 2016 Guenther Deschner - 4.4.0-0.7.rc4 +- Update to Samba 4.4.0rc4 +- resolves: #1315942 - CVE-2015-7560 Incorrect ACL get/set allowed on symlink path + +* Tue Feb 23 2016 Guenther Deschner - 4.4.0-0.6.rc3 +- Update to Samba 4.4.0rc3 + +* Wed Feb 17 2016 Guenther Deschner - 4.4.0-0.5.rc2 +- Activate multi channel support (switched off by default) + +* Mon Feb 15 2016 Andreas Schneider - 4.4.0-0.4.rc2 +- More spec file fixes +- resolves: #1306542 - scriptlet failure because of comments + +* Mon Feb 15 2016 Andreas Schneider - 4.4.0-0.3.rc2 +- More spec file fixes + +* Mon Feb 15 2016 Andreas Schneider - 4.4.0-0.2.rc2 +- More spec file fixes + +* Wed Feb 10 2016 Guenther Deschner - 4.4.0-0.1.rc2 +- Update to Samba 4.4.0rc2 + +* Thu Feb 04 2016 Fedora Release Engineering - 2:4.4.0-0.1.rc1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild + +* Wed Jan 27 2016 Guenther Deschner - 4.4.0-0.0.rc1 +- Update to Samba 4.4.0rc1 + +* Fri Jan 22 2016 Alexander Bokovoy - 4.3.4-1 +- resolves: #1300038 - PANIC: Bad talloc magic value - wrong talloc version used/mixed + +* Tue Jan 12 2016 Guenther Deschner - 4.3.4-0 +- resolves: #1261230 - Update to Samba 4.3.4 + +* Wed Dec 16 2015 Guenther Deschner - 4.3.3-0 +- Update to Samba 4.3.3 +- resolves: #1292069 +- CVE-2015-3223 Remote DoS in Samba (AD) LDAP server +- CVE-2015-5252 Insufficient symlink verification in smbd +- CVE-2015-5296 Samba client requesting encryption vulnerable to + downgrade attack +- CVE-2015-5299 Missing access control check in shadow copy code +- CVE-2015-7540 DoS to AD-DC due to insufficient checking of asn1 + memory allocation + +* Tue Dec 15 2015 Guenther Deschner - 4.3.2-2 +- revert dependencies to samba-common and -tools + +* Tue Dec 01 2015 Guenther Deschner - 4.3.2-1 +- resolves: #1261230 - Update to Samba 4.3.2 + +* Wed Nov 18 2015 Guenther Deschner - 4.3.1-3 +- resolves: #1282931 - Fix DCE/RPC bind nak parsing + +* Fri Oct 23 2015 Guenther Deschner - 4.3.1-2 +- Fix dependencies to samba-common + +* Tue Oct 20 2015 Guenther Deschner - 4.3.1-1 +- resolves: #1261230 - Update to Samba 4.3.1 + +* Mon Oct 12 2015 Guenther Deschner - 4.3.0-3 +- Use separate lockdir + +* Mon Oct 12 2015 Guenther Deschner - 4.3.0-2 +- resolves: #1270568 - Samba fails to start after update to 4.3.0 + +* Tue Sep 08 2015 Guenther Deschner - 4.3.0-1 +- resolves: #1088911 - Update to Samba 4.3.0 + +* Tue Sep 01 2015 Andreas Schneider - 4.3.0-0.1rc4 +- Update to Samba 4.3.0rc4 + +* Mon Aug 31 2015 Andreas Schneider - 4.3.0-0.1rc3 +- Update to Samba 4.3.0rc3 + +* Tue Jul 14 2015 Guenther Deschner - 4.2.3-0 +- resolves: #1088911 - Update to Samba 4.2.3 + +* Fri Jun 19 2015 Andreas Schneider - 4.2.2-1 +- resolves: #1227911 - Enable tar support for smbclient +- resolves: #1234908 - Own the /var/lib/samba directory +- Enable hardened build + +* Fri Jun 19 2015 Fedora Release Engineering - 2:4.2.2-0.2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild + +* Thu Jun 04 2015 Jitka Plesnikova - 2:4.2.2-0.1 +- Perl 5.22 rebuild + +* Thu May 28 2015 Guenther Deschner - 4.2.2-0 +- Update to Samba 4.2.2 + +* Mon May 11 2015 Alexander Bokovoy - 4.2.1-8 +- Fixes: #1219832: Samba 4.2 broke FreeIPA trusts to AD +- Remove usage of deprecated API from gnutls + +* Thu Apr 30 2015 Alexander Bokovoy - 4.2.1-7 +- Fix LSASD daemon +- resolves: #1217346 - FreeIPA trusts to AD broken due to Samba 4.2 failure to run LSARPC pipe externally + +* Mon Apr 27 2015 Alexander Bokovoy - 4.2.1-6 +- Remove samba-common-tools from samba-client package as it brings back Python 2.7 + +* Mon Apr 27 2015 Alexander Bokovoy - 4.2.1-5 +- Require samba-common-tools in samba package +- Require samba-common-tools in samba-client package +- resolves: #1215631 - /usr/bin/net moved to samba-common-tools but the package is not required by samba + +* Sat Apr 25 2015 Alexander Bokovoy - 4.2.1-4 +- Fix systemd library detection (incomplete patch upstream) + +* Fri Apr 24 2015 Andreas Schneider - 4.2.1-3 +- resolves: #1214973 - Fix libwbclient alternatives link. + +* Wed Apr 22 2015 Guenther Deschner - 4.2.1-2 +- Add vfs snapper module. + +* Tue Apr 21 2015 Andreas Schneider - 4.2.1-1 +- Update to Samba 4.2.1 +- resolves: #1213373 - Fix DEBUG macro issues in public headers + +* Wed Apr 08 2015 Andreas Schneider - 4.2.0-3 +- resolves: #1207381 - Fix libsystemd detection. + +* Tue Mar 10 2015 Andreas Schneider - 4.2.0-2 +- Fix the AD build. +- Create samba-client-libs subpackage. +- Fix multiarch issues by splitting the samba-common package. + +* Thu Mar 05 2015 Guenther Deschner - 4.2.0-1 +- Update to Samba 4.2.0 + +* Tue Mar 03 2015 Andreas Schneider - 4.2.0-0.5.rc5 +- Update to Samba 4.2.0rc5 + +* Fri Jan 16 2015 - Andreas Schneider - 4.2.0-0.4.rc4 +- Update to Samba 4.2.0rc4 +- resolves: #1154600 - Install missing samba pam.d configuration file. + +* Mon Jan 12 2015 Guenther Deschner - 4.2.0-0.6.rc3 +- Fix awk as a dependency (and require gawk) + +* Mon Jan 12 2015 Michael Adam - 4.2.0-0.5.rc3 +- Add dependencies for ctdb. + +* Fri Jan 09 2015 Stephen Gallagher 4.2.0-0.4.rc3 +- Apply the DEBUG patch + +* Fri Jan 09 2015 Andreas Schneider - 4.2.0-0.3.rc3 +- Fix issues with conflicting DEBUG macros. + +* Tue Jan 06 2015 Michael Adam - 4.2.0-0.2.rc3 +- Improve dependencies of vfs-glusterfs and vfs-cephfs. +- Remove unused python_libdir. +- Fix malformed changelog entries. + +* Tue Jan 06 2015 Guenther Deschner - 4.2.0-0.2.rc3 +- Fix ctdb and libcephfs dependencies. + +* Mon Jan 05 2015 Andreas Schneider - 4.2.0-0.1.rc3 +- Update to Samba 4.2.0rc3 + + Samba provides ctdb packages now. + +* Tue Dec 16 2014 Andreas Schneider - 4.2.0-0.3.rc2 +- resolves: #1174412 - Build VFS Ceph module. +- resolves: #1169067 - Move libsamba-cluster-support.so to samba-libs package. +- resolves: #1016122 - Move smbpasswd to samba-common package. + +* Fri Nov 21 2014 Andreas Schneider - 4.2.0-0.2.rc2 +- Use alternatives for libwbclient. +- Add cwrap to BuildRequires. + +* Wed Nov 12 2014 Andreas Schneider - 4.2.0-0.1.rc2 +- Update to Samba 4.2.0rc2. + +* Tue Oct 07 2014 Andreas Schneider - 4.1.12-5 +- resolves: #1033595 - Fix segfault in winbind. + +* Wed Sep 24 2014 Andreas Schneider - 4.1.12-1 +- Update to Samba 4.1.12. + +* Tue Sep 09 2014 Jitka Plesnikova - 2:4.1.11-1.4 +- Perl 5.20 mass + +* Wed Aug 27 2014 Jitka Plesnikova - 2:4.1.11-1.3 +- Perl 5.20 rebuild + +* Wed Aug 20 2014 Kalev Lember - 2:4.1.11-1.2 +- Rebuilt for rpm dependency generator failure (#1131892) + +* Mon Aug 18 2014 Fedora Release Engineering - 0:4.1.11-1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild + +* Fri Aug 1 2014 Jared Smith - 4.1.11-1 +- Update to upstream Samba 4.1.11 release +- resolves: #1126015 - Fix CVE-2014-3560 + +* Mon Jun 23 2014 Guenther Deschner - 4.1.9-3 +- Update to Samba 4.1.9. +- resolves: #1112251 - Fix CVE-2014-0244 and CVE-2014-3493. + +* Wed Jun 11 2014 Guenther Deschner - 4.1.8-3 +- Update to Samba 4.1.8. +- resolves: #1102528 - CVE-2014-0178. + +* Sun Jun 08 2014 Fedora Release Engineering - 2:4.1.6-3.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild + +* Thu Apr 03 2014 Andreas Schneider - 4.1.6-3 +- Add systemd integration to the service daemons. + +* Tue Mar 18 2014 Andreas Schneider - 4.1.6-2 +- Created a samba-test-libs package. + +* Tue Mar 11 2014 Andreas Schneider - 4.1.6-1 +- Fix CVE-2013-4496 and CVE-2013-6442. +- Fix installation of pidl. + +* Fri Feb 21 2014 Andreas Schneider - 4.1.5-1 +- Update to Samba 4.1.5. + +* Fri Feb 07 2014 Andreas Schneider - 4.1.4-1 +- Update to Samba 4.1.4. + +* Wed Jan 08 2014 Andreas Schneider - 4.1.3-3 +- resolves: #1042845 - Do not build with libbsd. + +* Tue Dec 10 2013 Guenther Deschner - 4.1.3-2 +- resolves: #1019469 - Fix winbind debug message NULL pointer derreference. + +* Mon Dec 09 2013 Andreas Schneider - 4.1.3-1 +- Update to Samba 4.1.3. +- resolves: #1039454 - CVE-2013-4408. +- resolves: #1039500 - CVE-2012-6150. + +* Mon Nov 25 2013 Andreas Schneider - 4.1.2-1 +- Update to Samba 4.1.2. + +* Mon Nov 18 2013 Guenther Deschner - 4.1.1-3 +- resolves: #948509 - Fix manpage correctness. + +* Fri Nov 15 2013 Andreas Schneider - 4.1.1-2 +- related: #884169 - Fix strict aliasing warnings. + +* Mon Nov 11 2013 Andreas Schneider - 4.1.1-1 +- resolves: #1024544 - Fix CVE-2013-4475. +- Update to Samba 4.1.1. + +* Mon Nov 11 2013 Andreas Schneider - 4.1.0-5 +- related: #884169 - Fix the upgrade path. + +* Wed Oct 30 2013 Andreas Schneider - 4.1.0-4 +- related: #884169 - Add direct dependency to samba-libs in the + glusterfs package. +- resolves: #996567 - Fix userPrincipalName composition. +- related: #884169 - Fix memset call with zero length in in ntdb. + +* Fri Oct 18 2013 Andreas Schneider - 4.1.0-3 +- resolves: #1020329 - Build glusterfs VFS plguin. + +* Tue Oct 15 2013 Andreas Schneider - 4.1.0-2 +- resolves: #1018856 - Fix installation of pam_winbind after upgrade. +- related: #1010722 - Split out a samba-winbind-modules package. +- related: #985609 + +* Fri Oct 11 2013 Andreas Schneider - 4.1.0-1 +- related: #985609 - Update to Samba 4.1.0. + +* Tue Oct 01 2013 Andreas Schneider - 2:4.1.0-0.8 +- related: #985609 - Update to Samba 4.1.0rc4. +- resolves: #1010722 - Split out a samba-winbind-modules package. + +* Wed Sep 11 2013 Andreas Schneider - 2:4.1.0-0.7 +- related: #985609 - Update to Samba 4.1.0rc3. +- resolves: #1005422 - Add support for KEYRING ccache type in pam_winbindd. + +* Wed Sep 04 2013 Andreas Schneider - 2:4.1.0-0.6 +- resolves: #717484 - Enable profiling data support. + +* Thu Aug 22 2013 Guenther Deschner - 2:4.1.0-0.5 +- resolves: #996160 - Fix winbind with trusted domains. + +* Wed Aug 14 2013 Andreas Schneider 2:4.1.0-0.4 +- resolves: #996160 - Fix winbind nbt name lookup segfault. + +* Mon Aug 12 2013 Andreas Schneider - 2:4.1.0-0.3 +- related: #985609 - Update to Samba 4.1.0rc2. + +* Sat Aug 03 2013 Petr Pisar - 2:4.1.0-0.2.rc1.1 +- Perl 5.18 rebuild + +* Wed Jul 24 2013 Andreas Schneider - 2:4.1.0-0.2 +- resolves: #985985 - Fix file conflict between samba and wine. +- resolves: #985107 - Add support for new default location for Kerberos + credential caches. + +* Sat Jul 20 2013 Petr Pisar - 2:4.1.0-0.1.rc1.1 +- Perl 5.18 rebuild + +* Wed Jul 17 2013 Andreas Schneider - 2:4.1.0-0.1 +- Update to Samba 4.1.0rc1. + +* Mon Jul 15 2013 Andreas Schneider - 2:4.0.7-2 +- resolves: #972692 - Build with PIE and full RELRO. +- resolves: #884169 - Add explicit dependencies suggested by rpmdiff. +- resolves: #981033 - Local user's krb5cc deleted by winbind. +- resolves: #984331 - Fix samba-common tmpfiles configuration file in wrong + directory. + +* Wed Jul 03 2013 Andreas Schneider - 2:4.0.7-1 +- Update to Samba 4.0.7. + +* Fri Jun 07 2013 Andreas Schneider - 2:4.0.6-3 +- Add UPN enumeration to passdb internal API (bso #9779). + +* Wed May 22 2013 Andreas Schneider - 2:4.0.6-2 +- resolves: #966130 - Fix build with MIT Kerberos. +- List vfs modules in spec file. + +* Tue May 21 2013 Andreas Schneider - 2:4.0.6-1 +- Update to Samba 4.0.6. +- Remove SWAT. + +* Wed Apr 10 2013 Andreas Schneider - 2:4.0.5-1 +- Update to Samba 4.0.5. +- Add UPN enumeration to passdb internal API (bso #9779). +- resolves: #928947 - samba-doc is obsolete now. +- resolves: #948606 - LogRotate should be optional, and not a hard "Requires". + +* Fri Mar 22 2013 Andreas Schneider - 2:4.0.4-3 +- resolves: #919405 - Fix and improve large_readx handling for broken clients. +- resolves: #924525 - Don't use waf caching. + +* Wed Mar 20 2013 Andreas Schneider - 2:4.0.4-2 +- resolves: #923765 - Improve packaging of README files. + +* Wed Mar 20 2013 Andreas Schneider - 2:4.0.4-1 +- Update to Samba 4.0.4. + +* Mon Mar 11 2013 Andreas Schneider - 2:4.0.3-4 +- resolves: #919333 - Create /run/samba too. + +* Mon Mar 04 2013 Andreas Schneider - 2:4.0.3-3 +- Fix the cache dir to be /var/lib/samba to support upgrades. + +* Thu Feb 14 2013 Andreas Schneider - 2:4.0.3-2 +- resolves: #907915 - libreplace.so => not found + +* Thu Feb 07 2013 Andreas Schneider - 2:4.0.3-1 +- Update to Samba 4.0.3. +- resolves: #907544 - Add unowned directory /usr/lib64/samba. +- resolves: #906517 - Fix pidl code generation with gcc 4.8. +- resolves: #908353 - Fix passdb backend ldapsam as module. + +* Wed Jan 30 2013 Andreas Schneider - 2:4.0.2-1 +- Update to Samba 4.0.2. +- Fixes CVE-2013-0213. +- Fixes CVE-2013-0214. +- resolves: #906002 +- resolves: #905700 +- resolves: #905704 +- Fix conn->share_access which is reset between user switches. +- resolves: #903806 +- Add missing example and make sure we don't introduce perl dependencies. +- resolves: #639470 + +* Wed Jan 16 2013 Andreas Schneider - 2:4.0.1-1 +- Update to Samba 4.0.1. +- Fixes CVE-2013-0172. + +* Mon Dec 17 2012 Andreas Schneider - 2:4.0.0-174 +- Fix typo in winbind-krb-locator post uninstall script. + +* Tue Dec 11 2012 Andreas Schneider - 2:4.0.0-173 +- Update to Samba 4.0.0. + +* Thu Dec 06 2012 Andreas Schneider - 2:4.0.0-171.rc6 +- Fix typo in winbind-krb-locator post uninstall script. + +* Tue Dec 04 2012 Andreas Schneider - 2:4.0.0-170.rc6 +- Update to Samba 4.0.0rc6. +- Add /etc/pam.d/samba for swat to work correctly. +- resolves #882700 + +* Fri Nov 23 2012 Guenther Deschner - 2:4.0.0-169.rc5 +- Make sure ncacn_ip_tcp client code looks for NBT_NAME_SERVER name types. + +* Thu Nov 15 2012 Andreas Schneider - 2:4.0.0-168.rc5 +- Reduce dependencies of samba-devel and create samba-test-devel package. + +* Tue Nov 13 2012 Andreas Schneider - 2:4.0.0-167.rc5 +- Use workaround for winbind default domain only when set. +- Build with old ctdb support. + +* Tue Nov 13 2012 Andreas Schneider - 2:4.0.0-166.rc5 +- Update to Samba 4.0.0rc5. + +* Mon Nov 05 2012 Andreas Schneider - 2:4.0.0-165.rc4 +- Fix library dependencies of libnetapi. + +* Mon Nov 05 2012 Andreas Schneider - 2:4.0.0-164.rc4 +- resolves: #872818 - Fix perl dependencies. + +* Tue Oct 30 2012 Andreas Schneider - 2:4.0.0-163.rc4 +- Update to Samba 4.0.0rc4. + +* Mon Oct 29 2012 Andreas Schneider - 2:4.0.0-162.rc3 +- resolves: #870630 - Fix scriptlets interpeting a comment as argument. + +* Fri Oct 26 2012 Andreas Schneider - 2:4.0.0-161.rc3 +- Add missing Requries for python modules. +- Add NetworkManager dispatcher script for winbind. + +* Fri Oct 19 2012 Andreas Schneider - 2:4.0.0-160.rc3 +- resolves: #867893 - Move /var/log/samba to samba-common package for + winbind which requires it. + +* Thu Oct 18 2012 Andreas Schneider - 2:4.0.0-159.rc3 +- Compile default auth methods into smbd. + +* Tue Oct 16 2012 Andreas Schneider - 2:4.0.0-158.rc3 +- Move pam_winbind.conf and the manpages to the right package. + +* Tue Oct 16 2012 Andreas Schneider - 2:4.0.0-157.rc3 +* resolves: #866959 - Build auth_builtin as static module. + +* Tue Oct 16 2012 Andreas Schneider - 2:4.0.0-156.rc3 +- Update systemd Requires to reflect latest packaging guidelines. + +* Tue Oct 16 2012 Andreas Schneider - 2:4.0.0-155.rc3 +- Add back the AES patches which didn't make it in rc3. + +* Tue Oct 16 2012 Andreas Schneider - 2:4.0.0-154.rc3 +- Update to 4.0.0rc3. +- resolves: #805562 - Unable to share print queues. +- resolves: #863388 - Unable to reload smbd configuration with systemctl. + +* Wed Oct 10 2012 Alexander Bokovoy - 2:4.0.0-153.rc2 +- Use alternatives to configure winbind_krb5_locator.so +- Fix Requires for winbind. + +* Thu Oct 04 2012 Andreas Schneider - 2:4.0.0-152.rc2 +- Add kerberos AES support. +- Fix printing initialization. + +* Tue Oct 02 2012 Andreas Schneider - 2:4.0.0-151.rc2 +- Update to 4.0.0rc2. + +* Wed Sep 26 2012 Andreas Schneider - 2:4.0.0-150.rc1 +- Fix Obsoletes/Provides for update from samba4. +- Bump release number to be bigger than samba4. + +* Wed Sep 26 2012 Andreas Schneider - 2:4.0.0-96.rc1 +- Package smbprint again. + +* Wed Sep 26 2012 Andreas Schneider - 2:4.0.0-95.rc1 +- Update to 4.0.0rc1. + +* Mon Aug 20 2012 Guenther Deschner - 2:3.6.7-94.2 +- Update to 3.6.7 + +* Sat Jul 21 2012 Fedora Release Engineering - 2:3.6.6-93.2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild + +* Thu Jul 19 2012 Guenther Deschner - 2:3.6.6-93 +- Fix printing tdb upgrade for 3.6.6 +- resolves: #841609 + +* Sun Jul 15 2012 Ville Skyttä - 2:3.6.6-92 +- Call ldconfig at libwbclient and -winbind-clients post(un)install time. +- Fix empty localization files, use %%find_lang to find and %%lang-mark them. +- Escape macros in %%changelog. +- Fix source tarball URL. + +* Tue Jun 26 2012 Guenther Deschner - 2:3.6.6-91 +- Update to 3.6.6 + +* Thu Jun 21 2012 Andreas Schneider - 2:3.6.5-90 +- Fix ldonfig. +- Require systemd for samba-common package. +- resolves: #829197 + +* Mon Jun 18 2012 Andreas Schneider - 2:3.6.5-89 +- Fix usrmove paths. +- resolves: #829197 + +* Tue May 15 2012 Andreas Schneider - 2:3.6.5-88 +- Move tmpfiles.d config to common package as it is needed for smbd and + winbind. +- Make sure tmpfiles get created after installation. + +* Wed May 09 2012 Guenther Deschner - 2:3.6.5-87 +- Correctly use system iniparser library + +* Fri May 04 2012 Andreas Schneider - 2:3.6.5-86 +- Bump Epoch to fix a problem with a Samba4 update in testing. + +* Mon Apr 30 2012 Guenther Deschner - 1:3.6.5-85 +- Security Release, fixes CVE-2012-2111 +- resolves: #817551 + +* Mon Apr 23 2012 Andreas Schneider - 1:3.6.4-84 +- Fix creation of /var/run/samba. +- resolves: #751625 + +* Fri Apr 20 2012 Guenther Deschner - 1:3.6.4-83 +- Avoid private krb5_locate_kdc usage +- resolves: #754783 + +* Thu Apr 12 2012 Jon Ciesla - 1:3.6.4-82 +- Update to 3.6.4 +- Fixes CVE-2012-1182 + +* Mon Mar 19 2012 Andreas Schneider - 1:3.6.3-81 +- Fix provides for of libwclient-devel for samba-winbind-devel. + +* Thu Feb 23 2012 Andreas Schneider - 1:3.6.3-80 +- Add commented out 'max protocol' to the default config. + +* Mon Feb 13 2012 Andreas Schneider - 1:3.6.3-79 +- Create a libwbclient package. +- Replace winbind-devel with libwbclient-devel package. + +* Mon Jan 30 2012 Andreas Schneider - 1:3.6.3-78 +- Update to 3.6.3 +- Fixes CVE-2012-0817 + +* Sat Jan 14 2012 Fedora Release Engineering - 1:3.6.1-77.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild + +* Mon Dec 05 2011 Andreas Schneider - 1:3.6.1-77 +- Fix winbind cache upgrade. +- resolves: #760137 + +* Fri Nov 18 2011 Andreas Schneider - 1:3.6.1-76 +- Fix piddir to match with systemd files. +- Fix crash bug in the debug system. +- resolves: #754525 + +* Fri Nov 04 2011 Andreas Schneider - 1:3.6.1-75 +- Fix systemd dependencies +- resolves: #751397 + +* Wed Oct 26 2011 Andreas Schneider - 1:3.6.1-74 +- Update to 3.6.1 + +* Tue Oct 04 2011 Guenther Deschner - 1:3.6.0-73 +- Fix nmbd startup +- resolves: #741630 + +* Tue Sep 20 2011 Tom Callaway - 1:3.6.0-72 +- convert to systemd +- restore epoch from f15 + +* Sat Aug 13 2011 Guenther Deschner - 3.6.0-71 +- Update to 3.6.0 final + +* Sun Jul 31 2011 Guenther Deschner - 3.6.0rc3-70 +- Update to 3.6.0rc3 + +* Tue Jun 07 2011 Guenther Deschner - 3.6.0rc2-69 +- Update to 3.6.0rc2 + +* Tue May 17 2011 Guenther Deschner - 3.6.0rc1-68 +- Update to 3.6.0rc1 + +* Wed Apr 27 2011 Guenther Deschner - 3.6.0pre3-67 +- Update to 3.6.0pre3 + +* Wed Apr 13 2011 Guenther Deschner - 3.6.0pre2-66 +- Update to 3.6.0pre2 + +* Fri Mar 11 2011 Guenther Deschner - 3.6.0pre1-65 +- Enable quota support + +* Wed Feb 09 2011 Fedora Release Engineering - 0:3.6.0-64pre1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild + +* Wed Nov 24 2010 Guenther Deschner - 3.6.0pre1-64 +- Add %%ghost entry for /var/run using tmpfs +- resolves: #656685 + +* Thu Aug 26 2010 Guenther Deschner - 3.6.0pre1-63 +- Put winbind krb5 locator plugin into a separate rpm +- resolves: #627181 + +* Tue Aug 03 2010 Guenther Deschner - 3.6.0pre1-62 +- Update to 3.6.0pre1 + +* Wed Jun 23 2010 Guenther Deschner - 3.5.4-61 +- Update to 3.5.4 + +* Wed May 19 2010 Guenther Deschner - 3.5.3-60 +- Update to 3.5.3 +- Make sure nmb and smb initscripts return LSB compliant return codes +- Fix winbind over ipv6 + +* Wed Apr 07 2010 Guenther Deschner - 3.5.2-59 +- Update to 3.5.2 + +* Mon Mar 08 2010 Simo Sorce - 3.5.1-58 +- Security update to 3.5.1 +- Fixes CVE-2010-0728 + +* Mon Mar 08 2010 Guenther Deschner - 3.5.0-57 +- Remove cifs.upcall and mount.cifs entirely + +* Mon Mar 01 2010 Guenther Deschner - 3.5.0-56 +- Update to 3.5.0 + +* Fri Feb 19 2010 Guenther Deschner - 3.5.0rc3-55 +- Update to 3.5.0rc3 + +* Tue Jan 26 2010 Guenther Deschner - 3.5.0rc2-54 +- Update to 3.5.0rc2 + +* Fri Jan 15 2010 Jeff Layton - 3.5.0rc1-53 +- separate out CIFS tools into cifs-utils package + +* Fri Jan 08 2010 Guenther Deschner - 3.5.0rc1-52 +- Update to 3.5.0rc1 + +* Tue Dec 15 2009 Guenther Deschner - 3.5.0pre2-51 +- Update to 3.5.0pre2 +- Remove umount.cifs + +* Wed Nov 25 2009 Guenther Deschner - 3.4.3-49 +- Various updates to inline documentation in default smb.conf file +- resolves: #483703 + +* Thu Oct 29 2009 Guenther Deschner - 3.4.3-48 +- Update to 3.4.3 + +* Fri Oct 09 2009 Simo Sorce - 3.4.2-47 +- Spec file cleanup +- Fix sources upstream location +- Remove conditionals to build talloc and tdb, now they are completely indepent + packages in Fedora +- Add defattr() where missing +- Turn all tabs into 4 spaces +- Remove unused migration script +- Split winbind-clients out of main winbind package to avoid multilib to include + huge packages for no good reason + +* Thu Oct 01 2009 Guenther Deschner - 3.4.2-0.46 +- Update to 3.4.2 +- Security Release, fixes CVE-2009-2813, CVE-2009-2948 and CVE-2009-2906 + +* Wed Sep 16 2009 Tomas Mraz - 3.4.1-0.45 +- Use password-auth common PAM configuration instead of system-auth + +* Wed Sep 09 2009 Guenther Deschner - 3.4.1-0.44 +- Update to 3.4.1 + +* Thu Aug 20 2009 Guenther Deschner - 3.4.0-0.43 +- Fix cli_read() +- resolves: #516165 + +* Thu Aug 06 2009 Guenther Deschner - 3.4.0-0.42 +- Fix required talloc version number +- resolves: #516086 + +* Sun Jul 26 2009 Fedora Release Engineering - 0:3.4.0-0.41.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild + +* Fri Jul 17 2009 Guenther Deschner - 3.4.0-0.41 +- Fix Bug #6551 (vuid and tid not set in sessionsetupX and tconX) +- Specify required talloc and tdb version for BuildRequires + +* Fri Jul 03 2009 Guenther Deschner - 3.4.0-0.40 +- Update to 3.4.0 + +* Fri Jun 19 2009 Guenther Deschner - 3.4.0rc1-0.39 +- Update to 3.4.0rc1 + +* Mon Jun 08 2009 Guenther Deschner - 3.4.0pre2-0.38 +- Update to 3.4.0pre2 + +* Thu Apr 30 2009 Guenther Deschner - 3.4.0pre1-0.37 +- Update to 3.4.0pre1 + +* Wed Apr 29 2009 Guenther Deschner - 3.3.4-0.36 +- Update to 3.3.4 + +* Mon Apr 20 2009 Guenther Deschner - 3.3.3-0.35 +- Enable build of idmap_tdb2 for clustered setups + +* Wed Apr 1 2009 Guenther Deschner - 3.3.3-0.34 +- Update to 3.3.3 + +* Thu Mar 26 2009 Simo Sorce - 3.3.2-0.33 +- Fix nmbd init script nmbd reload was causing smbd not nmbd to reload the + configuration +- Fix upstream bug 6224, nmbd was waiting 5+ minutes before running elections on + startup, causing your own machine not to show up in the network for 5 minutes + if it was the only client in that workgroup (fix committed upstream) + +* Thu Mar 12 2009 Guenther Deschner - 3.3.2-0.31 +- Update to 3.3.2 +- resolves: #489547 + +* Thu Mar 5 2009 Guenther Deschner - 3.3.1-0.30 +- Add libcap-devel to requires list (resolves: #488559) + +* Tue Mar 3 2009 Simo Sorce - 3.3.1-0.29 +- Make the talloc and ldb packages optionsl and disable their build within + the samba3 package, they are now built as part of the samba4 package + until they will both be released as independent packages. + +* Wed Feb 25 2009 Guenther Deschner - 3.3.1-0.28 +- Enable cluster support + +* Tue Feb 24 2009 Guenther Deschner - 3.3.1-0.27 +- Update to 3.3.1 + +* Sat Feb 21 2009 Simo Sorce - 3.3.0-0.26 +- Rename ldb* tools to ldb3* to avoid conflicts with newer ldb releases + +* Tue Feb 3 2009 Guenther Deschner - 3.3.0-0.25 +- Update to 3.3.0 final +- Add upstream fix for ldap connections to AD (Bug #6073) +- Remove bogus perl dependencies (resolves: #473051) + +* Fri Nov 28 2008 Guenther Deschner - 3.3.0-0rc1.24 +- Update to 3.3.0rc1 + +* Thu Nov 27 2008 Simo Sorce - 3.2.5-0.23 +- Security Release, fixes CVE-2008-4314 + +* Thu Sep 18 2008 Guenther Deschner - 3.2.4-0.22 +- Update to 3.2.4 +- resolves: #456889 +- move cifs.upcall to /usr/sbin + +* Wed Aug 27 2008 Guenther Deschner - 3.2.3-0.21 +- Security fix for CVE-2008-3789 + +* Mon Aug 25 2008 Guenther Deschner - 3.2.2-0.20 +- Update to 3.2.2 + +* Mon Aug 11 2008 Simo Sorce - 3.2.1-0.19 +- Add fix for CUPS problem, fixes bug #453951 + +* Wed Aug 6 2008 Simo Sorce - 3.2.1-0.18 +- Update to 3.2.1 + +* Tue Jul 1 2008 Guenther Deschner - 3.2.0-2.17 +- Update to 3.2.0 final +- resolves: #452622 + +* Tue Jun 10 2008 Guenther Deschner - 3.2.0-1.rc2.16 +- Update to 3.2.0rc2 +- resolves: #449522 +- resolves: #448107 + +* Fri May 30 2008 Guenther Deschner - 3.2.0-1.rc1.15 +- Fix security=server +- resolves: #449038, #449039 + +* Wed May 28 2008 Guenther Deschner - 3.2.0-1.rc1.14 +- Add fix for CVE-2008-1105 +- resolves: #446724 + +* Fri May 23 2008 Guenther Deschner - 3.2.0-1.rc1.13 +- Update to 3.2.0rc1 + +* Wed May 21 2008 Simo Sorce - 3.2.0-1.pre3.12 +- make it possible to print against Vista and XP SP3 as servers +- resolves: #439154 + +* Thu May 15 2008 Guenther Deschner - 3.2.0-1.pre3.11 +- Add "net ads join createcomputer=ou1/ou2/ou3" fix (BZO #5465) + +* Fri May 09 2008 Guenther Deschner - 3.2.0-1.pre3.10 +- Add smbclient fix (BZO #5452) + +* Fri Apr 25 2008 Guenther Deschner - 3.2.0-1.pre3.9 +- Update to 3.2.0pre3 + +* Tue Mar 18 2008 Guenther Deschner - 3.2.0-1.pre2.8 +- Add fixes for libsmbclient and support for r/o relocations + +* Mon Mar 10 2008 Guenther Deschner - 3.2.0-1.pre2.7 +- Fix libnetconf, libnetapi and msrpc DSSETUP call + +* Thu Mar 06 2008 Guenther Deschner - 3.2.0-1.pre2.6 +- Create separate packages for samba-winbind and samba-winbind-devel +- Add cifs.spnego helper + +* Wed Mar 05 2008 Guenther Deschner - 3.2.0-1.pre2.3 +- Update to 3.2.0pre2 +- Add talloc and tdb lib and devel packages +- Add domainjoin-gui package + +* Fri Feb 22 2008 Simo Sorce - 3.2.0-0.pre1.3 +- Try to fix GCC 4.3 build +- Add --with-dnsupdate flag and also make sure other flags are required just to + be sure the features are included without relying on autodetection to be + successful + +* Tue Feb 19 2008 Fedora Release Engineering - 0:3.2.0-1.pre1.2 +- Autorebuild for GCC 4.3 + +* Tue Dec 04 2007 Release Engineering - 3.2.0-0.pre1.2 +- Rebuild for openldap bump + +* Thu Oct 18 2007 Guenther Deschner 3.2.0-0.pre1.1.fc9 +- 32/64bit padding fix (affects multilib installations) + +* Mon Oct 8 2007 Simo Sorce 3.2.0-0.pre1.fc9 +- New major relase, minor switched from 0 to 2 +- License change, the code is now GPLv3+ +- Numerous improvements and bugfixes included +- package libsmbsharemodes too +- remove smbldap-tools as they are already packaged separately in Fedora +- Fix bug 245506 + +* Tue Oct 2 2007 Simo Sorce 3.0.26a-1.fc8 +- rebuild with AD DNS Update support + +* Tue Sep 11 2007 Simo Sorce 3.0.26a-0.fc8 +- upgrade to the latest upstream realease +- includes security fixes released today in 3.0.26 + +* Fri Aug 24 2007 Simo Sorce 3.0.25c-4.fc8 +- add fix reported upstream for heavy idmap_ldap memleak + +* Tue Aug 21 2007 Simo Sorce 3.0.25c-3.fc8 +- fix a few places were "open" is used an interfere with the new glibc + +* Tue Aug 21 2007 Simo Sorce 3.0.25c-2.fc8 +- remove old source +- add patch to fix samba bugzilla 4772 + +* Tue Aug 21 2007 Guenther Deschner 3.0.25c-0.fc8 +- update to 3.0.25c + +* Fri Jun 29 2007 Simo Sorce 3.0.25b-3.fc8 +- handle cases defined in #243766 + +* Tue Jun 26 2007 Simo Sorce 3.0.25b-2.fc8 +- update to 3.0.25b +- better error codes for init scripts: #244823 + +* Tue May 29 2007 Günther Deschner +- fix pam_smbpass patch. + +* Fri May 25 2007 Simo Sorce +- update to 3.0.25a as it contains many fixes +- add a fix for pam_smbpass made by Günther but committed upstream after 3.0.25a was cut. + +* Mon May 14 2007 Simo Sorce +- final 3.0.25 +- includes security fixes for CVE-2007-2444,CVE-2007-2446,CVE-2007-2447 + +* Mon Apr 30 2007 Günther Deschner +- move to 3.0.25rc3 + +* Thu Apr 19 2007 Simo Sorce +- fixes in the spec file +- moved to 3.0.25rc1 +- addedd patches (merged upstream so they will be removed in 3.0.25rc2) + +* Wed Apr 4 2007 Simo Sorce 3.0.24-12.fc7 +- fixes in smb.conf +- advice in smb.conf to put scripts in /var/lib/samba/scripts +- create /var/lib/samba/scripts so that selinux can be happy +- fix Vista problems with msdfs errors + +* Tue Apr 03 2007 Guenther Deschner 3.0.24-11.fc7 +- enable PAM and NSS dlopen checks during build +- fix unresolved symbols in libnss_wins.so (bug #198230) + +* Fri Mar 30 2007 Simo Sorce 3.0.24-10.fc7 +- set passdb backend = tdbsam as default in smb.conf +- remove samba-docs dependency from swat, that was a mistake +- put back COPYING and other files in samba-common +- put examples in samba not in samba-docs +- leave only stuff under docs/ in samba-doc + +* Thu Mar 29 2007 Simo Sorce 3.0.24-9.fc7 +- integrate most of merge review proposed changes (bug #226387) +- remove libsmbclient-devel-static and simply stop shipping the + static version of smbclient as it seem this is deprecated and + actively discouraged + +* Wed Mar 28 2007 Simo Sorce 3.0.24-8.fc7 +- fix for bug #176649 + +* Mon Mar 26 2007 Simo Sorce +- remove patch for bug 106483 as it introduces a new bug that prevents + the use of a credentials file with the smbclient tar command +- move the samba private dir from being the same as the config dir + (/etc/samba) to /var/lib/samba/private + +* Mon Mar 26 2007 Simo Sorce 3.0.24-7.fc7 +- make winbindd start earlier in the init process, at the same time + ypbind is usually started as well +- add a sepoarate init script for nmbd called nmb, we need to be able + to restart nmbd without dropping al smbd connections unnecessarily + +* Fri Mar 23 2007 Simo Sorce +- add samba.schema to /etc/openldap/schema + +* Thu Mar 22 2007 Florian La Roche +- adjust the Requires: for the scripts, add "chkconfig --add smb" + +* Tue Mar 20 2007 Simo Sorce 3.0.24-6.fc7 +- do not put comments inline on smb.conf options, they may be read + as part of the value (for example log files names) + +* Mon Mar 19 2007 Simo Sorce 3.0.24-5.fc7 +- actually use the correct samba.pamd file not the old samba.pamd.stack file +- fix logifles and use upstream convention of log.* instead of our old *.log + Winbindd creates its own log.* files anyway so we will be more consistent +- install our own (enhanced) default smb.conf file +- Fix pam_winbind acct_mgmt PAM result code (prevented local users from + logging in). Fixed by Guenther. +- move some files from samba to samba-common as they are used with winbindd + as well + +* Fri Mar 16 2007 Guenther Deschner 3.0.24-4.fc7 +- fix arch macro which reported Vista to Samba clients. + +* Thu Mar 15 2007 Simo Sorce 3.0.24-3.fc7 +- Directories reorg, tdb files must go to /var/lib, not + to /var/cache, add migration script in %%post common +- Split out libsmbclient, devel and doc packages +- Remove libmsrpc.[h|so] for now as they are not really usable +- Remove kill -HUP from rotate, samba use -HUP for other things + noit to reopen logs + +* Tue Feb 20 2007 Simo Sorce 3.0.24-2.fc7 +- New upstream release +- Fix packaging issue wrt idmap modules used only by smbd +- Addedd Vista Patchset for compatibility with Windows Vista +- Change default of "msdfs root", it seem to cause problems with + some applications and it has been proposed to change it for + 3.0.25 upstream + +* Fri Sep 1 2006 Jay Fenlason 3.0.23c-2 +- New upstream release. + +* Tue Aug 8 2006 Jay Fenlason 3.0.23b-2 +- New upstream release. + +* Mon Jul 24 2006 Jay Fenlason 3.0.23a-3 +- Fix the -logfiles patch to close + bz#199607 Samba compiled with wrong log path. + bz#199206 smb.conf has incorrect log file path + +* Mon Jul 24 2006 Jay Fenlason 3.0.23a-2 +- Upgrade to new upstream 3.0.23a +- include upstream samr_alias patch + +* Tue Jul 11 2006 Jay Fenlason 3.0.23-2 +- New upstream release. +- Use modified filter-requires-samba.sh from packaging/RHEL/setup/ + to get rid of bogus dependency on perl(Unicode::MapUTF8) +- Update the -logfiles and -smb.conf patches to work with 3.0.23 + +* Thu Jul 6 2006 Jay Fenlason 3.0.23-0.RC3 +- New upstream RC release. +- Update the -logfiles, and -passwd patches for + 3.0.23rc3 +- Include the change to smb.init from Bastien Nocera ) + to close + bz#182560 Wrong retval for initscript when smbd is dead +- Update this spec file to build with 3.0.23rc3 +- Remove the -install.mount.smbfs patch, since we don't install + mount.smbfs any more. + +* Wed Jun 14 2006 Tomas Mraz - 2.0.21c-3 +- rebuilt with new gnutls + +* Fri Mar 17 2006 Jay Fenlason 2.0.21c-2 +- New upstream version. + +* Mon Feb 13 2006 Jay Fenlason 3.0.21b-2 +- New upstream version. +- Since the rawhide kernel has dropped support for smbfs, remove smbmount + and smbumount. Users should use mount.cifs instead. +- Upgrade to 3.0.21b + +* Fri Feb 10 2006 Jesse Keating - 0:3.0.20b-2.1.1 +- bump again for double-long bug on ppc(64) + +* Fri Dec 09 2005 Jesse Keating +- rebuilt + +* Sun Nov 13 2005 Jay Fenlason 3.0.20b-2 +- turn on -DLDAP_DEPRECATED to allow access to ldap functions that have + been depricated in 2.3.11, but which don't have well-documented + replacements (ldap_simple_bind_s(), for example). +- Upgrade to 3.0.20b, which includes all the previous upstream patches. +- Updated the -warnings patch for 3.0.20a. +- Include --with-shared-modules=idmap_ad,idmap_rid to close + bz#156810 --with-shared-modules=idmap_ad,idmap_rid +- Include the new samba.pamd from Tomas Mraz (tmraz@redhat.com) to close + bz#170259 pam_stack is deprecated + +* Sun Nov 13 2005 Warren Togami 3.0.20-3 +- epochs from deps, req exact release +- rebuild against new openssl + +* Mon Aug 22 2005 Jay Fenlason 3.0.20-2 +- New upstream release + Includes five upstream patches -bug3010_v1, -groupname_enumeration_v3, + -regcreatekey_winxp_v1, -usrmgr_groups_v1, and -winbindd_v1 + This obsoletes the -pie and -delim patches + the -warning and -gcc4 patches are obsolete too + The -man, -passwd, and -smbspool patches were updated to match 3.0.20pre1 + Also, the -quoting patch was implemented differently upstream + There is now a umount.cifs executable and manpage + We run autogen.sh as part of the build phase + The testprns command is now gone + libsmbclient now has a man page +- Include -bug106483 patch to close + bz#106483 smbclient: -N negates the provided password, despite documentation +- Added the -warnings patch to quiet some compiler warnings. +- Removed many obsolete patches from CVS. + +* Mon May 2 2005 Jay Fenlason 3.0.14a-2 +- New upstream release. +- the -64bit-timestamps, -clitar, -establish_trust, user_rights_v1, + winbind_find_dc_v2 patches are now obsolete. + +* Thu Apr 7 2005 Jay Fenlason 3.0.13-2 +- New upstream release +- add my -quoting patch, to fix swat with strings that contain + html meta-characters, and to use correct quote characters in + lists, closing bz#134310 +- include the upstream winbindd_2k3sp1 patch +- include the -smbclient patch. +- include the -hang patch from upstream. + +* Thu Mar 24 2005 Florian La Roche +- add a "exit 0" to the postun of the main samba package + +* Wed Mar 2 2005 Tomas Mraz 3.0.11-5 +- rebuild with openssl-0.9.7e + +* Thu Feb 24 2005 Jay Fenlason 3.0.11-4 +- Use the updated filter-requires-samba.sh file, so we don't accidentally + pick up a dependency on perl(Crypt::SmbHash) + +* Fri Feb 18 2005 Jay Fenlason 3.0.11-3 +- add -gcc4 patch to compile with gcc 4. +- remove the now obsolete -smbclient-kerberos.patch +- Include four upstream patches from + http://samba.org/~jerry/patches/post-3.0.11/ + (Slightly modified the winbind_find_dc_v2 patch to apply easily with + rpmbuild). + +* Fri Feb 4 2005 Jay Fenlason 3.0.11-2 +- include -smbspool patch to close bz#104136 + +* Wed Jan 12 2005 Jay Fenlason 3.0.10-4 +- Update the -man patch to fix ntlm_auth.1 too. +- Move pam_smbpass.so to the -common package, so both the 32 + and 64-bit versions will be installed on multiarch platforms. + This closes bz#143617 +- Added new -delim patch to fix mount.cifs so it can accept + passwords with commas in them (via environment or credentials + file) to close bz#144198 + +* Wed Jan 12 2005 Tim Waugh 3.0.10-3 +- Rebuilt for new readline. + +* Fri Dec 17 2004 Jay Fenlason 3.0.10-2 +- New upstream release that closes CAN-2004-1154 bz#142544 +- Include the -64bit patch from Nalin. This closes bz#142873 +- Update the -logfiles patch to work with 3.0.10 +- Create /var/run/winbindd and make it part of the -common rpm to close + bz#142242 + +* Mon Nov 22 2004 Jay Fenlason 3.0.9-2 +- New upstream release. This obsoletes the -secret patch. + Include my changetrustpw patch to make "net ads changetrustpw" stop + aborting. This closes #134694 +- Remove obsolete triggers for ancient samba versions. +- Move /var/log/samba to the -common rpm. This closes #76628 +- Remove the hack needed to get around the bad docs files in the + 3.0.8 tarball. +- Change the comment in winbind.init to point at the correct pidfile. + This closes #76641 + +* Mon Nov 22 2004 Than Ngo 3.0.8-4 +- fix unresolved symbols in libsmbclient which caused applications + such as KDE's konqueror to fail when accessing smb:// URLs. #139894 + +* Thu Nov 11 2004 Jay Fenlason 3.0.8-3.1 +- Rescue the install.mount.smbfs patch from Juanjo Villaplana + (villapla@si.uji.es) to prevent building the srpm from trashing your + installed /usr/bin/smbmount + +* Tue Nov 9 2004 Jay Fenlason 3.0.8-3 +- Include the corrected docs tarball, and use it instead of the + obsolete docs from the upstream 3.0.8 tarball. +- Update the logfiles patch to work with the updated docs. + +* Mon Nov 8 2004 Jay Fenlason 3.0.8-2 +- New upstream version fixes CAN-2004-0930. This obsoletes the + disable-sendfile, salt, signing-shortkey and fqdn patches. +- Add my ugly non-ascii-domain patch. +- Updated the pie patch for 3.0.8. +- Updated the logfiles patch for 3.0.8. + +* Tue Oct 26 2004 Jay Fenlason 3.0.8-0.pre2 +- New upstream version +- Add Nalin's signing-shortkey patch. + +* Tue Oct 19 2004 Jay Fenlason 3.0.8-0.pre1.3 +- disable the -salt patch, because it causes undefined references in + libsmbclient that prevent gnome-vfs from building. + +* Fri Oct 15 2004 Jay Fenlason 3.0.8-0.pre1.2 +- Re-enable the x_fclose patch that was accidentally disabled + in 3.0.8-0.pre1.1. This closes #135832 +- include Nalin's -fqdn and -salt patches. + +* Wed Oct 13 2004 Jay Fenlason 3.0.8-0.pre1.1 +- Include disable-sendfile patch to default "use sendfile" to "no". + This closes #132779 + +* Wed Oct 6 2004 Jay Fenlason +- Include patch from Steven Lawrance (slawrance@yahoo.com) that modifies + smbmnt to work with 32-bit uids. + +* Mon Sep 27 2004 Jay Fenlason 3.0.8-0.pre1 +- new upstream release. This obsoletes the ldapsam_compat patches. + +* Wed Sep 15 2004 Jay Fenlason 3.0.7-4 +- Update docs section to not carryover the docs/manpages directory + This moved many files from /usr/share/doc/samba-3.0.7/docs/* to + /usr/share/doc/samba-3.0.7/* +- Modify spec file as suggested by Rex Dieter (rdieter@math.unl.edu) + to correctly create libsmbclient.so.0 and to use %%_initrddir instead + of rolling our own. This closes #132642 +- Add patch to default "use sendfile" to no, since sendfile appears to + be broken +- Add patch from Volker Lendecke to help make + ldapsam_compat work again. +- Add patch from "Vince Brimhall" for ldapsam_compat + These two patches close bugzilla #132169 + +* Mon Sep 13 2004 Jay Fenlason 3.0.7-3 +- Upgrade to 3.0.7, which fixes CAN-2004-0807 CAN-2004-0808 + This obsoletes the 3.0.6-schema patch. +- Update BuildRequires line to include openldap-devel openssl-devel + and cups-devel + +* Mon Aug 16 2004 Jay Fenlason 3.0.6-3 +- New upstream version. +- Include post 3.0.6 patch from "Gerald (Jerry) Carter" + to fix a duplicate in the LDAP schema. +- Include 64-bit timestamp patch from Ravikumar (rkumar@hp.com) + to allow correct timestamp handling on 64-bit platforms and fix #126109. +- reenable the -pie patch. Samba is too widely used, and too vulnerable + to potential security holes to disable an important security feature + like -pie. The correct fix is to have the toolchain not create broken + executables when programs compiled -pie are stripped. +- Remove obsolete patches. +- Modify this spec file to put libsmbclient.{a,so} in the right place on + x86_64 machines. + +* Thu Aug 5 2004 Jason Vas Dias 3.0.5-3 +- Removed '-pie' patch - 3.0.5 uses -fPIC/-PIC, and the combination +- resulted in executables getting corrupt stacks, causing smbmnt to +- get a SIGBUS in the mount() call (bug 127420). + +* Fri Jul 30 2004 Jay Fenlason 3.0.5-2 +- Upgrade to 3.0.5, which is a regression from 3.0.5pre1 for a + security fix. +- Include the 3.0.4-backport patch from the 3E branch. This restores + some of the 3.0.5pre1 and 3.0.5rc1 functionality. + +* Tue Jul 20 2004 Jay Fenlason 3.0.5-0.pre1.1 +- Backport base64_decode patche to close CAN-2004-0500 +- Backport hash patch to close CAN-2004-0686 +- use_authtok patch from Nalin Dahyabhai +- smbclient-kerberos patch from Alexander Larsson +- passwd patch uses "*" instead of "x" for "hashed" passwords for + accounts created by winbind. "x" means "password is in /etc/shadow" to + brain-damaged pam_unix module. + +* Fri Jul 2 2004 Jay Fenlason 3.0.5.0pre1.0 +- New upstream version +- use %% { SOURCE1 } instead of a hardcoded path +- include -winbind patch from Gerald (Jerry) Carter (jerry@samba.org) + https://bugzilla.samba.org/show_bug.cgi?id=1315 + to make winbindd work against Windows versions that do not have + 128 bit encryption enabled. +- Moved %%{_bindir}/net to the -common package, so that folks who just + want to use winbind, etc don't have to install -client in order to + "net join" their domain. +- New upstream version obsoletes the patches added in 3.0.3-5 +- Remove smbgetrc.5 man page, since we don't ship smbget. + +* Tue Jun 15 2004 Elliot Lee +- rebuilt + +* Tue May 4 2004 Jay Fenlason 3.0.3-5 +- Patch to allow password changes from machines patched with + Microsoft hotfix MS04-011. +- Include patches for https://bugzilla.samba.org/show_bug.cgi?id=1302 + and https://bugzilla.samba.org/show_bug.cgi?id=1309 + +* Thu Apr 29 2004 Jay Fenlason 3.0.3-4 +- Samba 3.0.3 released. + +* Wed Apr 21 2004 jay Fenlason 3.0.3-3.rc1 +- New upstream version +- updated spec file to make libsmbclient.so executable. This closes + bugzilla #121356 + +* Mon Apr 5 2004 Jay Fenlason 3.0.3-2.pre2 +- New upstream version +- Updated configure line to remove --with-fhs and to explicitly set all + the directories that --with-fhs was setting. We were overriding most of + them anyway. This closes #118598 + +* Mon Mar 15 2004 Jay Fenlason 3.0.3-1.pre1 +- New upstream version. +- Updated -pie and -logfiles patches for 3.0.3pre1 +- add krb5-devel to buildrequires, fixes #116560 +- Add patch from Miloslav Trmac (mitr@volny.cz) to allow non-root to run + "service smb status". This fixes #116559 + +* Tue Mar 02 2004 Elliot Lee +- rebuilt + +* Mon Feb 16 2004 Jay Fenlason 3.0.2a-1 +- Upgrade to 3.0.2a + +* Mon Feb 16 2004 Karsten Hopp 3.0.2-7 +- fix ownership in -common package + +* Fri Feb 13 2004 Elliot Lee +- rebuilt + +* Fri Feb 13 2004 Jay Fenlason +- Change all requires lines to list an explicit epoch. Closes #102715 +- Add an explicit Epoch so that %%{epoch} is defined. + +* Mon Feb 9 2004 Jay Fenlason 3.0.2-5 +- New upstream version: 3.0.2 final includes security fix for #114995 + (CAN-2004-0082) +- Edit postun script for the -common package to restart winbind when + appropriate. Fixes bugzilla #114051. + +* Mon Feb 2 2004 Jay Fenlason 3.0.2-3rc2 +- add %%dir entries for %%{_libdir}/samba and %%{_libdir}/samba/charset +- Upgrade to new upstream version +- build mount.cifs for the new cifs filesystem in the 2.6 kernel. + +* Mon Jan 19 2004 Jay Fenlason 3.0.2-1rc1 +- Upgrade to new upstream version + +* Wed Dec 17 2003 Felipe Alfaro Solana 3.0.1-1 +- Update to 3.0.1 +- Removed testparm patch as it's already merged +- Removed Samba.7* man pages +- Fixed .buildroot patch +- Fixed .pie patch +- Added new /usr/bin/tdbdump file + +* Thu Sep 25 2003 Jay Fenlason 3.0.0-15 +- New 3.0.0 final release +- merge nmbd-netbiosname and testparm patches from 3E branch +- updated the -logfiles patch to work against 3.0.0 +- updated the pie patch +- update the VERSION file during build +- use make -j if avaliable +- merge the winbindd_privileged change from 3E +- merge the "rm /usr/lib" patch that allows Samba to build on 64-bit + platforms despite the broken Makefile + +* Mon Aug 18 2003 Jay Fenlason +- Merge from samba-3E-branch after samba-3.0.0rc1 was released + +* Wed Jul 23 2003 Jay Fenlason 3.0.0-3beta3 +- Merge from 3.0.0-2beta3.3E +- (Correct log file names (#100981).) +- (Fix pidfile directory in samab.log) +- (Remove obsolete samba-3.0.0beta2.tar.bz2.md5 file) +- (Move libsmbclient to the -common package (#99449)) + +* Sun Jun 22 2003 Nalin Dahyabhai 2.2.8a-4 +- rebuild + +* Wed Jun 04 2003 Elliot Lee +- rebuilt + +* Wed May 28 2003 Jay Fenlason 2.2.8a-2 +- add libsmbclient.so for gnome-vfs-extras +- Edit specfile to specify /var/run for pid files +- Move /tmp/.winbindd/socket to /var/run/winbindd/socket + +* Wed May 14 2003 Florian La Roche +- add proper ldconfig calls + +* Thu Apr 24 2003 Jay Fenlason 2.2.8a-1 +- upgrade to 2.2.8a +- remove old .md5 files +- add "pid directory = /var/run" to the smb.conf file. Fixes #88495 +- Patch from jra@dp.samba.org to fix a delete-on-close regression + +* Mon Mar 24 2003 Jay Fenlason 2.2.8-0 +- Upgrade to 2.2.8 +- removed commented out patches. +- removed old patches and .md5 files from the repository. +- remove duplicate /sbin/chkconfig --del winbind which causes + warnings when removing samba. +- Fixed minor bug in smbprint that causes it to fail when called with + more than 10 parameters: the accounting file (and spool directory + derived from it) were being set wrong due to missing {}. This closes + bug #86473. +- updated smb.conf patch, includes new defaults to close bug #84822. + +* Mon Feb 24 2003 Elliot Lee +- rebuilt + +* Thu Feb 20 2003 Jonathan Blandford 2.2.7a-5 +- remove swat.desktop file + +* Thu Feb 20 2003 Nalin Dahyabhai 2.2.7a-4 +- relink libnss_wins.so with SHLD="%%{__cc} -lnsl" to force libnss_wins.so to + link with libnsl, avoiding unresolved symbol errors on functions in libnsl + +* Mon Feb 10 2003 Jay Fenlason 2.2.7a-3 +- edited spec file to put .so files in the correct directories + on 64-bit platforms that have 32-bit compatability issues + (sparc64, x86_64, etc). This fixes bugzilla #83782. +- Added samba-2.2.7a-error.patch from twaugh. This fixes + bugzilla #82454. + +* Wed Jan 22 2003 Tim Powers +- rebuilt + +* Thu Jan 9 2003 Jay Fenlason 2.2.7a-1 +- Update to 2.2.7a +- Change default printing system to CUPS +- Turn on pam_smbpass +- Turn on msdfs + +* Sat Jan 4 2003 Jeff Johnson 2.2.7-5 +- use internal dep generator. + +* Sat Dec 14 2002 Tim Powers 2.2.7-4 +- don't use rpms internal dep generator + +* Mon Dec 02 2002 Elliot Lee 2.2.7-3 +- Fix missing doc files. +- Fix multilib issues + +* Wed Nov 20 2002 Bill Nottingham 2.2.7-2 +- update to 2.2.7 +- add patch for LFS in smbclient () + +* Wed Aug 28 2002 Trond Eivind Glomsød 2.2.5-10 +- logrotate fixes (#65007) + +* Mon Aug 26 2002 Trond Eivind Glomsrød 2.2.5-9 +- /usr/lib was used in place of %%{_libdir} in three locations (#72554) + +* Mon Aug 5 2002 Trond Eivind Glomsrød 2.2.5-8 +- Initscript fix (#70720) + +* Fri Jul 26 2002 Trond Eivind Glomsrød 2.2.5-7 +- Enable VFS support and compile the "recycling" module (#69796) +- more selective includes of the examples dir + +* Tue Jul 23 2002 Trond Eivind Glomsrød 2.2.5-6 +- Fix the lpq parser for better handling of LPRng systems (#69352) + +* Tue Jul 23 2002 Trond Eivind Glomsrød 2.2.5-5 +- desktop file fixes (#69505) + +* Wed Jun 26 2002 Trond Eivind Glomsrød 2.2.5-4 +- Enable ACLs + +* Tue Jun 25 2002 Trond Eivind Glomsrød 2.2.5-3 +- Make it not depend on Net::LDAP - those are doc files and examples + +* Fri Jun 21 2002 Tim Powers +- automated rebuild + +* Thu Jun 20 2002 Trond Eivind Glomsrød 2.2.5-1 +- 2.2.5 + +* Fri Jun 14 2002 Trond Eivind Glomsrød 2.2.4-5 +- Move the post/preun of winbind into the -common subpackage, + where the script is (#66128) + +* Tue Jun 4 2002 Trond Eivind Glomsrød 2.2.4-4 +- Fix pidfile locations so it runs properly again (2.2.4 + added a new directtive - #65007) + +* Thu May 23 2002 Tim Powers +- automated rebuild + +* Tue May 14 2002 Trond Eivind Glomsrød 2.2.4-2 +- Fix #64804 + +* Thu May 9 2002 Trond Eivind Glomsrød 2.2.4-1 +- 2.2.4 +- Removed some zero-length and CVS internal files +- Make it build + +* Wed Apr 10 2002 Trond Eivind Glomsrød 2.2.3a-6 +- Don't use /etc/samba.d in smbadduser, it should be /etc/samba + +* Thu Apr 4 2002 Trond Eivind Glomsrød 2.2.3a-5 +- Add libsmbclient.a w/headerfile for KDE (#62202) + +* Tue Mar 26 2002 Trond Eivind Glomsrød 2.2.3a-4 +- Make the logrotate script look the correct place for the pid files + +* Thu Mar 14 2002 Nalin Dahyabhai 2.2.3a-3 +- include interfaces.o in pam_smbpass.so, which needs symbols from interfaces.o + (patch posted to samba-list by Ilia Chipitsine) + +* Thu Feb 21 2002 Trond Eivind Glomsrød 2.2.3a-2 +- Rebuild + +* Thu Feb 7 2002 Trond Eivind Glomsrød 2.2.3a-1 +- 2.2.3a + +* Mon Feb 4 2002 Trond Eivind Glomsrød 2.2.3-1 +- 2.2.3 + +* Thu Nov 29 2001 Trond Eivind Glomsrød 2.2.2-8 +- New pam configuration file for samba + +* Tue Nov 27 2001 Trond Eivind Glomsrød 2.2.2-7 +- Enable PAM session controll and password sync + +* Tue Nov 13 2001 Trond Eivind Glomsrød 2.2.2-6 +- Move winbind files to samba-common. Add separate initscript for + winbind +- Fixes for winbind - protect global variables with mutex, use + more secure getenv + +* Thu Nov 8 2001 Trond Eivind Glomsrød 2.2.2-5 +- Teach smbadduser about "getent passwd" +- Fix more pid-file references +- Add (conditional) winbindd startup to the initscript, configured in + /etc/sysconfig/samba + +* Wed Nov 7 2001 Trond Eivind Glomsrød 2.2.2-4 +- Fix pid-file reference in logrotate script +- include pam and nss modules for winbind + +* Mon Nov 5 2001 Trond Eivind Glomsrød 2.2.2-3 +- Add "--with-utmp" to configure options (#55372) +- Include winbind, pam_smbpass.so, rpcclient and smbcacls +- start using /var/cache/samba, we need to keep state and there is + more than just locks involved + +* Sat Nov 03 2001 Florian La Roche 2.2.2-2 +- add "reload" to the usage string in the startup script + +* Mon Oct 15 2001 Trond Eivind Glomsrød 2.2.2-1 +- 2.2.2 + +* Tue Sep 18 2001 Trond Eivind Glomsrød 2.2.1a-5 +- Add patch from Jeremy Allison to fix IA64 alignment problems (#51497) + +* Mon Aug 13 2001 Trond Eivind Glomsrød +- Don't include smbpasswd in samba, it's in samba-common (#51598) +- Add a disabled "obey pam restrictions" statement - it's not + active, as we use encrypted passwords, but if the admin turns + encrypted passwords off the choice is available. (#31351) + +* Wed Aug 8 2001 Trond Eivind Glomsrød +- Use /var/cache/samba instead of /var/lock/samba +- Remove "domain controller" keyword from smb.conf, it's + deprecated (from #13704) +- Sync some examples with smb.conf.default +- Fix password synchronization (#16987) + +* Fri Jul 20 2001 Trond Eivind Glomsrød +- Tweaks of BuildRequires (#49581) + +* Wed Jul 11 2001 Trond Eivind Glomsrød +- 2.2.1a bugfix release + +* Tue Jul 10 2001 Trond Eivind Glomsrød +- 2.2.1, which should work better for XP + +* Sat Jun 23 2001 Trond Eivind Glomsrød +- 2.2.0a security fix +- Mark lograte and pam configuration files as noreplace + +* Fri Jun 22 2001 Trond Eivind Glomsrød +- Add the /etc/samba directory to samba-common + +* Thu Jun 21 2001 Trond Eivind Glomsrød +- Add improvements to the smb.conf as suggested in #16931 + +* Tue Jun 19 2001 Trond Eivind Glomsrød +- (these changes are from the non-head version) +- Don't include /usr/sbin/samba, it's the same as the initscript +- unset TMPDIR, as samba can't write into a TMPDIR owned + by root (#41193) +- Add pidfile: lines for smbd and nmbd and a config: line + in the initscript (#15343) +- don't use make -j +- explicitly include /usr/share/samba, not just the files in it + +* Tue Jun 19 2001 Bill Nottingham +- mount.smb/mount.smbfs go in /sbin, *not* %%{_sbindir} + +* Fri Jun 8 2001 Preston Brown +- enable encypted passwords by default + +* Thu Jun 7 2001 Helge Deller +- build as 2.2.0-1 release +- skip the documentation-directories docbook, manpages and yodldocs +- don't include *.sgml documentation in package +- moved codepage-directory to /usr/share/samba/codepages +- make it compile with glibc-2.2.3-10 and kernel-headers-2.4.2-2 + +* Mon May 21 2001 Helge Deller +- updated to samba 2.2.0 +- moved codepages to %%{_datadir}/samba/codepages +- use all available CPUs for building rpm packages +- use %%{_xxx} defines at most places in spec-file +- "License:" replaces "Copyright:" +- dropped excludearch sparc +- de-activated japanese patches 100 and 200 for now + (they need to be fixed and tested wth 2.2.0) +- separated swat.desktop file from spec-file and added + german translations +- moved /etc/sysconfig/samba to a separate source-file +- use htmlview instead of direct call to netscape in + swat.desktop-file + +* Mon May 7 2001 Bill Nottingham +- device-remove security fix again () + +* Fri Apr 20 2001 Bill Nottingham +- fix tempfile security problems, officially () +- update to 2.0.8 + +* Sun Apr 8 2001 Bill Nottingham +- turn of SSL, kerberos + +* Thu Apr 5 2001 Bill Nottingham +- fix tempfile security problems (patch from ) + +* Thu Mar 29 2001 Bill Nottingham +- fix quota support, and quotas with the 2.4 kernel (#31362, #33915) + +* Mon Mar 26 2001 Nalin Dahyabhai +- tweak the PAM code some more to try to do a setcred() after initgroups() +- pull in all of the optflags on i386 and sparc +- don't explicitly enable Kerberos support -- it's only used for password + checking, and if PAM is enabled it's a no-op anyway + +* Mon Mar 5 2001 Tim Waugh +- exit successfully from preun script (bug #30644). + +* Fri Mar 2 2001 Nalin Dahyabhai +- rebuild in new environment + +* Wed Feb 14 2001 Bill Nottingham +- updated japanese stuff (#27683) + +* Fri Feb 9 2001 Bill Nottingham +- fix trigger (#26859) + +* Wed Feb 7 2001 Bill Nottingham +- add i18n support, japanese patch (#26253) + +* Wed Feb 7 2001 Trond Eivind Glomsrød +- i18n improvements in initscript (#26537) + +* Wed Jan 31 2001 Bill Nottingham +- put smbpasswd in samba-common (#25429) + +* Wed Jan 24 2001 Bill Nottingham +- new i18n stuff + +* Sun Jan 21 2001 Bill Nottingham +- rebuild + +* Thu Jan 18 2001 Bill Nottingham +- i18n-ize initscript +- add a sysconfig file for daemon options (#23550) +- clarify smbpasswd man page (#23370) +- build with LFS support (#22388) +- avoid extraneous pam error messages (#10666) +- add Urban Widmark's bug fixes for smbmount (#19623) +- fix setgid directory modes (#11911) +- split swat into subpackage (#19706) + +* Wed Oct 25 2000 Nalin Dahyabhai +- set a default CA certificate path in smb.conf (#19010) +- require openssl >= 0.9.5a-20 to make sure we have a ca-bundle.crt file + +* Mon Oct 16 2000 Bill Nottingham +- fix swat only_from line (#18726, others) +- fix attempt to write outside buildroot on install (#17943) + +* Mon Aug 14 2000 Bill Nottingham +- add smbspool back in (#15827) +- fix absolute symlinks (#16125) + +* Sun Aug 6 2000 Philipp Knirsch +- bugfix for smbadduser script (#15148) + +* Mon Jul 31 2000 Matt Wilson +- patch configure.ing (patch11) to disable cups test +- turn off swat by default + +* Fri Jul 28 2000 Bill Nottingham +- fix condrestart stuff + +* Fri Jul 21 2000 Bill Nottingham +- add copytruncate to logrotate file (#14360) +- fix init script (#13708) + +* Sat Jul 15 2000 Bill Nottingham +- move initscript back +- remove 'Using Samba' book from %%doc +- move stuff to /etc/samba (#13708) +- default configuration tweaks (#13704) +- some logrotate tweaks + +* Wed Jul 12 2000 Prospector +- automatic rebuild + +* Tue Jul 11 2000 Bill Nottingham +- fix logrotate script (#13698) + +* Thu Jul 6 2000 Bill Nottingham +- fix initscripts req (prereq /etc/init.d) + +* Wed Jul 5 2000 Than Ngo +- add initdir macro to handle the initscript directory +- add a new macro to handle /etc/pam.d/system-auth + +* Thu Jun 29 2000 Nalin Dahyabhai +- enable Kerberos 5 and SSL support +- patch for duplicate profile.h headers + +* Thu Jun 29 2000 Bill Nottingham +- fix init script + +* Tue Jun 27 2000 Bill Nottingham +- rename samba logs (#11606) + +* Mon Jun 26 2000 Bill Nottingham +- initscript munging + +* Fri Jun 16 2000 Bill Nottingham +- configure the swat stuff usefully +- re-integrate some specfile tweaks that got lost somewhere + +* Thu Jun 15 2000 Bill Nottingham +- rebuild to get rid of cups dependency + +* Wed Jun 14 2000 Nalin Dahyabhai +- tweak logrotate configurations to use the PID file in /var/lock/samba + +* Sun Jun 11 2000 Bill Nottingham +- rebuild in new environment + +* Thu Jun 1 2000 Nalin Dahyabhai +- change PAM setup to use system-auth + +* Mon May 8 2000 Bill Nottingham +- fixes for ia64 + +* Sat May 6 2000 Bill Nottingham +- switch to %%configure + +* Wed Apr 26 2000 Nils Philippsen +- version 2.0.7 + +* Sun Mar 26 2000 Florian La Roche +- simplify preun + +* Thu Mar 16 2000 Bill Nottingham +- fix yp_get_default_domain in autoconf +- only link against readline for smbclient +- fix log rotation (#9909) + +* Fri Feb 25 2000 Bill Nottingham +- fix trigger, again. + +* Mon Feb 7 2000 Bill Nottingham +- fix trigger. + +* Fri Feb 4 2000 Bill Nottingham +- turn on quota support + +* Mon Jan 31 2000 Cristian Gafton +- rebuild to fox dependencies +- man pages are compressed + +* Fri Jan 21 2000 Bill Nottingham +- munge post scripts slightly + +* Wed Jan 19 2000 Bill Nottingham +- turn on mmap again. Wheee. +- ship smbmount on alpha + +* Mon Dec 6 1999 Bill Nottingham +- turn off mmap. ;) + +* Wed Dec 1 1999 Bill Nottingham +- change /var/log/samba to 0700 +- turn on mmap support + +* Thu Nov 11 1999 Bill Nottingham +- update to 2.0.6 + +* Fri Oct 29 1999 Bill Nottingham +- add a %%defattr for -common + +* Tue Oct 5 1999 Bill Nottingham +- shift some files into -client +- remove /home/samba from package. + +* Tue Sep 28 1999 Bill Nottingham +- initscript oopsie. killproc -HUP, not other way around. + +* Sun Sep 26 1999 Bill Nottingham +- script cleanups. Again. + +* Wed Sep 22 1999 Bill Nottingham +- add a patch to fix dropped reconnection attempts + +* Mon Sep 6 1999 Jeff Johnson +- use cp rather than mv to preserve /etc/services perms (#4938 et al). +- use mktemp to generate /etc/tmp.XXXXXX file name. +- add prereqs on sed/mktemp/killall (need to move killall to /bin). +- fix trigger syntax (i.e. "samba < 1.9.18p7" not "samba < samba-1.9.18p7") + +* Mon Aug 30 1999 Bill Nottingham +- sed "s|nawk|gawk|" /usr/bin/convert_smbpasswd + +* Sat Aug 21 1999 Bill Nottingham +- fix typo in mount.smb + +* Fri Aug 20 1999 Bill Nottingham +- add a %%trigger to work around (sort of) broken scripts in + previous releases + +* Mon Aug 16 1999 Bill Nottingham +- initscript munging + +* Mon Aug 9 1999 Bill Nottingham +- add domain parsing to mount.smb + +* Fri Aug 6 1999 Bill Nottingham +- add a -common package, shuffle files around. + +* Fri Jul 23 1999 Bill Nottingham +- add a chmod in %%postun so /etc/services & inetd.conf don't become unreadable + +* Wed Jul 21 1999 Bill Nottingham +- update to 2.0.5 +- fix mount.smb - smbmount options changed again......... +- fix postun. oops. +- update some stuff from the samba team's spec file. + +* Fri Jun 18 1999 Bill Nottingham +- split off clients into separate package +- don't run samba by default + +* Mon Jun 14 1999 Bill Nottingham +- fix one problem with mount.smb script +- fix smbpasswd on sparc with a really ugly kludge + +* Thu Jun 10 1999 Dale Lovelace +- fixed logrotate script + +* Tue May 25 1999 Bill Nottingham +- turn of 64-bit locking on 32-bit platforms + +* Thu May 20 1999 Bill Nottingham +- so many releases, so little time +- explicitly uncomment 'printing = bsd' in sample config + +* Tue May 18 1999 Bill Nottingham +- update to 2.0.4a +- fix mount.smb arg ordering + +* Fri Apr 16 1999 Bill Nottingham +- go back to stop/start for restart (-HUP didn't work in testing) + +* Fri Mar 26 1999 Bill Nottingham +- add a mount.smb to make smb mounting a little easier. +- smb filesystems apparently don't work on alpha. Oops. + +* Thu Mar 25 1999 Bill Nottingham +- always create codepages + +* Tue Mar 23 1999 Bill Nottingham +- logrotate changes + +* Sun Mar 21 1999 Cristian Gafton +- auto rebuild in the new build environment (release 3) + +* Fri Mar 19 1999 Preston Brown +- updated init script to use graceful restart (not stop/start) + +* Tue Mar 9 1999 Bill Nottingham +- update to 2.0.3 + +* Thu Feb 18 1999 Bill Nottingham +- update to 2.0.2 + +* Mon Feb 15 1999 Bill Nottingham +- swat swat + +* Tue Feb 9 1999 Bill Nottingham +- fix bash2 breakage in post script + +* Fri Feb 5 1999 Bill Nottingham +- update to 2.0.0 + +* Mon Oct 12 1998 Cristian Gafton +- make sure all binaries are stripped + +* Thu Sep 17 1998 Jeff Johnson +- update to 1.9.18p10. +- fix %%triggerpostun. + +* Tue Jul 07 1998 Erik Troan +- updated postun triggerscript to check $0 +- clear /etc/codepages from %%preun instead of %%postun + +* Mon Jun 08 1998 Erik Troan +- made the %%postun script a tad less agressive; no reason to remove + the logs or lock file (after all, if the lock file is still there, + samba is still running) +- the %%postun and %%preun should only exectute if this is the final + removal +- migrated %%triggerpostun from Red Hat's samba package to work around + packaging problems in some Red Hat samba releases + +* Sun Apr 26 1998 John H Terpstra +- minor tidy up in preparation for release of 1.9.18p5 +- added findsmb utility from SGI package + +* Wed Mar 18 1998 John H Terpstra +- Updated version and codepage info. +- Release to test name resolve order + +* Sat Jan 24 1998 John H Terpstra +- Many optimisations (some suggested by Manoj Kasichainula +- Use of chkconfig in place of individual symlinks to /etc/rc.d/init/smb +- Compounded make line +- Updated smb.init restart mechanism +- Use compound mkdir -p line instead of individual calls to mkdir +- Fixed smb.conf file path for log files +- Fixed smb.conf file path for incoming smb print spool directory +- Added a number of options to smb.conf file +- Added smbadduser command (missed from all previous RPMs) - Doooh! +- Added smbuser file and smb.conf file updates for username map diff --git a/samba.spec b/samba.spec index 72558fd..143402e 100644 --- a/samba.spec +++ b/samba.spec @@ -147,13 +147,15 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.20.1 + +# Use 'autorelease -b 100' to start counting at 100 +%global samba_release %autorelease + +%global pre_release %nil +%if "x%{?pre_release}" != "x" %global baserelease 1 # This should be rc1 or %%nil -%global pre_release %nil - -%global samba_release %{baserelease} -%if "x%{?pre_release}" != "x" -%global samba_release 0.%{baserelease}.%{pre_release} +%global samba_release 0.%{baserelease}.%{pre_release}%{?dist} %endif @@ -205,7 +207,7 @@ Name: samba Version: %{samba_version} -Release: %{samba_release}%{?dist} +Release: %{samba_release} %if 0%{?fedora} Epoch: 2 @@ -4594,3043 +4596,4 @@ fi %endif %changelog -* Wed May 08 2024 Guenther Deschner - 4.20.1-1 -- resolves: #2279780 - Update to version 4.20.1 - -* Wed Mar 27 2024 Guenther Deschner - 4.20.0-7 -- resolves: #2271916 - Update to version 4.20.0 - -* Tue Mar 12 2024 Richard W.M. Jones - 2:4.20.0-0.6.rc4 -- Bump and rebuild package (for riscv64) - -* Mon Mar 11 2024 Guenther Deschner - 4.20.0rc4-5 -- resolves: #2269037 - Update to version 4.20.0rc4 - -* Mon Feb 26 2024 Guenther Deschner - 4.20.0rc3-4 -- resolves: #2266039 - Update to version 4.20.0rc3 - -* Mon Feb 12 2024 Guenther Deschner - 4.20.0rc2-3 -- resolves: #2263874 - Update to version 4.20.0rc2 - -* Thu Feb 01 2024 Pete Walter - 2:4.20.0-0.2.rc1 -- Rebuild for ICU 74 - -* Mon Jan 29 2024 Guenther Deschner - 4.20.0rc1-1 -- resolves: #2260895 - Update to version 4.20.0rc1 - -* Sat Jan 27 2024 Fedora Release Engineering - 2:4.19.4-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Tue Jan 16 2024 Andreas Schneider - 4.29.4-3 -- Fix samba-gpupdate on Fedora/RHEL - -* Tue Jan 09 2024 Andreas Schneider - 4.19.4-2 -- resolves: rhbz#2256326 - Create all groups using systemd - -* Mon Jan 08 2024 Guenther Deschner - 4.19.4-1 -- resolves: #2257287 - Update to version 4.19.4 - -* Tue Nov 28 2023 Guenther Deschner - 4.19.3-2 -- Disable performance co-pilot support for i686 - -* Mon Nov 27 2023 Guenther Deschner - 4.19.3-1 -- resolves: #2251766 - Update to version 4.19.3 - -* Wed Nov 15 2023 Andreas Schneider - 4.19.2-2 -- Package samba-gpupdate also for RHEL9 - -* Mon Oct 16 2023 Guenther Deschner - 4.19.2-1 -- resolves: #2244496 - Update to version 4.19.2 - -* Tue Oct 10 2023 Guenther Deschner - 4.19.1-1 -- resolves: #2243073 - Update to version 4.19.1 -- resolves: #2241881, #2243228: Security fix for CVE-2023-3961 -- resolves: #2241882, #2243231: Security fix for CVE-2023-4091 -- resolves: #2241883, #2243230: Security fix for CVE-2023-4154 -- resolves: #2241884, #2243229: Security fix for CVE-2023-42669 -- resolves: #2241885, #2243232: Security fix for CVE-2023-42670 - -* Mon Sep 04 2023 Guenther Deschner - 4.19.0-1 -- resolves: #2237259 - Update to version 4.19.0 - -* Mon Aug 28 2023 Guenther Deschner - 4.19.0-0.5.rc4 -- resolves: #2232744 - Update to version 4.19.0rc4 - -* Fri Aug 18 2023 Guenther Deschner - 4.19.0-0.4.rc3 -- resolves: #2232744 - Update to version 4.19.0rc3 - -* Wed Aug 16 2023 Yaakov Selkowitz - 2:4.19.0-0.3.rc2 -- Move ad-claims and authn-policy-util to dc-libs - -* Tue Aug 15 2023 Adam Williamson - 4.19.0-0.2.rc2 -- python3-samba-dc requires python3-markdown now - -* Tue Aug 08 2023 Guenther Deschner - 4.19.0-0.1.rc2 -- resolves: #2227246 - Update to version 4.19.0rc2 - -* Mon Aug 07 2023 Guenther Deschner - 4.19.0-0.0.rc1 -- resolves: #2227246 - Update to version 4.19.0rc1 - -* Thu Jul 20 2023 Guenther Deschner - 4.18.5-0 -- resolves: #2224040 - Update to version 4.18.5 -- resolves: #2222791, #2224254 - Security fix for CVE-2022-2127 -- resolves: #2222792, #2224255 - Security fix for CVE-2023-3347 -- resolves: #2222793, #2224253 - Security fix for CVE-2023-34966 -- resolves: #2222794, #2224252 - Security fix for CVE-2023-34967 -- resolves: #2222795, #2224250 - Security fix for CVE-2023-34968 - -* Sat Jul 15 2023 Guenther Deschner - 4.18.4-3 -- resolves: #2223091 - Fix netlogon LogonGetCapabilities level 2 error handling - -* Tue Jul 11 2023 František Zatloukal - 2:4.18.4-2 -- Rebuilt for ICU 73.2 - -* Wed Jul 05 2023 Python Maint - 2:4.18.4-1 -- Rebuilt for Python 3.12 - -* Wed Jul 05 2023 Guenther Deschner - 4.18.4-0 -- resolves: #2219799 - Update to version 4.18.4 - -* Mon Jun 26 2023 Python Maint - 2:4.18.3-5 -- Rebuilt for Python 3.12 - -* Mon Jun 26 2023 Adam Williamson - 4.18.3-4 -- Only run libwbclient %pre on upgrade, not fresh install - -* Fri Jun 23 2023 Andreas Schneider - 4.18.3-3 -- resolves: rhbz#2211577 - Fix libwbclient package upgrades - -* Thu Jun 15 2023 Python Maint - 2:4.18.3-2 -- Rebuilt for Python 3.12 - -* Thu Jun 15 2023 Andreas Schneider - 4.18.3-1 -- resolves: #2203539 - Also cover mit_kdc.log by logrotate - -* Thu Jun 01 2023 Guenther Deschner - 4.18.3-0 -- resolves: #2211453 - Update to version 4.18.3 - -* Wed Apr 19 2023 Guenther Deschner - 4.18.2-0 -- resolves: #2187991 - Update to version 4.18.2 - -* Wed Mar 29 2023 Guenther Deschner - 4.18.1-0 -- resolves: #2182787 - Update to version 4.18.1 -- resolves: #2182772, #2182773 - Security fixes for CVE-2023-0225 -- resolves: #2182774, #2182775 - Security fixes for CVE-2023-0922 -- resolves: #2182776, #2182777 - Security fixes for CVE-2023-0614 - -* Tue Mar 21 2023 Andreas Schneider - 4.18.0-12 -- Fix ctdb file lists when built with test suite enabled - -* Fri Mar 17 2023 Kalev Lember - 4.18.0-10 -- Move libstable-sort-samba4.so to samba-client-libs subpackage - -* Wed Mar 08 2023 Guenther Deschner - 4.18.0-9 -- resolves: #2176469 - Update to version 4.18.0 - -* Wed Mar 01 2023 Guenther Deschner - 4.18.0rc4-8 -- resolves: #2174415 - Update to version 4.18.0rc4 - -* Tue Feb 28 2023 Andreas Schneider - 4.18.0-0.7.rc3 -- resolves: #2173619 - Add missing Requires for glibc-gconv-extra - -* Thu Feb 23 2023 Pavel Filipenský - 4.18.0-0.6.rc3 -- SPDX migration - -* Wed Feb 15 2023 Guenther Deschner - 4.18.0rc3-6 -- resolves: #2166416 - Update to version 4.18.0rc3 - -* Mon Feb 13 2023 Pavel Filipenský - 4.18.0rc2-5 -- Create package samba-tools, move there samba-tool binary - -* Thu Feb 02 2023 Guenther Deschner - 4.18.0rc2-3 -- resolves: #2166416 - Update to version 4.18.0rc2 - -* Sat Jan 21 2023 Fedora Release Engineering - 2:4.18.0-0.2.rc1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - -* Thu Jan 19 2023 Guenther Deschner - 4.18.0rc1-0 -- resolves: #2162097 - Update to version 4.18.0rc1 - -* Sat Dec 31 2022 Pete Walter - 2:4.17.4-4 -- Rebuild for ICU 72 - -* Thu Dec 22 2022 Pavel Filipenský - 4.17.4-3 -- Create package dc-libs also for 'non-dc build' - -* Tue Dec 20 2022 Pavel Filipenský - 4.17.4-2 -- Fix '--without dc' build: delete libauth4-samba4.so - -* Mon Dec 19 2022 Pavel Filipenský - 4.17.4-1 -- Create a samba-dcerpc sub-package -- Fix package installation without samba and samba-dc package - -* Fri Dec 16 2022 Guenther Deschner - 4.17.4-0 -- resolves: #2153906 - Update to version 4.17.4 -- resolves: #2154362, #2154363 - Security fixes for CVE-2022-38023 -- resolves: #2154303, #2154304 - Security fixes for CVE-2022-37966 -- resolves: #2154320, #2154322 - Security fixes for CVE-2022-37967 - -* Thu Dec 1 2022 Alexander Bokovoy - 2:4.17.3-2 -- Rebuild against krb5 1.20.1, new KDB interface - -* Mon Nov 21 2022 Florian Weimer - 2:4.17.3-1 -- Remove C89-specific language constructs from configure checks -- Fix feature detection for major/minor macros - -* Tue Nov 15 2022 Guenther Deschner - 4.17.3-0 -- resolves: #2142959 - Update to version 4.17.3 -- resolves: #2140960, #2143117 - Security fixes for CVE-2022-42898 - -* Wed Nov 02 2022 Pavel Filipenský - 4.17.2-1 -- Always add epoch to samba_depver to fix osci.brew-build.rpmdeplint.functional - -* Tue Oct 25 2022 Andreas Schneider - 4.17.2-1 -- Update to version 4.17.2 -- Fix CVE-2022-3592: A malicious client can use a symlink to escape the - exported - -* Mon Oct 24 2022 Andreas Schneider - 4.17.1-2 -- Add missing dependency for wbinfo used by ctdb scripts - -* Wed Oct 19 2022 Pavel Filipenský - 4.17.1-1 -- Update to version 4.17.1 -- resolves: rhbz#2127301 - Permission denied calling SMBC_getatr when file not exists -- resolves: rhbz#2133818 - rpcclient 4.17.0 unable to resolve server hostname - -* Wed Oct 05 2022 Andreas Schneider - 4.17.0-2 -- Move group creation logic to sysusers.d fragment - -* Tue Sep 13 2022 Andreas Schneider - 4.17.0-1 -- resolves: rhbz#2118818 - Update to version 4.17.0 -- resolves: rhbz#2121138 - Fix CVE-2022-32743 -- resolves: rhbz#2122650 - Fix CVE-2022-1615 - -* Tue Sep 13 2022 Andreas Schneider - 4.17.0-0.11.rc5 -- resolves: rhbz#2093656 - Split out libnetapi(-devel) sub-packages -- resolves: rhbz#2096405 - Add samba-usershare package - -* Tue Sep 06 2022 Guenther Deschner - 4.17.0-0.10.rc5 -- resolves: #2118818 - Update to version 4.17.0rc5 - -* Wed Aug 31 2022 Guenther Deschner - 4.17.0-0.9.rc4 -- resolves: #2118818 - Update to version 4.17.0rc4 - -* Thu Aug 25 2022 Adam Williamson - 4.17.0-0.8.rc3 -- Rebuild with no changes to fix F37 update grouping - -* Thu Aug 25 2022 Andreas Schneider - 4.17.0-0.7.rc3 -- python3-samba package should not require the samba package - -* Tue Aug 23 2022 Pavel Filipenský - 4.17.0-0.6.rc3 -- resolves: #2118818 - Update to version 4.17.0rc3 - -* Fri Aug 19 2022 Andreas Schneider - 4.17.0-0.5.rc2 -- Create a samba-gpupdate sub-package for GPO client support - -* Fri Aug 19 2022 Andreas Schneider - 4.17.0-0.4.rc2 -- Split out a samba-ldb-ldap-modules subpackage - -* Thu Aug 18 2022 Kalev Lember - 2:4.17.0-0.3.rc2 -- Avoid requiring systemd as per updated packaging guidelines - -* Wed Aug 17 2022 Guenther Deschner - 4.17.0rc2-2 -- resolves: #2118818 - Update to version 4.17.0rc2 - -* Wed Aug 10 2022 Andreas Schneider - 4.17.0rc1-1 -- Make sure we detect if SO version numbers of public libraries change. - -* Mon Aug 08 2022 Guenther Deschner - 4.17.0rc1-0 -- resolves: #2116503 - Update to version 4.17.0rc1 - -* Mon Aug 01 2022 Frantisek Zatloukal - 2:4.16.4-1 -- Rebuilt for ICU 71.1 - -* Wed Jul 27 2022 Guenther Deschner - 4.16.4-0 -- resolves: #2111490 - Update to version 4.16.4 -- resolves: #2108196, #2111729 - Security fixes for CVE-2022-32742 -- resolves: #2108205, #2111731 - Security fixes for CVE-2022-32744 -- resolves: #2108211, #2111732 - Security fixes for CVE-2022-32745 -- resolves: #2108215, #2111734 - Security fixes for CVE-2022-32746 - -* Sat Jul 23 2022 Fedora Release Engineering - 2:4.16.3-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - -* Mon Jul 18 2022 Andreas Schneider - 4.16.3-1 -- Update to version 4.16.3 - -* Wed Jun 15 2022 Python Maint - 2:4.16.2-1 -- Rebuilt for Python 3.11 - -* Mon Jun 13 2022 Guenther Deschner - 4.16.2-0 -- Update to Samba 4.16.2 -- resolves: #2096167 - -* Wed Jun 08 2022 Andreas Schneider - 4.16.1-7 -- resolves: rhbz#2093833 - Remove weak dependency for logrotate for CentOS/RHEL - -* Tue May 31 2022 Jitka Plesnikova - 2:4.16.1-6 -- Perl 5.36 rebuild - -* Fri May 13 2022 Pavel Filipenský - 4.16.1-5 -- Fix rpminspect abidiff - -* Fri May 06 2022 Pavel Filipenský - 4.16.1-2 -- Update requires for packages - -* Thu May 05 2022 Tomas Popela - 4.16.1-1 -- Don't require full systemd for tmp files handling in samba-common - -* Mon May 02 2022 Pavel Filipenský - 4.16.1-0 -- Update to Samba 4.16.1 -- resolves: #2080915 - -* Fri Mar 25 2022 Sandro Mani - 2:4.16.0-7 -- Rebuild with mingw-gcc-12 - -* Tue Mar 22 2022 Guenther Deschner - 4.16.0-6 -- Update to Samba 4.16.0 -- resolves: #2066290 - -* Wed Mar 09 2022 Guenther Deschner - 4.16.0-0.5.rc5 -- Update to Samba 4.16.0rc5 -- resolves: #2042518 - -* Tue Mar 01 2022 Pavel Filipenský - 4.16.0-0.4.rc4 -- Update to Samba 4.16.0rc4 -- resolves: #2042518 - -* Wed Feb 23 2022 Andreas Schneider - 4.16.0-0.3.rc3 -- resolves: rhbz#2036443 - Fix samba-tool on builds with samba-dc - -* Tue Feb 15 2022 Pavel Filipenský - 4.16.0rc3 -- Update to Samba 4.16.0rc3 -- resolves: #2042518 - -* Tue Feb 01 2022 Pavel Filipenský - 4.16.0rc2 -- Update to Samba 4.16.0rc2 -- resolves: #2046120, #2048566 - Security fixes for CVE-2021-44141 -- resolves: #2046146, #2048570 - Security fixes for CVE-2021-44142 -- resolves: #2046134, #2048568 - Security fixes for CVE-2022-0336 -- resolves: #2042518 - -* Wed Jan 26 2022 Pavel Filipenský - 4.16.0rc1 -- Exclude temporarily ceph on ppc64le to fix failing build - -* Tue Jan 25 2022 Pavel Filipenský - 4.16.0rc1 -- Update to Samba 4.16.0rc1 -- resolves: #2042518 - -* Thu Jan 20 2022 Pavel Filipenský - 4.15.4-0 -- Update to Samba 4.15.4 -- resolves: #2009673, #2039034 - Security fixes for CVE-2021-20316 -- resolves: #2042518 - -* Wed Dec 15 2021 Pavel Filipenský - 4.15.3-1 -- Fix resolv_wrapper with glibc 2.34 -- resolves: #2019669 - -* Wed Dec 08 2021 Pavel Filipenský - 4.15.3-0 -- Update to Samba 4.15.3 -- resolves: #2030382 - -* Sat Nov 13 2021 Guenther Deschner - 4.15.2-3 -- Fix IPA DC schannel support - -* Thu Nov 11 2021 Guenther Deschner - 4.15.2-2 -- Fix winbind trusted domain regression -- related: #2021716 -- Fix logfile handling -- Fix smbclient -N failures in container setups - -* Tue Nov 09 2021 Guenther Deschner - 4.15.2-0 -- Update to Samba 4.15.2 -- resolves: #2019660, #2021711 - Security fixes for CVE-2016-2124 -- resolves: #2019672, #2021716 - Security fixes for CVE-2020-25717 -- resolves: #2019726, #2021718 - Security fixes for CVE-2020-25718 -- resolves: #2019732, #2021719 - Security fixes for CVE-2020-25719 -- resolves: #2021728, #2021729 - Security fixes for CVE-2020-25721 -- resolves: #2019764, #2021721 - Security fixes for CVE-2020-25722 -- resolves: #2021726, #2021727 - Security fixes for CVE-2021-3738 -- resolves: #2019666, #2021715 - Security fixes for CVE-2021-23192 -- resolves: #2021625 - -* Fri Nov 05 2021 Guenther Deschner - 4.15.1-1 -- Fix winexe core dump -- resolves: #2020376 - -* Wed Oct 27 2021 Guenther Deschner - 4.15.1-0 -- Update to Samba 4.15.1 -- resolves: #2017847 - -* Mon Sep 20 2021 Guenther Deschner - 4.15.0-13 -- Update to Samba 4.15.0 -- resolves: #2005817 - -* Mon Sep 13 2021 Guenther Deschner - 4.15.0-0.12.rc7 -- Update to Samba 4.15.0rc7 -- resolves: #2003740 - -* Thu Sep 09 2021 Guenther Deschner - 4.15.0-0.11.rc6 -- Update to Samba 4.15.0rc6 -- resolves: #2002546 - -* Tue Sep 07 2021 Guenther Deschner - 4.15.0-0.10.rc5 -- Update to Samba 4.15.0rc5 -- resolves: #2001827 - -* Wed Sep 01 2021 Guenther Deschner - 4.15.0-0.9.rc4 -- Update to Samba 4.15.0rc4 -- resolves: #2000079 - -* Thu Aug 26 2021 Guenther Deschner - 4.15.0-0.8.rc3 -- Update to Samba 4.15.0rc3 -- resolves: #1998024 - -* Wed Aug 25 2021 Guenther Deschner - 4.15.0-0.7.rc2 -- Add ceph and etcd mutex helpers for CTDB - -* Mon Aug 16 2021 Anoop C S - 4.15.0-0.6.rc2 -- Avoid removing PyDSDB library files from buildroot for non AD DC build - -* Fri Aug 13 2021 Adam Williamson - 4.15.0-0.5.rc2 -- Fix samba-common-tools dependency - -* Thu Aug 12 2021 Andreas Schneider - 4.15.0-0.4.rc2 -- Package samba-tool correctly - -* Mon Aug 09 2021 Guenther Deschner - 4.15.0-0.3.rc2 -- Update to Samba 4.15.0rc2 -- resolves: #1991634 - -* Fri Jul 23 2021 Fedora Release Engineering - 2:4.15.0-0.2.rc1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - -* Mon Jul 19 2021 Guenther Deschner - 4.15.0rc1-1 -- Fix ctdb-pcp-pmda install -- resolves: #1983369 - -* Thu Jul 15 2021 Guenther Deschner - 4.15.0rc1-0 -- Update to Samba 4.15.0rc1 -- resolves: #1982623 - -* Wed Jul 14 2021 Guenther Deschner - 4.14.6-1 -- Build with pcp-pmda support by default on Fedora -- resolves: #1552276 - -* Tue Jul 13 2021 Guenther Deschner - 4.14.6-0 -- Update to Samba 4.14.6 -- resolves: #1981764 - -* Thu Jun 24 2021 Andreas Schneider - 4.14.5-3 -- Create a subpackage for vfs-io-uring - -* Fri Jun 04 2021 Python Maint - 2:4.14.5-1 -- Rebuilt for Python 3.10 - -* Tue Jun 01 2021 Guenther Deschner - 4.14.5-0 -- Update to Samba 4.14.5 -- resolves: #1966456 - -* Fri May 21 2021 Jitka Plesnikova - 2:4.14.4-3 -- Perl 5.34 rebuild - -* Wed May 19 2021 Pete Walter - 2:4.14.4-2 -- Rebuild for ICU 69 - -* Tue May 18 2021 Andreas Schneider - 4.14.4-1 -- Fixed building with gcc 11.x -- Fixed quota support - -* Thu Apr 29 2021 Guenther Deschner - 4.14.4-0 -- Update to Samba 4.14.4 -- resolves: #1949442, #1955027 - Security fixes for CVE-2021-20254 -- resolves: #1955011 - -* Wed Apr 28 2021 Anoop C S - 4.14.3-2 -- resolves: #1954263 - wrong conditional build check of AD DC - -* Tue Apr 20 2021 Andreas Schneider - 4.14.3-1 -- resolves: #1942378 - Drop NIS support - -* Tue Apr 20 2021 Guenther Deschner - 4.14.3-0 -- Update to Samba 4.14.3 -- resolves: #1951531 - -* Mon Apr 19 2021 Michal Ambroz - 4.14.2-4 - - Added python3-ldb to BR - -* Mon Apr 19 2021 Andreas Schneider - 4.12.2-3 -- resolves: #1949295 - Remove findsmb script - -* Wed Apr 14 2021 Richard W.M. Jones - 2:4.14.2-2 -- Rebuild for updated liburing. - -* Wed Apr 07 2021 Alexander Bokovoy - 4.14.2-1 -- Fix memory leaks in RPC server -- resolves: #1946950 - -* Thu Mar 25 2021 Guenther Deschner - 4.14.2-0 -- Update to Samba 4.14.2 -- related: #1941400, #1942496 - Security fixes for CVE-2020-27840 -- related: #1941402, #1942497 - Security fixes for CVE-2021-20277 - -* Wed Mar 24 2021 Guenther Deschner - 4.14.1-0 -- Update to Samba 4.14.1 -- resolves: #1941400, #1942496 - Security fixes for CVE-2020-27840 -- resolves: #1941402, #1942497 - Security fixes for CVE-2021-20277 - -* Tue Mar 09 2021 Guenther Deschner - 4.14.0-3 -- Update to Samba 4.14.0 - -* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 2:4.14.0-0.0.rc4.2 -- Rebuilt for updated systemd-rpm-macros - See https://pagure.io/fesco/issue/2583. - -* Mon Mar 01 2021 Guenther Deschner - 4.14.0rc4-0 -- Update to Samba 4.14.0rc4 - -* Thu Feb 18 2021 Guenther Deschner - 4.14.0rc3-0 -- Update to Samba 4.14.0rc3 - -* Thu Feb 04 2021 Guenther Deschner - 4.14.0rc2-0 -- Update to Samba 4.14.0rc2 - -* Wed Jan 27 2021 Guenther Deschner - 4.14.0rc1-0 -- Update to Samba 4.14.0rc1 - -* Tue Jan 26 2021 Guenther Deschner - 4.13.4-0 -- Update to Samba 4.13.4 - -* Wed Dec 16 2020 Guenther Deschner - 4.13.3-1 -- Rebuild against krb5-1.19 -- Resolves: rhbz#1915928 - -* Tue Dec 15 2020 Guenther Deschner - 4.13.3-0 -- Update to Samba 4.13.3 - -* Wed Nov 25 2020 Alexander Bokovoy - 4.13.2-2 -- rhbz#1892745, rhbz#1900232: smbclient mget crashes (upstream bug 14517) -- Merge RHEL 8.4 patches: - - FIPS-related enhancements - - FreeIPA Global Catalog patches - -* Tue Nov 03 2020 Andreas Schneider - 4.13.2-1 -- Create a python3-samba-devel package to avoid unnessary dependencies - -* Tue Nov 03 2020 Guenther Deschner - 4.13.2-0 -- Update to Samba 4.13.2 - -* Thu Oct 29 2020 Guenther Deschner - 4.13.1-0 -- Update to Samba 4.13.1 -- resolves: #1892631, #1892634 - Security fixes for CVE-2020-14318 -- resolves: #1891685, #1892628 - Security fixes for CVE-2020-14323 -- resolves: #1892636, #1892640 - Security fixes for CVE-2020-14383 - -* Mon Oct 26 2020 Andreas Schneider - 4.13.0-14 -- Fixed dbcheck running in a release tarball -- Updated internal resolv_wrapper copy to verison 1.1.7 - -* Sun Oct 25 2020 Alexander Bokovoy - 4.13.0-13 -- Report 'samba' daemon status back to systemd -- Support dnspython 2.0.0 or later in samba_dnsupdate - -* Thu Oct 22 2020 Alexander Bokovoy - 4.13.0-12 -- Add preliminary support for S4U operations in Samba AD DC - resolves: #1836630 - Samba DC: Remote Desktop cannot access files -- Fix lookup_unix_user_name to allow lookup of realm-qualified users and groups - required for upcoming FreeIPA Global Catalog support - -* Tue Sep 22 2020 Guenther Deschner - 4.13.0-11 -- Update to Samba 4.13.0 - -* Fri Sep 18 2020 Guenther Deschner - 4.13.0rc6-10 -- Update to Samba 4.13.0rc6 -- resolves: #1879822, #1880703 - Security fixes for CVE-2020-1472 - -* Wed Sep 16 2020 Guenther Deschner - 4.13.0rc5-9 -- Update to Samba 4.13.0rc5 - -* Mon Sep 07 2020 Guenther Deschner - 4.13.0rc4-8 -- Update to Samba 4.13.0rc4 - -* Fri Aug 28 2020 Neal Gompa - 4.13.0rc3-6 -- Enable winexe by default everywhere - -* Fri Aug 28 2020 Guenther Deschner - 4.13.0rc3-5 -- Update to Samba 4.13.0rc3 - -* Fri Aug 14 2020 Guenther Deschner - 4.13.0rc2-4 -- Update to Samba 4.13.0rc2 - -* Wed Aug 12 2020 Andreas Schneider - 4.13.0rc1-3 -- resolves: #1865831 - Add missing /usr/lib64/samba/krb5 directory -- resolves: #1866989 - Remove obsolete python3-crypto dependency - -* Wed Jul 29 2020 Fedora Release Engineering - 2:4.13.0-0.2.rc1.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - -* Tue Jul 14 2020 Tom Stellard - 2:4.13.0-0.2.rc1 -- Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - -* Tue Jul 14 2020 Andreas Schneider - 4.13.0rc1-1 -- Move mdssvc data files to correct package - -* Thu Jul 09 2020 Guenther Deschner - 4.13.0rc1-0 -- Update to Samba 4.13.0rc1 - -* Wed Jul 08 2020 Merlin Mathesius - 4.12.5-1 -- Remove nonexistent --without-winexe option from configure - -* Thu Jul 02 2020 Guenther Deschner - 4.12.5-0 -- Update to Samba 4.12.5 - -* Thu Jul 02 2020 Guenther Deschner - 4.12.4-0 -- Update to Samba 4.12.4 -- resolves: #1849489, #1853255 - Security fixes for CVE-2020-10730 -- resolves: #1849491, #1853256 - Security fixes for CVE-2020-10745 -- resolves: #1849509, #1853276 - Security fixes for CVE-2020-10760 -- resolves: #1851298, #1853259 - Security fixes for CVE-2020-14303 - -* Sat Jun 27 2020 Jitka Plesnikova - 2:4.12.3-1.1 -- Perl 5.32 re-rebuild updated packages - -* Thu Jun 25 2020 Guenther Deschner - 4.12.3-1 -- Add BuildRequires for python3-setuptools - -* Thu Jun 25 2020 Jitka Plesnikova - 2:4.12.3-0.4 -- Perl 5.32 rebuild - -* Tue May 26 2020 Miro Hrončok - 2:4.12.3-0.3 -- Rebuilt for Python 3.9 - -* Tue May 19 2020 Guenther Deschner - 4.12.3-0 -- Update to Samba 4.12.3 - -* Fri May 15 2020 Pete Walter - 2:4.12.2-1.2 -- Rebuild for ICU 67 - -* Wed May 13 2020 Guenther Deschner - 4.12.2-1 -- Add support for building the new experimental io_uring VFS module - -* Tue Apr 28 2020 Guenther Deschner - 4.12.2-0 -- Update to Samba 4.12.2 -- resolves: #1825731, #1828870 - Security fixes for CVE-2020-10700 -- resolves: #1825734, #1828872 - Security fixes for CVE-2020-10704 - -* Sun Apr 12 2020 Alexander Bokovoy - 4.12.1-1 -- Revert POSIX stat tuning in libsmbclient -- Resolves: rhbz#1801442 - -* Tue Apr 07 2020 Guenther Deschner - 4.12.1-0 -- Update to Samba 4.12.1 - -* Sat Mar 21 2020 Alexander Bokovoy - 4.12.0-6 -- Fix samba_requires_eq macro definition -- Resolves rhbz#1815739 - -* Tue Mar 10 2020 Guenther Deschner - 4.12.0-5 -- Add build requirement for perl-FindBin -- resolves: #1661213 - Add winexe subpackage for remote windows command execution - -* Tue Mar 03 2020 Guenther Deschner - 4.12.0-3 -- Update to Samba 4.12.0 - -* Wed Feb 26 2020 Guenther Deschner - 4.12.0rc4-2 -- Update to Samba 4.12.0rc4 - -* Wed Feb 19 2020 Guenther Deschner - 4.12.0rc3-2 -- Update to Samba 4.12.0rc3 - -* Tue Feb 04 2020 Guenther Deschner - 4.12.0rc2-2 -- Update to Samba 4.12.0rc2 - -* Thu Jan 30 2020 Fedora Release Engineering - 2:4.12.0-0.1.rc1.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - -* Fri Jan 24 2020 Alexander Bokovoy - 4.12.0.rc1-1 -- Allow building against krb5 1.18 beta and require it for Rawhide - -* Wed Jan 22 2020 Guenther Deschner - 4.12.0rc1-0 -- Update to Samba 4.12.0rc1 - -* Tue Jan 21 2020 Guenther Deschner - 4.11.5-0 -- Update to Samba 4.11.5 -- resolves: #1791201, #1793405 - Security fixes for CVE-2019-14902 -- resolves: #1791207, #1793407 - Security fixes for CVE-2019-14907 -- resolves: #1791204, #1793406 - Security fixes for CVE-2019-19344 - -* Mon Dec 16 2019 Guenther Deschner - 4.11.4-0 -- Update to Samba 4.11.4 - -* Tue Dec 10 2019 Guenther Deschner - 4.11.3-0 -- Update to Samba 4.11.3 -- resolves: #1778586, #1781542 - Security fixes for CVE-2019-14861 -- resolves: #1778589, #1781545 - Security fixes for CVE-2019-14870 - -* Thu Dec 05 2019 Andreas Schneider - 4.11.2-2 -- Restart winbindd on samba-winbind package upgrade - -* Wed Nov 06 2019 Alexander Bokovoy - 4.11.2-1 -- Update DES removal patch - -* Tue Oct 29 2019 Guenther Deschner - 4.11.2-0 -- Update to Samba 4.11.2 -- resolves: #1763137, #1766558 - Security fixes for CVE-2019-10218 -- resolves: #1764126, #1766559 - Security fixes for CVE-2019-14833 - -* Sun Oct 27 2019 Alexander Bokovoy - 4.11.1-1 -- resolves: #1757071 - Deploy new samba DC fails - -* Fri Oct 18 2019 Guenther Deschner - 4.11.1-0 -- Update to Samba 4.11.1 - -* Tue Sep 17 2019 Guenther Deschner - 4.11.0-3 -- Update to Samba 4.11.0 - -* Wed Sep 11 2019 Guenther Deschner - 4.11.0rc4-2 -- Update to Samba 4.11.0rc4 - -* Tue Sep 03 2019 Guenther Deschner - 4.11.0rc3-2 -- Update to Samba 4.11.0rc3 -- resolves: #1746225, #1748308 - Security fixes for CVE-2019-10197 - -* Tue Aug 27 2019 Guenther Deschner - 4.11.0rc2-2 -- resolves: #1746014 - re-add pidl - -* Mon Aug 26 2019 Lubomir Rintel - 2:4.11.0-0.1.rc2 -- Move the NetworkManager dispatcher script out of /etc - -* Wed Aug 21 2019 Guenther Deschner - 4.11.0rc2-0 -- Update to Samba 4.11.0rc2 - -* Tue Aug 20 2019 Guenther Deschner - 4.11.0rc1-0 -- Update to Samba 4.11.0rc1 - -* Mon Aug 19 2019 Miro Hrončok - 2:4.10.6-1.1 -- Rebuilt for Python 3.8 - -* Fri Aug 16 2019 Alexander Bokovoy - 2:4.10.6-1 -- Fix Samba bug https://bugzilla.samba.org/show_bug.cgi?id=14091 -- Fixes: Windows systems cannot resolve IPA users and groups over LSA RPC - -* Fri Jul 26 2019 Fedora Release Engineering - 2:4.10.6-0.2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild - -* Mon Jul 08 2019 Guenther Deschner - 4.10.6-0 -- Update to Samba 4.10.6 - -* Mon Jul 01 2019 Guenther Deschner - 4.10.5-2 -- resolves: #1718113 - Avoid deprecated time.clock in wafsamba -- resolves: #1711638 - Update to latest waf version 2.0.17 - -* Thu Jun 20 2019 Guenther Deschner - 4.10.5-1 -- resolves: #1602824 - Make vfs_fruit operable with other remote VFS modules -- resolves: #1716455 - Avoid pathconf() in get_real_filename() VFS calls -- resolves: #1706090, #1700791 - Fix smbspool - -* Wed Jun 19 2019 Guenther Deschner - 4.10.5-0 -- Update to Samba 4.10.5 -- resolves: #1711816, #1721872 - Security fixes for CVE-2019-12435 -- resolves: #1711837, #1721873 - Security fixes for CVE-2019-12436 - -* Fri May 31 2019 Jitka Plesnikova - 2:4.10.4-1.1 -- Perl 5.30 rebuild - -* Tue May 28 2019 Guenther Deschner - 4.10.4-1 -- Add missing ctdb directories -- resolves: #1656777 - -* Wed May 22 2019 Guenther Deschner - 4.10.4-0 -- Update to Samba 4.10.4 - -* Tue May 14 2019 Guenther Deschner - 4.10.3-0 -- Update to Samba 4.10.3 -- resolves: #1705877, #1709679 - Security fixes for CVE-2018-16860 - -* Mon Apr 15 2019 Andreas Schneider - 4.10.2-1 -- resolves: #1699230 - Rebuild for MIT Kerberos soname bump of libkadm5srv - -* Mon Apr 08 2019 Guenther Deschner - 4.10.2-0 -- Update to Samba 4.10.2 -- resolves: #1689010, #1697718 - Security fixes for CVE-2019-3870 -- resolves: #1691518, #1697717 - Security fixes for CVE-2019-3880 - -* Wed Apr 03 2019 Guenther Deschner - 4.10.1-0 -- Update to Samba 4.10.1 - -* Mon Mar 25 2019 Andreas Schneider - 4.10.0-6 -- resolves: #1692347 - Add missing DC requirement for its python3 tools - -* Wed Mar 20 2019 Guenther Deschner - 4.10.0-5 -- Fix build failure (duplication during install) - -* Tue Mar 19 2019 Guenther Deschner - 4.10.0-4 -- Update to Samba 4.10.0 - -* Wed Mar 06 2019 Guenther Deschner - 4.10.0rc4-2 -- Update to Samba 4.10.0rc4 - -* Fri Feb 22 2019 Guenther Deschner - 4.10.0rc3-2 -- Update to Samba 4.10.0rc3 - -* Sun Feb 17 2019 Igor Gnatenko - 2:4.10.0-0.2.rc2.1 -- Rebuild for readline 8.0 - -* Thu Feb 14 2019 Andreas Schneider - 4.10.0rc2-2 -- resolves: #1672231 - Fix public NDR API - -* Tue Feb 12 2019 Guenther Deschner - 4.10.0rc2-1 -- resolves: #1674547 - Move samba.xattr modules out of python3 test package - -* Wed Feb 06 2019 Guenther Deschner - 4.10.0rc2-0 -- Update to Samba 4.10.0rc2 - -* Tue Jan 15 2019 Guenther Deschner - 4.10.0rc1-0 -- Update to Samba 4.10.0rc1 - -* Mon Jan 14 2019 Björn Esser - 2:4.9.4-0.1 -- Rebuilt for libcrypt.so.2 (#1666033) - -* Thu Dec 20 2018 Guenther Deschner - 4.9.4-0 -- Update to Samba 4.9.4 - -* Tue Nov 27 2018 Guenther Deschner - 4.9.3-0 -- Update to Samba 4.9.3 -- resolves: #1625449, #1654078 - Security fixes for CVE-2018-14629 -- resolves: #1642545, #1654082 - Security fixes for CVE-2018-16841 -- resolves: #1646377, #1654091 - Security fixes for CVE-2018-16851 -- resolves: #1646386, #1654092 - Security fixes for CVE-2018-16852 -- resolves: #1647246, #1654093 - Security fixes for CVE-2018-16853 -- resolves: #1649278, #1654095 - Security fixes for CVE-2018-16857 - -* Thu Nov 08 2018 Guenther Deschner - 4.9.2-0 -- Update to Samba 4.9.2 - -* Wed Sep 26 2018 Alexander Bokovoy - 4.9.1-2 -- Package ctdb/doc/examples - -* Mon Sep 24 2018 Andreas Schneider - 4.9.1-1 -- Update to Samba 4.9.1 - -* Thu Sep 13 2018 Guenther Deschner - 4.9.0-4 -- Update to Samba 4.9.0 - -* Thu Sep 06 2018 Andreas Schneider - 4.9.0rc5-3 -- Update to Samba 4.9.0rc5 - -* Wed Aug 29 2018 Guenther Deschner - 4.9.0rc4-3 -- Update to Samba 4.9.0rc4 - -* Thu Aug 16 2018 Andreas Schneider - 4.9.0rc3-3 -- Fix python3 packaging - -* Wed Aug 15 2018 Guenther Deschner - 4.9.0rc3-2 -- Update to Samba 4.9.0rc3 -- resolves: #1589651, #1617916 - Security fixes for CVE-2018-1139 -- resolves: #1580230, #1618613 - Security fixes for CVE-2018-1140 -- resolves: #1612805, #1618697 - Security fixes for CVE-2018-10858 -- resolves: #1610640, #1617910 - Security fixes for CVE-2018-10918 -- resolves: #1610645, #1617911 - Security fixes for CVE-2018-10919 - -* Wed Aug 01 2018 Andreas Schneider - 4.9.0rc2-2 -- Add some spec file cleanups - -* Wed Aug 01 2018 Guenther Deschner - 4.9.0rc2-0 -- Update to Samba 4.9.0rc2 - -* Thu Jul 12 2018 Guenther Deschner - 4.9.0rc1-0 -- Update to Samba 4.9.0rc1 - -* Thu Jul 12 2018 Alexander Bokovoy - 2:4.8.3-4.1 -- Scope to local __bss_start symbol (typo in a patch) -- Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1600035 - -* Thu Jul 12 2018 Alexander Bokovoy - 2:4.8.3-4 -- Change scope to local for symbols automatically added by upcoming binutils 2.31 -- Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1600035 - -* Wed Jul 11 2018 Alexander Bokovoy - 2:4.8.3-3 -- Rebuild Samba against binutils 2.30.90-2.fc29 -- Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1600035 -- Add explicit BuildRequires for gcc - -* Fri Jul 06 2018 Petr Pisar -- Perl 5.28 rebuild - -* Thu Jul 05 2018 Alexander Bokovoy - 2:4.8.3-2 -- Fix rawhide build by explicitly using /usr/bin/python2 - -* Tue Jul 03 2018 Petr Pisar -- Perl 5.28 rebuild - -* Mon Jul 02 2018 Miro Hrončok - 2:4.8.3-1.2 -- Rebuilt for Python 3.7 - -* Thu Jun 28 2018 Jitka Plesnikova - 2:4.8.3-1.1 -- Perl 5.28 rebuild - -* Tue Jun 26 2018 Andreas Schneider - 4.8.3-1 -- Update to Samba 4.8.3 -- Remove python(2|3)-subunit dependency - -* Tue Jun 19 2018 Miro Hrončok - 2:4.8.2-1.1 -- Rebuilt for Python 3.7 - -* Wed May 16 2018 Guenther Deschner - 4.8.2-0 -- Update to Samba 4.8.2 - -* Wed May 09 2018 Andreas Schneider - 4.8.1-1 -- resolves: #1574177 - Fix smbspool command line argument handling - -* Thu Apr 26 2018 Guenther Deschner - 4.8.1-0 -- Update to Samba 4.8.1 - -* Wed Mar 14 2018 Guenther Deschner - 4.8.0-7 -- resolves: #1554754, #1554756 - Security fixes for CVE-2018-1050 CVE-2018-1057 -- resolves: #1555112 - Update to Samba 4.8.0 - -* Tue Mar 13 2018 Andreas Schneider - 4.8.0rc4-6 -- resolves: #1552652 - Fix usage of nc in ctdb tests and only recommned it - -* Fri Mar 02 2018 Guenther Deschner - 4.8.0rc4-5 -- Update to Samba 4.8.0rc4 - -* Mon Feb 12 2018 Guenther Deschner - 4.8.0rc3-4 -- Update to Samba 4.8.0rc3 - -* Fri Feb 09 2018 Igor Gnatenko - 2:4.8.0-0.3.rc2.1 -- Escape macros in %%changelog - -* Fri Jan 26 2018 Guenther Deschner - 4.8.0rc2-3 -- Update to Samba 4.8.0rc2 - -* Sun Jan 21 2018 Björn Esser - 2:4.8.0-0.2.rc1 -- Explicitly BR: rpcsvc-proto-devel - -* Sat Jan 20 2018 Björn Esser - 2:4.8.0-0.1.rc1.1 -- Rebuilt for switch to libxcrypt - -* Mon Jan 15 2018 Guenther Deschner - 4.8.0rc1-1 -- Update to Samba 4.8.0rc1 - -* Mon Jan 08 2018 Andreas Schneider - 4.7.4-1 -- resolves: #1508092 - Add missing dependency for tdbbackup - -* Mon Dec 25 2017 Guenther Deschner - 4.7.4-0 -- Update to Samba 4.7.4 - -* Mon Dec 04 2017 Andreas Schneider - 4.7.3-3 -- resolves: #1520163 - Link libaesni-intel-samba4.so with -z noexecstack - -* Thu Nov 30 2017 Andreas Schneider - 4.7.3-2 -- Fix deamon startup with systemd - -* Thu Nov 23 2017 Bastien Nocera - 4.7.3-1 -- Enable AES acceleration on Intel compatible CPUs by default - -* Tue Nov 21 2017 Guenther Deschner - 4.7.3-0 -- Update to Samba 4.7.3 -- resolves: #1515692 - Security fix for CVE-2017-14746 and CVE-2017-15275 - -* Wed Nov 15 2017 Guenther Deschner - 4.7.2-0 -- resolves: #1513452 - Update to Samba 4.7.2 - -* Mon Nov 13 2017 Andreas Schneider - 4.7.1-2 -- Fix release number - -* Tue Nov 07 2017 Igor Gnatenko - 4.7.1-1 -- Remove old crufty coreutils requires - -* Thu Nov 02 2017 Guenther Deschner - 4.7.1-0 -- resolves: #1508871 - Update to Samba 4.7.1 - -* Mon Oct 30 2017 Alexander Bokovoy - 4.7.0-18 -- Force samba-dc to use the same libldb version as LDB modules compiled -- resolves: #1507420 - LDB / Samba module version mismatch - -* Fri Oct 27 2017 Andreas Schneider - 4.7.0-17 -- Move dsdb libs to python2-samba-dc - -* Thu Oct 26 2017 Andreas Schneider - 4.7.0-16 -- Create python[2|3]-samba-dc packages - -* Wed Oct 25 2017 Andreas Schneider - 4.7.0-15 -- related: #1499140 - Fix several dependency issues -- Fix building with MIT Kerberos 1.16 - -* Fri Oct 13 2017 Andreas Schneider - 4.7.0-14 -- resolves: #1499140 - Move libdfs-server-ad to the correct subpackage - -* Fri Oct 06 2017 Alexander Bokovoy - 4.7.0-13 -- Move /usr/lib{64,}/samba/libdsdb-garbage-collect-tombstones-samba4.so to samba-dc-libs -- Rebuild in rawhide against new krb5 1.16 and docbook-xml - -* Thu Sep 21 2017 Guenther Deschner - 4.7.0-12 -- Update to Samba 4.7.0 -- resolves: #1493441 - Security fix for CVE-2017-12150 CVE-2017-12151 CVE-2017-12163 - -* Sun Sep 17 2017 Guenther Deschner - 4.7.0-0.11.rc6 -- Update to Samba 4.7.0rc6 - -* Wed Sep 13 2017 Alexander Bokovoy - 4.7.0-0.11.rc5 -- resolves: #1491137 - dcerpc/__init__.py is not packaged for py3 - -* Tue Sep 12 2017 Andreas Schneider - 4.7.0-0.10.rc5 -- resolves: #1476175 - Create seperate package for bind_dlz module - -* Tue Aug 29 2017 Guenther Deschner - 4.7.0-0.9.rc5 -- Update to Samba 4.7.0rc5 - -* Tue Aug 08 2017 Andreas Schneider - 4.7.0-0.9.rc3 -- Add printadmin group for printer driver handling - -* Sun Jul 30 2017 Florian Weimer - 2:4.7.0-0.8.rc3.2 -- Rebuild with binutils fix for ppc64le (#1475636) - -* Thu Jul 27 2017 Fedora Release Engineering - 2:4.7.0-0.8.rc3.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild - -* Wed Jul 26 2017 Andreas Schneider - 4.7.0-0.8.rc3 -- resolves: #1301002 - Enable avahi support - -* Tue Jul 25 2017 Guenther Deschner - 4.7.0-0.7.rc3 -- Update to Samba 4.7.0rc3 - -* Mon Jul 24 2017 Andreas Schneider - 4.7.0-0.7.rc1 -- Rename samba-python to python2-samba -- Update build requirement for libcephfs - -* Thu Jul 20 2017 Alexander Bokovoy - 4.7.0-0.6.rc1 -- Use Python 2 explicitly for samba-tool and other Python-based tools -- Install samba.service as it is required for the AD DC case - -* Tue Jul 18 2017 Alexander Bokovoy - 4.7.0-0.5.rc1 -- Convert more rpc modules to python3 -- Explicitly specify Python artifacts in the spec to be able to catch unpackaged ones -- Split 'make test' Python code into separate python2-samba-test/python3-samba-test sub-packages -- Remove embedded python2-dns version, require python{2,3}-dns instead - -* Thu Jul 06 2017 Andreas Schneider - 4.7.0-0.4.rc1 -- Add python3 support -- Fix %%posttrans for libwbclient-devel - -* Thu Jul 06 2017 Andreas Schneider - 4.7.0-0.3.rc1 -- Do not install conflicting file _ldb_text.py - -* Wed Jul 05 2017 Andreas Schneider - 4.7.0-0.2.rc1 -- Fix requirement generation for shared libraries - -* Wed Jul 05 2017 Andreas Schneider - 4.7.0-0.1.rc1 -- Build Samba with Active Directory support! - -* Mon Jun 12 2017 Guenther Deschner - 4.7.0-0.0.rc1 -- Update to Samba 4.7.0rc1 - -* Mon Jun 12 2017 Guenther Deschner - 4.6.5-0 -- Update to Samba 4.6.5 - -* Sun Jun 04 2017 Jitka Plesnikova - 2:4.6.4-1.1 -- Perl 5.26 rebuild - -* Wed May 24 2017 Andreas Schneider - 4.6.4-1 -- #resolves: #1451486 - Add source tarball comment - -* Wed May 24 2017 Guenther Deschner - 4.6.4-0 -- Update to Samba 4.6.4 -- resolves: #1455050 - Security fix for CVE-2017-7494 - -* Tue Apr 25 2017 Guenther Deschner - 4.6.3-0 -- Update to Samba 4.6.3 - -* Fri Mar 31 2017 Guenther Deschner - 4.6.2-0 -- Update to Samba 4.6.2 -- related: #1435156 - Security fix for CVE-2017-2619 - -* Thu Mar 23 2017 Guenther Deschner - 4.6.1-0 -- Update to Samba 4.6.1 -- resolves: #1435156 - Security fix for CVE-2017-2619 - -* Wed Mar 15 2017 Alexander Bokovoy - 4.6.0-4 -- Export arcfour_crypt_blob to Python as samba.crypto.arcfour_encrypt -- Makes possible to run trust to AD in FreeIPA in FIPS mode - -* Fri Mar 10 2017 Alexander Bokovoy - 4.6.0-3 -- auth/credentials: Always set the the realm if we set the principal from the ccache -- resolves: #1430761 - credentials_crb5: use gss_acquire_cred for client-side GSSAPI use case - -* Thu Mar 09 2017 Alexander Bokovoy - 4.6.0-2 -- resolves: #1430761 - credentials_krb5: use gss_acquire_cred for client-side GSSAPI use case - -* Tue Mar 07 2017 Andreas Schneider - 4.6.0-1 -- Update to Samba 4.6.0 - -* Wed Mar 01 2017 Andreas Schneider - 4.6.0-0.3.rc4 -- Update to Samba 4.6.0rc4 - -* Tue Feb 14 2017 Andreas Schneider - 4.6.0-0.1.rc3 -- Update to Samba 4.6.0rc3 - -* Sat Feb 11 2017 Fedora Release Engineering - 4.6.0-0.1.rc2.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild - -* Fri Jan 27 2017 Guenther Deschner - 4.6.0-0.1.rc2 -- Update to Samba 4.6.0rc2 - -* Thu Jan 12 2017 Andreas Schneider - 4.6.0-0.1.rc1 -- resolves: #1319098 - Add missing Requires for pre-required packages - -* Thu Jan 05 2017 Guenther Deschner - 4.6.0-0.1.rc1 -- Update to Samba 4.6.0rc1 - -* Mon Dec 19 2016 Guenther Deschner - 4.5.3-0 -- Update to Samba 4.5.3 -- resolves: #1405984 - CVE-2016-2123,CVE-2016-2125 and CVE-2016-2126 - -* Wed Dec 07 2016 Guenther Deschner - 4.5.2-0 -- Update to Samba 4.5.2 - -* Mon Dec 05 2016 Rex Dieter - - -- rebuild (libldb) - -* Fri Nov 04 2016 Anoop C S - 4.5.1-1 -- Fix glfs_realpath allocation in vfs_glusterfs - -* Wed Oct 26 2016 Guenther Deschner - 4.5.1-0 -- Update to Samba 4.5.1 - -* Mon Oct 17 2016 Andreas Schneider - 4.5.0-3 -- resolves: 1375973 - Fix tevent incompatibility issue - -* Wed Sep 14 2016 Guenther Deschner - 4.5.0-2 -- Fix smbspool alternatives handling during samba-client uninstall - -* Wed Sep 07 2016 Guenther Deschner - 4.5.0-1 -- Update to Samba 4.5.0 - -* Mon Aug 29 2016 Guenther Deschner - 4.5.0rc3-0 -- Update to Samba 4.5.0rc3 - -* Mon Aug 15 2016 Guenther Deschner - 4.5.0rc2-0 -- Update to Samba 4.5.0rc2 - -* Thu Jul 28 2016 Guenther Deschner - 4.5.0rc1-0 -- Update to Samba 4.5.0rc1 - -* Tue Jul 19 2016 Fedora Release Engineering - 2:4.4.5-1.1 -- https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages - -* Thu Jul 07 2016 Guenther Deschner - 4.4.5-1 -- Update to Samba 4.4.5 -- resolves: #1353504 - CVE-2016-2119 - -* Thu Jun 23 2016 Guenther Deschner - 4.4.4-4 -- resolves: #1348899 - Import of samba.ntacls fails - -* Mon Jun 20 2016 Andreas Schneider - 4.4.4-3 -- resolves: #1337260 - Small fix to the example smb.conf file - -* Wed Jun 15 2016 Andreas Schneider - 4.4.4-2 -- Fix resolving trusted domain users on domain member - -* Tue Jun 07 2016 Guenther Deschner - 4.4.4-1 -- Update to Samba 4.4.4 -- resolves: #1343529 - -* Wed May 25 2016 Alexander Bokovoy - 2:4.4.3-2 -- Fix libsystemd patch (#1125086) so that it actually works - -* Mon May 23 2016 Zbigniew Jędrzejewski-Szmek - 2:4.4.3-1.2 -- Rebuild to drop libsystemd-daemon dependency (#1125086) - -* Sun May 15 2016 Jitka Plesnikova - 2:4.4.3-1.1 -- Perl 5.24 rebuild - -* Mon May 02 2016 Guenther Deschner - 4.4.3-1 -- Update to Samba 4.4.3 -- resolves: #1332178 - -* Tue Apr 12 2016 Guenther Deschner - 4.4.2-1 -- Update to Samba 4.4.2, fix badlock security bug -- resolves: #1326453 - CVE-2015-5370 -- resolves: #1326453 - CVE-2016-2110 -- resolves: #1326453 - CVE-2016-2111 -- resolves: #1326453 - CVE-2016-2112 -- resolves: #1326453 - CVE-2016-2113 -- resolves: #1326453 - CVE-2016-2114 -- resolves: #1326453 - CVE-2016-2115 -- resolves: #1326453 - CVE-2016-2118 - -* Tue Mar 22 2016 Guenther Deschner - 4.4.0-1 -- Update to Samba 4.4.0 - -* Wed Mar 16 2016 Guenther Deschner - 4.4.0-0.8.rc5 -- Update to Samba 4.4.0rc5 - -* Tue Mar 08 2016 Guenther Deschner - 4.4.0-0.7.rc4 -- Update to Samba 4.4.0rc4 -- resolves: #1315942 - CVE-2015-7560 Incorrect ACL get/set allowed on symlink path - -* Tue Feb 23 2016 Guenther Deschner - 4.4.0-0.6.rc3 -- Update to Samba 4.4.0rc3 - -* Wed Feb 17 2016 Guenther Deschner - 4.4.0-0.5.rc2 -- Activate multi channel support (switched off by default) - -* Mon Feb 15 2016 Andreas Schneider - 4.4.0-0.4.rc2 -- More spec file fixes -- resolves: #1306542 - scriptlet failure because of comments - -* Mon Feb 15 2016 Andreas Schneider - 4.4.0-0.3.rc2 -- More spec file fixes - -* Mon Feb 15 2016 Andreas Schneider - 4.4.0-0.2.rc2 -- More spec file fixes - -* Wed Feb 10 2016 Guenther Deschner - 4.4.0-0.1.rc2 -- Update to Samba 4.4.0rc2 - -* Thu Feb 04 2016 Fedora Release Engineering - 2:4.4.0-0.1.rc1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild - -* Wed Jan 27 2016 Guenther Deschner - 4.4.0-0.0.rc1 -- Update to Samba 4.4.0rc1 - -* Fri Jan 22 2016 Alexander Bokovoy - 4.3.4-1 -- resolves: #1300038 - PANIC: Bad talloc magic value - wrong talloc version used/mixed - -* Tue Jan 12 2016 Guenther Deschner - 4.3.4-0 -- resolves: #1261230 - Update to Samba 4.3.4 - -* Wed Dec 16 2015 Guenther Deschner - 4.3.3-0 -- Update to Samba 4.3.3 -- resolves: #1292069 -- CVE-2015-3223 Remote DoS in Samba (AD) LDAP server -- CVE-2015-5252 Insufficient symlink verification in smbd -- CVE-2015-5296 Samba client requesting encryption vulnerable to - downgrade attack -- CVE-2015-5299 Missing access control check in shadow copy code -- CVE-2015-7540 DoS to AD-DC due to insufficient checking of asn1 - memory allocation - -* Tue Dec 15 2015 Guenther Deschner - 4.3.2-2 -- revert dependencies to samba-common and -tools - -* Tue Dec 01 2015 Guenther Deschner - 4.3.2-1 -- resolves: #1261230 - Update to Samba 4.3.2 - -* Wed Nov 18 2015 Guenther Deschner - 4.3.1-3 -- resolves: #1282931 - Fix DCE/RPC bind nak parsing - -* Fri Oct 23 2015 Guenther Deschner - 4.3.1-2 -- Fix dependencies to samba-common - -* Tue Oct 20 2015 Guenther Deschner - 4.3.1-1 -- resolves: #1261230 - Update to Samba 4.3.1 - -* Mon Oct 12 2015 Guenther Deschner - 4.3.0-3 -- Use separate lockdir - -* Mon Oct 12 2015 Guenther Deschner - 4.3.0-2 -- resolves: #1270568 - Samba fails to start after update to 4.3.0 - -* Tue Sep 08 2015 Guenther Deschner - 4.3.0-1 -- resolves: #1088911 - Update to Samba 4.3.0 - -* Tue Sep 01 2015 Andreas Schneider - 4.3.0-0.1rc4 -- Update to Samba 4.3.0rc4 - -* Mon Aug 31 2015 Andreas Schneider - 4.3.0-0.1rc3 -- Update to Samba 4.3.0rc3 - -* Tue Jul 14 2015 Guenther Deschner - 4.2.3-0 -- resolves: #1088911 - Update to Samba 4.2.3 - -* Fri Jun 19 2015 Andreas Schneider - 4.2.2-1 -- resolves: #1227911 - Enable tar support for smbclient -- resolves: #1234908 - Own the /var/lib/samba directory -- Enable hardened build - -* Fri Jun 19 2015 Fedora Release Engineering - 2:4.2.2-0.2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild - -* Thu Jun 04 2015 Jitka Plesnikova - 2:4.2.2-0.1 -- Perl 5.22 rebuild - -* Thu May 28 2015 Guenther Deschner - 4.2.2-0 -- Update to Samba 4.2.2 - -* Mon May 11 2015 Alexander Bokovoy - 4.2.1-8 -- Fixes: #1219832: Samba 4.2 broke FreeIPA trusts to AD -- Remove usage of deprecated API from gnutls - -* Thu Apr 30 2015 Alexander Bokovoy - 4.2.1-7 -- Fix LSASD daemon -- resolves: #1217346 - FreeIPA trusts to AD broken due to Samba 4.2 failure to run LSARPC pipe externally - -* Mon Apr 27 2015 Alexander Bokovoy - 4.2.1-6 -- Remove samba-common-tools from samba-client package as it brings back Python 2.7 - -* Mon Apr 27 2015 Alexander Bokovoy - 4.2.1-5 -- Require samba-common-tools in samba package -- Require samba-common-tools in samba-client package -- resolves: #1215631 - /usr/bin/net moved to samba-common-tools but the package is not required by samba - -* Sat Apr 25 2015 Alexander Bokovoy - 4.2.1-4 -- Fix systemd library detection (incomplete patch upstream) - -* Fri Apr 24 2015 Andreas Schneider - 4.2.1-3 -- resolves: #1214973 - Fix libwbclient alternatives link. - -* Wed Apr 22 2015 Guenther Deschner - 4.2.1-2 -- Add vfs snapper module. - -* Tue Apr 21 2015 Andreas Schneider - 4.2.1-1 -- Update to Samba 4.2.1 -- resolves: #1213373 - Fix DEBUG macro issues in public headers - -* Wed Apr 08 2015 Andreas Schneider - 4.2.0-3 -- resolves: #1207381 - Fix libsystemd detection. - -* Tue Mar 10 2015 Andreas Schneider - 4.2.0-2 -- Fix the AD build. -- Create samba-client-libs subpackage. -- Fix multiarch issues by splitting the samba-common package. - -* Thu Mar 05 2015 Guenther Deschner - 4.2.0-1 -- Update to Samba 4.2.0 - -* Tue Mar 03 2015 Andreas Schneider - 4.2.0-0.5.rc5 -- Update to Samba 4.2.0rc5 - -* Fri Jan 16 2015 - Andreas Schneider - 4.2.0-0.4.rc4 -- Update to Samba 4.2.0rc4 -- resolves: #1154600 - Install missing samba pam.d configuration file. - -* Mon Jan 12 2015 Guenther Deschner - 4.2.0-0.6.rc3 -- Fix awk as a dependency (and require gawk) - -* Mon Jan 12 2015 Michael Adam - 4.2.0-0.5.rc3 -- Add dependencies for ctdb. - -* Fri Jan 09 2015 Stephen Gallagher 4.2.0-0.4.rc3 -- Apply the DEBUG patch - -* Fri Jan 09 2015 Andreas Schneider - 4.2.0-0.3.rc3 -- Fix issues with conflicting DEBUG macros. - -* Tue Jan 06 2015 Michael Adam - 4.2.0-0.2.rc3 -- Improve dependencies of vfs-glusterfs and vfs-cephfs. -- Remove unused python_libdir. -- Fix malformed changelog entries. - -* Tue Jan 06 2015 Guenther Deschner - 4.2.0-0.2.rc3 -- Fix ctdb and libcephfs dependencies. - -* Mon Jan 05 2015 Andreas Schneider - 4.2.0-0.1.rc3 -- Update to Samba 4.2.0rc3 - + Samba provides ctdb packages now. - -* Tue Dec 16 2014 Andreas Schneider - 4.2.0-0.3.rc2 -- resolves: #1174412 - Build VFS Ceph module. -- resolves: #1169067 - Move libsamba-cluster-support.so to samba-libs package. -- resolves: #1016122 - Move smbpasswd to samba-common package. - -* Fri Nov 21 2014 Andreas Schneider - 4.2.0-0.2.rc2 -- Use alternatives for libwbclient. -- Add cwrap to BuildRequires. - -* Wed Nov 12 2014 Andreas Schneider - 4.2.0-0.1.rc2 -- Update to Samba 4.2.0rc2. - -* Tue Oct 07 2014 Andreas Schneider - 4.1.12-5 -- resolves: #1033595 - Fix segfault in winbind. - -* Wed Sep 24 2014 Andreas Schneider - 4.1.12-1 -- Update to Samba 4.1.12. - -* Tue Sep 09 2014 Jitka Plesnikova - 2:4.1.11-1.4 -- Perl 5.20 mass - -* Wed Aug 27 2014 Jitka Plesnikova - 2:4.1.11-1.3 -- Perl 5.20 rebuild - -* Wed Aug 20 2014 Kalev Lember - 2:4.1.11-1.2 -- Rebuilt for rpm dependency generator failure (#1131892) - -* Mon Aug 18 2014 Fedora Release Engineering - 0:4.1.11-1.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild - -* Fri Aug 1 2014 Jared Smith - 4.1.11-1 -- Update to upstream Samba 4.1.11 release -- resolves: #1126015 - Fix CVE-2014-3560 - -* Mon Jun 23 2014 Guenther Deschner - 4.1.9-3 -- Update to Samba 4.1.9. -- resolves: #1112251 - Fix CVE-2014-0244 and CVE-2014-3493. - -* Wed Jun 11 2014 Guenther Deschner - 4.1.8-3 -- Update to Samba 4.1.8. -- resolves: #1102528 - CVE-2014-0178. - -* Sun Jun 08 2014 Fedora Release Engineering - 2:4.1.6-3.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild - -* Thu Apr 03 2014 Andreas Schneider - 4.1.6-3 -- Add systemd integration to the service daemons. - -* Tue Mar 18 2014 Andreas Schneider - 4.1.6-2 -- Created a samba-test-libs package. - -* Tue Mar 11 2014 Andreas Schneider - 4.1.6-1 -- Fix CVE-2013-4496 and CVE-2013-6442. -- Fix installation of pidl. - -* Fri Feb 21 2014 Andreas Schneider - 4.1.5-1 -- Update to Samba 4.1.5. - -* Fri Feb 07 2014 Andreas Schneider - 4.1.4-1 -- Update to Samba 4.1.4. - -* Wed Jan 08 2014 Andreas Schneider - 4.1.3-3 -- resolves: #1042845 - Do not build with libbsd. - -* Tue Dec 10 2013 Guenther Deschner - 4.1.3-2 -- resolves: #1019469 - Fix winbind debug message NULL pointer derreference. - -* Mon Dec 09 2013 Andreas Schneider - 4.1.3-1 -- Update to Samba 4.1.3. -- resolves: #1039454 - CVE-2013-4408. -- resolves: #1039500 - CVE-2012-6150. - -* Mon Nov 25 2013 Andreas Schneider - 4.1.2-1 -- Update to Samba 4.1.2. - -* Mon Nov 18 2013 Guenther Deschner - 4.1.1-3 -- resolves: #948509 - Fix manpage correctness. - -* Fri Nov 15 2013 Andreas Schneider - 4.1.1-2 -- related: #884169 - Fix strict aliasing warnings. - -* Mon Nov 11 2013 Andreas Schneider - 4.1.1-1 -- resolves: #1024544 - Fix CVE-2013-4475. -- Update to Samba 4.1.1. - -* Mon Nov 11 2013 Andreas Schneider - 4.1.0-5 -- related: #884169 - Fix the upgrade path. - -* Wed Oct 30 2013 Andreas Schneider - 4.1.0-4 -- related: #884169 - Add direct dependency to samba-libs in the - glusterfs package. -- resolves: #996567 - Fix userPrincipalName composition. -- related: #884169 - Fix memset call with zero length in in ntdb. - -* Fri Oct 18 2013 Andreas Schneider - 4.1.0-3 -- resolves: #1020329 - Build glusterfs VFS plguin. - -* Tue Oct 15 2013 Andreas Schneider - 4.1.0-2 -- resolves: #1018856 - Fix installation of pam_winbind after upgrade. -- related: #1010722 - Split out a samba-winbind-modules package. -- related: #985609 - -* Fri Oct 11 2013 Andreas Schneider - 4.1.0-1 -- related: #985609 - Update to Samba 4.1.0. - -* Tue Oct 01 2013 Andreas Schneider - 2:4.1.0-0.8 -- related: #985609 - Update to Samba 4.1.0rc4. -- resolves: #1010722 - Split out a samba-winbind-modules package. - -* Wed Sep 11 2013 Andreas Schneider - 2:4.1.0-0.7 -- related: #985609 - Update to Samba 4.1.0rc3. -- resolves: #1005422 - Add support for KEYRING ccache type in pam_winbindd. - -* Wed Sep 04 2013 Andreas Schneider - 2:4.1.0-0.6 -- resolves: #717484 - Enable profiling data support. - -* Thu Aug 22 2013 Guenther Deschner - 2:4.1.0-0.5 -- resolves: #996160 - Fix winbind with trusted domains. - -* Wed Aug 14 2013 Andreas Schneider 2:4.1.0-0.4 -- resolves: #996160 - Fix winbind nbt name lookup segfault. - -* Mon Aug 12 2013 Andreas Schneider - 2:4.1.0-0.3 -- related: #985609 - Update to Samba 4.1.0rc2. - -* Sat Aug 03 2013 Petr Pisar - 2:4.1.0-0.2.rc1.1 -- Perl 5.18 rebuild - -* Wed Jul 24 2013 Andreas Schneider - 2:4.1.0-0.2 -- resolves: #985985 - Fix file conflict between samba and wine. -- resolves: #985107 - Add support for new default location for Kerberos - credential caches. - -* Sat Jul 20 2013 Petr Pisar - 2:4.1.0-0.1.rc1.1 -- Perl 5.18 rebuild - -* Wed Jul 17 2013 Andreas Schneider - 2:4.1.0-0.1 -- Update to Samba 4.1.0rc1. - -* Mon Jul 15 2013 Andreas Schneider - 2:4.0.7-2 -- resolves: #972692 - Build with PIE and full RELRO. -- resolves: #884169 - Add explicit dependencies suggested by rpmdiff. -- resolves: #981033 - Local user's krb5cc deleted by winbind. -- resolves: #984331 - Fix samba-common tmpfiles configuration file in wrong - directory. - -* Wed Jul 03 2013 Andreas Schneider - 2:4.0.7-1 -- Update to Samba 4.0.7. - -* Fri Jun 07 2013 Andreas Schneider - 2:4.0.6-3 -- Add UPN enumeration to passdb internal API (bso #9779). - -* Wed May 22 2013 Andreas Schneider - 2:4.0.6-2 -- resolves: #966130 - Fix build with MIT Kerberos. -- List vfs modules in spec file. - -* Tue May 21 2013 Andreas Schneider - 2:4.0.6-1 -- Update to Samba 4.0.6. -- Remove SWAT. - -* Wed Apr 10 2013 Andreas Schneider - 2:4.0.5-1 -- Update to Samba 4.0.5. -- Add UPN enumeration to passdb internal API (bso #9779). -- resolves: #928947 - samba-doc is obsolete now. -- resolves: #948606 - LogRotate should be optional, and not a hard "Requires". - -* Fri Mar 22 2013 Andreas Schneider - 2:4.0.4-3 -- resolves: #919405 - Fix and improve large_readx handling for broken clients. -- resolves: #924525 - Don't use waf caching. - -* Wed Mar 20 2013 Andreas Schneider - 2:4.0.4-2 -- resolves: #923765 - Improve packaging of README files. - -* Wed Mar 20 2013 Andreas Schneider - 2:4.0.4-1 -- Update to Samba 4.0.4. - -* Mon Mar 11 2013 Andreas Schneider - 2:4.0.3-4 -- resolves: #919333 - Create /run/samba too. - -* Mon Mar 04 2013 Andreas Schneider - 2:4.0.3-3 -- Fix the cache dir to be /var/lib/samba to support upgrades. - -* Thu Feb 14 2013 Andreas Schneider - 2:4.0.3-2 -- resolves: #907915 - libreplace.so => not found - -* Thu Feb 07 2013 Andreas Schneider - 2:4.0.3-1 -- Update to Samba 4.0.3. -- resolves: #907544 - Add unowned directory /usr/lib64/samba. -- resolves: #906517 - Fix pidl code generation with gcc 4.8. -- resolves: #908353 - Fix passdb backend ldapsam as module. - -* Wed Jan 30 2013 Andreas Schneider - 2:4.0.2-1 -- Update to Samba 4.0.2. -- Fixes CVE-2013-0213. -- Fixes CVE-2013-0214. -- resolves: #906002 -- resolves: #905700 -- resolves: #905704 -- Fix conn->share_access which is reset between user switches. -- resolves: #903806 -- Add missing example and make sure we don't introduce perl dependencies. -- resolves: #639470 - -* Wed Jan 16 2013 Andreas Schneider - 2:4.0.1-1 -- Update to Samba 4.0.1. -- Fixes CVE-2013-0172. - -* Mon Dec 17 2012 Andreas Schneider - 2:4.0.0-174 -- Fix typo in winbind-krb-locator post uninstall script. - -* Tue Dec 11 2012 Andreas Schneider - 2:4.0.0-173 -- Update to Samba 4.0.0. - -* Thu Dec 06 2012 Andreas Schneider - 2:4.0.0-171.rc6 -- Fix typo in winbind-krb-locator post uninstall script. - -* Tue Dec 04 2012 Andreas Schneider - 2:4.0.0-170.rc6 -- Update to Samba 4.0.0rc6. -- Add /etc/pam.d/samba for swat to work correctly. -- resolves #882700 - -* Fri Nov 23 2012 Guenther Deschner - 2:4.0.0-169.rc5 -- Make sure ncacn_ip_tcp client code looks for NBT_NAME_SERVER name types. - -* Thu Nov 15 2012 Andreas Schneider - 2:4.0.0-168.rc5 -- Reduce dependencies of samba-devel and create samba-test-devel package. - -* Tue Nov 13 2012 Andreas Schneider - 2:4.0.0-167.rc5 -- Use workaround for winbind default domain only when set. -- Build with old ctdb support. - -* Tue Nov 13 2012 Andreas Schneider - 2:4.0.0-166.rc5 -- Update to Samba 4.0.0rc5. - -* Mon Nov 05 2012 Andreas Schneider - 2:4.0.0-165.rc4 -- Fix library dependencies of libnetapi. - -* Mon Nov 05 2012 Andreas Schneider - 2:4.0.0-164.rc4 -- resolves: #872818 - Fix perl dependencies. - -* Tue Oct 30 2012 Andreas Schneider - 2:4.0.0-163.rc4 -- Update to Samba 4.0.0rc4. - -* Mon Oct 29 2012 Andreas Schneider - 2:4.0.0-162.rc3 -- resolves: #870630 - Fix scriptlets interpeting a comment as argument. - -* Fri Oct 26 2012 Andreas Schneider - 2:4.0.0-161.rc3 -- Add missing Requries for python modules. -- Add NetworkManager dispatcher script for winbind. - -* Fri Oct 19 2012 Andreas Schneider - 2:4.0.0-160.rc3 -- resolves: #867893 - Move /var/log/samba to samba-common package for - winbind which requires it. - -* Thu Oct 18 2012 Andreas Schneider - 2:4.0.0-159.rc3 -- Compile default auth methods into smbd. - -* Tue Oct 16 2012 Andreas Schneider - 2:4.0.0-158.rc3 -- Move pam_winbind.conf and the manpages to the right package. - -* Tue Oct 16 2012 Andreas Schneider - 2:4.0.0-157.rc3 -* resolves: #866959 - Build auth_builtin as static module. - -* Tue Oct 16 2012 Andreas Schneider - 2:4.0.0-156.rc3 -- Update systemd Requires to reflect latest packaging guidelines. - -* Tue Oct 16 2012 Andreas Schneider - 2:4.0.0-155.rc3 -- Add back the AES patches which didn't make it in rc3. - -* Tue Oct 16 2012 Andreas Schneider - 2:4.0.0-154.rc3 -- Update to 4.0.0rc3. -- resolves: #805562 - Unable to share print queues. -- resolves: #863388 - Unable to reload smbd configuration with systemctl. - -* Wed Oct 10 2012 Alexander Bokovoy - 2:4.0.0-153.rc2 -- Use alternatives to configure winbind_krb5_locator.so -- Fix Requires for winbind. - -* Thu Oct 04 2012 Andreas Schneider - 2:4.0.0-152.rc2 -- Add kerberos AES support. -- Fix printing initialization. - -* Tue Oct 02 2012 Andreas Schneider - 2:4.0.0-151.rc2 -- Update to 4.0.0rc2. - -* Wed Sep 26 2012 Andreas Schneider - 2:4.0.0-150.rc1 -- Fix Obsoletes/Provides for update from samba4. -- Bump release number to be bigger than samba4. - -* Wed Sep 26 2012 Andreas Schneider - 2:4.0.0-96.rc1 -- Package smbprint again. - -* Wed Sep 26 2012 Andreas Schneider - 2:4.0.0-95.rc1 -- Update to 4.0.0rc1. - -* Mon Aug 20 2012 Guenther Deschner - 2:3.6.7-94.2 -- Update to 3.6.7 - -* Sat Jul 21 2012 Fedora Release Engineering - 2:3.6.6-93.2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild - -* Thu Jul 19 2012 Guenther Deschner - 2:3.6.6-93 -- Fix printing tdb upgrade for 3.6.6 -- resolves: #841609 - -* Sun Jul 15 2012 Ville Skyttä - 2:3.6.6-92 -- Call ldconfig at libwbclient and -winbind-clients post(un)install time. -- Fix empty localization files, use %%find_lang to find and %%lang-mark them. -- Escape macros in %%changelog. -- Fix source tarball URL. - -* Tue Jun 26 2012 Guenther Deschner - 2:3.6.6-91 -- Update to 3.6.6 - -* Thu Jun 21 2012 Andreas Schneider - 2:3.6.5-90 -- Fix ldonfig. -- Require systemd for samba-common package. -- resolves: #829197 - -* Mon Jun 18 2012 Andreas Schneider - 2:3.6.5-89 -- Fix usrmove paths. -- resolves: #829197 - -* Tue May 15 2012 Andreas Schneider - 2:3.6.5-88 -- Move tmpfiles.d config to common package as it is needed for smbd and - winbind. -- Make sure tmpfiles get created after installation. - -* Wed May 09 2012 Guenther Deschner - 2:3.6.5-87 -- Correctly use system iniparser library - -* Fri May 04 2012 Andreas Schneider - 2:3.6.5-86 -- Bump Epoch to fix a problem with a Samba4 update in testing. - -* Mon Apr 30 2012 Guenther Deschner - 1:3.6.5-85 -- Security Release, fixes CVE-2012-2111 -- resolves: #817551 - -* Mon Apr 23 2012 Andreas Schneider - 1:3.6.4-84 -- Fix creation of /var/run/samba. -- resolves: #751625 - -* Fri Apr 20 2012 Guenther Deschner - 1:3.6.4-83 -- Avoid private krb5_locate_kdc usage -- resolves: #754783 - -* Thu Apr 12 2012 Jon Ciesla - 1:3.6.4-82 -- Update to 3.6.4 -- Fixes CVE-2012-1182 - -* Mon Mar 19 2012 Andreas Schneider - 1:3.6.3-81 -- Fix provides for of libwclient-devel for samba-winbind-devel. - -* Thu Feb 23 2012 Andreas Schneider - 1:3.6.3-80 -- Add commented out 'max protocol' to the default config. - -* Mon Feb 13 2012 Andreas Schneider - 1:3.6.3-79 -- Create a libwbclient package. -- Replace winbind-devel with libwbclient-devel package. - -* Mon Jan 30 2012 Andreas Schneider - 1:3.6.3-78 -- Update to 3.6.3 -- Fixes CVE-2012-0817 - -* Sat Jan 14 2012 Fedora Release Engineering - 1:3.6.1-77.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild - -* Mon Dec 05 2011 Andreas Schneider - 1:3.6.1-77 -- Fix winbind cache upgrade. -- resolves: #760137 - -* Fri Nov 18 2011 Andreas Schneider - 1:3.6.1-76 -- Fix piddir to match with systemd files. -- Fix crash bug in the debug system. -- resolves: #754525 - -* Fri Nov 04 2011 Andreas Schneider - 1:3.6.1-75 -- Fix systemd dependencies -- resolves: #751397 - -* Wed Oct 26 2011 Andreas Schneider - 1:3.6.1-74 -- Update to 3.6.1 - -* Tue Oct 04 2011 Guenther Deschner - 1:3.6.0-73 -- Fix nmbd startup -- resolves: #741630 - -* Tue Sep 20 2011 Tom Callaway - 1:3.6.0-72 -- convert to systemd -- restore epoch from f15 - -* Sat Aug 13 2011 Guenther Deschner - 3.6.0-71 -- Update to 3.6.0 final - -* Sun Jul 31 2011 Guenther Deschner - 3.6.0rc3-70 -- Update to 3.6.0rc3 - -* Tue Jun 07 2011 Guenther Deschner - 3.6.0rc2-69 -- Update to 3.6.0rc2 - -* Tue May 17 2011 Guenther Deschner - 3.6.0rc1-68 -- Update to 3.6.0rc1 - -* Wed Apr 27 2011 Guenther Deschner - 3.6.0pre3-67 -- Update to 3.6.0pre3 - -* Wed Apr 13 2011 Guenther Deschner - 3.6.0pre2-66 -- Update to 3.6.0pre2 - -* Fri Mar 11 2011 Guenther Deschner - 3.6.0pre1-65 -- Enable quota support - -* Wed Feb 09 2011 Fedora Release Engineering - 0:3.6.0-64pre1.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild - -* Wed Nov 24 2010 Guenther Deschner - 3.6.0pre1-64 -- Add %%ghost entry for /var/run using tmpfs -- resolves: #656685 - -* Thu Aug 26 2010 Guenther Deschner - 3.6.0pre1-63 -- Put winbind krb5 locator plugin into a separate rpm -- resolves: #627181 - -* Tue Aug 03 2010 Guenther Deschner - 3.6.0pre1-62 -- Update to 3.6.0pre1 - -* Wed Jun 23 2010 Guenther Deschner - 3.5.4-61 -- Update to 3.5.4 - -* Wed May 19 2010 Guenther Deschner - 3.5.3-60 -- Update to 3.5.3 -- Make sure nmb and smb initscripts return LSB compliant return codes -- Fix winbind over ipv6 - -* Wed Apr 07 2010 Guenther Deschner - 3.5.2-59 -- Update to 3.5.2 - -* Mon Mar 08 2010 Simo Sorce - 3.5.1-58 -- Security update to 3.5.1 -- Fixes CVE-2010-0728 - -* Mon Mar 08 2010 Guenther Deschner - 3.5.0-57 -- Remove cifs.upcall and mount.cifs entirely - -* Mon Mar 01 2010 Guenther Deschner - 3.5.0-56 -- Update to 3.5.0 - -* Fri Feb 19 2010 Guenther Deschner - 3.5.0rc3-55 -- Update to 3.5.0rc3 - -* Tue Jan 26 2010 Guenther Deschner - 3.5.0rc2-54 -- Update to 3.5.0rc2 - -* Fri Jan 15 2010 Jeff Layton - 3.5.0rc1-53 -- separate out CIFS tools into cifs-utils package - -* Fri Jan 08 2010 Guenther Deschner - 3.5.0rc1-52 -- Update to 3.5.0rc1 - -* Tue Dec 15 2009 Guenther Deschner - 3.5.0pre2-51 -- Update to 3.5.0pre2 -- Remove umount.cifs - -* Wed Nov 25 2009 Guenther Deschner - 3.4.3-49 -- Various updates to inline documentation in default smb.conf file -- resolves: #483703 - -* Thu Oct 29 2009 Guenther Deschner - 3.4.3-48 -- Update to 3.4.3 - -* Fri Oct 09 2009 Simo Sorce - 3.4.2-47 -- Spec file cleanup -- Fix sources upstream location -- Remove conditionals to build talloc and tdb, now they are completely indepent - packages in Fedora -- Add defattr() where missing -- Turn all tabs into 4 spaces -- Remove unused migration script -- Split winbind-clients out of main winbind package to avoid multilib to include - huge packages for no good reason - -* Thu Oct 01 2009 Guenther Deschner - 3.4.2-0.46 -- Update to 3.4.2 -- Security Release, fixes CVE-2009-2813, CVE-2009-2948 and CVE-2009-2906 - -* Wed Sep 16 2009 Tomas Mraz - 3.4.1-0.45 -- Use password-auth common PAM configuration instead of system-auth - -* Wed Sep 09 2009 Guenther Deschner - 3.4.1-0.44 -- Update to 3.4.1 - -* Thu Aug 20 2009 Guenther Deschner - 3.4.0-0.43 -- Fix cli_read() -- resolves: #516165 - -* Thu Aug 06 2009 Guenther Deschner - 3.4.0-0.42 -- Fix required talloc version number -- resolves: #516086 - -* Sun Jul 26 2009 Fedora Release Engineering - 0:3.4.0-0.41.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild - -* Fri Jul 17 2009 Guenther Deschner - 3.4.0-0.41 -- Fix Bug #6551 (vuid and tid not set in sessionsetupX and tconX) -- Specify required talloc and tdb version for BuildRequires - -* Fri Jul 03 2009 Guenther Deschner - 3.4.0-0.40 -- Update to 3.4.0 - -* Fri Jun 19 2009 Guenther Deschner - 3.4.0rc1-0.39 -- Update to 3.4.0rc1 - -* Mon Jun 08 2009 Guenther Deschner - 3.4.0pre2-0.38 -- Update to 3.4.0pre2 - -* Thu Apr 30 2009 Guenther Deschner - 3.4.0pre1-0.37 -- Update to 3.4.0pre1 - -* Wed Apr 29 2009 Guenther Deschner - 3.3.4-0.36 -- Update to 3.3.4 - -* Mon Apr 20 2009 Guenther Deschner - 3.3.3-0.35 -- Enable build of idmap_tdb2 for clustered setups - -* Wed Apr 1 2009 Guenther Deschner - 3.3.3-0.34 -- Update to 3.3.3 - -* Thu Mar 26 2009 Simo Sorce - 3.3.2-0.33 -- Fix nmbd init script nmbd reload was causing smbd not nmbd to reload the - configuration -- Fix upstream bug 6224, nmbd was waiting 5+ minutes before running elections on - startup, causing your own machine not to show up in the network for 5 minutes - if it was the only client in that workgroup (fix committed upstream) - -* Thu Mar 12 2009 Guenther Deschner - 3.3.2-0.31 -- Update to 3.3.2 -- resolves: #489547 - -* Thu Mar 5 2009 Guenther Deschner - 3.3.1-0.30 -- Add libcap-devel to requires list (resolves: #488559) - -* Tue Mar 3 2009 Simo Sorce - 3.3.1-0.29 -- Make the talloc and ldb packages optionsl and disable their build within - the samba3 package, they are now built as part of the samba4 package - until they will both be released as independent packages. - -* Wed Feb 25 2009 Guenther Deschner - 3.3.1-0.28 -- Enable cluster support - -* Tue Feb 24 2009 Guenther Deschner - 3.3.1-0.27 -- Update to 3.3.1 - -* Sat Feb 21 2009 Simo Sorce - 3.3.0-0.26 -- Rename ldb* tools to ldb3* to avoid conflicts with newer ldb releases - -* Tue Feb 3 2009 Guenther Deschner - 3.3.0-0.25 -- Update to 3.3.0 final -- Add upstream fix for ldap connections to AD (Bug #6073) -- Remove bogus perl dependencies (resolves: #473051) - -* Fri Nov 28 2008 Guenther Deschner - 3.3.0-0rc1.24 -- Update to 3.3.0rc1 - -* Thu Nov 27 2008 Simo Sorce - 3.2.5-0.23 -- Security Release, fixes CVE-2008-4314 - -* Thu Sep 18 2008 Guenther Deschner - 3.2.4-0.22 -- Update to 3.2.4 -- resolves: #456889 -- move cifs.upcall to /usr/sbin - -* Wed Aug 27 2008 Guenther Deschner - 3.2.3-0.21 -- Security fix for CVE-2008-3789 - -* Mon Aug 25 2008 Guenther Deschner - 3.2.2-0.20 -- Update to 3.2.2 - -* Mon Aug 11 2008 Simo Sorce - 3.2.1-0.19 -- Add fix for CUPS problem, fixes bug #453951 - -* Wed Aug 6 2008 Simo Sorce - 3.2.1-0.18 -- Update to 3.2.1 - -* Tue Jul 1 2008 Guenther Deschner - 3.2.0-2.17 -- Update to 3.2.0 final -- resolves: #452622 - -* Tue Jun 10 2008 Guenther Deschner - 3.2.0-1.rc2.16 -- Update to 3.2.0rc2 -- resolves: #449522 -- resolves: #448107 - -* Fri May 30 2008 Guenther Deschner - 3.2.0-1.rc1.15 -- Fix security=server -- resolves: #449038, #449039 - -* Wed May 28 2008 Guenther Deschner - 3.2.0-1.rc1.14 -- Add fix for CVE-2008-1105 -- resolves: #446724 - -* Fri May 23 2008 Guenther Deschner - 3.2.0-1.rc1.13 -- Update to 3.2.0rc1 - -* Wed May 21 2008 Simo Sorce - 3.2.0-1.pre3.12 -- make it possible to print against Vista and XP SP3 as servers -- resolves: #439154 - -* Thu May 15 2008 Guenther Deschner - 3.2.0-1.pre3.11 -- Add "net ads join createcomputer=ou1/ou2/ou3" fix (BZO #5465) - -* Fri May 09 2008 Guenther Deschner - 3.2.0-1.pre3.10 -- Add smbclient fix (BZO #5452) - -* Fri Apr 25 2008 Guenther Deschner - 3.2.0-1.pre3.9 -- Update to 3.2.0pre3 - -* Tue Mar 18 2008 Guenther Deschner - 3.2.0-1.pre2.8 -- Add fixes for libsmbclient and support for r/o relocations - -* Mon Mar 10 2008 Guenther Deschner - 3.2.0-1.pre2.7 -- Fix libnetconf, libnetapi and msrpc DSSETUP call - -* Thu Mar 06 2008 Guenther Deschner - 3.2.0-1.pre2.6 -- Create separate packages for samba-winbind and samba-winbind-devel -- Add cifs.spnego helper - -* Wed Mar 05 2008 Guenther Deschner - 3.2.0-1.pre2.3 -- Update to 3.2.0pre2 -- Add talloc and tdb lib and devel packages -- Add domainjoin-gui package - -* Fri Feb 22 2008 Simo Sorce - 3.2.0-0.pre1.3 -- Try to fix GCC 4.3 build -- Add --with-dnsupdate flag and also make sure other flags are required just to - be sure the features are included without relying on autodetection to be - successful - -* Tue Feb 19 2008 Fedora Release Engineering - 0:3.2.0-1.pre1.2 -- Autorebuild for GCC 4.3 - -* Tue Dec 04 2007 Release Engineering - 3.2.0-0.pre1.2 -- Rebuild for openldap bump - -* Thu Oct 18 2007 Guenther Deschner 3.2.0-0.pre1.1.fc9 -- 32/64bit padding fix (affects multilib installations) - -* Mon Oct 8 2007 Simo Sorce 3.2.0-0.pre1.fc9 -- New major relase, minor switched from 0 to 2 -- License change, the code is now GPLv3+ -- Numerous improvements and bugfixes included -- package libsmbsharemodes too -- remove smbldap-tools as they are already packaged separately in Fedora -- Fix bug 245506 - -* Tue Oct 2 2007 Simo Sorce 3.0.26a-1.fc8 -- rebuild with AD DNS Update support - -* Tue Sep 11 2007 Simo Sorce 3.0.26a-0.fc8 -- upgrade to the latest upstream realease -- includes security fixes released today in 3.0.26 - -* Fri Aug 24 2007 Simo Sorce 3.0.25c-4.fc8 -- add fix reported upstream for heavy idmap_ldap memleak - -* Tue Aug 21 2007 Simo Sorce 3.0.25c-3.fc8 -- fix a few places were "open" is used an interfere with the new glibc - -* Tue Aug 21 2007 Simo Sorce 3.0.25c-2.fc8 -- remove old source -- add patch to fix samba bugzilla 4772 - -* Tue Aug 21 2007 Guenther Deschner 3.0.25c-0.fc8 -- update to 3.0.25c - -* Fri Jun 29 2007 Simo Sorce 3.0.25b-3.fc8 -- handle cases defined in #243766 - -* Tue Jun 26 2007 Simo Sorce 3.0.25b-2.fc8 -- update to 3.0.25b -- better error codes for init scripts: #244823 - -* Tue May 29 2007 Günther Deschner -- fix pam_smbpass patch. - -* Fri May 25 2007 Simo Sorce -- update to 3.0.25a as it contains many fixes -- add a fix for pam_smbpass made by Günther but committed upstream after 3.0.25a was cut. - -* Mon May 14 2007 Simo Sorce -- final 3.0.25 -- includes security fixes for CVE-2007-2444,CVE-2007-2446,CVE-2007-2447 - -* Mon Apr 30 2007 Günther Deschner -- move to 3.0.25rc3 - -* Thu Apr 19 2007 Simo Sorce -- fixes in the spec file -- moved to 3.0.25rc1 -- addedd patches (merged upstream so they will be removed in 3.0.25rc2) - -* Wed Apr 4 2007 Simo Sorce 3.0.24-12.fc7 -- fixes in smb.conf -- advice in smb.conf to put scripts in /var/lib/samba/scripts -- create /var/lib/samba/scripts so that selinux can be happy -- fix Vista problems with msdfs errors - -* Tue Apr 03 2007 Guenther Deschner 3.0.24-11.fc7 -- enable PAM and NSS dlopen checks during build -- fix unresolved symbols in libnss_wins.so (bug #198230) - -* Fri Mar 30 2007 Simo Sorce 3.0.24-10.fc7 -- set passdb backend = tdbsam as default in smb.conf -- remove samba-docs dependency from swat, that was a mistake -- put back COPYING and other files in samba-common -- put examples in samba not in samba-docs -- leave only stuff under docs/ in samba-doc - -* Thu Mar 29 2007 Simo Sorce 3.0.24-9.fc7 -- integrate most of merge review proposed changes (bug #226387) -- remove libsmbclient-devel-static and simply stop shipping the - static version of smbclient as it seem this is deprecated and - actively discouraged - -* Wed Mar 28 2007 Simo Sorce 3.0.24-8.fc7 -- fix for bug #176649 - -* Mon Mar 26 2007 Simo Sorce -- remove patch for bug 106483 as it introduces a new bug that prevents - the use of a credentials file with the smbclient tar command -- move the samba private dir from being the same as the config dir - (/etc/samba) to /var/lib/samba/private - -* Mon Mar 26 2007 Simo Sorce 3.0.24-7.fc7 -- make winbindd start earlier in the init process, at the same time - ypbind is usually started as well -- add a sepoarate init script for nmbd called nmb, we need to be able - to restart nmbd without dropping al smbd connections unnecessarily - -* Fri Mar 23 2007 Simo Sorce -- add samba.schema to /etc/openldap/schema - -* Thu Mar 22 2007 Florian La Roche -- adjust the Requires: for the scripts, add "chkconfig --add smb" - -* Tue Mar 20 2007 Simo Sorce 3.0.24-6.fc7 -- do not put comments inline on smb.conf options, they may be read - as part of the value (for example log files names) - -* Mon Mar 19 2007 Simo Sorce 3.0.24-5.fc7 -- actually use the correct samba.pamd file not the old samba.pamd.stack file -- fix logifles and use upstream convention of log.* instead of our old *.log - Winbindd creates its own log.* files anyway so we will be more consistent -- install our own (enhanced) default smb.conf file -- Fix pam_winbind acct_mgmt PAM result code (prevented local users from - logging in). Fixed by Guenther. -- move some files from samba to samba-common as they are used with winbindd - as well - -* Fri Mar 16 2007 Guenther Deschner 3.0.24-4.fc7 -- fix arch macro which reported Vista to Samba clients. - -* Thu Mar 15 2007 Simo Sorce 3.0.24-3.fc7 -- Directories reorg, tdb files must go to /var/lib, not - to /var/cache, add migration script in %%post common -- Split out libsmbclient, devel and doc packages -- Remove libmsrpc.[h|so] for now as they are not really usable -- Remove kill -HUP from rotate, samba use -HUP for other things - noit to reopen logs - -* Tue Feb 20 2007 Simo Sorce 3.0.24-2.fc7 -- New upstream release -- Fix packaging issue wrt idmap modules used only by smbd -- Addedd Vista Patchset for compatibility with Windows Vista -- Change default of "msdfs root", it seem to cause problems with - some applications and it has been proposed to change it for - 3.0.25 upstream - -* Fri Sep 1 2006 Jay Fenlason 3.0.23c-2 -- New upstream release. - -* Tue Aug 8 2006 Jay Fenlason 3.0.23b-2 -- New upstream release. - -* Mon Jul 24 2006 Jay Fenlason 3.0.23a-3 -- Fix the -logfiles patch to close - bz#199607 Samba compiled with wrong log path. - bz#199206 smb.conf has incorrect log file path - -* Mon Jul 24 2006 Jay Fenlason 3.0.23a-2 -- Upgrade to new upstream 3.0.23a -- include upstream samr_alias patch - -* Tue Jul 11 2006 Jay Fenlason 3.0.23-2 -- New upstream release. -- Use modified filter-requires-samba.sh from packaging/RHEL/setup/ - to get rid of bogus dependency on perl(Unicode::MapUTF8) -- Update the -logfiles and -smb.conf patches to work with 3.0.23 - -* Thu Jul 6 2006 Jay Fenlason 3.0.23-0.RC3 -- New upstream RC release. -- Update the -logfiles, and -passwd patches for - 3.0.23rc3 -- Include the change to smb.init from Bastien Nocera ) - to close - bz#182560 Wrong retval for initscript when smbd is dead -- Update this spec file to build with 3.0.23rc3 -- Remove the -install.mount.smbfs patch, since we don't install - mount.smbfs any more. - -* Wed Jun 14 2006 Tomas Mraz - 2.0.21c-3 -- rebuilt with new gnutls - -* Fri Mar 17 2006 Jay Fenlason 2.0.21c-2 -- New upstream version. - -* Mon Feb 13 2006 Jay Fenlason 3.0.21b-2 -- New upstream version. -- Since the rawhide kernel has dropped support for smbfs, remove smbmount - and smbumount. Users should use mount.cifs instead. -- Upgrade to 3.0.21b - -* Fri Feb 10 2006 Jesse Keating - 0:3.0.20b-2.1.1 -- bump again for double-long bug on ppc(64) - -* Fri Dec 09 2005 Jesse Keating -- rebuilt - -* Sun Nov 13 2005 Jay Fenlason 3.0.20b-2 -- turn on -DLDAP_DEPRECATED to allow access to ldap functions that have - been depricated in 2.3.11, but which don't have well-documented - replacements (ldap_simple_bind_s(), for example). -- Upgrade to 3.0.20b, which includes all the previous upstream patches. -- Updated the -warnings patch for 3.0.20a. -- Include --with-shared-modules=idmap_ad,idmap_rid to close - bz#156810 --with-shared-modules=idmap_ad,idmap_rid -- Include the new samba.pamd from Tomas Mraz (tmraz@redhat.com) to close - bz#170259 pam_stack is deprecated - -* Sun Nov 13 2005 Warren Togami 3.0.20-3 -- epochs from deps, req exact release -- rebuild against new openssl - -* Mon Aug 22 2005 Jay Fenlason 3.0.20-2 -- New upstream release - Includes five upstream patches -bug3010_v1, -groupname_enumeration_v3, - -regcreatekey_winxp_v1, -usrmgr_groups_v1, and -winbindd_v1 - This obsoletes the -pie and -delim patches - the -warning and -gcc4 patches are obsolete too - The -man, -passwd, and -smbspool patches were updated to match 3.0.20pre1 - Also, the -quoting patch was implemented differently upstream - There is now a umount.cifs executable and manpage - We run autogen.sh as part of the build phase - The testprns command is now gone - libsmbclient now has a man page -- Include -bug106483 patch to close - bz#106483 smbclient: -N negates the provided password, despite documentation -- Added the -warnings patch to quiet some compiler warnings. -- Removed many obsolete patches from CVS. - -* Mon May 2 2005 Jay Fenlason 3.0.14a-2 -- New upstream release. -- the -64bit-timestamps, -clitar, -establish_trust, user_rights_v1, - winbind_find_dc_v2 patches are now obsolete. - -* Thu Apr 7 2005 Jay Fenlason 3.0.13-2 -- New upstream release -- add my -quoting patch, to fix swat with strings that contain - html meta-characters, and to use correct quote characters in - lists, closing bz#134310 -- include the upstream winbindd_2k3sp1 patch -- include the -smbclient patch. -- include the -hang patch from upstream. - -* Thu Mar 24 2005 Florian La Roche -- add a "exit 0" to the postun of the main samba package - -* Wed Mar 2 2005 Tomas Mraz 3.0.11-5 -- rebuild with openssl-0.9.7e - -* Thu Feb 24 2005 Jay Fenlason 3.0.11-4 -- Use the updated filter-requires-samba.sh file, so we don't accidentally - pick up a dependency on perl(Crypt::SmbHash) - -* Fri Feb 18 2005 Jay Fenlason 3.0.11-3 -- add -gcc4 patch to compile with gcc 4. -- remove the now obsolete -smbclient-kerberos.patch -- Include four upstream patches from - http://samba.org/~jerry/patches/post-3.0.11/ - (Slightly modified the winbind_find_dc_v2 patch to apply easily with - rpmbuild). - -* Fri Feb 4 2005 Jay Fenlason 3.0.11-2 -- include -smbspool patch to close bz#104136 - -* Wed Jan 12 2005 Jay Fenlason 3.0.10-4 -- Update the -man patch to fix ntlm_auth.1 too. -- Move pam_smbpass.so to the -common package, so both the 32 - and 64-bit versions will be installed on multiarch platforms. - This closes bz#143617 -- Added new -delim patch to fix mount.cifs so it can accept - passwords with commas in them (via environment or credentials - file) to close bz#144198 - -* Wed Jan 12 2005 Tim Waugh 3.0.10-3 -- Rebuilt for new readline. - -* Fri Dec 17 2004 Jay Fenlason 3.0.10-2 -- New upstream release that closes CAN-2004-1154 bz#142544 -- Include the -64bit patch from Nalin. This closes bz#142873 -- Update the -logfiles patch to work with 3.0.10 -- Create /var/run/winbindd and make it part of the -common rpm to close - bz#142242 - -* Mon Nov 22 2004 Jay Fenlason 3.0.9-2 -- New upstream release. This obsoletes the -secret patch. - Include my changetrustpw patch to make "net ads changetrustpw" stop - aborting. This closes #134694 -- Remove obsolete triggers for ancient samba versions. -- Move /var/log/samba to the -common rpm. This closes #76628 -- Remove the hack needed to get around the bad docs files in the - 3.0.8 tarball. -- Change the comment in winbind.init to point at the correct pidfile. - This closes #76641 - -* Mon Nov 22 2004 Than Ngo 3.0.8-4 -- fix unresolved symbols in libsmbclient which caused applications - such as KDE's konqueror to fail when accessing smb:// URLs. #139894 - -* Thu Nov 11 2004 Jay Fenlason 3.0.8-3.1 -- Rescue the install.mount.smbfs patch from Juanjo Villaplana - (villapla@si.uji.es) to prevent building the srpm from trashing your - installed /usr/bin/smbmount - -* Tue Nov 9 2004 Jay Fenlason 3.0.8-3 -- Include the corrected docs tarball, and use it instead of the - obsolete docs from the upstream 3.0.8 tarball. -- Update the logfiles patch to work with the updated docs. - -* Mon Nov 8 2004 Jay Fenlason 3.0.8-2 -- New upstream version fixes CAN-2004-0930. This obsoletes the - disable-sendfile, salt, signing-shortkey and fqdn patches. -- Add my ugly non-ascii-domain patch. -- Updated the pie patch for 3.0.8. -- Updated the logfiles patch for 3.0.8. - -* Tue Oct 26 2004 Jay Fenlason 3.0.8-0.pre2 -- New upstream version -- Add Nalin's signing-shortkey patch. - -* Tue Oct 19 2004 Jay Fenlason 3.0.8-0.pre1.3 -- disable the -salt patch, because it causes undefined references in - libsmbclient that prevent gnome-vfs from building. - -* Fri Oct 15 2004 Jay Fenlason 3.0.8-0.pre1.2 -- Re-enable the x_fclose patch that was accidentally disabled - in 3.0.8-0.pre1.1. This closes #135832 -- include Nalin's -fqdn and -salt patches. - -* Wed Oct 13 2004 Jay Fenlason 3.0.8-0.pre1.1 -- Include disable-sendfile patch to default "use sendfile" to "no". - This closes #132779 - -* Wed Oct 6 2004 Jay Fenlason -- Include patch from Steven Lawrance (slawrance@yahoo.com) that modifies - smbmnt to work with 32-bit uids. - -* Mon Sep 27 2004 Jay Fenlason 3.0.8-0.pre1 -- new upstream release. This obsoletes the ldapsam_compat patches. - -* Wed Sep 15 2004 Jay Fenlason 3.0.7-4 -- Update docs section to not carryover the docs/manpages directory - This moved many files from /usr/share/doc/samba-3.0.7/docs/* to - /usr/share/doc/samba-3.0.7/* -- Modify spec file as suggested by Rex Dieter (rdieter@math.unl.edu) - to correctly create libsmbclient.so.0 and to use %%_initrddir instead - of rolling our own. This closes #132642 -- Add patch to default "use sendfile" to no, since sendfile appears to - be broken -- Add patch from Volker Lendecke to help make - ldapsam_compat work again. -- Add patch from "Vince Brimhall" for ldapsam_compat - These two patches close bugzilla #132169 - -* Mon Sep 13 2004 Jay Fenlason 3.0.7-3 -- Upgrade to 3.0.7, which fixes CAN-2004-0807 CAN-2004-0808 - This obsoletes the 3.0.6-schema patch. -- Update BuildRequires line to include openldap-devel openssl-devel - and cups-devel - -* Mon Aug 16 2004 Jay Fenlason 3.0.6-3 -- New upstream version. -- Include post 3.0.6 patch from "Gerald (Jerry) Carter" - to fix a duplicate in the LDAP schema. -- Include 64-bit timestamp patch from Ravikumar (rkumar@hp.com) - to allow correct timestamp handling on 64-bit platforms and fix #126109. -- reenable the -pie patch. Samba is too widely used, and too vulnerable - to potential security holes to disable an important security feature - like -pie. The correct fix is to have the toolchain not create broken - executables when programs compiled -pie are stripped. -- Remove obsolete patches. -- Modify this spec file to put libsmbclient.{a,so} in the right place on - x86_64 machines. - -* Thu Aug 5 2004 Jason Vas Dias 3.0.5-3 -- Removed '-pie' patch - 3.0.5 uses -fPIC/-PIC, and the combination -- resulted in executables getting corrupt stacks, causing smbmnt to -- get a SIGBUS in the mount() call (bug 127420). - -* Fri Jul 30 2004 Jay Fenlason 3.0.5-2 -- Upgrade to 3.0.5, which is a regression from 3.0.5pre1 for a - security fix. -- Include the 3.0.4-backport patch from the 3E branch. This restores - some of the 3.0.5pre1 and 3.0.5rc1 functionality. - -* Tue Jul 20 2004 Jay Fenlason 3.0.5-0.pre1.1 -- Backport base64_decode patche to close CAN-2004-0500 -- Backport hash patch to close CAN-2004-0686 -- use_authtok patch from Nalin Dahyabhai -- smbclient-kerberos patch from Alexander Larsson -- passwd patch uses "*" instead of "x" for "hashed" passwords for - accounts created by winbind. "x" means "password is in /etc/shadow" to - brain-damaged pam_unix module. - -* Fri Jul 2 2004 Jay Fenlason 3.0.5.0pre1.0 -- New upstream version -- use %% { SOURCE1 } instead of a hardcoded path -- include -winbind patch from Gerald (Jerry) Carter (jerry@samba.org) - https://bugzilla.samba.org/show_bug.cgi?id=1315 - to make winbindd work against Windows versions that do not have - 128 bit encryption enabled. -- Moved %%{_bindir}/net to the -common package, so that folks who just - want to use winbind, etc don't have to install -client in order to - "net join" their domain. -- New upstream version obsoletes the patches added in 3.0.3-5 -- Remove smbgetrc.5 man page, since we don't ship smbget. - -* Tue Jun 15 2004 Elliot Lee -- rebuilt - -* Tue May 4 2004 Jay Fenlason 3.0.3-5 -- Patch to allow password changes from machines patched with - Microsoft hotfix MS04-011. -- Include patches for https://bugzilla.samba.org/show_bug.cgi?id=1302 - and https://bugzilla.samba.org/show_bug.cgi?id=1309 - -* Thu Apr 29 2004 Jay Fenlason 3.0.3-4 -- Samba 3.0.3 released. - -* Wed Apr 21 2004 jay Fenlason 3.0.3-3.rc1 -- New upstream version -- updated spec file to make libsmbclient.so executable. This closes - bugzilla #121356 - -* Mon Apr 5 2004 Jay Fenlason 3.0.3-2.pre2 -- New upstream version -- Updated configure line to remove --with-fhs and to explicitly set all - the directories that --with-fhs was setting. We were overriding most of - them anyway. This closes #118598 - -* Mon Mar 15 2004 Jay Fenlason 3.0.3-1.pre1 -- New upstream version. -- Updated -pie and -logfiles patches for 3.0.3pre1 -- add krb5-devel to buildrequires, fixes #116560 -- Add patch from Miloslav Trmac (mitr@volny.cz) to allow non-root to run - "service smb status". This fixes #116559 - -* Tue Mar 02 2004 Elliot Lee -- rebuilt - -* Mon Feb 16 2004 Jay Fenlason 3.0.2a-1 -- Upgrade to 3.0.2a - -* Mon Feb 16 2004 Karsten Hopp 3.0.2-7 -- fix ownership in -common package - -* Fri Feb 13 2004 Elliot Lee -- rebuilt - -* Fri Feb 13 2004 Jay Fenlason -- Change all requires lines to list an explicit epoch. Closes #102715 -- Add an explicit Epoch so that %%{epoch} is defined. - -* Mon Feb 9 2004 Jay Fenlason 3.0.2-5 -- New upstream version: 3.0.2 final includes security fix for #114995 - (CAN-2004-0082) -- Edit postun script for the -common package to restart winbind when - appropriate. Fixes bugzilla #114051. - -* Mon Feb 2 2004 Jay Fenlason 3.0.2-3rc2 -- add %%dir entries for %%{_libdir}/samba and %%{_libdir}/samba/charset -- Upgrade to new upstream version -- build mount.cifs for the new cifs filesystem in the 2.6 kernel. - -* Mon Jan 19 2004 Jay Fenlason 3.0.2-1rc1 -- Upgrade to new upstream version - -* Wed Dec 17 2003 Felipe Alfaro Solana 3.0.1-1 -- Update to 3.0.1 -- Removed testparm patch as it's already merged -- Removed Samba.7* man pages -- Fixed .buildroot patch -- Fixed .pie patch -- Added new /usr/bin/tdbdump file - -* Thu Sep 25 2003 Jay Fenlason 3.0.0-15 -- New 3.0.0 final release -- merge nmbd-netbiosname and testparm patches from 3E branch -- updated the -logfiles patch to work against 3.0.0 -- updated the pie patch -- update the VERSION file during build -- use make -j if avaliable -- merge the winbindd_privileged change from 3E -- merge the "rm /usr/lib" patch that allows Samba to build on 64-bit - platforms despite the broken Makefile - -* Mon Aug 18 2003 Jay Fenlason -- Merge from samba-3E-branch after samba-3.0.0rc1 was released - -* Wed Jul 23 2003 Jay Fenlason 3.0.0-3beta3 -- Merge from 3.0.0-2beta3.3E -- (Correct log file names (#100981).) -- (Fix pidfile directory in samab.log) -- (Remove obsolete samba-3.0.0beta2.tar.bz2.md5 file) -- (Move libsmbclient to the -common package (#99449)) - -* Sun Jun 22 2003 Nalin Dahyabhai 2.2.8a-4 -- rebuild - -* Wed Jun 04 2003 Elliot Lee -- rebuilt - -* Wed May 28 2003 Jay Fenlason 2.2.8a-2 -- add libsmbclient.so for gnome-vfs-extras -- Edit specfile to specify /var/run for pid files -- Move /tmp/.winbindd/socket to /var/run/winbindd/socket - -* Wed May 14 2003 Florian La Roche -- add proper ldconfig calls - -* Thu Apr 24 2003 Jay Fenlason 2.2.8a-1 -- upgrade to 2.2.8a -- remove old .md5 files -- add "pid directory = /var/run" to the smb.conf file. Fixes #88495 -- Patch from jra@dp.samba.org to fix a delete-on-close regression - -* Mon Mar 24 2003 Jay Fenlason 2.2.8-0 -- Upgrade to 2.2.8 -- removed commented out patches. -- removed old patches and .md5 files from the repository. -- remove duplicate /sbin/chkconfig --del winbind which causes - warnings when removing samba. -- Fixed minor bug in smbprint that causes it to fail when called with - more than 10 parameters: the accounting file (and spool directory - derived from it) were being set wrong due to missing {}. This closes - bug #86473. -- updated smb.conf patch, includes new defaults to close bug #84822. - -* Mon Feb 24 2003 Elliot Lee -- rebuilt - -* Thu Feb 20 2003 Jonathan Blandford 2.2.7a-5 -- remove swat.desktop file - -* Thu Feb 20 2003 Nalin Dahyabhai 2.2.7a-4 -- relink libnss_wins.so with SHLD="%%{__cc} -lnsl" to force libnss_wins.so to - link with libnsl, avoiding unresolved symbol errors on functions in libnsl - -* Mon Feb 10 2003 Jay Fenlason 2.2.7a-3 -- edited spec file to put .so files in the correct directories - on 64-bit platforms that have 32-bit compatability issues - (sparc64, x86_64, etc). This fixes bugzilla #83782. -- Added samba-2.2.7a-error.patch from twaugh. This fixes - bugzilla #82454. - -* Wed Jan 22 2003 Tim Powers -- rebuilt - -* Thu Jan 9 2003 Jay Fenlason 2.2.7a-1 -- Update to 2.2.7a -- Change default printing system to CUPS -- Turn on pam_smbpass -- Turn on msdfs - -* Sat Jan 4 2003 Jeff Johnson 2.2.7-5 -- use internal dep generator. - -* Sat Dec 14 2002 Tim Powers 2.2.7-4 -- don't use rpms internal dep generator - -* Mon Dec 02 2002 Elliot Lee 2.2.7-3 -- Fix missing doc files. -- Fix multilib issues - -* Wed Nov 20 2002 Bill Nottingham 2.2.7-2 -- update to 2.2.7 -- add patch for LFS in smbclient () - -* Wed Aug 28 2002 Trond Eivind Glomsød 2.2.5-10 -- logrotate fixes (#65007) - -* Mon Aug 26 2002 Trond Eivind Glomsrød 2.2.5-9 -- /usr/lib was used in place of %%{_libdir} in three locations (#72554) - -* Mon Aug 5 2002 Trond Eivind Glomsrød 2.2.5-8 -- Initscript fix (#70720) - -* Fri Jul 26 2002 Trond Eivind Glomsrød 2.2.5-7 -- Enable VFS support and compile the "recycling" module (#69796) -- more selective includes of the examples dir - -* Tue Jul 23 2002 Trond Eivind Glomsrød 2.2.5-6 -- Fix the lpq parser for better handling of LPRng systems (#69352) - -* Tue Jul 23 2002 Trond Eivind Glomsrød 2.2.5-5 -- desktop file fixes (#69505) - -* Wed Jun 26 2002 Trond Eivind Glomsrød 2.2.5-4 -- Enable ACLs - -* Tue Jun 25 2002 Trond Eivind Glomsrød 2.2.5-3 -- Make it not depend on Net::LDAP - those are doc files and examples - -* Fri Jun 21 2002 Tim Powers -- automated rebuild - -* Thu Jun 20 2002 Trond Eivind Glomsrød 2.2.5-1 -- 2.2.5 - -* Fri Jun 14 2002 Trond Eivind Glomsrød 2.2.4-5 -- Move the post/preun of winbind into the -common subpackage, - where the script is (#66128) - -* Tue Jun 4 2002 Trond Eivind Glomsrød 2.2.4-4 -- Fix pidfile locations so it runs properly again (2.2.4 - added a new directtive - #65007) - -* Thu May 23 2002 Tim Powers -- automated rebuild - -* Tue May 14 2002 Trond Eivind Glomsrød 2.2.4-2 -- Fix #64804 - -* Thu May 9 2002 Trond Eivind Glomsrød 2.2.4-1 -- 2.2.4 -- Removed some zero-length and CVS internal files -- Make it build - -* Wed Apr 10 2002 Trond Eivind Glomsrød 2.2.3a-6 -- Don't use /etc/samba.d in smbadduser, it should be /etc/samba - -* Thu Apr 4 2002 Trond Eivind Glomsrød 2.2.3a-5 -- Add libsmbclient.a w/headerfile for KDE (#62202) - -* Tue Mar 26 2002 Trond Eivind Glomsrød 2.2.3a-4 -- Make the logrotate script look the correct place for the pid files - -* Thu Mar 14 2002 Nalin Dahyabhai 2.2.3a-3 -- include interfaces.o in pam_smbpass.so, which needs symbols from interfaces.o - (patch posted to samba-list by Ilia Chipitsine) - -* Thu Feb 21 2002 Trond Eivind Glomsrød 2.2.3a-2 -- Rebuild - -* Thu Feb 7 2002 Trond Eivind Glomsrød 2.2.3a-1 -- 2.2.3a - -* Mon Feb 4 2002 Trond Eivind Glomsrød 2.2.3-1 -- 2.2.3 - -* Thu Nov 29 2001 Trond Eivind Glomsrød 2.2.2-8 -- New pam configuration file for samba - -* Tue Nov 27 2001 Trond Eivind Glomsrød 2.2.2-7 -- Enable PAM session controll and password sync - -* Tue Nov 13 2001 Trond Eivind Glomsrød 2.2.2-6 -- Move winbind files to samba-common. Add separate initscript for - winbind -- Fixes for winbind - protect global variables with mutex, use - more secure getenv - -* Thu Nov 8 2001 Trond Eivind Glomsrød 2.2.2-5 -- Teach smbadduser about "getent passwd" -- Fix more pid-file references -- Add (conditional) winbindd startup to the initscript, configured in - /etc/sysconfig/samba - -* Wed Nov 7 2001 Trond Eivind Glomsrød 2.2.2-4 -- Fix pid-file reference in logrotate script -- include pam and nss modules for winbind - -* Mon Nov 5 2001 Trond Eivind Glomsrød 2.2.2-3 -- Add "--with-utmp" to configure options (#55372) -- Include winbind, pam_smbpass.so, rpcclient and smbcacls -- start using /var/cache/samba, we need to keep state and there is - more than just locks involved - -* Sat Nov 03 2001 Florian La Roche 2.2.2-2 -- add "reload" to the usage string in the startup script - -* Mon Oct 15 2001 Trond Eivind Glomsrød 2.2.2-1 -- 2.2.2 - -* Tue Sep 18 2001 Trond Eivind Glomsrød 2.2.1a-5 -- Add patch from Jeremy Allison to fix IA64 alignment problems (#51497) - -* Mon Aug 13 2001 Trond Eivind Glomsrød -- Don't include smbpasswd in samba, it's in samba-common (#51598) -- Add a disabled "obey pam restrictions" statement - it's not - active, as we use encrypted passwords, but if the admin turns - encrypted passwords off the choice is available. (#31351) - -* Wed Aug 8 2001 Trond Eivind Glomsrød -- Use /var/cache/samba instead of /var/lock/samba -- Remove "domain controller" keyword from smb.conf, it's - deprecated (from #13704) -- Sync some examples with smb.conf.default -- Fix password synchronization (#16987) - -* Fri Jul 20 2001 Trond Eivind Glomsrød -- Tweaks of BuildRequires (#49581) - -* Wed Jul 11 2001 Trond Eivind Glomsrød -- 2.2.1a bugfix release - -* Tue Jul 10 2001 Trond Eivind Glomsrød -- 2.2.1, which should work better for XP - -* Sat Jun 23 2001 Trond Eivind Glomsrød -- 2.2.0a security fix -- Mark lograte and pam configuration files as noreplace - -* Fri Jun 22 2001 Trond Eivind Glomsrød -- Add the /etc/samba directory to samba-common - -* Thu Jun 21 2001 Trond Eivind Glomsrød -- Add improvements to the smb.conf as suggested in #16931 - -* Tue Jun 19 2001 Trond Eivind Glomsrød -- (these changes are from the non-head version) -- Don't include /usr/sbin/samba, it's the same as the initscript -- unset TMPDIR, as samba can't write into a TMPDIR owned - by root (#41193) -- Add pidfile: lines for smbd and nmbd and a config: line - in the initscript (#15343) -- don't use make -j -- explicitly include /usr/share/samba, not just the files in it - -* Tue Jun 19 2001 Bill Nottingham -- mount.smb/mount.smbfs go in /sbin, *not* %%{_sbindir} - -* Fri Jun 8 2001 Preston Brown -- enable encypted passwords by default - -* Thu Jun 7 2001 Helge Deller -- build as 2.2.0-1 release -- skip the documentation-directories docbook, manpages and yodldocs -- don't include *.sgml documentation in package -- moved codepage-directory to /usr/share/samba/codepages -- make it compile with glibc-2.2.3-10 and kernel-headers-2.4.2-2 - -* Mon May 21 2001 Helge Deller -- updated to samba 2.2.0 -- moved codepages to %%{_datadir}/samba/codepages -- use all available CPUs for building rpm packages -- use %%{_xxx} defines at most places in spec-file -- "License:" replaces "Copyright:" -- dropped excludearch sparc -- de-activated japanese patches 100 and 200 for now - (they need to be fixed and tested wth 2.2.0) -- separated swat.desktop file from spec-file and added - german translations -- moved /etc/sysconfig/samba to a separate source-file -- use htmlview instead of direct call to netscape in - swat.desktop-file - -* Mon May 7 2001 Bill Nottingham -- device-remove security fix again () - -* Fri Apr 20 2001 Bill Nottingham -- fix tempfile security problems, officially () -- update to 2.0.8 - -* Sun Apr 8 2001 Bill Nottingham -- turn of SSL, kerberos - -* Thu Apr 5 2001 Bill Nottingham -- fix tempfile security problems (patch from ) - -* Thu Mar 29 2001 Bill Nottingham -- fix quota support, and quotas with the 2.4 kernel (#31362, #33915) - -* Mon Mar 26 2001 Nalin Dahyabhai -- tweak the PAM code some more to try to do a setcred() after initgroups() -- pull in all of the optflags on i386 and sparc -- don't explicitly enable Kerberos support -- it's only used for password - checking, and if PAM is enabled it's a no-op anyway - -* Mon Mar 5 2001 Tim Waugh -- exit successfully from preun script (bug #30644). - -* Fri Mar 2 2001 Nalin Dahyabhai -- rebuild in new environment - -* Wed Feb 14 2001 Bill Nottingham -- updated japanese stuff (#27683) - -* Fri Feb 9 2001 Bill Nottingham -- fix trigger (#26859) - -* Wed Feb 7 2001 Bill Nottingham -- add i18n support, japanese patch (#26253) - -* Wed Feb 7 2001 Trond Eivind Glomsrød -- i18n improvements in initscript (#26537) - -* Wed Jan 31 2001 Bill Nottingham -- put smbpasswd in samba-common (#25429) - -* Wed Jan 24 2001 Bill Nottingham -- new i18n stuff - -* Sun Jan 21 2001 Bill Nottingham -- rebuild - -* Thu Jan 18 2001 Bill Nottingham -- i18n-ize initscript -- add a sysconfig file for daemon options (#23550) -- clarify smbpasswd man page (#23370) -- build with LFS support (#22388) -- avoid extraneous pam error messages (#10666) -- add Urban Widmark's bug fixes for smbmount (#19623) -- fix setgid directory modes (#11911) -- split swat into subpackage (#19706) - -* Wed Oct 25 2000 Nalin Dahyabhai -- set a default CA certificate path in smb.conf (#19010) -- require openssl >= 0.9.5a-20 to make sure we have a ca-bundle.crt file - -* Mon Oct 16 2000 Bill Nottingham -- fix swat only_from line (#18726, others) -- fix attempt to write outside buildroot on install (#17943) - -* Mon Aug 14 2000 Bill Nottingham -- add smbspool back in (#15827) -- fix absolute symlinks (#16125) - -* Sun Aug 6 2000 Philipp Knirsch -- bugfix for smbadduser script (#15148) - -* Mon Jul 31 2000 Matt Wilson -- patch configure.ing (patch11) to disable cups test -- turn off swat by default - -* Fri Jul 28 2000 Bill Nottingham -- fix condrestart stuff - -* Fri Jul 21 2000 Bill Nottingham -- add copytruncate to logrotate file (#14360) -- fix init script (#13708) - -* Sat Jul 15 2000 Bill Nottingham -- move initscript back -- remove 'Using Samba' book from %%doc -- move stuff to /etc/samba (#13708) -- default configuration tweaks (#13704) -- some logrotate tweaks - -* Wed Jul 12 2000 Prospector -- automatic rebuild - -* Tue Jul 11 2000 Bill Nottingham -- fix logrotate script (#13698) - -* Thu Jul 6 2000 Bill Nottingham -- fix initscripts req (prereq /etc/init.d) - -* Wed Jul 5 2000 Than Ngo -- add initdir macro to handle the initscript directory -- add a new macro to handle /etc/pam.d/system-auth - -* Thu Jun 29 2000 Nalin Dahyabhai -- enable Kerberos 5 and SSL support -- patch for duplicate profile.h headers - -* Thu Jun 29 2000 Bill Nottingham -- fix init script - -* Tue Jun 27 2000 Bill Nottingham -- rename samba logs (#11606) - -* Mon Jun 26 2000 Bill Nottingham -- initscript munging - -* Fri Jun 16 2000 Bill Nottingham -- configure the swat stuff usefully -- re-integrate some specfile tweaks that got lost somewhere - -* Thu Jun 15 2000 Bill Nottingham -- rebuild to get rid of cups dependency - -* Wed Jun 14 2000 Nalin Dahyabhai -- tweak logrotate configurations to use the PID file in /var/lock/samba - -* Sun Jun 11 2000 Bill Nottingham -- rebuild in new environment - -* Thu Jun 1 2000 Nalin Dahyabhai -- change PAM setup to use system-auth - -* Mon May 8 2000 Bill Nottingham -- fixes for ia64 - -* Sat May 6 2000 Bill Nottingham -- switch to %%configure - -* Wed Apr 26 2000 Nils Philippsen -- version 2.0.7 - -* Sun Mar 26 2000 Florian La Roche -- simplify preun - -* Thu Mar 16 2000 Bill Nottingham -- fix yp_get_default_domain in autoconf -- only link against readline for smbclient -- fix log rotation (#9909) - -* Fri Feb 25 2000 Bill Nottingham -- fix trigger, again. - -* Mon Feb 7 2000 Bill Nottingham -- fix trigger. - -* Fri Feb 4 2000 Bill Nottingham -- turn on quota support - -* Mon Jan 31 2000 Cristian Gafton -- rebuild to fox dependencies -- man pages are compressed - -* Fri Jan 21 2000 Bill Nottingham -- munge post scripts slightly - -* Wed Jan 19 2000 Bill Nottingham -- turn on mmap again. Wheee. -- ship smbmount on alpha - -* Mon Dec 6 1999 Bill Nottingham -- turn off mmap. ;) - -* Wed Dec 1 1999 Bill Nottingham -- change /var/log/samba to 0700 -- turn on mmap support - -* Thu Nov 11 1999 Bill Nottingham -- update to 2.0.6 - -* Fri Oct 29 1999 Bill Nottingham -- add a %%defattr for -common - -* Tue Oct 5 1999 Bill Nottingham -- shift some files into -client -- remove /home/samba from package. - -* Tue Sep 28 1999 Bill Nottingham -- initscript oopsie. killproc -HUP, not other way around. - -* Sun Sep 26 1999 Bill Nottingham -- script cleanups. Again. - -* Wed Sep 22 1999 Bill Nottingham -- add a patch to fix dropped reconnection attempts - -* Mon Sep 6 1999 Jeff Johnson -- use cp rather than mv to preserve /etc/services perms (#4938 et al). -- use mktemp to generate /etc/tmp.XXXXXX file name. -- add prereqs on sed/mktemp/killall (need to move killall to /bin). -- fix trigger syntax (i.e. "samba < 1.9.18p7" not "samba < samba-1.9.18p7") - -* Mon Aug 30 1999 Bill Nottingham -- sed "s|nawk|gawk|" /usr/bin/convert_smbpasswd - -* Sat Aug 21 1999 Bill Nottingham -- fix typo in mount.smb - -* Fri Aug 20 1999 Bill Nottingham -- add a %%trigger to work around (sort of) broken scripts in - previous releases - -* Mon Aug 16 1999 Bill Nottingham -- initscript munging - -* Mon Aug 9 1999 Bill Nottingham -- add domain parsing to mount.smb - -* Fri Aug 6 1999 Bill Nottingham -- add a -common package, shuffle files around. - -* Fri Jul 23 1999 Bill Nottingham -- add a chmod in %%postun so /etc/services & inetd.conf don't become unreadable - -* Wed Jul 21 1999 Bill Nottingham -- update to 2.0.5 -- fix mount.smb - smbmount options changed again......... -- fix postun. oops. -- update some stuff from the samba team's spec file. - -* Fri Jun 18 1999 Bill Nottingham -- split off clients into separate package -- don't run samba by default - -* Mon Jun 14 1999 Bill Nottingham -- fix one problem with mount.smb script -- fix smbpasswd on sparc with a really ugly kludge - -* Thu Jun 10 1999 Dale Lovelace -- fixed logrotate script - -* Tue May 25 1999 Bill Nottingham -- turn of 64-bit locking on 32-bit platforms - -* Thu May 20 1999 Bill Nottingham -- so many releases, so little time -- explicitly uncomment 'printing = bsd' in sample config - -* Tue May 18 1999 Bill Nottingham -- update to 2.0.4a -- fix mount.smb arg ordering - -* Fri Apr 16 1999 Bill Nottingham -- go back to stop/start for restart (-HUP didn't work in testing) - -* Fri Mar 26 1999 Bill Nottingham -- add a mount.smb to make smb mounting a little easier. -- smb filesystems apparently don't work on alpha. Oops. - -* Thu Mar 25 1999 Bill Nottingham -- always create codepages - -* Tue Mar 23 1999 Bill Nottingham -- logrotate changes - -* Sun Mar 21 1999 Cristian Gafton -- auto rebuild in the new build environment (release 3) - -* Fri Mar 19 1999 Preston Brown -- updated init script to use graceful restart (not stop/start) - -* Tue Mar 9 1999 Bill Nottingham -- update to 2.0.3 - -* Thu Feb 18 1999 Bill Nottingham -- update to 2.0.2 - -* Mon Feb 15 1999 Bill Nottingham -- swat swat - -* Tue Feb 9 1999 Bill Nottingham -- fix bash2 breakage in post script - -* Fri Feb 5 1999 Bill Nottingham -- update to 2.0.0 - -* Mon Oct 12 1998 Cristian Gafton -- make sure all binaries are stripped - -* Thu Sep 17 1998 Jeff Johnson -- update to 1.9.18p10. -- fix %%triggerpostun. - -* Tue Jul 07 1998 Erik Troan -- updated postun triggerscript to check $0 -- clear /etc/codepages from %%preun instead of %%postun - -* Mon Jun 08 1998 Erik Troan -- made the %%postun script a tad less agressive; no reason to remove - the logs or lock file (after all, if the lock file is still there, - samba is still running) -- the %%postun and %%preun should only exectute if this is the final - removal -- migrated %%triggerpostun from Red Hat's samba package to work around - packaging problems in some Red Hat samba releases - -* Sun Apr 26 1998 John H Terpstra -- minor tidy up in preparation for release of 1.9.18p5 -- added findsmb utility from SGI package - -* Wed Mar 18 1998 John H Terpstra -- Updated version and codepage info. -- Release to test name resolve order - -* Sat Jan 24 1998 John H Terpstra -- Many optimisations (some suggested by Manoj Kasichainula -- Use of chkconfig in place of individual symlinks to /etc/rc.d/init/smb -- Compounded make line -- Updated smb.init restart mechanism -- Use compound mkdir -p line instead of individual calls to mkdir -- Fixed smb.conf file path for log files -- Fixed smb.conf file path for incoming smb print spool directory -- Added a number of options to smb.conf file -- Added smbadduser command (missed from all previous RPMs) - Doooh! -- Added smbuser file and smb.conf file updates for username map - +%autochangelog From 5ae3a0ccb0e0751ac40e276e86d0d6061d76b4bf Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 22 May 2024 09:54:05 +0200 Subject: [PATCH 317/425] Improve setting the version number for pre-releases [skip changelog] --- samba.spec | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/samba.spec b/samba.spec index 143402e..d13651e 100644 --- a/samba.spec +++ b/samba.spec @@ -148,14 +148,22 @@ %global samba_version 4.20.1 -# Use 'autorelease -b 100' to start counting at 100 +# The release field is extended: +# [.][.]%%{?dist}[.] +# Square brackets indicate an optional item. +# +# The autorelease macro accepts these parameters to allow packagers to specify +# those added fields: +# +# -p: Designates a pre-release, i.e. pkgrel will be prefixed with '0.'. +# -e : Allows specifying the extraver portion of the release. +# -b : Allows specifying a custom base release number (the +# default is 1). %global samba_release %autorelease %global pre_release %nil %if "x%{?pre_release}" != "x" -%global baserelease 1 -# This should be rc1 or %%nil -%global samba_release 0.%{baserelease}.%{pre_release}%{?dist} +%global samba_release %autorelease -p -e %pre_release %endif From e5c614494cb9ff14322c0070409adc6fb50ba996 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Mon, 10 Jun 2024 11:52:50 +0200 Subject: [PATCH 318/425] Rebuilt for Python 3.13 From 2588fdd81f38d423c73f8712ad3735685d54a0af Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 19 Jun 2024 16:43:35 +0200 Subject: [PATCH 319/425] resolves: #2293100 - Update to version 4.20.2 Guenther --- .gitignore | 2 ++ samba.spec | 6 ++++-- sources | 4 ++-- 3 files changed, 8 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index fd0792f..e9c42cc 100644 --- a/.gitignore +++ b/.gitignore @@ -367,3 +367,5 @@ samba-3.6.0pre1.tar.gz /samba-4.20.0.tar.asc /samba-4.20.1.tar.xz /samba-4.20.1.tar.asc +/samba-4.20.2.tar.xz +/samba-4.20.2.tar.asc diff --git a/samba.spec b/samba.spec index d13651e..c48b206 100644 --- a/samba.spec +++ b/samba.spec @@ -146,7 +146,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.20.1 +%global samba_version 4.20.2 # The release field is extended: # [.][.]%%{?dist}[.] @@ -193,7 +193,7 @@ %global talloc_version 2.4.2 %global tdb_version 1.4.10 %global tevent_version 0.16.1 -%global ldb_version 2.9.0 +%global ldb_version 2.9.1 %global required_mit_krb5 1.20.1 @@ -3159,6 +3159,7 @@ fi %{python3_sitearch}/samba/tests/blackbox/__pycache__/http_chunk.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/http_content.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/mdsearch.*.pyc +%{python3_sitearch}/samba/tests/blackbox/__pycache__/misc_dfs_widelink.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/ndrdump.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/netads_dns.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/netads_json.*.pyc @@ -3181,6 +3182,7 @@ fi %{python3_sitearch}/samba/tests/blackbox/http_chunk.py %{python3_sitearch}/samba/tests/blackbox/http_content.py %{python3_sitearch}/samba/tests/blackbox/mdsearch.py +%{python3_sitearch}/samba/tests/blackbox/misc_dfs_widelink.py %{python3_sitearch}/samba/tests/blackbox/ndrdump.py %{python3_sitearch}/samba/tests/blackbox/netads_dns.py %{python3_sitearch}/samba/tests/blackbox/netads_json.py diff --git a/sources b/sources index cfeeed8..9abdbb7 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.20.1.tar.xz) = 7cef945833516b305a2eb6bd4717cc4e8d895575e6dcf7a47d80fa1859847adeb4a9f32814bafdd5c732ce63d793ca168b7f4e0bdda89c56f10d1595ea45b5c0 -SHA512 (samba-4.20.1.tar.asc) = 5ce9f0e4358c1ff5ce991204aaf72e1dfe431ba2686d12f1668b15c7b48247666ecbf6354acbadbcf5e77e657ef93bc07fab0ff7ed7b8a7588f5bcc7bf6facef +SHA512 (samba-4.20.2.tar.xz) = cf07b12b6c1ac9bc3fd0df7fd658529ebd08309a0823f49c68dd3c55c0c80f412d6af50a0f78b8f4484635029aeb292a72dd0a6638edbd463e73baff404d5315 +SHA512 (samba-4.20.2.tar.asc) = a0051efdca684bc6c3e40367b0a8b862d0b1b988aa9c15ec6987d5f97440daa1f7609e6be61611aa9bbed56d89e0258b192c43028384899c75c4cd449cc99694 From 4b62d2684298370063a424705fedba764002d829 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 25 Jun 2024 14:27:11 +0200 Subject: [PATCH 320/425] resolves: #2293108 - Move LICENSE file to samba-common Guenther --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index c48b206..a9f0ff9 100644 --- a/samba.spec +++ b/samba.spec @@ -1657,7 +1657,6 @@ fi ### SAMBA %files -%license COPYING %doc README.md WHATSNEW.txt %doc examples/autofs examples/LDAP examples/misc %doc examples/printer-accounting examples/printing @@ -1995,6 +1994,7 @@ fi ### COMMON %files common +%license COPYING %{_tmpfilesdir}/samba.conf %{_sysusersdir}/samba.conf %dir %{_sysconfdir}/logrotate.d/ From 41e97d4a9dc82598b1840ee9d778db5fdbdfc9d0 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 1 Jul 2024 11:41:48 +0200 Subject: [PATCH 321/425] Move README.md and WHATSNEW.txt to samba-common --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index a9f0ff9..3a8f7db 100644 --- a/samba.spec +++ b/samba.spec @@ -1657,7 +1657,6 @@ fi ### SAMBA %files -%doc README.md WHATSNEW.txt %doc examples/autofs examples/LDAP examples/misc %doc examples/printer-accounting examples/printing %doc packaging/README.downgrade @@ -1994,6 +1993,7 @@ fi ### COMMON %files common +%doc README.md WHATSNEW.txt %license COPYING %{_tmpfilesdir}/samba.conf %{_sysusersdir}/samba.conf From 44bb1d44388b6e844a4cde88be0c008b0caabc10 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 20 Jul 2024 04:44:46 +0000 Subject: [PATCH 322/425] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild From ac58d580e8ff60046b6600a1f6c843391ae1ffdd Mon Sep 17 00:00:00 2001 From: Christoph Erhardt Date: Mon, 5 Aug 2024 08:21:41 +0200 Subject: [PATCH 323/425] Re-enable linking with mold on i686 --- samba.spec | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 3a8f7db..336f2ca 100644 --- a/samba.spec +++ b/samba.spec @@ -342,7 +342,7 @@ BuildRequires: zlib-devel >= 1.2.3 BuildRequires: pkgconfig(libsystemd) -%ifnarch i686 riscv64 +%ifnarch riscv64 %if 0%{?fedora} >= 37 BuildRequires: mold %endif @@ -1282,13 +1282,13 @@ export python_LDFLAGS="$(echo %{__global_ldflags} | sed -e 's/-Wl,-z,defs//g')" # Use the mold linker if possible export python_LDFLAGS="$(echo %{__global_ldflags} | sed -e 's/-Wl,-z,defs//g')" -%ifnarch i686 riscv64 +%ifnarch riscv64 %if 0%{?fedora} >= 37 export LDFLAGS="%{__global_ldflags} -fuse-ld=mold" export python_LDFLAGS="$(echo ${LDFLAGS} | sed -e 's/-Wl,-z,defs//g')" #endif fedora >= 37 %endif -#endif narch i686 +#endif narch riscv64 %endif # Add support for mock ccache plugin From 3dd6bed73b9fff21ca4f7d01a56e3b749233ac9d Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sat, 17 Aug 2024 16:16:53 +0100 Subject: [PATCH 324/425] Update to version 4.20.4 --- .gitignore | 373 +---------------------------------------------------- samba.spec | 2 +- sources | 4 +- 3 files changed, 5 insertions(+), 374 deletions(-) diff --git a/.gitignore b/.gitignore index e9c42cc..a695288 100644 --- a/.gitignore +++ b/.gitignore @@ -1,371 +1,2 @@ -samba-3.5.4.tar.gz -samba-3.6.0pre1.tar.gz -/samba-3.6.0pre2.tar.gz -/samba-3.6.0pre3.tar.gz -/samba-3.6.0rc1.tar.gz -/samba-3.6.0rc2.tar.gz -/samba-3.6.0rc3.tar.gz -/samba-3.6.0.tar.gz -/samba-3.6.1.tar.gz -/samba-3.6.3.tar.gz -/samba-3.6.4.tar.gz -/samba-3.6.5.tar.gz -/samba-3.6.6.tar.gz -/samba-3.6.7.tar.gz -/samba-4.0.0rc1.tar.bz2 -/samba-4.0.0rc2.tar.bz2 -/samba-4.0.0rc3.tar.bz2 -/samba-4.0.0rc4.tar.bz2 -/samba-4.0.0rc5.tar.bz2 -/samba-4.0.0rc6.tar.bz2 -/samba-4.0.0.tar.bz2 -/samba-4.0.1.tar.bz2 -/samba-4.0.2.tar.bz2 -/samba-4.0.3.tar.bz2 -/samba-4.0.4.tar.bz2 -/samba-4.0.5.tar.bz2 -/samba-4.0.6.tar.bz2 -/samba-4.0.7.tar.xz -/samba-4.1.0rc1.tar.xz -/samba-4.1.0rc2.tar.xz -/samba-4.1.0rc3.tar.xz -/samba-4.1.0rc4.tar.xz -/samba-4.1.0.tar.xz -/samba-4.1.1.tar.xz -/samba-4.1.2.tar.xz -/samba-4.1.3.tar.xz -/samba-4.1.4.tar.xz -/samba-4.1.5.tar.xz -/samba-4.1.6.tar.xz -/samba-4.1.8.tar.xz -/samba-4.1.9.tar.xz -/samba-4.1.11.tar.gz -/samba-4.1.11.tar.xz -/samba-4.1.12.tar.xz -/samba-4.2.0rc2.tar.xz -/samba-4.2.0rc3.tar.xz -/samba-4.2.0rc4.tar.xz -/samba-4.2.0rc5.tar.xz -/samba-4.2.0.tar.xz -/samba-4.2.1.tar.xz -/samba-4.2.2.tar.xz -/samba-4.2.3.tar.xz -/samba-4.3.0rc3.tar.xz -/samba-4.3.0rc4.tar.xz -/samba-4.3.0.tar.xz -/samba-4.3.1.tar.xz -/samba-4.3.2.tar.xz -/samba-4.3.3.tar.xz -/samba-4.3.4.tar.xz -/samba-4.4.0rc1.tar.xz -/samba-4.4.0rc2.tar.xz -/samba-4.4.0rc3.tar.xz -/samba-4.4.0rc4.tar.xz -/samba-4.4.0rc5.tar.xz -/samba-4.4.0.tar.xz -/samba-4.4.2.tar.xz -/samba-4.4.3.tar.xz -/samba-4.4.4.tar.xz -/samba-4.4.5.tar.xz -/samba-4.5.0rc1.tar.xz -/samba-4.5.0rc2.tar.xz -/samba-4.5.0rc3.tar.xz -/samba-4.5.0.tar.xz -/samba-4.5.1.tar.xz -/samba-4.5.2.tar.xz -/samba-4.5.3.tar.xz -/samba-4.6.0rc1.tar.xz -/samba-4.6.0rc2.tar.xz -/samba-4.6.0rc2.tar.asc -/samba-4.6.0rc3.tar.asc -/samba-4.6.0rc3.tar.xz -/samba-4.6.0rc4.tar.xz -/samba-4.6.0rc4.tar.asc -/samba-4.6.0.tar.asc -/samba-4.6.0.tar.xz -/samba-4.6.1.tar.xz -/samba-4.6.1.tar.asc -/samba-4.6.2.tar.xz -/samba-4.6.2.tar.asc -/samba-4.6.3.tar.xz -/samba-4.6.3.tar.asc -/samba-4.6.4.tar.xz -/samba-4.6.4.tar.asc -/samba-4.6.5.tar.xz -/samba-4.6.5.tar.asc -/samba-4.7.0rc1.tar.xz -/samba-4.7.0rc1.tar.asc -/samba-4.7.0rc3.tar.xz -/samba-4.7.0rc3.tar.asc -/samba-4.7.0rc5.tar.xz -/samba-4.7.0rc5.tar.asc -/samba-4.7.0rc6.tar.xz -/samba-4.7.0rc6.tar.asc -/samba-4.7.0.tar.xz -/samba-4.7.0.tar.asc -/samba-4.7.1.tar.xz -/samba-4.7.1.tar.asc -/samba-4.7.2.tar.xz -/samba-4.7.2.tar.asc -/samba-4.7.3.tar.xz -/samba-4.7.3.tar.asc -/samba-4.7.4.tar.xz -/samba-4.7.4.tar.asc -/samba-4.8.0rc1.tar.xz -/samba-4.8.0rc1.tar.asc -/samba-4.8.0rc2.tar.xz -/samba-4.8.0rc2.tar.asc -/samba-4.8.0rc3.tar.xz -/samba-4.8.0rc3.tar.asc -/samba-4.8.0rc4.tar.xz -/samba-4.8.0rc4.tar.asc -/samba-4.8.0.tar.xz -/samba-4.8.0.tar.asc -/samba-4.8.1.tar.xz -/samba-4.8.1.tar.asc -/samba-4.8.2.tar.xz -/samba-4.8.2.tar.asc -/samba-4.8.3.tar.asc -/samba-4.8.3.tar.xz -/samba-4.9.0rc1.tar.xz -/samba-4.9.0rc1.tar.asc -/samba-4.9.0rc2.tar.xz -/samba-4.9.0rc2.tar.asc -/samba-4.9.0rc3.tar.xz -/samba-4.9.0rc3.tar.asc -/samba-4.9.0rc4.tar.xz -/samba-4.9.0rc4.tar.asc -/samba-4.9.0rc5.tar.asc -/samba-4.9.0rc5.tar.xz -/samba-4.9.0.tar.xz -/samba-4.9.0.tar.asc -/samba-4.9.1.tar.asc -/samba-4.9.1.tar.xz -/samba-4.9.2.tar.xz -/samba-4.9.2.tar.asc -/samba-4.9.3.tar.xz -/samba-4.9.3.tar.asc -/samba-4.9.4.tar.xz -/samba-4.9.4.tar.asc -/samba-4.10.0rc1.tar.xz -/samba-4.10.0rc1.tar.asc -/samba-4.10.0rc2.tar.xz -/samba-4.10.0rc2.tar.asc -/samba-4.10.0rc3.tar.xz -/samba-4.10.0rc3.tar.asc -/samba-4.10.0rc4.tar.xz -/samba-4.10.0rc4.tar.asc -/samba-4.10.0.tar.xz -/samba-4.10.0.tar.asc -/samba-4.10.1.tar.xz -/samba-4.10.1.tar.asc -/samba-4.10.2.tar.xz -/samba-4.10.2.tar.asc -/samba-4.10.3.tar.xz -/samba-4.10.3.tar.asc -/samba-4.10.4.tar.xz -/samba-4.10.4.tar.asc -/samba-4.10.5.tar.xz -/samba-4.10.5.tar.asc -/samba-4.10.6.tar.xz -/samba-4.10.6.tar.asc -/samba-4.11.0rc1.tar.xz -/samba-4.11.0rc1.tar.asc -/samba-4.11.0rc2.tar.xz -/samba-4.11.0rc2.tar.asc -/samba-4.11.0rc3.tar.xz -/samba-4.11.0rc3.tar.asc -/samba-4.11.0rc4.tar.xz -/samba-4.11.0rc4.tar.asc -/samba-4.11.0.tar.xz -/samba-4.11.0.tar.asc -/samba-4.11.1.tar.xz -/samba-4.11.1.tar.asc -/samba-4.11.2.tar.xz -/samba-4.11.2.tar.asc -/samba-4.11.3.tar.xz -/samba-4.11.3.tar.asc -/samba-4.11.4.tar.xz -/samba-4.11.4.tar.asc -/samba-4.11.5.tar.xz -/samba-4.11.5.tar.asc -/samba-4.12.0rc1.tar.xz -/samba-4.12.0rc1.tar.asc -/samba-4.12.0rc2.tar.xz -/samba-4.12.0rc2.tar.asc -/samba-4.12.0rc3.tar.xz -/samba-4.12.0rc3.tar.asc -/samba-4.12.0rc4.tar.xz -/samba-4.12.0rc4.tar.asc -/samba-4.12.0.tar.xz -/samba-4.12.0.tar.asc -/samba-4.12.1.tar.xz -/samba-4.12.1.tar.asc -/samba-4.12.2.tar.xz -/samba-4.12.2.tar.asc -/samba-4.12.3.tar.xz -/samba-4.12.3.tar.asc -/samba-4.12.4.tar.xz -/samba-4.12.4.tar.asc -/samba-4.12.5.tar.xz -/samba-4.12.5.tar.asc -/samba-4.13.0rc1.tar.xz -/samba-4.13.0rc1.tar.asc -/samba-4.13.0rc2.tar.xz -/samba-4.13.0rc2.tar.asc -/samba-4.13.0rc3.tar.xz -/samba-4.13.0rc3.tar.asc -/samba-4.13.0rc4.tar.xz -/samba-4.13.0rc4.tar.asc -/samba-4.13.0rc5.tar.xz -/samba-4.13.0rc5.tar.asc -/samba-4.13.0rc6.tar.xz -/samba-4.13.0rc6.tar.asc -/samba-4.13.0.tar.xz -/samba-4.13.0.tar.asc -/samba-4.13.1.tar.xz -/samba-4.13.1.tar.asc -/samba-4.13.2.tar.xz -/samba-4.13.2.tar.asc -/samba-4.13.3.tar.xz -/samba-4.13.3.tar.asc -/samba-4.13.4.tar.xz -/samba-4.13.4.tar.asc -/samba-4.14.0rc1.tar.xz -/samba-4.14.0rc1.tar.asc -/samba-4.14.0rc2.tar.xz -/samba-4.14.0rc2.tar.asc -/samba-4.14.0rc3.tar.xz -/samba-4.14.0rc3.tar.asc -/samba-4.14.0rc4.tar.xz -/samba-4.14.0rc4.tar.asc -/samba-4.14.0.tar.xz -/samba-4.14.0.tar.asc -/samba-4.14.1.tar.xz -/samba-4.14.1.tar.asc -/samba-4.14.2.tar.xz -/samba-4.14.2.tar.asc -/samba-4.14.3.tar.xz -/samba-4.14.3.tar.asc -/samba-4.14.4.tar.xz -/samba-4.14.4.tar.asc -/samba-4.14.5.tar.xz -/samba-4.14.5.tar.asc -/samba-4.14.6.tar.xz -/samba-4.14.6.tar.asc -/samba-4.15.0rc1.tar.xz -/samba-4.15.0rc1.tar.asc -/samba-4.15.0rc2.tar.xz -/samba-4.15.0rc2.tar.asc -/samba-4.15.0rc3.tar.xz -/samba-4.15.0rc3.tar.asc -/samba-4.15.0rc4.tar.xz -/samba-4.15.0rc4.tar.asc -/samba-4.15.0rc5.tar.xz -/samba-4.15.0rc5.tar.asc -/samba-4.15.0rc6.tar.xz -/samba-4.15.0rc6.tar.asc -/samba-4.15.0rc7.tar.xz -/samba-4.15.0rc7.tar.asc -/samba-4.15.0.tar.xz -/samba-4.15.0.tar.asc -/samba-4.15.1.tar.xz -/samba-4.15.1.tar.asc -/samba-4.15.2.tar.xz -/samba-4.15.2.tar.asc -/samba-4.15.3.tar.xz -/samba-4.15.3.tar.asc -/samba-4.15.4.tar.xz -/samba-4.15.4.tar.asc -/samba-4.16.0rc1.tar.xz -/samba-4.16.0rc1.tar.asc -/samba-4.16.0rc2.tar.xz -/samba-4.16.0rc2.tar.asc -/samba-4.16.0rc3.tar.xz -/samba-4.16.0rc3.tar.asc -/samba-4.16.0rc4.tar.xz -/samba-4.16.0rc4.tar.asc -/samba-4.16.0rc5.tar.xz -/samba-4.16.0rc5.tar.asc -/samba-4.16.0.tar.xz -/samba-4.16.0.tar.asc -/samba-4.16.1.tar.xz -/samba-4.16.1.tar.asc -/samba-4.16.2.tar.xz -/samba-4.16.2.tar.asc -/samba-4.16.3.tar.xz -/samba-4.16.3.tar.asc -/samba-4.16.4.tar.xz -/samba-4.16.4.tar.asc -/samba-4.17.0rc1.tar.xz -/samba-4.17.0rc1.tar.asc -/samba-4.17.0rc2.tar.xz -/samba-4.17.0rc2.tar.asc -/samba-4.17.0rc3.tar.asc -/samba-4.17.0rc3.tar.xz -/samba-4.17.0rc4.tar.xz -/samba-4.17.0rc4.tar.asc -/samba-4.17.0rc5.tar.xz -/samba-4.17.0rc5.tar.asc -/samba-4.17.0.tar.xz -/samba-4.17.0.tar.asc -/samba-4.17.1.tar.xz -/samba-4.17.1.tar.asc -/samba-4.17.2.tar.xz -/samba-4.17.2.tar.asc -/samba-4.17.3.tar.xz -/samba-4.17.3.tar.asc -/samba-4.17.4.tar.xz -/samba-4.17.4.tar.asc -/samba-4.18.0rc1.tar.xz -/samba-4.18.0rc1.tar.asc -/samba-4.18.0rc2.tar.xz -/samba-4.18.0rc2.tar.asc -/samba-4.18.0rc3.tar.xz -/samba-4.18.0rc3.tar.asc -/samba-4.18.0rc4.tar.xz -/samba-4.18.0rc4.tar.asc -/samba-4.18.0.tar.xz -/samba-4.18.0.tar.asc -/samba-4.18.1.tar.xz -/samba-4.18.1.tar.asc -/samba-4.18.2.tar.xz -/samba-4.18.2.tar.asc -/samba-4.18.3.tar.xz -/samba-4.18.3.tar.asc -/samba-4.18.4.tar.xz -/samba-4.18.4.tar.asc -/samba-4.18.5.tar.xz -/samba-4.18.5.tar.asc -/samba-4.19.0rc1.tar.xz -/samba-4.19.0rc1.tar.asc -/samba-4.19.0rc2.tar.xz -/samba-4.19.0rc2.tar.asc -/samba-4.19.0rc3.tar.xz -/samba-4.19.0rc3.tar.asc -/samba-4.19.0rc4.tar.xz -/samba-4.19.0rc4.tar.asc -/samba-4.19.0.tar.xz -/samba-4.19.0.tar.asc -/samba-4.19.1.tar.xz -/samba-4.19.1.tar.asc -/samba-4.19.2.tar.xz -/samba-4.19.2.tar.asc -/samba-4.19.3.tar.xz -/samba-4.19.3.tar.asc -/samba-4.19.4.tar.xz -/samba-4.19.4.tar.asc -/samba-4.20.0rc1.tar.xz -/samba-4.20.0rc1.tar.asc -/samba-4.20.0rc2.tar.xz -/samba-4.20.0rc2.tar.asc -/samba-4.20.0rc3.tar.xz -/samba-4.20.0rc3.tar.asc -/samba-4.20.0rc4.tar.xz -/samba-4.20.0rc4.tar.asc -/samba-4.20.0.tar.xz -/samba-4.20.0.tar.asc -/samba-4.20.1.tar.xz -/samba-4.20.1.tar.asc -/samba-4.20.2.tar.xz -/samba-4.20.2.tar.asc +/samba-*.tar.xz +/samba-*.tar.asc diff --git a/samba.spec b/samba.spec index 336f2ca..dcc42c3 100644 --- a/samba.spec +++ b/samba.spec @@ -146,7 +146,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.20.2 +%global samba_version 4.20.4 # The release field is extended: # [.][.]%%{?dist}[.] diff --git a/sources b/sources index 9abdbb7..fa51daa 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.20.2.tar.xz) = cf07b12b6c1ac9bc3fd0df7fd658529ebd08309a0823f49c68dd3c55c0c80f412d6af50a0f78b8f4484635029aeb292a72dd0a6638edbd463e73baff404d5315 -SHA512 (samba-4.20.2.tar.asc) = a0051efdca684bc6c3e40367b0a8b862d0b1b988aa9c15ec6987d5f97440daa1f7609e6be61611aa9bbed56d89e0258b192c43028384899c75c4cd449cc99694 +SHA512 (samba-4.20.4.tar.xz) = 390805d006c380e83f0a0f6f0c00cd6605c32c937f4cf11e7ac5b177abd4538b0be40c505d72c500855f28a625f60aaa007c4466c316c3f93bfb5baa583f384f +SHA512 (samba-4.20.4.tar.asc) = ff8369bf307e56fe842a101b05dcbf382779a3812763e67b573449412195777fce25864ca4e0d89c126bc46cf3a2d359c5d5bda68b60af8849cd91f9d418ee98 From d04728829da7462c35ceaf0fdbc43107ad9fd72c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 29 Jul 2024 18:15:46 +0200 Subject: [PATCH 325/425] Update to Samba 4.21.0rc2 - Package libldb a public library - resolves: #2300469 Pair-Programmed-With: Andreas Schneider --- samba.spec | 384 +++++++++++++++------ sources | 4 +- sync_machine_password_script_install.patch | 91 +++++ 3 files changed, 376 insertions(+), 103 deletions(-) create mode 100644 sync_machine_password_script_install.patch diff --git a/samba.spec b/samba.spec index dcc42c3..22d0376 100644 --- a/samba.spec +++ b/samba.spec @@ -8,7 +8,7 @@ # %bcond_with testsuite -# Build with internal talloc, tevent, tdb and ldb. +# Build with internal talloc, tevent, tdb # # fedpkg mockbuild --with=testsuite --with=includelibs # or @@ -144,9 +144,15 @@ %bcond_with gpupdate %endif +%ifarch aarch64 ppc64le s390x x86_64 +%bcond lmdb 1 +%else +%bcond lmdb 0 +%endif + %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.20.4 +%global samba_version 4.21.0 # The release field is extended: # [.][.]%%{?dist}[.] @@ -161,7 +167,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release %nil +%global pre_release rc2 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif @@ -174,13 +180,14 @@ %global libdcerpc_so_version 0 %global libndr_krb5pac_so_version 0 %global libndr_nbt_so_version 0 -%global libndr_so_version 4 +%global libndr_so_version 5 %global libndr_standard_so_version 0 %global libnetapi_so_version 1 %global libsamba_credentials_so_version 1 %global libsamba_errors_so_version 1 %global libsamba_hostconfig_so_version 0 %global libsamba_passdb_so_version 0 +%global libsamba_policy_so_version 0 %global libsamba_util_so_version 0 %global libsamdb_so_version 0 %global libsmbconf_so_version 0 @@ -191,9 +198,8 @@ %global libwbclient_so_version 0 %global talloc_version 2.4.2 -%global tdb_version 1.4.10 +%global tdb_version 1.4.11 %global tevent_version 0.16.1 -%global ldb_version 2.9.1 %global required_mit_krb5 1.20.1 @@ -248,6 +254,8 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore +Patch0: sync_machine_password_script_install.patch + Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} @@ -291,6 +299,7 @@ BuildRequires: bison BuildRequires: cups-devel BuildRequires: dbus-devel BuildRequires: docbook-style-xsl +BuildRequires: doxygen BuildRequires: e2fsprogs-devel BuildRequires: flex BuildRequires: gawk @@ -309,7 +318,10 @@ BuildRequires: libcmocka-devel BuildRequires: libtirpc-devel BuildRequires: libuuid-devel BuildRequires: libxslt +%if %{with lmdb} BuildRequires: lmdb +BuildRequires: lmdb-devel >= 0.9.16 +%endif %if %{with winexe} BuildRequires: mingw32-gcc BuildRequires: mingw64-gcc @@ -389,17 +401,6 @@ BuildRequires: python3-tevent >= %{tevent_version} BuildRequires: libtdb-devel >= %{tdb_version} BuildRequires: python3-tdb >= %{tdb_version} - -BuildRequires: libldb-devel >= %{ldb_version} -BuildRequires: python3-ldb >= %{ldb_version} -BuildRequires: python3-ldb-devel >= %{ldb_version} -%endif - -%if %{with includelibs} || %{with testsuite} -# lmdb-devel is required for the mdb ldb module, if samba is configured -# to build includelibs we need lmdb-devel for building that module on our own -BuildRequires: lmdb-devel -#endif without includelibs %endif %if %{with dc} || %{with testsuite} @@ -417,7 +418,6 @@ BuildRequires: python3-setproctitle %if %{without includelibs} BuildRequires: tdb-tools -BuildRequires: ldb-tools #endif without includelibs %endif @@ -559,7 +559,9 @@ Requires: python3-%{name} = %{samba_depver} Requires: python3-%{name}-dc = %{samba_depver} %if %{with dc} # samba-tool needs mdb_copy and tdbackup for domain backup or upgrade provision +%if %{with lmdb} Requires: lmdb +%endif Requires: tdb-tools Requires: python3-gpg %endif @@ -603,11 +605,7 @@ Requires: libwbclient = %{samba_depver} Requires: ldb-tools Requires: python3-setproctitle -# Force using libldb version to be the same as build version -# Otherwise LDB modules will not be loaded and samba-tool will fail -# See bug 1507420 -%samba_requires_eq libldb - +Requires: libldb = %{samba_depver} Requires: python3-%{name} = %{samba_depver} Requires: python3-%{name}-dc = %{samba_depver} Requires: krb5-server >= %{required_mit_krb5} @@ -896,13 +894,6 @@ Provides: bundled(libreplace) The python3-%{name} package contains the Python 3 libraries needed by programs that use SMB, RPC and other Samba provided protocols in Python 3 programs. -%package -n python3-%{name}-devel -Summary: Samba python devel files -Requires: python3-%{name} = %{samba_depver} - -%description -n python3-%{name}-devel -The python3-%{name}-devel package contains the Python 3 devel files. - %package -n python3-samba-test Summary: Samba Python libraries Requires: python3-%{name} = %{samba_depver} @@ -1221,7 +1212,79 @@ Support for using an existing CEPH cluster as a mutex helper for CTDB #endif with clustering %endif +### LIBLDB +%package -n libldb +Summary: A schema-less, ldap like, API and database +License: LGPL-3.0-or-later +Requires: libtalloc%{?_isa} >= %{talloc_version} +Requires: libtdb%{?_isa} >= %{tdb_version} +Requires: libtevent%{?_isa} >= %{tevent_version} +Provides: bundled(libreplace) +Obsoletes: libldb < 2.10 +Provides: libldb = %{samba_depver} + +%description -n libldb +An extensible library that implements an LDAP like API to access remote LDAP +servers, or use local tdb databases. + +### LIBLDB-DEVEL +%package -n libldb-devel +Summary: Developer tools for the LDB library +License: LGPL-3.0-or-later +Requires: libldb%{?_isa} = %{version}-%{release} +Requires: libtdb-devel%{?_isa} >= %{tdb_version} +Requires: libtalloc-devel%{?_isa} >= %{talloc_version} +Requires: libtevent-devel%{?_isa} >= %{tevent_version} + +Obsoletes: libldb-devel < 2.10 +Provides: libldb-devel = %{samba_depver} + +%description -n libldb-devel +Header files needed to develop programs that link against the LDB library. + +### LDB-TOOLS +%package -n ldb-tools +Summary: Tools to manage LDB files +License: LGPL-3.0-or-later +Requires: libldb%{?_isa} = %{samba_release} +Obsoletes: ldb-tools < 2.10 +Provides: ldb-tools = %{samba_depver} + +%description -n ldb-tools +Tools to manage LDB files + +### PYTHON3-LDB-DEVEL-COMMON +%package -n python-ldb-devel-common +Summary: Common development files for the Python bindings for the LDB library +License: LGPL-3.0-or-later + +Provides: pyldb-devel%{?_isa} = %{version}-%{release} +%{?python_provide:%python_provide python2-ldb-devel} + +Obsoletes: python-ldb-devel-common < 2.10 +Provides: python-ldb-devel-common = %{samba_depver} + +%description -n python-ldb-devel-common +Development files for the Python bindings for the LDB library. +This package includes files that aren't specific to a Python version. + +### PYTHON3-LDB +%package -n python3-ldb +Summary: Python bindings for the LDB library +License: LGPL-3.0-or-later +Requires: libldb%{?_isa} = %{version}-%{release} +Requires: python3-tdb%{?_isa} >= %{tdb_version} +%{?python_provide:%python_provide python3-ldb} + +Obsoletes: python3-ldb < 2.10 +Provides: python3-ldb = %{samba_depver} +# These were the C bindings, only used by Samba +Obsoletes: python3-ldb-devel < 2.10 +Provides: python3-ldb-devel = %{samba_depver} + +%description -n python3-ldb +Python bindings for the LDB library %prep %if 0%{?fedora} || 0%{?rhel} >= 9 @@ -1239,16 +1302,14 @@ rm -rfv third_party/heimdal %global _talloc_lib ,talloc,pytalloc,pytalloc-util %global _tevent_lib ,tevent,pytevent %global _tdb_lib ,tdb,pytdb -%global _ldb_lib ,ldb,pyldb,pyldb-util %else %global _talloc_lib ,!talloc,!pytalloc,!pytalloc-util %global _tevent_lib ,!tevent,!pytevent %global _tdb_lib ,!tdb,!pytdb -%global _ldb_lib ,!ldb,!pyldb,!pyldb-util #endif with includelibs %endif -%global _samba_libraries !popt%{_talloc_lib}%{_tevent_lib}%{_tdb_lib}%{_ldb_lib} +%global _samba_bundled_libraries !popt%{_talloc_lib}%{_tevent_lib}%{_tdb_lib} %global _samba_idmap_modules idmap_ad,idmap_rid,idmap_ldap,idmap_hash,idmap_tdb2 %global _samba_pdb_modules pdb_tdbsam,pdb_ldap,pdb_smbpasswd,pdb_wbc_sam,pdb_samba4 @@ -1274,7 +1335,8 @@ rm -rfv third_party/heimdal %global _libwbclient wbclient, %endif -%global _samba_private_libraries %{_libsmbclient}%{_libwbclient} +%global _default_private_libraries !ldb,!dcerpc-samr,!samba-policy,!tevent-util,!dcerpc,!samba-hostconfig,!samba-credentials,!dcerpc_server,!samdb, +%global _samba_private_libraries %{_default_private_libraries}%{_libsmbclient}%{_libwbclient} # TODO: resolve underlinked python modules export python_LDFLAGS="$(echo %{__global_ldflags} | sed -e 's/-Wl,-z,defs//g')" @@ -1311,14 +1373,12 @@ fi --with-cachedir=/var/lib/samba \ --disable-rpath-install \ --with-shared-modules=%{_samba_modules} \ - --bundled-libraries=%{_samba_libraries} \ + --bundled-libraries=%{_samba_bundled_libraries} \ + --private-libraries=%{_samba_private_libraries} \ --with-pam \ --with-pie \ --with-relro \ --without-fam \ -%if (%{without libsmbclient}) || (%{without libwbclient}) - --private-libraries=%{_samba_private_libraries} \ -%endif --with-system-mitkrb5 \ --with-experimental-mit-ad-dc \ %if %{without dc} && %{without testsuite} @@ -1364,6 +1424,10 @@ pushd pidl %make_build popd +pushd lib/ldb +doxygen Doxyfile +popd + %install # Do not use %%make_install, make is just a wrapper around waf in Samba! %{__make} %{?_smp_mflags} %{_make_verbose} install DESTDIR=%{buildroot} @@ -1472,8 +1536,8 @@ rm -f %{buildroot}%{_mandir}/man8/vfs_ceph_snapshots.8* /sbin/ldconfig -N -n %{buildroot}%{_libdir} %if %{without dc} && %{without testsuite} -for f in samba/libsamba-net-samba4.so \ - samba/libsamba-python-samba4.so \ +for f in samba/libsamba-net-private-samba.so \ + samba/libsamba-python-private-samba.so \ libsamba-policy.so* \ pkgconfig/samba-policy.pc ; do rm -f %{buildroot}%{_libdir}/$f @@ -1496,6 +1560,10 @@ rm -f %{buildroot}%{perl_archlib}/vendor_perl/auto/Parse/Pidl/.packlist rm -rf %{buildroot}%{perl_vendorlib}/Parse/Yapp popd +# libldb manpages +cp -a lib/ldb/apidocs/man/* %{buildroot}%{_mandir} +rm -f %{buildroot}%{_mandir}/man3/_* + %if %{with testsuite} %check # @@ -1654,6 +1722,8 @@ fi %systemd_postun_with_restart ctdb.service %endif +%ldconfig_scriptlets -n libldb +%ldconfig_scriptlets -n python3-ldb ### SAMBA %files @@ -1954,7 +2024,6 @@ fi %{_libdir}/samba/libtdb-wrap-private-samba.so %{_libdir}/samba/libtime-basic-private-samba.so %{_libdir}/samba/libtorture-private-samba.so -%{_libdir}/samba/libtrusts-util-private-samba.so %{_libdir}/samba/libutil-reg-private-samba.so %{_libdir}/samba/libutil-setid-private-samba.so %{_libdir}/samba/libutil-tdb-private-samba.so @@ -1976,16 +2045,6 @@ fi %{_libdir}/samba/libtdb-private-samba.so %{_libdir}/samba/libtevent-private-samba.so -%{_libdir}/samba/ldb/asq.so -%{_libdir}/samba/ldb/ldb.so -%{_libdir}/samba/ldb/mdb.so -%{_libdir}/samba/ldb/paged_searches.so -%{_libdir}/samba/ldb/rdn_name.so -%{_libdir}/samba/ldb/sample.so -%{_libdir}/samba/ldb/server_sort.so -%{_libdir}/samba/ldb/skel.so -%{_libdir}/samba/ldb/tdb.so - %{_mandir}/man3/ldb.3.gz %{_mandir}/man3/talloc.3.gz #endif with includelibs @@ -2150,6 +2209,8 @@ fi %endif ### DC-LIBS %files dc-libs +%{_libdir}/libsamba-policy.so.%{libsamba_policy_so_version}* +%{_libdir}/samba/libsamba-net-private-samba.so %{_libdir}/samba/libauth4-private-samba.so %if %{with dc} || %{with testsuite} @@ -2299,6 +2360,7 @@ fi %{_libdir}/libsamba-credentials.so %{_libdir}/libsamba-errors.so %{_libdir}/libsamba-hostconfig.so +%{_libdir}/libsamba-policy.so %{_libdir}/libsamba-util.so %{_libdir}/libsamdb.so %{_libdir}/libsmbconf.so @@ -2311,6 +2373,7 @@ fi %{_libdir}/pkgconfig/ndr_standard.pc %{_libdir}/pkgconfig/samba-credentials.pc %{_libdir}/pkgconfig/samba-hostconfig.pc +%{_libdir}/pkgconfig/samba-policy.pc %{_libdir}/pkgconfig/samba-util.pc %{_libdir}/pkgconfig/samdb.pc %{_libdir}/libsamba-passdb.so @@ -2336,8 +2399,10 @@ fi %if %{with vfs_cephfs} %files vfs-cephfs %{_libdir}/samba/vfs/ceph.so +%{_libdir}/samba/vfs/ceph_new.so %{_libdir}/samba/vfs/ceph_snapshots.so %{_mandir}/man8/vfs_ceph.8* +%{_mandir}/man8/vfs_ceph_new.8* %{_mandir}/man8/vfs_ceph_snapshots.8* %endif @@ -2372,6 +2437,7 @@ fi %files ldb-ldap-modules %{_libdir}/samba/ldb/ldbsamba_extensions.so %{_libdir}/samba/ldb/ildap.so +%{_libdir}/samba/ldb/ldap.so ### LIBS %files libs @@ -2491,6 +2557,7 @@ fi %{python3_sitearch}/samba/__pycache__/hostconfig.*.pyc %{python3_sitearch}/samba/__pycache__/idmap.*.pyc %{python3_sitearch}/samba/__pycache__/join.*.pyc +%{python3_sitearch}/samba/__pycache__/lsa_utils.*.pyc %{python3_sitearch}/samba/__pycache__/logger.*.pyc %{python3_sitearch}/samba/__pycache__/mdb_util.*.pyc %{python3_sitearch}/samba/__pycache__/ms_display_specifiers.*.pyc @@ -2504,7 +2571,6 @@ fi %{python3_sitearch}/samba/__pycache__/sites.*.pyc %{python3_sitearch}/samba/__pycache__/subnets.*.pyc %{python3_sitearch}/samba/__pycache__/tdb_util.*.pyc -%{python3_sitearch}/samba/__pycache__/trust_utils.*.pyc %{python3_sitearch}/samba/__pycache__/upgrade.*.pyc %{python3_sitearch}/samba/__pycache__/upgradehelpers.*.pyc %{python3_sitearch}/samba/__pycache__/xattr.*.pyc @@ -2570,6 +2636,53 @@ fi %{python3_sitearch}/samba/dcerpc/xattr.*.so %{python3_sitearch}/samba/descriptor.py %{python3_sitearch}/samba/dnsresolver.py +%dir %{python3_sitearch}/samba/domain +%{python3_sitearch}/samba/domain/__init__.py +%{python3_sitearch}/samba/domain/__pycache__/__init__.*.pyc +%{python3_sitearch}/samba/domain/models/__init__.py +%{python3_sitearch}/samba/domain/models/__pycache__/__init__.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/auth_policy.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/auth_silo.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/claim_type.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/computer.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/constants.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/container.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/exceptions.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/fields.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/gmsa.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/group.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/model.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/org.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/person.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/query.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/registry.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/schema.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/site.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/subnet.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/types.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/user.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/value_type.*.pyc +%{python3_sitearch}/samba/domain/models/auth_policy.py +%{python3_sitearch}/samba/domain/models/auth_silo.py +%{python3_sitearch}/samba/domain/models/claim_type.py +%{python3_sitearch}/samba/domain/models/computer.py +%{python3_sitearch}/samba/domain/models/constants.py +%{python3_sitearch}/samba/domain/models/container.py +%{python3_sitearch}/samba/domain/models/exceptions.py +%{python3_sitearch}/samba/domain/models/fields.py +%{python3_sitearch}/samba/domain/models/gmsa.py +%{python3_sitearch}/samba/domain/models/group.py +%{python3_sitearch}/samba/domain/models/model.py +%{python3_sitearch}/samba/domain/models/org.py +%{python3_sitearch}/samba/domain/models/person.py +%{python3_sitearch}/samba/domain/models/query.py +%{python3_sitearch}/samba/domain/models/registry.py +%{python3_sitearch}/samba/domain/models/schema.py +%{python3_sitearch}/samba/domain/models/site.py +%{python3_sitearch}/samba/domain/models/subnet.py +%{python3_sitearch}/samba/domain/models/types.py +%{python3_sitearch}/samba/domain/models/user.py +%{python3_sitearch}/samba/domain/models/value_type.py %{python3_sitearch}/samba/drs_utils.py %{python3_sitearch}/samba/dsdb.*.so %{python3_sitearch}/samba/dsdb_dns.*.so @@ -2581,6 +2694,7 @@ fi %{python3_sitearch}/samba/hostconfig.py %{python3_sitearch}/samba/idmap.py %{python3_sitearch}/samba/join.py +%{python3_sitearch}/samba/lsa_utils.py %{python3_sitearch}/samba/messaging.*.so %{python3_sitearch}/samba/ndr.py %{python3_sitearch}/samba/net.*.so @@ -2733,12 +2847,30 @@ fi %{python3_sitearch}/samba/netcmd/domain/auth/__init__.py %dir %{python3_sitearch}/samba/netcmd/domain/auth/__pycache__ %{python3_sitearch}/samba/netcmd/domain/auth/__pycache__/__init__.*.pyc -%{python3_sitearch}/samba/netcmd/domain/auth/__pycache__/policy.*.pyc -%{python3_sitearch}/samba/netcmd/domain/auth/__pycache__/silo.*.pyc -%{python3_sitearch}/samba/netcmd/domain/auth/__pycache__/silo_member.*.pyc -%{python3_sitearch}/samba/netcmd/domain/auth/policy.py -%{python3_sitearch}/samba/netcmd/domain/auth/silo.py -%{python3_sitearch}/samba/netcmd/domain/auth/silo_member.py +%dir %{python3_sitearch}/samba/netcmd/domain/auth/policy +%{python3_sitearch}/samba/netcmd/domain/auth/policy/computer_allowed_to_authenticate_to.py +%{python3_sitearch}/samba/netcmd/domain/auth/policy/__init__.py +%{python3_sitearch}/samba/netcmd/domain/auth/policy/policy.py +%dir %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__ +%{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/computer_allowed_to_authenticate_to.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/__init__.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/policy.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/service_allowed_to_authenticate_from.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/service_allowed_to_authenticate_to.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/user_allowed_to_authenticate_from.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/user_allowed_to_authenticate_to.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/policy/service_allowed_to_authenticate_from.py +%{python3_sitearch}/samba/netcmd/domain/auth/policy/service_allowed_to_authenticate_to.py +%{python3_sitearch}/samba/netcmd/domain/auth/policy/user_allowed_to_authenticate_from.py +%{python3_sitearch}/samba/netcmd/domain/auth/policy/user_allowed_to_authenticate_to.py +%dir %{python3_sitearch}/samba/netcmd/domain/auth/silo +%{python3_sitearch}/samba/netcmd/domain/auth/silo/__init__.py +%{python3_sitearch}/samba/netcmd/domain/auth/silo/member.py +%dir %{python3_sitearch}/samba/netcmd/domain/auth/silo/__pycache__ +%{python3_sitearch}/samba/netcmd/domain/auth/silo/__pycache__/__init__.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/silo/__pycache__/member.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/silo/__pycache__/silo.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/silo/silo.py %{python3_sitearch}/samba/netcmd/domain/backup.py %dir %{python3_sitearch}/samba/netcmd/domain/claim %{python3_sitearch}/samba/netcmd/domain/claim/__init__.py @@ -2755,39 +2887,15 @@ fi %{python3_sitearch}/samba/netcmd/domain/functional_prep.py %{python3_sitearch}/samba/netcmd/domain/info.py %{python3_sitearch}/samba/netcmd/domain/join.py +%dir %{python3_sitearch}/samba/netcmd/domain/kds +%{python3_sitearch}/samba/netcmd/domain/kds/__init__.py +%dir %{python3_sitearch}/samba/netcmd/domain/kds/__pycache__ +%{python3_sitearch}/samba/netcmd/domain/kds/__pycache__/__init__.*.pyc +%{python3_sitearch}/samba/netcmd/domain/kds/__pycache__/root_key.*.pyc +%{python3_sitearch}/samba/netcmd/domain/kds/root_key.py %{python3_sitearch}/samba/netcmd/domain/keytab.py %{python3_sitearch}/samba/netcmd/domain/leave.py %{python3_sitearch}/samba/netcmd/domain/level.py -%dir %{python3_sitearch}/samba/netcmd/domain/models -%{python3_sitearch}/samba/netcmd/domain/models/__init__.py -%dir %{python3_sitearch}/samba/netcmd/domain/models/__pycache__ -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/__init__.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/auth_policy.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/auth_silo.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/claim_type.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/exceptions.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/fields.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/group.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/model.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/query.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/schema.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/site.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/subnet.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/user.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/value_type.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/auth_policy.py -%{python3_sitearch}/samba/netcmd/domain/models/auth_silo.py -%{python3_sitearch}/samba/netcmd/domain/models/claim_type.py -%{python3_sitearch}/samba/netcmd/domain/models/exceptions.py -%{python3_sitearch}/samba/netcmd/domain/models/fields.py -%{python3_sitearch}/samba/netcmd/domain/models/group.py -%{python3_sitearch}/samba/netcmd/domain/models/model.py -%{python3_sitearch}/samba/netcmd/domain/models/query.py -%{python3_sitearch}/samba/netcmd/domain/models/schema.py -%{python3_sitearch}/samba/netcmd/domain/models/site.py -%{python3_sitearch}/samba/netcmd/domain/models/subnet.py -%{python3_sitearch}/samba/netcmd/domain/models/user.py -%{python3_sitearch}/samba/netcmd/domain/models/value_type.py %{python3_sitearch}/samba/netcmd/domain/passwordsettings.py %{python3_sitearch}/samba/netcmd/domain/provision.py %{python3_sitearch}/samba/netcmd/domain/samba3upgrade.py @@ -2812,6 +2920,13 @@ fi %{python3_sitearch}/samba/netcmd/pso.py %{python3_sitearch}/samba/netcmd/rodc.py %{python3_sitearch}/samba/netcmd/schema.py +%dir %{python3_sitearch}/samba/netcmd/service_account +%{python3_sitearch}/samba/netcmd/service_account/__init__.py +%{python3_sitearch}/samba/netcmd/service_account/__pycache__/__init__.*.pyc +%{python3_sitearch}/samba/netcmd/service_account/__pycache__/group_msa_membership.*.pyc +%{python3_sitearch}/samba/netcmd/service_account/__pycache__/service_account.*.pyc +%{python3_sitearch}/samba/netcmd/service_account/group_msa_membership.py +%{python3_sitearch}/samba/netcmd/service_account/service_account.py %{python3_sitearch}/samba/netcmd/shell.py %{python3_sitearch}/samba/netcmd/sites.py %{python3_sitearch}/samba/netcmd/spn.py @@ -2908,20 +3023,17 @@ fi %{python3_sitearch}/samba/subunit/__pycache__/run.*.pyc %{python3_sitearch}/samba/subunit/run.py %{python3_sitearch}/samba/tdb_util.py -%{python3_sitearch}/samba/trust_utils.py %{python3_sitearch}/samba/upgrade.py %{python3_sitearch}/samba/upgradehelpers.py %{python3_sitearch}/samba/werror.*.so %{python3_sitearch}/samba/xattr.py %{python3_sitearch}/samba/xattr_native.*.so %{python3_sitearch}/samba/xattr_tdb.*.so -%{_libdir}/libsamba-policy.cpython*.so.* -%{_libdir}/samba/libsamba-net.cpython*.so +%{_libdir}/samba/libsamba-net-join.cpython*.so %{_libdir}/samba/libsamba-python.cpython*.so %if %{with includelibs} %{_libdir}/samba/libpyldb-util.cpython*.so -%{_libdir}/samba/libpytalloc-util.cpython*.so %{python3_sitearch}/__pycache__/_ldb_text*.pyc %{python3_sitearch}/__pycache__/_tdb_text*.pyc @@ -2930,16 +3042,13 @@ fi %{python3_sitearch}/_tdb_text.py %{python3_sitearch}/_tevent.cpython*.so %{python3_sitearch}/ldb.cpython*.so -%{python3_sitearch}/talloc.cpython*.so +#FIXME why is it missing? +#%{python3_sitearch}/talloc.cpython*.so %{python3_sitearch}/tdb.cpython*.so %{python3_sitearch}/tevent.py #endif with includelibs %endif -%files -n python3-%{name}-devel -%{_libdir}/libsamba-policy.*.so -%{_libdir}/pkgconfig/samba-policy.*.pc - %files -n python3-%{name}-dc %{python3_sitearch}/samba/samdb.py %{python3_sitearch}/samba/schema.py @@ -3038,6 +3147,8 @@ fi %{python3_sitearch}/samba/tests/__pycache__/dsdb_api.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dsdb_dns.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dsdb_lock.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/dsdb_quiet_env_tests.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/dsdb_quiet_provision_tests.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dsdb_schema_attributes.*.pyc %{python3_sitearch}/samba/tests/__pycache__/docs.*.pyc %{python3_sitearch}/samba/tests/__pycache__/domain_backup.*.pyc @@ -3156,6 +3267,7 @@ fi %{python3_sitearch}/samba/tests/blackbox/__pycache__/check_output.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/claims.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/downgradedatabase.*.pyc +%{python3_sitearch}/samba/tests/blackbox/__pycache__/gmsa.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/http_chunk.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/http_content.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/mdsearch.*.pyc @@ -3179,6 +3291,7 @@ fi %{python3_sitearch}/samba/tests/blackbox/check_output.py %{python3_sitearch}/samba/tests/blackbox/claims.py %{python3_sitearch}/samba/tests/blackbox/downgradedatabase.py +%{python3_sitearch}/samba/tests/blackbox/gmsa.py %{python3_sitearch}/samba/tests/blackbox/http_chunk.py %{python3_sitearch}/samba/tests/blackbox/http_content.py %{python3_sitearch}/samba/tests/blackbox/mdsearch.py @@ -3213,11 +3326,11 @@ fi %{python3_sitearch}/samba/tests/dcerpc/__pycache__/__init__.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/array.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/bare.*.pyc -%{python3_sitearch}/samba/tests/dcerpc/__pycache__/createtrustrelax.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/binding.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/dnsserver.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/integer.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/lsa.*.pyc +%{python3_sitearch}/samba/tests/dcerpc/__pycache__/lsa_utils.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/mdssvc.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/misc.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/raw_protocol.*.pyc @@ -3234,10 +3347,10 @@ fi %{python3_sitearch}/samba/tests/dcerpc/array.py %{python3_sitearch}/samba/tests/dcerpc/bare.py %{python3_sitearch}/samba/tests/dcerpc/binding.py -%{python3_sitearch}/samba/tests/dcerpc/createtrustrelax.py %{python3_sitearch}/samba/tests/dcerpc/dnsserver.py %{python3_sitearch}/samba/tests/dcerpc/integer.py %{python3_sitearch}/samba/tests/dcerpc/lsa.py +%{python3_sitearch}/samba/tests/dcerpc/lsa_utils.py %{python3_sitearch}/samba/tests/dcerpc/mdssvc.py %{python3_sitearch}/samba/tests/dcerpc/misc.py %{python3_sitearch}/samba/tests/dcerpc/raw_protocol.py @@ -3268,6 +3381,8 @@ fi %{python3_sitearch}/samba/tests/dsdb_dns.py %{python3_sitearch}/samba/tests/dsdb_lock.py %{python3_sitearch}/samba/tests/dsdb_schema_attributes.py +%{python3_sitearch}/samba/tests/dsdb_quiet_env_tests.py +%{python3_sitearch}/samba/tests/dsdb_quiet_provision_tests.py %{python3_sitearch}/samba/tests/docs.py %{python3_sitearch}/samba/tests/domain_backup.py %{python3_sitearch}/samba/tests/domain_backup_offline.py @@ -3318,6 +3433,7 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/etype_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/fast_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/gkdi_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/gmsa_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/group_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kcrypto.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_base_test.*.pyc @@ -3359,6 +3475,7 @@ fi %{python3_sitearch}/samba/tests/krb5/etype_tests.py %{python3_sitearch}/samba/tests/krb5/fast_tests.py %{python3_sitearch}/samba/tests/krb5/gkdi_tests.py +%{python3_sitearch}/samba/tests/krb5/gmsa_tests.py %{python3_sitearch}/samba/tests/krb5/group_tests.py %{python3_sitearch}/samba/tests/krb5/kcrypto.py %{python3_sitearch}/samba/tests/krb5/kdc_base_test.py @@ -3462,6 +3579,7 @@ fi %{python3_sitearch}/samba/tests/samba_tool/__pycache__/domain_auth_policy.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/domain_auth_silo.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/domain_claim.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/domain_kds_root_key.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/domain_models.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/drs_clone_dc_data_lmdb_size.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/dsacl.*.pyc @@ -3484,6 +3602,7 @@ fi %{python3_sitearch}/samba/tests/samba_tool/__pycache__/provision_userPassword_crypt.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/rodc.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/schema.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/service_account.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/silo_base.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/sites.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/timecmd.*.pyc @@ -3508,6 +3627,7 @@ fi %{python3_sitearch}/samba/tests/samba_tool/domain_auth_policy.py %{python3_sitearch}/samba/tests/samba_tool/domain_auth_silo.py %{python3_sitearch}/samba/tests/samba_tool/domain_claim.py +%{python3_sitearch}/samba/tests/samba_tool/domain_kds_root_key.py %{python3_sitearch}/samba/tests/samba_tool/domain_models.py %{python3_sitearch}/samba/tests/samba_tool/drs_clone_dc_data_lmdb_size.py %{python3_sitearch}/samba/tests/samba_tool/dsacl.py @@ -3530,6 +3650,7 @@ fi %{python3_sitearch}/samba/tests/samba_tool/provision_userPassword_crypt.py %{python3_sitearch}/samba/tests/samba_tool/rodc.py %{python3_sitearch}/samba/tests/samba_tool/schema.py +%{python3_sitearch}/samba/tests/samba_tool/service_account.py %{python3_sitearch}/samba/tests/samba_tool/silo_base.py %{python3_sitearch}/samba/tests/samba_tool/sites.py %{python3_sitearch}/samba/tests/samba_tool/timecmd.py @@ -3667,7 +3788,6 @@ fi %{_sysconfdir}/ctdb/functions %{_sysconfdir}/ctdb/nfs-linux-kernel-callout %{_sysconfdir}/ctdb/statd-callout -%config %{_sysconfdir}/sudoers.d/ctdb # CTDB scripts, no config files # script with executable bit means activated @@ -3707,6 +3827,8 @@ fi %{_libexecdir}/ctdb/ctdb_recovery_helper %{_libexecdir}/ctdb/ctdb_takeover_helper %{_libexecdir}/ctdb/smnotify +%{_libexecdir}/ctdb/statd_callout +%{_libexecdir}/ctdb/statd_callout_helper %{_libexecdir}/ctdb/tdb_mutex_check %dir %{_localstatedir}/lib/ctdb/ @@ -3737,7 +3859,6 @@ fi %{_datadir}/ctdb/events/legacy/00.ctdb.script %{_datadir}/ctdb/events/legacy/01.reclock.script %{_datadir}/ctdb/events/legacy/05.system.script -%{_datadir}/ctdb/events/legacy/06.nfs.script %{_datadir}/ctdb/events/legacy/10.interface.script %{_datadir}/ctdb/events/legacy/11.natgw.script %{_datadir}/ctdb/events/legacy/11.routing.script @@ -3746,6 +3867,7 @@ fi %{_datadir}/ctdb/events/legacy/31.clamd.script %{_datadir}/ctdb/events/legacy/40.vsftpd.script %{_datadir}/ctdb/events/legacy/41.httpd.script +%{_datadir}/ctdb/events/legacy/46.update-keytabs.script %{_datadir}/ctdb/events/legacy/47.samba-dcerpcd.script %{_datadir}/ctdb/events/legacy/48.netbios.script %{_datadir}/ctdb/events/legacy/49.winbind.script @@ -3753,6 +3875,8 @@ fi %{_datadir}/ctdb/events/legacy/60.nfs.script %{_datadir}/ctdb/events/legacy/70.iscsi.script %{_datadir}/ctdb/events/legacy/91.lvs.script +%dir %{_datadir}/ctdb/scripts +%{_datadir}/ctdb/scripts/winbind_ctdb_updatekeytab.sh %if %{with testsuite} %files -n ctdb-tests @@ -4605,5 +4729,63 @@ fi %{_mandir}/man1/winexe.1.gz %endif +%files -n libldb +%{_libdir}/libldb.so.* +%dir %{_libdir}/samba +%{_libdir}/samba/libldb-key-value-private-samba.so +%{_libdir}/samba/libldb-tdb-err-map-private-samba.so +%{_libdir}/samba/libldb-tdb-int-private-samba.so +%if %{with lmdb} +%{_libdir}/samba/libldb-mdb-int-private-samba.so +%endif + +%dir %{_libdir}/samba/ldb +%{_libdir}/samba/ldb/asq.so +%{_libdir}/samba/ldb/ldb.so +%{_libdir}/samba/ldb/mdb.so +%{_libdir}/samba/ldb/paged_searches.so +%{_libdir}/samba/ldb/rdn_name.so +%{_libdir}/samba/ldb/sample.so +%{_libdir}/samba/ldb/server_sort.so +%{_libdir}/samba/ldb/skel.so +%{_libdir}/samba/ldb/tdb.so + +%files -n libldb-devel +%{_includedir}/samba-4.0/ldb_module.h +%{_includedir}/samba-4.0/ldb_handlers.h +%{_includedir}/samba-4.0/ldb_errors.h +%{_includedir}/samba-4.0/ldb_version.h +%{_includedir}/samba-4.0/ldb.h +%{_libdir}/libldb.so + +%{_libdir}/pkgconfig/ldb.pc +%{_mandir}/man3/ldb*.gz +%{_mandir}/man3/ldif*.gz + +%files -n ldb-tools +%{_bindir}/ldbadd +%{_bindir}/ldbdel +%{_bindir}/ldbedit +%{_bindir}/ldbmodify +%{_bindir}/ldbrename +%{_bindir}/ldbsearch +%{_libdir}/samba/libldb-cmdline-private-samba.so +%{_mandir}/man1/ldbadd.1.* +%{_mandir}/man1/ldbdel.1.* +%{_mandir}/man1/ldbedit.1.* +%{_mandir}/man1/ldbmodify.1.* +%{_mandir}/man1/ldbrename.1.* +%{_mandir}/man1/ldbsearch.1.* + +%files -n python-ldb-devel-common +#{_includedir}/pyldb.h +%{_mandir}/man*/Py*.gz + +%files -n python3-ldb +%{python3_sitearch}/ldb.cpython-*.so +%{_libdir}/samba/libpyldb-util.cpython-*-private-samba.so +%{python3_sitearch}/_ldb_text.py +%{python3_sitearch}/__pycache__/_ldb_text.cpython-*.py* + %changelog %autochangelog diff --git a/sources b/sources index fa51daa..153969e 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.20.4.tar.xz) = 390805d006c380e83f0a0f6f0c00cd6605c32c937f4cf11e7ac5b177abd4538b0be40c505d72c500855f28a625f60aaa007c4466c316c3f93bfb5baa583f384f -SHA512 (samba-4.20.4.tar.asc) = ff8369bf307e56fe842a101b05dcbf382779a3812763e67b573449412195777fce25864ca4e0d89c126bc46cf3a2d359c5d5bda68b60af8849cd91f9d418ee98 +SHA512 (samba-4.21.0rc2.tar.xz) = c561a1cff99fd23baa738ce304efacfab1f7033880c6b5da6c6d2fc821a751be4f3a11b6e98700192490df17a87b9d9ba24e1ce7ed17bf6710a80d3a24ee3639 +SHA512 (samba-4.21.0rc2.tar.asc) = 415abad180a9771765a3f17978b9aa8008088ef60aee4fa98a278a8d21fa8fc2cdde4d8b8b6b23ff7476d63f642ba2a0d028e63d12f8d27eddd66030dc1068b2 diff --git a/sync_machine_password_script_install.patch b/sync_machine_password_script_install.patch new file mode 100644 index 0000000..ea70c82 --- /dev/null +++ b/sync_machine_password_script_install.patch @@ -0,0 +1,91 @@ +From 7fedd0925965705e435a4bd411fdbd0e73d8b6a6 Mon Sep 17 00:00:00 2001 +From: Anoop C S +Date: Wed, 14 Aug 2024 19:47:35 +0530 +Subject: [PATCH 1/2] source3/script: Fix installation of + winbind_ctdb_updatekeytab.sh + +winbind_ctdb_updatekeytab.sh assumes the presence `onnode` utility to +execute `net ads` command on all nodes in the cluster. But `onnode` +is only built when configured with clustering support. Therefore perform +the script installation only with ctdb configuration. Also fix the +installation path to /usr/share/ctdb/scripts. + +Signed-off-by: Anoop C S +Reviewed-by: Guenther Deschner +--- + source3/script/wscript_build | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/source3/script/wscript_build b/source3/script/wscript_build +index 2b0643b0876..a634ece7ec1 100644 +--- a/source3/script/wscript_build ++++ b/source3/script/wscript_build +@@ -6,7 +6,8 @@ bld.INSTALL_FILES('${BINDIR}', + 'smbtar', + chmod=MODE_755, flat=True) + bld.INSTALL_FILES('${BINDIR}', 'samba-log-parser', chmod=MODE_755, flat=True) +-bld.INSTALL_FILES('${DATADIR}', 'winbind_ctdb_updatekeytab.sh', chmod=MODE_755, flat=True) ++if conf.env.with_ctdb: ++ bld.INSTALL_FILES(bld.env.CTDB_DATADIR+"/scripts", 'winbind_ctdb_updatekeytab.sh', chmod=MODE_755, flat=True) + + # Callout scripts for use in selftest environment + bld.SAMBA_SCRIPT('smbaddshare', pattern='smbaddshare', installdir='.') +-- +2.46.0 + + +From 24d5b7d711566297ce5db92ebc2f56ec100b1dca Mon Sep 17 00:00:00 2001 +From: Anoop C S +Date: Wed, 14 Aug 2024 19:49:04 +0530 +Subject: [PATCH 2/2] docs-xml: Fix script location in + syncmachinepasswordscript.xml + +Update the change in installation path for winbind_ctdb_updatekeytab.sh +from SAMBA_DATADIR to newly defined CTDB_DATADIR. + +Signed-off-by: Anoop C S +Reviewed-by: Guenther Deschner +--- + docs-xml/smbdotconf/security/syncmachinepasswordscript.xml | 4 ++-- + dynconfig/wscript | 5 +++++ + 2 files changed, 7 insertions(+), 2 deletions(-) + +diff --git a/docs-xml/smbdotconf/security/syncmachinepasswordscript.xml b/docs-xml/smbdotconf/security/syncmachinepasswordscript.xml +index 9a7731930d5..df98610cf36 100644 +--- a/docs-xml/smbdotconf/security/syncmachinepasswordscript.xml ++++ b/docs-xml/smbdotconf/security/syncmachinepasswordscript.xml +@@ -11,7 +11,7 @@ + + + If keytabs should be generated in clustered environments it is recommended to update them on all nodes. +- You can set the config option to &pathconfig.SAMBA_DATADIR;/scripts/winbind_ctdb_updatekeytab.sh in clustering case. ++ You can set the config option to &pathconfig.CTDB_DATADIR;/scripts/winbind_ctdb_updatekeytab.sh in clustering case. + It is also needed to activate the 46.update-keytabs.script in ctdb, + it re-creates the keytab during the ctdb recovered event: + +@@ -22,5 +22,5 @@ + + + +-&pathconfig.SAMBA_DATADIR;/scripts/winbind_ctdb_updatekeytab.sh ++&pathconfig.CTDB_DATADIR;/scripts/winbind_ctdb_updatekeytab.sh + +diff --git a/dynconfig/wscript b/dynconfig/wscript +index 2041d881546..a784dac4e6c 100644 +--- a/dynconfig/wscript ++++ b/dynconfig/wscript +@@ -105,6 +105,11 @@ dynconfig = { + 'FHS-PATH': '${DATADIR}', + 'OVERWRITE': True, + }, ++ 'CTDB_DATADIR' : { ++ 'STD-PATH': '${DATADIR}/ctdb', ++ 'FHS-PATH': '${DATADIR}/ctdb', ++ 'OVERWRITE': True, ++ }, + 'SAMBA_DATADIR' : { + 'STD-PATH': '${DATADIR}/samba', + 'FHS-PATH': '${DATADIR}/samba', +-- +2.46.0 + From 22760e8157b79d2bb5dd4e150d49be93050da5e0 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 21 Aug 2024 07:49:11 +0200 Subject: [PATCH 326/425] Remove also python-ldb-devel-common - related: rhbz#230046 This was only used internally. --- samba.spec | 25 +++++-------------------- 1 file changed, 5 insertions(+), 20 deletions(-) diff --git a/samba.spec b/samba.spec index 22d0376..79d5769 100644 --- a/samba.spec +++ b/samba.spec @@ -1254,21 +1254,6 @@ Provides: ldb-tools = %{samba_depver} %description -n ldb-tools Tools to manage LDB files -### PYTHON3-LDB-DEVEL-COMMON -%package -n python-ldb-devel-common -Summary: Common development files for the Python bindings for the LDB library -License: LGPL-3.0-or-later - -Provides: pyldb-devel%{?_isa} = %{version}-%{release} -%{?python_provide:%python_provide python2-ldb-devel} - -Obsoletes: python-ldb-devel-common < 2.10 -Provides: python-ldb-devel-common = %{samba_depver} - -%description -n python-ldb-devel-common -Development files for the Python bindings for the LDB library. -This package includes files that aren't specific to a Python version. - ### PYTHON3-LDB %package -n python3-ldb Summary: Python bindings for the LDB library @@ -1280,6 +1265,8 @@ Requires: python3-tdb%{?_isa} >= %{tdb_version} Obsoletes: python3-ldb < 2.10 Provides: python3-ldb = %{samba_depver} # These were the C bindings, only used by Samba +Obsoletes: python-ldb-devel-common < 2.10 +Provides: python-ldb-devel-common = %{samba_depver} Obsoletes: python3-ldb-devel < 2.10 Provides: python3-ldb-devel = %{samba_depver} @@ -1560,9 +1547,11 @@ rm -f %{buildroot}%{perl_archlib}/vendor_perl/auto/Parse/Pidl/.packlist rm -rf %{buildroot}%{perl_vendorlib}/Parse/Yapp popd -# libldb manpages +# Install libldb manpages cp -a lib/ldb/apidocs/man/* %{buildroot}%{_mandir} +# Remove manpages we don't want rm -f %{buildroot}%{_mandir}/man3/_* +rm -f %{buildroot}%{_mandir}/man*/Py*.gz %if %{with testsuite} %check @@ -4777,10 +4766,6 @@ fi %{_mandir}/man1/ldbrename.1.* %{_mandir}/man1/ldbsearch.1.* -%files -n python-ldb-devel-common -#{_includedir}/pyldb.h -%{_mandir}/man*/Py*.gz - %files -n python3-ldb %{python3_sitearch}/ldb.cpython-*.so %{_libdir}/samba/libpyldb-util.cpython-*-private-samba.so From 49d714c02974d2989ea1ff9129ffd90bfaa98ea2 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 21 Aug 2024 08:02:37 +0200 Subject: [PATCH 327/425] Update to version 4.21.0rc3 - related: rhbz#230046 --- samba.spec | 6 +- sources | 4 +- sync_machine_password_script_install.patch | 91 ---------------------- 3 files changed, 5 insertions(+), 96 deletions(-) delete mode 100644 sync_machine_password_script_install.patch diff --git a/samba.spec b/samba.spec index 79d5769..3465b9e 100644 --- a/samba.spec +++ b/samba.spec @@ -167,7 +167,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc2 +%global pre_release rc3 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif @@ -254,8 +254,6 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore -Patch0: sync_machine_password_script_install.patch - Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} @@ -4731,7 +4729,9 @@ fi %dir %{_libdir}/samba/ldb %{_libdir}/samba/ldb/asq.so %{_libdir}/samba/ldb/ldb.so +%if %{with lmdb} %{_libdir}/samba/ldb/mdb.so +%endif %{_libdir}/samba/ldb/paged_searches.so %{_libdir}/samba/ldb/rdn_name.so %{_libdir}/samba/ldb/sample.so diff --git a/sources b/sources index 153969e..f42760a 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.21.0rc2.tar.xz) = c561a1cff99fd23baa738ce304efacfab1f7033880c6b5da6c6d2fc821a751be4f3a11b6e98700192490df17a87b9d9ba24e1ce7ed17bf6710a80d3a24ee3639 -SHA512 (samba-4.21.0rc2.tar.asc) = 415abad180a9771765a3f17978b9aa8008088ef60aee4fa98a278a8d21fa8fc2cdde4d8b8b6b23ff7476d63f642ba2a0d028e63d12f8d27eddd66030dc1068b2 +SHA512 (samba-4.21.0rc3.tar.xz) = 8f4bd550e922beb4af4ddbc1a3e96169c35a348ccaa6bd5de51cc0ce9545952c5262ecbd0e3e9e37576a8346b1e0c5ab27baccf6d015208a8ed2629df64e553b +SHA512 (samba-4.21.0rc3.tar.asc) = a2cdd7d9e53f58ecd32df0d41a928a103fdf78a3885a5d74cf48b7a6e40eed263853f0fa8161f4524844391ef443736659a6c6419aad41345cdc59192db704d3 diff --git a/sync_machine_password_script_install.patch b/sync_machine_password_script_install.patch deleted file mode 100644 index ea70c82..0000000 --- a/sync_machine_password_script_install.patch +++ /dev/null @@ -1,91 +0,0 @@ -From 7fedd0925965705e435a4bd411fdbd0e73d8b6a6 Mon Sep 17 00:00:00 2001 -From: Anoop C S -Date: Wed, 14 Aug 2024 19:47:35 +0530 -Subject: [PATCH 1/2] source3/script: Fix installation of - winbind_ctdb_updatekeytab.sh - -winbind_ctdb_updatekeytab.sh assumes the presence `onnode` utility to -execute `net ads` command on all nodes in the cluster. But `onnode` -is only built when configured with clustering support. Therefore perform -the script installation only with ctdb configuration. Also fix the -installation path to /usr/share/ctdb/scripts. - -Signed-off-by: Anoop C S -Reviewed-by: Guenther Deschner ---- - source3/script/wscript_build | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/source3/script/wscript_build b/source3/script/wscript_build -index 2b0643b0876..a634ece7ec1 100644 ---- a/source3/script/wscript_build -+++ b/source3/script/wscript_build -@@ -6,7 +6,8 @@ bld.INSTALL_FILES('${BINDIR}', - 'smbtar', - chmod=MODE_755, flat=True) - bld.INSTALL_FILES('${BINDIR}', 'samba-log-parser', chmod=MODE_755, flat=True) --bld.INSTALL_FILES('${DATADIR}', 'winbind_ctdb_updatekeytab.sh', chmod=MODE_755, flat=True) -+if conf.env.with_ctdb: -+ bld.INSTALL_FILES(bld.env.CTDB_DATADIR+"/scripts", 'winbind_ctdb_updatekeytab.sh', chmod=MODE_755, flat=True) - - # Callout scripts for use in selftest environment - bld.SAMBA_SCRIPT('smbaddshare', pattern='smbaddshare', installdir='.') --- -2.46.0 - - -From 24d5b7d711566297ce5db92ebc2f56ec100b1dca Mon Sep 17 00:00:00 2001 -From: Anoop C S -Date: Wed, 14 Aug 2024 19:49:04 +0530 -Subject: [PATCH 2/2] docs-xml: Fix script location in - syncmachinepasswordscript.xml - -Update the change in installation path for winbind_ctdb_updatekeytab.sh -from SAMBA_DATADIR to newly defined CTDB_DATADIR. - -Signed-off-by: Anoop C S -Reviewed-by: Guenther Deschner ---- - docs-xml/smbdotconf/security/syncmachinepasswordscript.xml | 4 ++-- - dynconfig/wscript | 5 +++++ - 2 files changed, 7 insertions(+), 2 deletions(-) - -diff --git a/docs-xml/smbdotconf/security/syncmachinepasswordscript.xml b/docs-xml/smbdotconf/security/syncmachinepasswordscript.xml -index 9a7731930d5..df98610cf36 100644 ---- a/docs-xml/smbdotconf/security/syncmachinepasswordscript.xml -+++ b/docs-xml/smbdotconf/security/syncmachinepasswordscript.xml -@@ -11,7 +11,7 @@ - - - If keytabs should be generated in clustered environments it is recommended to update them on all nodes. -- You can set the config option to &pathconfig.SAMBA_DATADIR;/scripts/winbind_ctdb_updatekeytab.sh in clustering case. -+ You can set the config option to &pathconfig.CTDB_DATADIR;/scripts/winbind_ctdb_updatekeytab.sh in clustering case. - It is also needed to activate the 46.update-keytabs.script in ctdb, - it re-creates the keytab during the ctdb recovered event: - -@@ -22,5 +22,5 @@ - - - --&pathconfig.SAMBA_DATADIR;/scripts/winbind_ctdb_updatekeytab.sh -+&pathconfig.CTDB_DATADIR;/scripts/winbind_ctdb_updatekeytab.sh - -diff --git a/dynconfig/wscript b/dynconfig/wscript -index 2041d881546..a784dac4e6c 100644 ---- a/dynconfig/wscript -+++ b/dynconfig/wscript -@@ -105,6 +105,11 @@ dynconfig = { - 'FHS-PATH': '${DATADIR}', - 'OVERWRITE': True, - }, -+ 'CTDB_DATADIR' : { -+ 'STD-PATH': '${DATADIR}/ctdb', -+ 'FHS-PATH': '${DATADIR}/ctdb', -+ 'OVERWRITE': True, -+ }, - 'SAMBA_DATADIR' : { - 'STD-PATH': '${DATADIR}/samba', - 'FHS-PATH': '${DATADIR}/samba', --- -2.46.0 - From bcb3974e312f6d84a8f23246dc0c65121a2199b5 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 21 Aug 2024 09:29:46 +0200 Subject: [PATCH 328/425] Fix manpages for libldb related: rhbz#230046 --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 3465b9e..792808a 100644 --- a/samba.spec +++ b/samba.spec @@ -1549,7 +1549,7 @@ popd cp -a lib/ldb/apidocs/man/* %{buildroot}%{_mandir} # Remove manpages we don't want rm -f %{buildroot}%{_mandir}/man3/_* -rm -f %{buildroot}%{_mandir}/man*/Py*.gz +rm -f %{buildroot}%{_mandir}/man3/PyLdb* %if %{with testsuite} %check From 4c2a193110ff7a9048ce27321cfdaed9dad37bf4 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 21 Aug 2024 14:55:13 +0200 Subject: [PATCH 329/425] Fix ldb requires and provides - related: rhbz#230046 --- samba.spec | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 792808a..2c36f16 100644 --- a/samba.spec +++ b/samba.spec @@ -1220,6 +1220,7 @@ Requires: libtevent%{?_isa} >= %{tevent_version} Provides: bundled(libreplace) Obsoletes: libldb < 2.10 +Provides: libldb = 2.10 Provides: libldb = %{samba_depver} %description -n libldb @@ -1230,12 +1231,13 @@ servers, or use local tdb databases. %package -n libldb-devel Summary: Developer tools for the LDB library License: LGPL-3.0-or-later -Requires: libldb%{?_isa} = %{version}-%{release} +Requires: libldb%{?_isa} = %{samba_depver} Requires: libtdb-devel%{?_isa} >= %{tdb_version} Requires: libtalloc-devel%{?_isa} >= %{talloc_version} Requires: libtevent-devel%{?_isa} >= %{tevent_version} Obsoletes: libldb-devel < 2.10 +Provides: libldb-devel = 2.10 Provides: libldb-devel = %{samba_depver} %description -n libldb-devel @@ -1245,7 +1247,7 @@ Header files needed to develop programs that link against the LDB library. %package -n ldb-tools Summary: Tools to manage LDB files License: LGPL-3.0-or-later -Requires: libldb%{?_isa} = %{samba_release} +Requires: libldb%{?_isa} = %{samba_depver} Obsoletes: ldb-tools < 2.10 Provides: ldb-tools = %{samba_depver} @@ -1256,7 +1258,7 @@ Tools to manage LDB files %package -n python3-ldb Summary: Python bindings for the LDB library License: LGPL-3.0-or-later -Requires: libldb%{?_isa} = %{version}-%{release} +Requires: libldb%{?_isa} = %{samba_depver} Requires: python3-tdb%{?_isa} >= %{tdb_version} %{?python_provide:%python_provide python3-ldb} @@ -1264,8 +1266,10 @@ Obsoletes: python3-ldb < 2.10 Provides: python3-ldb = %{samba_depver} # These were the C bindings, only used by Samba Obsoletes: python-ldb-devel-common < 2.10 +Provides: python-ldb-devel-common = 2.10 Provides: python-ldb-devel-common = %{samba_depver} Obsoletes: python3-ldb-devel < 2.10 +Provides: python3-ldb-devel = 2.10 Provides: python3-ldb-devel = %{samba_depver} %description -n python3-ldb From 11eed52070ab5a7afa578bdc5adf776ab691f09b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 28 Aug 2024 13:54:34 +0200 Subject: [PATCH 330/425] Update to version 4.21.0rc4 - resolves: rhbz#2300469 --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 2c36f16..9c94887 100644 --- a/samba.spec +++ b/samba.spec @@ -167,7 +167,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc3 +%global pre_release rc4 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif diff --git a/sources b/sources index f42760a..f6fbb9e 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.21.0rc3.tar.xz) = 8f4bd550e922beb4af4ddbc1a3e96169c35a348ccaa6bd5de51cc0ce9545952c5262ecbd0e3e9e37576a8346b1e0c5ab27baccf6d015208a8ed2629df64e553b -SHA512 (samba-4.21.0rc3.tar.asc) = a2cdd7d9e53f58ecd32df0d41a928a103fdf78a3885a5d74cf48b7a6e40eed263853f0fa8161f4524844391ef443736659a6c6419aad41345cdc59192db704d3 +SHA512 (samba-4.21.0rc4.tar.xz) = bbf3e6506b15d7a386292e84c189a8dd2136cb016df9bdb07066359b4bbce5da7e1c7f889a2de223ed83bbd8760a0e5232f5986bfd1c368b1beead4ed25c1076 +SHA512 (samba-4.21.0rc4.tar.asc) = 8a646d3e4b79886e723ad0558f0412e5033d8481ae0d9e04606204ce6af47e2eee2028a32ecd342572ee882aae798a702675d7e4e0593c83dda69edd23b30850 From b363a4cfec680b18ab6f2b0659899d8485e3d993 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 2 Sep 2024 15:25:28 +0200 Subject: [PATCH 331/425] Update to version 4.21.0 - resolves: rhbz#2309153 --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 9c94887..554fa54 100644 --- a/samba.spec +++ b/samba.spec @@ -167,7 +167,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc4 +%global pre_release %nil %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif diff --git a/sources b/sources index f6fbb9e..3e8e284 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.21.0rc4.tar.xz) = bbf3e6506b15d7a386292e84c189a8dd2136cb016df9bdb07066359b4bbce5da7e1c7f889a2de223ed83bbd8760a0e5232f5986bfd1c368b1beead4ed25c1076 -SHA512 (samba-4.21.0rc4.tar.asc) = 8a646d3e4b79886e723ad0558f0412e5033d8481ae0d9e04606204ce6af47e2eee2028a32ecd342572ee882aae798a702675d7e4e0593c83dda69edd23b30850 +SHA512 (samba-4.21.0.tar.xz) = d05c823afc04669766130745c139e7d129eb9961525453d6da8b5ee6693d4c08192496d07e5c211e86d553956504fb9df16611cc9268111b71b95c7f2fa868a0 +SHA512 (samba-4.21.0.tar.asc) = 7fffbd0b88b42dd7f340e4bcae17da4a68a0f8de86a1e71534a4a02a477a746e4cdb16df7c0da33aaf13278cefb452bd9b7c61ed029e248576f7158e8bec339e From 63dc1a2f19c43bd88f085b39457d3c9f2609e101 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 3 Sep 2024 00:19:59 +0200 Subject: [PATCH 332/425] Update required tdb version - related: rhbz#2309153 --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 554fa54..2a18182 100644 --- a/samba.spec +++ b/samba.spec @@ -198,7 +198,7 @@ %global libwbclient_so_version 0 %global talloc_version 2.4.2 -%global tdb_version 1.4.11 +%global tdb_version 1.4.12 %global tevent_version 0.16.1 %global required_mit_krb5 1.20.1 From 19fdf21ce657e81bc5a06bca1fbaeeacbcd1eb48 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Fri, 13 Sep 2024 16:28:34 +0300 Subject: [PATCH 333/425] Fix Samba integration with FreeIPA - resolves: rhbz#2309199 Signed-off-by: Alexander Bokovoy --- samba-4.21.0-backport-freeipa-support.patch | 132 ++++++++++++++++++++ samba.spec | 2 + 2 files changed, 134 insertions(+) create mode 100644 samba-4.21.0-backport-freeipa-support.patch diff --git a/samba-4.21.0-backport-freeipa-support.patch b/samba-4.21.0-backport-freeipa-support.patch new file mode 100644 index 0000000..d1c5776 --- /dev/null +++ b/samba-4.21.0-backport-freeipa-support.patch @@ -0,0 +1,132 @@ +From 26797d7bd2662718b3eb795f1b8e6100d51e3ab7 Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Tue, 3 Sep 2024 08:48:24 +0300 +Subject: [PATCH] sync machine password to keytab: handle FreeIPA use case +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +FreeIPA uses own procedure to retrieve keytabs and during the setup of +Samba on FreeIPA client the keytab is already present, only machine +account needs to be set in the secrets database. + +'sync machine password to keytab' option handling broke this use case by +always attempting to contact a domain controller and failing to do so +(Fedora bug https://bugzilla.redhat.com/show_bug.cgi?id=2309199). + +The original synchronizing machine account password to keytab feature +did not have a mechanism to disable its logic at all. + +Signed-off-by: Alexander Bokovoy +Reviewed-by: Pavel Filipenský + +Autobuild-User(master): Alexander Bokovoy +Autobuild-Date(master): Fri Sep 13 13:16:09 UTC 2024 on atb-devel-224 + +(cherry picked from commit 4f577c7b6894132be4842944f2f950b087312b16) +--- + .../security/syncmachinepasswordtokeytab.xml | 29 +++++++++++++++++-- + source3/libads/kerberos_keytab.c | 5 ++++ + source3/utils/net.c | 8 +++++ + source3/utils/testparm.c | 3 +- + 4 files changed, 41 insertions(+), 4 deletions(-) + +diff --git a/docs-xml/smbdotconf/security/syncmachinepasswordtokeytab.xml b/docs-xml/smbdotconf/security/syncmachinepasswordtokeytab.xml +index 4cad9da73f2..f7dc30023d4 100644 +--- a/docs-xml/smbdotconf/security/syncmachinepasswordtokeytab.xml ++++ b/docs-xml/smbdotconf/security/syncmachinepasswordtokeytab.xml +@@ -18,7 +18,11 @@ or by winbindd doing regular updates (see ++If no value is present and is different from ++'secrets only', the behavior differs between winbind and net utility: ++ ++ ++ ++ winbind uses value ++ /path/to/keytab:sync_spns:sync_kvno:machine_password ++ where the path to the keytab is obtained either from the krb5 library or from ++ . ++ ++ ++ ++ net changesecretpw -f command uses the default 'disabled' value. ++ ++ No other net subcommands use the 'disabled' value. ++ ++ ++ ++If a single value 'disabled' is present, the synchronization process is ++disabled. This is required for FreeIPA domain member setup where keytab ++synchronization uses a protocol not implemented by Samba. + + + +diff --git a/source3/libads/kerberos_keytab.c b/source3/libads/kerberos_keytab.c +index 6ede567b75f..dbf8af44c1f 100644 +--- a/source3/libads/kerberos_keytab.c ++++ b/source3/libads/kerberos_keytab.c +@@ -904,6 +904,11 @@ NTSTATUS sync_pw2keytabs(void) + goto params_ready; + } + ++ if ((*lp_ptr != NULL) && strequal_m(*lp_ptr, "disabled")) { ++ DBG_DEBUG("'sync machine password to keytab' is explicitly disabled.\n"); ++ return NT_STATUS_OK; ++ } ++ + line = lp_ptr; + while (*line) { + DBG_DEBUG("Scanning line: %s\n", *line); +diff --git a/source3/utils/net.c b/source3/utils/net.c +index 7b40d2bee95..c432ebe991f 100644 +--- a/source3/utils/net.c ++++ b/source3/utils/net.c +@@ -207,6 +207,14 @@ static int net_changesecretpw(struct net_context *c, int argc, + struct timeval tv = timeval_current(); + NTTIME now = timeval_to_nttime(&tv); + ++#ifdef HAVE_ADS ++ if (USE_KERBEROS_KEYTAB) { ++ if (lp_sync_machine_password_to_keytab() == NULL) { ++ lp_do_parameter(-1, "sync machine password to keytab", "disabled"); ++ } ++ } ++#endif ++ + if (c->opt_stdin) { + set_line_buffering(stdin); + set_line_buffering(stdout); +diff --git a/source3/utils/testparm.c b/source3/utils/testparm.c +index e3ed336a79a..a31a7a8a30a 100644 +--- a/source3/utils/testparm.c ++++ b/source3/utils/testparm.c +@@ -803,7 +803,8 @@ static int do_global_checks(void) + "instead of 'kerberos method'.\n\n"); + } + +- if (lp_ptr != NULL) { ++ if (lp_ptr != NULL && ++ ((*lp_ptr != NULL) && !strequal_m(*lp_ptr, "disabled"))) { + while (*lp_ptr) { + ret |= pw2kt_check_line(*lp_ptr++); + } +-- +2.46.0 + diff --git a/samba.spec b/samba.spec index 2a18182..6c5f6b3 100644 --- a/samba.spec +++ b/samba.spec @@ -254,6 +254,8 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore +Patch0: samba-4.21.0-backport-freeipa-support.patch + Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} From b16ff1f961129810587ac3074f8f6ffaa83ee934 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 23 Sep 2024 12:58:24 +0200 Subject: [PATCH 334/425] Add cert directories to samba-common Those are created by gpupdate and we need to have them packaged that selinux can label them correctly. --- samba.spec | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/samba.spec b/samba.spec index 6c5f6b3..a5bcf9e 100644 --- a/samba.spec +++ b/samba.spec @@ -1426,9 +1426,11 @@ popd install -d -m 0755 %{buildroot}/usr/{sbin,bin} install -d -m 0755 %{buildroot}%{_libdir}/security install -d -m 0755 %{buildroot}/var/lib/samba +install -d -m 0755 %{buildroot}/var/lib/samba/certs install -d -m 0755 %{buildroot}/var/lib/samba/drivers install -d -m 0755 %{buildroot}/var/lib/samba/lock install -d -m 0755 %{buildroot}/var/lib/samba/private +install -d -m 0755 %{buildroot}/var/lib/samba/private/certs install -d -m 0755 %{buildroot}/var/lib/samba/scripts install -d -m 0755 %{buildroot}/var/lib/samba/sysvol install -d -m 0755 %{buildroot}/var/lib/samba/usershares @@ -2056,7 +2058,9 @@ fi %ghost %dir /run/samba %ghost %dir /run/winbindd %dir /var/lib/samba +%dir /var/lib/samba/certs %attr(700,root,root) %dir /var/lib/samba/private +%attr(700,root,root) %dir /var/lib/samba/private/certs %dir /var/lib/samba/lock %attr(755,root,root) %dir %{_sysconfdir}/samba %config(noreplace) %{_sysconfdir}/samba/smb.conf From 6ad66947912c84943cf8533cdd0f82583ca21446 Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Mon, 23 Sep 2024 19:35:26 -0400 Subject: [PATCH 335/425] Fix ELN build libsamba-policy is only built with the AD DC, but the LDB LMDB components should be built regardless: https://gitlab.com/samba-team/samba/-/merge_requests/3807 --- samba-4.21.0-ldb-lmdb.patch | 55 +++++++++++++++++++++++++++++++++++++ samba.spec | 10 ++++--- 2 files changed, 61 insertions(+), 4 deletions(-) create mode 100644 samba-4.21.0-ldb-lmdb.patch diff --git a/samba-4.21.0-ldb-lmdb.patch b/samba-4.21.0-ldb-lmdb.patch new file mode 100644 index 0000000..894014a --- /dev/null +++ b/samba-4.21.0-ldb-lmdb.patch @@ -0,0 +1,55 @@ +From 9f265d6f3b852a9eed9f19147585fe2801507f63 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 24 Sep 2024 15:48:23 +0200 +Subject: [PATCH] ldb: Build lmdb backend also in non-AD case + +We should build with lmdb support also if it is not in AD case. The lmdb +backend is also used e.g. by sssd. + +If you don't want to build it, you can always specify --without-ldb-lmdb + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15721 + +Signed-off-by: Andreas Schneider +--- + lib/ldb/wscript | 22 +++++++++------------- + 1 file changed, 9 insertions(+), 13 deletions(-) + +diff --git a/lib/ldb/wscript b/lib/ldb/wscript +index 87aa3bb6d77..f234fa79c10 100644 +--- a/lib/ldb/wscript ++++ b/lib/ldb/wscript +@@ -33,21 +33,17 @@ def configure(conf): + conf.CONFIG_GET('ENABLE_SELFTEST'): + Logs.warn("NOTE: Some AD DC parts of selftest will fail") + ++ conf.env.REQUIRE_LMDB = False ++ elif Options.options.without_ldb_lmdb: ++ if not Options.options.without_ad_dc and \ ++ conf.CONFIG_GET('ENABLE_SELFTEST'): ++ raise Errors.WafError('--without-ldb-lmdb conflicts ' ++ 'with --enable-selftest while ' ++ 'building the AD DC') ++ + conf.env.REQUIRE_LMDB = False + else: +- if Options.options.without_ad_dc: +- conf.env.REQUIRE_LMDB = False +- else: +- if Options.options.without_ldb_lmdb: +- if not Options.options.without_ad_dc and \ +- conf.CONFIG_GET('ENABLE_SELFTEST'): +- raise Errors.WafError('--without-ldb-lmdb conflicts ' +- 'with --enable-selftest while ' +- 'building the AD DC') +- +- conf.env.REQUIRE_LMDB = False +- else: +- conf.env.REQUIRE_LMDB = True ++ conf.env.REQUIRE_LMDB = True + + # if lmdb support is enabled then we require lmdb + # is present, build the mdb back end and enable lmdb support in +-- +GitLab + diff --git a/samba.spec b/samba.spec index a5bcf9e..4465c44 100644 --- a/samba.spec +++ b/samba.spec @@ -255,6 +255,8 @@ Source201: README.downgrade Source202: samba.abignore Patch0: samba-4.21.0-backport-freeipa-support.patch +# https://gitlab.com/samba-team/samba/-/merge_requests/3807 +Patch1: samba-4.21.0-ldb-lmdb.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} @@ -2206,14 +2208,14 @@ fi %endif ### DC-LIBS %files dc-libs -%{_libdir}/libsamba-policy.so.%{libsamba_policy_so_version}* -%{_libdir}/samba/libsamba-net-private-samba.so %{_libdir}/samba/libauth4-private-samba.so %if %{with dc} || %{with testsuite} +%{_libdir}/libsamba-policy.so.%{libsamba_policy_so_version}* %{_libdir}/samba/libdb-glue-private-samba.so %{_libdir}/samba/libpac-private-samba.so %{_libdir}/samba/libprocess-model-private-samba.so +%{_libdir}/samba/libsamba-net-private-samba.so %{_libdir}/samba/libservice-private-samba.so %if %{with testsuite} @@ -2357,7 +2359,6 @@ fi %{_libdir}/libsamba-credentials.so %{_libdir}/libsamba-errors.so %{_libdir}/libsamba-hostconfig.so -%{_libdir}/libsamba-policy.so %{_libdir}/libsamba-util.so %{_libdir}/libsamdb.so %{_libdir}/libsmbconf.so @@ -2370,7 +2371,6 @@ fi %{_libdir}/pkgconfig/ndr_standard.pc %{_libdir}/pkgconfig/samba-credentials.pc %{_libdir}/pkgconfig/samba-hostconfig.pc -%{_libdir}/pkgconfig/samba-policy.pc %{_libdir}/pkgconfig/samba-util.pc %{_libdir}/pkgconfig/samdb.pc %{_libdir}/libsamba-passdb.so @@ -2379,7 +2379,9 @@ fi %if %{with dc} || %{with testsuite} %{_includedir}/samba-4.0/dcerpc_server.h %{_libdir}/libdcerpc-server.so +%{_libdir}/libsamba-policy.so %{_libdir}/pkgconfig/dcerpc_server.pc +%{_libdir}/pkgconfig/samba-policy.pc %endif %if %{without libsmbclient} From a4001d23ea32acfe66586fa9a612e60c6615f60a Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Wed, 25 Sep 2024 18:06:49 -0400 Subject: [PATCH 336/425] Always include libsamba-policy and libsamba-net-private-samba As of 4.21, these were converted to regular C libraries to which their respective Python modules depend: https://gitlab.com/samba-team/samba/-/commit/d11b281aefa98e6850053ccd6142253c6cf0d04f https://gitlab.com/samba-team/samba/-/commit/829b52f99d5a9c9df19c9eb67611618095967edd --- samba.spec | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/samba.spec b/samba.spec index 4465c44..8ee8df5 100644 --- a/samba.spec +++ b/samba.spec @@ -1531,10 +1531,7 @@ rm -f %{buildroot}%{_mandir}/man8/vfs_ceph_snapshots.8* /sbin/ldconfig -N -n %{buildroot}%{_libdir} %if %{without dc} && %{without testsuite} -for f in samba/libsamba-net-private-samba.so \ - samba/libsamba-python-private-samba.so \ - libsamba-policy.so* \ - pkgconfig/samba-policy.pc ; do +for f in samba/libsamba-python-private-samba.so; do rm -f %{buildroot}%{_libdir}/$f done #endif without dc @@ -2208,14 +2205,14 @@ fi %endif ### DC-LIBS %files dc-libs +%{_libdir}/libsamba-policy.so.%{libsamba_policy_so_version}* %{_libdir}/samba/libauth4-private-samba.so +%{_libdir}/samba/libsamba-net-private-samba.so %if %{with dc} || %{with testsuite} -%{_libdir}/libsamba-policy.so.%{libsamba_policy_so_version}* %{_libdir}/samba/libdb-glue-private-samba.so %{_libdir}/samba/libpac-private-samba.so %{_libdir}/samba/libprocess-model-private-samba.so -%{_libdir}/samba/libsamba-net-private-samba.so %{_libdir}/samba/libservice-private-samba.so %if %{with testsuite} @@ -2371,17 +2368,17 @@ fi %{_libdir}/pkgconfig/ndr_standard.pc %{_libdir}/pkgconfig/samba-credentials.pc %{_libdir}/pkgconfig/samba-hostconfig.pc +%{_libdir}/pkgconfig/samba-policy.pc %{_libdir}/pkgconfig/samba-util.pc %{_libdir}/pkgconfig/samdb.pc %{_libdir}/libsamba-passdb.so +%{_libdir}/libsamba-policy.so %{_libdir}/libsmbldap.so %if %{with dc} || %{with testsuite} %{_includedir}/samba-4.0/dcerpc_server.h %{_libdir}/libdcerpc-server.so -%{_libdir}/libsamba-policy.so %{_libdir}/pkgconfig/dcerpc_server.pc -%{_libdir}/pkgconfig/samba-policy.pc %endif %if %{without libsmbclient} From 8f40e555ff762fd56d2d2ec0dc0e0c30f0f558e8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Fri, 27 Sep 2024 13:59:42 +0200 Subject: [PATCH 337/425] Build with ceph again for ppc64le This is fixed https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104172 in gcc >= 11.3. It is ok to enable for rhel-9, rhel-10 and f41: gcc-11.5.0-2.el9 gcc-14.2.1-2.el10 gcc-14.2.1-3.fc41 --- samba.spec | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 8ee8df5..06a1376 100644 --- a/samba.spec +++ b/samba.spec @@ -55,9 +55,7 @@ # Build vfs_ceph module and ctdb cepth mutex helper by default on 64bit Fedora %if 0%{?fedora} -# ppc64le excluded pending resolution of https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104172 -#%%ifarch aarch64 ppc64le s390x x86_64 -%ifarch aarch64 s390x x86_64 riscv64 +%ifarch aarch64 ppc64le s390x x86_64 riscv64 %bcond_without vfs_cephfs %bcond_without ceph_mutex %else From 92d190c9b671b656cdccf53479443211be887f77 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 1 Oct 2024 14:11:48 +0200 Subject: [PATCH 338/425] Don't use RTLD_DEEPBIND by default in libldb - resolves: rhbz#2278016 --- samba-4-21-fix-libldb-deepbind.patch | 286 +++++++++++++++++++++++++++ samba.spec | 1 + 2 files changed, 287 insertions(+) create mode 100644 samba-4-21-fix-libldb-deepbind.patch diff --git a/samba-4-21-fix-libldb-deepbind.patch b/samba-4-21-fix-libldb-deepbind.patch new file mode 100644 index 0000000..9593482 --- /dev/null +++ b/samba-4-21-fix-libldb-deepbind.patch @@ -0,0 +1,286 @@ +From e2d3bf09d6d75c7dc009aff36119e51ea59371fc Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 25 Sep 2024 09:19:17 +0200 +Subject: [PATCH 1/4] lib:ldb: Remove trailing spaces from ldb_modules.c + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15643 + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +(cherry picked from commit 8d6b5183770895fef002b6cce84902d1874fa502) +--- + lib/ldb/common/ldb_modules.c | 34 +++++++++++++++++----------------- + 1 file changed, 17 insertions(+), 17 deletions(-) + +diff --git a/lib/ldb/common/ldb_modules.c b/lib/ldb/common/ldb_modules.c +index b5627b0d04f..5c970626206 100644 +--- a/lib/ldb/common/ldb_modules.c ++++ b/lib/ldb/common/ldb_modules.c +@@ -631,9 +631,9 @@ int ldb_next_start_trans(struct ldb_module *module) + /* Set a default error string, to place the blame somewhere */ + ldb_asprintf_errstring(module->ldb, "start_trans error in module %s: %s (%d)", module->ops->name, ldb_strerror(ret), ret); + } +- if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { +- ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_start_trans error: %s", +- ldb_errstring(module->ldb)); ++ if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { ++ ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_start_trans error: %s", ++ ldb_errstring(module->ldb)); + } + return ret; + } +@@ -650,9 +650,9 @@ int ldb_next_end_trans(struct ldb_module *module) + /* Set a default error string, to place the blame somewhere */ + ldb_asprintf_errstring(module->ldb, "end_trans error in module %s: %s (%d)", module->ops->name, ldb_strerror(ret), ret); + } +- if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { +- ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_end_trans error: %s", +- ldb_errstring(module->ldb)); ++ if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { ++ ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_end_trans error: %s", ++ ldb_errstring(module->ldb)); + } + return ret; + } +@@ -720,9 +720,9 @@ int ldb_next_prepare_commit(struct ldb_module *module) + /* Set a default error string, to place the blame somewhere */ + ldb_asprintf_errstring(module->ldb, "prepare_commit error in module %s: %s (%d)", module->ops->name, ldb_strerror(ret), ret); + } +- if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { +- ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_prepare_commit error: %s", +- ldb_errstring(module->ldb)); ++ if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { ++ ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_prepare_commit error: %s", ++ ldb_errstring(module->ldb)); + } + return ret; + } +@@ -739,9 +739,9 @@ int ldb_next_del_trans(struct ldb_module *module) + /* Set a default error string, to place the blame somewhere */ + ldb_asprintf_errstring(module->ldb, "del_trans error in module %s: %s (%d)", module->ops->name, ldb_strerror(ret), ret); + } +- if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { +- ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_del_trans error: %s", +- ldb_errstring(module->ldb)); ++ if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { ++ ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_del_trans error: %s", ++ ldb_errstring(module->ldb)); + } + return ret; + } +@@ -777,17 +777,17 @@ int ldb_module_send_entry(struct ldb_request *req, + req->handle->nesting == 0) { + char *s; + struct ldb_ldif ldif; +- ++ + ldif.changetype = LDB_CHANGETYPE_NONE; + ldif.msg = discard_const_p(struct ldb_message, msg); + + ldb_debug_add(req->handle->ldb, "ldb_trace_response: ENTRY\n"); + +- /* ++ /* + * The choice to call + * ldb_ldif_write_redacted_trace_string() is CRITICAL + * for security. It ensures that we do not output +- * passwords into debug logs ++ * passwords into debug logs + */ + + s = ldb_ldif_write_redacted_trace_string(req->handle->ldb, msg, &ldif); +@@ -1104,8 +1104,8 @@ static int ldb_modules_load_dir(const char *modules_dir, const char *version) + return LDB_SUCCESS; + } + +-/* +- load any additional modules from the given directory ++/* ++ load any additional modules from the given directory + */ + void ldb_set_modules_dir(struct ldb_context *ldb, const char *path) + { +-- +2.46.1 + + +From d0ec464cfced2654d74672846d83c19f69af622b Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 25 Sep 2024 09:19:44 +0200 +Subject: [PATCH 2/4] lib:ldb: Don't use RTLD_DEEPBIND by default + +It should be off by default, as this is not needed by default. It +crashes named on startup, if bind is built with jemalloc support. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15643 + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +(cherry picked from commit dc6927fdca2ad77dbcf212ef4d3ba0d118ec7bdf) +--- + lib/ldb/common/ldb_modules.c | 21 ++++++--------------- + selftest/selftest.pl | 6 ------ + selftest/wscript | 5 ++--- + 3 files changed, 8 insertions(+), 24 deletions(-) + +diff --git a/lib/ldb/common/ldb_modules.c b/lib/ldb/common/ldb_modules.c +index 5c970626206..08d251f9bdd 100644 +--- a/lib/ldb/common/ldb_modules.c ++++ b/lib/ldb/common/ldb_modules.c +@@ -945,7 +945,7 @@ static int ldb_modules_load_path(const char *path, const char *version) + int dlopen_flags; + + #ifdef RTLD_DEEPBIND +- bool deepbind_enabled = (getenv("LDB_MODULES_DISABLE_DEEPBIND") == NULL); ++ bool deepbind_enabled = (getenv("LDB_MODULES_ENABLE_DEEPBIND") != NULL); + #endif + + ret = stat(path, &st); +@@ -981,21 +981,12 @@ static int ldb_modules_load_path(const char *path, const char *version) + dlopen_flags = RTLD_NOW; + #ifdef RTLD_DEEPBIND + /* +- * use deepbind if possible, to avoid issues with different +- * system library variants, for example ldb modules may be linked +- * against Heimdal while the application may use MIT kerberos. ++ * On systems where e.g. different kerberos libraries are used, like a ++ * mix of Heimdal and MIT Kerberos, LDB_MODULES_ENABLE_DEEPBIND should ++ * be set to avoid issues. + * +- * See the dlopen manpage for details. +- * +- * One typical user is the bind_dlz module of Samba, +- * but symbol versioning might be enough... +- * +- * We need a way to disable this in order to allow the +- * ldb_*ldap modules to work with a preloaded socket wrapper. +- * +- * So in future we may remove this completely +- * or at least invert the default behavior. +- */ ++ * By default Linux distributions only have one Kerberos library. ++ */ + if (deepbind_enabled) { + dlopen_flags |= RTLD_DEEPBIND; + } +diff --git a/selftest/selftest.pl b/selftest/selftest.pl +index 26b1663b5b6..a0c4ec80f59 100755 +--- a/selftest/selftest.pl ++++ b/selftest/selftest.pl +@@ -433,12 +433,6 @@ $ENV{UID_WRAPPER} = 1; + # We are already hitting the limit, so double it. + $ENV{NSS_WRAPPER_MAX_HOSTENTS} = 200; + +-# Disable RTLD_DEEPBIND hack for Samba bind dlz module +-# +-# This is needed in order to allow the ldb_*ldap module +-# to work with a preloaded socket wrapper. +-$ENV{LDB_MODULES_DISABLE_DEEPBIND} = 1; +- + my $socket_wrapper_dir; + if ($opt_socket_wrapper) { + $socket_wrapper_dir = SocketWrapper::setup_dir("$prefix_abs/w", $opt_socket_wrapper_pcap); +diff --git a/selftest/wscript b/selftest/wscript +index 52c34dcb88d..95e70706e63 100644 +--- a/selftest/wscript ++++ b/selftest/wscript +@@ -333,9 +333,8 @@ def cmd_testonly(opt): + asan_options += ":suppressions=${srcdir}/selftest/sanitizer/asan.supp" + asan_options += " " + +- # And we need to disable RTLD_DEEPBIND in ldb and socket wrapper +- no_leak_check = "LDB_MODULES_DISABLE_DEEPBIND=1 " +- no_leak_check += "SOCKET_WRAPPER_DISABLE_DEEP_BIND=1" ++ # We need to disable RTLD_DEEPBIND in socket wrapper ++ no_leak_check = "SOCKET_WRAPPER_DISABLE_DEEP_BIND=1" + no_leak_check += " " + env.CORE_COMMAND = asan_options + no_leak_check + env.CORE_COMMAND + +-- +2.46.1 + + +From e6745b1444b28904258710dff1dddd18a8b9f662 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 25 Sep 2024 09:40:23 +0200 +Subject: [PATCH 3/4] lib:ldb: Remove trailing spaces from ldb.3.xml + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15643 + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +(cherry picked from commit d6ff05cb5708fb6746176821bee5f713195efa54) +--- + lib/ldb/man/ldb.3.xml | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/ldb/man/ldb.3.xml b/lib/ldb/man/ldb.3.xml +index 1c0a2ece552..1dd8b2462d4 100644 +--- a/lib/ldb/man/ldb.3.xml ++++ b/lib/ldb/man/ldb.3.xml +@@ -247,7 +247,7 @@ ldb_search(3) manual pages. + Author + + +- ldb was written by ++ ldb was written by + Andrew Tridgell. + + +-- +2.46.1 + + +From ba9918d45820fbdb864b5a1e058136eeb0cf1ce7 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 25 Sep 2024 09:22:08 +0200 +Subject: [PATCH 4/4] lib:ldb: Document environment variables in ldb manpage + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15643 + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher + +Autobuild-User(master): Andreas Schneider +Autobuild-Date(master): Fri Sep 27 09:06:43 UTC 2024 on atb-devel-224 + +(cherry picked from commit 20a3a94e06a2294206ec233ccc7f873d6ef2aca0) +--- + lib/ldb/man/ldb.3.xml | 21 +++++++++++++++++++++ + 1 file changed, 21 insertions(+) + +diff --git a/lib/ldb/man/ldb.3.xml b/lib/ldb/man/ldb.3.xml +index 1dd8b2462d4..f8d3cb50446 100644 +--- a/lib/ldb/man/ldb.3.xml ++++ b/lib/ldb/man/ldb.3.xml +@@ -243,6 +243,27 @@ ldb_search(3) manual pages. + + + ++ ++ ENVIRONMENT VARIABLES ++ ++ ++ ++ LDB_URL ++ - connect to the provided URL (cmdline tools only) ++ ++ ++ ++ LDB_MODULES_PATH ++ - path where to load ldb modules from ++ ++ ++ ++ LDB_MODULES_ENABLE_DEEPBIND ++ - enable RTLD_DEEPBIND when loading ldb modules ++ ++ ++ ++ + + Author + +-- +2.46.1 + diff --git a/samba.spec b/samba.spec index 06a1376..67e3895 100644 --- a/samba.spec +++ b/samba.spec @@ -255,6 +255,7 @@ Source202: samba.abignore Patch0: samba-4.21.0-backport-freeipa-support.patch # https://gitlab.com/samba-team/samba/-/merge_requests/3807 Patch1: samba-4.21.0-ldb-lmdb.patch +Patch2: samba-4-21-fix-libldb-deepbind.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} From 2535a64d3408af19f390482a87aabf0f148c6683 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Mon, 14 Oct 2024 14:29:04 +0200 Subject: [PATCH 339/425] Update to version 4.21.1 - resolves: rhbz#2318518 --- samba-4-21-fix-libldb-deepbind.patch | 286 ----------- samba-4.21.0-backport-freeipa-support.patch | 132 ----- samba-4.21.0-ldb-lmdb.patch | 55 --- samba-4.21.0-s3-notifyd.patch | 513 ++++++++++++++++++++ samba.spec | 7 +- sources | 4 +- 6 files changed, 517 insertions(+), 480 deletions(-) delete mode 100644 samba-4-21-fix-libldb-deepbind.patch delete mode 100644 samba-4.21.0-backport-freeipa-support.patch delete mode 100644 samba-4.21.0-ldb-lmdb.patch create mode 100644 samba-4.21.0-s3-notifyd.patch diff --git a/samba-4-21-fix-libldb-deepbind.patch b/samba-4-21-fix-libldb-deepbind.patch deleted file mode 100644 index 9593482..0000000 --- a/samba-4-21-fix-libldb-deepbind.patch +++ /dev/null @@ -1,286 +0,0 @@ -From e2d3bf09d6d75c7dc009aff36119e51ea59371fc Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Wed, 25 Sep 2024 09:19:17 +0200 -Subject: [PATCH 1/4] lib:ldb: Remove trailing spaces from ldb_modules.c - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15643 - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher -(cherry picked from commit 8d6b5183770895fef002b6cce84902d1874fa502) ---- - lib/ldb/common/ldb_modules.c | 34 +++++++++++++++++----------------- - 1 file changed, 17 insertions(+), 17 deletions(-) - -diff --git a/lib/ldb/common/ldb_modules.c b/lib/ldb/common/ldb_modules.c -index b5627b0d04f..5c970626206 100644 ---- a/lib/ldb/common/ldb_modules.c -+++ b/lib/ldb/common/ldb_modules.c -@@ -631,9 +631,9 @@ int ldb_next_start_trans(struct ldb_module *module) - /* Set a default error string, to place the blame somewhere */ - ldb_asprintf_errstring(module->ldb, "start_trans error in module %s: %s (%d)", module->ops->name, ldb_strerror(ret), ret); - } -- if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { -- ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_start_trans error: %s", -- ldb_errstring(module->ldb)); -+ if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { -+ ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_start_trans error: %s", -+ ldb_errstring(module->ldb)); - } - return ret; - } -@@ -650,9 +650,9 @@ int ldb_next_end_trans(struct ldb_module *module) - /* Set a default error string, to place the blame somewhere */ - ldb_asprintf_errstring(module->ldb, "end_trans error in module %s: %s (%d)", module->ops->name, ldb_strerror(ret), ret); - } -- if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { -- ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_end_trans error: %s", -- ldb_errstring(module->ldb)); -+ if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { -+ ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_end_trans error: %s", -+ ldb_errstring(module->ldb)); - } - return ret; - } -@@ -720,9 +720,9 @@ int ldb_next_prepare_commit(struct ldb_module *module) - /* Set a default error string, to place the blame somewhere */ - ldb_asprintf_errstring(module->ldb, "prepare_commit error in module %s: %s (%d)", module->ops->name, ldb_strerror(ret), ret); - } -- if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { -- ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_prepare_commit error: %s", -- ldb_errstring(module->ldb)); -+ if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { -+ ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_prepare_commit error: %s", -+ ldb_errstring(module->ldb)); - } - return ret; - } -@@ -739,9 +739,9 @@ int ldb_next_del_trans(struct ldb_module *module) - /* Set a default error string, to place the blame somewhere */ - ldb_asprintf_errstring(module->ldb, "del_trans error in module %s: %s (%d)", module->ops->name, ldb_strerror(ret), ret); - } -- if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { -- ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_del_trans error: %s", -- ldb_errstring(module->ldb)); -+ if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { -+ ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_del_trans error: %s", -+ ldb_errstring(module->ldb)); - } - return ret; - } -@@ -777,17 +777,17 @@ int ldb_module_send_entry(struct ldb_request *req, - req->handle->nesting == 0) { - char *s; - struct ldb_ldif ldif; -- -+ - ldif.changetype = LDB_CHANGETYPE_NONE; - ldif.msg = discard_const_p(struct ldb_message, msg); - - ldb_debug_add(req->handle->ldb, "ldb_trace_response: ENTRY\n"); - -- /* -+ /* - * The choice to call - * ldb_ldif_write_redacted_trace_string() is CRITICAL - * for security. It ensures that we do not output -- * passwords into debug logs -+ * passwords into debug logs - */ - - s = ldb_ldif_write_redacted_trace_string(req->handle->ldb, msg, &ldif); -@@ -1104,8 +1104,8 @@ static int ldb_modules_load_dir(const char *modules_dir, const char *version) - return LDB_SUCCESS; - } - --/* -- load any additional modules from the given directory -+/* -+ load any additional modules from the given directory - */ - void ldb_set_modules_dir(struct ldb_context *ldb, const char *path) - { --- -2.46.1 - - -From d0ec464cfced2654d74672846d83c19f69af622b Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Wed, 25 Sep 2024 09:19:44 +0200 -Subject: [PATCH 2/4] lib:ldb: Don't use RTLD_DEEPBIND by default - -It should be off by default, as this is not needed by default. It -crashes named on startup, if bind is built with jemalloc support. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15643 - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher -(cherry picked from commit dc6927fdca2ad77dbcf212ef4d3ba0d118ec7bdf) ---- - lib/ldb/common/ldb_modules.c | 21 ++++++--------------- - selftest/selftest.pl | 6 ------ - selftest/wscript | 5 ++--- - 3 files changed, 8 insertions(+), 24 deletions(-) - -diff --git a/lib/ldb/common/ldb_modules.c b/lib/ldb/common/ldb_modules.c -index 5c970626206..08d251f9bdd 100644 ---- a/lib/ldb/common/ldb_modules.c -+++ b/lib/ldb/common/ldb_modules.c -@@ -945,7 +945,7 @@ static int ldb_modules_load_path(const char *path, const char *version) - int dlopen_flags; - - #ifdef RTLD_DEEPBIND -- bool deepbind_enabled = (getenv("LDB_MODULES_DISABLE_DEEPBIND") == NULL); -+ bool deepbind_enabled = (getenv("LDB_MODULES_ENABLE_DEEPBIND") != NULL); - #endif - - ret = stat(path, &st); -@@ -981,21 +981,12 @@ static int ldb_modules_load_path(const char *path, const char *version) - dlopen_flags = RTLD_NOW; - #ifdef RTLD_DEEPBIND - /* -- * use deepbind if possible, to avoid issues with different -- * system library variants, for example ldb modules may be linked -- * against Heimdal while the application may use MIT kerberos. -+ * On systems where e.g. different kerberos libraries are used, like a -+ * mix of Heimdal and MIT Kerberos, LDB_MODULES_ENABLE_DEEPBIND should -+ * be set to avoid issues. - * -- * See the dlopen manpage for details. -- * -- * One typical user is the bind_dlz module of Samba, -- * but symbol versioning might be enough... -- * -- * We need a way to disable this in order to allow the -- * ldb_*ldap modules to work with a preloaded socket wrapper. -- * -- * So in future we may remove this completely -- * or at least invert the default behavior. -- */ -+ * By default Linux distributions only have one Kerberos library. -+ */ - if (deepbind_enabled) { - dlopen_flags |= RTLD_DEEPBIND; - } -diff --git a/selftest/selftest.pl b/selftest/selftest.pl -index 26b1663b5b6..a0c4ec80f59 100755 ---- a/selftest/selftest.pl -+++ b/selftest/selftest.pl -@@ -433,12 +433,6 @@ $ENV{UID_WRAPPER} = 1; - # We are already hitting the limit, so double it. - $ENV{NSS_WRAPPER_MAX_HOSTENTS} = 200; - --# Disable RTLD_DEEPBIND hack for Samba bind dlz module --# --# This is needed in order to allow the ldb_*ldap module --# to work with a preloaded socket wrapper. --$ENV{LDB_MODULES_DISABLE_DEEPBIND} = 1; -- - my $socket_wrapper_dir; - if ($opt_socket_wrapper) { - $socket_wrapper_dir = SocketWrapper::setup_dir("$prefix_abs/w", $opt_socket_wrapper_pcap); -diff --git a/selftest/wscript b/selftest/wscript -index 52c34dcb88d..95e70706e63 100644 ---- a/selftest/wscript -+++ b/selftest/wscript -@@ -333,9 +333,8 @@ def cmd_testonly(opt): - asan_options += ":suppressions=${srcdir}/selftest/sanitizer/asan.supp" - asan_options += " " - -- # And we need to disable RTLD_DEEPBIND in ldb and socket wrapper -- no_leak_check = "LDB_MODULES_DISABLE_DEEPBIND=1 " -- no_leak_check += "SOCKET_WRAPPER_DISABLE_DEEP_BIND=1" -+ # We need to disable RTLD_DEEPBIND in socket wrapper -+ no_leak_check = "SOCKET_WRAPPER_DISABLE_DEEP_BIND=1" - no_leak_check += " " - env.CORE_COMMAND = asan_options + no_leak_check + env.CORE_COMMAND - --- -2.46.1 - - -From e6745b1444b28904258710dff1dddd18a8b9f662 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Wed, 25 Sep 2024 09:40:23 +0200 -Subject: [PATCH 3/4] lib:ldb: Remove trailing spaces from ldb.3.xml - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15643 - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher -(cherry picked from commit d6ff05cb5708fb6746176821bee5f713195efa54) ---- - lib/ldb/man/ldb.3.xml | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/lib/ldb/man/ldb.3.xml b/lib/ldb/man/ldb.3.xml -index 1c0a2ece552..1dd8b2462d4 100644 ---- a/lib/ldb/man/ldb.3.xml -+++ b/lib/ldb/man/ldb.3.xml -@@ -247,7 +247,7 @@ ldb_search(3) manual pages. - Author - - -- ldb was written by -+ ldb was written by - Andrew Tridgell. - - --- -2.46.1 - - -From ba9918d45820fbdb864b5a1e058136eeb0cf1ce7 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Wed, 25 Sep 2024 09:22:08 +0200 -Subject: [PATCH 4/4] lib:ldb: Document environment variables in ldb manpage - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15643 - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher - -Autobuild-User(master): Andreas Schneider -Autobuild-Date(master): Fri Sep 27 09:06:43 UTC 2024 on atb-devel-224 - -(cherry picked from commit 20a3a94e06a2294206ec233ccc7f873d6ef2aca0) ---- - lib/ldb/man/ldb.3.xml | 21 +++++++++++++++++++++ - 1 file changed, 21 insertions(+) - -diff --git a/lib/ldb/man/ldb.3.xml b/lib/ldb/man/ldb.3.xml -index 1dd8b2462d4..f8d3cb50446 100644 ---- a/lib/ldb/man/ldb.3.xml -+++ b/lib/ldb/man/ldb.3.xml -@@ -243,6 +243,27 @@ ldb_search(3) manual pages. - - - -+ -+ ENVIRONMENT VARIABLES -+ -+ -+ -+ LDB_URL -+ - connect to the provided URL (cmdline tools only) -+ -+ -+ -+ LDB_MODULES_PATH -+ - path where to load ldb modules from -+ -+ -+ -+ LDB_MODULES_ENABLE_DEEPBIND -+ - enable RTLD_DEEPBIND when loading ldb modules -+ -+ -+ -+ - - Author - --- -2.46.1 - diff --git a/samba-4.21.0-backport-freeipa-support.patch b/samba-4.21.0-backport-freeipa-support.patch deleted file mode 100644 index d1c5776..0000000 --- a/samba-4.21.0-backport-freeipa-support.patch +++ /dev/null @@ -1,132 +0,0 @@ -From 26797d7bd2662718b3eb795f1b8e6100d51e3ab7 Mon Sep 17 00:00:00 2001 -From: Alexander Bokovoy -Date: Tue, 3 Sep 2024 08:48:24 +0300 -Subject: [PATCH] sync machine password to keytab: handle FreeIPA use case -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -FreeIPA uses own procedure to retrieve keytabs and during the setup of -Samba on FreeIPA client the keytab is already present, only machine -account needs to be set in the secrets database. - -'sync machine password to keytab' option handling broke this use case by -always attempting to contact a domain controller and failing to do so -(Fedora bug https://bugzilla.redhat.com/show_bug.cgi?id=2309199). - -The original synchronizing machine account password to keytab feature -did not have a mechanism to disable its logic at all. - -Signed-off-by: Alexander Bokovoy -Reviewed-by: Pavel Filipenský - -Autobuild-User(master): Alexander Bokovoy -Autobuild-Date(master): Fri Sep 13 13:16:09 UTC 2024 on atb-devel-224 - -(cherry picked from commit 4f577c7b6894132be4842944f2f950b087312b16) ---- - .../security/syncmachinepasswordtokeytab.xml | 29 +++++++++++++++++-- - source3/libads/kerberos_keytab.c | 5 ++++ - source3/utils/net.c | 8 +++++ - source3/utils/testparm.c | 3 +- - 4 files changed, 41 insertions(+), 4 deletions(-) - -diff --git a/docs-xml/smbdotconf/security/syncmachinepasswordtokeytab.xml b/docs-xml/smbdotconf/security/syncmachinepasswordtokeytab.xml -index 4cad9da73f2..f7dc30023d4 100644 ---- a/docs-xml/smbdotconf/security/syncmachinepasswordtokeytab.xml -+++ b/docs-xml/smbdotconf/security/syncmachinepasswordtokeytab.xml -@@ -18,7 +18,11 @@ or by winbindd doing regular updates (see -+If no value is present and is different from -+'secrets only', the behavior differs between winbind and net utility: -+ -+ -+ -+ winbind uses value -+ /path/to/keytab:sync_spns:sync_kvno:machine_password -+ where the path to the keytab is obtained either from the krb5 library or from -+ . -+ -+ -+ -+ net changesecretpw -f command uses the default 'disabled' value. -+ -+ No other net subcommands use the 'disabled' value. -+ -+ -+ -+If a single value 'disabled' is present, the synchronization process is -+disabled. This is required for FreeIPA domain member setup where keytab -+synchronization uses a protocol not implemented by Samba. - - - -diff --git a/source3/libads/kerberos_keytab.c b/source3/libads/kerberos_keytab.c -index 6ede567b75f..dbf8af44c1f 100644 ---- a/source3/libads/kerberos_keytab.c -+++ b/source3/libads/kerberos_keytab.c -@@ -904,6 +904,11 @@ NTSTATUS sync_pw2keytabs(void) - goto params_ready; - } - -+ if ((*lp_ptr != NULL) && strequal_m(*lp_ptr, "disabled")) { -+ DBG_DEBUG("'sync machine password to keytab' is explicitly disabled.\n"); -+ return NT_STATUS_OK; -+ } -+ - line = lp_ptr; - while (*line) { - DBG_DEBUG("Scanning line: %s\n", *line); -diff --git a/source3/utils/net.c b/source3/utils/net.c -index 7b40d2bee95..c432ebe991f 100644 ---- a/source3/utils/net.c -+++ b/source3/utils/net.c -@@ -207,6 +207,14 @@ static int net_changesecretpw(struct net_context *c, int argc, - struct timeval tv = timeval_current(); - NTTIME now = timeval_to_nttime(&tv); - -+#ifdef HAVE_ADS -+ if (USE_KERBEROS_KEYTAB) { -+ if (lp_sync_machine_password_to_keytab() == NULL) { -+ lp_do_parameter(-1, "sync machine password to keytab", "disabled"); -+ } -+ } -+#endif -+ - if (c->opt_stdin) { - set_line_buffering(stdin); - set_line_buffering(stdout); -diff --git a/source3/utils/testparm.c b/source3/utils/testparm.c -index e3ed336a79a..a31a7a8a30a 100644 ---- a/source3/utils/testparm.c -+++ b/source3/utils/testparm.c -@@ -803,7 +803,8 @@ static int do_global_checks(void) - "instead of 'kerberos method'.\n\n"); - } - -- if (lp_ptr != NULL) { -+ if (lp_ptr != NULL && -+ ((*lp_ptr != NULL) && !strequal_m(*lp_ptr, "disabled"))) { - while (*lp_ptr) { - ret |= pw2kt_check_line(*lp_ptr++); - } --- -2.46.0 - diff --git a/samba-4.21.0-ldb-lmdb.patch b/samba-4.21.0-ldb-lmdb.patch deleted file mode 100644 index 894014a..0000000 --- a/samba-4.21.0-ldb-lmdb.patch +++ /dev/null @@ -1,55 +0,0 @@ -From 9f265d6f3b852a9eed9f19147585fe2801507f63 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Tue, 24 Sep 2024 15:48:23 +0200 -Subject: [PATCH] ldb: Build lmdb backend also in non-AD case - -We should build with lmdb support also if it is not in AD case. The lmdb -backend is also used e.g. by sssd. - -If you don't want to build it, you can always specify --without-ldb-lmdb - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15721 - -Signed-off-by: Andreas Schneider ---- - lib/ldb/wscript | 22 +++++++++------------- - 1 file changed, 9 insertions(+), 13 deletions(-) - -diff --git a/lib/ldb/wscript b/lib/ldb/wscript -index 87aa3bb6d77..f234fa79c10 100644 ---- a/lib/ldb/wscript -+++ b/lib/ldb/wscript -@@ -33,21 +33,17 @@ def configure(conf): - conf.CONFIG_GET('ENABLE_SELFTEST'): - Logs.warn("NOTE: Some AD DC parts of selftest will fail") - -+ conf.env.REQUIRE_LMDB = False -+ elif Options.options.without_ldb_lmdb: -+ if not Options.options.without_ad_dc and \ -+ conf.CONFIG_GET('ENABLE_SELFTEST'): -+ raise Errors.WafError('--without-ldb-lmdb conflicts ' -+ 'with --enable-selftest while ' -+ 'building the AD DC') -+ - conf.env.REQUIRE_LMDB = False - else: -- if Options.options.without_ad_dc: -- conf.env.REQUIRE_LMDB = False -- else: -- if Options.options.without_ldb_lmdb: -- if not Options.options.without_ad_dc and \ -- conf.CONFIG_GET('ENABLE_SELFTEST'): -- raise Errors.WafError('--without-ldb-lmdb conflicts ' -- 'with --enable-selftest while ' -- 'building the AD DC') -- -- conf.env.REQUIRE_LMDB = False -- else: -- conf.env.REQUIRE_LMDB = True -+ conf.env.REQUIRE_LMDB = True - - # if lmdb support is enabled then we require lmdb - # is present, build the mdb back end and enable lmdb support in --- -GitLab - diff --git a/samba-4.21.0-s3-notifyd.patch b/samba-4.21.0-s3-notifyd.patch new file mode 100644 index 0000000..31463fd --- /dev/null +++ b/samba-4.21.0-s3-notifyd.patch @@ -0,0 +1,513 @@ +From c9a7bc3e8f36cb9d6746e23ea56f9c27b82dcf49 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Mon, 22 Jul 2024 12:26:55 +0200 +Subject: [PATCH] s3:notifyd: Use a watcher per db record +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +This fixes a O(n²) performance regression in notifyd. The problem was +that we had a watcher per notify instance. This changes the code to have +a watcher per notify db entry. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14430 + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +(cherry picked from commit af011b987a4ad0d3753d83cc0b8d97ad64ba874a) +--- + source3/smbd/notifyd/notifyd.c | 214 ++++++++++++++++++------- + source3/smbd/notifyd/notifyd_db.c | 5 +- + source3/smbd/notifyd/notifyd_entry.c | 51 ++++-- + source3/smbd/notifyd/notifyd_private.h | 46 ++++-- + 4 files changed, 228 insertions(+), 88 deletions(-) + +diff --git a/source3/smbd/notifyd/notifyd.c b/source3/smbd/notifyd/notifyd.c +index 64dd26a7e11..0b07ab3e435 100644 +--- a/source3/smbd/notifyd/notifyd.c ++++ b/source3/smbd/notifyd/notifyd.c +@@ -337,6 +337,7 @@ static bool notifyd_apply_rec_change( + struct messaging_context *msg_ctx) + { + struct db_record *rec = NULL; ++ struct notifyd_watcher watcher = {}; + struct notifyd_instance *instances = NULL; + size_t num_instances; + size_t i; +@@ -344,6 +345,7 @@ static bool notifyd_apply_rec_change( + TDB_DATA value; + NTSTATUS status; + bool ok = false; ++ bool new_watcher = false; + + if (pathlen == 0) { + DBG_WARNING("pathlen==0\n"); +@@ -374,8 +376,12 @@ static bool notifyd_apply_rec_change( + value = dbwrap_record_get_value(rec); + + if (value.dsize != 0) { +- if (!notifyd_parse_entry(value.dptr, value.dsize, NULL, +- &num_instances)) { ++ ok = notifyd_parse_entry(value.dptr, ++ value.dsize, ++ &watcher, ++ NULL, ++ &num_instances); ++ if (!ok) { + goto fail; + } + } +@@ -390,8 +396,22 @@ static bool notifyd_apply_rec_change( + goto fail; + } + +- if (value.dsize != 0) { +- memcpy(instances, value.dptr, value.dsize); ++ if (num_instances > 0) { ++ struct notifyd_instance *tmp = NULL; ++ size_t num_tmp = 0; ++ ++ ok = notifyd_parse_entry(value.dptr, ++ value.dsize, ++ NULL, ++ &tmp, ++ &num_tmp); ++ if (!ok) { ++ goto fail; ++ } ++ ++ memcpy(instances, ++ tmp, ++ sizeof(struct notifyd_instance) * num_tmp); + } + + for (i=0; ifilter, +- .internal_subdir_filter = chg->subdir_filter + }; + + num_instances += 1; + } + +- if ((instance->instance.filter != 0) || +- (instance->instance.subdir_filter != 0)) { +- int ret; ++ /* ++ * Calculate an intersection of the instances filters for the watcher. ++ */ ++ if (instance->instance.filter > 0) { ++ uint32_t filter = instance->instance.filter; ++ ++ if ((watcher.filter & filter) != filter) { ++ watcher.filter |= filter; ++ ++ new_watcher = true; ++ } ++ } ++ ++ /* ++ * Calculate an intersection of the instances subdir_filters for the ++ * watcher. ++ */ ++ if (instance->instance.subdir_filter > 0) { ++ uint32_t subdir_filter = instance->instance.subdir_filter; + +- TALLOC_FREE(instance->sys_watch); ++ if ((watcher.subdir_filter & subdir_filter) != subdir_filter) { ++ watcher.subdir_filter |= subdir_filter; + +- ret = sys_notify_watch(entries, sys_notify_ctx, path, +- &instance->internal_filter, +- &instance->internal_subdir_filter, +- notifyd_sys_callback, msg_ctx, +- &instance->sys_watch); +- if (ret != 0) { +- DBG_WARNING("sys_notify_watch for [%s] returned %s\n", +- path, strerror(errno)); ++ new_watcher = true; + } + } + + if ((instance->instance.filter == 0) && + (instance->instance.subdir_filter == 0)) { ++ uint32_t tmp_filter = 0; ++ uint32_t tmp_subdir_filter = 0; ++ + /* This is a delete request */ +- TALLOC_FREE(instance->sys_watch); + *instance = instances[num_instances-1]; + num_instances -= 1; ++ ++ for (i = 0; i < num_instances; i++) { ++ struct notifyd_instance *tmp = &instances[i]; ++ ++ tmp_filter |= tmp->instance.filter; ++ tmp_subdir_filter |= tmp->instance.subdir_filter; ++ } ++ ++ /* ++ * If the filter has changed, register a new watcher with the ++ * changed filter. ++ */ ++ if (watcher.filter != tmp_filter || ++ watcher.subdir_filter != tmp_subdir_filter) ++ { ++ watcher.filter = tmp_filter; ++ watcher.subdir_filter = tmp_subdir_filter; ++ ++ new_watcher = true; ++ } ++ } ++ ++ if (new_watcher) { ++ /* ++ * In case we removed all notify instances, we want to remove ++ * the watcher. We won't register a new one, if no filters are ++ * set anymore. ++ */ ++ ++ TALLOC_FREE(watcher.sys_watch); ++ ++ watcher.sys_filter = watcher.filter; ++ watcher.sys_subdir_filter = watcher.subdir_filter; ++ ++ /* ++ * Only register a watcher if we have filter. ++ */ ++ if (watcher.filter != 0 || watcher.subdir_filter != 0) { ++ int ret = sys_notify_watch(entries, ++ sys_notify_ctx, ++ path, ++ &watcher.sys_filter, ++ &watcher.sys_subdir_filter, ++ notifyd_sys_callback, ++ msg_ctx, ++ &watcher.sys_watch); ++ if (ret != 0) { ++ DBG_WARNING("sys_notify_watch for [%s] " ++ "returned %s\n", ++ path, ++ strerror(errno)); ++ } ++ } + } + + DBG_DEBUG("%s has %zu instances\n", path, num_instances); + + if (num_instances == 0) { ++ TALLOC_FREE(watcher.sys_watch); ++ + status = dbwrap_record_delete(rec); + if (!NT_STATUS_IS_OK(status)) { + DBG_WARNING("dbwrap_record_delete returned %s\n", +@@ -456,13 +541,21 @@ static bool notifyd_apply_rec_change( + goto fail; + } + } else { +- value = make_tdb_data( +- (uint8_t *)instances, +- sizeof(struct notifyd_instance) * num_instances); ++ struct TDB_DATA iov[2] = { ++ { ++ .dptr = (uint8_t *)&watcher, ++ .dsize = sizeof(struct notifyd_watcher), ++ }, ++ { ++ .dptr = (uint8_t *)instances, ++ .dsize = sizeof(struct notifyd_instance) * ++ num_instances, ++ }, ++ }; + +- status = dbwrap_record_store(rec, value, 0); ++ status = dbwrap_record_storev(rec, iov, ARRAY_SIZE(iov), 0); + if (!NT_STATUS_IS_OK(status)) { +- DBG_WARNING("dbwrap_record_store returned %s\n", ++ DBG_WARNING("dbwrap_record_storev returned %s\n", + nt_errstr(status)); + goto fail; + } +@@ -706,12 +799,18 @@ static void notifyd_trigger_parser(TDB_DATA key, TDB_DATA data, + .when = tstate->msg->when }; + struct iovec iov[2]; + size_t path_len = key.dsize; ++ struct notifyd_watcher watcher = {}; + struct notifyd_instance *instances = NULL; + size_t num_instances = 0; + size_t i; ++ bool ok; + +- if (!notifyd_parse_entry(data.dptr, data.dsize, &instances, +- &num_instances)) { ++ ok = notifyd_parse_entry(data.dptr, ++ data.dsize, ++ &watcher, ++ &instances, ++ &num_instances); ++ if (!ok) { + DBG_DEBUG("Could not parse notifyd_entry\n"); + return; + } +@@ -734,9 +833,11 @@ static void notifyd_trigger_parser(TDB_DATA key, TDB_DATA data, + + if (tstate->covered_by_sys_notify) { + if (tstate->recursive) { +- i_filter = instance->internal_subdir_filter; ++ i_filter = watcher.sys_subdir_filter & ++ instance->instance.subdir_filter; + } else { +- i_filter = instance->internal_filter; ++ i_filter = watcher.sys_filter & ++ instance->instance.filter; + } + } else { + if (tstate->recursive) { +@@ -1146,46 +1247,39 @@ static int notifyd_add_proxy_syswatches(struct db_record *rec, + struct db_context *db = dbwrap_record_get_db(rec); + TDB_DATA key = dbwrap_record_get_key(rec); + TDB_DATA value = dbwrap_record_get_value(rec); +- struct notifyd_instance *instances = NULL; +- size_t num_instances = 0; +- size_t i; ++ struct notifyd_watcher watcher = {}; + char path[key.dsize+1]; + bool ok; ++ int ret; + + memcpy(path, key.dptr, key.dsize); + path[key.dsize] = '\0'; + +- ok = notifyd_parse_entry(value.dptr, value.dsize, &instances, +- &num_instances); ++ /* This is a remote database, we just need the watcher. */ ++ ok = notifyd_parse_entry(value.dptr, value.dsize, &watcher, NULL, NULL); + if (!ok) { + DBG_WARNING("Could not parse notifyd entry for %s\n", path); + return 0; + } + +- for (i=0; iinstance.filter; +- uint32_t subdir_filter = instance->instance.subdir_filter; +- int ret; ++ watcher.sys_watch = NULL; ++ watcher.sys_filter = watcher.filter; ++ watcher.sys_subdir_filter = watcher.subdir_filter; + +- /* +- * This is a remote database. Pointers that we were +- * given don't make sense locally. Initialize to NULL +- * in case sys_notify_watch fails. +- */ +- instances[i].sys_watch = NULL; +- +- ret = state->sys_notify_watch( +- db, state->sys_notify_ctx, path, +- &filter, &subdir_filter, +- notifyd_sys_callback, state->msg_ctx, +- &instance->sys_watch); +- if (ret != 0) { +- DBG_WARNING("inotify_watch returned %s\n", +- strerror(errno)); +- } ++ ret = state->sys_notify_watch(db, ++ state->sys_notify_ctx, ++ path, ++ &watcher.filter, ++ &watcher.subdir_filter, ++ notifyd_sys_callback, ++ state->msg_ctx, ++ &watcher.sys_watch); ++ if (ret != 0) { ++ DBG_WARNING("inotify_watch returned %s\n", strerror(errno)); + } + ++ memcpy(value.dptr, &watcher, sizeof(struct notifyd_watcher)); ++ + return 0; + } + +@@ -1193,21 +1287,17 @@ static int notifyd_db_del_syswatches(struct db_record *rec, void *private_data) + { + TDB_DATA key = dbwrap_record_get_key(rec); + TDB_DATA value = dbwrap_record_get_value(rec); +- struct notifyd_instance *instances = NULL; +- size_t num_instances = 0; +- size_t i; ++ struct notifyd_watcher watcher = {}; + bool ok; + +- ok = notifyd_parse_entry(value.dptr, value.dsize, &instances, +- &num_instances); ++ ok = notifyd_parse_entry(value.dptr, value.dsize, &watcher, NULL, NULL); + if (!ok) { + DBG_WARNING("Could not parse notifyd entry for %.*s\n", + (int)key.dsize, (char *)key.dptr); + return 0; + } +- for (i=0; ientries database + */ + +-bool notifyd_parse_entry( +- uint8_t *buf, +- size_t buflen, +- struct notifyd_instance **instances, +- size_t *num_instances) ++/** ++ * @brief Parse a notifyd database entry. ++ * ++ * The memory we pass down needs to be aligned. If it isn't aligned we can run ++ * into obscure errors as we just point into the data buffer. ++ * ++ * @param data The data to parse ++ * @param data_len The length of the data to parse ++ * @param watcher A pointer to store the watcher data or NULL. ++ * @param instances A pointer to store the array of notify instances or NULL. ++ * @param pnum_instances The number of elements in the array. If you just want ++ * the number of elements pass NULL for the watcher and instances pointers. ++ * ++ * @return true on success, false if an error occurred. ++ */ ++bool notifyd_parse_entry(uint8_t *data, ++ size_t data_len, ++ struct notifyd_watcher *watcher, ++ struct notifyd_instance **instances, ++ size_t *pnum_instances) + { +- if ((buflen % sizeof(struct notifyd_instance)) != 0) { +- DBG_WARNING("invalid buffer size: %zu\n", buflen); ++ size_t ilen; ++ ++ if (data_len < sizeof(struct notifyd_watcher)) { + return false; + } + +- if (instances != NULL) { +- *instances = (struct notifyd_instance *)buf; ++ if (watcher != NULL) { ++ *watcher = *((struct notifyd_watcher *)(uintptr_t)data); + } +- if (num_instances != NULL) { +- *num_instances = buflen / sizeof(struct notifyd_instance); ++ ++ ilen = data_len - sizeof(struct notifyd_watcher); ++ if ((ilen % sizeof(struct notifyd_instance)) != 0) { ++ return false; ++ } ++ ++ if (pnum_instances != NULL) { ++ *pnum_instances = ilen / sizeof(struct notifyd_instance); + } ++ if (instances != NULL) { ++ /* The (uintptr_t) cast removes a warning from -Wcast-align. */ ++ *instances = ++ (struct notifyd_instance *)(uintptr_t) ++ (data + sizeof(struct notifyd_watcher)); ++ } ++ + return true; + } +diff --git a/source3/smbd/notifyd/notifyd_private.h b/source3/smbd/notifyd/notifyd_private.h +index 36c08f47c54..db8e6e1c005 100644 +--- a/source3/smbd/notifyd/notifyd_private.h ++++ b/source3/smbd/notifyd/notifyd_private.h +@@ -20,30 +20,48 @@ + #include "lib/util/server_id.h" + #include "notifyd.h" + ++ + /* +- * notifyd's representation of a notify instance ++ * Representation of a watcher for a path ++ * ++ * This will be stored in the db. + */ +-struct notifyd_instance { +- struct server_id client; +- struct notify_instance instance; +- +- void *sys_watch; /* inotify/fam/etc handle */ ++struct notifyd_watcher { ++ /* ++ * This is an intersections of the filter the watcher is listening for. ++ */ ++ uint32_t filter; ++ uint32_t subdir_filter; + + /* +- * Filters after sys_watch took responsibility of some bits ++ * Those are inout variables passed to the sys_watcher. The sys_watcher ++ * will remove the bits it can't handle. + */ +- uint32_t internal_filter; +- uint32_t internal_subdir_filter; ++ uint32_t sys_filter; ++ uint32_t sys_subdir_filter; ++ ++ /* The handle for inotify/fam etc. */ ++ void *sys_watch; ++}; ++ ++/* ++ * Representation of a notifyd instance ++ * ++ * This will be stored in the db. ++ */ ++struct notifyd_instance { ++ struct server_id client; ++ struct notify_instance instance; + }; + + /* + * Parse an entry in the notifyd_context->entries database + */ + +-bool notifyd_parse_entry( +- uint8_t *buf, +- size_t buflen, +- struct notifyd_instance **instances, +- size_t *num_instances); ++bool notifyd_parse_entry(uint8_t *data, ++ size_t data_len, ++ struct notifyd_watcher *watcher, ++ struct notifyd_instance **instances, ++ size_t *num_instances); + + #endif +-- +2.46.1 + diff --git a/samba.spec b/samba.spec index 67e3895..0de5d76 100644 --- a/samba.spec +++ b/samba.spec @@ -150,7 +150,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.21.0 +%global samba_version 4.21.1 # The release field is extended: # [.][.]%%{?dist}[.] @@ -252,10 +252,7 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore -Patch0: samba-4.21.0-backport-freeipa-support.patch -# https://gitlab.com/samba-team/samba/-/merge_requests/3807 -Patch1: samba-4.21.0-ldb-lmdb.patch -Patch2: samba-4-21-fix-libldb-deepbind.patch +Patch0: samba-4.21.0-s3-notifyd.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} diff --git a/sources b/sources index 3e8e284..a1c1a28 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.21.0.tar.xz) = d05c823afc04669766130745c139e7d129eb9961525453d6da8b5ee6693d4c08192496d07e5c211e86d553956504fb9df16611cc9268111b71b95c7f2fa868a0 -SHA512 (samba-4.21.0.tar.asc) = 7fffbd0b88b42dd7f340e4bcae17da4a68a0f8de86a1e71534a4a02a477a746e4cdb16df7c0da33aaf13278cefb452bd9b7c61ed029e248576f7158e8bec339e +SHA512 (samba-4.21.1.tar.xz) = 182759820708c9df26fbcb09e755e81236ecacf543f3e18a05dbd0ea551ab072d338fe239eb99ff506f158ec45e981a893ce46eacdde6e073ee85ceb43e2669a +SHA512 (samba-4.21.1.tar.asc) = 2c1e4b347044e15a852ced8bb412a3f372fd2c2b5e0001b1a773f7283f2d8fa62942143b46cbc3f16b18882255cf0aac4426002453971361b0002357657484f1 From 16e2ea30c449f8a043680b12aaac21abe6af286a Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 15 Oct 2024 11:33:45 +0200 Subject: [PATCH 340/425] rpminspect: Disable inspection of disttag rpminspect just reads the file an doesn't expand it so it doesn't understand: Release: %{samba_release} [skip changelog] --- rpminspect.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/rpminspect.yaml b/rpminspect.yaml index 75d7856..c1455e2 100644 --- a/rpminspect.yaml +++ b/rpminspect.yaml @@ -1,4 +1,7 @@ --- +inspections: + disttag: off + badfuncs: ignore: - /usr/bin/nmblookup From a55c2e04452fd163be78a5079c6dc77218e916fc Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 15 Oct 2024 11:57:41 +0200 Subject: [PATCH 341/425] Fix several rpminspect warnings --- samba.spec | 31 +++++++++++++++++++++++++++---- 1 file changed, 27 insertions(+), 4 deletions(-) diff --git a/samba.spec b/samba.spec index 0de5d76..e44cdd5 100644 --- a/samba.spec +++ b/samba.spec @@ -261,6 +261,7 @@ Requires: %{name}-common-tools = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-dcerpc = %{samba_depver} +Requires: libldb = %{samba_depver} Requires: libnetapi = %{samba_depver} %if %{with libwbclient} Requires(post): libwbclient = %{samba_depver} @@ -438,6 +439,7 @@ Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} +Requires: libldb = %{samba_depver} %if %{with libsmbclient} Requires: libsmbclient = %{samba_depver} %endif @@ -464,6 +466,7 @@ Summary: Samba client libraries Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} +Requires: libldb = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} %endif @@ -498,6 +501,7 @@ Summary: Libraries used by both Samba servers and clients Requires(pre): samba-common = %{samba_depver} Requires: samba-common = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} +Requires: libldb = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} %endif @@ -538,6 +542,7 @@ Requires: samba-common-libs = %{samba_depver} Requires: samba-client-libs = %{samba_depver} Requires: samba-libs = %{samba_depver} Requires: samba-ldb-ldap-modules = %{samba_depver} +Requires: libldb = %{samba_depver} Requires: libnetapi = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} @@ -574,6 +579,7 @@ Summary: DCE RPC binaries Requires: samba-common-libs = %{samba_depver} Requires: samba-client-libs = %{samba_depver} Requires: samba-libs = %{samba_depver} +Requires: libldb = %{samba_depver} Requires: libnetapi = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} @@ -634,6 +640,7 @@ Summary: Samba AD Domain Controller Libraries Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} +Requires: libldb = %{samba_depver} Provides: samba4-dc-libs = %{samba_depver} Obsoletes: samba4-dc-libs < %{samba_depver} @@ -654,6 +661,7 @@ Requires: %{name}-dc-libs = %{samba_depver} Requires: %{name}-dc = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: bind +Requires: libldb = %{samba_depver} Provides: bundled(libreplace) @@ -688,6 +696,7 @@ Summary: Samba VFS module for Ceph distributed storage system Requires: %{name} = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} +Requires: libldb = %{samba_depver} Provides: bundled(libreplace) @@ -703,6 +712,7 @@ Summary: Samba VFS module for io_uring Requires: %{name} = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} +Requires: libldb = %{samba_depver} Provides: bundled(libreplace) @@ -721,6 +731,7 @@ Requires: %{name} = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} +Requires: libldb = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} %endif @@ -772,6 +783,7 @@ the Kerberos credentials cache of the user issuing the print job. Summary: Samba ldap modules for ldb Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} +Requires: libldb = %{samba_depver} %description ldb-ldap-modules This package contains the ldb ldap modules required by samba-tool and @@ -782,6 +794,7 @@ samba-gpupdate. Summary: Samba libraries Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} +Requires: libldb = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} %endif @@ -802,6 +815,7 @@ Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} +Requires: libldb = %{samba_depver} %description -n libnetapi This contains the NETAPI library from the Samba suite. @@ -822,6 +836,7 @@ Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} +Requires: libldb = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} %endif @@ -879,6 +894,7 @@ Requires: python3-requests Requires: python3-talloc Requires: python3-tdb Requires: python3-tevent +Requires: libldb = %{samba_depver} %if %{with libsmbclient} Requires: libsmbclient = %{samba_depver} %endif @@ -909,6 +925,7 @@ Requires: %{name}-dc-libs = %{samba_depver} Requires: python3-%{name} = %{samba_depver} # for ms_forest_updates_markdown.py and ms_schema_markdown.py Requires: python3-markdown +Requires: libldb = %{samba_depver} %description -n python3-samba-dc The python3-%{name}-dc package contains the Python libraries needed by programs @@ -944,6 +961,7 @@ Requires: %{name}-test-libs = %{samba_depver} Requires: %{name}-dc-libs = %{samba_depver} %endif Requires: %{name}-libs = %{samba_depver} +Requires: libldb = %{samba_depver} Requires: libnetapi = %{samba_depver} %if %{with libsmbclient} Requires: libsmbclient = %{samba_depver} @@ -969,6 +987,7 @@ Summary: Libraries need by the testing tools for Samba servers and clients Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} +Requires: libldb = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} %endif @@ -1006,6 +1025,7 @@ Requires: %{name}-libs = %{samba_depver} Requires(post): %{name}-libs = %{samba_depver} Requires: %{name}-winbind-modules = %{samba_depver} Suggests: %{name}-tools = %{samba_depver} +Requires: libldb = %{samba_depver} %if %{with libwbclient} Requires(post): libwbclient = %{samba_depver} @@ -1034,6 +1054,7 @@ Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-winbind = %{samba_depver} +Requires: libldb = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} %endif @@ -1057,6 +1078,7 @@ Requires: %{name}-winbind = %{samba_depver} Requires: %{name}-libs = %{samba_depver} %endif Requires: samba-client-libs = %{samba_depver} +Requires: libldb = %{samba_depver} Provides: samba4-winbind-krb5-locator = %{samba_depver} Obsoletes: samba4-winbind-krb5-locator < %{samba_depver} @@ -1099,6 +1121,7 @@ Summary: Samba Winexe Windows Binary License: GPL-3.0-only Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} +Requires: libldb = %{samba_depver} Provides: bundled(libreplace) @@ -1219,8 +1242,8 @@ Requires: libtdb%{?_isa} >= %{tdb_version} Requires: libtevent%{?_isa} >= %{tevent_version} Provides: bundled(libreplace) -Obsoletes: libldb < 2.10 -Provides: libldb = 2.10 +Obsoletes: libldb < 0:2.10 +Provides: libldb = 0:2.10 Provides: libldb = %{samba_depver} %description -n libldb @@ -1236,8 +1259,8 @@ Requires: libtdb-devel%{?_isa} >= %{tdb_version} Requires: libtalloc-devel%{?_isa} >= %{talloc_version} Requires: libtevent-devel%{?_isa} >= %{tevent_version} -Obsoletes: libldb-devel < 2.10 -Provides: libldb-devel = 2.10 +Obsoletes: libldb-devel < 0:2.10 +Provides: libldb-devel = 0:2.10 Provides: libldb-devel = %{samba_depver} %description -n libldb-devel From 682be9e3984abd64b6bd10423d79e26f99bcf196 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 15 Oct 2024 13:19:08 +0200 Subject: [PATCH 342/425] Fix some more rpminspect warnings --- samba.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index e44cdd5..5258f94 100644 --- a/samba.spec +++ b/samba.spec @@ -1271,7 +1271,7 @@ Header files needed to develop programs that link against the LDB library. Summary: Tools to manage LDB files License: LGPL-3.0-or-later Requires: libldb%{?_isa} = %{samba_depver} -Obsoletes: ldb-tools < 2.10 +Obsoletes: ldb-tools < 0:2.10 Provides: ldb-tools = %{samba_depver} %description -n ldb-tools @@ -1285,7 +1285,7 @@ Requires: libldb%{?_isa} = %{samba_depver} Requires: python3-tdb%{?_isa} >= %{tdb_version} %{?python_provide:%python_provide python3-ldb} -Obsoletes: python3-ldb < 2.10 +Obsoletes: python3-ldb < 0:2.10 Provides: python3-ldb = %{samba_depver} # These were the C bindings, only used by Samba Obsoletes: python-ldb-devel-common < 2.10 From 6d5708b5e4b8e9be2742e147c52b1961198d0ef5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Wed, 16 Oct 2024 10:17:10 +0200 Subject: [PATCH 343/425] Fix even more rpminspect warnings --- samba.spec | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/samba.spec b/samba.spec index 5258f94..acaed49 100644 --- a/samba.spec +++ b/samba.spec @@ -641,6 +641,7 @@ Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: libldb = %{samba_depver} +Requires: libwbclient = %{samba_depver} Provides: samba4-dc-libs = %{samba_depver} Obsoletes: samba4-dc-libs < %{samba_depver} @@ -662,6 +663,7 @@ Requires: %{name}-dc = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: bind Requires: libldb = %{samba_depver} +Requires: libwbclient = %{samba_depver} Provides: bundled(libreplace) @@ -697,6 +699,7 @@ Requires: %{name} = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: libldb = %{samba_depver} +Requires: libwbclient = %{samba_depver} Provides: bundled(libreplace) @@ -713,6 +716,7 @@ Requires: %{name} = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: libldb = %{samba_depver} +Requires: libwbclient = %{samba_depver} Provides: bundled(libreplace) @@ -784,6 +788,7 @@ Summary: Samba ldap modules for ldb Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: libldb = %{samba_depver} +Requires: libwbclient = %{samba_depver} %description ldb-ldap-modules This package contains the ldb ldap modules required by samba-tool and @@ -816,6 +821,7 @@ Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: libldb = %{samba_depver} +Requires: libwbclient = %{samba_depver} %description -n libnetapi This contains the NETAPI library from the Samba suite. @@ -926,6 +932,7 @@ Requires: python3-%{name} = %{samba_depver} # for ms_forest_updates_markdown.py and ms_schema_markdown.py Requires: python3-markdown Requires: libldb = %{samba_depver} +Requires: libwbclient = %{samba_depver} %description -n python3-samba-dc The python3-%{name}-dc package contains the Python libraries needed by programs @@ -1122,6 +1129,7 @@ License: GPL-3.0-only Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: libldb = %{samba_depver} +Requires: libwbclient = %{samba_depver} Provides: bundled(libreplace) @@ -1283,6 +1291,7 @@ Summary: Python bindings for the LDB library License: LGPL-3.0-or-later Requires: libldb%{?_isa} = %{samba_depver} Requires: python3-tdb%{?_isa} >= %{tdb_version} +Requires: samba-client-libs = %{samba_depver} %{?python_provide:%python_provide python3-ldb} Obsoletes: python3-ldb < 0:2.10 From 1caea566a46616d21248b4a2ce7c87b7abf3b131 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Thu, 17 Oct 2024 11:39:31 +0200 Subject: [PATCH 344/425] Revert "Re-enable linking with mold on i686" This reverts commit ac58d580e8ff60046b6600a1f6c843391ae1ffdd. This is to address debuginfo issue reported by rpminspect for i686: https://bugzilla.redhat.com/show_bug.cgi?id=2318727 --- samba.spec | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index acaed49..4001c34 100644 --- a/samba.spec +++ b/samba.spec @@ -353,7 +353,7 @@ BuildRequires: zlib-devel >= 1.2.3 BuildRequires: pkgconfig(libsystemd) -%ifnarch riscv64 +%ifnarch i686 riscv64 %if 0%{?fedora} >= 37 BuildRequires: mold %endif @@ -1365,13 +1365,13 @@ export python_LDFLAGS="$(echo %{__global_ldflags} | sed -e 's/-Wl,-z,defs//g')" # Use the mold linker if possible export python_LDFLAGS="$(echo %{__global_ldflags} | sed -e 's/-Wl,-z,defs//g')" -%ifnarch riscv64 +%ifnarch i686 riscv64 %if 0%{?fedora} >= 37 export LDFLAGS="%{__global_ldflags} -fuse-ld=mold" export python_LDFLAGS="$(echo ${LDFLAGS} | sed -e 's/-Wl,-z,defs//g')" #endif fedora >= 37 %endif -#endif narch riscv64 +#endif narch i686 %endif # Add support for mock ccache plugin From a98899c6d21a92fdb6b5ab406297406e8c7af2d1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 22 Oct 2024 11:02:58 +0200 Subject: [PATCH 345/425] Fix samba 4.20 -> 4.21 upgrade for the removed python3-samba-devel --- samba.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/samba.spec b/samba.spec index 4001c34..cee1bec 100644 --- a/samba.spec +++ b/samba.spec @@ -685,6 +685,8 @@ Requires: libnetapi = %{samba_depver} Provides: samba4-devel = %{samba_depver} Obsoletes: samba4-devel < %{samba_depver} +Provides: python3-samba-devel = %{samba_depver} +Obsoletes: python3-samba-devel < %{samba_depver} %description devel The %{name}-devel package contains the header files for the libraries From 4ae2996e49becec13fe8a30bed92b3a9a9330170 Mon Sep 17 00:00:00 2001 From: "Richard W.M. Jones" Date: Tue, 22 Oct 2024 13:42:50 +0100 Subject: [PATCH 346/425] Rebuild for Jansson 2.14 (https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/3PYINSQGKQ4BB25NQUI2A2UCGGLAG5ND/) From 667e752f95dad7cfb1526eb3d0f54a65e0e38386 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Fri, 25 Oct 2024 19:42:31 +0200 Subject: [PATCH 347/425] Add always to samba-devel: Requires: samba-dc-libs --- samba.spec | 2 -- 1 file changed, 2 deletions(-) diff --git a/samba.spec b/samba.spec index cee1bec..8867bf8 100644 --- a/samba.spec +++ b/samba.spec @@ -678,9 +678,7 @@ name server related details of Samba AD. Summary: Developer tools for Samba libraries Requires: %{name}-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} -%if %{with dc} Requires: %{name}-dc-libs = %{samba_depver} -%endif Requires: libnetapi = %{samba_depver} Provides: samba4-devel = %{samba_depver} From f654bad3bbb3968dd029d795205d4879bda2e864 Mon Sep 17 00:00:00 2001 From: Anoop C S Date: Wed, 13 Nov 2024 11:29:47 +0530 Subject: [PATCH 348/425] Remove unused macro samba_requires_eq This was previously used to force the installation of a matching libldb version from build time. With libldb now versioned along with Samba as a public library its usage got removed in d0472882 but the definition remained as a left over. Signed-off-by: Anoop C S --- samba.spec | 2 -- 1 file changed, 2 deletions(-) diff --git a/samba.spec b/samba.spec index 8867bf8..57b412a 100644 --- a/samba.spec +++ b/samba.spec @@ -148,8 +148,6 @@ %bcond lmdb 0 %endif -%define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") - %global samba_version 4.21.1 # The release field is extended: From 438b8a6e95335df41efa69442b7aef2bc246f51c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 25 Nov 2024 18:55:39 +0100 Subject: [PATCH 349/425] Update to version 4.21.2 - resolves: rhbz#2328717 --- samba.spec | 11 +++++++++-- sources | 4 ++-- 2 files changed, 11 insertions(+), 4 deletions(-) diff --git a/samba.spec b/samba.spec index 57b412a..c3a8da1 100644 --- a/samba.spec +++ b/samba.spec @@ -148,7 +148,7 @@ %bcond lmdb 0 %endif -%global samba_version 4.21.1 +%global samba_version 4.21.2 # The release field is extended: # [.][.]%%{?dist}[.] @@ -1584,6 +1584,12 @@ cp -a lib/ldb/apidocs/man/* %{buildroot}%{_mandir} rm -f %{buildroot}%{_mandir}/man3/_* rm -f %{buildroot}%{_mandir}/man3/PyLdb* +# CTDB +%if %{with clustering} +touch %{buildroot}%{_libexecdir}/ctdb/statd_callout +#endif with clustering +%endif + %if %{with testsuite} %check # @@ -2640,6 +2646,7 @@ fi %{python3_sitearch}/samba/dcerpc/ntlmssp.*.so %{python3_sitearch}/samba/dcerpc/preg.*.so %{python3_sitearch}/samba/dcerpc/samr.*.so +%{python3_sitearch}/samba/dcerpc/schannel.*.so %{python3_sitearch}/samba/dcerpc/security.*.so %{python3_sitearch}/samba/dcerpc/server_id.*.so %{python3_sitearch}/samba/dcerpc/smb_acl.*.so @@ -3809,7 +3816,7 @@ fi %{_sysconfdir}/ctdb/functions %{_sysconfdir}/ctdb/nfs-linux-kernel-callout -%{_sysconfdir}/ctdb/statd-callout +%ghost %{_sysconfdir}/ctdb/statd-callout # CTDB scripts, no config files # script with executable bit means activated diff --git a/sources b/sources index a1c1a28..285808c 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.21.1.tar.xz) = 182759820708c9df26fbcb09e755e81236ecacf543f3e18a05dbd0ea551ab072d338fe239eb99ff506f158ec45e981a893ce46eacdde6e073ee85ceb43e2669a -SHA512 (samba-4.21.1.tar.asc) = 2c1e4b347044e15a852ced8bb412a3f372fd2c2b5e0001b1a773f7283f2d8fa62942143b46cbc3f16b18882255cf0aac4426002453971361b0002357657484f1 +SHA512 (samba-4.21.2.tar.xz) = c26311a60d3994561aa12c36e54bc37d1161ec1063aa9876ea03dee24984e9c827e5836dc86bc392e37193010275a642b960e775b5a9e029246ba56ae1697682 +SHA512 (samba-4.21.2.tar.asc) = f3da123d2e86a7e07c4fcb83924edd29195d865091d80125f3531c463662a8a38ba6d8c467932af8cd065d0cc4467131c83a4e3783573b757f6ed9c2bde0befc From e2b080c313ae5af530b0b830bd5bf9f6af216cad Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 26 Nov 2024 14:52:12 +0100 Subject: [PATCH 350/425] Add python3-crypt-r as requirement for samba-tool --- samba.spec | 3 +++ 1 file changed, 3 insertions(+) diff --git a/samba.spec b/samba.spec index c3a8da1..9fd763b 100644 --- a/samba.spec +++ b/samba.spec @@ -565,6 +565,9 @@ Requires: lmdb %endif Requires: tdb-tools Requires: python3-gpg +# The `crypt` module has been removed in Python 3.13, this is a copy +# See also python3-crypt-r.x86_64 +Requires: python3-crypt-r %endif %description tools From 1af6d0aa01aa45a9bca5051d056cb3cd5660777e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 27 Nov 2024 17:45:39 +0100 Subject: [PATCH 351/425] Add missing BuildRequires for running the testsuite [skip changelog] --- samba.spec | 32 +++++++++++++++++++++++++++++++- 1 file changed, 31 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 9fd763b..771e79f 100644 --- a/samba.spec +++ b/samba.spec @@ -419,6 +419,36 @@ BuildRequires: tdb-tools %endif #endif with dc || with testsuite + +%if %{with testsuite} +BuildRequires: bind-utils +BuildRequires: glibc-langpack-en +BuildRequires: git +BuildRequires: gnutls-utils +BuildRequires: jq +BuildRequires: krb5-pkinit +BuildRequires: krb5-workstation +BuildRequires: lmdb +BuildRequires: nss_wrapper +BuildRequires: pam_wrapper +BuildRequires: perl-Archive-Tar +BuildRequires: perl-Digest-MD5 +BuildRequires: perl-ExtUtils-MakeMaker +BuildRequires: perl-JSON +BuildRequires: perl-JSON-Parse +BuildRequires: perl-Parse-Yapp +BuildRequires: perl-Test-Base +BuildRequires: psmisc +BuildRequires: python3-libpamtest +# The `crypt` module has been removed in Python 3.13, this is a copy +# See also https://bugzilla.samba.org/show_bug.cgi?id=15756 +BuildRequires: python3-crypt-r +BuildRequires: resolv_wrapper +BuildRequires: rsync +BuildRequires: socket_wrapper +BuildRequires: sudo +BuildRequires: uid_wrapper +#endif with testsuite %endif # filter out perl requirements pulled in from examples in the docdir. @@ -566,7 +596,7 @@ Requires: lmdb Requires: tdb-tools Requires: python3-gpg # The `crypt` module has been removed in Python 3.13, this is a copy -# See also python3-crypt-r.x86_64 +# See also https://bugzilla.samba.org/show_bug.cgi?id=15756 Requires: python3-crypt-r %endif From a5688d299c0d43fe960e3e57535c3e1fdcb392bf Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 27 Nov 2024 17:48:35 +0100 Subject: [PATCH 352/425] Rework 'with testsuite' In case we run the testsuite, the %install part will be skipped. Without the testsuite, the %check section will be skipped. [skip changelog] --- samba.spec | 896 ++--------------------------------------------------- 1 file changed, 21 insertions(+), 875 deletions(-) diff --git a/samba.spec b/samba.spec index 771e79f..039caad 100644 --- a/samba.spec +++ b/samba.spec @@ -400,7 +400,7 @@ BuildRequires: libtdb-devel >= %{tdb_version} BuildRequires: python3-tdb >= %{tdb_version} %endif -%if %{with dc} || %{with testsuite} +%if %{with dc} BuildRequires: bind BuildRequires: krb5-server >= %{required_mit_krb5} %if 0%{?fedora} || 0%{?rhel} >= 9 @@ -418,7 +418,8 @@ BuildRequires: tdb-tools #endif without includelibs %endif -#endif with dc || with testsuite +#endif with dc +%endif %if %{with testsuite} BuildRequires: bind-utils @@ -1206,30 +1207,6 @@ projects to store temporary data. If an application is already using TDB for temporary data it is very easy to convert that application to be cluster aware and use CTDB instead. -%if %{with testsuite} -### CTDB-TEST -%package -n ctdb-tests -Summary: CTDB clustered database test suite - -Requires: %{name}-common-libs = %{samba_depver} -Requires: %{name}-client-libs = %{samba_depver} - -Requires: ctdb = %{samba_depver} -Recommends: nc - -Provides: ctdb-devel = %{samba_depver} -Obsoletes: ctdb-devel < %{samba_depver} - -%description -n ctdb-tests -Test suite for CTDB. -CTDB is a cluster implementation of the TDB database used by Samba and other -projects to store temporary data. If an application is already using TDB for -temporary data it is very easy to convert that application to be cluster aware -and use CTDB instead. - -#endif with testsuite -%endif - %if %{with pcp_pmda} %package -n ctdb-pcp-pmda @@ -1481,6 +1458,7 @@ doxygen Doxyfile popd %install +%if !%{with testsuite} # Do not use %%make_install, make is just a wrapper around waf in Samba! %{__make} %{?_smp_mflags} %{_make_verbose} install DESTDIR=%{buildroot} @@ -1623,8 +1601,11 @@ touch %{buildroot}%{_libexecdir}/ctdb/statd_callout #endif with clustering %endif -%if %{with testsuite} +#endif !with testsuite +%endif + %check +%if %{with testsuite} # # samba3.smb2.timestamps.*: # @@ -1648,6 +1629,7 @@ export WINBINDD_DONT_LOG_STDOUT=1 #endif with testsuite %endif +%if !%{with testsuite} %post %systemd_post samba-bgqd.service %systemd_post smb.service @@ -1691,7 +1673,7 @@ fi %ldconfig_scriptlets common-libs -%if %{with dc} || %{with testsuite} +%if %{with dc} %ldconfig_scriptlets dc-libs %post dc @@ -1793,7 +1775,7 @@ fi %{_sbindir}/eventlogadm %{_sbindir}/nmbd %{_sbindir}/smbd -%if %{with dc} || %{with testsuite} +%if %{with dc} # This is only used by vfs_dfs_samba4 %{_libdir}/samba/libdfs-server-ad-private-samba.so %endif @@ -1811,7 +1793,7 @@ fi %{_libdir}/samba/vfs/commit.so %{_libdir}/samba/vfs/crossrename.so %{_libdir}/samba/vfs/default_quota.so -%if %{with dc} || %{with testsuite} +%if %{with dc} %{_libdir}/samba/vfs/dfs_samba4.so %endif %{_libdir}/samba/vfs/dirsort.so @@ -1844,10 +1826,6 @@ fi %{_libdir}/samba/vfs/worm.so %{_libdir}/samba/vfs/xattr_tdb.so -%if %{with testsuite} -%{_libdir}/samba/vfs/nfs4acl_xattr.so -%endif - %dir %{_libexecdir}/samba %{_libexecdir}/samba/samba-bgqd @@ -2179,16 +2157,13 @@ fi %{_libexecdir}/samba/rpcd_fsrvp %{_libexecdir}/samba/rpcd_lsad %{_libexecdir}/samba/rpcd_mdssvc -%if %{with testsuite} -%{_libexecdir}/samba/rpcd_rpcecho -%endif %{_libexecdir}/samba/rpcd_spoolss %{_libexecdir}/samba/rpcd_winreg %{_libexecdir}/samba/rpcd_witness %{_mandir}/man8/samba-dcerpcd.8* ### DC -%if %{with dc} || %{with testsuite} +%if %{with dc} %files dc %{_unitdir}/samba.service %{_sbindir}/samba @@ -2266,7 +2241,7 @@ fi %license source4/setup/ad-schema/licence.txt %{_datadir}/samba/setup -#endif with dc || with testsuite +#endif with dc %endif ### DC-LIBS %files dc-libs @@ -2274,16 +2249,12 @@ fi %{_libdir}/samba/libauth4-private-samba.so %{_libdir}/samba/libsamba-net-private-samba.so -%if %{with dc} || %{with testsuite} +%if %{with dc} %{_libdir}/samba/libdb-glue-private-samba.so %{_libdir}/samba/libpac-private-samba.so %{_libdir}/samba/libprocess-model-private-samba.so %{_libdir}/samba/libservice-private-samba.so -%if %{with testsuite} -%{_libdir}/samba/libntvfs-private-samba.so -%endif - %dir %{_libdir}/samba/process_model %{_libdir}/samba/process_model/prefork.so %{_libdir}/samba/process_model/standard.so @@ -2302,10 +2273,6 @@ fi %{_libdir}/samba/service/winbindd.so %{_libdir}/samba/service/wrepl.so -%if %{with testsuite} -%{_libdir}/samba/service/smb.so -%endif - %{_libdir}/libdcerpc-server.so.* %{_libdir}/samba/libad-claims-private-samba.so %{_libdir}/samba/libauthn-policy-util-private-samba.so @@ -2440,7 +2407,7 @@ fi %{_libdir}/libsamba-policy.so %{_libdir}/libsmbldap.so -%if %{with dc} || %{with testsuite} +%if %{with dc} %{_includedir}/samba-4.0/dcerpc_server.h %{_libdir}/libdcerpc-server.so %{_libdir}/pkgconfig/dcerpc_server.pc @@ -3126,7 +3093,7 @@ fi %{python3_sitearch}/samba/__pycache__/uptodateness.*.pyc %{python3_sitearch}/samba/dcerpc/dnsserver.*.so -%if %{with dc} || %{with testsuite} +%if %{with dc} %{python3_sitearch}/samba/dckeytab.*.so %endif %{python3_sitearch}/samba/domain_update.py @@ -3770,21 +3737,12 @@ fi %{_mandir}/man1/ndrdump.1* %{_mandir}/man1/smbtorture.1* -%if %{with testsuite} -%{_mandir}/man1/vfstest.1* -# files to ignore in testsuite mode -%{_libdir}/samba/libnss-wrapper.so -%{_libdir}/samba/libsocket-wrapper.so -%{_libdir}/samba/libuid-wrapper.so -%endif - ### TEST-LIBS %files test-libs -%if %{with dc} || %{with testsuite} +%if %{with dc} %{_libdir}/samba/libdlz-bind9-for-torture-private-samba.so -%else -%{_libdir}/samba/libdsdb-module-private-samba.so %endif +%{_libdir}/samba/libdsdb-module-private-samba.so ### USERSHARES %files usershares @@ -3940,820 +3898,6 @@ fi %dir %{_datadir}/ctdb/scripts %{_datadir}/ctdb/scripts/winbind_ctdb_updatekeytab.sh -%if %{with testsuite} -%files -n ctdb-tests -%doc ctdb/tests/README -%{_bindir}/ctdb_local_daemons -%{_bindir}/ctdb_run_tests -%{_bindir}/ctdb_run_cluster_tests - -%dir %{_libexecdir}/ctdb -%dir %{_libexecdir}/ctdb/tests -%{_libexecdir}/ctdb/tests/cluster_mutex_test -%{_libexecdir}/ctdb/tests/cmdline_test -%{_libexecdir}/ctdb/tests/comm_client_test -%{_libexecdir}/ctdb/tests/comm_server_test -%{_libexecdir}/ctdb/tests/comm_test -%{_libexecdir}/ctdb/tests/conf_test -%{_libexecdir}/ctdb/tests/ctdb-db-test -%{_libexecdir}/ctdb/tests/ctdb_io_test -%{_libexecdir}/ctdb/tests/ctdb_packet_parse -%{_libexecdir}/ctdb/tests/ctdb_takeover_tests -%{_libexecdir}/ctdb/tests/db_hash_test -%{_libexecdir}/ctdb/tests/dummy_client -%{_libexecdir}/ctdb/tests/errcode -%{_libexecdir}/ctdb/tests/event_protocol_test -%{_libexecdir}/ctdb/tests/event_script_test -%{_libexecdir}/ctdb/tests/fake_ctdbd -%{_libexecdir}/ctdb/tests/fetch_loop -%{_libexecdir}/ctdb/tests/fetch_loop_key -%{_libexecdir}/ctdb/tests/fetch_readonly -%{_libexecdir}/ctdb/tests/fetch_readonly_loop -%{_libexecdir}/ctdb/tests/fetch_ring -%{_libexecdir}/ctdb/tests/g_lock_loop -%{_libexecdir}/ctdb/tests/hash_count_test -%{_libexecdir}/ctdb/tests/line_test -%{_libexecdir}/ctdb/tests/lock_tdb -%{_libexecdir}/ctdb/tests/message_ring -%{_libexecdir}/ctdb/tests/pidfile_test -%{_libexecdir}/ctdb/tests/pkt_read_test -%{_libexecdir}/ctdb/tests/pkt_write_test -%{_libexecdir}/ctdb/tests/porting_tests -%{_libexecdir}/ctdb/tests/protocol_basic_test -%{_libexecdir}/ctdb/tests/protocol_ctdb_compat_test -%{_libexecdir}/ctdb/tests/protocol_ctdb_test -%{_libexecdir}/ctdb/tests/protocol_types_compat_test -%{_libexecdir}/ctdb/tests/protocol_types_test -%{_libexecdir}/ctdb/tests/protocol_util_test -%{_libexecdir}/ctdb/tests/rb_test -%{_libexecdir}/ctdb/tests/reqid_test -%{_libexecdir}/ctdb/tests/run_event_test -%{_libexecdir}/ctdb/tests/run_proc_test -%{_libexecdir}/ctdb/tests/sigcode -%{_libexecdir}/ctdb/tests/sock_daemon_test -%{_libexecdir}/ctdb/tests/sock_io_test -%{_libexecdir}/ctdb/tests/srvid_test -%{_libexecdir}/ctdb/tests/system_socket_test -%{_libexecdir}/ctdb/tests/tmon_ping_test -%{_libexecdir}/ctdb/tests/tmon_test -%{_libexecdir}/ctdb/tests/transaction_loop -%{_libexecdir}/ctdb/tests/tunable_test -%{_libexecdir}/ctdb/tests/tunnel_cmd -%{_libexecdir}/ctdb/tests/tunnel_test -%{_libexecdir}/ctdb/tests/update_record -%{_libexecdir}/ctdb/tests/update_record_persistent - -%dir %{_datadir}/ctdb/tests -%dir %{_datadir}/ctdb/tests/CLUSTER -%dir %{_datadir}/ctdb/tests/CLUSTER/complex -%{_datadir}/ctdb/tests/CLUSTER/complex/11_ctdb_delip_removes_ip.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/18_ctdb_reloadips.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/30_nfs_tickle_killtcp.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/31_nfs_tickle.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/32_cifs_tickle.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/33_gratuitous_arp.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/34_nfs_tickle_restart.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/36_smb_reset_server.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/37_nfs_reset_server.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/41_failover_ping_discrete.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/42_failover_ssh_hostname.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/43_failover_nfs_basic.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/44_failover_nfs_oneway.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/45_failover_nfs_kill.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/60_rogueip_releaseip.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/61_rogueip_takeip.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/README - -%dir %{_datadir}/ctdb/tests/CLUSTER/complex/scripts -%{_datadir}/ctdb/tests/CLUSTER/complex/scripts/local.bash - -%dir %{_datadir}/ctdb/tests/etc-ctdb -%dir %{_datadir}/ctdb/tests/etc-ctdb/events -%dir %{_datadir}/ctdb/tests/etc-ctdb/events/legacy -%{_datadir}/ctdb/tests/etc-ctdb/events/legacy/00.test.script -%dir %{_datadir}/ctdb/tests/INTEGRATION -%dir %{_datadir}/ctdb/tests/INTEGRATION/database -%{_datadir}/ctdb/tests/INTEGRATION/database/basics.001.attach.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/basics.002.attach.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/basics.003.detach.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/basics.004.wipe.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/basics.010.backup_restore.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/fetch.001.ring.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/fetch.002.ring-hotkeys.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/readonly.001.basic.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/recovery.001.volatile.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/recovery.002.large.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/recovery.003.no_resurrect.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/recovery.010.persistent.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/recovery.011.continue.sh -%dir %{_datadir}/ctdb/tests/INTEGRATION/database/scripts -%{_datadir}/ctdb/tests/INTEGRATION/database/scripts/local.bash -%{_datadir}/ctdb/tests/INTEGRATION/database/transaction.001.ptrans.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/transaction.002.loop.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/transaction.003.loop_recovery.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/transaction.004.update_record.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/transaction.010.loop_recovery.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/traverse.001.one.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/traverse.002.many.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/vacuum.001.fast.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/vacuum.002.full.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/vacuum.003.recreate.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/vacuum.030.locked.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/vacuum.031.locked.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/vacuum.032.locked.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/vacuum.033.locked.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/vacuum.034.locked.sh -%dir %{_datadir}/ctdb/tests/INTEGRATION/failover -%{_datadir}/ctdb/tests/INTEGRATION/failover/pubips.001.list.sh -%{_datadir}/ctdb/tests/INTEGRATION/failover/pubips.010.addip.sh -%{_datadir}/ctdb/tests/INTEGRATION/failover/pubips.011.delip.sh -%{_datadir}/ctdb/tests/INTEGRATION/failover/pubips.012.reloadips.sh -%{_datadir}/ctdb/tests/INTEGRATION/failover/pubips.013.failover_noop.sh -%{_datadir}/ctdb/tests/INTEGRATION/failover/pubips.014.iface_gc.sh -%{_datadir}/ctdb/tests/INTEGRATION/failover/pubips.020.moveip.sh -%{_datadir}/ctdb/tests/INTEGRATION/failover/pubips.030.disable_enable.sh -%{_datadir}/ctdb/tests/INTEGRATION/failover/pubips.032.stop_continue.sh -%{_datadir}/ctdb/tests/INTEGRATION/failover/pubips.040.NoIPTakeover.sh -%{_datadir}/ctdb/tests/INTEGRATION/failover/pubips.050.missing_ip.sh -%dir %{_datadir}/ctdb/tests/INTEGRATION/simple -%{_datadir}/ctdb/tests/INTEGRATION/simple/basics.000.onnode.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/basics.001.listnodes.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/basics.002.tunables.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/basics.003.ping.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/basics.004.getpid.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/basics.005.process_exists.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/basics.010.statistics.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/basics.011.statistics_reset.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.001.stop_leader_yield.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.002.ban_leader_yield.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.003.capability_leader_yield.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.006.stop_leader_yield_no_lock.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.007.ban_leader_yield_no_lock.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.008.capability_leader_yield_no_lock.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.010.getrelock.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.012.reclock_command.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.015.reclock_remove_lock.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.016.reclock_move_lock_dir.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.020.message_ring.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.021.tunnel_ring.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.030.node_stall_leader_timeout.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.090.unreachable.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.091.version_check.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/debug.001.getdebug.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/debug.002.setdebug.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/debug.003.dumpmemory.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/eventscripts.001.zero_scripts.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/eventscripts.090.debug_hung.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/README -%dir %{_datadir}/ctdb/tests/scripts -%{_datadir}/ctdb/tests/scripts/cluster.bash -%{_datadir}/ctdb/tests/scripts/common.sh -%{_datadir}/ctdb/tests/scripts/integration.bash -%{_datadir}/ctdb/tests/scripts/integration_local_daemons.bash -%{_datadir}/ctdb/tests/scripts/integration_real_cluster.bash -%{_datadir}/ctdb/tests/scripts/script_install_paths.sh -%{_datadir}/ctdb/tests/scripts/test_wrap -%{_datadir}/ctdb/tests/scripts/unit.sh -%dir %{_datadir}/ctdb/tests/UNIT -%dir %{_datadir}/ctdb/tests/UNIT/cunit -%{_datadir}/ctdb/tests/UNIT/cunit/cluster_mutex_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/cluster_mutex_002.sh -%{_datadir}/ctdb/tests/UNIT/cunit/cluster_mutex_003.sh -%{_datadir}/ctdb/tests/UNIT/cunit/cmdline_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/comm_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/comm_test_002.sh -%{_datadir}/ctdb/tests/UNIT/cunit/conf_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/config_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/config_test_002.sh -%{_datadir}/ctdb/tests/UNIT/cunit/config_test_003.sh -%{_datadir}/ctdb/tests/UNIT/cunit/config_test_004.sh -%{_datadir}/ctdb/tests/UNIT/cunit/config_test_005.sh -%{_datadir}/ctdb/tests/UNIT/cunit/config_test_006.sh -%{_datadir}/ctdb/tests/UNIT/cunit/config_test_007.sh -%{_datadir}/ctdb/tests/UNIT/cunit/ctdb_io_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/db_hash_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/event_protocol_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/event_script_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/hash_count_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/line_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/path_tests_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/pidfile_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/pkt_read_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/pkt_write_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/porting_tests_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/protocol_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/protocol_test_002.sh -%{_datadir}/ctdb/tests/UNIT/cunit/protocol_test_012.sh -%{_datadir}/ctdb/tests/UNIT/cunit/protocol_test_101.sh -%{_datadir}/ctdb/tests/UNIT/cunit/protocol_test_111.sh -%{_datadir}/ctdb/tests/UNIT/cunit/protocol_test_201.sh -%{_datadir}/ctdb/tests/UNIT/cunit/rb_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/reqid_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/run_event_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/run_proc_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/sock_daemon_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/sock_io_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/srvid_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/system_socket_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/system_socket_test_002.sh -%{_datadir}/ctdb/tests/UNIT/cunit/system_socket_test_003.sh -%{_datadir}/ctdb/tests/UNIT/cunit/tmon_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/tmon_test_002.sh -%{_datadir}/ctdb/tests/UNIT/cunit/tunable_test_001.sh -%dir %{_datadir}/ctdb/tests/UNIT/eventd -%dir %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/ctdb.conf -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/debug-script.sh -%dir %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events -%dir %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/data -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/data/03.notalink.script -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/data/README -%dir %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/empty -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/empty/README -%dir %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/multi -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/multi/01.test.script -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/multi/02.test.script -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/multi/03.test.script -%dir %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/random -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/random/01.disabled.script -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/random/02.enabled.script -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/random/a.script -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/random/README.script -%dir %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/share -%dir %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/share/events -%dir %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/share/events/data -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/share/events/data/01.dummy.script -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/share/events/data/02.disabled.script -%dir %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/share/events/empty -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/share/events/empty/README -%dir %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/share/events/random -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/share/events/random/01.disabled.script -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/share/events/random/02.enabled.script -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/share/events/random/a.script -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/share/events/random/README.script -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_001.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_002.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_003.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_004.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_005.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_006.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_007.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_008.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_009.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_011.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_012.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_013.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_014.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_021.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_022.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_023.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_024.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_031.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_032.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_033.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_041.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_042.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_043.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_044.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_051.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_052.sh -%{_datadir}/ctdb/tests/UNIT/eventd/README -%dir %{_datadir}/ctdb/tests/UNIT/eventd/scripts -%{_datadir}/ctdb/tests/UNIT/eventd/scripts/local.sh -%dir %{_datadir}/ctdb/tests/UNIT/eventscripts -%{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.init.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.init.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.init.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.init.004.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.init.005.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.init.006.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.init.007.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.init.008.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.init.009.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/01.reclock.init.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/01.reclock.init.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/01.reclock.init.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.004.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.005.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.006.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.007.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.011.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.012.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.014.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.015.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.017.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.018.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/06.nfs.releaseip.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/06.nfs.releaseip.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/06.nfs.takeip.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/06.nfs.takeip.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.010.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.011.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.012.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.013.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.init.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.init.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.init.021.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.init.022.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.init.023.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.004.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.005.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.006.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.009.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.010.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.011.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.012.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.013.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.014.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.015.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.016.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.017.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.018.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.multi.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.releaseip.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.releaseip.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.startup.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.startup.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.takeip.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.takeip.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.takeip.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.004.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.011.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.012.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.013.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.014.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.015.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.021.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.022.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.023.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.024.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.025.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.031.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.041.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.042.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.051.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.052.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.053.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.054.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.004.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.005.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.006.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.007.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.008.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.009.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.010.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.011.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.012.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.013.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.014.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.015.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.016.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.017.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.018.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.019.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.021.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.022.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.023.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.024.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/20.multipathd.monitor.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/20.multipathd.monitor.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/20.multipathd.monitor.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/20.multipathd.monitor.004.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/31.clamd.monitor.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/31.clamd.monitor.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/40.vsftpd.monitor.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/40.vsftpd.shutdown.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/40.vsftpd.startup.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/41.httpd.monitor.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/41.httpd.shutdown.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/41.httpd.startup.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/48.netbios.shutdown.011.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/48.netbios.startup.011.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/49.winbind.monitor.101.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/49.winbind.monitor.102.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/49.winbind.shutdown.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/49.winbind.startup.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.monitor.101.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.monitor.103.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.monitor.104.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.monitor.105.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.monitor.106.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.monitor.110.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.monitor.111.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.monitor.112.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.monitor.113.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.shutdown.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.shutdown.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.shutdown.011.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.startup.011.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.101.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.102.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.103.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.104.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.105.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.106.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.107.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.108.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.109.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.111.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.112.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.113.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.114.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.121.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.122.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.131.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.132.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.141.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.142.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.143.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.144.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.151.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.152.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.153.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.161.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.162.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.multi.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.multi.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.releaseip.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.releaseip.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.shutdown.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.shutdown.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.startup.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.startup.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.takeip.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.takeip.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.ipreallocated.011.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.ipreallocated.012.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.ipreallocated.013.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.ipreallocated.014.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.monitor.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.monitor.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.monitor.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.shutdown.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.shutdown.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.startup.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.startup.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.004.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.005.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.006.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.007.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.008.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.021.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.022.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.023.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.024.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.025.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.026.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.027.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.028.sh -%dir %{_datadir}/ctdb/tests/UNIT/eventscripts/etc -%dir %{_datadir}/ctdb/tests/UNIT/eventscripts/etc-ctdb -%{_datadir}/ctdb/tests/UNIT/eventscripts/etc-ctdb/public_addresses -%{_datadir}/ctdb/tests/UNIT/eventscripts/etc-ctdb/rc.local -%dir %{_datadir}/ctdb/tests/UNIT/eventscripts/etc/init.d -%{_datadir}/ctdb/tests/UNIT/eventscripts/etc/init.d/nfs -%{_datadir}/ctdb/tests/UNIT/eventscripts/etc/init.d/nfslock -%dir %{_datadir}/ctdb/tests/UNIT/eventscripts/etc/samba -%{_datadir}/ctdb/tests/UNIT/eventscripts/etc/samba/smb.conf -%dir %{_datadir}/ctdb/tests/UNIT/eventscripts/etc/sysconfig -%{_datadir}/ctdb/tests/UNIT/eventscripts/etc/sysconfig/nfs -%{_datadir}/ctdb/tests/UNIT/eventscripts/README -%dir %{_datadir}/ctdb/tests/UNIT/eventscripts/scripts -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/00.ctdb.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/01.reclock.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/05.system.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/06.nfs.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/10.interface.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/11.natgw.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/13.per_ip_routing.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/20.multipathd.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/31.clamd.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/40.vsftpd.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/41.httpd.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/48.netbios.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/49.winbind.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/50.samba.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/60.nfs.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/91.lvs.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/debug_locks.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/local.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/statd-callout.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/statd-callout.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/statd-callout.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/statd-callout.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/statd-callout.004.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/statd-callout.005.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/statd-callout.006.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/statd-callout.007.sh -%dir %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ctdb -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ctdb-config -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ctdb_killtcp -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ctdb_lvs -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ctdb_natgw -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/date -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/df -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ethtool -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/exportfs -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/gstack -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/id -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ip -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ip6tables -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/iptables -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ipvsadm -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/kill -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/killall -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/multipath -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/net -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/nfs-fake-callout -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/nfsconf -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/pidof -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/pkill -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ps -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/rm -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/rpc.lockd -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/rpc.mountd -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/rpc.rquotad -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/rpc.statd -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/rpcinfo -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/service -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/sleep -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/smnotify -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ss -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/stat -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/tdb_mutex_check -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/tdbdump -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/tdbtool -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/testparm -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/timeout -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/wbinfo -%dir %{_datadir}/ctdb/tests/UNIT/onnode -%{_datadir}/ctdb/tests/UNIT/onnode/0001.sh -%{_datadir}/ctdb/tests/UNIT/onnode/0002.sh -%{_datadir}/ctdb/tests/UNIT/onnode/0003.sh -%{_datadir}/ctdb/tests/UNIT/onnode/0004.sh -%{_datadir}/ctdb/tests/UNIT/onnode/0005.sh -%{_datadir}/ctdb/tests/UNIT/onnode/0006.sh -%{_datadir}/ctdb/tests/UNIT/onnode/0010.sh -%{_datadir}/ctdb/tests/UNIT/onnode/0011.sh -%{_datadir}/ctdb/tests/UNIT/onnode/0070.sh -%{_datadir}/ctdb/tests/UNIT/onnode/0071.sh -%{_datadir}/ctdb/tests/UNIT/onnode/0072.sh -%{_datadir}/ctdb/tests/UNIT/onnode/0075.sh -%dir %{_datadir}/ctdb/tests/UNIT/onnode/etc-ctdb -%{_datadir}/ctdb/tests/UNIT/onnode/etc-ctdb/nodes -%dir %{_datadir}/ctdb/tests/UNIT/onnode/scripts -%{_datadir}/ctdb/tests/UNIT/onnode/scripts/local.sh -%dir %{_datadir}/ctdb/tests/UNIT/onnode/stubs -%{_datadir}/ctdb/tests/UNIT/onnode/stubs/ctdb -%{_datadir}/ctdb/tests/UNIT/onnode/stubs/ssh -%dir %{_datadir}/ctdb/tests/UNIT/shellcheck -%{_datadir}/ctdb/tests/UNIT/shellcheck/base_scripts.sh -%{_datadir}/ctdb/tests/UNIT/shellcheck/ctdb_helpers.sh -%{_datadir}/ctdb/tests/UNIT/shellcheck/event_scripts.sh -%{_datadir}/ctdb/tests/UNIT/shellcheck/functions.sh -%{_datadir}/ctdb/tests/UNIT/shellcheck/init_script.sh -%dir %{_datadir}/ctdb/tests/UNIT/shellcheck/scripts -%{_datadir}/ctdb/tests/UNIT/shellcheck/scripts/local.sh -%{_datadir}/ctdb/tests/UNIT/shellcheck/tests.sh -%{_datadir}/ctdb/tests/UNIT/shellcheck/tools.sh -%dir %{_datadir}/ctdb/tests/UNIT/takeover -%{_datadir}/ctdb/tests/UNIT/takeover/det.001.sh -%{_datadir}/ctdb/tests/UNIT/takeover/det.002.sh -%{_datadir}/ctdb/tests/UNIT/takeover/det.003.sh -%dir %{_datadir}/ctdb/tests/UNIT/takeover_helper -%{_datadir}/ctdb/tests/UNIT/takeover_helper/000.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/010.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/011.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/012.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/013.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/014.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/016.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/017.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/018.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/019.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/021.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/022.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/023.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/024.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/025.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/026.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/027.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/028.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/030.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/031.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/110.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/111.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/120.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/121.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/122.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/130.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/131.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/132.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/140.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/150.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/160.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/210.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/211.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/220.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/230.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/240.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/250.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/260.sh -%dir %{_datadir}/ctdb/tests/UNIT/takeover_helper/scripts -%{_datadir}/ctdb/tests/UNIT/takeover_helper/scripts/local.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.001.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.002.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.003.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.004.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.005.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.006.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.007.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.008.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.009.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.010.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.011.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.012.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.013.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.014.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.015.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.016.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.024.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.025.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.027.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.028.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.029.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.030.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.031.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.032.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.033.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.034.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.035.sh -%{_datadir}/ctdb/tests/UNIT/takeover/nondet.001.sh -%{_datadir}/ctdb/tests/UNIT/takeover/nondet.002.sh -%{_datadir}/ctdb/tests/UNIT/takeover/nondet.003.sh -%{_datadir}/ctdb/tests/UNIT/takeover/README -%dir %{_datadir}/ctdb/tests/UNIT/takeover/scripts -%{_datadir}/ctdb/tests/UNIT/takeover/scripts/local.sh -%dir %{_datadir}/ctdb/tests/UNIT/tool -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.attach.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.attach.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.attach.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ban.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ban.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ban.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.catdb.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.catdb.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.cattdb.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.cattdb.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.continue.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.continue.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.continue.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.deletekey.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.disable.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.disable.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.disable.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.disable.004.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.enable.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.enable.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.enable.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getcapabilities.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getcapabilities.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getcapabilities.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getcapabilities.004.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getdbmap.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getdbseqnum.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getdbseqnum.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getdbstatus.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getdbstatus.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getpid.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getpid.010.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getreclock.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getreclock.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getvar.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getvar.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ifaces.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ip.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ip.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ip.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ip.004.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ip.005.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ip.006.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ip.007.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ipinfo.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ipinfo.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ipinfo.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.leader.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.leader.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.listnodes.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.listnodes.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.listvars.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.lvs.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.lvs.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.lvs.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.lvs.004.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.lvs.005.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.lvs.006.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.lvs.007.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.lvs.008.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.lvs.010.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.natgw.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.natgw.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.natgw.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.natgw.004.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.natgw.005.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.natgw.006.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.natgw.007.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.natgw.008.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.natgw.010.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.nodestatus.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.nodestatus.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.nodestatus.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.nodestatus.004.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.nodestatus.005.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.nodestatus.006.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.nodestatus.007.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.pdelete.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ping.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.pnn.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.process-exists.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.process-exists.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.process-exists.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.pstore.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ptrans.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.readkey.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.recover.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.011.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.012.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.013.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.014.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.015.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.016.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.017.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.018.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.019.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.020.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.021.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.023.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.024.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.runstate.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.runstate.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.runstate.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.runstate.004.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.runstate.005.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdbreadonly.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdbreadonly.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdbreadonly.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdbreadonly.004.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdbreadonly.005.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdbsticky.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdbsticky.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdbsticky.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdbsticky.004.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdbsticky.005.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdebug.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdebug.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdebug.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setifacelink.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setifacelink.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setvar.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setvar.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.status.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.status.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.status.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.stop.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.stop.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.stop.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.unban.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.unban.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.unban.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.uptime.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.writekey.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/README -%dir %{_datadir}/ctdb/tests/UNIT/tool/scripts -%{_datadir}/ctdb/tests/UNIT/tool/scripts/local.sh -#endif with selftest -%endif - %if %{with pcp_pmda} %files -n ctdb-pcp-pmda %dir %{_localstatedir}/lib/pcp/pmdas/ctdb @@ -4846,6 +3990,8 @@ fi %{_libdir}/samba/libpyldb-util.cpython-*-private-samba.so %{python3_sitearch}/_ldb_text.py %{python3_sitearch}/__pycache__/_ldb_text.cpython-*.py* +#endif !with testsuite +%endif %changelog %autochangelog From b0f6e67bbc2238f365056aa0f264c437c4e07159 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 27 Nov 2024 17:50:17 +0100 Subject: [PATCH 353/425] Add missing SAMBA_DCERPCD_DONT_LOG_STDOUT=1 for the testsuite [skip changelog] --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index 039caad..c45bb11 100644 --- a/samba.spec +++ b/samba.spec @@ -1625,6 +1625,7 @@ export TDB_NO_FSYNC=1 export NMBD_DONT_LOG_STDOUT=1 export SMBD_DONT_LOG_STDOUT=1 export WINBINDD_DONT_LOG_STDOUT=1 +export SAMBA_DCERPCD_DONT_LOG_STDOUT=1 %{__make} %{?_smp_mflags} test FAIL_IMMEDIATELY=1 #endif with testsuite %endif From 6b05011701d1266df1099baf1daa6dd2c0d44f45 Mon Sep 17 00:00:00 2001 From: Pete Walter Date: Sun, 8 Dec 2024 22:44:21 +0000 Subject: [PATCH 354/425] Rebuild for ICU 76 From d70953a5edf7f4ccc6b9be7958d739e30f8f861c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 7 Jan 2025 10:42:42 +0100 Subject: [PATCH 355/425] Update to version 4.21.3 - resolves: rhbz#2335911 --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index c45bb11..b956d6d 100644 --- a/samba.spec +++ b/samba.spec @@ -148,7 +148,7 @@ %bcond lmdb 0 %endif -%global samba_version 4.21.2 +%global samba_version 4.21.3 # The release field is extended: # [.][.]%%{?dist}[.] diff --git a/sources b/sources index 285808c..1055c45 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.21.2.tar.xz) = c26311a60d3994561aa12c36e54bc37d1161ec1063aa9876ea03dee24984e9c827e5836dc86bc392e37193010275a642b960e775b5a9e029246ba56ae1697682 -SHA512 (samba-4.21.2.tar.asc) = f3da123d2e86a7e07c4fcb83924edd29195d865091d80125f3531c463662a8a38ba6d8c467932af8cd065d0cc4467131c83a4e3783573b757f6ed9c2bde0befc +SHA512 (samba-4.21.3.tar.xz) = 62eb3bfe1aa1cc8aa68055d4caf21bdea6d6f5b0f767566bef1da210100b5dd17b7d60f5c47da01b0123d3a2c1c3689b1960ef2c2cbd4f804ff998ead994fc3f +SHA512 (samba-4.21.3.tar.asc) = 11e40d32b783b7d57d3f35fe96a17e897719f65d796d965b371dfb58b8cf1f8ffe60c3047bea8c2b2b0d475fa55cd25237b9ba84d44b3d65a8cd53c6af760957 From a7c8b51b0f13bd381d5cab73a48f9583d6b5ae56 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 7 Jan 2025 13:27:35 +0100 Subject: [PATCH 356/425] Use upstream Patch instead of python3-crypt-r --- samba-4-21-pycrypt.patch | 853 +++++++++++++++++++++++++++++++++++++++ samba.spec | 5 +- 2 files changed, 855 insertions(+), 3 deletions(-) create mode 100644 samba-4-21-pycrypt.patch diff --git a/samba-4-21-pycrypt.patch b/samba-4-21-pycrypt.patch new file mode 100644 index 0000000..8c197fc --- /dev/null +++ b/samba-4-21-pycrypt.patch @@ -0,0 +1,853 @@ +From 93bc860e8f344a96d0496edbc5d463f2c5411fcd Mon Sep 17 00:00:00 2001 +From: Douglas Bagnall +Date: Thu, 5 Dec 2024 16:35:51 +1300 +Subject: [PATCH 01/10] util: add a crypt wrapper, derived from + dsdb:password_hash + +This is going to be used by the dsdb password_hash module, and exposed +to Python via pyglue. + +We're doing this because Python 3.13 has dropped crypt from the Python +standard library. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 + +Reviewed-by: Andreas Schneider +--- + lib/util/util_crypt.c | 90 ++++++++++++++++++++++++++++++++++++++++++ + lib/util/util_crypt.h | 5 +++ + lib/util/wscript_build | 6 +++ + 3 files changed, 101 insertions(+) + create mode 100644 lib/util/util_crypt.c + create mode 100644 lib/util/util_crypt.h + +diff --git a/lib/util/util_crypt.c b/lib/util/util_crypt.c +new file mode 100644 +index 00000000000..0f7b2d0fd31 +--- /dev/null ++++ b/lib/util/util_crypt.c +@@ -0,0 +1,90 @@ ++#include ++#include "data_blob.h" ++#include ++#include ++#include "util_crypt.h" ++ ++ ++static int crypt_as_best_we_can(const char *phrase, ++ const char *setting, ++ const char **hashp) ++{ ++ int ret = 0; ++ const char *hash = NULL; ++ ++#if defined(HAVE_CRYPT_R) || defined(HAVE_CRYPT_RN) ++ struct crypt_data crypt_data = { ++ .initialized = 0 /* working storage used by crypt */ ++ }; ++#endif ++ ++ /* ++ * crypt_r() and crypt() may return a null pointer upon error ++ * depending on how libcrypt was configured, so we prefer ++ * crypt_rn() from libcrypt / libxcrypt which always returns ++ * NULL on error. ++ * ++ * POSIX specifies returning a null pointer and setting ++ * errno. ++ * ++ * RHEL 7 (which does not use libcrypt / libxcrypt) returns a ++ * non-NULL pointer from crypt_r() on success but (always?) ++ * sets errno during internal processing in the NSS crypto ++ * subsystem. ++ * ++ * By preferring crypt_rn we avoid the 'return non-NULL but ++ * set-errno' that we otherwise cannot tell apart from the ++ * RHEL 7 behaviour. ++ */ ++ errno = 0; ++ ++#ifdef HAVE_CRYPT_RN ++ hash = crypt_rn(phrase, setting, ++ &crypt_data, ++ sizeof(crypt_data)); ++#elif HAVE_CRYPT_R ++ hash = crypt_r(phrase, setting, &crypt_data); ++#else ++ /* ++ * No crypt_r falling back to crypt, which is NOT thread safe ++ * Thread safety MT-Unsafe race:crypt ++ */ ++ hash = crypt(phrase, setting); ++#endif ++ /* ++ * On error, crypt() and crypt_r() may return a null pointer, ++ * or a pointer to an invalid hash beginning with a '*'. ++ */ ++ ret = errno; ++ errno = 0; ++ if (hash == NULL || hash[0] == '*') { ++ if (ret == 0) { ++ /* this is annoying */ ++ ret = ENOTRECOVERABLE; ++ } ++ } ++ ++ *hashp = hash; ++ return ret; ++} ++ ++ ++int talloc_crypt_blob(TALLOC_CTX *mem_ctx, ++ const char *phrase, ++ const char *setting, ++ DATA_BLOB *blob) ++{ ++ const char *hash = NULL; ++ int ret = crypt_as_best_we_can(phrase, setting, &hash); ++ if (ret != 0) { ++ blob->data = NULL; ++ blob->length = 0; ++ return ret; ++ } ++ blob->length = strlen(hash); ++ blob->data = talloc_memdup(mem_ctx, hash, blob->length); ++ if (blob->data == NULL) { ++ return ENOMEM; ++ } ++ return 0; ++} +diff --git a/lib/util/util_crypt.h b/lib/util/util_crypt.h +new file mode 100644 +index 00000000000..8c289e489e8 +--- /dev/null ++++ b/lib/util/util_crypt.h +@@ -0,0 +1,5 @@ ++ ++int talloc_crypt_blob(TALLOC_CTX *mem_ctx, ++ const char *phrase, ++ const char *cmd, ++ DATA_BLOB *blob); +diff --git a/lib/util/wscript_build b/lib/util/wscript_build +index b4fcfeaba07..7de9c0b7b17 100644 +--- a/lib/util/wscript_build ++++ b/lib/util/wscript_build +@@ -253,6 +253,12 @@ else: + private_library=True, + local_include=False) + ++ bld.SAMBA_LIBRARY('util_crypt', ++ source='util_crypt.c', ++ deps='talloc crypt', ++ private_library=True, ++ local_include=False) ++ + + bld.SAMBA_SUBSYSTEM('UNIX_PRIVS', + source='unix_privs.c', +-- +2.34.1 + + +From c8c1de1ac3b715e76cb987525197209e453cdd50 Mon Sep 17 00:00:00 2001 +From: Douglas Bagnall +Date: Wed, 11 Dec 2024 14:29:21 +1300 +Subject: [PATCH 02/10] dsdb:password_hash: move hash_blob allocation up + +This will make the next patch simpler. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 + +Signed-off-by: Douglas Bagnall +Reviewed-by: Andreas Schneider +--- + source4/dsdb/samdb/ldb_modules/password_hash.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c +index 1d1267624e2..c1902126a72 100644 +--- a/source4/dsdb/samdb/ldb_modules/password_hash.c ++++ b/source4/dsdb/samdb/ldb_modules/password_hash.c +@@ -1649,6 +1649,13 @@ static int setup_primary_userPassword_hash( + } + } + ++ hash_blob = talloc_zero(ctx, DATA_BLOB); ++ ++ if (hash_blob == NULL) { ++ TALLOC_FREE(frame); ++ return ldb_oom(ldb); ++ } ++ + /* + * Relies on the assertion that cleartext_utf8->data is a zero + * terminated UTF-8 string +@@ -1712,15 +1719,10 @@ static int setup_primary_userPassword_hash( + scheme, + reason); + TALLOC_FREE(frame); ++ TALLOC_FREE(hash_blob); + return LDB_ERR_OPERATIONS_ERROR; + } + +- hash_blob = talloc_zero(ctx, DATA_BLOB); +- +- if (hash_blob == NULL) { +- TALLOC_FREE(frame); +- return ldb_oom(ldb); +- } + + *hash_blob = data_blob_talloc(hash_blob, + (const uint8_t *)hash, +-- +2.34.1 + + +From ac5008598e4a4d3dbf5d58f4b4a2c6fc25195775 Mon Sep 17 00:00:00 2001 +From: Douglas Bagnall +Date: Thu, 12 Dec 2024 11:16:22 +1300 +Subject: [PATCH 03/10] dsdb:password_hash: use talloc_crypt_blob() + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 + +Signed-off-by: Douglas Bagnall +Reviewed-by: Andreas Schneider +--- + .../dsdb/samdb/ldb_modules/password_hash.c | 68 ++++--------------- + .../samdb/ldb_modules/wscript_build_server | 2 +- + 2 files changed, 13 insertions(+), 57 deletions(-) + +diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c +index c1902126a72..7a7114c1caa 100644 +--- a/source4/dsdb/samdb/ldb_modules/password_hash.c ++++ b/source4/dsdb/samdb/ldb_modules/password_hash.c +@@ -51,6 +51,7 @@ + #include "auth/common_auth.h" + #include "lib/messaging/messaging.h" + #include "lib/param/loadparm.h" ++#include "lib/util/util_crypt.h" + + #include "lib/crypto/gnutls_helpers.h" + #include +@@ -1592,16 +1593,11 @@ static int setup_primary_userPassword_hash( + struct ldb_context *ldb = ldb_module_get_ctx(io->ac->module); + const char *salt = NULL; /* Randomly generated salt */ + const char *cmd = NULL; /* command passed to crypt */ +- const char *hash = NULL; /* password hash generated by crypt */ + int algorithm = 0; /* crypt hash algorithm number */ + int rounds = 0; /* The number of hash rounds */ ++ int ret; + DATA_BLOB *hash_blob = NULL; + TALLOC_CTX *frame = talloc_stackframe(); +-#if defined(HAVE_CRYPT_R) || defined(HAVE_CRYPT_RN) +- struct crypt_data crypt_data = { +- .initialized = 0 /* working storage used by crypt */ +- }; +-#endif + + /* Generate a random password salt */ + salt = generate_random_str_list(frame, +@@ -1660,52 +1656,20 @@ static int setup_primary_userPassword_hash( + * Relies on the assertion that cleartext_utf8->data is a zero + * terminated UTF-8 string + */ +- +- /* +- * crypt_r() and crypt() may return a null pointer upon error +- * depending on how libcrypt was configured, so we prefer +- * crypt_rn() from libcrypt / libxcrypt which always returns +- * NULL on error. +- * +- * POSIX specifies returning a null pointer and setting +- * errno. +- * +- * RHEL 7 (which does not use libcrypt / libxcrypt) returns a +- * non-NULL pointer from crypt_r() on success but (always?) +- * sets errno during internal processing in the NSS crypto +- * subsystem. +- * +- * By preferring crypt_rn we avoid the 'return non-NULL but +- * set-errno' that we otherwise cannot tell apart from the +- * RHEL 7 behaviour. +- */ +- errno = 0; +- +-#ifdef HAVE_CRYPT_RN +- hash = crypt_rn((char *)io->n.cleartext_utf8->data, +- cmd, +- &crypt_data, +- sizeof(crypt_data)); +-#elif HAVE_CRYPT_R +- hash = crypt_r((char *)io->n.cleartext_utf8->data, cmd, &crypt_data); +-#else +- /* +- * No crypt_r falling back to crypt, which is NOT thread safe +- * Thread safety MT-Unsafe race:crypt +- */ +- hash = crypt((char *)io->n.cleartext_utf8->data, cmd); +-#endif +- /* +- * On error, crypt() and crypt_r() may return a null pointer, +- * or a pointer to an invalid hash beginning with a '*'. +- */ +- if (hash == NULL || hash[0] == '*') { ++ ret = talloc_crypt_blob(hash_blob, ++ (char *)io->n.cleartext_utf8->data, ++ cmd, ++ hash_blob); ++ if (ret != 0) { + char buf[1024]; + const char *reason = NULL; +- if (errno == ERANGE) { ++ if (ret == ERANGE) { + reason = "Password exceeds maximum length allowed for crypt() hashing"; ++ } else if (ret == ENOTRECOVERABLE) { ++ /* probably weird RHEL7 crypt, see talloc_crypt_blob() */ ++ reason = "Unknown error"; + } else { +- int err = strerror_r(errno, buf, sizeof(buf)); ++ int err = strerror_r(ret, buf, sizeof(buf)); + if (err == 0) { + reason = buf; + } else { +@@ -1723,14 +1687,6 @@ static int setup_primary_userPassword_hash( + return LDB_ERR_OPERATIONS_ERROR; + } + +- +- *hash_blob = data_blob_talloc(hash_blob, +- (const uint8_t *)hash, +- strlen(hash)); +- if (hash_blob->data == NULL) { +- TALLOC_FREE(frame); +- return ldb_oom(ldb); +- } + hash_value->value = hash_blob; + TALLOC_FREE(frame); + return LDB_SUCCESS; +diff --git a/source4/dsdb/samdb/ldb_modules/wscript_build_server b/source4/dsdb/samdb/ldb_modules/wscript_build_server +index 9c1eb12a7c2..16d9b31a982 100644 +--- a/source4/dsdb/samdb/ldb_modules/wscript_build_server ++++ b/source4/dsdb/samdb/ldb_modules/wscript_build_server +@@ -195,7 +195,7 @@ bld.SAMBA_MODULE('ldb_password_hash', + init_function='ldb_password_hash_module_init', + module_init_name='ldb_init_module', + internal_module=False, +- deps='talloc samdb LIBCLI_AUTH NDR_DRSBLOBS authkrb5 krb5 gpgme DSDB_MODULE_HELPERS crypt db-glue' ++ deps='talloc samdb LIBCLI_AUTH NDR_DRSBLOBS authkrb5 krb5 gpgme DSDB_MODULE_HELPERS util_crypt db-glue' + ) + + +-- +2.34.1 + + +From 0f19a12e9f28dd78e5108eeb22950eff48202d97 Mon Sep 17 00:00:00 2001 +From: Douglas Bagnall +Date: Wed, 11 Dec 2024 14:30:04 +1300 +Subject: [PATCH 04/10] util: add a crypt strerror helper + +This will be used by Python also. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 + +Signed-off-by: Douglas Bagnall +Reviewed-by: Andreas Schneider +--- + lib/util/util_crypt.c | 24 +++++++++++++++++++ + lib/util/util_crypt.h | 2 ++ + .../dsdb/samdb/ldb_modules/password_hash.c | 16 +------------ + 3 files changed, 27 insertions(+), 15 deletions(-) + +diff --git a/lib/util/util_crypt.c b/lib/util/util_crypt.c +index 0f7b2d0fd31..09cd47597d1 100644 +--- a/lib/util/util_crypt.c ++++ b/lib/util/util_crypt.c +@@ -88,3 +88,27 @@ int talloc_crypt_blob(TALLOC_CTX *mem_ctx, + } + return 0; + } ++ ++ ++char *talloc_crypt_errstring(TALLOC_CTX *mem_ctx, int error) ++{ ++ char buf[1024]; ++ int err; ++ if (error == ERANGE) { ++ return talloc_strdup( ++ mem_ctx, ++ "Password exceeds maximum length allowed for crypt() hashing"); ++ } ++ if (error == ENOTRECOVERABLE) { ++ /* probably weird RHEL7 crypt, see crypt_as_best_we_can() */ ++ goto unknown; ++ } ++ ++ err = strerror_r(error, buf, sizeof(buf)); ++ if (err != 0) { ++ goto unknown; ++ } ++ return talloc_strndup(mem_ctx, buf, sizeof(buf)); ++unknown: ++ return talloc_strdup(mem_ctx, "Unknown error"); ++} +diff --git a/lib/util/util_crypt.h b/lib/util/util_crypt.h +index 8c289e489e8..ca1a58e922c 100644 +--- a/lib/util/util_crypt.h ++++ b/lib/util/util_crypt.h +@@ -3,3 +3,5 @@ int talloc_crypt_blob(TALLOC_CTX *mem_ctx, + const char *phrase, + const char *cmd, + DATA_BLOB *blob); ++ ++char *talloc_crypt_errstring(TALLOC_CTX *mem_ctx, int error); +diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c +index 7a7114c1caa..6949a92fc3e 100644 +--- a/source4/dsdb/samdb/ldb_modules/password_hash.c ++++ b/source4/dsdb/samdb/ldb_modules/password_hash.c +@@ -1661,21 +1661,7 @@ static int setup_primary_userPassword_hash( + cmd, + hash_blob); + if (ret != 0) { +- char buf[1024]; +- const char *reason = NULL; +- if (ret == ERANGE) { +- reason = "Password exceeds maximum length allowed for crypt() hashing"; +- } else if (ret == ENOTRECOVERABLE) { +- /* probably weird RHEL7 crypt, see talloc_crypt_blob() */ +- reason = "Unknown error"; +- } else { +- int err = strerror_r(ret, buf, sizeof(buf)); +- if (err == 0) { +- reason = buf; +- } else { +- reason = "Unknown error"; +- } +- } ++ const char *reason = talloc_crypt_errstring(frame, ret); + ldb_asprintf_errstring( + ldb, + "setup_primary_userPassword: generation of a %s " +-- +2.34.1 + + +From 354ea5b1e69e27bfdd2d0b5ae8157790ba1bb590 Mon Sep 17 00:00:00 2001 +From: Douglas Bagnall +Date: Wed, 11 Dec 2024 14:30:15 +1300 +Subject: [PATCH 05/10] pyglue: add crypt() function + +This wraps talloc_crypt_blob() from lib/util/util_crypt.c which in +turn wraps the system crypt[_r[n]]. + +We want this because the Python standard library crypt module is going +away. That one also wrapped the system crypt or crypt_r, so there +should be no change. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 + +Signed-off-by: Douglas Bagnall +Reviewed-by: Andreas Schneider +--- + python/pyglue.c | 41 +++++++++++++++++++++++++++++++++++++++++ + python/wscript | 1 + + 2 files changed, 42 insertions(+) + +diff --git a/python/pyglue.c b/python/pyglue.c +index 042bf9e14f3..fcccb849f5e 100644 +--- a/python/pyglue.c ++++ b/python/pyglue.c +@@ -18,6 +18,7 @@ + */ + + #include "lib/replace/system/python.h" ++#include "pyerrors.h" + #include "python/py3compat.h" + #include "includes.h" + #include "python/modules.h" +@@ -25,6 +26,7 @@ + #include "param/pyparam.h" + #include "lib/socket/netif.h" + #include "lib/util/debug.h" ++#include "lib/util/util_crypt.h" + #include "librpc/ndr/ndr_private.h" + #include "lib/cmdline/cmdline.h" + #include "lib/crypto/gkdi.h" +@@ -519,6 +521,42 @@ static PyObject *py_get_burnt_commandline(PyObject *self, PyObject *args) + return ret; + } + ++static PyObject *py_crypt(PyObject *self, PyObject *args) ++{ ++ PyObject *py_hash = NULL; ++ char *phrase = NULL; ++ char *setting = NULL; ++ TALLOC_CTX *frame = NULL; ++ int ret; ++ DATA_BLOB hash = {}; ++ ++ if (!PyArg_ParseTuple(args, "ss", &phrase, &setting)) { ++ TALLOC_FREE(frame); ++ return NULL; ++ } ++ frame = talloc_stackframe(); ++ ret = talloc_crypt_blob(frame, phrase, setting, &hash); ++ if (ret != 0) { ++ const char *errstr = talloc_crypt_errstring(frame, ret); ++ if (ret == EINVAL || ret == ERANGE || ret == ENOTRECOVERABLE) { ++ PyErr_Format(PyExc_ValueError, ++ "could not crypt(): %s", ++ errstr); ++ } else { ++ PyErr_Format(PyExc_OSError, ++ "could not crypt(): %s", ++ errstr); ++ } ++ TALLOC_FREE(frame); ++ return NULL; ++ } ++ ++ py_hash = PyUnicode_FromStringAndSize((char *)hash.data, hash.length); ++ TALLOC_FREE(frame); ++ return py_hash; ++} ++ ++ + static PyMethodDef py_misc_methods[] = { + { "generate_random_str", (PyCFunction)py_generate_random_str, METH_VARARGS, + "generate_random_str(len) -> string\n" +@@ -580,6 +618,9 @@ static PyMethodDef py_misc_methods[] = { + METH_NOARGS, "How many NDR internal tokens is too many for this build?" }, + { "get_burnt_commandline", (PyCFunction)py_get_burnt_commandline, + METH_VARARGS, "Return a redacted commandline to feed to setproctitle (None if no redaction required)" }, ++ { "crypt", (PyCFunction)py_crypt, ++ METH_VARARGS, ++ "encrypt as phrase, per crypt(3), as determined by setting." }, + {0} + }; + +diff --git a/python/wscript b/python/wscript +index 3e6439930e9..7c17e390dc7 100644 +--- a/python/wscript ++++ b/python/wscript +@@ -119,6 +119,7 @@ def build(bld): + ndr + cmdline + gkdi ++ util_crypt + %s + ''' % (pyparam_util, pytalloc_util), + realname='samba/_glue.so') +-- +2.34.1 + + +From fec10dfe574a8acef0646a666fd4ff54ef11adf6 Mon Sep 17 00:00:00 2001 +From: Douglas Bagnall +Date: Thu, 12 Dec 2024 10:44:07 +1300 +Subject: [PATCH 06/10] pytest: test that _glue.crypt works + +The test vectors were generated via Python 3.10 crypt module, which +directly wraps crypt(3), which in this case is from glibc 2.39-0ubuntu8.3. + +We mainly test the sha256 and sha512 vectors, which seems to be all we +use, and which are said to be widely supported. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 + +Signed-off-by: Douglas Bagnall +Reviewed-by: Andreas Schneider +--- + python/samba/tests/glue.py | 65 ++++++++++++++++++++++++++++++++++++++ + 1 file changed, 65 insertions(+) + +diff --git a/python/samba/tests/glue.py b/python/samba/tests/glue.py +index ac504b3f366..824f5ca0c81 100644 +--- a/python/samba/tests/glue.py ++++ b/python/samba/tests/glue.py +@@ -88,3 +88,68 @@ class GlueTests(samba.tests.TestCase): + self.assertEqual(_glue.strstr_m(string, '_'), '_string_num__one') + self.assertEqual(_glue.strstr_m(string, '__'), '__one') + self.assertEqual(_glue.strstr_m(string, 'ring'), 'ring_num__one') ++ ++ def test_crypt(self): ++ # We hopefully only use schemes 5 and 6 (sha256 and sha512), ++ # which are OK and also quite widely supported according to ++ # https://en.wikipedia.org/wiki/Crypt_(C) ++ for phrase, setting, expected in [ ++ ("a", "$5$aaaaaa", ++ "$5$aaaaaa$F4lxguL7mZR7TGlvukPTJIxoRhVmHMZs8ZdH8oDP0.6"), ++ # with scheme 5, 5000 rounds is default, so hash is the same as above ++ ('a', '$5$rounds=5000$aaaaaa', ++ '$5$rounds=5000$aaaaaa$F4lxguL7mZR7TGlvukPTJIxoRhVmHMZs8ZdH8oDP0.6'), ++ ('a', ++ '$5$rounds=4999$aaaaaa', ++ '$5$rounds=4999$aaaaaa$FiP70gtxOJUFLokUJvET06E7jbL6aNmF6Wtv2ddzjY8'), ++ ('a', '$5$aaaaab', ++ '$5$aaaaab$e9qR2F833/JyuMu.nkQc9kn184vBWLo0ODqnCe./mj0'), ++ ++ ('', '$5$aaaaaa', '$5$aaaaaa$5B4WTdWp5n/v/aNUw2N8RsEitqvlZJEaAKhH/pOkGg4'), ++ ++ ("a", "$6$aaaaaa", ++ "$6$aaaaaa$KHs/Ez7X/I5/K.V8FR7kEsx9rOvjXnEDUmGC.dLBWP87XWy.oUEAM7QYcZQRVhiDwGepOF2pKrCVETYLyASh60"), ++ ++ ('', '$5$', '$5$$3c2QQ0KjIU1OLtB29cl8Fplc2WN7X89bnoEjaR7tWu.'), ++ ++ # scheme 1 (md5) should be supported if not used ++ ('a', '$1$aaaaaa', ++ '$1$aaaaaa$MUMWPbGfzrHFCNm7ZHg31.'), ++ ++ ('', '$6$', ++ '$6$$/chiBau24cE26QQVW3IfIe68Xu5.JQ4E8Ie7lcRLwqxO5cxGuBhqF2HmTL.zWJ9zjChg3yJYFXeGBQ2y3Ba1d1'), ++ (' ', ++ '$6$6', ++ '$6$6$asLnbxf0obyuv3ybNvDE9ZcdwGFkDhLe7uW.wzdOdKCm4/M3vGFKq4Ttk1tBQrOn4wALZ3tj1L8IarIu5i8hR/'), ++ ++ # original DES scheme, 12 bits of salt ++ ("a", "lalala", "laKGbFzgh./R2"), ++ ("a", "lalalaLALALAla", "laKGbFzgh./R2"), ++ ("a", "arrgh", "ar7VUiUvDhX2c"), ++ ("a", "arrggghhh", "ar7VUiUvDhX2c"), ++ ]: ++ hash = _glue.crypt(phrase, setting) ++ self.assertEqual(hash, expected) ++ ++ def test_crypt_bad(self): ++ # We can't be too strident in our assertions, because every ++ # system allows a different set of algorithms, and some have ++ # different ideas of how to parse. ++ for phrase, setting, exception in [ ++ ("a", "$5", ValueError), ++ ("a", "$0$", ValueError), ++ ("a", None, TypeError), ++ (None, "", TypeError), ++ ('a', '$66$', ValueError), ++ ('a', '$$', ValueError), ++ ('a', '*0', ValueError), ++ ('a', '*', ValueError), ++ ('a', '++', ValueError), ++ # this next one is too long, except on Rocky Linux 8. ++ #('a' * 10000, '$5$5', ValueError), ++ # this is invalid, except on Debian 11. ++ # (' ', '$6$ ', ValueError), ++ ]: ++ with self.assertRaises(exception, ++ msg=f"crypt({phrase!r}, {setting!r}) didn't fail"): ++ _glue.crypt(phrase, setting) +-- +2.34.1 + + +From 7d1fa8cdc52423bd53de4314a62e2c2b2e0b2aa7 Mon Sep 17 00:00:00 2001 +From: Douglas Bagnall +Date: Wed, 11 Dec 2024 15:54:48 +1300 +Subject: [PATCH 07/10] samba-tool user: use _glue.crypt, not crypt.crypt + +Because we know we have _glue.crypt, and we know it raises exceptions +rather than returning None, we can simplify the checks. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 + +Signed-off-by: Douglas Bagnall +Reviewed-by: Andreas Schneider +--- + .../samba/netcmd/user/readpasswords/common.py | 21 ++++++------------- + 1 file changed, 6 insertions(+), 15 deletions(-) + +diff --git a/python/samba/netcmd/user/readpasswords/common.py b/python/samba/netcmd/user/readpasswords/common.py +index 7944d4e1682..68befb3f356 100644 +--- a/python/samba/netcmd/user/readpasswords/common.py ++++ b/python/samba/netcmd/user/readpasswords/common.py +@@ -37,6 +37,7 @@ from samba.netcmd import Command, CommandError + from samba.samdb import SamDB + from samba.nt_time import timedelta_from_nt_time_delta, nt_time_from_datetime + from samba.gkdi import MAX_CLOCK_SKEW ++from samba._glue import crypt + + # python[3]-gpgme is abandoned since ubuntu 1804 and debian 9 + # have to use python[3]-gpg instead +@@ -132,9 +133,7 @@ def get_crypt_value(alg, utf8pw, rounds=0): + else: + crypt_salt = "$%s$%s$" % (alg, b64salt) + +- crypt_value = crypt.crypt(utf8pw, crypt_salt) +- if crypt_value is None: +- raise NotImplementedError("crypt.crypt(%s) returned None" % (crypt_salt)) ++ crypt_value = crypt(utf8pw, crypt_salt) + expected_len = len(crypt_salt) + algs[alg]["length"] + if len(crypt_value) != expected_len: + raise NotImplementedError("crypt.crypt(%s) returned a value with length %d, expected length is %d" % ( +@@ -156,21 +155,13 @@ except ImportError as e: + + for (alg, attr) in [("5", "virtualCryptSHA256"), ("6", "virtualCryptSHA512")]: + try: +- import crypt + get_crypt_value(alg, "") +- virtual_attributes[attr] = { +- } +- except ImportError as e: +- reason = "crypt" +- reason += " required" +- disabled_virtual_attributes[attr] = { +- "reason": reason, +- } +- except NotImplementedError as e: +- reason = "modern '$%s$' salt in crypt(3) required" % (alg) ++ except (ValueError, OSError): + disabled_virtual_attributes[attr] = { +- "reason": reason, ++ "reason": f"modern '${alg}$' salt in crypt(3) required" + } ++ continue ++ virtual_attributes[attr] = {} + + # Add the wDigest virtual attributes, virtualWDigest01 to virtualWDigest29 + for x in range(1, 30): +-- +2.34.1 + + +From dde9d1c473ac2fccfc123cfe2ca224da59042c6d Mon Sep 17 00:00:00 2001 +From: Douglas Bagnall +Date: Wed, 11 Dec 2024 15:56:20 +1300 +Subject: [PATCH 08/10] samba-tool user: hashlib.sha1 is always present + +We maybe thought we were checking that sha1 was in hashlib, but we were +only checking that hashlib is in the Python library (`hashlib.sha1()` +would not raise ImportError). + +The documentation says hashlib always contains sha1 -- if that +changes, it is better we know by failing noisily with the import error +at the top of the file. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 + +Signed-off-by: Douglas Bagnall +Reviewed-by: Andreas Schneider +--- + python/samba/netcmd/user/readpasswords/common.py | 16 ++++------------ + 1 file changed, 4 insertions(+), 12 deletions(-) + +diff --git a/python/samba/netcmd/user/readpasswords/common.py b/python/samba/netcmd/user/readpasswords/common.py +index 68befb3f356..3043525874e 100644 +--- a/python/samba/netcmd/user/readpasswords/common.py ++++ b/python/samba/netcmd/user/readpasswords/common.py +@@ -26,6 +26,7 @@ import datetime + import errno + import io + import os ++from hashlib import sha1 + + import ldb + from samba import credentials, nttime2float +@@ -141,17 +142,8 @@ def get_crypt_value(alg, utf8pw, rounds=0): + return crypt_value + + +-try: +- import hashlib +- hashlib.sha1() +- virtual_attributes["virtualSSHA"] = { +- } +-except ImportError as e: +- reason = "hashlib.sha1()" +- reason += " required" +- disabled_virtual_attributes["virtualSSHA"] = { +- "reason": reason, +- } ++ ++virtual_attributes["virtualSSHA"] = {} + + for (alg, attr) in [("5", "virtualCryptSHA256"), ("6", "virtualCryptSHA512")]: + try: +@@ -736,7 +728,7 @@ class GetPasswordCommand(Command): + if u8 is None: + continue + salt = os.urandom(4) +- h = hashlib.sha1() ++ h = sha1() + h.update(u8) + h.update(salt) + bv = h.digest() + salt +-- +2.34.1 + + +From 361a7bcfc203c8cf4884c3f35e7147b59c0e4116 Mon Sep 17 00:00:00 2001 +From: Douglas Bagnall +Date: Thu, 12 Dec 2024 10:46:16 +1300 +Subject: [PATCH 09/10] pytest: password_hash uses internal _glue.crypt + +This will remove an external dependency. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 + +Signed-off-by: Douglas Bagnall +Reviewed-by: Andreas Schneider +--- + python/samba/tests/password_hash.py | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/python/samba/tests/password_hash.py b/python/samba/tests/password_hash.py +index 1b7af7de7b8..39ef13fd7b2 100644 +--- a/python/samba/tests/password_hash.py ++++ b/python/samba/tests/password_hash.py +@@ -30,11 +30,11 @@ from samba.dcerpc.samr import DOMAIN_PASSWORD_STORE_CLEARTEXT + from samba.dsdb import UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED + from samba.tests import delete_force + from samba.tests.password_test import PasswordCommon ++from samba._glue import crypt + import ldb + import samba + import binascii + from hashlib import md5 +-import crypt + + + USER_NAME = "PasswordHashTestUser" +@@ -321,7 +321,7 @@ class PassWordHashTests(TestCase): + cmd = "$%s$rounds=%d$%s" % (alg, rounds, data[3]) + + # Calculate the expected hash value +- expected = crypt.crypt(USER_PASS, cmd) ++ expected = crypt(USER_PASS, cmd) + self.assertEqual(expected, up.hashes[i].value.decode('utf8')) + i += 1 + +-- +2.34.1 + + +From 11ec542b49c4fe165ce717b0f978439ed717f3e0 Mon Sep 17 00:00:00 2001 +From: Douglas Bagnall +Date: Wed, 11 Dec 2024 14:31:18 +1300 +Subject: [PATCH 10/10] util:datablob: data_blob_pad checks its alignment + assumption + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 + +Signed-off-by: Douglas Bagnall +Reviewed-by: Andreas Schneider + +Autobuild-User(master): Andreas Schneider +Autobuild-Date(master): Fri Dec 20 07:59:51 UTC 2024 on atb-devel-224 +--- + lib/util/data_blob.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/util/data_blob.c b/lib/util/data_blob.c +index b5b78bc7a8a..0522e7755af 100644 +--- a/lib/util/data_blob.c ++++ b/lib/util/data_blob.c +@@ -286,7 +286,7 @@ _PUBLIC_ bool data_blob_pad(TALLOC_CTX *mem_ctx, DATA_BLOB *blob, + size_t old_len = blob->length; + size_t new_len = (old_len + pad - 1) & ~(pad - 1); + +- if (new_len < old_len) { ++ if (new_len < old_len || (pad & (pad - 1)) != 0) { + return false; + } + +-- +2.34.1 + diff --git a/samba.spec b/samba.spec index b956d6d..68977a3 100644 --- a/samba.spec +++ b/samba.spec @@ -251,6 +251,7 @@ Source201: README.downgrade Source202: samba.abignore Patch0: samba-4.21.0-s3-notifyd.patch +Patch1: samba-4-21-pycrypt.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} @@ -441,9 +442,6 @@ BuildRequires: perl-Parse-Yapp BuildRequires: perl-Test-Base BuildRequires: psmisc BuildRequires: python3-libpamtest -# The `crypt` module has been removed in Python 3.13, this is a copy -# See also https://bugzilla.samba.org/show_bug.cgi?id=15756 -BuildRequires: python3-crypt-r BuildRequires: resolv_wrapper BuildRequires: rsync BuildRequires: socket_wrapper @@ -2062,6 +2060,7 @@ fi %{_libdir}/samba/libtdb-wrap-private-samba.so %{_libdir}/samba/libtime-basic-private-samba.so %{_libdir}/samba/libtorture-private-samba.so +%{_libdir}/samba/libutil-crypt-private-samba.so %{_libdir}/samba/libutil-reg-private-samba.so %{_libdir}/samba/libutil-setid-private-samba.so %{_libdir}/samba/libutil-tdb-private-samba.so From 99bcb0cab84201e9f7154c4bf58ebe206f30e112 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 7 Jan 2025 14:23:35 +0100 Subject: [PATCH 357/425] Remove 'Requires: python3-crypt-r' also from samba-tools --- samba.spec | 3 --- 1 file changed, 3 deletions(-) diff --git a/samba.spec b/samba.spec index 68977a3..30fdeb5 100644 --- a/samba.spec +++ b/samba.spec @@ -594,9 +594,6 @@ Requires: lmdb %endif Requires: tdb-tools Requires: python3-gpg -# The `crypt` module has been removed in Python 3.13, this is a copy -# See also https://bugzilla.samba.org/show_bug.cgi?id=15756 -Requires: python3-crypt-r %endif %description tools From 09d4509590333c14fe063ef4115f51c81a512f04 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sun, 19 Jan 2025 09:54:56 +0000 Subject: [PATCH 358/425] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild From c6899c34b0abb2e408216e19c317e5a5949b37e3 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 22 Jan 2025 09:00:27 +0100 Subject: [PATCH 359/425] Fix stack use after return in new crypt module --- samba-4-21-pycrypt.patch | 150 +++++++++++++++++++++++++++++++-------- 1 file changed, 120 insertions(+), 30 deletions(-) diff --git a/samba-4-21-pycrypt.patch b/samba-4-21-pycrypt.patch index 8c197fc..bf4c1e5 100644 --- a/samba-4-21-pycrypt.patch +++ b/samba-4-21-pycrypt.patch @@ -1,7 +1,7 @@ -From 93bc860e8f344a96d0496edbc5d463f2c5411fcd Mon Sep 17 00:00:00 2001 +From 07fe7b437c695c7a715418d4414c930b72758dab Mon Sep 17 00:00:00 2001 From: Douglas Bagnall Date: Thu, 5 Dec 2024 16:35:51 +1300 -Subject: [PATCH 01/10] util: add a crypt wrapper, derived from +Subject: [PATCH 01/11] util: add a crypt wrapper, derived from dsdb:password_hash This is going to be used by the dsdb password_hash module, and exposed @@ -13,6 +13,7 @@ standard library. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 Reviewed-by: Andreas Schneider +(cherry picked from commit 833455c7f9f71583d567e3a53e854567cd8c3b0b) --- lib/util/util_crypt.c | 90 ++++++++++++++++++++++++++++++++++++++++++ lib/util/util_crypt.h | 5 +++ @@ -146,13 +147,13 @@ index b4fcfeaba07..7de9c0b7b17 100644 bld.SAMBA_SUBSYSTEM('UNIX_PRIVS', source='unix_privs.c', -- -2.34.1 +2.48.1 -From c8c1de1ac3b715e76cb987525197209e453cdd50 Mon Sep 17 00:00:00 2001 +From adf180613e4172292090d4c3573a439388a09788 Mon Sep 17 00:00:00 2001 From: Douglas Bagnall Date: Wed, 11 Dec 2024 14:29:21 +1300 -Subject: [PATCH 02/10] dsdb:password_hash: move hash_blob allocation up +Subject: [PATCH 02/11] dsdb:password_hash: move hash_blob allocation up This will make the next patch simpler. @@ -160,6 +161,7 @@ BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 Signed-off-by: Douglas Bagnall Reviewed-by: Andreas Schneider +(cherry picked from commit 1edb12f79593d0b2aac36d5acdaaae6f495772f6) --- source4/dsdb/samdb/ldb_modules/password_hash.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) @@ -200,18 +202,19 @@ index 1d1267624e2..c1902126a72 100644 *hash_blob = data_blob_talloc(hash_blob, (const uint8_t *)hash, -- -2.34.1 +2.48.1 -From ac5008598e4a4d3dbf5d58f4b4a2c6fc25195775 Mon Sep 17 00:00:00 2001 +From 9d43e4d649db23549bbb230ed60426fa286b7ab7 Mon Sep 17 00:00:00 2001 From: Douglas Bagnall Date: Thu, 12 Dec 2024 11:16:22 +1300 -Subject: [PATCH 03/10] dsdb:password_hash: use talloc_crypt_blob() +Subject: [PATCH 03/11] dsdb:password_hash: use talloc_crypt_blob() BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 Signed-off-by: Douglas Bagnall Reviewed-by: Andreas Schneider +(cherry picked from commit c7597380b479208e33a403211cec9b3c7bd3f034) --- .../dsdb/samdb/ldb_modules/password_hash.c | 68 ++++--------------- .../samdb/ldb_modules/wscript_build_server | 2 +- @@ -339,13 +342,13 @@ index 9c1eb12a7c2..16d9b31a982 100644 -- -2.34.1 +2.48.1 -From 0f19a12e9f28dd78e5108eeb22950eff48202d97 Mon Sep 17 00:00:00 2001 +From 1c94645881bd5130c67bfee96aa463f360df300a Mon Sep 17 00:00:00 2001 From: Douglas Bagnall Date: Wed, 11 Dec 2024 14:30:04 +1300 -Subject: [PATCH 04/10] util: add a crypt strerror helper +Subject: [PATCH 04/11] util: add a crypt strerror helper This will be used by Python also. @@ -353,6 +356,7 @@ BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 Signed-off-by: Douglas Bagnall Reviewed-by: Andreas Schneider +(cherry picked from commit 5f365e71c1fa8cdc533159283a5977164b5d39f2) --- lib/util/util_crypt.c | 24 +++++++++++++++++++ lib/util/util_crypt.h | 2 ++ @@ -429,13 +433,13 @@ index 7a7114c1caa..6949a92fc3e 100644 ldb, "setup_primary_userPassword: generation of a %s " -- -2.34.1 +2.48.1 -From 354ea5b1e69e27bfdd2d0b5ae8157790ba1bb590 Mon Sep 17 00:00:00 2001 +From ce70e852783ec69104d274def931e7d39f17576a Mon Sep 17 00:00:00 2001 From: Douglas Bagnall Date: Wed, 11 Dec 2024 14:30:15 +1300 -Subject: [PATCH 05/10] pyglue: add crypt() function +Subject: [PATCH 05/11] pyglue: add crypt() function This wraps talloc_crypt_blob() from lib/util/util_crypt.c which in turn wraps the system crypt[_r[n]]. @@ -448,6 +452,7 @@ BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 Signed-off-by: Douglas Bagnall Reviewed-by: Andreas Schneider +(backported from commit 88e3c82d88a68cf972f8189e1c3718698b49974a) --- python/pyglue.c | 41 +++++++++++++++++++++++++++++++++++++++++ python/wscript | 1 + @@ -539,13 +544,13 @@ index 3e6439930e9..7c17e390dc7 100644 ''' % (pyparam_util, pytalloc_util), realname='samba/_glue.so') -- -2.34.1 +2.48.1 -From fec10dfe574a8acef0646a666fd4ff54ef11adf6 Mon Sep 17 00:00:00 2001 +From 9a0dc2db7cde22f36583159c0d697a3de6640990 Mon Sep 17 00:00:00 2001 From: Douglas Bagnall Date: Thu, 12 Dec 2024 10:44:07 +1300 -Subject: [PATCH 06/10] pytest: test that _glue.crypt works +Subject: [PATCH 06/11] pytest: test that _glue.crypt works The test vectors were generated via Python 3.10 crypt module, which directly wraps crypt(3), which in this case is from glibc 2.39-0ubuntu8.3. @@ -557,6 +562,7 @@ BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 Signed-off-by: Douglas Bagnall Reviewed-by: Andreas Schneider +(cherry picked from commit 5636d30c0959fd4a211ee7b8d1b267dcdbf0b963) --- python/samba/tests/glue.py | 65 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 65 insertions(+) @@ -635,13 +641,13 @@ index ac504b3f366..824f5ca0c81 100644 + msg=f"crypt({phrase!r}, {setting!r}) didn't fail"): + _glue.crypt(phrase, setting) -- -2.34.1 +2.48.1 -From 7d1fa8cdc52423bd53de4314a62e2c2b2e0b2aa7 Mon Sep 17 00:00:00 2001 +From 6425e2514052027ee2269e15e0e0dff1686fa34e Mon Sep 17 00:00:00 2001 From: Douglas Bagnall Date: Wed, 11 Dec 2024 15:54:48 +1300 -Subject: [PATCH 07/10] samba-tool user: use _glue.crypt, not crypt.crypt +Subject: [PATCH 07/11] samba-tool user: use _glue.crypt, not crypt.crypt Because we know we have _glue.crypt, and we know it raises exceptions rather than returning None, we can simplify the checks. @@ -650,6 +656,7 @@ BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 Signed-off-by: Douglas Bagnall Reviewed-by: Andreas Schneider +(cherry picked from commit 405187d2ef4920a9a284649c9c3287f5844d5180) --- .../samba/netcmd/user/readpasswords/common.py | 21 ++++++------------- 1 file changed, 6 insertions(+), 15 deletions(-) @@ -704,13 +711,13 @@ index 7944d4e1682..68befb3f356 100644 # Add the wDigest virtual attributes, virtualWDigest01 to virtualWDigest29 for x in range(1, 30): -- -2.34.1 +2.48.1 -From dde9d1c473ac2fccfc123cfe2ca224da59042c6d Mon Sep 17 00:00:00 2001 +From a2a04286e13676177c952e67363fc7502f544861 Mon Sep 17 00:00:00 2001 From: Douglas Bagnall Date: Wed, 11 Dec 2024 15:56:20 +1300 -Subject: [PATCH 08/10] samba-tool user: hashlib.sha1 is always present +Subject: [PATCH 08/11] samba-tool user: hashlib.sha1 is always present We maybe thought we were checking that sha1 was in hashlib, but we were only checking that hashlib is in the Python library (`hashlib.sha1()` @@ -724,6 +731,7 @@ BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 Signed-off-by: Douglas Bagnall Reviewed-by: Andreas Schneider +(cherry picked from commit 4af4dd8135e8edbe2a16cfdfc7ded8c145c82e98) --- python/samba/netcmd/user/readpasswords/common.py | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-) @@ -770,13 +778,13 @@ index 68befb3f356..3043525874e 100644 h.update(salt) bv = h.digest() + salt -- -2.34.1 +2.48.1 -From 361a7bcfc203c8cf4884c3f35e7147b59c0e4116 Mon Sep 17 00:00:00 2001 +From e9a8748f3cc4ba74f8b0d75e7a01866e7c12a0a4 Mon Sep 17 00:00:00 2001 From: Douglas Bagnall Date: Thu, 12 Dec 2024 10:46:16 +1300 -Subject: [PATCH 09/10] pytest: password_hash uses internal _glue.crypt +Subject: [PATCH 09/11] pytest: password_hash uses internal _glue.crypt This will remove an external dependency. @@ -784,6 +792,7 @@ BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 Signed-off-by: Douglas Bagnall Reviewed-by: Andreas Schneider +(cherry picked from commit 552053b6445611ecef6ac4c11c55ebf92f03571d) --- python/samba/tests/password_hash.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) @@ -815,13 +824,13 @@ index 1b7af7de7b8..39ef13fd7b2 100644 i += 1 -- -2.34.1 +2.48.1 -From 11ec542b49c4fe165ce717b0f978439ed717f3e0 Mon Sep 17 00:00:00 2001 +From 0e01dc4f1fabfd2c3f21f724c05d94227a278b20 Mon Sep 17 00:00:00 2001 From: Douglas Bagnall Date: Wed, 11 Dec 2024 14:31:18 +1300 -Subject: [PATCH 10/10] util:datablob: data_blob_pad checks its alignment +Subject: [PATCH 10/11] util:datablob: data_blob_pad checks its alignment assumption BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 @@ -831,6 +840,8 @@ Reviewed-by: Andreas Schneider Autobuild-User(master): Andreas Schneider Autobuild-Date(master): Fri Dec 20 07:59:51 UTC 2024 on atb-devel-224 + +(cherry picked from commit 8b84282008dc372d67ba01c8fe256ef756c3dcfb) --- lib/util/data_blob.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) @@ -849,5 +860,84 @@ index b5b78bc7a8a..0522e7755af 100644 } -- -2.34.1 +2.48.1 + + +From 8cfae9f33fb1c170c3fe937be200490597e9e4c2 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Fri, 17 Jan 2025 13:28:30 +0100 +Subject: [PATCH 11/11] lib:util: Fix stack-use-after-return in + crypt_as_best_we_can() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15784 + +Signed-off-by: Andreas Schneider +Reviewed-by: Douglas Bagnall +Reviewed-by: Pavel Filipenský + +Autobuild-User(master): Douglas Bagnall +Autobuild-Date(master): Fri Jan 17 23:21:13 UTC 2025 on atb-devel-224 + +(cherry picked from commit 6cd9849b58ec653cbffc602e3c96996a082faf53) +--- + lib/util/util_crypt.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +diff --git a/lib/util/util_crypt.c b/lib/util/util_crypt.c +index 09cd47597d1..9ac6e1cfd0e 100644 +--- a/lib/util/util_crypt.c ++++ b/lib/util/util_crypt.c +@@ -1,11 +1,13 @@ + #include + #include "data_blob.h" ++#include "discard.h" + #include + #include + #include "util_crypt.h" + + +-static int crypt_as_best_we_can(const char *phrase, ++static int crypt_as_best_we_can(TALLOC_CTX *mem_ctx, ++ const char *phrase, + const char *setting, + const char **hashp) + { +@@ -63,8 +65,14 @@ static int crypt_as_best_we_can(const char *phrase, + ret = ENOTRECOVERABLE; + } + } ++ if (ret != 0) { ++ return ret; ++ } + +- *hashp = hash; ++ *hashp = talloc_strdup(mem_ctx, hash); ++ if (*hashp == NULL) { ++ ret = -1; ++ } + return ret; + } + +@@ -75,14 +83,14 @@ int talloc_crypt_blob(TALLOC_CTX *mem_ctx, + DATA_BLOB *blob) + { + const char *hash = NULL; +- int ret = crypt_as_best_we_can(phrase, setting, &hash); ++ int ret = crypt_as_best_we_can(mem_ctx, phrase, setting, &hash); + if (ret != 0) { + blob->data = NULL; + blob->length = 0; + return ret; + } + blob->length = strlen(hash); +- blob->data = talloc_memdup(mem_ctx, hash, blob->length); ++ blob->data = discard_const_p(uint8_t, hash); + if (blob->data == NULL) { + return ENOMEM; + } +-- +2.48.1 From 7bc49d20ad6345bd820bb043262db005c422b535 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 22 Jan 2025 09:03:43 +0100 Subject: [PATCH 360/425] Fix building with gcc 15 --- samba-4-21-fix-smbreadline.patch | 112 +++++++++++++++++++++++++++++++ samba.spec | 1 + 2 files changed, 113 insertions(+) create mode 100644 samba-4-21-fix-smbreadline.patch diff --git a/samba-4-21-fix-smbreadline.patch b/samba-4-21-fix-smbreadline.patch new file mode 100644 index 0000000..9fd288d --- /dev/null +++ b/samba-4-21-fix-smbreadline.patch @@ -0,0 +1,112 @@ +From 36e3944418789f5d2018063fa3988c318baa0a35 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 21 Jan 2025 17:59:12 +0100 +Subject: [PATCH 1/2] lib:replace: Remove trailing spaces from readline.h + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15788 + +Signed-off-by: Andreas Schneider +Reviewed-by: Alexander Bokovoy +(cherry picked from commit dbff53f77680f0ccd022f2d864ba6ae7585a34b7) +--- + lib/replace/system/readline.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/lib/replace/system/readline.h b/lib/replace/system/readline.h +index 29379626e0d..9a9af266ca6 100644 +--- a/lib/replace/system/readline.h ++++ b/lib/replace/system/readline.h +@@ -1,14 +1,14 @@ + #ifndef _system_readline_h + #define _system_readline_h +-/* ++/* + Unix SMB/CIFS implementation. + + Readline wrappers +- ++ + ** NOTE! The following LGPL license applies to the replace + ** library. This does NOT imply that all of Samba is released + ** under the LGPL +- ++ + This library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either +-- +2.48.1 + + +From 6944f700dcd4ad795652070dfb04135d602622a2 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 21 Jan 2025 17:59:27 +0100 +Subject: [PATCH 2/2] lib:replace: Don't use deprecated readline CPPFunction + cast +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +HAVE_RL_COMPLETION_FUNC_T was unused and not checking for the right +function. + +libcli/smbreadline/smbreadline.c: In function ‘smb_readline’: +libcli/smbreadline/smbreadline.c:139:17: warning: ‘CPPFunction’ is deprecated [-Wdeprecated-declarations] + 139 | rl_attempted_completion_function = RL_COMPLETION_CAST completion_fn; + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +libcli/smbreadline/smbreadline.c:139:50: error: assignment to ‘char ** (*)(const char *, int, int)’ from incompatible pointer type ‘char ** (*)(void)’ [-Wincompatible-pointer-types] + 139 | rl_attempted_completion_function = RL_COMPLETION_CAST completion_fn; + | ^ + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15788 + +Signed-off-by: Andreas Schneider +Reviewed-by: Alexander Bokovoy + +Autobuild-User(master): Andreas Schneider +Autobuild-Date(master): Tue Jan 21 19:38:37 UTC 2025 on atb-devel-224 + +(cherry picked from commit 9aa5c43315d83c19514251a11c4fba5a137f2821) +--- + lib/replace/system/readline.h | 4 +++- + libcli/smbreadline/wscript_configure | 8 +++++--- + 2 files changed, 8 insertions(+), 4 deletions(-) + +diff --git a/lib/replace/system/readline.h b/lib/replace/system/readline.h +index 9a9af266ca6..ac3604fc12e 100644 +--- a/lib/replace/system/readline.h ++++ b/lib/replace/system/readline.h +@@ -46,7 +46,9 @@ + #endif + + #ifdef HAVE_NEW_LIBREADLINE +-#ifdef HAVE_CPPFUNCTION ++#if defined(HAVE_RL_COMPLETION_FUNC_T) ++# define RL_COMPLETION_CAST (rl_completion_func_t *) ++#elif defined(HAVE_CPPFUNCTION) + # define RL_COMPLETION_CAST (CPPFunction *) + #elif defined(HAVE_RL_COMPLETION_T) + # define RL_COMPLETION_CAST (rl_completion_t *) +diff --git a/libcli/smbreadline/wscript_configure b/libcli/smbreadline/wscript_configure +index 912ff53a150..f5a401ebae0 100644 +--- a/libcli/smbreadline/wscript_configure ++++ b/libcli/smbreadline/wscript_configure +@@ -51,10 +51,12 @@ conf.CHECK_CODE(''' + # endif + # endif + #endif +-int main(void) {rl_completion_t f; return 0;} ++int main(void) {rl_completion_func_t f; return 0;} + ''', +-'HAVE_RL_COMPLETION_FUNC_T', execute=False, addmain=False, +-msg='Checking for rl_completion_t') ++ 'HAVE_RL_COMPLETION_FUNC_T', ++ execute=False, ++ addmain=False, ++ msg='Checking for rl_completion_func_t') + + conf.CHECK_CODE(''' + #ifdef HAVE_READLINE_READLINE_H +-- +2.48.1 + diff --git a/samba.spec b/samba.spec index 30fdeb5..0852641 100644 --- a/samba.spec +++ b/samba.spec @@ -252,6 +252,7 @@ Source202: samba.abignore Patch0: samba-4.21.0-s3-notifyd.patch Patch1: samba-4-21-pycrypt.patch +Patch2: samba-4-21-fix-smbreadline.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} From e52328b755e2fe92cf0c6d2455aea7b42b47848e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Esser?= Date: Sat, 1 Feb 2025 19:57:20 +0100 Subject: [PATCH 361/425] Add explicit BR: libxcrypt-devel MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Björn Esser --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index 0852641..ba9f3ed 100644 --- a/samba.spec +++ b/samba.spec @@ -316,6 +316,7 @@ BuildRequires: libicu-devel BuildRequires: libcmocka-devel BuildRequires: libtirpc-devel BuildRequires: libuuid-devel +BuildRequires: libxcrypt-devel BuildRequires: libxslt %if %{with lmdb} BuildRequires: lmdb From f24bbdaf786f2f75a82df28ddffb5491d7db6b35 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Sat, 8 Feb 2025 23:02:27 +0100 Subject: [PATCH 362/425] Update to version 4.22.0rc1 - resolves: rhbz#2344189 Guenther --- samba-4-21-fix-smbreadline.patch | 112 ---- samba-4-21-pycrypt.patch | 943 ------------------------------- samba-4.21.0-s3-notifyd.patch | 513 ----------------- samba.spec | 36 +- sources | 4 +- 5 files changed, 23 insertions(+), 1585 deletions(-) delete mode 100644 samba-4-21-fix-smbreadline.patch delete mode 100644 samba-4-21-pycrypt.patch delete mode 100644 samba-4.21.0-s3-notifyd.patch diff --git a/samba-4-21-fix-smbreadline.patch b/samba-4-21-fix-smbreadline.patch deleted file mode 100644 index 9fd288d..0000000 --- a/samba-4-21-fix-smbreadline.patch +++ /dev/null @@ -1,112 +0,0 @@ -From 36e3944418789f5d2018063fa3988c318baa0a35 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Tue, 21 Jan 2025 17:59:12 +0100 -Subject: [PATCH 1/2] lib:replace: Remove trailing spaces from readline.h - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15788 - -Signed-off-by: Andreas Schneider -Reviewed-by: Alexander Bokovoy -(cherry picked from commit dbff53f77680f0ccd022f2d864ba6ae7585a34b7) ---- - lib/replace/system/readline.h | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/lib/replace/system/readline.h b/lib/replace/system/readline.h -index 29379626e0d..9a9af266ca6 100644 ---- a/lib/replace/system/readline.h -+++ b/lib/replace/system/readline.h -@@ -1,14 +1,14 @@ - #ifndef _system_readline_h - #define _system_readline_h --/* -+/* - Unix SMB/CIFS implementation. - - Readline wrappers -- -+ - ** NOTE! The following LGPL license applies to the replace - ** library. This does NOT imply that all of Samba is released - ** under the LGPL -- -+ - This library is free software; you can redistribute it and/or - modify it under the terms of the GNU Lesser General Public - License as published by the Free Software Foundation; either --- -2.48.1 - - -From 6944f700dcd4ad795652070dfb04135d602622a2 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Tue, 21 Jan 2025 17:59:27 +0100 -Subject: [PATCH 2/2] lib:replace: Don't use deprecated readline CPPFunction - cast -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -HAVE_RL_COMPLETION_FUNC_T was unused and not checking for the right -function. - -libcli/smbreadline/smbreadline.c: In function ‘smb_readline’: -libcli/smbreadline/smbreadline.c:139:17: warning: ‘CPPFunction’ is deprecated [-Wdeprecated-declarations] - 139 | rl_attempted_completion_function = RL_COMPLETION_CAST completion_fn; - | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -libcli/smbreadline/smbreadline.c:139:50: error: assignment to ‘char ** (*)(const char *, int, int)’ from incompatible pointer type ‘char ** (*)(void)’ [-Wincompatible-pointer-types] - 139 | rl_attempted_completion_function = RL_COMPLETION_CAST completion_fn; - | ^ - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15788 - -Signed-off-by: Andreas Schneider -Reviewed-by: Alexander Bokovoy - -Autobuild-User(master): Andreas Schneider -Autobuild-Date(master): Tue Jan 21 19:38:37 UTC 2025 on atb-devel-224 - -(cherry picked from commit 9aa5c43315d83c19514251a11c4fba5a137f2821) ---- - lib/replace/system/readline.h | 4 +++- - libcli/smbreadline/wscript_configure | 8 +++++--- - 2 files changed, 8 insertions(+), 4 deletions(-) - -diff --git a/lib/replace/system/readline.h b/lib/replace/system/readline.h -index 9a9af266ca6..ac3604fc12e 100644 ---- a/lib/replace/system/readline.h -+++ b/lib/replace/system/readline.h -@@ -46,7 +46,9 @@ - #endif - - #ifdef HAVE_NEW_LIBREADLINE --#ifdef HAVE_CPPFUNCTION -+#if defined(HAVE_RL_COMPLETION_FUNC_T) -+# define RL_COMPLETION_CAST (rl_completion_func_t *) -+#elif defined(HAVE_CPPFUNCTION) - # define RL_COMPLETION_CAST (CPPFunction *) - #elif defined(HAVE_RL_COMPLETION_T) - # define RL_COMPLETION_CAST (rl_completion_t *) -diff --git a/libcli/smbreadline/wscript_configure b/libcli/smbreadline/wscript_configure -index 912ff53a150..f5a401ebae0 100644 ---- a/libcli/smbreadline/wscript_configure -+++ b/libcli/smbreadline/wscript_configure -@@ -51,10 +51,12 @@ conf.CHECK_CODE(''' - # endif - # endif - #endif --int main(void) {rl_completion_t f; return 0;} -+int main(void) {rl_completion_func_t f; return 0;} - ''', --'HAVE_RL_COMPLETION_FUNC_T', execute=False, addmain=False, --msg='Checking for rl_completion_t') -+ 'HAVE_RL_COMPLETION_FUNC_T', -+ execute=False, -+ addmain=False, -+ msg='Checking for rl_completion_func_t') - - conf.CHECK_CODE(''' - #ifdef HAVE_READLINE_READLINE_H --- -2.48.1 - diff --git a/samba-4-21-pycrypt.patch b/samba-4-21-pycrypt.patch deleted file mode 100644 index bf4c1e5..0000000 --- a/samba-4-21-pycrypt.patch +++ /dev/null @@ -1,943 +0,0 @@ -From 07fe7b437c695c7a715418d4414c930b72758dab Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Thu, 5 Dec 2024 16:35:51 +1300 -Subject: [PATCH 01/11] util: add a crypt wrapper, derived from - dsdb:password_hash - -This is going to be used by the dsdb password_hash module, and exposed -to Python via pyglue. - -We're doing this because Python 3.13 has dropped crypt from the Python -standard library. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Reviewed-by: Andreas Schneider -(cherry picked from commit 833455c7f9f71583d567e3a53e854567cd8c3b0b) ---- - lib/util/util_crypt.c | 90 ++++++++++++++++++++++++++++++++++++++++++ - lib/util/util_crypt.h | 5 +++ - lib/util/wscript_build | 6 +++ - 3 files changed, 101 insertions(+) - create mode 100644 lib/util/util_crypt.c - create mode 100644 lib/util/util_crypt.h - -diff --git a/lib/util/util_crypt.c b/lib/util/util_crypt.c -new file mode 100644 -index 00000000000..0f7b2d0fd31 ---- /dev/null -+++ b/lib/util/util_crypt.c -@@ -0,0 +1,90 @@ -+#include -+#include "data_blob.h" -+#include -+#include -+#include "util_crypt.h" -+ -+ -+static int crypt_as_best_we_can(const char *phrase, -+ const char *setting, -+ const char **hashp) -+{ -+ int ret = 0; -+ const char *hash = NULL; -+ -+#if defined(HAVE_CRYPT_R) || defined(HAVE_CRYPT_RN) -+ struct crypt_data crypt_data = { -+ .initialized = 0 /* working storage used by crypt */ -+ }; -+#endif -+ -+ /* -+ * crypt_r() and crypt() may return a null pointer upon error -+ * depending on how libcrypt was configured, so we prefer -+ * crypt_rn() from libcrypt / libxcrypt which always returns -+ * NULL on error. -+ * -+ * POSIX specifies returning a null pointer and setting -+ * errno. -+ * -+ * RHEL 7 (which does not use libcrypt / libxcrypt) returns a -+ * non-NULL pointer from crypt_r() on success but (always?) -+ * sets errno during internal processing in the NSS crypto -+ * subsystem. -+ * -+ * By preferring crypt_rn we avoid the 'return non-NULL but -+ * set-errno' that we otherwise cannot tell apart from the -+ * RHEL 7 behaviour. -+ */ -+ errno = 0; -+ -+#ifdef HAVE_CRYPT_RN -+ hash = crypt_rn(phrase, setting, -+ &crypt_data, -+ sizeof(crypt_data)); -+#elif HAVE_CRYPT_R -+ hash = crypt_r(phrase, setting, &crypt_data); -+#else -+ /* -+ * No crypt_r falling back to crypt, which is NOT thread safe -+ * Thread safety MT-Unsafe race:crypt -+ */ -+ hash = crypt(phrase, setting); -+#endif -+ /* -+ * On error, crypt() and crypt_r() may return a null pointer, -+ * or a pointer to an invalid hash beginning with a '*'. -+ */ -+ ret = errno; -+ errno = 0; -+ if (hash == NULL || hash[0] == '*') { -+ if (ret == 0) { -+ /* this is annoying */ -+ ret = ENOTRECOVERABLE; -+ } -+ } -+ -+ *hashp = hash; -+ return ret; -+} -+ -+ -+int talloc_crypt_blob(TALLOC_CTX *mem_ctx, -+ const char *phrase, -+ const char *setting, -+ DATA_BLOB *blob) -+{ -+ const char *hash = NULL; -+ int ret = crypt_as_best_we_can(phrase, setting, &hash); -+ if (ret != 0) { -+ blob->data = NULL; -+ blob->length = 0; -+ return ret; -+ } -+ blob->length = strlen(hash); -+ blob->data = talloc_memdup(mem_ctx, hash, blob->length); -+ if (blob->data == NULL) { -+ return ENOMEM; -+ } -+ return 0; -+} -diff --git a/lib/util/util_crypt.h b/lib/util/util_crypt.h -new file mode 100644 -index 00000000000..8c289e489e8 ---- /dev/null -+++ b/lib/util/util_crypt.h -@@ -0,0 +1,5 @@ -+ -+int talloc_crypt_blob(TALLOC_CTX *mem_ctx, -+ const char *phrase, -+ const char *cmd, -+ DATA_BLOB *blob); -diff --git a/lib/util/wscript_build b/lib/util/wscript_build -index b4fcfeaba07..7de9c0b7b17 100644 ---- a/lib/util/wscript_build -+++ b/lib/util/wscript_build -@@ -253,6 +253,12 @@ else: - private_library=True, - local_include=False) - -+ bld.SAMBA_LIBRARY('util_crypt', -+ source='util_crypt.c', -+ deps='talloc crypt', -+ private_library=True, -+ local_include=False) -+ - - bld.SAMBA_SUBSYSTEM('UNIX_PRIVS', - source='unix_privs.c', --- -2.48.1 - - -From adf180613e4172292090d4c3573a439388a09788 Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Wed, 11 Dec 2024 14:29:21 +1300 -Subject: [PATCH 02/11] dsdb:password_hash: move hash_blob allocation up - -This will make the next patch simpler. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider -(cherry picked from commit 1edb12f79593d0b2aac36d5acdaaae6f495772f6) ---- - source4/dsdb/samdb/ldb_modules/password_hash.c | 14 ++++++++------ - 1 file changed, 8 insertions(+), 6 deletions(-) - -diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c -index 1d1267624e2..c1902126a72 100644 ---- a/source4/dsdb/samdb/ldb_modules/password_hash.c -+++ b/source4/dsdb/samdb/ldb_modules/password_hash.c -@@ -1649,6 +1649,13 @@ static int setup_primary_userPassword_hash( - } - } - -+ hash_blob = talloc_zero(ctx, DATA_BLOB); -+ -+ if (hash_blob == NULL) { -+ TALLOC_FREE(frame); -+ return ldb_oom(ldb); -+ } -+ - /* - * Relies on the assertion that cleartext_utf8->data is a zero - * terminated UTF-8 string -@@ -1712,15 +1719,10 @@ static int setup_primary_userPassword_hash( - scheme, - reason); - TALLOC_FREE(frame); -+ TALLOC_FREE(hash_blob); - return LDB_ERR_OPERATIONS_ERROR; - } - -- hash_blob = talloc_zero(ctx, DATA_BLOB); -- -- if (hash_blob == NULL) { -- TALLOC_FREE(frame); -- return ldb_oom(ldb); -- } - - *hash_blob = data_blob_talloc(hash_blob, - (const uint8_t *)hash, --- -2.48.1 - - -From 9d43e4d649db23549bbb230ed60426fa286b7ab7 Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Thu, 12 Dec 2024 11:16:22 +1300 -Subject: [PATCH 03/11] dsdb:password_hash: use talloc_crypt_blob() - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider -(cherry picked from commit c7597380b479208e33a403211cec9b3c7bd3f034) ---- - .../dsdb/samdb/ldb_modules/password_hash.c | 68 ++++--------------- - .../samdb/ldb_modules/wscript_build_server | 2 +- - 2 files changed, 13 insertions(+), 57 deletions(-) - -diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c -index c1902126a72..7a7114c1caa 100644 ---- a/source4/dsdb/samdb/ldb_modules/password_hash.c -+++ b/source4/dsdb/samdb/ldb_modules/password_hash.c -@@ -51,6 +51,7 @@ - #include "auth/common_auth.h" - #include "lib/messaging/messaging.h" - #include "lib/param/loadparm.h" -+#include "lib/util/util_crypt.h" - - #include "lib/crypto/gnutls_helpers.h" - #include -@@ -1592,16 +1593,11 @@ static int setup_primary_userPassword_hash( - struct ldb_context *ldb = ldb_module_get_ctx(io->ac->module); - const char *salt = NULL; /* Randomly generated salt */ - const char *cmd = NULL; /* command passed to crypt */ -- const char *hash = NULL; /* password hash generated by crypt */ - int algorithm = 0; /* crypt hash algorithm number */ - int rounds = 0; /* The number of hash rounds */ -+ int ret; - DATA_BLOB *hash_blob = NULL; - TALLOC_CTX *frame = talloc_stackframe(); --#if defined(HAVE_CRYPT_R) || defined(HAVE_CRYPT_RN) -- struct crypt_data crypt_data = { -- .initialized = 0 /* working storage used by crypt */ -- }; --#endif - - /* Generate a random password salt */ - salt = generate_random_str_list(frame, -@@ -1660,52 +1656,20 @@ static int setup_primary_userPassword_hash( - * Relies on the assertion that cleartext_utf8->data is a zero - * terminated UTF-8 string - */ -- -- /* -- * crypt_r() and crypt() may return a null pointer upon error -- * depending on how libcrypt was configured, so we prefer -- * crypt_rn() from libcrypt / libxcrypt which always returns -- * NULL on error. -- * -- * POSIX specifies returning a null pointer and setting -- * errno. -- * -- * RHEL 7 (which does not use libcrypt / libxcrypt) returns a -- * non-NULL pointer from crypt_r() on success but (always?) -- * sets errno during internal processing in the NSS crypto -- * subsystem. -- * -- * By preferring crypt_rn we avoid the 'return non-NULL but -- * set-errno' that we otherwise cannot tell apart from the -- * RHEL 7 behaviour. -- */ -- errno = 0; -- --#ifdef HAVE_CRYPT_RN -- hash = crypt_rn((char *)io->n.cleartext_utf8->data, -- cmd, -- &crypt_data, -- sizeof(crypt_data)); --#elif HAVE_CRYPT_R -- hash = crypt_r((char *)io->n.cleartext_utf8->data, cmd, &crypt_data); --#else -- /* -- * No crypt_r falling back to crypt, which is NOT thread safe -- * Thread safety MT-Unsafe race:crypt -- */ -- hash = crypt((char *)io->n.cleartext_utf8->data, cmd); --#endif -- /* -- * On error, crypt() and crypt_r() may return a null pointer, -- * or a pointer to an invalid hash beginning with a '*'. -- */ -- if (hash == NULL || hash[0] == '*') { -+ ret = talloc_crypt_blob(hash_blob, -+ (char *)io->n.cleartext_utf8->data, -+ cmd, -+ hash_blob); -+ if (ret != 0) { - char buf[1024]; - const char *reason = NULL; -- if (errno == ERANGE) { -+ if (ret == ERANGE) { - reason = "Password exceeds maximum length allowed for crypt() hashing"; -+ } else if (ret == ENOTRECOVERABLE) { -+ /* probably weird RHEL7 crypt, see talloc_crypt_blob() */ -+ reason = "Unknown error"; - } else { -- int err = strerror_r(errno, buf, sizeof(buf)); -+ int err = strerror_r(ret, buf, sizeof(buf)); - if (err == 0) { - reason = buf; - } else { -@@ -1723,14 +1687,6 @@ static int setup_primary_userPassword_hash( - return LDB_ERR_OPERATIONS_ERROR; - } - -- -- *hash_blob = data_blob_talloc(hash_blob, -- (const uint8_t *)hash, -- strlen(hash)); -- if (hash_blob->data == NULL) { -- TALLOC_FREE(frame); -- return ldb_oom(ldb); -- } - hash_value->value = hash_blob; - TALLOC_FREE(frame); - return LDB_SUCCESS; -diff --git a/source4/dsdb/samdb/ldb_modules/wscript_build_server b/source4/dsdb/samdb/ldb_modules/wscript_build_server -index 9c1eb12a7c2..16d9b31a982 100644 ---- a/source4/dsdb/samdb/ldb_modules/wscript_build_server -+++ b/source4/dsdb/samdb/ldb_modules/wscript_build_server -@@ -195,7 +195,7 @@ bld.SAMBA_MODULE('ldb_password_hash', - init_function='ldb_password_hash_module_init', - module_init_name='ldb_init_module', - internal_module=False, -- deps='talloc samdb LIBCLI_AUTH NDR_DRSBLOBS authkrb5 krb5 gpgme DSDB_MODULE_HELPERS crypt db-glue' -+ deps='talloc samdb LIBCLI_AUTH NDR_DRSBLOBS authkrb5 krb5 gpgme DSDB_MODULE_HELPERS util_crypt db-glue' - ) - - --- -2.48.1 - - -From 1c94645881bd5130c67bfee96aa463f360df300a Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Wed, 11 Dec 2024 14:30:04 +1300 -Subject: [PATCH 04/11] util: add a crypt strerror helper - -This will be used by Python also. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider -(cherry picked from commit 5f365e71c1fa8cdc533159283a5977164b5d39f2) ---- - lib/util/util_crypt.c | 24 +++++++++++++++++++ - lib/util/util_crypt.h | 2 ++ - .../dsdb/samdb/ldb_modules/password_hash.c | 16 +------------ - 3 files changed, 27 insertions(+), 15 deletions(-) - -diff --git a/lib/util/util_crypt.c b/lib/util/util_crypt.c -index 0f7b2d0fd31..09cd47597d1 100644 ---- a/lib/util/util_crypt.c -+++ b/lib/util/util_crypt.c -@@ -88,3 +88,27 @@ int talloc_crypt_blob(TALLOC_CTX *mem_ctx, - } - return 0; - } -+ -+ -+char *talloc_crypt_errstring(TALLOC_CTX *mem_ctx, int error) -+{ -+ char buf[1024]; -+ int err; -+ if (error == ERANGE) { -+ return talloc_strdup( -+ mem_ctx, -+ "Password exceeds maximum length allowed for crypt() hashing"); -+ } -+ if (error == ENOTRECOVERABLE) { -+ /* probably weird RHEL7 crypt, see crypt_as_best_we_can() */ -+ goto unknown; -+ } -+ -+ err = strerror_r(error, buf, sizeof(buf)); -+ if (err != 0) { -+ goto unknown; -+ } -+ return talloc_strndup(mem_ctx, buf, sizeof(buf)); -+unknown: -+ return talloc_strdup(mem_ctx, "Unknown error"); -+} -diff --git a/lib/util/util_crypt.h b/lib/util/util_crypt.h -index 8c289e489e8..ca1a58e922c 100644 ---- a/lib/util/util_crypt.h -+++ b/lib/util/util_crypt.h -@@ -3,3 +3,5 @@ int talloc_crypt_blob(TALLOC_CTX *mem_ctx, - const char *phrase, - const char *cmd, - DATA_BLOB *blob); -+ -+char *talloc_crypt_errstring(TALLOC_CTX *mem_ctx, int error); -diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c -index 7a7114c1caa..6949a92fc3e 100644 ---- a/source4/dsdb/samdb/ldb_modules/password_hash.c -+++ b/source4/dsdb/samdb/ldb_modules/password_hash.c -@@ -1661,21 +1661,7 @@ static int setup_primary_userPassword_hash( - cmd, - hash_blob); - if (ret != 0) { -- char buf[1024]; -- const char *reason = NULL; -- if (ret == ERANGE) { -- reason = "Password exceeds maximum length allowed for crypt() hashing"; -- } else if (ret == ENOTRECOVERABLE) { -- /* probably weird RHEL7 crypt, see talloc_crypt_blob() */ -- reason = "Unknown error"; -- } else { -- int err = strerror_r(ret, buf, sizeof(buf)); -- if (err == 0) { -- reason = buf; -- } else { -- reason = "Unknown error"; -- } -- } -+ const char *reason = talloc_crypt_errstring(frame, ret); - ldb_asprintf_errstring( - ldb, - "setup_primary_userPassword: generation of a %s " --- -2.48.1 - - -From ce70e852783ec69104d274def931e7d39f17576a Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Wed, 11 Dec 2024 14:30:15 +1300 -Subject: [PATCH 05/11] pyglue: add crypt() function - -This wraps talloc_crypt_blob() from lib/util/util_crypt.c which in -turn wraps the system crypt[_r[n]]. - -We want this because the Python standard library crypt module is going -away. That one also wrapped the system crypt or crypt_r, so there -should be no change. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider -(backported from commit 88e3c82d88a68cf972f8189e1c3718698b49974a) ---- - python/pyglue.c | 41 +++++++++++++++++++++++++++++++++++++++++ - python/wscript | 1 + - 2 files changed, 42 insertions(+) - -diff --git a/python/pyglue.c b/python/pyglue.c -index 042bf9e14f3..fcccb849f5e 100644 ---- a/python/pyglue.c -+++ b/python/pyglue.c -@@ -18,6 +18,7 @@ - */ - - #include "lib/replace/system/python.h" -+#include "pyerrors.h" - #include "python/py3compat.h" - #include "includes.h" - #include "python/modules.h" -@@ -25,6 +26,7 @@ - #include "param/pyparam.h" - #include "lib/socket/netif.h" - #include "lib/util/debug.h" -+#include "lib/util/util_crypt.h" - #include "librpc/ndr/ndr_private.h" - #include "lib/cmdline/cmdline.h" - #include "lib/crypto/gkdi.h" -@@ -519,6 +521,42 @@ static PyObject *py_get_burnt_commandline(PyObject *self, PyObject *args) - return ret; - } - -+static PyObject *py_crypt(PyObject *self, PyObject *args) -+{ -+ PyObject *py_hash = NULL; -+ char *phrase = NULL; -+ char *setting = NULL; -+ TALLOC_CTX *frame = NULL; -+ int ret; -+ DATA_BLOB hash = {}; -+ -+ if (!PyArg_ParseTuple(args, "ss", &phrase, &setting)) { -+ TALLOC_FREE(frame); -+ return NULL; -+ } -+ frame = talloc_stackframe(); -+ ret = talloc_crypt_blob(frame, phrase, setting, &hash); -+ if (ret != 0) { -+ const char *errstr = talloc_crypt_errstring(frame, ret); -+ if (ret == EINVAL || ret == ERANGE || ret == ENOTRECOVERABLE) { -+ PyErr_Format(PyExc_ValueError, -+ "could not crypt(): %s", -+ errstr); -+ } else { -+ PyErr_Format(PyExc_OSError, -+ "could not crypt(): %s", -+ errstr); -+ } -+ TALLOC_FREE(frame); -+ return NULL; -+ } -+ -+ py_hash = PyUnicode_FromStringAndSize((char *)hash.data, hash.length); -+ TALLOC_FREE(frame); -+ return py_hash; -+} -+ -+ - static PyMethodDef py_misc_methods[] = { - { "generate_random_str", (PyCFunction)py_generate_random_str, METH_VARARGS, - "generate_random_str(len) -> string\n" -@@ -580,6 +618,9 @@ static PyMethodDef py_misc_methods[] = { - METH_NOARGS, "How many NDR internal tokens is too many for this build?" }, - { "get_burnt_commandline", (PyCFunction)py_get_burnt_commandline, - METH_VARARGS, "Return a redacted commandline to feed to setproctitle (None if no redaction required)" }, -+ { "crypt", (PyCFunction)py_crypt, -+ METH_VARARGS, -+ "encrypt as phrase, per crypt(3), as determined by setting." }, - {0} - }; - -diff --git a/python/wscript b/python/wscript -index 3e6439930e9..7c17e390dc7 100644 ---- a/python/wscript -+++ b/python/wscript -@@ -119,6 +119,7 @@ def build(bld): - ndr - cmdline - gkdi -+ util_crypt - %s - ''' % (pyparam_util, pytalloc_util), - realname='samba/_glue.so') --- -2.48.1 - - -From 9a0dc2db7cde22f36583159c0d697a3de6640990 Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Thu, 12 Dec 2024 10:44:07 +1300 -Subject: [PATCH 06/11] pytest: test that _glue.crypt works - -The test vectors were generated via Python 3.10 crypt module, which -directly wraps crypt(3), which in this case is from glibc 2.39-0ubuntu8.3. - -We mainly test the sha256 and sha512 vectors, which seems to be all we -use, and which are said to be widely supported. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider -(cherry picked from commit 5636d30c0959fd4a211ee7b8d1b267dcdbf0b963) ---- - python/samba/tests/glue.py | 65 ++++++++++++++++++++++++++++++++++++++ - 1 file changed, 65 insertions(+) - -diff --git a/python/samba/tests/glue.py b/python/samba/tests/glue.py -index ac504b3f366..824f5ca0c81 100644 ---- a/python/samba/tests/glue.py -+++ b/python/samba/tests/glue.py -@@ -88,3 +88,68 @@ class GlueTests(samba.tests.TestCase): - self.assertEqual(_glue.strstr_m(string, '_'), '_string_num__one') - self.assertEqual(_glue.strstr_m(string, '__'), '__one') - self.assertEqual(_glue.strstr_m(string, 'ring'), 'ring_num__one') -+ -+ def test_crypt(self): -+ # We hopefully only use schemes 5 and 6 (sha256 and sha512), -+ # which are OK and also quite widely supported according to -+ # https://en.wikipedia.org/wiki/Crypt_(C) -+ for phrase, setting, expected in [ -+ ("a", "$5$aaaaaa", -+ "$5$aaaaaa$F4lxguL7mZR7TGlvukPTJIxoRhVmHMZs8ZdH8oDP0.6"), -+ # with scheme 5, 5000 rounds is default, so hash is the same as above -+ ('a', '$5$rounds=5000$aaaaaa', -+ '$5$rounds=5000$aaaaaa$F4lxguL7mZR7TGlvukPTJIxoRhVmHMZs8ZdH8oDP0.6'), -+ ('a', -+ '$5$rounds=4999$aaaaaa', -+ '$5$rounds=4999$aaaaaa$FiP70gtxOJUFLokUJvET06E7jbL6aNmF6Wtv2ddzjY8'), -+ ('a', '$5$aaaaab', -+ '$5$aaaaab$e9qR2F833/JyuMu.nkQc9kn184vBWLo0ODqnCe./mj0'), -+ -+ ('', '$5$aaaaaa', '$5$aaaaaa$5B4WTdWp5n/v/aNUw2N8RsEitqvlZJEaAKhH/pOkGg4'), -+ -+ ("a", "$6$aaaaaa", -+ "$6$aaaaaa$KHs/Ez7X/I5/K.V8FR7kEsx9rOvjXnEDUmGC.dLBWP87XWy.oUEAM7QYcZQRVhiDwGepOF2pKrCVETYLyASh60"), -+ -+ ('', '$5$', '$5$$3c2QQ0KjIU1OLtB29cl8Fplc2WN7X89bnoEjaR7tWu.'), -+ -+ # scheme 1 (md5) should be supported if not used -+ ('a', '$1$aaaaaa', -+ '$1$aaaaaa$MUMWPbGfzrHFCNm7ZHg31.'), -+ -+ ('', '$6$', -+ '$6$$/chiBau24cE26QQVW3IfIe68Xu5.JQ4E8Ie7lcRLwqxO5cxGuBhqF2HmTL.zWJ9zjChg3yJYFXeGBQ2y3Ba1d1'), -+ (' ', -+ '$6$6', -+ '$6$6$asLnbxf0obyuv3ybNvDE9ZcdwGFkDhLe7uW.wzdOdKCm4/M3vGFKq4Ttk1tBQrOn4wALZ3tj1L8IarIu5i8hR/'), -+ -+ # original DES scheme, 12 bits of salt -+ ("a", "lalala", "laKGbFzgh./R2"), -+ ("a", "lalalaLALALAla", "laKGbFzgh./R2"), -+ ("a", "arrgh", "ar7VUiUvDhX2c"), -+ ("a", "arrggghhh", "ar7VUiUvDhX2c"), -+ ]: -+ hash = _glue.crypt(phrase, setting) -+ self.assertEqual(hash, expected) -+ -+ def test_crypt_bad(self): -+ # We can't be too strident in our assertions, because every -+ # system allows a different set of algorithms, and some have -+ # different ideas of how to parse. -+ for phrase, setting, exception in [ -+ ("a", "$5", ValueError), -+ ("a", "$0$", ValueError), -+ ("a", None, TypeError), -+ (None, "", TypeError), -+ ('a', '$66$', ValueError), -+ ('a', '$$', ValueError), -+ ('a', '*0', ValueError), -+ ('a', '*', ValueError), -+ ('a', '++', ValueError), -+ # this next one is too long, except on Rocky Linux 8. -+ #('a' * 10000, '$5$5', ValueError), -+ # this is invalid, except on Debian 11. -+ # (' ', '$6$ ', ValueError), -+ ]: -+ with self.assertRaises(exception, -+ msg=f"crypt({phrase!r}, {setting!r}) didn't fail"): -+ _glue.crypt(phrase, setting) --- -2.48.1 - - -From 6425e2514052027ee2269e15e0e0dff1686fa34e Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Wed, 11 Dec 2024 15:54:48 +1300 -Subject: [PATCH 07/11] samba-tool user: use _glue.crypt, not crypt.crypt - -Because we know we have _glue.crypt, and we know it raises exceptions -rather than returning None, we can simplify the checks. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider -(cherry picked from commit 405187d2ef4920a9a284649c9c3287f5844d5180) ---- - .../samba/netcmd/user/readpasswords/common.py | 21 ++++++------------- - 1 file changed, 6 insertions(+), 15 deletions(-) - -diff --git a/python/samba/netcmd/user/readpasswords/common.py b/python/samba/netcmd/user/readpasswords/common.py -index 7944d4e1682..68befb3f356 100644 ---- a/python/samba/netcmd/user/readpasswords/common.py -+++ b/python/samba/netcmd/user/readpasswords/common.py -@@ -37,6 +37,7 @@ from samba.netcmd import Command, CommandError - from samba.samdb import SamDB - from samba.nt_time import timedelta_from_nt_time_delta, nt_time_from_datetime - from samba.gkdi import MAX_CLOCK_SKEW -+from samba._glue import crypt - - # python[3]-gpgme is abandoned since ubuntu 1804 and debian 9 - # have to use python[3]-gpg instead -@@ -132,9 +133,7 @@ def get_crypt_value(alg, utf8pw, rounds=0): - else: - crypt_salt = "$%s$%s$" % (alg, b64salt) - -- crypt_value = crypt.crypt(utf8pw, crypt_salt) -- if crypt_value is None: -- raise NotImplementedError("crypt.crypt(%s) returned None" % (crypt_salt)) -+ crypt_value = crypt(utf8pw, crypt_salt) - expected_len = len(crypt_salt) + algs[alg]["length"] - if len(crypt_value) != expected_len: - raise NotImplementedError("crypt.crypt(%s) returned a value with length %d, expected length is %d" % ( -@@ -156,21 +155,13 @@ except ImportError as e: - - for (alg, attr) in [("5", "virtualCryptSHA256"), ("6", "virtualCryptSHA512")]: - try: -- import crypt - get_crypt_value(alg, "") -- virtual_attributes[attr] = { -- } -- except ImportError as e: -- reason = "crypt" -- reason += " required" -- disabled_virtual_attributes[attr] = { -- "reason": reason, -- } -- except NotImplementedError as e: -- reason = "modern '$%s$' salt in crypt(3) required" % (alg) -+ except (ValueError, OSError): - disabled_virtual_attributes[attr] = { -- "reason": reason, -+ "reason": f"modern '${alg}$' salt in crypt(3) required" - } -+ continue -+ virtual_attributes[attr] = {} - - # Add the wDigest virtual attributes, virtualWDigest01 to virtualWDigest29 - for x in range(1, 30): --- -2.48.1 - - -From a2a04286e13676177c952e67363fc7502f544861 Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Wed, 11 Dec 2024 15:56:20 +1300 -Subject: [PATCH 08/11] samba-tool user: hashlib.sha1 is always present - -We maybe thought we were checking that sha1 was in hashlib, but we were -only checking that hashlib is in the Python library (`hashlib.sha1()` -would not raise ImportError). - -The documentation says hashlib always contains sha1 -- if that -changes, it is better we know by failing noisily with the import error -at the top of the file. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider -(cherry picked from commit 4af4dd8135e8edbe2a16cfdfc7ded8c145c82e98) ---- - python/samba/netcmd/user/readpasswords/common.py | 16 ++++------------ - 1 file changed, 4 insertions(+), 12 deletions(-) - -diff --git a/python/samba/netcmd/user/readpasswords/common.py b/python/samba/netcmd/user/readpasswords/common.py -index 68befb3f356..3043525874e 100644 ---- a/python/samba/netcmd/user/readpasswords/common.py -+++ b/python/samba/netcmd/user/readpasswords/common.py -@@ -26,6 +26,7 @@ import datetime - import errno - import io - import os -+from hashlib import sha1 - - import ldb - from samba import credentials, nttime2float -@@ -141,17 +142,8 @@ def get_crypt_value(alg, utf8pw, rounds=0): - return crypt_value - - --try: -- import hashlib -- hashlib.sha1() -- virtual_attributes["virtualSSHA"] = { -- } --except ImportError as e: -- reason = "hashlib.sha1()" -- reason += " required" -- disabled_virtual_attributes["virtualSSHA"] = { -- "reason": reason, -- } -+ -+virtual_attributes["virtualSSHA"] = {} - - for (alg, attr) in [("5", "virtualCryptSHA256"), ("6", "virtualCryptSHA512")]: - try: -@@ -736,7 +728,7 @@ class GetPasswordCommand(Command): - if u8 is None: - continue - salt = os.urandom(4) -- h = hashlib.sha1() -+ h = sha1() - h.update(u8) - h.update(salt) - bv = h.digest() + salt --- -2.48.1 - - -From e9a8748f3cc4ba74f8b0d75e7a01866e7c12a0a4 Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Thu, 12 Dec 2024 10:46:16 +1300 -Subject: [PATCH 09/11] pytest: password_hash uses internal _glue.crypt - -This will remove an external dependency. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider -(cherry picked from commit 552053b6445611ecef6ac4c11c55ebf92f03571d) ---- - python/samba/tests/password_hash.py | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/python/samba/tests/password_hash.py b/python/samba/tests/password_hash.py -index 1b7af7de7b8..39ef13fd7b2 100644 ---- a/python/samba/tests/password_hash.py -+++ b/python/samba/tests/password_hash.py -@@ -30,11 +30,11 @@ from samba.dcerpc.samr import DOMAIN_PASSWORD_STORE_CLEARTEXT - from samba.dsdb import UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED - from samba.tests import delete_force - from samba.tests.password_test import PasswordCommon -+from samba._glue import crypt - import ldb - import samba - import binascii - from hashlib import md5 --import crypt - - - USER_NAME = "PasswordHashTestUser" -@@ -321,7 +321,7 @@ class PassWordHashTests(TestCase): - cmd = "$%s$rounds=%d$%s" % (alg, rounds, data[3]) - - # Calculate the expected hash value -- expected = crypt.crypt(USER_PASS, cmd) -+ expected = crypt(USER_PASS, cmd) - self.assertEqual(expected, up.hashes[i].value.decode('utf8')) - i += 1 - --- -2.48.1 - - -From 0e01dc4f1fabfd2c3f21f724c05d94227a278b20 Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Wed, 11 Dec 2024 14:31:18 +1300 -Subject: [PATCH 10/11] util:datablob: data_blob_pad checks its alignment - assumption - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider - -Autobuild-User(master): Andreas Schneider -Autobuild-Date(master): Fri Dec 20 07:59:51 UTC 2024 on atb-devel-224 - -(cherry picked from commit 8b84282008dc372d67ba01c8fe256ef756c3dcfb) ---- - lib/util/data_blob.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/lib/util/data_blob.c b/lib/util/data_blob.c -index b5b78bc7a8a..0522e7755af 100644 ---- a/lib/util/data_blob.c -+++ b/lib/util/data_blob.c -@@ -286,7 +286,7 @@ _PUBLIC_ bool data_blob_pad(TALLOC_CTX *mem_ctx, DATA_BLOB *blob, - size_t old_len = blob->length; - size_t new_len = (old_len + pad - 1) & ~(pad - 1); - -- if (new_len < old_len) { -+ if (new_len < old_len || (pad & (pad - 1)) != 0) { - return false; - } - --- -2.48.1 - - -From 8cfae9f33fb1c170c3fe937be200490597e9e4c2 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Fri, 17 Jan 2025 13:28:30 +0100 -Subject: [PATCH 11/11] lib:util: Fix stack-use-after-return in - crypt_as_best_we_can() -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15784 - -Signed-off-by: Andreas Schneider -Reviewed-by: Douglas Bagnall -Reviewed-by: Pavel Filipenský - -Autobuild-User(master): Douglas Bagnall -Autobuild-Date(master): Fri Jan 17 23:21:13 UTC 2025 on atb-devel-224 - -(cherry picked from commit 6cd9849b58ec653cbffc602e3c96996a082faf53) ---- - lib/util/util_crypt.c | 16 ++++++++++++---- - 1 file changed, 12 insertions(+), 4 deletions(-) - -diff --git a/lib/util/util_crypt.c b/lib/util/util_crypt.c -index 09cd47597d1..9ac6e1cfd0e 100644 ---- a/lib/util/util_crypt.c -+++ b/lib/util/util_crypt.c -@@ -1,11 +1,13 @@ - #include - #include "data_blob.h" -+#include "discard.h" - #include - #include - #include "util_crypt.h" - - --static int crypt_as_best_we_can(const char *phrase, -+static int crypt_as_best_we_can(TALLOC_CTX *mem_ctx, -+ const char *phrase, - const char *setting, - const char **hashp) - { -@@ -63,8 +65,14 @@ static int crypt_as_best_we_can(const char *phrase, - ret = ENOTRECOVERABLE; - } - } -+ if (ret != 0) { -+ return ret; -+ } - -- *hashp = hash; -+ *hashp = talloc_strdup(mem_ctx, hash); -+ if (*hashp == NULL) { -+ ret = -1; -+ } - return ret; - } - -@@ -75,14 +83,14 @@ int talloc_crypt_blob(TALLOC_CTX *mem_ctx, - DATA_BLOB *blob) - { - const char *hash = NULL; -- int ret = crypt_as_best_we_can(phrase, setting, &hash); -+ int ret = crypt_as_best_we_can(mem_ctx, phrase, setting, &hash); - if (ret != 0) { - blob->data = NULL; - blob->length = 0; - return ret; - } - blob->length = strlen(hash); -- blob->data = talloc_memdup(mem_ctx, hash, blob->length); -+ blob->data = discard_const_p(uint8_t, hash); - if (blob->data == NULL) { - return ENOMEM; - } --- -2.48.1 - diff --git a/samba-4.21.0-s3-notifyd.patch b/samba-4.21.0-s3-notifyd.patch deleted file mode 100644 index 31463fd..0000000 --- a/samba-4.21.0-s3-notifyd.patch +++ /dev/null @@ -1,513 +0,0 @@ -From c9a7bc3e8f36cb9d6746e23ea56f9c27b82dcf49 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Mon, 22 Jul 2024 12:26:55 +0200 -Subject: [PATCH] s3:notifyd: Use a watcher per db record -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -This fixes a O(n²) performance regression in notifyd. The problem was -that we had a watcher per notify instance. This changes the code to have -a watcher per notify db entry. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14430 - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher -(cherry picked from commit af011b987a4ad0d3753d83cc0b8d97ad64ba874a) ---- - source3/smbd/notifyd/notifyd.c | 214 ++++++++++++++++++------- - source3/smbd/notifyd/notifyd_db.c | 5 +- - source3/smbd/notifyd/notifyd_entry.c | 51 ++++-- - source3/smbd/notifyd/notifyd_private.h | 46 ++++-- - 4 files changed, 228 insertions(+), 88 deletions(-) - -diff --git a/source3/smbd/notifyd/notifyd.c b/source3/smbd/notifyd/notifyd.c -index 64dd26a7e11..0b07ab3e435 100644 ---- a/source3/smbd/notifyd/notifyd.c -+++ b/source3/smbd/notifyd/notifyd.c -@@ -337,6 +337,7 @@ static bool notifyd_apply_rec_change( - struct messaging_context *msg_ctx) - { - struct db_record *rec = NULL; -+ struct notifyd_watcher watcher = {}; - struct notifyd_instance *instances = NULL; - size_t num_instances; - size_t i; -@@ -344,6 +345,7 @@ static bool notifyd_apply_rec_change( - TDB_DATA value; - NTSTATUS status; - bool ok = false; -+ bool new_watcher = false; - - if (pathlen == 0) { - DBG_WARNING("pathlen==0\n"); -@@ -374,8 +376,12 @@ static bool notifyd_apply_rec_change( - value = dbwrap_record_get_value(rec); - - if (value.dsize != 0) { -- if (!notifyd_parse_entry(value.dptr, value.dsize, NULL, -- &num_instances)) { -+ ok = notifyd_parse_entry(value.dptr, -+ value.dsize, -+ &watcher, -+ NULL, -+ &num_instances); -+ if (!ok) { - goto fail; - } - } -@@ -390,8 +396,22 @@ static bool notifyd_apply_rec_change( - goto fail; - } - -- if (value.dsize != 0) { -- memcpy(instances, value.dptr, value.dsize); -+ if (num_instances > 0) { -+ struct notifyd_instance *tmp = NULL; -+ size_t num_tmp = 0; -+ -+ ok = notifyd_parse_entry(value.dptr, -+ value.dsize, -+ NULL, -+ &tmp, -+ &num_tmp); -+ if (!ok) { -+ goto fail; -+ } -+ -+ memcpy(instances, -+ tmp, -+ sizeof(struct notifyd_instance) * num_tmp); - } - - for (i=0; ifilter, -- .internal_subdir_filter = chg->subdir_filter - }; - - num_instances += 1; - } - -- if ((instance->instance.filter != 0) || -- (instance->instance.subdir_filter != 0)) { -- int ret; -+ /* -+ * Calculate an intersection of the instances filters for the watcher. -+ */ -+ if (instance->instance.filter > 0) { -+ uint32_t filter = instance->instance.filter; -+ -+ if ((watcher.filter & filter) != filter) { -+ watcher.filter |= filter; -+ -+ new_watcher = true; -+ } -+ } -+ -+ /* -+ * Calculate an intersection of the instances subdir_filters for the -+ * watcher. -+ */ -+ if (instance->instance.subdir_filter > 0) { -+ uint32_t subdir_filter = instance->instance.subdir_filter; - -- TALLOC_FREE(instance->sys_watch); -+ if ((watcher.subdir_filter & subdir_filter) != subdir_filter) { -+ watcher.subdir_filter |= subdir_filter; - -- ret = sys_notify_watch(entries, sys_notify_ctx, path, -- &instance->internal_filter, -- &instance->internal_subdir_filter, -- notifyd_sys_callback, msg_ctx, -- &instance->sys_watch); -- if (ret != 0) { -- DBG_WARNING("sys_notify_watch for [%s] returned %s\n", -- path, strerror(errno)); -+ new_watcher = true; - } - } - - if ((instance->instance.filter == 0) && - (instance->instance.subdir_filter == 0)) { -+ uint32_t tmp_filter = 0; -+ uint32_t tmp_subdir_filter = 0; -+ - /* This is a delete request */ -- TALLOC_FREE(instance->sys_watch); - *instance = instances[num_instances-1]; - num_instances -= 1; -+ -+ for (i = 0; i < num_instances; i++) { -+ struct notifyd_instance *tmp = &instances[i]; -+ -+ tmp_filter |= tmp->instance.filter; -+ tmp_subdir_filter |= tmp->instance.subdir_filter; -+ } -+ -+ /* -+ * If the filter has changed, register a new watcher with the -+ * changed filter. -+ */ -+ if (watcher.filter != tmp_filter || -+ watcher.subdir_filter != tmp_subdir_filter) -+ { -+ watcher.filter = tmp_filter; -+ watcher.subdir_filter = tmp_subdir_filter; -+ -+ new_watcher = true; -+ } -+ } -+ -+ if (new_watcher) { -+ /* -+ * In case we removed all notify instances, we want to remove -+ * the watcher. We won't register a new one, if no filters are -+ * set anymore. -+ */ -+ -+ TALLOC_FREE(watcher.sys_watch); -+ -+ watcher.sys_filter = watcher.filter; -+ watcher.sys_subdir_filter = watcher.subdir_filter; -+ -+ /* -+ * Only register a watcher if we have filter. -+ */ -+ if (watcher.filter != 0 || watcher.subdir_filter != 0) { -+ int ret = sys_notify_watch(entries, -+ sys_notify_ctx, -+ path, -+ &watcher.sys_filter, -+ &watcher.sys_subdir_filter, -+ notifyd_sys_callback, -+ msg_ctx, -+ &watcher.sys_watch); -+ if (ret != 0) { -+ DBG_WARNING("sys_notify_watch for [%s] " -+ "returned %s\n", -+ path, -+ strerror(errno)); -+ } -+ } - } - - DBG_DEBUG("%s has %zu instances\n", path, num_instances); - - if (num_instances == 0) { -+ TALLOC_FREE(watcher.sys_watch); -+ - status = dbwrap_record_delete(rec); - if (!NT_STATUS_IS_OK(status)) { - DBG_WARNING("dbwrap_record_delete returned %s\n", -@@ -456,13 +541,21 @@ static bool notifyd_apply_rec_change( - goto fail; - } - } else { -- value = make_tdb_data( -- (uint8_t *)instances, -- sizeof(struct notifyd_instance) * num_instances); -+ struct TDB_DATA iov[2] = { -+ { -+ .dptr = (uint8_t *)&watcher, -+ .dsize = sizeof(struct notifyd_watcher), -+ }, -+ { -+ .dptr = (uint8_t *)instances, -+ .dsize = sizeof(struct notifyd_instance) * -+ num_instances, -+ }, -+ }; - -- status = dbwrap_record_store(rec, value, 0); -+ status = dbwrap_record_storev(rec, iov, ARRAY_SIZE(iov), 0); - if (!NT_STATUS_IS_OK(status)) { -- DBG_WARNING("dbwrap_record_store returned %s\n", -+ DBG_WARNING("dbwrap_record_storev returned %s\n", - nt_errstr(status)); - goto fail; - } -@@ -706,12 +799,18 @@ static void notifyd_trigger_parser(TDB_DATA key, TDB_DATA data, - .when = tstate->msg->when }; - struct iovec iov[2]; - size_t path_len = key.dsize; -+ struct notifyd_watcher watcher = {}; - struct notifyd_instance *instances = NULL; - size_t num_instances = 0; - size_t i; -+ bool ok; - -- if (!notifyd_parse_entry(data.dptr, data.dsize, &instances, -- &num_instances)) { -+ ok = notifyd_parse_entry(data.dptr, -+ data.dsize, -+ &watcher, -+ &instances, -+ &num_instances); -+ if (!ok) { - DBG_DEBUG("Could not parse notifyd_entry\n"); - return; - } -@@ -734,9 +833,11 @@ static void notifyd_trigger_parser(TDB_DATA key, TDB_DATA data, - - if (tstate->covered_by_sys_notify) { - if (tstate->recursive) { -- i_filter = instance->internal_subdir_filter; -+ i_filter = watcher.sys_subdir_filter & -+ instance->instance.subdir_filter; - } else { -- i_filter = instance->internal_filter; -+ i_filter = watcher.sys_filter & -+ instance->instance.filter; - } - } else { - if (tstate->recursive) { -@@ -1146,46 +1247,39 @@ static int notifyd_add_proxy_syswatches(struct db_record *rec, - struct db_context *db = dbwrap_record_get_db(rec); - TDB_DATA key = dbwrap_record_get_key(rec); - TDB_DATA value = dbwrap_record_get_value(rec); -- struct notifyd_instance *instances = NULL; -- size_t num_instances = 0; -- size_t i; -+ struct notifyd_watcher watcher = {}; - char path[key.dsize+1]; - bool ok; -+ int ret; - - memcpy(path, key.dptr, key.dsize); - path[key.dsize] = '\0'; - -- ok = notifyd_parse_entry(value.dptr, value.dsize, &instances, -- &num_instances); -+ /* This is a remote database, we just need the watcher. */ -+ ok = notifyd_parse_entry(value.dptr, value.dsize, &watcher, NULL, NULL); - if (!ok) { - DBG_WARNING("Could not parse notifyd entry for %s\n", path); - return 0; - } - -- for (i=0; iinstance.filter; -- uint32_t subdir_filter = instance->instance.subdir_filter; -- int ret; -+ watcher.sys_watch = NULL; -+ watcher.sys_filter = watcher.filter; -+ watcher.sys_subdir_filter = watcher.subdir_filter; - -- /* -- * This is a remote database. Pointers that we were -- * given don't make sense locally. Initialize to NULL -- * in case sys_notify_watch fails. -- */ -- instances[i].sys_watch = NULL; -- -- ret = state->sys_notify_watch( -- db, state->sys_notify_ctx, path, -- &filter, &subdir_filter, -- notifyd_sys_callback, state->msg_ctx, -- &instance->sys_watch); -- if (ret != 0) { -- DBG_WARNING("inotify_watch returned %s\n", -- strerror(errno)); -- } -+ ret = state->sys_notify_watch(db, -+ state->sys_notify_ctx, -+ path, -+ &watcher.filter, -+ &watcher.subdir_filter, -+ notifyd_sys_callback, -+ state->msg_ctx, -+ &watcher.sys_watch); -+ if (ret != 0) { -+ DBG_WARNING("inotify_watch returned %s\n", strerror(errno)); - } - -+ memcpy(value.dptr, &watcher, sizeof(struct notifyd_watcher)); -+ - return 0; - } - -@@ -1193,21 +1287,17 @@ static int notifyd_db_del_syswatches(struct db_record *rec, void *private_data) - { - TDB_DATA key = dbwrap_record_get_key(rec); - TDB_DATA value = dbwrap_record_get_value(rec); -- struct notifyd_instance *instances = NULL; -- size_t num_instances = 0; -- size_t i; -+ struct notifyd_watcher watcher = {}; - bool ok; - -- ok = notifyd_parse_entry(value.dptr, value.dsize, &instances, -- &num_instances); -+ ok = notifyd_parse_entry(value.dptr, value.dsize, &watcher, NULL, NULL); - if (!ok) { - DBG_WARNING("Could not parse notifyd entry for %.*s\n", - (int)key.dsize, (char *)key.dptr); - return 0; - } -- for (i=0; ientries database - */ - --bool notifyd_parse_entry( -- uint8_t *buf, -- size_t buflen, -- struct notifyd_instance **instances, -- size_t *num_instances) -+/** -+ * @brief Parse a notifyd database entry. -+ * -+ * The memory we pass down needs to be aligned. If it isn't aligned we can run -+ * into obscure errors as we just point into the data buffer. -+ * -+ * @param data The data to parse -+ * @param data_len The length of the data to parse -+ * @param watcher A pointer to store the watcher data or NULL. -+ * @param instances A pointer to store the array of notify instances or NULL. -+ * @param pnum_instances The number of elements in the array. If you just want -+ * the number of elements pass NULL for the watcher and instances pointers. -+ * -+ * @return true on success, false if an error occurred. -+ */ -+bool notifyd_parse_entry(uint8_t *data, -+ size_t data_len, -+ struct notifyd_watcher *watcher, -+ struct notifyd_instance **instances, -+ size_t *pnum_instances) - { -- if ((buflen % sizeof(struct notifyd_instance)) != 0) { -- DBG_WARNING("invalid buffer size: %zu\n", buflen); -+ size_t ilen; -+ -+ if (data_len < sizeof(struct notifyd_watcher)) { - return false; - } - -- if (instances != NULL) { -- *instances = (struct notifyd_instance *)buf; -+ if (watcher != NULL) { -+ *watcher = *((struct notifyd_watcher *)(uintptr_t)data); - } -- if (num_instances != NULL) { -- *num_instances = buflen / sizeof(struct notifyd_instance); -+ -+ ilen = data_len - sizeof(struct notifyd_watcher); -+ if ((ilen % sizeof(struct notifyd_instance)) != 0) { -+ return false; -+ } -+ -+ if (pnum_instances != NULL) { -+ *pnum_instances = ilen / sizeof(struct notifyd_instance); - } -+ if (instances != NULL) { -+ /* The (uintptr_t) cast removes a warning from -Wcast-align. */ -+ *instances = -+ (struct notifyd_instance *)(uintptr_t) -+ (data + sizeof(struct notifyd_watcher)); -+ } -+ - return true; - } -diff --git a/source3/smbd/notifyd/notifyd_private.h b/source3/smbd/notifyd/notifyd_private.h -index 36c08f47c54..db8e6e1c005 100644 ---- a/source3/smbd/notifyd/notifyd_private.h -+++ b/source3/smbd/notifyd/notifyd_private.h -@@ -20,30 +20,48 @@ - #include "lib/util/server_id.h" - #include "notifyd.h" - -+ - /* -- * notifyd's representation of a notify instance -+ * Representation of a watcher for a path -+ * -+ * This will be stored in the db. - */ --struct notifyd_instance { -- struct server_id client; -- struct notify_instance instance; -- -- void *sys_watch; /* inotify/fam/etc handle */ -+struct notifyd_watcher { -+ /* -+ * This is an intersections of the filter the watcher is listening for. -+ */ -+ uint32_t filter; -+ uint32_t subdir_filter; - - /* -- * Filters after sys_watch took responsibility of some bits -+ * Those are inout variables passed to the sys_watcher. The sys_watcher -+ * will remove the bits it can't handle. - */ -- uint32_t internal_filter; -- uint32_t internal_subdir_filter; -+ uint32_t sys_filter; -+ uint32_t sys_subdir_filter; -+ -+ /* The handle for inotify/fam etc. */ -+ void *sys_watch; -+}; -+ -+/* -+ * Representation of a notifyd instance -+ * -+ * This will be stored in the db. -+ */ -+struct notifyd_instance { -+ struct server_id client; -+ struct notify_instance instance; - }; - - /* - * Parse an entry in the notifyd_context->entries database - */ - --bool notifyd_parse_entry( -- uint8_t *buf, -- size_t buflen, -- struct notifyd_instance **instances, -- size_t *num_instances); -+bool notifyd_parse_entry(uint8_t *data, -+ size_t data_len, -+ struct notifyd_watcher *watcher, -+ struct notifyd_instance **instances, -+ size_t *num_instances); - - #endif --- -2.46.1 - diff --git a/samba.spec b/samba.spec index ba9f3ed..9dbc887 100644 --- a/samba.spec +++ b/samba.spec @@ -148,7 +148,7 @@ %bcond lmdb 0 %endif -%global samba_version 4.21.3 +%global samba_version 4.22.0 # The release field is extended: # [.][.]%%{?dist}[.] @@ -163,7 +163,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release %nil +%global pre_release rc1 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif @@ -176,7 +176,7 @@ %global libdcerpc_so_version 0 %global libndr_krb5pac_so_version 0 %global libndr_nbt_so_version 0 -%global libndr_so_version 5 +%global libndr_so_version 6 %global libndr_standard_so_version 0 %global libnetapi_so_version 1 %global libsamba_credentials_so_version 1 @@ -193,9 +193,9 @@ %global libsmbclient_so_version 0 %global libwbclient_so_version 0 -%global talloc_version 2.4.2 -%global tdb_version 1.4.12 -%global tevent_version 0.16.1 +%global talloc_version 2.4.3 +%global tdb_version 1.4.13 +%global tevent_version 0.16.2 %global required_mit_krb5 1.20.1 @@ -250,10 +250,6 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore -Patch0: samba-4.21.0-s3-notifyd.patch -Patch1: samba-4-21-pycrypt.patch -Patch2: samba-4-21-fix-smbreadline.patch - Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} @@ -2666,8 +2662,11 @@ fi %{python3_sitearch}/samba/dnsresolver.py %dir %{python3_sitearch}/samba/domain %{python3_sitearch}/samba/domain/__init__.py +%dir %{python3_sitearch}/samba/domain/__pycache__ %{python3_sitearch}/samba/domain/__pycache__/__init__.*.pyc +%dir %{python3_sitearch}/samba/domain/models %{python3_sitearch}/samba/domain/models/__init__.py +%dir %{python3_sitearch}/samba/domain/models/__pycache__ %{python3_sitearch}/samba/domain/models/__pycache__/__init__.*.pyc %{python3_sitearch}/samba/domain/models/__pycache__/auth_policy.*.pyc %{python3_sitearch}/samba/domain/models/__pycache__/auth_silo.*.pyc @@ -2876,28 +2875,28 @@ fi %dir %{python3_sitearch}/samba/netcmd/domain/auth/__pycache__ %{python3_sitearch}/samba/netcmd/domain/auth/__pycache__/__init__.*.pyc %dir %{python3_sitearch}/samba/netcmd/domain/auth/policy -%{python3_sitearch}/samba/netcmd/domain/auth/policy/computer_allowed_to_authenticate_to.py %{python3_sitearch}/samba/netcmd/domain/auth/policy/__init__.py -%{python3_sitearch}/samba/netcmd/domain/auth/policy/policy.py %dir %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__ -%{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/computer_allowed_to_authenticate_to.*.pyc %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/__init__.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/computer_allowed_to_authenticate_to.*.pyc %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/policy.*.pyc %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/service_allowed_to_authenticate_from.*.pyc %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/service_allowed_to_authenticate_to.*.pyc %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/user_allowed_to_authenticate_from.*.pyc %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/user_allowed_to_authenticate_to.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/policy/computer_allowed_to_authenticate_to.py +%{python3_sitearch}/samba/netcmd/domain/auth/policy/policy.py %{python3_sitearch}/samba/netcmd/domain/auth/policy/service_allowed_to_authenticate_from.py %{python3_sitearch}/samba/netcmd/domain/auth/policy/service_allowed_to_authenticate_to.py %{python3_sitearch}/samba/netcmd/domain/auth/policy/user_allowed_to_authenticate_from.py %{python3_sitearch}/samba/netcmd/domain/auth/policy/user_allowed_to_authenticate_to.py %dir %{python3_sitearch}/samba/netcmd/domain/auth/silo %{python3_sitearch}/samba/netcmd/domain/auth/silo/__init__.py -%{python3_sitearch}/samba/netcmd/domain/auth/silo/member.py %dir %{python3_sitearch}/samba/netcmd/domain/auth/silo/__pycache__ %{python3_sitearch}/samba/netcmd/domain/auth/silo/__pycache__/__init__.*.pyc %{python3_sitearch}/samba/netcmd/domain/auth/silo/__pycache__/member.*.pyc %{python3_sitearch}/samba/netcmd/domain/auth/silo/__pycache__/silo.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/silo/member.py %{python3_sitearch}/samba/netcmd/domain/auth/silo/silo.py %{python3_sitearch}/samba/netcmd/domain/backup.py %dir %{python3_sitearch}/samba/netcmd/domain/claim @@ -2950,6 +2949,7 @@ fi %{python3_sitearch}/samba/netcmd/schema.py %dir %{python3_sitearch}/samba/netcmd/service_account %{python3_sitearch}/samba/netcmd/service_account/__init__.py +%dir %{python3_sitearch}/samba/netcmd/service_account/__pycache__ %{python3_sitearch}/samba/netcmd/service_account/__pycache__/__init__.*.pyc %{python3_sitearch}/samba/netcmd/service_account/__pycache__/group_msa_membership.*.pyc %{python3_sitearch}/samba/netcmd/service_account/__pycache__/service_account.*.pyc @@ -3238,6 +3238,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/py_credentials.*.pyc %{python3_sitearch}/samba/tests/__pycache__/registry.*.pyc %{python3_sitearch}/samba/tests/__pycache__/reparsepoints.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/rust.*.pyc %{python3_sitearch}/samba/tests/__pycache__/s3idmapdb.*.pyc %{python3_sitearch}/samba/tests/__pycache__/s3param.*.pyc %{python3_sitearch}/samba/tests/__pycache__/s3passdb.*.pyc @@ -3471,6 +3472,7 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/kpasswd_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/lockout_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/ms_kile_client_principal_lookup_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/netlogon.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/nt_hash_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/pac_align_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/pkinit_tests.*.pyc @@ -3513,6 +3515,7 @@ fi %{python3_sitearch}/samba/tests/krb5/kpasswd_tests.py %{python3_sitearch}/samba/tests/krb5/lockout_tests.py %{python3_sitearch}/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py +%{python3_sitearch}/samba/tests/krb5/netlogon.py %{python3_sitearch}/samba/tests/krb5/nt_hash_tests.py %{python3_sitearch}/samba/tests/krb5/pac_align_tests.py %{python3_sitearch}/samba/tests/krb5/pkinit_tests.py @@ -3585,6 +3588,7 @@ fi %{python3_sitearch}/samba/tests/py_credentials.py %{python3_sitearch}/samba/tests/registry.py %{python3_sitearch}/samba/tests/reparsepoints.py +%{python3_sitearch}/samba/tests/rust.py %{python3_sitearch}/samba/tests/s3idmapdb.py %{python3_sitearch}/samba/tests/s3param.py %{python3_sitearch}/samba/tests/s3passdb.py @@ -3801,6 +3805,7 @@ fi %config(noreplace) %{_sysconfdir}/ctdb/ctdb.conf %config(noreplace) %{_sysconfdir}/ctdb/notify.sh %config(noreplace) %{_sysconfdir}/ctdb/debug-hung-script.sh +%config(noreplace) %{_sysconfdir}/ctdb/ctdb-backup-persistent-tdbs.sh %config(noreplace) %{_sysconfdir}/ctdb/ctdb-crash-cleanup.sh %config(noreplace) %{_sysconfdir}/ctdb/debug_locks.sh @@ -3844,8 +3849,8 @@ fi %{_libexecdir}/ctdb/ctdb_natgw %{_libexecdir}/ctdb/ctdb-path %{_libexecdir}/ctdb/ctdb_recovery_helper +%{_libexecdir}/ctdb/ctdb_smnotify_helper %{_libexecdir}/ctdb/ctdb_takeover_helper -%{_libexecdir}/ctdb/smnotify %{_libexecdir}/ctdb/statd_callout %{_libexecdir}/ctdb/statd_callout_helper %{_libexecdir}/ctdb/tdb_mutex_check @@ -3894,6 +3899,7 @@ fi %{_datadir}/ctdb/events/legacy/60.nfs.script %{_datadir}/ctdb/events/legacy/70.iscsi.script %{_datadir}/ctdb/events/legacy/91.lvs.script +%{_datadir}/ctdb/events/legacy/95.database.script %dir %{_datadir}/ctdb/scripts %{_datadir}/ctdb/scripts/winbind_ctdb_updatekeytab.sh diff --git a/sources b/sources index 1055c45..300da04 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.21.3.tar.xz) = 62eb3bfe1aa1cc8aa68055d4caf21bdea6d6f5b0f767566bef1da210100b5dd17b7d60f5c47da01b0123d3a2c1c3689b1960ef2c2cbd4f804ff998ead994fc3f -SHA512 (samba-4.21.3.tar.asc) = 11e40d32b783b7d57d3f35fe96a17e897719f65d796d965b371dfb58b8cf1f8ffe60c3047bea8c2b2b0d475fa55cd25237b9ba84d44b3d65a8cd53c6af760957 +SHA512 (samba-4.22.0rc1.tar.xz) = 70cefc0c84456ab88971c3eefeb287cf3366c83b6f726c8bcd9c209f7e891390d44230303cedf3ec989749a85a96adb3f5b64bf49b05e10289a0f52669eb3caf +SHA512 (samba-4.22.0rc1.tar.asc) = 07fefd436fac1d5f8344e0a6cfcaa89c36ecb555f3c1484def24febe5c63df386021a726049245e5d08a636b9fddee8725e9cd09406555343b255a79903b768b From 67e7277c752d1795e50066139c904e3c7b62a162 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 13 Feb 2025 23:53:18 +0100 Subject: [PATCH 363/425] Update to Samba 4.22.0rc2 - resolves: rhbz#2345547 Guenther --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 9dbc887..7e88c49 100644 --- a/samba.spec +++ b/samba.spec @@ -163,7 +163,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc1 +%global pre_release rc2 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif diff --git a/sources b/sources index 300da04..b75ed0a 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.22.0rc1.tar.xz) = 70cefc0c84456ab88971c3eefeb287cf3366c83b6f726c8bcd9c209f7e891390d44230303cedf3ec989749a85a96adb3f5b64bf49b05e10289a0f52669eb3caf -SHA512 (samba-4.22.0rc1.tar.asc) = 07fefd436fac1d5f8344e0a6cfcaa89c36ecb555f3c1484def24febe5c63df386021a726049245e5d08a636b9fddee8725e9cd09406555343b255a79903b768b +SHA512 (samba-4.22.0rc2.tar.xz) = e0211687c51e0261a170a1d84d44ce82d65e44ff0f18f92fd59dff464037efbc9408c532d5717f9e1ba6cce9160cbd27be60c16b3d5b6b707c48f71503621d90 +SHA512 (samba-4.22.0rc2.tar.asc) = aac019083d039f633dc6f3255972832c8071a7415bb7bb2ee355e2a0095118a1c6351daaa70c5c7e95b0524094f2443ca9331f50ae5e2776ebd0c89309bd03fd From cb85d85e0f490da7cf6ca5fe93a38852aabcaaaa Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 14 Feb 2025 11:52:05 +0100 Subject: [PATCH 364/425] Make %bcond switches easier to understand This also removes support for building on rhel8. --- samba.spec | 99 ++++++++++++++---------------------------------------- 1 file changed, 25 insertions(+), 74 deletions(-) diff --git a/samba.spec b/samba.spec index 7e88c49..680bd4f 100644 --- a/samba.spec +++ b/samba.spec @@ -6,7 +6,7 @@ # or # rpmbuild --rebuild --with testsuite samba.src.rpm # -%bcond_with testsuite +%bcond testsuite 0 # Build with internal talloc, tevent, tdb # @@ -14,132 +14,97 @@ # or # rpmbuild --rebuild --with=testsuite --with=includelibs samba.src.rpm # -%bcond_with includelibs +%bcond includelibs 0 # fedpkg mockbuild --with=ccache -%bcond_with ccache +%bcond ccache 0 # ctdb is enabled by default, you can disable it with: --without clustering -%bcond_without clustering +%bcond clustering 1 # Define _make_verbose if it doesn't exist (RHEL8) %{!?_make_verbose:%define _make_verbose V=1 VERBOSE=1} # Build with Active Directory Domain Controller support by default on Fedora %if 0%{?fedora} -%bcond_without dc +%bcond dc 1 %else -%bcond_with dc +%bcond dc 0 %endif # Build a libsmbclient package by default -%bcond_without libsmbclient +%bcond libsmbclient 1 # Build a libwbclient package by default -%bcond_without libwbclient +%bcond libwbclient 1 # Build with winexe by default %if 0%{?rhel} %ifarch x86_64 -%bcond_without winexe +%bcond winexe 1 %else -%bcond_with winexe +%bcond winexe 0 #endifarch %endif %else -%bcond_without winexe +%bcond winexe 1 %endif # Build vfs_ceph module and ctdb cepth mutex helper by default on 64bit Fedora %if 0%{?fedora} %ifarch aarch64 ppc64le s390x x86_64 riscv64 -%bcond_without vfs_cephfs -%bcond_without ceph_mutex +%bcond vfs_cephfs 1 +%bcond ceph_mutex 1 %else -%bcond_with vfs_cephfs -%bcond_with ceph_mutex +%bcond vfs_cephfs 0 +%bcond ceph_mutex 0 #endifarch %endif %else -%bcond_with vfs_cephfs -%bcond_with ceph_mutex +%bcond vfs_cephfs 0 +%bcond ceph_mutex 0 #endif fedora %endif -# Build vfs_gluster module by default on 64bit Fedora -%global is_rhgs 0 -%if "%{dist}" == ".el7rhgs" || "%{dist}" == ".el8rhgs" -%global is_rhgs 1 -%endif - %if 0%{?fedora} %ifarch aarch64 ppc64le s390x x86_64 riscv64 -%bcond_without vfs_glusterfs +%bcond vfs_glusterfs 1 %else -%bcond_with vfs_glusterfs +%bcond vfs_glusterfs 0 #endifarch %endif -#else rhel -%else - -%if 0%{?is_rhgs} -# Enable on rhgs x86_64 -%ifarch x86_64 -%bcond_without vfs_glusterfs -%else -%bcond_with vfs_glusterfs -#endifarch -%endif -%else -%bcond_with vfs_glusterfs -#endif is_rhgs -%endif - #endif fedora %endif # Build vfs_io_uring module by default on 64bit Fedora -%if 0%{?fedora} || 0%{?rhel} >= 8 - %ifarch aarch64 ppc64le s390x x86_64 riscv64 -%bcond_without vfs_io_uring +%bcond vfs_io_uring 1 %else -%bcond_with vfs_io_uring +%bcond vfs_io_uring 0 #endifarch %endif -%else -%bcond_with vfs_io_uring -#endif fedora || rhel >= 8 -%endif - # Build the ctdb-pcp-pmda package by default on Fedora, except for i686 where # pcp is no longer supported %if 0%{?fedora} %ifnarch i686 -%bcond_without pcp_pmda +%bcond pcp_pmda 1 %endif %else -%bcond_with pcp_pmda +%bcond pcp_pmda 0 %endif # Build the etcd helpers by default on Fedora %if 0%{?fedora} -%bcond_without etcd_mutex +%bcond etcd_mutex 1 %else -%bcond_with etcd_mutex -%endif - -%if 0%{?fedora} || 0%{?rhel} >= 9 -%bcond_without gpupdate -%else -%bcond_with gpupdate +%bcond etcd_mutex 0 %endif %ifarch aarch64 ppc64le s390x x86_64 @@ -379,9 +344,7 @@ BuildRequires: librados-devel BuildRequires: python3-etcd %endif -%if %{with gpupdate} BuildRequires: cepces-certmonger >= 0.3.8 -%endif # pidl requirements BuildRequires: perl(ExtUtils::MakeMaker) @@ -775,7 +738,6 @@ Samba VFS module for GlusterFS integration. %endif ### GPUPDATE -%if %{with gpupdate} %package gpupdate Summary: Samba GPO support for clients Requires: cepces-certmonger @@ -789,9 +751,6 @@ Requires: python3-%{name}-dc = %{samba_depver} This package provides the samba-gpupdate tool to apply Group Policy Objects (GPO) on Samba clients. -#endif with gpupdate -%endif - ### KRB5-PRINTING %package krb5-printing Summary: Samba CUPS backend for printing with Kerberos @@ -1542,11 +1501,6 @@ for i in \ done %endif -%if %{without gpupdate} -rm -f %{buildroot}%{_sbindir}/samba-gpupdate -rm -f %{buildroot}%{_mandir}/man8/samba-gpupdate.8* -%endif - %if %{without vfs_glusterfs} rm -f %{buildroot}%{_mandir}/man8/vfs_glusterfs.8* %endif @@ -2444,12 +2398,9 @@ fi %endif ### GPUPDATE -%if %{with gpupdate} %files gpupdate %{_mandir}/man8/samba-gpupdate.8* %{_sbindir}/samba-gpupdate -#endif with gpupdate -%endif ### KRB5-PRINTING %files krb5-printing From 314544c636c2987c2399dcbd87234d6d95459fb0 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 14 Feb 2025 14:30:24 +0100 Subject: [PATCH 365/425] Add LICENSE file of libldb --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index 680bd4f..9c84080 100644 --- a/samba.spec +++ b/samba.spec @@ -3892,6 +3892,7 @@ fi %endif %files -n libldb +%license lib/ldb/LICENSE %{_libdir}/libldb.so.* %dir %{_libdir}/samba %{_libdir}/samba/libldb-key-value-private-samba.so From 036c40ef5eb24c660d9e2ac71dbbe80dcf7ddf63 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 14 Feb 2025 19:05:42 +0100 Subject: [PATCH 366/425] Fix the '--with includelibs' build --- samba.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index 9c84080..9e37fbb 100644 --- a/samba.spec +++ b/samba.spec @@ -3013,6 +3013,7 @@ fi %if %{with includelibs} %{_libdir}/samba/libpyldb-util.cpython*.so +%{_libdir}/samba/libpytalloc-util.cpython*.so %{python3_sitearch}/__pycache__/_ldb_text*.pyc %{python3_sitearch}/__pycache__/_tdb_text*.pyc @@ -3021,8 +3022,7 @@ fi %{python3_sitearch}/_tdb_text.py %{python3_sitearch}/_tevent.cpython*.so %{python3_sitearch}/ldb.cpython*.so -#FIXME why is it missing? -#%{python3_sitearch}/talloc.cpython*.so +%{python3_sitearch}/talloc.cpython*.so %{python3_sitearch}/tdb.cpython*.so %{python3_sitearch}/tevent.py #endif with includelibs From 4e6ca9ecfb75a192cfc49ce7591e8afe88ca9fba Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 18 Feb 2025 11:00:44 +0100 Subject: [PATCH 367/425] Fix libldb built with '--with includelibs' --- samba.spec | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/samba.spec b/samba.spec index 9e37fbb..cc94374 100644 --- a/samba.spec +++ b/samba.spec @@ -1205,9 +1205,12 @@ Support for using an existing CEPH cluster as a mutex helper for CTDB %package -n libldb Summary: A schema-less, ldap like, API and database License: LGPL-3.0-or-later +%if %{without includelibs} Requires: libtalloc%{?_isa} >= %{talloc_version} Requires: libtdb%{?_isa} >= %{tdb_version} Requires: libtevent%{?_isa} >= %{tevent_version} +# /endif without includelibs +%endif Provides: bundled(libreplace) Obsoletes: libldb < 0:2.10 @@ -1223,9 +1226,12 @@ servers, or use local tdb databases. Summary: Developer tools for the LDB library License: LGPL-3.0-or-later Requires: libldb%{?_isa} = %{samba_depver} +%if %{without includelibs} Requires: libtdb-devel%{?_isa} >= %{tdb_version} Requires: libtalloc-devel%{?_isa} >= %{talloc_version} Requires: libtevent-devel%{?_isa} >= %{tevent_version} +# /endif without includelibs +%endif Obsoletes: libldb-devel < 0:2.10 Provides: libldb-devel = 0:2.10 @@ -1250,7 +1256,10 @@ Tools to manage LDB files Summary: Python bindings for the LDB library License: LGPL-3.0-or-later Requires: libldb%{?_isa} = %{samba_depver} +%if %{without includelibs} Requires: python3-tdb%{?_isa} >= %{tdb_version} +# /endif without includelibs +%endif Requires: samba-client-libs = %{samba_depver} %{?python_provide:%python_provide python3-ldb} From c4883ac1e7043a7ec8f3673b9d419c8e43290a7b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 20 Feb 2025 18:39:08 +0100 Subject: [PATCH 368/425] Update to Samba 4.22.0rc3 - resolves: rhbz#2346803 Guenther --- samba.spec | 4 +++- sources | 4 ++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index cc94374..71388b2 100644 --- a/samba.spec +++ b/samba.spec @@ -128,7 +128,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc2 +%global pre_release rc3 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif @@ -3511,9 +3511,11 @@ fi %dir %{python3_sitearch}/samba/tests/ndr %{python3_sitearch}/samba/tests/ndr/gkdi.py %{python3_sitearch}/samba/tests/ndr/gmsa.py +%{python3_sitearch}/samba/tests/ndr/sd.py %dir %{python3_sitearch}/samba/tests/ndr/__pycache__ %{python3_sitearch}/samba/tests/ndr/__pycache__/gkdi.*.pyc %{python3_sitearch}/samba/tests/ndr/__pycache__/gmsa.*.pyc +%{python3_sitearch}/samba/tests/ndr/__pycache__/sd.*.pyc %{python3_sitearch}/samba/tests/ndr/__pycache__/wbint.*.pyc %{python3_sitearch}/samba/tests/ndr/wbint.py %{python3_sitearch}/samba/tests/netbios.py diff --git a/sources b/sources index b75ed0a..a7d3db0 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.22.0rc2.tar.xz) = e0211687c51e0261a170a1d84d44ce82d65e44ff0f18f92fd59dff464037efbc9408c532d5717f9e1ba6cce9160cbd27be60c16b3d5b6b707c48f71503621d90 -SHA512 (samba-4.22.0rc2.tar.asc) = aac019083d039f633dc6f3255972832c8071a7415bb7bb2ee355e2a0095118a1c6351daaa70c5c7e95b0524094f2443ca9331f50ae5e2776ebd0c89309bd03fd +SHA512 (samba-4.22.0rc3.tar.xz) = fbfd87cbb874e8818061dfb5cc962e80148b8fe68ffa414c9345e70b49777b237c5f6eb633d546d12d47a3027e9da9098a7c08e91f6f87237e1515181e0b73d6 +SHA512 (samba-4.22.0rc3.tar.asc) = ba9ab3ecdd6912f302c9ba1cb8c12cce1d390c6703528796a7d75e6281d578d9bc19df7e612ebc4e6c7d58b964e0aebf108061f08da8af57668424e7ce968222 From c295775181cbe26686635dadeb9feb38c16615be Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 27 Feb 2025 20:00:34 +0100 Subject: [PATCH 369/425] Update to Samba 4.22.0rc4 - resolves: rhbz#2348758 Guenther --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 71388b2..1c9b659 100644 --- a/samba.spec +++ b/samba.spec @@ -128,7 +128,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc3 +%global pre_release rc4 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif diff --git a/sources b/sources index a7d3db0..2a41d3e 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.22.0rc3.tar.xz) = fbfd87cbb874e8818061dfb5cc962e80148b8fe68ffa414c9345e70b49777b237c5f6eb633d546d12d47a3027e9da9098a7c08e91f6f87237e1515181e0b73d6 -SHA512 (samba-4.22.0rc3.tar.asc) = ba9ab3ecdd6912f302c9ba1cb8c12cce1d390c6703528796a7d75e6281d578d9bc19df7e612ebc4e6c7d58b964e0aebf108061f08da8af57668424e7ce968222 +SHA512 (samba-4.22.0rc4.tar.xz) = 050f13471a5b21db7e9bf0a68326e2a821811b3a779758e275c7bcafeebe4534c0797e6beb76335ec31ab3a1b0a97c66d62b9c87ea4585d151810a0159946aca +SHA512 (samba-4.22.0rc4.tar.asc) = f3d114f427935c3a3a5fc4e29a1ab9929163219fe0cc1a446df45cf2098a561b0765ed1ebab14e20d82b86328e2d1a8f03b565537b8e1fc539245fb93e55250c From 6744eb181dae65b117b56a7c9deae7a0cee98f23 Mon Sep 17 00:00:00 2001 From: David Abdurachmanov Date: Wed, 11 Dec 2024 17:45:11 +0200 Subject: [PATCH 370/425] Enable lmdb on riscv64 Solves configuration error: [..] Checking for a 64-bit host to support lmdb : ok Checking for lmdb >= 0.9.16 : not found Checking for header lmdb.h : no Checking for lmdb >= 0.9.16 via header check : not found Samba AD DC and --enable-selftest requires lmdb 0.9.16 or later [..] Signed-off-by: David Abdurachmanov --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 1c9b659..f40570f 100644 --- a/samba.spec +++ b/samba.spec @@ -107,7 +107,7 @@ %bcond etcd_mutex 0 %endif -%ifarch aarch64 ppc64le s390x x86_64 +%ifarch aarch64 ppc64le s390x x86_64 riscv64 %bcond lmdb 1 %else %bcond lmdb 0 From 947b0b72d5d1ec7e3f3e62b19bab6329ec182673 Mon Sep 17 00:00:00 2001 From: Andrea Bolognani Date: Tue, 25 Feb 2025 20:48:03 +0100 Subject: [PATCH 371/425] Re-enable mold on riscv64 mold didn't build successfully on riscv64 back when riscv64 support was added to samba, but that has changed since and today there is no longer any reason not to use it. Signed-off-by: Andrea Bolognani --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index f40570f..ac9f967 100644 --- a/samba.spec +++ b/samba.spec @@ -315,7 +315,7 @@ BuildRequires: zlib-devel >= 1.2.3 BuildRequires: pkgconfig(libsystemd) -%ifnarch i686 riscv64 +%ifnarch i686 %if 0%{?fedora} >= 37 BuildRequires: mold %endif From 7ebad9bdd168b4fce18a0ef2face757a5a4487ae Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 4 Mar 2025 10:41:36 +0100 Subject: [PATCH 372/425] Set version for bundled libreplace --- samba.spec | 42 +++++++++++++++++++++--------------------- 1 file changed, 21 insertions(+), 21 deletions(-) diff --git a/samba.spec b/samba.spec index ac9f967..2aa6242 100644 --- a/samba.spec +++ b/samba.spec @@ -249,7 +249,7 @@ Obsoletes: samba-swat < %{samba_depver} Provides: samba4-swat = %{samba_depver} Obsoletes: samba4-swat < %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} BuildRequires: make BuildRequires: gcc @@ -441,7 +441,7 @@ Obsoletes: samba4-client < %{samba_depver} Requires(post): %{_sbindir}/update-alternatives Requires(postun): %{_sbindir}/update-alternatives -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description client The %{name}-client package provides some SMB/CIFS clients to complement @@ -494,7 +494,7 @@ Requires: libldb = %{samba_depver} Requires: libwbclient = %{samba_depver} %endif -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %if %{without dc} && %{without testsuite} Obsoletes: samba-dc < %{samba_depver} @@ -536,7 +536,7 @@ Requires: libnetapi = %{samba_depver} Requires: libwbclient = %{samba_depver} %endif -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description common-tools The samba-common-tools package contains tools for SMB/CIFS clients. @@ -606,7 +606,7 @@ Requires: bind-utils Provides: samba4-dc = %{samba_depver} Obsoletes: samba4-dc < %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description dc The samba-dc package provides AD Domain Controller functionality @@ -634,7 +634,7 @@ Requires: libwbclient = %{samba_depver} Provides: samba4-dc-libs = %{samba_depver} Obsoletes: samba4-dc-libs < %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description dc-libs The %{name}-dc-libs package contains the libraries needed by the DC to @@ -653,7 +653,7 @@ Requires: bind Requires: libldb = %{samba_depver} Requires: libwbclient = %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description dc-bind-dlz The %{name}-dc-bind-dlz package contains the libraries for bind to manage all @@ -689,7 +689,7 @@ Requires: %{name}-libs = %{samba_depver} Requires: libldb = %{samba_depver} Requires: libwbclient = %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description vfs-cephfs Samba VFS module for Ceph distributed storage system integration. @@ -706,7 +706,7 @@ Requires: %{name}-client-libs = %{samba_depver} Requires: libldb = %{samba_depver} Requires: libwbclient = %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description vfs-iouring Samba VFS module for io_uring instance integration. @@ -731,7 +731,7 @@ Requires: libwbclient = %{samba_depver} Obsoletes: samba-glusterfs < %{samba_depver} Provides: samba-glusterfs = %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description vfs-glusterfs Samba VFS module for GlusterFS integration. @@ -791,7 +791,7 @@ Requires: libwbclient = %{samba_depver} Provides: samba4-libs = %{samba_depver} Obsoletes: samba4-libs < %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description libs The %{name}-libs package contains the libraries needed by programs that link @@ -892,7 +892,7 @@ Requires: libsmbclient = %{samba_depver} Requires: libwbclient = %{samba_depver} %endif -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description -n python3-%{name} The python3-%{name} package contains the Python 3 libraries needed by programs @@ -966,7 +966,7 @@ Requires: perl(Archive::Tar) Provides: samba4-test = %{samba_depver} Obsoletes: samba4-test < %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description test %{name}-test provides testing tools for both the server and client @@ -986,7 +986,7 @@ Requires: libwbclient = %{samba_depver} Provides: %{name}-test-devel = %{samba_depver} Obsoletes: %{name}-test-devel < %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description test-libs %{name}-test-libs provides libraries required by the testing tools. @@ -1030,7 +1030,7 @@ Obsoletes: samba4-winbind < %{samba_depver} # Old NetworkManager expects the dispatcher scripts in a different place Conflicts: NetworkManager < 1.20 -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description winbind The samba-winbind package provides the winbind NSS library, and some client @@ -1053,7 +1053,7 @@ Requires: libwbclient = %{samba_depver} Provides: samba4-winbind-clients = %{samba_depver} Obsoletes: samba4-winbind-clients < %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description winbind-clients The samba-winbind-clients package provides the wbinfo and ntlm_auth @@ -1083,7 +1083,7 @@ Requires(post): %{_sbindir}/update-alternatives Requires(postun): %{_sbindir}/update-alternatives Requires(preun): %{_sbindir}/update-alternatives -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description winbind-krb5-locator The winbind krb5 locator is a plugin for the system kerberos library to allow @@ -1099,7 +1099,7 @@ Requires: libwbclient = %{samba_depver} %endif Requires: pam -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description winbind-modules The samba-winbind-modules package provides the NSS library and a PAM module @@ -1115,7 +1115,7 @@ Requires: %{name}-common-libs = %{samba_depver} Requires: libldb = %{samba_depver} Requires: libwbclient = %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description winexe Winexe is a Remote Windows-command executor @@ -1151,7 +1151,7 @@ Requires(post): systemd-units Requires(preun): systemd-units Requires(postun): systemd-units -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description -n ctdb CTDB is a cluster implementation of the TDB database used by Samba and other @@ -1212,7 +1212,7 @@ Requires: libtevent%{?_isa} >= %{tevent_version} # /endif without includelibs %endif -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} Obsoletes: libldb < 0:2.10 Provides: libldb = 0:2.10 Provides: libldb = %{samba_depver} From 1b2e68adffe00a7f5a881cc3901106a257e847f4 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 4 Mar 2025 10:43:32 +0100 Subject: [PATCH 373/425] Add missing /run/ctdb dir to files list --- samba.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/samba.spec b/samba.spec index 2aa6242..78d3c22 100644 --- a/samba.spec +++ b/samba.spec @@ -3835,6 +3835,8 @@ fi %{_mandir}/man7/ctdb-tunables.7.gz %{_mandir}/man7/ctdb-statistics.7.gz +%ghost %dir /run/ctdb + %{_tmpfilesdir}/ctdb.conf %{_unitdir}/ctdb.service From e1991f29eccc30163711bb8f4a0192697bd3c548 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 4 Mar 2025 10:32:35 +0100 Subject: [PATCH 374/425] Set samba-usershare to noarch It only includes configuration files. --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index 78d3c22..605fedb 100644 --- a/samba.spec +++ b/samba.spec @@ -996,6 +996,7 @@ Provides: bundled(libreplace) = %{samba_depver} Summary: Provides support for non-root user shares Requires: %{name} = %{samba_depver} Requires: %{name}-common-tools = %{samba_depver} +BuildArch: noarch %description usershares Installing this package will provide a configuration file, group and From f00c21e2a89e49b9aeb5a4915869dc392f99e429 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 4 Mar 2025 11:01:51 +0100 Subject: [PATCH 375/425] Set samba-tools to noarch This only include a python scripts. --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index 605fedb..03442a5 100644 --- a/samba.spec +++ b/samba.spec @@ -556,6 +556,7 @@ Requires: lmdb Requires: tdb-tools Requires: python3-gpg %endif +BuildArch: noarch %description tools The samba-tools package contains tools for Samba servers From e4ac2d5dcb832c64a9c7ecf28fa61272d3497d16 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 4 Mar 2025 11:02:47 +0100 Subject: [PATCH 376/425] Set samba-gpupdate to noarch This only includes python scripts. --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index 03442a5..8cfd96c 100644 --- a/samba.spec +++ b/samba.spec @@ -747,6 +747,7 @@ Requires: %{name}-ldb-ldap-modules = %{samba_depver} Requires: python3-%{name} = %{samba_depver} # samba-tool needs python3-samba-dc also on non-dc build Requires: python3-%{name}-dc = %{samba_depver} +BuildArch: noarch %description gpupdate This package provides the samba-gpupdate tool to apply Group Policy Objects From 8ee5558015bd0da1c51388fb219c4fb0f608a473 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 4 Mar 2025 11:03:58 +0100 Subject: [PATCH 377/425] Set ctdb-etcd-mutex to noarch This only includes python scripts. --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index 8cfd96c..941ad1a 100644 --- a/samba.spec +++ b/samba.spec @@ -1182,6 +1182,7 @@ Performance Co-Pilot (PCP) support for CTDB Summary: CTDB ETCD mutex helper Requires: ctdb = %{samba_depver} Requires: python3-etcd +BuildArch: noarch %description -n ctdb-etcd-mutex Support for using an existing ETCD cluster as a mutex helper for CTDB From 417731acd07046213951b3614bf13d73dae3b8ee Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 4 Mar 2025 11:06:07 +0100 Subject: [PATCH 378/425] Use spaces instead of tabs for krb5-printing scripts Removes rpmlint warnings --- samba.spec | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 941ad1a..bde77c1 100644 --- a/samba.spec +++ b/samba.spec @@ -1650,12 +1650,12 @@ fi %post krb5-printing %{_sbindir}/update-alternatives --install %{_libexecdir}/samba/cups_backend_smb \ - cups_backend_smb \ - %{_libexecdir}/samba/smbspool_krb5_wrapper 50 + cups_backend_smb \ + %{_libexecdir}/samba/smbspool_krb5_wrapper 50 %postun krb5-printing if [ $1 -eq 0 ] ; then - %{_sbindir}/update-alternatives --remove cups_backend_smb %{_libexecdir}/samba/smbspool_krb5_wrapper + %{_sbindir}/update-alternatives --remove cups_backend_smb %{_libexecdir}/samba/smbspool_krb5_wrapper fi %ldconfig_scriptlets libs From 21e22997d47dd5c656e95a18ae8b8741fdf449c8 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 4 Mar 2025 14:01:29 +0100 Subject: [PATCH 379/425] Revert "Set samba-tools to noarch" This reverts commit f00c21e2a89e49b9aeb5a4915869dc392f99e429. We can't set it to noarch as koji complains that "Requires: lmdb" is present on some arches and not on others. --- samba.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/samba.spec b/samba.spec index bde77c1..bd6a4ec 100644 --- a/samba.spec +++ b/samba.spec @@ -556,7 +556,6 @@ Requires: lmdb Requires: tdb-tools Requires: python3-gpg %endif -BuildArch: noarch %description tools The samba-tools package contains tools for Samba servers From 30ff8554df8fb3435491d5959145abd59a60ecb6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 6 Mar 2025 16:10:31 +0100 Subject: [PATCH 380/425] Update to Samba 4.22.0 - resolves: rhbz#2350342 Guenther --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index bd6a4ec..d6d6e9d 100644 --- a/samba.spec +++ b/samba.spec @@ -128,7 +128,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc4 +%global pre_release %nil %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif diff --git a/sources b/sources index 2a41d3e..914331f 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.22.0rc4.tar.xz) = 050f13471a5b21db7e9bf0a68326e2a821811b3a779758e275c7bcafeebe4534c0797e6beb76335ec31ab3a1b0a97c66d62b9c87ea4585d151810a0159946aca -SHA512 (samba-4.22.0rc4.tar.asc) = f3d114f427935c3a3a5fc4e29a1ab9929163219fe0cc1a446df45cf2098a561b0765ed1ebab14e20d82b86328e2d1a8f03b565537b8e1fc539245fb93e55250c +SHA512 (samba-4.22.0.tar.xz) = 649c8808cf88e1f8df55e9df32cbb0a87afa0b5fe13b220fb5ee00506ed94f76073c9196866903a6061ea945670fc0a85f4c67940c86a18198e1cda22a75ea88 +SHA512 (samba-4.22.0.tar.asc) = 0098927156b01667d69e2850caf64156129d5da5aea557774acb43d4403d50759d48cf1c976ede4e7f312d75b639002aa1c11337e48922c7d7c5eeb0d057e900 From 0cb9860a40530163c1f6893ed04e7e4d59d5757a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 6 Mar 2025 16:23:22 +0100 Subject: [PATCH 381/425] Turn on SMB 3.1.1 Unix Extensions in default smb.conf Guenther --- smb.conf.example | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/smb.conf.example b/smb.conf.example index 4e6b5d4..271f13b 100644 --- a/smb.conf.example +++ b/smb.conf.example @@ -269,6 +269,13 @@ ; map system = no ; store dos attributes = yes +# Turn on SMB 3.1.1 Unix Extensions by default +# +# Note: The Linux Kernel SMB3 client will negotiate unix extensions by default, +# find more info in man mount.smb3(8). Linux 6.13 will finally support special +# filetypes and symlink handling. + + smb3 unix extensions = yes #============================ Share Definitions ============================== From b508f2ed7a9797fcbf82c9e2eee69832c5d20282 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 6 Mar 2025 16:23:22 +0100 Subject: [PATCH 382/425] Turn on SMB 3.1.1 Unix Extensions in vendor smb.conf as well... Guenther --- smb.conf.vendor | 2 ++ 1 file changed, 2 insertions(+) diff --git a/smb.conf.vendor b/smb.conf.vendor index e45384d..748c6e5 100644 --- a/smb.conf.vendor +++ b/smb.conf.vendor @@ -18,6 +18,8 @@ load printers = yes cups options = raw + smb3 unix extensions = yes + # Install samba-usershares package for support include = /etc/samba/usershares.conf From 40bd3a26e8685d077cf7818dbc8e3e16a2181d5c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 18 Apr 2025 02:26:37 +0200 Subject: [PATCH 383/425] Update to Samba 4.22.1 - resolves: rhbz#2360776 Guenther --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index d6d6e9d..531958b 100644 --- a/samba.spec +++ b/samba.spec @@ -113,7 +113,7 @@ %bcond lmdb 0 %endif -%global samba_version 4.22.0 +%global samba_version 4.22.1 # The release field is extended: # [.][.]%%{?dist}[.] diff --git a/sources b/sources index 914331f..8e2875d 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.22.0.tar.xz) = 649c8808cf88e1f8df55e9df32cbb0a87afa0b5fe13b220fb5ee00506ed94f76073c9196866903a6061ea945670fc0a85f4c67940c86a18198e1cda22a75ea88 -SHA512 (samba-4.22.0.tar.asc) = 0098927156b01667d69e2850caf64156129d5da5aea557774acb43d4403d50759d48cf1c976ede4e7f312d75b639002aa1c11337e48922c7d7c5eeb0d057e900 +SHA512 (samba-4.22.1.tar.xz) = 34c5e63da50ccbf68f59d8fcea23711a18374a3f6e112cb62dde86ad084a4be0857ff347c763de2ae0eb14fb9991cf226d74c522ae61571feb518cec752dca67 +SHA512 (samba-4.22.1.tar.asc) = dd574647892f992312bdfeea9f1202a0a16cef667418e9cd239c7d6cca68f4dd0f34fbafca5c2d67fbc7b8ee888ca6798c4909960ce1b7eba39d8461f29f3341 From b8a889b232cd2519d49fa87dbda960fa19f18f3e Mon Sep 17 00:00:00 2001 From: Python Maint Date: Thu, 5 Jun 2025 00:08:08 +0200 Subject: [PATCH 384/425] Rebuilt for Python 3.14 From eb8dac413e347d2b662b93045d9fcf964d6b45f7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 5 Jun 2025 19:14:20 +0200 Subject: [PATCH 385/425] Update to Samba 4.22.2 - resolves: rhbz#2370468 - resolves: rhbz#2370455 - Security fix for CVE-2025-0620 Guenther --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 531958b..a4eca83 100644 --- a/samba.spec +++ b/samba.spec @@ -113,7 +113,7 @@ %bcond lmdb 0 %endif -%global samba_version 4.22.1 +%global samba_version 4.22.2 # The release field is extended: # [.][.]%%{?dist}[.] diff --git a/sources b/sources index 8e2875d..d93d58f 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.22.1.tar.xz) = 34c5e63da50ccbf68f59d8fcea23711a18374a3f6e112cb62dde86ad084a4be0857ff347c763de2ae0eb14fb9991cf226d74c522ae61571feb518cec752dca67 -SHA512 (samba-4.22.1.tar.asc) = dd574647892f992312bdfeea9f1202a0a16cef667418e9cd239c7d6cca68f4dd0f34fbafca5c2d67fbc7b8ee888ca6798c4909960ce1b7eba39d8461f29f3341 +SHA512 (samba-4.22.2.tar.xz) = 8ce34210797e531c7624a033d4b68a424d7e698872cdac826109a66930257fad41396bca4b90d7a0fc8551ef2a640d8d8b875cf2115146360acee354d6483351 +SHA512 (samba-4.22.2.tar.asc) = 68c1dae279b732c7fcdab014fc670b6d90c0f139be53176d1275c756a30f28c86d40cd4e4edb90aab871470274ce65d58aae27e2d8eba5d5c1ebafbb192626fe From e9a8536578eda0bae0a91d467b271f5c86e033fa Mon Sep 17 00:00:00 2001 From: Python Maint Date: Fri, 6 Jun 2025 09:34:20 +0200 Subject: [PATCH 386/425] Rebuilt for Python 3.14 From 64f8b2a48455f504c8018a6f929c672170d6aa98 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 10 Jun 2025 14:08:56 +0200 Subject: [PATCH 387/425] Install /run/ctdb Fix following report: rpm --verify ctdb-0:4.22.2-3.el9.x86_64 .M....... g /run/ctdb M Mode differs (includes permissions and file type) --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index a4eca83..d044cbd 100644 --- a/samba.spec +++ b/samba.spec @@ -1439,6 +1439,7 @@ install -d -m 0755 %{buildroot}/var/lib/samba/sysvol install -d -m 0755 %{buildroot}/var/lib/samba/usershares install -d -m 0755 %{buildroot}/var/lib/samba/winbindd_privileged install -d -m 0755 %{buildroot}/var/log/samba/old +install -d -m 0755 %{buildroot}/run/ctdb install -d -m 0755 %{buildroot}/run/samba install -d -m 0755 %{buildroot}/run/winbindd install -d -m 0755 %{buildroot}/%{_libdir}/samba From ac5f4a1f4b8f3ed80469febdf56c7dd2519162cf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 10 Jun 2025 14:11:41 +0200 Subject: [PATCH 388/425] Move libreplace-private-samba.so to samba-common-libs Fix this rpmdeps report: VERIFY Subpackage libldb on x86_64 carries 'Requires: libreplace-private-samba.so()(64bit)' which comes from subpackage samba-client-libs but does not carry an explicit package version requirement. Please add 'Requires: samba-client-libs = %{version}-%{release}' to the spec file to avoid the need to test interoperability between various combinations of old and new subpackages. --- samba.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index d044cbd..68508b7 100644 --- a/samba.spec +++ b/samba.spec @@ -1212,10 +1212,10 @@ License: LGPL-3.0-or-later Requires: libtalloc%{?_isa} >= %{talloc_version} Requires: libtdb%{?_isa} >= %{tdb_version} Requires: libtevent%{?_isa} >= %{tevent_version} +Requires: samba-common-libs = %{samba_depver} # /endif without includelibs %endif -Provides: bundled(libreplace) = %{samba_depver} Obsoletes: libldb < 0:2.10 Provides: libldb = 0:2.10 Provides: libldb = %{samba_depver} @@ -1997,7 +1997,6 @@ fi %{_libdir}/samba/libposix-eadb-private-samba.so %{_libdir}/samba/libprinter-driver-private-samba.so %{_libdir}/samba/libprinting-migrate-private-samba.so -%{_libdir}/samba/libreplace-private-samba.so %{_libdir}/samba/libregistry-private-samba.so %{_libdir}/samba/libsamba-cluster-support-private-samba.so %{_libdir}/samba/libsamba-debug-private-samba.so @@ -2080,6 +2079,7 @@ fi %files common-libs # common libraries %{_libdir}/samba/libcmdline-private-samba.so +%{_libdir}/samba/libreplace-private-samba.so %dir %{_libdir}/samba/ldb From 060552411c704e9f5f965ded37e9b1c9e8373692 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 23 Jun 2025 10:14:07 +0200 Subject: [PATCH 389/425] smb.conf: Remove the '@' for NIX groups, we removed NIS support --- smb.conf.vendor | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/smb.conf.vendor b/smb.conf.vendor index 748c6e5..cbb2e0f 100644 --- a/smb.conf.vendor +++ b/smb.conf.vendor @@ -40,7 +40,8 @@ [print$] comment = Printer Drivers path = /var/lib/samba/drivers - write list = @printadmin root - force group = @printadmin + # printadmin is a local group + write list = printadmin root + force group = printadmin create mask = 0664 directory mask = 0775 From d5056e867a933be92f93c22c7e3c47f37af380b8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 8 Jul 2025 00:50:10 +0200 Subject: [PATCH 390/425] Update to Samba 4.22.3 - resolves: #2376873 Guenther --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 68508b7..f59cd87 100644 --- a/samba.spec +++ b/samba.spec @@ -113,7 +113,7 @@ %bcond lmdb 0 %endif -%global samba_version 4.22.2 +%global samba_version 4.22.3 # The release field is extended: # [.][.]%%{?dist}[.] diff --git a/sources b/sources index d93d58f..c47ad40 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.22.2.tar.xz) = 8ce34210797e531c7624a033d4b68a424d7e698872cdac826109a66930257fad41396bca4b90d7a0fc8551ef2a640d8d8b875cf2115146360acee354d6483351 -SHA512 (samba-4.22.2.tar.asc) = 68c1dae279b732c7fcdab014fc670b6d90c0f139be53176d1275c756a30f28c86d40cd4e4edb90aab871470274ce65d58aae27e2d8eba5d5c1ebafbb192626fe +SHA512 (samba-4.22.3.tar.xz) = 426f5128eefc8e96677e507d6980756e7bc70d063c62a9d38d5c33b9c3eb54aaffe1fab5432e09f50d6dfc898635952df8122b2a1a9ee45a6a01702f3c91f43c +SHA512 (samba-4.22.3.tar.asc) = 612d3bec57048168e5c0f95c2ce28daaf0dd29282ba34af26a590ff20c6187f5efaa5b717577d445df4f4752ded6f8ee139ab878b8ccb4cf41c2a38fb8b4694e From b40f280be5c9cc340c245d69dfd554891cedd4ec Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 10 Jul 2025 21:46:16 +0200 Subject: [PATCH 391/425] Fix get_kdc_ip_string handling for secondary KDCs - resolves: bzso#15881 Guenther --- samba-4.22.x-get_kdc_ip_string.patch | 34 ++++++++++++++++++++++++++++ samba.spec | 2 ++ 2 files changed, 36 insertions(+) create mode 100644 samba-4.22.x-get_kdc_ip_string.patch diff --git a/samba-4.22.x-get_kdc_ip_string.patch b/samba-4.22.x-get_kdc_ip_string.patch new file mode 100644 index 0000000..9277c9b --- /dev/null +++ b/samba-4.22.x-get_kdc_ip_string.patch @@ -0,0 +1,34 @@ +From 88572cc8f629a737a1d5b33d5800f3692895233f Mon Sep 17 00:00:00 2001 +From: Ralph Boehme +Date: Fri, 4 Jul 2025 17:50:40 +0200 +Subject: [PATCH] libads: fix get_kdc_ip_string() ... +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15881 + +Signed-off-by: Ralph Boehme +Reviewed-by: Guenther Deschner + +Autobuild-User(master): Günther Deschner +Autobuild-Date(master): Mon Jul 7 16:46:29 UTC 2025 on atb-devel-224 +--- + source3/libads/kerberos.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/source3/libads/kerberos.c b/source3/libads/kerberos.c +index 75803500d31..145bc36cdb2 100644 +--- a/source3/libads/kerberos.c ++++ b/source3/libads/kerberos.c +@@ -1230,6 +1230,7 @@ static char *get_kdc_ip_string(char *mem_ctx, + + if (!NT_STATUS_IS_OK(status)) { + DBG_DEBUG("netlogon_pings failed: %s\n", nt_errstr(status)); ++ result = talloc_move(mem_ctx, &kdc_str); + goto out; + } + +-- +2.50.0 + diff --git a/samba.spec b/samba.spec index f59cd87..7da5ef4 100644 --- a/samba.spec +++ b/samba.spec @@ -215,6 +215,8 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore +Patch0: samba-4.22.x-get_kdc_ip_string.patch + Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} From 5c93354123f7302192a52b305334853f6d2ef56d Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 25 Jul 2025 17:53:14 +0000 Subject: [PATCH 392/425] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild From ad5439e191ee3e9dab69e76b148b78207e66fb19 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Franti=C5=A1ek=20Zatloukal?= Date: Wed, 6 Aug 2025 09:57:46 +0200 Subject: [PATCH 393/425] Rebuilt for icu 77.1 From 052edc4ab62c26380f1865674a88047a41201db4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 12 Aug 2025 22:09:33 +0200 Subject: [PATCH 394/425] Update to Samba 4.23.0rc1 - resolves: #2387090 Guenther --- samba-4.22.x-get_kdc_ip_string.patch | 34 ------------ samba.spec | 78 +++++++++++++++++++++++++--- sources | 4 +- 3 files changed, 73 insertions(+), 43 deletions(-) delete mode 100644 samba-4.22.x-get_kdc_ip_string.patch diff --git a/samba-4.22.x-get_kdc_ip_string.patch b/samba-4.22.x-get_kdc_ip_string.patch deleted file mode 100644 index 9277c9b..0000000 --- a/samba-4.22.x-get_kdc_ip_string.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 88572cc8f629a737a1d5b33d5800f3692895233f Mon Sep 17 00:00:00 2001 -From: Ralph Boehme -Date: Fri, 4 Jul 2025 17:50:40 +0200 -Subject: [PATCH] libads: fix get_kdc_ip_string() ... -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15881 - -Signed-off-by: Ralph Boehme -Reviewed-by: Guenther Deschner - -Autobuild-User(master): Günther Deschner -Autobuild-Date(master): Mon Jul 7 16:46:29 UTC 2025 on atb-devel-224 ---- - source3/libads/kerberos.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/source3/libads/kerberos.c b/source3/libads/kerberos.c -index 75803500d31..145bc36cdb2 100644 ---- a/source3/libads/kerberos.c -+++ b/source3/libads/kerberos.c -@@ -1230,6 +1230,7 @@ static char *get_kdc_ip_string(char *mem_ctx, - - if (!NT_STATUS_IS_OK(status)) { - DBG_DEBUG("netlogon_pings failed: %s\n", nt_errstr(status)); -+ result = talloc_move(mem_ctx, &kdc_str); - goto out; - } - --- -2.50.0 - diff --git a/samba.spec b/samba.spec index 7da5ef4..bebd14a 100644 --- a/samba.spec +++ b/samba.spec @@ -107,13 +107,20 @@ %bcond etcd_mutex 0 %endif +# Build the prometheus exporter by default on Fedora +%if 0%{?fedora} +%bcond prometheus 1 +%else +%bcond prometheus 0 +%endif + %ifarch aarch64 ppc64le s390x x86_64 riscv64 %bcond lmdb 1 %else %bcond lmdb 0 %endif -%global samba_version 4.22.3 +%global samba_version 4.23.0 # The release field is extended: # [.][.]%%{?dist}[.] @@ -128,7 +135,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release %nil +%global pre_release rc1 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif @@ -159,8 +166,8 @@ %global libwbclient_so_version 0 %global talloc_version 2.4.3 -%global tdb_version 1.4.13 -%global tevent_version 0.16.2 +%global tdb_version 1.4.14 +%global tevent_version 0.17.1 %global required_mit_krb5 1.20.1 @@ -215,8 +222,6 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore -Patch0: samba-4.22.x-get_kdc_ip_string.patch - Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} @@ -345,6 +350,9 @@ BuildRequires: librados-devel %if %{with etcd_mutex} BuildRequires: python3-etcd %endif +%if %{with prometheus} +BuildRequires: libevent-devel +%endif BuildRequires: cepces-certmonger >= 0.3.8 @@ -1206,6 +1214,18 @@ Support for using an existing CEPH cluster as a mutex helper for CTDB #endif with clustering %endif +%if %{with prometheus} + +%package prometheus +Summary: SMB Prometheus exporter +Requires: samba = %{samba_depver} + +%description prometheus +Support for exporting metrics via Prometheus + +#endif with prometheus +%endif + ### LIBLDB %package -n libldb Summary: A schema-less, ldap like, API and database @@ -1357,6 +1377,8 @@ if [ -n "${CCACHE}" ]; then fi %endif +# workaround https://gitlab.com/ita1024/waf/-/issues/2472 +export PYTHONARCHDIR=%{python3_sitearch} %configure \ --enable-fhs \ --with-piddir=/run \ @@ -1396,6 +1418,9 @@ fi %endif %if %{with etcd_mutex} --enable-etcd-reclock \ +%endif +%if %{with prometheus} + --with-prometheus-exporter \ %endif --with-profiling-data \ --with-systemd \ @@ -1995,22 +2020,25 @@ fi %{_libdir}/samba/libndr-samba4-private-samba.so %{_libdir}/samba/libnet-keytab-private-samba.so %{_libdir}/samba/libnetif-private-samba.so +%{_libdir}/samba/libngtcp2-crypto-gnutls-private-samba.so +%{_libdir}/samba/libngtcp2-private-samba.so %{_libdir}/samba/libnpa-tstream-private-samba.so %{_libdir}/samba/libposix-eadb-private-samba.so %{_libdir}/samba/libprinter-driver-private-samba.so %{_libdir}/samba/libprinting-migrate-private-samba.so +%{_libdir}/samba/libquic-private-samba.so %{_libdir}/samba/libregistry-private-samba.so %{_libdir}/samba/libsamba-cluster-support-private-samba.so %{_libdir}/samba/libsamba-debug-private-samba.so %{_libdir}/samba/libsamba-modules-private-samba.so %{_libdir}/samba/libsamba-security-private-samba.so +%{_libdir}/samba/libsamba-security-trusts-private-samba.so %{_libdir}/samba/libsamba-sockets-private-samba.so %{_libdir}/samba/libsamba3-util-private-samba.so %{_libdir}/samba/libsamdb-common-private-samba.so %{_libdir}/samba/libsecrets3-private-samba.so %{_libdir}/samba/libserver-id-db-private-samba.so %{_libdir}/samba/libserver-role-private-samba.so -%{_libdir}/samba/libsmb-transport-private-samba.so %{_libdir}/samba/libsmbclient-raw-private-samba.so %{_libdir}/samba/libsmbd-base-private-samba.so %{_libdir}/samba/libsmbd-shim-private-samba.so @@ -2106,6 +2134,7 @@ fi %{_mandir}/man8/net.8* %{_mandir}/man8/pdbedit.8* %{_mandir}/man8/smbpasswd.8* +%{_datadir}/locale/*/LC_MESSAGES/net.mo ### TOOLS %files tools @@ -2228,6 +2257,7 @@ fi %{_libdir}/samba/service/dns.so %{_libdir}/samba/service/dns_update.so %{_libdir}/samba/service/drepl.so +%{_libdir}/samba/service/ft_scanner.so %{_libdir}/samba/service/kcc.so %{_libdir}/samba/service/kdc.so %{_libdir}/samba/service/ldap.so @@ -2580,6 +2610,7 @@ fi %{python3_sitearch}/samba/dcerpc/atsvc.*.so %{python3_sitearch}/samba/dcerpc/auth.*.so %{python3_sitearch}/samba/dcerpc/base.*.so +%{python3_sitearch}/samba/dcerpc/bcrypt_rsakey_blob.*.so %{python3_sitearch}/samba/dcerpc/claims.*.so %{python3_sitearch}/samba/dcerpc/conditional_ace.*.so %{python3_sitearch}/samba/dcerpc/dcerpc.*.so @@ -2595,6 +2626,7 @@ fi %{python3_sitearch}/samba/dcerpc/idmap.*.so %{python3_sitearch}/samba/dcerpc/initshutdown.*.so %{python3_sitearch}/samba/dcerpc/irpc.*.so +%{python3_sitearch}/samba/dcerpc/keycredlink.*.so %{python3_sitearch}/samba/dcerpc/krb5ccache.*.so %{python3_sitearch}/samba/dcerpc/krb5pac.*.so %{python3_sitearch}/samba/dcerpc/lsa.*.so @@ -2616,6 +2648,7 @@ fi %{python3_sitearch}/samba/dcerpc/spoolss.*.so %{python3_sitearch}/samba/dcerpc/srvsvc.*.so %{python3_sitearch}/samba/dcerpc/svcctl.*.so +%{python3_sitearch}/samba/dcerpc/tpm20_rsakey_blob.*.so %{python3_sitearch}/samba/dcerpc/unixinfo.*.so %{python3_sitearch}/samba/dcerpc/winbind.*.so %{python3_sitearch}/samba/dcerpc/windows_event_ids.*.so @@ -3119,6 +3152,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/auth_log_netlogon_bad_creds.*.pyc %{python3_sitearch}/samba/tests/__pycache__/auth_log_samlogon.*.pyc %{python3_sitearch}/samba/tests/__pycache__/auth_log_winbind.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/bcrypt_rsakey_blob.*.pyc %{python3_sitearch}/samba/tests/__pycache__/common.*.pyc %{python3_sitearch}/samba/tests/__pycache__/complex_expressions.*.pyc %{python3_sitearch}/samba/tests/__pycache__/compression.*.pyc @@ -3160,6 +3194,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/hostconfig.*.pyc %{python3_sitearch}/samba/tests/__pycache__/imports.*.pyc %{python3_sitearch}/samba/tests/__pycache__/join.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/key_credential_link.*.pyc %{python3_sitearch}/samba/tests/__pycache__/krb5_credentials.*.pyc %{python3_sitearch}/samba/tests/__pycache__/ldap_raw.*.pyc %{python3_sitearch}/samba/tests/__pycache__/ldap_referrals.*.pyc @@ -3237,6 +3272,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/subunitrun.*.pyc %{python3_sitearch}/samba/tests/__pycache__/tdb_util.*.pyc %{python3_sitearch}/samba/tests/__pycache__/token_factory.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/tpm20_rsakey_blob.*.pyc %{python3_sitearch}/samba/tests/__pycache__/upgrade.*.pyc %{python3_sitearch}/samba/tests/__pycache__/upgradeprovision.*.pyc %{python3_sitearch}/samba/tests/__pycache__/upgradeprovisionneeddc.*.pyc @@ -3254,6 +3290,7 @@ fi %{python3_sitearch}/samba/tests/auth_log_pass_change.py %{python3_sitearch}/samba/tests/auth_log_samlogon.py %{python3_sitearch}/samba/tests/auth_log_winbind.py +%{python3_sitearch}/samba/tests/bcrypt_rsakey_blob.py %dir %{python3_sitearch}/samba/tests/blackbox %{python3_sitearch}/samba/tests/blackbox/__init__.py %dir %{python3_sitearch}/samba/tests/blackbox/__pycache__ @@ -3414,6 +3451,7 @@ fi %{python3_sitearch}/samba/tests/kcc/graph_utils.py %{python3_sitearch}/samba/tests/kcc/kcc_utils.py %{python3_sitearch}/samba/tests/kcc/ldif_import_export.py +%{python3_sitearch}/samba/tests/key_credential_link.py %dir %{python3_sitearch}/samba/tests/krb5 %dir %{python3_sitearch}/samba/tests/krb5/__pycache__ %{python3_sitearch}/samba/tests/krb5/__pycache__/alias_tests.*.pyc @@ -3529,6 +3567,12 @@ fi %{python3_sitearch}/samba/tests/net_join_no_spnego.py %{python3_sitearch}/samba/tests/net_join.py %{python3_sitearch}/samba/tests/netlogonsvc.py +%dir %{python3_sitearch}/samba/tests/nss +%dir %{python3_sitearch}/samba/tests/nss/__pycache__ +%{python3_sitearch}/samba/tests/nss/__pycache__/base.*.pyc +%{python3_sitearch}/samba/tests/nss/__pycache__/group.*.pyc +%{python3_sitearch}/samba/tests/nss/base.py +%{python3_sitearch}/samba/tests/nss/group.py %{python3_sitearch}/samba/tests/ntacls.py %{python3_sitearch}/samba/tests/ntacls_backup.py %{python3_sitearch}/samba/tests/ntlmdisabled.py @@ -3689,10 +3733,21 @@ fi %{python3_sitearch}/samba/tests/subunitrun.py %{python3_sitearch}/samba/tests/tdb_util.py %{python3_sitearch}/samba/tests/token_factory.py +%{python3_sitearch}/samba/tests/tpm20_rsakey_blob.py %{python3_sitearch}/samba/tests/upgrade.py %{python3_sitearch}/samba/tests/upgradeprovision.py %{python3_sitearch}/samba/tests/upgradeprovisionneeddc.py %{python3_sitearch}/samba/tests/usage.py +%dir %{python3_sitearch}/samba/tests/varlink +%dir %{python3_sitearch}/samba/tests/varlink/__pycache__ +%{python3_sitearch}/samba/tests/varlink/__pycache__/base.*.pyc +%{python3_sitearch}/samba/tests/varlink/__pycache__/getgrouprecord.*.pyc +%{python3_sitearch}/samba/tests/varlink/__pycache__/getmemberships.*.pyc +%{python3_sitearch}/samba/tests/varlink/__pycache__/getuserrecord.*.pyc +%{python3_sitearch}/samba/tests/varlink/base.py +%{python3_sitearch}/samba/tests/varlink/getgrouprecord.py +%{python3_sitearch}/samba/tests/varlink/getmemberships.py +%{python3_sitearch}/samba/tests/varlink/getuserrecord.py %{python3_sitearch}/samba/tests/xattr.py ### TEST @@ -3761,6 +3816,7 @@ fi %config(noreplace) %{_sysconfdir}/security/pam_winbind.conf %{_mandir}/man5/pam_winbind.conf.5* %{_mandir}/man8/pam_winbind.8* +%{_datadir}/locale/*/LC_MESSAGES/pam_winbind.mo %if %{with clustering} %files -n ctdb @@ -3910,6 +3966,13 @@ fi %{_mandir}/man1/winexe.1.gz %endif +%if %{with prometheus} +%files prometheus +%{_bindir}/smb_prometheus_endpoint +%{_mandir}/man8/smb_prometheus_endpoint.8.gz +#endif with prometheus + +%endif %files -n libldb %license lib/ldb/LICENSE %{_libdir}/libldb.so.* @@ -3933,6 +3996,7 @@ fi %{_libdir}/samba/ldb/server_sort.so %{_libdir}/samba/ldb/skel.so %{_libdir}/samba/ldb/tdb.so +%{_libdir}/samba/ldb/trust_notify.so %files -n libldb-devel %{_includedir}/samba-4.0/ldb_module.h diff --git a/sources b/sources index c47ad40..ddc3910 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.22.3.tar.xz) = 426f5128eefc8e96677e507d6980756e7bc70d063c62a9d38d5c33b9c3eb54aaffe1fab5432e09f50d6dfc898635952df8122b2a1a9ee45a6a01702f3c91f43c -SHA512 (samba-4.22.3.tar.asc) = 612d3bec57048168e5c0f95c2ce28daaf0dd29282ba34af26a590ff20c6187f5efaa5b717577d445df4f4752ded6f8ee139ab878b8ccb4cf41c2a38fb8b4694e +SHA512 (samba-4.23.0rc1.tar.xz) = 6472b7445c138abb69185954c2ba86164fa500d8e267cf26ca6208f78599abcd6af282c19a7609cb72dc2d40d68956cdef3599d27dbf7e30d6b9b1f02d0cddea +SHA512 (samba-4.23.0rc1.tar.asc) = 56c9f8a4357599c52ad62e5ddf342c7e0eee4eb3f3c874f77280f06684e00aaf19d3a6d8bea9da8e63f8f79c4f6f28b0bdf3997dbe5213b17b3b4679e5fe5441 From c2bf86b8d2dc38adaded41822a69127cce364e47 Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Sun, 17 Aug 2025 23:05:41 -0400 Subject: [PATCH 395/425] Move trust_notify module to -dc subpackage This module is not built in ELN, resulting in a file not found error when packaging libldb. Its build conditions are the same as the dns_notify module already in -dc. --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index bebd14a..5811a12 100644 --- a/samba.spec +++ b/samba.spec @@ -2212,6 +2212,7 @@ fi %{_libdir}/samba/ldb/subtree_delete.so %{_libdir}/samba/ldb/subtree_rename.so %{_libdir}/samba/ldb/tombstone_reanimate.so +%{_libdir}/samba/ldb/trust_notify.so %{_libdir}/samba/ldb/unique_object_sids.so %{_libdir}/samba/ldb/update_keytab.so %{_libdir}/samba/ldb/vlv.so @@ -3996,7 +3997,6 @@ fi %{_libdir}/samba/ldb/server_sort.so %{_libdir}/samba/ldb/skel.so %{_libdir}/samba/ldb/tdb.so -%{_libdir}/samba/ldb/trust_notify.so %files -n libldb-devel %{_includedir}/samba-4.0/ldb_module.h From c108db5e55fd5b9b4e9a5b8062744e4b7796dac6 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Mon, 18 Aug 2025 13:57:35 +0200 Subject: [PATCH 396/425] Rebuilt for Python 3.14.0rc2 bytecode From e6a975e42205afdb48c4c0e56c7ae97d61630788 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 22 Aug 2025 21:51:03 +0200 Subject: [PATCH 397/425] Update to Samba 4.23.0rc2 - resolves: #2387090 Guenther --- samba.spec | 5 +++-- sources | 4 ++-- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/samba.spec b/samba.spec index 5811a12..76df67c 100644 --- a/samba.spec +++ b/samba.spec @@ -102,7 +102,8 @@ # Build the etcd helpers by default on Fedora %if 0%{?fedora} -%bcond etcd_mutex 1 +# disable etcd mutex helper as etcd is orphaned in Fedora now +%bcond etcd_mutex 0 %else %bcond etcd_mutex 0 %endif @@ -135,7 +136,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc1 +%global pre_release rc2 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif diff --git a/sources b/sources index ddc3910..24013e1 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.23.0rc1.tar.xz) = 6472b7445c138abb69185954c2ba86164fa500d8e267cf26ca6208f78599abcd6af282c19a7609cb72dc2d40d68956cdef3599d27dbf7e30d6b9b1f02d0cddea -SHA512 (samba-4.23.0rc1.tar.asc) = 56c9f8a4357599c52ad62e5ddf342c7e0eee4eb3f3c874f77280f06684e00aaf19d3a6d8bea9da8e63f8f79c4f6f28b0bdf3997dbe5213b17b3b4679e5fe5441 +SHA512 (samba-4.23.0rc2.tar.xz) = 44c8fab0523038270295b1d4ea9d535df04deb91dfe08680e1bde0b621eb6146ff9157ec97e9c0f0fb95ae33aaf66903a192b486b2df35899b6c5d4a57e09ee9 +SHA512 (samba-4.23.0rc2.tar.asc) = 7bdc54eb7bf4736123ea889f18ff0aa29eca91d2ab25fbfaeed431a0c7d193167526312bf051e58c70d2d9de0dfa9a5cdc9d8177f6f144c1b2d32c8ed2d0631d From 83273a97b1fb10bb6db374215af67549ef94637a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 29 Aug 2025 23:32:47 +0200 Subject: [PATCH 398/425] Update to Samba 4.23.0rc3 - resolves: #2387090 Guenther --- samba.spec | 4 +++- sources | 4 ++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 76df67c..3e1a5fd 100644 --- a/samba.spec +++ b/samba.spec @@ -136,7 +136,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc2 +%global pre_release rc3 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif @@ -3361,6 +3361,7 @@ fi %{python3_sitearch}/samba/tests/dcerpc/__pycache__/array.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/bare.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/binding.*.pyc +%{python3_sitearch}/samba/tests/dcerpc/__pycache__/dfs.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/dnsserver.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/integer.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/lsa.*.pyc @@ -3381,6 +3382,7 @@ fi %{python3_sitearch}/samba/tests/dcerpc/array.py %{python3_sitearch}/samba/tests/dcerpc/bare.py %{python3_sitearch}/samba/tests/dcerpc/binding.py +%{python3_sitearch}/samba/tests/dcerpc/dfs.py %{python3_sitearch}/samba/tests/dcerpc/dnsserver.py %{python3_sitearch}/samba/tests/dcerpc/integer.py %{python3_sitearch}/samba/tests/dcerpc/lsa.py diff --git a/sources b/sources index 24013e1..168a85d 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.23.0rc2.tar.xz) = 44c8fab0523038270295b1d4ea9d535df04deb91dfe08680e1bde0b621eb6146ff9157ec97e9c0f0fb95ae33aaf66903a192b486b2df35899b6c5d4a57e09ee9 -SHA512 (samba-4.23.0rc2.tar.asc) = 7bdc54eb7bf4736123ea889f18ff0aa29eca91d2ab25fbfaeed431a0c7d193167526312bf051e58c70d2d9de0dfa9a5cdc9d8177f6f144c1b2d32c8ed2d0631d +SHA512 (samba-4.23.0rc3.tar.xz) = 1e8b9bec0e42d387a0b4665d395ec63bcb9b84353c62be0ed253dfe79c1ff44f13a8a1825f2a1eba4c8f209cae55e0b3ed7f89b39884ec73b05383b0008a5249 +SHA512 (samba-4.23.0rc3.tar.asc) = 727d328c0f4bd075d927bcfdb86083c3e6e9f066c938d5232e655c676d78f936453bc0d39bf271d0f8371f33e8ffe30aa376ad6461ca0be8d34ebca01553c3ab From a6119e2bb3d77153a87af9be96ca2140a9da6316 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Tue, 2 Sep 2025 10:47:58 +0300 Subject: [PATCH 399/425] Fix FreeIPA trust to AD - resolves: rhbz#2392626 Signed-off-by: Alexander Bokovoy --- samba-bz15902.patch | 167 ++++++++++++++++++++++++++++++++++++++++++++ samba.spec | 1 + 2 files changed, 168 insertions(+) create mode 100644 samba-bz15902.patch diff --git a/samba-bz15902.patch b/samba-bz15902.patch new file mode 100644 index 0000000..659eecc --- /dev/null +++ b/samba-bz15902.patch @@ -0,0 +1,167 @@ +From 00b900e82ac0d859562ec88825975a2d9fbe1040 Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Tue, 2 Sep 2025 10:36:11 +0300 +Subject: [PATCH] krb5: handle GSS-Proxy credentials lifetime +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +GSS-Proxy stores its credential in encrypted form in the Kerberos ccache +with a start and end time of 0 and a server principal in the realm named +'X-GSSPROXY:'. This credential is accessed through GSS-Proxy interposer +mechanism in MIT Kerberos and cannot be analysed with raw krb5 API. + +As MIT Kerberos has no krb5_cc_get_lifetime() implementation, add check +for the GSS-Proxy credential to smb_krb5_cc_get_lifetime() wrapper to +return KRB5_PLUGIN_NO_HANDLE. The two places where +smb_krb5_cc_get_lifetime() is used then handle this return code to avoid +deciding on the 'expired' lifetime to cause a kinit. + +This fixes FreeIPA use case where an IPA API endpoint uses Samba Python +bindings with a GSS-Proxy-controlled credential cache. + +Bug: https://bugzilla.samba.org/show_bug.cgi?id=15902 + +Signed-off-by: Alexander Bokovoy +Reviewed-by: Pavel Filipenský + +Autobuild-User(master): Pavel Filipensky +Autobuild-Date(master): Wed Sep 3 10:15:50 UTC 2025 on atb-devel-224 + +(cherry picked from commit c00b98ad840706cda222bb610d0d4860b98c72d4) +--- + auth/credentials/credentials_krb5.c | 36 +++++++++++++++++++++-------- + lib/krb5_wrap/krb5_samba.c | 35 ++++++++++++++++++++++++++-- + 2 files changed, 59 insertions(+), 12 deletions(-) + +diff --git a/auth/credentials/credentials_krb5.c b/auth/credentials/credentials_krb5.c +index 4dc7e7be67e..8d289e26781 100644 +--- a/auth/credentials/credentials_krb5.c ++++ b/auth/credentials/credentials_krb5.c +@@ -687,7 +687,14 @@ _PUBLIC_ int cli_credentials_get_named_ccache(struct cli_credentials *cred, + bool kinit_required = false; + ret = smb_krb5_cc_get_lifetime(cred->ccache->smb_krb5_context->krb5_context, + cred->ccache->ccache, &lifetime); +- if (ret == KRB5_CC_END || ret == ENOENT) { ++ if (ret == KRB5_PLUGIN_NO_HANDLE) { ++ /* ++ * KRB5_PLUGIN_NO_HANDLE is a special case of the encrypted ++ * GSSProxy credential. We don't know its lifetime but assume it ++ * is a valid one. Acquiring it will show the lifetime. ++ */ ++ kinit_required = false; ++ } else if (ret == KRB5_CC_END || ret == ENOENT) { + kinit_required = true; + } else if (ret == 0) { + if (lifetime == 0) { +@@ -800,18 +807,27 @@ _PUBLIC_ bool cli_credentials_get_ccache_name_obtained( + if (ret == KRB5_CC_END || ret == ENOENT) { + return false; + } +- if (ret != 0) { ++ ++ /* ++ * KRB5_PLUGIN_NO_HANDLE is a special case of the encrypted ++ * GSSProxy credential. We don't know its lifetime but assume it ++ * is a valid one. Acquiring it will show the lifetime. ++ * */ ++ if (ret != 0 && ret != KRB5_PLUGIN_NO_HANDLE) { + return false; + } +- if (lifetime == 0) { +- return false; +- } else if (lifetime < 300) { +- if (cred->password_obtained >= cred->ccache_obtained) { +- /* +- * we have a password to re-kinit +- * so let the caller try that. +- */ ++ ++ if (ret == 0) { ++ if (lifetime == 0) { + return false; ++ } else if (lifetime < 300) { ++ if (cred->password_obtained >= cred->ccache_obtained) { ++ /* ++ * we have a password to re-kinit ++ * so let the caller try that. ++ */ ++ return false; ++ } + } + } + +diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c +index f9d91a4f0c1..dcf91348d1a 100644 +--- a/lib/krb5_wrap/krb5_samba.c ++++ b/lib/krb5_wrap/krb5_samba.c +@@ -3025,6 +3025,8 @@ krb5_error_code smb_krb5_cc_get_lifetime(krb5_context context, + krb5_creds cred; + krb5_timestamp endtime = 0; + krb5_timestamp now; ++ char *realm = NULL; ++ TALLOC_CTX *mem_ctx = NULL; + + *t = 0; + +@@ -3038,12 +3040,37 @@ krb5_error_code smb_krb5_cc_get_lifetime(krb5_context context, + return kerr; + } + ++ mem_ctx = talloc_stackframe(); ++ if (mem_ctx == NULL) { ++ krb5_cc_end_seq_get(context, id, &cursor); ++ return ENOMEM; ++ } ++ + while ((kerr = krb5_cc_next_cred(context, id, &cursor, &cred)) == 0) { + if (krb5_is_config_principal(context, cred.server)) { + krb5_free_cred_contents(context, &cred); + continue; + } + ++ realm = smb_krb5_principal_get_realm(mem_ctx, context, cred.server); ++ if (realm == NULL) { ++ krb5_free_cred_contents(context, &cred); ++ kerr = ENOMEM; ++ break; ++ } ++ ++ /* ++ * 'X-GSSPROXY:' is the realm for an encrypted credential stored ++ * by the GSSProxy. There are no other creds in such ccache and ++ * we cannot see the actual lifetime (it is set to 0), ++ * indicate to the caller they need to handle this themselves. ++ */ ++ if (strcmp(realm, "X-GSSPROXY:") == 0) { ++ krb5_free_cred_contents(context, &cred); ++ kerr = KRB5_PLUGIN_NO_HANDLE; ++ break; ++ } ++ + #ifndef HAVE_FLAGS_IN_KRB5_CREDS + if (cred.ticket_flags & TKT_FLG_INITIAL) { + #else +@@ -3073,13 +3100,17 @@ krb5_error_code smb_krb5_cc_get_lifetime(krb5_context context, + krb5_free_cred_contents(context, &cred); + } + ++ krb5_cc_end_seq_get(context, id, &cursor); ++ talloc_free(mem_ctx); ++ if (kerr == ENOMEM || kerr == KRB5_PLUGIN_NO_HANDLE) { ++ return kerr; ++ } ++ + if (now < endtime) { + *t = (time_t) (endtime - now); + kerr = 0; + } + +- krb5_cc_end_seq_get(context, id, &cursor); +- + return kerr; + } + #endif /* HAVE_KRB5_CC_GET_LIFETIME */ +-- +2.51.0 + diff --git a/samba.spec b/samba.spec index 3e1a5fd..aa68a70 100644 --- a/samba.spec +++ b/samba.spec @@ -222,6 +222,7 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore +Patch0: samba-bz15902.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} From 5a96c9042742117afd7b42a742495e578ae06db4 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Wed, 3 Sep 2025 15:44:06 +0300 Subject: [PATCH 400/425] Disable PCP 7.0.0 support PCP 7.0.0 API has changed, needs more work in ctdb https://bugzilla.samba.org/show_bug.cgi?id=15904 - resolves: rhbz#2392879 Signed-off-by: Alexander Bokovoy --- samba-pcp-7.0.0.patch | 63 +++++++++++++++++++++++++++++++++++++++++++ samba.spec | 3 +++ 2 files changed, 66 insertions(+) create mode 100644 samba-pcp-7.0.0.patch diff --git a/samba-pcp-7.0.0.patch b/samba-pcp-7.0.0.patch new file mode 100644 index 0000000..953bc46 --- /dev/null +++ b/samba-pcp-7.0.0.patch @@ -0,0 +1,63 @@ +From edede7256f7bfa25186e22b3c5f1aab9a56ac141 Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Wed, 3 Sep 2025 15:42:46 +0300 +Subject: [PATCH] ctdb/wscript: fix build against PCP 7.0.0 + +Signed-off-by: Alexander Bokovoy +--- + ctdb/utils/pmda/pmda_ctdb.c | 4 ++++ + ctdb/wscript | 20 +++++++++----------- + 2 files changed, 13 insertions(+), 11 deletions(-) + +diff --git a/ctdb/utils/pmda/pmda_ctdb.c b/ctdb/utils/pmda/pmda_ctdb.c +index 7ac8a3b38d1..a8d6704c8a9 100644 +--- a/ctdb/utils/pmda/pmda_ctdb.c ++++ b/ctdb/utils/pmda/pmda_ctdb.c +@@ -39,9 +39,13 @@ + + #define pmID_cluster(id) id->cluster + #define pmID_item(id) id->item ++#ifndef pmGetProgname + #define pmGetProgname() pmProgname ++#endif ++#ifndef pmSetProgname + #define pmSetProgname(a) __pmSetProgname(a) + #endif ++#endif + + #include "domain.h" + +diff --git a/ctdb/wscript b/ctdb/wscript +index e9cd89436a3..15dedb1c432 100644 +--- a/ctdb/wscript ++++ b/ctdb/wscript +@@ -226,17 +226,15 @@ def configure(conf): + + have_pmda = False + if Options.options.ctdb_pmda: +- pmda_support = True +- +- if not conf.CHECK_HEADERS('pcp/pmapi.h pcp/impl.h pcp/pmda.h', +- together=True): +- pmda_support = False +- if not conf.CHECK_FUNCS_IN('pmProgname', 'pcp'): +- pmda_support = False +- if not conf.CHECK_FUNCS_IN('pmdaDaemon', 'pcp_pmda'): +- pmda_support = False +- if pmda_support: +- conf.CHECK_TYPE_IN('__pmID_int', 'pcp/pmapi.h pcp/impl.h') ++ checks = [conf.CHECK_HEADERS('pcp/pmapi.h pcp/impl.h pcp/pmda.h', ++ together=True), ++ conf.CHECK_FUNCS_IN('pmdaDaemon', 'pcp_pmda')] ++ ++ have_progname = [conf.CHECK_FUNCS_IN('pmProgname', 'pcp'), ++ conf.CHECK_FUNCS_IN('pmGetProgname', 'pcp')] ++ ++ if all(checks) and any(have_progname): ++ conf.CHECK_TYPE_IN('__pmID_int', 'libpcp.h pcp/pmapi.h pcp/impl.h') + have_pmda = True + else: + Logs.error("PMDA support not available") +-- +2.51.0 + diff --git a/samba.spec b/samba.spec index aa68a70..8a8a21e 100644 --- a/samba.spec +++ b/samba.spec @@ -94,8 +94,10 @@ # pcp is no longer supported %if 0%{?fedora} %ifnarch i686 +%if 0%{?fedora} < 43 %bcond pcp_pmda 1 %endif +%endif %else %bcond pcp_pmda 0 %endif @@ -223,6 +225,7 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore Patch0: samba-bz15902.patch +Patch1: samba-pcp-7.0.0.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} From beb6a110890db1bd1c6d5f1ef7602cc21d84ec6b Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Thu, 4 Sep 2025 09:25:26 +0300 Subject: [PATCH 401/425] Restore PCP support - resolves: rhbz#2392879 Signed-off-by: Alexander Bokovoy --- samba-pcp-7.0.0.patch | 17 +++++++++++++---- samba.spec | 2 -- 2 files changed, 13 insertions(+), 6 deletions(-) diff --git a/samba-pcp-7.0.0.patch b/samba-pcp-7.0.0.patch index 953bc46..1b2c6a5 100644 --- a/samba-pcp-7.0.0.patch +++ b/samba-pcp-7.0.0.patch @@ -1,16 +1,16 @@ -From edede7256f7bfa25186e22b3c5f1aab9a56ac141 Mon Sep 17 00:00:00 2001 +From 4b74db174b92e00eb4c342c77adcb8140851d025 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Wed, 3 Sep 2025 15:42:46 +0300 Subject: [PATCH] ctdb/wscript: fix build against PCP 7.0.0 Signed-off-by: Alexander Bokovoy --- - ctdb/utils/pmda/pmda_ctdb.c | 4 ++++ + ctdb/utils/pmda/pmda_ctdb.c | 6 +++++- ctdb/wscript | 20 +++++++++----------- - 2 files changed, 13 insertions(+), 11 deletions(-) + 2 files changed, 14 insertions(+), 12 deletions(-) diff --git a/ctdb/utils/pmda/pmda_ctdb.c b/ctdb/utils/pmda/pmda_ctdb.c -index 7ac8a3b38d1..a8d6704c8a9 100644 +index 7ac8a3b38d1..75ae1079dc4 100644 --- a/ctdb/utils/pmda/pmda_ctdb.c +++ b/ctdb/utils/pmda/pmda_ctdb.c @@ -39,9 +39,13 @@ @@ -27,6 +27,15 @@ index 7ac8a3b38d1..a8d6704c8a9 100644 #include "domain.h" +@@ -450,7 +454,7 @@ err_out: + * instance domain evaluation. + */ + static int +-pmda_ctdb_fetch(int numpmid, pmID pmidlist[], pmResult **resp, pmdaExt *pmda) ++pmda_ctdb_fetch(int numpmid, pmID pmidlist[], pmdaResult **resp, pmdaExt *pmda) + { + int ret; + diff --git a/ctdb/wscript b/ctdb/wscript index e9cd89436a3..15dedb1c432 100644 --- a/ctdb/wscript diff --git a/samba.spec b/samba.spec index 8a8a21e..1d9ef9a 100644 --- a/samba.spec +++ b/samba.spec @@ -94,10 +94,8 @@ # pcp is no longer supported %if 0%{?fedora} %ifnarch i686 -%if 0%{?fedora} < 43 %bcond pcp_pmda 1 %endif -%endif %else %bcond pcp_pmda 0 %endif From e0762b936f9c379833168f93bde983aa8b82131c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 10 Sep 2025 10:28:22 +0200 Subject: [PATCH 402/425] Update to Samba 4.23.0rc4 - resolves: #2393434 Guenther --- samba-bz15902.patch | 167 -------------------------------------------- samba.spec | 5 +- sources | 4 +- 3 files changed, 4 insertions(+), 172 deletions(-) delete mode 100644 samba-bz15902.patch diff --git a/samba-bz15902.patch b/samba-bz15902.patch deleted file mode 100644 index 659eecc..0000000 --- a/samba-bz15902.patch +++ /dev/null @@ -1,167 +0,0 @@ -From 00b900e82ac0d859562ec88825975a2d9fbe1040 Mon Sep 17 00:00:00 2001 -From: Alexander Bokovoy -Date: Tue, 2 Sep 2025 10:36:11 +0300 -Subject: [PATCH] krb5: handle GSS-Proxy credentials lifetime -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -GSS-Proxy stores its credential in encrypted form in the Kerberos ccache -with a start and end time of 0 and a server principal in the realm named -'X-GSSPROXY:'. This credential is accessed through GSS-Proxy interposer -mechanism in MIT Kerberos and cannot be analysed with raw krb5 API. - -As MIT Kerberos has no krb5_cc_get_lifetime() implementation, add check -for the GSS-Proxy credential to smb_krb5_cc_get_lifetime() wrapper to -return KRB5_PLUGIN_NO_HANDLE. The two places where -smb_krb5_cc_get_lifetime() is used then handle this return code to avoid -deciding on the 'expired' lifetime to cause a kinit. - -This fixes FreeIPA use case where an IPA API endpoint uses Samba Python -bindings with a GSS-Proxy-controlled credential cache. - -Bug: https://bugzilla.samba.org/show_bug.cgi?id=15902 - -Signed-off-by: Alexander Bokovoy -Reviewed-by: Pavel Filipenský - -Autobuild-User(master): Pavel Filipensky -Autobuild-Date(master): Wed Sep 3 10:15:50 UTC 2025 on atb-devel-224 - -(cherry picked from commit c00b98ad840706cda222bb610d0d4860b98c72d4) ---- - auth/credentials/credentials_krb5.c | 36 +++++++++++++++++++++-------- - lib/krb5_wrap/krb5_samba.c | 35 ++++++++++++++++++++++++++-- - 2 files changed, 59 insertions(+), 12 deletions(-) - -diff --git a/auth/credentials/credentials_krb5.c b/auth/credentials/credentials_krb5.c -index 4dc7e7be67e..8d289e26781 100644 ---- a/auth/credentials/credentials_krb5.c -+++ b/auth/credentials/credentials_krb5.c -@@ -687,7 +687,14 @@ _PUBLIC_ int cli_credentials_get_named_ccache(struct cli_credentials *cred, - bool kinit_required = false; - ret = smb_krb5_cc_get_lifetime(cred->ccache->smb_krb5_context->krb5_context, - cred->ccache->ccache, &lifetime); -- if (ret == KRB5_CC_END || ret == ENOENT) { -+ if (ret == KRB5_PLUGIN_NO_HANDLE) { -+ /* -+ * KRB5_PLUGIN_NO_HANDLE is a special case of the encrypted -+ * GSSProxy credential. We don't know its lifetime but assume it -+ * is a valid one. Acquiring it will show the lifetime. -+ */ -+ kinit_required = false; -+ } else if (ret == KRB5_CC_END || ret == ENOENT) { - kinit_required = true; - } else if (ret == 0) { - if (lifetime == 0) { -@@ -800,18 +807,27 @@ _PUBLIC_ bool cli_credentials_get_ccache_name_obtained( - if (ret == KRB5_CC_END || ret == ENOENT) { - return false; - } -- if (ret != 0) { -+ -+ /* -+ * KRB5_PLUGIN_NO_HANDLE is a special case of the encrypted -+ * GSSProxy credential. We don't know its lifetime but assume it -+ * is a valid one. Acquiring it will show the lifetime. -+ * */ -+ if (ret != 0 && ret != KRB5_PLUGIN_NO_HANDLE) { - return false; - } -- if (lifetime == 0) { -- return false; -- } else if (lifetime < 300) { -- if (cred->password_obtained >= cred->ccache_obtained) { -- /* -- * we have a password to re-kinit -- * so let the caller try that. -- */ -+ -+ if (ret == 0) { -+ if (lifetime == 0) { - return false; -+ } else if (lifetime < 300) { -+ if (cred->password_obtained >= cred->ccache_obtained) { -+ /* -+ * we have a password to re-kinit -+ * so let the caller try that. -+ */ -+ return false; -+ } - } - } - -diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c -index f9d91a4f0c1..dcf91348d1a 100644 ---- a/lib/krb5_wrap/krb5_samba.c -+++ b/lib/krb5_wrap/krb5_samba.c -@@ -3025,6 +3025,8 @@ krb5_error_code smb_krb5_cc_get_lifetime(krb5_context context, - krb5_creds cred; - krb5_timestamp endtime = 0; - krb5_timestamp now; -+ char *realm = NULL; -+ TALLOC_CTX *mem_ctx = NULL; - - *t = 0; - -@@ -3038,12 +3040,37 @@ krb5_error_code smb_krb5_cc_get_lifetime(krb5_context context, - return kerr; - } - -+ mem_ctx = talloc_stackframe(); -+ if (mem_ctx == NULL) { -+ krb5_cc_end_seq_get(context, id, &cursor); -+ return ENOMEM; -+ } -+ - while ((kerr = krb5_cc_next_cred(context, id, &cursor, &cred)) == 0) { - if (krb5_is_config_principal(context, cred.server)) { - krb5_free_cred_contents(context, &cred); - continue; - } - -+ realm = smb_krb5_principal_get_realm(mem_ctx, context, cred.server); -+ if (realm == NULL) { -+ krb5_free_cred_contents(context, &cred); -+ kerr = ENOMEM; -+ break; -+ } -+ -+ /* -+ * 'X-GSSPROXY:' is the realm for an encrypted credential stored -+ * by the GSSProxy. There are no other creds in such ccache and -+ * we cannot see the actual lifetime (it is set to 0), -+ * indicate to the caller they need to handle this themselves. -+ */ -+ if (strcmp(realm, "X-GSSPROXY:") == 0) { -+ krb5_free_cred_contents(context, &cred); -+ kerr = KRB5_PLUGIN_NO_HANDLE; -+ break; -+ } -+ - #ifndef HAVE_FLAGS_IN_KRB5_CREDS - if (cred.ticket_flags & TKT_FLG_INITIAL) { - #else -@@ -3073,13 +3100,17 @@ krb5_error_code smb_krb5_cc_get_lifetime(krb5_context context, - krb5_free_cred_contents(context, &cred); - } - -+ krb5_cc_end_seq_get(context, id, &cursor); -+ talloc_free(mem_ctx); -+ if (kerr == ENOMEM || kerr == KRB5_PLUGIN_NO_HANDLE) { -+ return kerr; -+ } -+ - if (now < endtime) { - *t = (time_t) (endtime - now); - kerr = 0; - } - -- krb5_cc_end_seq_get(context, id, &cursor); -- - return kerr; - } - #endif /* HAVE_KRB5_CC_GET_LIFETIME */ --- -2.51.0 - diff --git a/samba.spec b/samba.spec index 1d9ef9a..5cebd13 100644 --- a/samba.spec +++ b/samba.spec @@ -136,7 +136,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc3 +%global pre_release rc4 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif @@ -222,8 +222,7 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore -Patch0: samba-bz15902.patch -Patch1: samba-pcp-7.0.0.patch +Patch0: samba-pcp-7.0.0.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} diff --git a/sources b/sources index 168a85d..a13eeba 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.23.0rc3.tar.xz) = 1e8b9bec0e42d387a0b4665d395ec63bcb9b84353c62be0ed253dfe79c1ff44f13a8a1825f2a1eba4c8f209cae55e0b3ed7f89b39884ec73b05383b0008a5249 -SHA512 (samba-4.23.0rc3.tar.asc) = 727d328c0f4bd075d927bcfdb86083c3e6e9f066c938d5232e655c676d78f936453bc0d39bf271d0f8371f33e8ffe30aa376ad6461ca0be8d34ebca01553c3ab +SHA512 (samba-4.23.0rc4.tar.xz) = 0e31cce7b6627d07c0d6caa4be6e7e962c5c32bb426532584f5d429c9354c5e9a3180c6cb6c2cabe0daad130c78fb43cf0b304b515d1e0a92e67e0e581539dba +SHA512 (samba-4.23.0rc4.tar.asc) = 068891e289c62ce8602ea6524c05c0348cc21853597e3e192bf932d3a4b7fb514925950828bc97375492aa30e5937761911f0ade2af202ddaec504f105fec580 From 86832ccc3983caa58af6bcc646f1bccabaa9b7e5 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 12 Sep 2025 14:55:35 +0200 Subject: [PATCH 403/425] Update to version 4.23.0 - resolves: rhbz#2394791 --- samba-pcp-7.0.0.patch | 72 ------------------------------------------- samba.spec | 8 +++-- 2 files changed, 6 insertions(+), 74 deletions(-) delete mode 100644 samba-pcp-7.0.0.patch diff --git a/samba-pcp-7.0.0.patch b/samba-pcp-7.0.0.patch deleted file mode 100644 index 1b2c6a5..0000000 --- a/samba-pcp-7.0.0.patch +++ /dev/null @@ -1,72 +0,0 @@ -From 4b74db174b92e00eb4c342c77adcb8140851d025 Mon Sep 17 00:00:00 2001 -From: Alexander Bokovoy -Date: Wed, 3 Sep 2025 15:42:46 +0300 -Subject: [PATCH] ctdb/wscript: fix build against PCP 7.0.0 - -Signed-off-by: Alexander Bokovoy ---- - ctdb/utils/pmda/pmda_ctdb.c | 6 +++++- - ctdb/wscript | 20 +++++++++----------- - 2 files changed, 14 insertions(+), 12 deletions(-) - -diff --git a/ctdb/utils/pmda/pmda_ctdb.c b/ctdb/utils/pmda/pmda_ctdb.c -index 7ac8a3b38d1..75ae1079dc4 100644 ---- a/ctdb/utils/pmda/pmda_ctdb.c -+++ b/ctdb/utils/pmda/pmda_ctdb.c -@@ -39,9 +39,13 @@ - - #define pmID_cluster(id) id->cluster - #define pmID_item(id) id->item -+#ifndef pmGetProgname - #define pmGetProgname() pmProgname -+#endif -+#ifndef pmSetProgname - #define pmSetProgname(a) __pmSetProgname(a) - #endif -+#endif - - #include "domain.h" - -@@ -450,7 +454,7 @@ err_out: - * instance domain evaluation. - */ - static int --pmda_ctdb_fetch(int numpmid, pmID pmidlist[], pmResult **resp, pmdaExt *pmda) -+pmda_ctdb_fetch(int numpmid, pmID pmidlist[], pmdaResult **resp, pmdaExt *pmda) - { - int ret; - -diff --git a/ctdb/wscript b/ctdb/wscript -index e9cd89436a3..15dedb1c432 100644 ---- a/ctdb/wscript -+++ b/ctdb/wscript -@@ -226,17 +226,15 @@ def configure(conf): - - have_pmda = False - if Options.options.ctdb_pmda: -- pmda_support = True -- -- if not conf.CHECK_HEADERS('pcp/pmapi.h pcp/impl.h pcp/pmda.h', -- together=True): -- pmda_support = False -- if not conf.CHECK_FUNCS_IN('pmProgname', 'pcp'): -- pmda_support = False -- if not conf.CHECK_FUNCS_IN('pmdaDaemon', 'pcp_pmda'): -- pmda_support = False -- if pmda_support: -- conf.CHECK_TYPE_IN('__pmID_int', 'pcp/pmapi.h pcp/impl.h') -+ checks = [conf.CHECK_HEADERS('pcp/pmapi.h pcp/impl.h pcp/pmda.h', -+ together=True), -+ conf.CHECK_FUNCS_IN('pmdaDaemon', 'pcp_pmda')] -+ -+ have_progname = [conf.CHECK_FUNCS_IN('pmProgname', 'pcp'), -+ conf.CHECK_FUNCS_IN('pmGetProgname', 'pcp')] -+ -+ if all(checks) and any(have_progname): -+ conf.CHECK_TYPE_IN('__pmID_int', 'libpcp.h pcp/pmapi.h pcp/impl.h') - have_pmda = True - else: - Logs.error("PMDA support not available") --- -2.51.0 - diff --git a/samba.spec b/samba.spec index 5cebd13..dca57e4 100644 --- a/samba.spec +++ b/samba.spec @@ -136,7 +136,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc4 +%global pre_release %nil %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif @@ -222,7 +222,6 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore -Patch0: samba-pcp-7.0.0.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} @@ -323,6 +322,11 @@ BuildRequires: xz BuildRequires: zlib-devel >= 1.2.3 BuildRequires: pkgconfig(libsystemd) +# TODO FIXME This is not in RHEL yet +%if 0%{?fedora} >= 34 +BuildRequires: pkgconfig(libngtcp2) +BuildRequires: pkgconfig(libngtcp2_crypto_gnutls) +%endif %ifnarch i686 %if 0%{?fedora} >= 37 From 0bc0416ee8ae7375d809c566d6ecfcba9b2beb04 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 12 Sep 2025 15:03:30 +0200 Subject: [PATCH 404/425] Remove `smb3 unix extensions = yes` from smb.conf This is enabled by default now. --- smb.conf.vendor | 2 -- sources | 4 ++-- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/smb.conf.vendor b/smb.conf.vendor index cbb2e0f..f237c86 100644 --- a/smb.conf.vendor +++ b/smb.conf.vendor @@ -18,8 +18,6 @@ load printers = yes cups options = raw - smb3 unix extensions = yes - # Install samba-usershares package for support include = /etc/samba/usershares.conf diff --git a/sources b/sources index a13eeba..e69f8ff 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.23.0rc4.tar.xz) = 0e31cce7b6627d07c0d6caa4be6e7e962c5c32bb426532584f5d429c9354c5e9a3180c6cb6c2cabe0daad130c78fb43cf0b304b515d1e0a92e67e0e581539dba -SHA512 (samba-4.23.0rc4.tar.asc) = 068891e289c62ce8602ea6524c05c0348cc21853597e3e192bf932d3a4b7fb514925950828bc97375492aa30e5937761911f0ade2af202ddaec504f105fec580 +SHA512 (samba-4.23.0.tar.xz) = 660b35a99544a868b11b24ea3c2ed58de5f68c7fc12d3ea71bc84724285eee4375d13ccf357f0248352fab344d76303660e09598f5f1988f3d0f8e76c535a781 +SHA512 (samba-4.23.0.tar.asc) = 508587816e941cd8dc9f65b7f05c828ce859fb7f74a01a200f685c5188c79c916b4d5b167b71298c53cc8a01d6e17a272ea773980488af532a85308fd1142156 From 54c3bbd3f168e8816d279498b3d18435d9a4081b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 12 Sep 2025 18:04:02 +0200 Subject: [PATCH 405/425] Fix building ctdb with PCP 7.0.0 --- samba-fix-ctdb-pcp-7-support.patch | 36 ++++++++++++++++++++++++++++++ samba.spec | 6 ++++- 2 files changed, 41 insertions(+), 1 deletion(-) create mode 100644 samba-fix-ctdb-pcp-7-support.patch diff --git a/samba-fix-ctdb-pcp-7-support.patch b/samba-fix-ctdb-pcp-7-support.patch new file mode 100644 index 0000000..116a4ff --- /dev/null +++ b/samba-fix-ctdb-pcp-7-support.patch @@ -0,0 +1,36 @@ +From 56be6583e8a32cd4dcdfcd3a1f072cc7642668e4 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Fri, 12 Sep 2025 15:37:38 +0200 +Subject: [PATCH] ctdb: Fix redefinitoin of pmdaResult + +../../ctdb/utils/pmda/pmda_ctdb.c:52:9: warning: 'pmdaResult' redefined + 52 | #define pmdaResult pmResult + | ^~~~~~~~~~ +In file included from ../../ctdb/utils/pmda/pmda_ctdb.c:35: +/usr/include/pcp/pmda.h:30:9: note: this is the location of the previous definition + 30 | #define pmdaResult pmResult_v2 + | ^~~~~~~~~~ + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15904 + +Signed-off-by: Andreas Schneider +--- + ctdb/utils/pmda/pmda_ctdb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/ctdb/utils/pmda/pmda_ctdb.c b/ctdb/utils/pmda/pmda_ctdb.c +index 9845f26defb..5c09aca7b84 100644 +--- a/ctdb/utils/pmda/pmda_ctdb.c ++++ b/ctdb/utils/pmda/pmda_ctdb.c +@@ -48,7 +48,7 @@ + #define pmSetProgname(a) __pmSetProgname(a) + #endif + +-#ifdef HAVE_STRUCT_PMRESULT ++#if !defined(pmdaResult) && defined(HAVE_STRUCT_PMRESULT) + #define pmdaResult pmResult + #endif + +-- +2.51.0 + diff --git a/samba.spec b/samba.spec index dca57e4..a68adfa 100644 --- a/samba.spec +++ b/samba.spec @@ -223,6 +223,8 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore +Patch0: samba-fix-ctdb-pcp-7-support.patch + Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} @@ -323,7 +325,7 @@ BuildRequires: zlib-devel >= 1.2.3 BuildRequires: pkgconfig(libsystemd) # TODO FIXME This is not in RHEL yet -%if 0%{?fedora} >= 34 +%if 0%{?fedora} >= 43 BuildRequires: pkgconfig(libngtcp2) BuildRequires: pkgconfig(libngtcp2_crypto_gnutls) %endif @@ -2026,8 +2028,10 @@ fi %{_libdir}/samba/libndr-samba4-private-samba.so %{_libdir}/samba/libnet-keytab-private-samba.so %{_libdir}/samba/libnetif-private-samba.so +%if 0%{?rhel} %{_libdir}/samba/libngtcp2-crypto-gnutls-private-samba.so %{_libdir}/samba/libngtcp2-private-samba.so +%endif %{_libdir}/samba/libnpa-tstream-private-samba.so %{_libdir}/samba/libposix-eadb-private-samba.so %{_libdir}/samba/libprinter-driver-private-samba.so From b40a7310d3f6cc89d9b97bd587235793ad42a4b9 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 15 Sep 2025 10:43:55 +0200 Subject: [PATCH 406/425] Build with systemd-userdb support --- samba.spec | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/samba.spec b/samba.spec index a68adfa..406e975 100644 --- a/samba.spec +++ b/samba.spec @@ -121,6 +121,12 @@ %bcond lmdb 0 %endif +%if 0%{?fedora} >= 43 +%bcond varlink 1 +%else +%bcond varlink 0 +%endif + %global samba_version 4.23.0 # The release field is extended: @@ -330,6 +336,10 @@ BuildRequires: pkgconfig(libngtcp2) BuildRequires: pkgconfig(libngtcp2_crypto_gnutls) %endif +%if %{with varlink} +BuildRequires: pkgconfig(libvarlink) >= 24 +%endif + %ifnarch i686 %if 0%{?fedora} >= 37 BuildRequires: mold @@ -1429,6 +1439,9 @@ export PYTHONARCHDIR=%{python3_sitearch} %endif %if %{with prometheus} --with-prometheus-exporter \ +%endif +%if %{with varlink} + --with-systemd-userdb \ %endif --with-profiling-data \ --with-systemd \ From 07953f426e3bacaaab66308f0cc460811ce9a29d Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Tue, 23 Sep 2025 11:40:30 +0300 Subject: [PATCH 407/425] Fix DLZ crash on unconfigured Samba AD system and rebuild against Python 3.14.0rc3 - Resolves: rhbz#2396621 - Resolves: rhbz#2397242 Signed-off-by: Alexander Bokovoy --- samba-dlz-crash-fix.patch | 53 +++++++++++++++++++++++++++++++++++++++ samba.spec | 1 + 2 files changed, 54 insertions(+) create mode 100644 samba-dlz-crash-fix.patch diff --git a/samba-dlz-crash-fix.patch b/samba-dlz-crash-fix.patch new file mode 100644 index 0000000..e3e84b2 --- /dev/null +++ b/samba-dlz-crash-fix.patch @@ -0,0 +1,53 @@ +From 821cf798d87162b1f3b5d7388891d15fea0a969a Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Fri, 19 Sep 2025 16:23:41 +0300 +Subject: [PATCH] Fix crash in DLZ plugin for incorrect setup + +When bind is not yet setup properly, logging errors should be done +through the temporary handle. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15920 + +Signed-off-by: Alexander Bokovoy +Reviewed-by: Douglas Bagnall + +Autobuild-User(master): Douglas Bagnall +Autobuild-Date(master): Sat Sep 20 06:49:37 UTC 2025 on atb-devel-224 +--- + source4/dns_server/dlz_bind9.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/source4/dns_server/dlz_bind9.c b/source4/dns_server/dlz_bind9.c +index e5c9679835e..2a2430caba2 100644 +--- a/source4/dns_server/dlz_bind9.c ++++ b/source4/dns_server/dlz_bind9.c +@@ -671,6 +671,9 @@ _PUBLIC_ isc_result_t dlz_create(const char *dlzname, + } + va_end(ap); + ++ /* starting from here, we can only use state->log() until ++ * dlz_bind9_state is assigned */ ++ + /* Do not install samba signal handlers */ + fault_setup_disable(); + +@@ -727,11 +730,11 @@ _PUBLIC_ isc_result_t dlz_create(const char *dlzname, + } + + if (!file_exist(state->options.url)) { +- dlz_bind9_state->log(ISC_LOG_ERROR, +- "samba_dlz: dlz_create could not find '%s'; " +- "trying old location '%s/dns/sam.ldb' instead", +- state->options.url, +- lpcfg_private_dir(state->lp)); ++ state->log(ISC_LOG_ERROR, ++ "samba_dlz: dlz_create could not find '%s'; " ++ "trying old location '%s/dns/sam.ldb' instead", ++ state->options.url, ++ lpcfg_private_dir(state->lp)); + state->options.url = talloc_asprintf(state, + "%s/dns/sam.ldb", + lpcfg_private_dir(state->lp)); +-- +2.51.0 + diff --git a/samba.spec b/samba.spec index 406e975..4846712 100644 --- a/samba.spec +++ b/samba.spec @@ -230,6 +230,7 @@ Source201: README.downgrade Source202: samba.abignore Patch0: samba-fix-ctdb-pcp-7-support.patch +Patch1: samba-dlz-crash-fix.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} From 4e3699d8b510bcd13d65116dca74012906d32a31 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 29 Sep 2025 14:14:11 +0200 Subject: [PATCH 408/425] Update to Samba 4.23.1 - resolves: #2399755 Guenther --- samba-dlz-crash-fix.patch | 53 ------------------------------ samba-fix-ctdb-pcp-7-support.patch | 36 -------------------- samba.spec | 5 +-- sources | 4 +-- 4 files changed, 3 insertions(+), 95 deletions(-) delete mode 100644 samba-dlz-crash-fix.patch delete mode 100644 samba-fix-ctdb-pcp-7-support.patch diff --git a/samba-dlz-crash-fix.patch b/samba-dlz-crash-fix.patch deleted file mode 100644 index e3e84b2..0000000 --- a/samba-dlz-crash-fix.patch +++ /dev/null @@ -1,53 +0,0 @@ -From 821cf798d87162b1f3b5d7388891d15fea0a969a Mon Sep 17 00:00:00 2001 -From: Alexander Bokovoy -Date: Fri, 19 Sep 2025 16:23:41 +0300 -Subject: [PATCH] Fix crash in DLZ plugin for incorrect setup - -When bind is not yet setup properly, logging errors should be done -through the temporary handle. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15920 - -Signed-off-by: Alexander Bokovoy -Reviewed-by: Douglas Bagnall - -Autobuild-User(master): Douglas Bagnall -Autobuild-Date(master): Sat Sep 20 06:49:37 UTC 2025 on atb-devel-224 ---- - source4/dns_server/dlz_bind9.c | 13 ++++++++----- - 1 file changed, 8 insertions(+), 5 deletions(-) - -diff --git a/source4/dns_server/dlz_bind9.c b/source4/dns_server/dlz_bind9.c -index e5c9679835e..2a2430caba2 100644 ---- a/source4/dns_server/dlz_bind9.c -+++ b/source4/dns_server/dlz_bind9.c -@@ -671,6 +671,9 @@ _PUBLIC_ isc_result_t dlz_create(const char *dlzname, - } - va_end(ap); - -+ /* starting from here, we can only use state->log() until -+ * dlz_bind9_state is assigned */ -+ - /* Do not install samba signal handlers */ - fault_setup_disable(); - -@@ -727,11 +730,11 @@ _PUBLIC_ isc_result_t dlz_create(const char *dlzname, - } - - if (!file_exist(state->options.url)) { -- dlz_bind9_state->log(ISC_LOG_ERROR, -- "samba_dlz: dlz_create could not find '%s'; " -- "trying old location '%s/dns/sam.ldb' instead", -- state->options.url, -- lpcfg_private_dir(state->lp)); -+ state->log(ISC_LOG_ERROR, -+ "samba_dlz: dlz_create could not find '%s'; " -+ "trying old location '%s/dns/sam.ldb' instead", -+ state->options.url, -+ lpcfg_private_dir(state->lp)); - state->options.url = talloc_asprintf(state, - "%s/dns/sam.ldb", - lpcfg_private_dir(state->lp)); --- -2.51.0 - diff --git a/samba-fix-ctdb-pcp-7-support.patch b/samba-fix-ctdb-pcp-7-support.patch deleted file mode 100644 index 116a4ff..0000000 --- a/samba-fix-ctdb-pcp-7-support.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 56be6583e8a32cd4dcdfcd3a1f072cc7642668e4 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Fri, 12 Sep 2025 15:37:38 +0200 -Subject: [PATCH] ctdb: Fix redefinitoin of pmdaResult - -../../ctdb/utils/pmda/pmda_ctdb.c:52:9: warning: 'pmdaResult' redefined - 52 | #define pmdaResult pmResult - | ^~~~~~~~~~ -In file included from ../../ctdb/utils/pmda/pmda_ctdb.c:35: -/usr/include/pcp/pmda.h:30:9: note: this is the location of the previous definition - 30 | #define pmdaResult pmResult_v2 - | ^~~~~~~~~~ - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15904 - -Signed-off-by: Andreas Schneider ---- - ctdb/utils/pmda/pmda_ctdb.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/ctdb/utils/pmda/pmda_ctdb.c b/ctdb/utils/pmda/pmda_ctdb.c -index 9845f26defb..5c09aca7b84 100644 ---- a/ctdb/utils/pmda/pmda_ctdb.c -+++ b/ctdb/utils/pmda/pmda_ctdb.c -@@ -48,7 +48,7 @@ - #define pmSetProgname(a) __pmSetProgname(a) - #endif - --#ifdef HAVE_STRUCT_PMRESULT -+#if !defined(pmdaResult) && defined(HAVE_STRUCT_PMRESULT) - #define pmdaResult pmResult - #endif - --- -2.51.0 - diff --git a/samba.spec b/samba.spec index 4846712..493c0bf 100644 --- a/samba.spec +++ b/samba.spec @@ -127,7 +127,7 @@ %bcond varlink 0 %endif -%global samba_version 4.23.0 +%global samba_version 4.23.1 # The release field is extended: # [.][.]%%{?dist}[.] @@ -229,9 +229,6 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore -Patch0: samba-fix-ctdb-pcp-7-support.patch -Patch1: samba-dlz-crash-fix.patch - Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} diff --git a/sources b/sources index e69f8ff..1bea503 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.23.0.tar.xz) = 660b35a99544a868b11b24ea3c2ed58de5f68c7fc12d3ea71bc84724285eee4375d13ccf357f0248352fab344d76303660e09598f5f1988f3d0f8e76c535a781 -SHA512 (samba-4.23.0.tar.asc) = 508587816e941cd8dc9f65b7f05c828ce859fb7f74a01a200f685c5188c79c916b4d5b167b71298c53cc8a01d6e17a272ea773980488af532a85308fd1142156 +SHA512 (samba-4.23.1.tar.xz) = d6e2863dc729b2c4feb337634ad80d9f8cb244455dbdb035f6d164ed722c07e507d2018d68221beada429d6e2c00aa36bfbfcc788e96e34225bb963beb2e017e +SHA512 (samba-4.23.1.tar.asc) = cea22d67e374b4350bd78e941ec60655b4176b7c24dc3514f476608f91c5806f1dc11aed66a237dec82ed31979eeeacac91f2191c3b9fe415920f762a0085118 From c05bf06122c9f8f630c5435c3ebe7d04046472c8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 15 Oct 2025 23:27:11 +0200 Subject: [PATCH 409/425] Update to Samba 4.23.2 - resolves: rhbz#2404204 - resolves: rhbz#2391698 - Security fix for CVE-2025-9640 - resolves: rhbz#2394377 - Security fix for CVE-2025-10230 Guenther --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 493c0bf..d6e2912 100644 --- a/samba.spec +++ b/samba.spec @@ -127,7 +127,7 @@ %bcond varlink 0 %endif -%global samba_version 4.23.1 +%global samba_version 4.23.2 # The release field is extended: # [.][.]%%{?dist}[.] diff --git a/sources b/sources index 1bea503..4af6c05 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.23.1.tar.xz) = d6e2863dc729b2c4feb337634ad80d9f8cb244455dbdb035f6d164ed722c07e507d2018d68221beada429d6e2c00aa36bfbfcc788e96e34225bb963beb2e017e -SHA512 (samba-4.23.1.tar.asc) = cea22d67e374b4350bd78e941ec60655b4176b7c24dc3514f476608f91c5806f1dc11aed66a237dec82ed31979eeeacac91f2191c3b9fe415920f762a0085118 +SHA512 (samba-4.23.2.tar.xz) = ffc9415d76244a199ef23cb39da7b97ec07b7fd061f84ba6185ac3a45e6b6942d0196945ac6d7e72f137787eafb2811220227c2c72a006fdfc903f90caa4673f +SHA512 (samba-4.23.2.tar.asc) = 775a8e321ea63193b027e6c2f351f9532b93cb6662571dc30bf2150624649afc425d3c9a0bfdea92ac093d25a1aee71d7ff6e4a47d44b2286074cf7ac6cdea98 From efaa5fdc6d2a13fc842f453c360f76a8f8ed587e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 4 Mar 2025 20:08:17 +0100 Subject: [PATCH 410/425] Fix --with testsuite [skip changelog] --- samba.spec | 48 +++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 41 insertions(+), 7 deletions(-) diff --git a/samba.spec b/samba.spec index d6e2912..08d2cb9 100644 --- a/samba.spec +++ b/samba.spec @@ -6,7 +6,17 @@ # or # rpmbuild --rebuild --with testsuite samba.src.rpm # +# If you just want to run a single test, you can use: +# fedpkg mockbuild --with testsuite -- --define 'SAMBA_TESTS regex' samba.src.rpm +# or +# rpmbuild --rebuild --with testsuite --define='SAMBA_TESTS regex' samba.src.rpm +# %bcond testsuite 0 +%if %{with testsuite} +# As the file list is empty for running just the tests, we have empty debuginfo +# package. Disable it to avoid error reporting. +%global debug_package %{nil} +%endif # Build with internal talloc, tevent, tdb # @@ -1328,6 +1338,13 @@ xzcat %{SOURCE0} | gpgv2 --quiet --keyring %{SOURCE2} %{SOURCE1} - # Make sure we do not build with heimdal code rm -rfv third_party/heimdal +%if %{with testsuite} +# WARNING: Don't change that for production! +# +# Shorten the priviliged dir, as unix sockets only have 108 chars +sed -i 's/#define WINBINDD_PRIV_SOCKET_SUBDIR.*/#define WINBINDD_PRIV_SOCKET_SUBDIR "wb_priv"/' nsswitch/winbind_struct_protocol.h +%endif + %build %if %{with includelibs} %global _talloc_lib ,talloc,pytalloc,pytalloc-util @@ -1619,20 +1636,37 @@ touch %{buildroot}%{_libexecdir}/ctdb/statd_callout # in the timestamp so the year 2038 problem is deferred till 2446. # https://bugzilla.samba.org/show_bug.cgi?id=14546 # -for t in samba3.smb2.timestamps.time_t_15032385535 \ - samba3.smb2.timestamps.time_t_10000000000 \ - samba3.smb2.timestamps.time_t_4294967295 \ - ; do - echo "^$t" >> selftest/knownfail.d/fedora.%{dist} -done -cat selftest/knownfail.d/fedora.%{dist} +if [ "$(df --portability --print-type "$(pwd)" | grep -c ext4)" == "1" ]; then + cat > selftest/knownfail.d/fedora%{dist} << EOF +^samba3.smb2.timestamps.time_t_15032385535 +^samba3.smb2.timestamps.time_t_10000000000 +^samba3.smb2.timestamps.time_t_4294967295 +EOF +fi + +echo +echo "Content of selftest/knownfail.d/fedora%{dist}:" +cat selftest/knownfail.d/fedora%{dist} || true + +cat >> selftest/skip << EOF +# FIXME: Investigate why it fails. Might be CUPS is not running? +^samba3.rpc.spoolss.printserver +EOF + +echo +echo "Content of selftest/skip:" +cat selftest/skip export TDB_NO_FSYNC=1 export NMBD_DONT_LOG_STDOUT=1 export SMBD_DONT_LOG_STDOUT=1 export WINBINDD_DONT_LOG_STDOUT=1 export SAMBA_DCERPCD_DONT_LOG_STDOUT=1 +%if "x%{?SAMBA_TESTS}" != "x" +%{__make} %{?_smp_mflags} test FAIL_IMMEDIATELY=1 TESTS="%{SAMBA_TESTS}" +%else %{__make} %{?_smp_mflags} test FAIL_IMMEDIATELY=1 +%endif #endif with testsuite %endif From 80c8f322115895534520fe5a4c6159ff629fe13a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 7 Nov 2025 16:41:40 +0100 Subject: [PATCH 411/425] Update to Samba 4.23.3 - resolves: #2413362 Guenther --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 08d2cb9..25b8dbc 100644 --- a/samba.spec +++ b/samba.spec @@ -137,7 +137,7 @@ %bcond varlink 0 %endif -%global samba_version 4.23.2 +%global samba_version 4.23.3 # The release field is extended: # [.][.]%%{?dist}[.] diff --git a/sources b/sources index 4af6c05..d966a50 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.23.2.tar.xz) = ffc9415d76244a199ef23cb39da7b97ec07b7fd061f84ba6185ac3a45e6b6942d0196945ac6d7e72f137787eafb2811220227c2c72a006fdfc903f90caa4673f -SHA512 (samba-4.23.2.tar.asc) = 775a8e321ea63193b027e6c2f351f9532b93cb6662571dc30bf2150624649afc425d3c9a0bfdea92ac093d25a1aee71d7ff6e4a47d44b2286074cf7ac6cdea98 +SHA512 (samba-4.23.3.tar.xz) = 5cb15c8eeda14dc4317b239864a4b7aa50b9c16a49ac9aefdc06ba6bde9b869fee2955eb21ed4620b73bb68682d368821869594fd106f3387e9ced9978483e7e +SHA512 (samba-4.23.3.tar.asc) = 27804ead26f8363d2a84b8ad37495a60b28c80b002e3c7420d434792c893355bd2652a8222825dbc877acbba65db18c4a648eaec218d69f275428b6f6d8a990e From 4af627337110534bd4de9e18adc758c2e7c1b093 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 10 Nov 2025 13:20:07 +0100 Subject: [PATCH 412/425] Update gitignore [skip changelog] --- .gitignore | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.gitignore b/.gitignore index a695288..47652a9 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,4 @@ /samba-*.tar.xz /samba-*.tar.asc +/*.rpm +/results_samba From fb14cf225b29844693fd6240ba590d7c77622d00 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 14 Nov 2025 19:10:30 +0100 Subject: [PATCH 413/425] Add hint that we bundle ngtcp2 if not provided by the system --- samba.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/samba.spec b/samba.spec index 25b8dbc..789eb43 100644 --- a/samba.spec +++ b/samba.spec @@ -342,6 +342,8 @@ BuildRequires: pkgconfig(libsystemd) %if 0%{?fedora} >= 43 BuildRequires: pkgconfig(libngtcp2) BuildRequires: pkgconfig(libngtcp2_crypto_gnutls) +%else +Provides: bundled(ngtcp2) %endif %if %{with varlink} From 8c46386794df75e98db1520c6f03cc26e14e8c1d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 12 Dec 2025 17:04:18 +0100 Subject: [PATCH 414/425] Update to Samba 4.23.4 - resolves: #2421764 Guenther --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 789eb43..9b87190 100644 --- a/samba.spec +++ b/samba.spec @@ -137,7 +137,7 @@ %bcond varlink 0 %endif -%global samba_version 4.23.3 +%global samba_version 4.23.4 # The release field is extended: # [.][.]%%{?dist}[.] diff --git a/sources b/sources index d966a50..01648ec 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.23.3.tar.xz) = 5cb15c8eeda14dc4317b239864a4b7aa50b9c16a49ac9aefdc06ba6bde9b869fee2955eb21ed4620b73bb68682d368821869594fd106f3387e9ced9978483e7e -SHA512 (samba-4.23.3.tar.asc) = 27804ead26f8363d2a84b8ad37495a60b28c80b002e3c7420d434792c893355bd2652a8222825dbc877acbba65db18c4a648eaec218d69f275428b6f6d8a990e +SHA512 (samba-4.23.4.tar.xz) = 58979aa8a83e8210918f4f1adbcadff329e57a9cd25d7aba98d18f54a2e790a7ef3cc6b9fb3303d492d33d67f4a135849a419c95644d14e53a39654736d486ac +SHA512 (samba-4.23.4.tar.asc) = 0981ce6a43202953cdc7ceae77fa0e3b4ab853991430dde4df6daa163984de6c7ca3f3a3037376659d3bdaedcc108cdd7a77ce0ac24d0a1add56c7103fca7dce From a170fadc8dd6bcea5ed3839b6086643e43d06f71 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 12 Jan 2026 10:05:53 +0100 Subject: [PATCH 415/425] Do not redeclare cmocka functions This might cause issues when compiling with newer cmocka versions. --- samba-4.23-fix-cmocka.patch | 38 +++++++++++++++++++++++++++++++++++++ samba.spec | 2 ++ 2 files changed, 40 insertions(+) create mode 100644 samba-4.23-fix-cmocka.patch diff --git a/samba-4.23-fix-cmocka.patch b/samba-4.23-fix-cmocka.patch new file mode 100644 index 0000000..26289d6 --- /dev/null +++ b/samba-4.23-fix-cmocka.patch @@ -0,0 +1,38 @@ +From b1ec803f420b2c6d3c5c83d70c6875a7f36b15fc Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Fri, 21 Nov 2025 15:33:32 +0100 +Subject: [PATCH] s4:dsdb: Do not declare cm_print_error() + +This is part of the cmocka.h header file. + +Signed-off-by: Andreas Schneider +Reviewed-by: Martin Schwenke +Reviewed-by: Volker Lendecke + +Autobuild-User(master): Volker Lendecke +Autobuild-Date(master): Mon Nov 24 11:28:08 UTC 2025 on atb-devel-224 + +(cherry picked from commit 5a981663e4f677042ba80191770100aecff2120a) +--- + source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c b/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c +index f7075f3485e..12c464b49c7 100644 +--- a/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c ++++ b/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c +@@ -103,11 +103,6 @@ void audit_message_send( + + #define check_group_change_message(m, u, a, e) \ + _check_group_change_message(m, u, a, e, __FILE__, __LINE__); +-/* +- * declare the internal cmocka cm_print_error so that we can output messages +- * in sub unit format +- */ +-void cm_print_error(const char * const format, ...); + + /* + * Validate a group change JSON audit message +-- +2.52.0 + diff --git a/samba.spec b/samba.spec index 9b87190..2e3fe75 100644 --- a/samba.spec +++ b/samba.spec @@ -239,6 +239,8 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore +Patch0: samba-4.23-fix-cmocka.patch + Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} From 4a23ce5b7a021fac72e887bf4f71f843b150c987 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 14 Jan 2026 08:01:17 +0100 Subject: [PATCH 416/425] Remove unneeded dependency to samba-common-libs --- samba.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/samba.spec b/samba.spec index 2e3fe75..647fc92 100644 --- a/samba.spec +++ b/samba.spec @@ -1264,7 +1264,6 @@ License: LGPL-3.0-or-later Requires: libtalloc%{?_isa} >= %{talloc_version} Requires: libtdb%{?_isa} >= %{tdb_version} Requires: libtevent%{?_isa} >= %{tevent_version} -Requires: samba-common-libs = %{samba_depver} # /endif without includelibs %endif From b8395d93a751e2417fd1dd28e5cc09501ac2bb24 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 14 Jan 2026 10:53:10 +0100 Subject: [PATCH 417/425] Create a core-libs sub-package to split up library dependencies --- samba.spec | 135 +++++++++++++++++++++++++++++++++++++++-------------- 1 file changed, 100 insertions(+), 35 deletions(-) diff --git a/samba.spec b/samba.spec index 647fc92..c72ba68 100644 --- a/samba.spec +++ b/samba.spec @@ -488,12 +488,26 @@ The %{name}-client package provides some SMB/CIFS clients to complement the built-in SMB/CIFS filesystem in Linux. These clients allow access of SMB/CIFS shares and printing to SMB/CIFS printers. +### CORE-LIBS +%package core-libs +Summary: Samba core libraries +Requires(pre): %{name}-common = %{samba_depver} +Requires: %{name}-common = %{samba_depver} + +Provides: bundled(libreplace) = %{samba_depver} + +%description core-libs +The samba-core-libs package contains foundational libraries needed by +both Samba servers and clients. This includes error handling, utilities, +and NDR serialization support. + ### CLIENT-LIBS %package client-libs Summary: Samba client libraries Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-core-libs = %{samba_depver} Requires: libldb = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} @@ -528,7 +542,7 @@ packages of Samba. Summary: Libraries used by both Samba servers and clients Requires(pre): samba-common = %{samba_depver} Requires: samba-common = %{samba_depver} -Requires: %{name}-client-libs = %{samba_depver} +Requires: %{name}-core-libs = %{samba_depver} Requires: libldb = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} @@ -890,7 +904,7 @@ suite. %if %{with libwbclient} %package -n libwbclient Summary: The winbind client library -Requires: %{name}-client-libs = %{samba_depver} +# libwbclient.so only links to libc - no samba library dependencies needed Conflicts: sssd-libwbclient %description -n libwbclient @@ -2009,6 +2023,45 @@ fi #endif with includelibs %endif +### CORE-LIBS +%files core-libs +%dir %{_libdir}/samba + +# +# Tier 0: Private libraries - libc only dependencies +# +%{_libdir}/samba/libreplace-private-samba.so +%{_libdir}/samba/libsocket-blocking-private-samba.so +%{_libdir}/samba/libsys-rw-private-samba.so +%{_libdir}/samba/libtime-basic-private-samba.so + +# +# Tier 1: Private libraries - system libs (libtalloc, libsystemd) +# +%{_libdir}/samba/libsamba-debug-private-samba.so +%{_libdir}/samba/libserver-role-private-samba.so + +# +# Tier 1: Public libraries - system libs (libtalloc) +# +%{_libdir}/libsamba-errors.so.%{libsamba_errors_so_version}* + +# +# Tier 2: Private libraries - adds gnutls +# +%{_libdir}/samba/libgenrand-private-samba.so + +# +# Tier 2: Public libraries - adds gnutls, icu, tevent +# +%{_libdir}/libsamba-util.so.%{libsamba_util_so_version}* +%{_libdir}/libtevent-util.so.%{libtevent_util_so_version}* + +# +# Tier 3: Public libraries - NDR serialization (depends on Tier 1-2) +# +%{_libdir}/libndr.so.%{libndr_so_version}* + ### CLIENT-LIBS %files client-libs %{_libdir}/libdcerpc-binding.so.%{libdcerpc_binding_so_version}* @@ -2017,18 +2070,12 @@ fi %{_libdir}/libndr-krb5pac.so.%{libndr_krb5pac_so_version}* %{_libdir}/libndr-nbt.so.%{libndr_nbt_so_version}* %{_libdir}/libndr-standard.so.%{libndr_standard_so_version}* -%{_libdir}/libndr.so.%{libndr_so_version}* %{_libdir}/libsamba-credentials.so.%{libsamba_credentials_so_version}* -%{_libdir}/libsamba-errors.so.%{libsamba_errors_so_version}* %{_libdir}/libsamba-hostconfig.so.%{libsamba_hostconfig_so_version}* %{_libdir}/libsamba-passdb.so.%{libsamba_passdb_so_version}* -%{_libdir}/libsamba-util.so.%{libsamba_util_so_version}* %{_libdir}/libsamdb.so.%{libsamdb_so_version}* %{_libdir}/libsmbconf.so.%{libsmbconf_so_version}* %{_libdir}/libsmbldap.so.%{libsmbldap_so_version}* -%{_libdir}/libtevent-util.so.%{libtevent_util_so_version}* - -%dir %{_libdir}/samba %{_libdir}/samba/libCHARSET3-private-samba.so %{_libdir}/samba/libMESSAGING-SEND-private-samba.so %{_libdir}/samba/libMESSAGING-private-samba.so @@ -2049,19 +2096,14 @@ fi %{_libdir}/samba/libcmdline-contexts-private-samba.so %{_libdir}/samba/libcommon-auth-private-samba.so %{_libdir}/samba/libctdb-event-client-private-samba.so -%{_libdir}/samba/libdbwrap-private-samba.so %{_libdir}/samba/libdcerpc-pkt-auth-private-samba.so %{_libdir}/samba/libdcerpc-samba-private-samba.so %{_libdir}/samba/libevents-private-samba.so -%{_libdir}/samba/libflag-mapping-private-samba.so -%{_libdir}/samba/libgenrand-private-samba.so %{_libdir}/samba/libgensec-private-samba.so %{_libdir}/samba/libgpext-private-samba.so %{_libdir}/samba/libgpo-private-samba.so %{_libdir}/samba/libgse-private-samba.so %{_libdir}/samba/libhttp-private-samba.so -%{_libdir}/samba/libinterfaces-private-samba.so -%{_libdir}/samba/libiov-buf-private-samba.so %{_libdir}/samba/libkrb5samba-private-samba.so %{_libdir}/samba/libldbsamba-private-samba.so %{_libdir}/samba/liblibcli-lsa3-private-samba.so @@ -2087,32 +2129,32 @@ fi %{_libdir}/samba/libquic-private-samba.so %{_libdir}/samba/libregistry-private-samba.so %{_libdir}/samba/libsamba-cluster-support-private-samba.so -%{_libdir}/samba/libsamba-debug-private-samba.so %{_libdir}/samba/libsamba-modules-private-samba.so -%{_libdir}/samba/libsamba-security-private-samba.so %{_libdir}/samba/libsamba-security-trusts-private-samba.so %{_libdir}/samba/libsamba-sockets-private-samba.so -%{_libdir}/samba/libsamba3-util-private-samba.so %{_libdir}/samba/libsamdb-common-private-samba.so %{_libdir}/samba/libsecrets3-private-samba.so %{_libdir}/samba/libserver-id-db-private-samba.so -%{_libdir}/samba/libserver-role-private-samba.so %{_libdir}/samba/libsmbclient-raw-private-samba.so %{_libdir}/samba/libsmbd-base-private-samba.so %{_libdir}/samba/libsmbd-shim-private-samba.so %{_libdir}/samba/libsmbldaphelper-private-samba.so -%{_libdir}/samba/libstable-sort-private-samba.so -%{_libdir}/samba/libsys-rw-private-samba.so -%{_libdir}/samba/libsocket-blocking-private-samba.so -%{_libdir}/samba/libtalloc-report-printf-private-samba.so -%{_libdir}/samba/libtalloc-report-private-samba.so -%{_libdir}/samba/libtdb-wrap-private-samba.so -%{_libdir}/samba/libtime-basic-private-samba.so %{_libdir}/samba/libtorture-private-samba.so %{_libdir}/samba/libutil-crypt-private-samba.so -%{_libdir}/samba/libutil-reg-private-samba.so -%{_libdir}/samba/libutil-setid-private-samba.so -%{_libdir}/samba/libutil-tdb-private-samba.so + +# +# Command line library +# +%{_libdir}/samba/libcmdline-private-samba.so + +# +# Password database modules (depend on libsamba-passdb) +# +%dir %{_libdir}/samba/ldb +%dir %{_libdir}/samba/pdb +%{_libdir}/samba/pdb/ldapsam.so +%{_libdir}/samba/pdb/smbpasswd.so +%{_libdir}/samba/pdb/tdbsam.so %if %{without libwbclient} %{_libdir}/samba/libwbclient.so.* @@ -2165,16 +2207,39 @@ fi ### COMMON-LIBS %files common-libs -# common libraries -%{_libdir}/samba/libcmdline-private-samba.so -%{_libdir}/samba/libreplace-private-samba.so -%dir %{_libdir}/samba/ldb +# +# Tier 0: libc only dependencies +# +%{_libdir}/samba/libutil-setid-private-samba.so +%{_libdir}/samba/libutil-tdb-private-samba.so -%dir %{_libdir}/samba/pdb -%{_libdir}/samba/pdb/ldapsam.so -%{_libdir}/samba/pdb/smbpasswd.so -%{_libdir}/samba/pdb/tdbsam.so +# +# Tier 1: system libs only (libtalloc) +# +%{_libdir}/samba/libiov-buf-private-samba.so +%{_libdir}/samba/libstable-sort-private-samba.so +%{_libdir}/samba/libtalloc-report-private-samba.so +%{_libdir}/samba/libtalloc-report-printf-private-samba.so + +# +# Tier 2: depends on core-libs (debug, replace) +# +%{_libdir}/samba/libflag-mapping-private-samba.so +%{_libdir}/samba/libinterfaces-private-samba.so +%{_libdir}/samba/libtdb-wrap-private-samba.so + +# +# Tier 3: depends on core-libs (util, errors, ndr) +# +%{_libdir}/samba/libdbwrap-private-samba.so +%{_libdir}/samba/libsamba3-util-private-samba.so +%{_libdir}/samba/libutil-reg-private-samba.so + +# +# Tier 4: depends on core-libs + Tier 3 libs +# +%{_libdir}/samba/libsamba-security-private-samba.so ### COMMON-TOOLS %files common-tools From fcd8668e55e701de2421c6b27425a4c942673bd7 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 14 Jan 2026 11:24:56 +0100 Subject: [PATCH 418/425] Add gating test to detect dependency changes in samba libraries [skip changelog] --- gating.yaml | 6 ++ tests/deps-check.fmf | 13 +++++ tests/deps-check.sh | 133 +++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 152 insertions(+) create mode 100644 gating.yaml create mode 100644 tests/deps-check.fmf create mode 100755 tests/deps-check.sh diff --git a/gating.yaml b/gating.yaml new file mode 100644 index 0000000..c2182c7 --- /dev/null +++ b/gating.yaml @@ -0,0 +1,6 @@ +--- !Policy +product_versions: + - fedora-* +decision_context: bodhi_update_push_stable +rules: + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional} diff --git a/tests/deps-check.fmf b/tests/deps-check.fmf new file mode 100644 index 0000000..878b8b2 --- /dev/null +++ b/tests/deps-check.fmf @@ -0,0 +1,13 @@ +summary: Check samba package dependency structure +description: | + Verify that samba library packages maintain correct dependency hierarchy: + - samba-core-libs has no samba-*-libs dependencies + - samba-common-libs depends on samba-core-libs (not samba-client-libs) + - libwbclient has no samba-*-libs dependencies +test: ./deps-check.sh +framework: shell +require: + - samba-core-libs + - samba-common-libs + - samba-client-libs + - libwbclient diff --git a/tests/deps-check.sh b/tests/deps-check.sh new file mode 100755 index 0000000..622e88a --- /dev/null +++ b/tests/deps-check.sh @@ -0,0 +1,133 @@ +#!/bin/bash +# +# Samba package dependency structure verification +# +# This test ensures that the samba library package dependencies don't regress. +# The expected hierarchy is: +# +# samba-core-libs (no samba-*-libs dependencies) +# ^ +# | +# samba-common-libs (depends on samba-core-libs only) +# ^ +# | +# samba-client-libs (depends on samba-core-libs + samba-common-libs) +# +# libwbclient (no samba-*-libs dependencies - only links to libc) +# +# NOTE: This test checks RESOLVED dependencies, not just explicit Requires. +# A library requirement like 'libfoo.so' is resolved to the package that +# provides it, ensuring we catch indirect dependencies. +# + +set -e + +ERRORS=0 + +# Get all packages that a package depends on (resolved) +# This resolves library deps like 'libfoo.so' to actual package names +get_resolved_deps() { + local pkg="$1" + + rpm -qR "$pkg" 2>/dev/null | while read -r req; do + # Skip rpmlib and config requirements + [[ "$req" =~ ^rpmlib ]] && continue + [[ "$req" =~ ^config ]] && continue + [[ "$req" =~ ^/ ]] && continue + + # Get the package that provides this requirement + provider=$(rpm -q --whatprovides "$req" 2>/dev/null | head -1) + if [ -n "$provider" ] && [ "$provider" != "no package provides $req" ]; then + # Extract just the package name (remove version-release.arch) + echo "${provider%%-[0-9]*}" + fi + done | sort -u +} + +# Check that a package does NOT depend on packages matching a pattern +# This checks RESOLVED dependencies (what packages actually get pulled in) +check_no_resolved_dep() { + local pkg="$1" + local pattern="$2" + local description="$3" + + if ! rpm -q "$pkg" &>/dev/null; then + echo "SKIP: $pkg not installed" + return 0 + fi + + local bad_deps + # Exclude the package itself from the check + bad_deps=$(get_resolved_deps "$pkg" | grep -v "^${pkg}$" | grep -E "$pattern" || true) + + if [ -n "$bad_deps" ]; then + echo "FAIL: $pkg depends on $description" + echo " Found: $bad_deps" + ERRORS=$((ERRORS + 1)) + return 1 + fi + echo "PASS: $pkg does not depend on $description" + return 0 +} + +# Check that a package DOES depend on a specific package +check_has_resolved_dep() { + local pkg="$1" + local expected="$2" + + if ! rpm -q "$pkg" &>/dev/null; then + echo "SKIP: $pkg not installed" + return 0 + fi + + if get_resolved_deps "$pkg" | grep -qF "$expected"; then + echo "PASS: $pkg depends on $expected" + return 0 + fi + echo "FAIL: $pkg does not depend on $expected" + ERRORS=$((ERRORS + 1)) + return 1 +} + +echo "=== Samba Package Dependency Checks ===" +echo "" +echo "Checking resolved dependencies (library deps resolved to packages)" +echo "" + +# 1. samba-core-libs must NOT depend on any samba-*-libs packages +echo "--- samba-core-libs ---" +check_no_resolved_dep samba-core-libs "^samba-.*-libs$" "any samba-*-libs package" + +echo "" + +# 2. samba-common-libs must depend on samba-core-libs +# but NOT samba-client-libs +echo "--- samba-common-libs ---" +check_has_resolved_dep samba-common-libs "samba-core-libs" +check_no_resolved_dep samba-common-libs "^samba-client-libs$" "samba-client-libs" + +echo "" + +# 3. samba-client-libs must depend on samba-core-libs and samba-common-libs +# but NOT samba-libs +echo "--- samba-client-libs ---" +check_has_resolved_dep samba-client-libs "samba-core-libs" +check_has_resolved_dep samba-client-libs "samba-common-libs" +check_no_resolved_dep samba-client-libs "^samba-libs$" "samba-libs" + +echo "" + +# 4. libwbclient must NOT depend on any samba-*-libs packages +echo "--- libwbclient ---" +check_no_resolved_dep libwbclient "^samba-.*-libs$" "any samba-*-libs package" + +echo "" +echo "=== Summary ===" + +if [ $ERRORS -gt 0 ]; then + echo "FAILED: $ERRORS dependency check(s) failed" + exit 1 +fi + +echo "All dependency checks passed" +exit 0 From baa9e6f8c0c9594e05f953d54cf2e8fd720404c6 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 14 Jan 2026 12:23:39 +0100 Subject: [PATCH 419/425] Move libraries from samba-client-libs to samba-libs --- samba.spec | 30 +++++++++++++++++------------- tests/deps-check.fmf | 7 +++++++ tests/deps-check.sh | 26 ++++++++++++++++++++++++++ 3 files changed, 50 insertions(+), 13 deletions(-) diff --git a/samba.spec b/samba.spec index c72ba68..ccb55fc 100644 --- a/samba.spec +++ b/samba.spec @@ -2078,11 +2078,9 @@ fi %{_libdir}/libsmbldap.so.%{libsmbldap_so_version}* %{_libdir}/samba/libCHARSET3-private-samba.so %{_libdir}/samba/libMESSAGING-SEND-private-samba.so -%{_libdir}/samba/libMESSAGING-private-samba.so %{_libdir}/samba/libaddns-private-samba.so %{_libdir}/samba/libads-private-samba.so %{_libdir}/samba/libasn1util-private-samba.so -%{_libdir}/samba/libauth-private-samba.so %{_libdir}/samba/libauthkrb5-private-samba.so %{_libdir}/samba/libcli-cldap-private-samba.so %{_libdir}/samba/libcli-ldap-common-private-samba.so @@ -2095,13 +2093,10 @@ fi %{_libdir}/samba/libcluster-private-samba.so %{_libdir}/samba/libcmdline-contexts-private-samba.so %{_libdir}/samba/libcommon-auth-private-samba.so -%{_libdir}/samba/libctdb-event-client-private-samba.so %{_libdir}/samba/libdcerpc-pkt-auth-private-samba.so %{_libdir}/samba/libdcerpc-samba-private-samba.so %{_libdir}/samba/libevents-private-samba.so %{_libdir}/samba/libgensec-private-samba.so -%{_libdir}/samba/libgpext-private-samba.so -%{_libdir}/samba/libgpo-private-samba.so %{_libdir}/samba/libgse-private-samba.so %{_libdir}/samba/libhttp-private-samba.so %{_libdir}/samba/libkrb5samba-private-samba.so @@ -2116,16 +2111,12 @@ fi %{_libdir}/samba/libmsrpc3-private-samba.so %{_libdir}/samba/libndr-samba-private-samba.so %{_libdir}/samba/libndr-samba4-private-samba.so -%{_libdir}/samba/libnet-keytab-private-samba.so %{_libdir}/samba/libnetif-private-samba.so %if 0%{?rhel} %{_libdir}/samba/libngtcp2-crypto-gnutls-private-samba.so %{_libdir}/samba/libngtcp2-private-samba.so %endif %{_libdir}/samba/libnpa-tstream-private-samba.so -%{_libdir}/samba/libposix-eadb-private-samba.so -%{_libdir}/samba/libprinter-driver-private-samba.so -%{_libdir}/samba/libprinting-migrate-private-samba.so %{_libdir}/samba/libquic-private-samba.so %{_libdir}/samba/libregistry-private-samba.so %{_libdir}/samba/libsamba-cluster-support-private-samba.so @@ -2136,11 +2127,7 @@ fi %{_libdir}/samba/libsecrets3-private-samba.so %{_libdir}/samba/libserver-id-db-private-samba.so %{_libdir}/samba/libsmbclient-raw-private-samba.so -%{_libdir}/samba/libsmbd-base-private-samba.so %{_libdir}/samba/libsmbd-shim-private-samba.so -%{_libdir}/samba/libsmbldaphelper-private-samba.so -%{_libdir}/samba/libtorture-private-samba.so -%{_libdir}/samba/libutil-crypt-private-samba.so # # Command line library @@ -2597,6 +2584,23 @@ fi %{_libdir}/samba/libRPC-SERVER-LOOP-private-samba.so %{_libdir}/samba/libRPC-WORKER-private-samba.so +# +# Server-side libraries (not used by libsmbclient) +# +%{_libdir}/samba/libauth-private-samba.so +%{_libdir}/samba/libctdb-event-client-private-samba.so +%{_libdir}/samba/libgpext-private-samba.so +%{_libdir}/samba/libgpo-private-samba.so +%{_libdir}/samba/libMESSAGING-private-samba.so +%{_libdir}/samba/libnet-keytab-private-samba.so +%{_libdir}/samba/libposix-eadb-private-samba.so +%{_libdir}/samba/libprinter-driver-private-samba.so +%{_libdir}/samba/libprinting-migrate-private-samba.so +%{_libdir}/samba/libsmbd-base-private-samba.so +%{_libdir}/samba/libsmbldaphelper-private-samba.so +%{_libdir}/samba/libtorture-private-samba.so +%{_libdir}/samba/libutil-crypt-private-samba.so + ### LIBNETAPI %files -n libnetapi %{_libdir}/libnetapi.so.%{libnetapi_so_version}* diff --git a/tests/deps-check.fmf b/tests/deps-check.fmf index 878b8b2..959093e 100644 --- a/tests/deps-check.fmf +++ b/tests/deps-check.fmf @@ -3,11 +3,18 @@ description: | Verify that samba library packages maintain correct dependency hierarchy: - samba-core-libs has no samba-*-libs dependencies - samba-common-libs depends on samba-core-libs (not samba-client-libs) + - samba-client-libs depends on core-libs + common-libs (not samba-libs) - libwbclient has no samba-*-libs dependencies + - samba-client depends on samba-client-libs (not samba-libs) + - libsmbclient depends on samba-client-libs (not samba-libs) + - libldb has no samba-*-libs dependencies test: ./deps-check.sh framework: shell require: - samba-core-libs - samba-common-libs - samba-client-libs + - samba-client - libwbclient + - libsmbclient + - libldb diff --git a/tests/deps-check.sh b/tests/deps-check.sh index 622e88a..017c01d 100755 --- a/tests/deps-check.sh +++ b/tests/deps-check.sh @@ -15,6 +15,9 @@ # # libwbclient (no samba-*-libs dependencies - only links to libc) # +# samba-client (depends on samba-client-libs, NOT samba-libs) +# libsmbclient (depends on samba-client-libs, NOT samba-libs) +# # NOTE: This test checks RESOLVED dependencies, not just explicit Requires. # A library requirement like 'libfoo.so' is resolved to the package that # provides it, ensuring we catch indirect dependencies. @@ -121,6 +124,29 @@ echo "" echo "--- libwbclient ---" check_no_resolved_dep libwbclient "^samba-.*-libs$" "any samba-*-libs package" +echo "" + +# 5. samba-client must depend on samba-client-libs but NOT samba-libs +# (client tools should not pull in server libraries) +echo "--- samba-client ---" +check_has_resolved_dep samba-client "samba-client-libs" +check_no_resolved_dep samba-client "^samba-libs$" "samba-libs" + +echo "" + +# 6. libsmbclient must depend on samba-client-libs but NOT samba-libs +# (SMB client library should not pull in server libraries) +echo "--- libsmbclient ---" +check_has_resolved_dep libsmbclient "samba-client-libs" +check_no_resolved_dep libsmbclient "^samba-libs$" "samba-libs" + +echo "" + +# 7. libldb must NOT depend on any samba-*-libs packages +# (libldb is a standalone database library) +echo "--- libldb ---" +check_no_resolved_dep libldb "^samba-.*-libs$" "any samba-*-libs package" + echo "" echo "=== Summary ===" From dab569ad7194d1c3a2b51e50df08b20fdb00ce60 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 14 Jan 2026 12:46:37 +0100 Subject: [PATCH 420/425] Create a samba-ndr-libs package and drop samba-common-libs This should help sssd to reduce some of its dependencies. --- samba.spec | 216 ++++++++++++++++++++++--------------------- tests/deps-check.fmf | 10 +- tests/deps-check.sh | 40 ++++---- 3 files changed, 141 insertions(+), 125 deletions(-) diff --git a/samba.spec b/samba.spec index ccb55fc..da855ba 100644 --- a/samba.spec +++ b/samba.spec @@ -243,7 +243,7 @@ Patch0: samba-4.23-fix-cmocka.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-common-tools = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} @@ -465,7 +465,7 @@ Unix. Summary: Samba client programs Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: libldb = %{samba_depver} %if %{with libsmbclient} @@ -496,18 +496,54 @@ Requires: %{name}-common = %{samba_depver} Provides: bundled(libreplace) = %{samba_depver} +%if %{without dc} && %{without testsuite} +Obsoletes: samba-dc < %{samba_depver} +Obsoletes: samba-dc-libs < %{samba_depver} +Obsoletes: samba-dc-bind-dlz < %{samba_depver} +%endif + +# ctdb-tests package has been dropped if we do not build the testsuite +%if %{with clustering} +%if %{without testsuite} +Obsoletes: ctdb-tests < %{samba_depver} +Obsoletes: ctdb-tests-debuginfo < %{samba_depver} +# endif without testsuite +%endif +# endif with clustering +%endif + +# We only build glusterfs for RHGS and Fedora, so obsolete it on other versions +# of the distro +%if %{without vfs_glusterfs} +Obsoletes: samba-vfs-glusterfs < %{samba_depver} +# endif without vfs_glusterfs +%endif + %description core-libs The samba-core-libs package contains foundational libraries needed by both Samba servers and clients. This includes error handling, utilities, -and NDR serialization support. +and basic support libraries. + +### NDR-LIBS +%package ndr-libs +Summary: Samba NDR libraries +Requires(pre): %{name}-common = %{samba_depver} +Requires: %{name}-common = %{samba_depver} +Requires: %{name}-core-libs = %{samba_depver} + +Provides: %{name}-common-libs = %{samba_depver} +Obsoletes: %{name}-common-libs < %{samba_depver} + +%description ndr-libs +The samba-ndr-libs package contains NDR (Network Data Representation) +encoding libraries used by both Samba servers and clients. ### CLIENT-LIBS %package client-libs Summary: Samba client libraries Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} -Requires: %{name}-core-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: libldb = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} @@ -537,50 +573,10 @@ Obsoletes: samba4-common < %{samba_depver} samba-common provides files necessary for both the server and client packages of Samba. -### COMMON-LIBS -%package common-libs -Summary: Libraries used by both Samba servers and clients -Requires(pre): samba-common = %{samba_depver} -Requires: samba-common = %{samba_depver} -Requires: %{name}-core-libs = %{samba_depver} -Requires: libldb = %{samba_depver} -%if %{with libwbclient} -Requires: libwbclient = %{samba_depver} -%endif - -Provides: bundled(libreplace) = %{samba_depver} - -%if %{without dc} && %{without testsuite} -Obsoletes: samba-dc < %{samba_depver} -Obsoletes: samba-dc-libs < %{samba_depver} -Obsoletes: samba-dc-bind-dlz < %{samba_depver} -%endif - -# ctdb-tests package has been dropped if we do not build the testsuite -%if %{with clustering} -%if %{without testsuite} -Obsoletes: ctdb-tests < %{samba_depver} -Obsoletes: ctdb-tests-debuginfo < %{samba_depver} -# endif without testsuite -%endif -# endif with clustering -%endif - -# We only build glusterfs for RHGS and Fedora, so obsolete it on other versions -# of the distro -%if %{without vfs_glusterfs} -Obsoletes: samba-vfs-glusterfs < %{samba_depver} -# endif without vfs_glusterfs -%endif - -%description common-libs -The samba-common-libs package contains internal libraries needed by the -SMB/CIFS clients. - ### COMMON-TOOLS %package common-tools Summary: Tools for Samba clients -Requires: samba-common-libs = %{samba_depver} +Requires: samba-ndr-libs = %{samba_depver} Requires: samba-client-libs = %{samba_depver} Requires: samba-libs = %{samba_depver} Requires: samba-ldb-ldap-modules = %{samba_depver} @@ -618,7 +614,7 @@ and for GPO management on domain members. ### RPC %package dcerpc Summary: DCE RPC binaries -Requires: samba-common-libs = %{samba_depver} +Requires: samba-ndr-libs = %{samba_depver} Requires: samba-client-libs = %{samba_depver} Requires: samba-libs = %{samba_depver} Requires: libldb = %{samba_depver} @@ -636,7 +632,7 @@ The samba-dcerpc package contains binaries that serve DCERPC over named pipes. Summary: Samba AD Domain Controller Requires: %{name} = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-common-tools = %{samba_depver} Requires: %{name}-tools = %{samba_depver} Requires: %{name}-libs = %{samba_depver} @@ -680,7 +676,7 @@ The samba-dc-provision package provides files to setup a domain controller %package dc-libs Summary: Samba AD Domain Controller Libraries Requires: %{name}-client-libs = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: libldb = %{samba_depver} Requires: libwbclient = %{samba_depver} @@ -718,8 +714,10 @@ name server related details of Samba AD. ### DEVEL %package devel Summary: Developer tools for Samba libraries -Requires: %{name}-libs = %{samba_depver} +Requires: %{name}-core-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} +Requires: %{name}-libs = %{samba_depver} Requires: %{name}-dc-libs = %{samba_depver} Requires: libnetapi = %{samba_depver} @@ -774,7 +772,7 @@ Summary: Samba VFS module for GlusterFS Requires: glusterfs-api >= 3.4.0.16 Requires: glusterfs >= 3.4.0.16 Requires: %{name} = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: libldb = %{samba_depver} @@ -825,7 +823,7 @@ the Kerberos credentials cache of the user issuing the print job. %package ldb-ldap-modules Summary: Samba ldap modules for ldb Requires: %{name}-client-libs = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: libldb = %{samba_depver} Requires: libwbclient = %{samba_depver} @@ -836,7 +834,7 @@ samba-gpupdate. ### LIBS %package libs Summary: Samba libraries -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: libldb = %{samba_depver} %if %{with libwbclient} @@ -857,7 +855,7 @@ against the SMB, RPC and other protocols provided by the Samba suite. Summary: The NETAPI library Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: libldb = %{samba_depver} Requires: libwbclient = %{samba_depver} @@ -879,7 +877,7 @@ develop programs that link against the NETAPI library in the Samba suite. Summary: The SMB client library Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: libldb = %{samba_depver} %if %{with libwbclient} @@ -929,7 +927,7 @@ library. %package -n python3-%{name} Summary: Samba Python3 libraries Requires: %{name}-client-libs = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-dc-libs = %{samba_depver} Requires: python3-cryptography @@ -999,7 +997,7 @@ Requires: %{name} = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-winbind = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-test-libs = %{samba_depver} @@ -1030,7 +1028,7 @@ packages of Samba. ### TEST-LIBS %package test-libs Summary: Libraries need by the testing tools for Samba servers and clients -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: libldb = %{samba_depver} @@ -1063,8 +1061,8 @@ as a user using the `net usershare` command. Summary: Samba winbind Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} -Requires(post): %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} +Requires(post): %{name}-ndr-libs = %{samba_depver} Requires: %{name}-common-tools = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires(post): %{name}-client-libs = %{samba_depver} @@ -1097,7 +1095,7 @@ Windows user and group accounts on Linux. %package winbind-clients Summary: Samba winbind clients Requires: %{name}-common = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-winbind = %{samba_depver} @@ -1167,7 +1165,7 @@ necessary to communicate to the Winbind Daemon Summary: Samba Winexe Windows Binary License: GPL-3.0-only Requires: %{name}-client-libs = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: libldb = %{samba_depver} Requires: libwbclient = %{samba_depver} @@ -1182,7 +1180,7 @@ Winexe is a Remote Windows-command executor %package -n ctdb Summary: A Clustered Database based on Samba's Trivial Database (TDB) -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-winbind-clients = %{samba_depver} @@ -1729,7 +1727,7 @@ fi %ldconfig_scriptlets client-libs -%ldconfig_scriptlets common-libs +%ldconfig_scriptlets ndr-libs %if %{with dc} %ldconfig_scriptlets dc-libs @@ -2057,19 +2055,59 @@ fi %{_libdir}/libsamba-util.so.%{libsamba_util_so_version}* %{_libdir}/libtevent-util.so.%{libtevent_util_so_version}* +### NDR-LIBS +%files ndr-libs + # -# Tier 3: Public libraries - NDR serialization (depends on Tier 1-2) +# Core NDR library # %{_libdir}/libndr.so.%{libndr_so_version}* +# +# Tier 0: libc only dependencies +# +%{_libdir}/samba/libutil-setid-private-samba.so +%{_libdir}/samba/libutil-tdb-private-samba.so + +# +# Tier 1: system libs only (libtalloc) +# +%{_libdir}/samba/libiov-buf-private-samba.so +%{_libdir}/samba/libstable-sort-private-samba.so +%{_libdir}/samba/libtalloc-report-private-samba.so +%{_libdir}/samba/libtalloc-report-printf-private-samba.so + +# +# Tier 2: depends on core-libs (debug, replace) +# +%{_libdir}/samba/libflag-mapping-private-samba.so +%{_libdir}/samba/libinterfaces-private-samba.so +%{_libdir}/samba/libtdb-wrap-private-samba.so + +# +# Tier 3: depends on core-libs (util, errors, ndr) +# +%{_libdir}/samba/libdbwrap-private-samba.so +%{_libdir}/samba/libsamba3-util-private-samba.so +%{_libdir}/samba/libutil-reg-private-samba.so + +# +# Tier 4: depends on core-libs + Tier 3 libs +# +%{_libdir}/samba/libsamba-security-private-samba.so + +# +# NDR encoding libraries +# +%{_libdir}/libndr-nbt.so.%{libndr_nbt_so_version}* +%{_libdir}/libndr-standard.so.%{libndr_standard_so_version}* +%{_libdir}/libndr-krb5pac.so.%{libndr_krb5pac_so_version}* + ### CLIENT-LIBS %files client-libs %{_libdir}/libdcerpc-binding.so.%{libdcerpc_binding_so_version}* %{_libdir}/libdcerpc-server-core.so.%{libdcerpc_server_core_so_version}* %{_libdir}/libdcerpc.so.%{libdcerpc_so_version}* -%{_libdir}/libndr-krb5pac.so.%{libndr_krb5pac_so_version}* -%{_libdir}/libndr-nbt.so.%{libndr_nbt_so_version}* -%{_libdir}/libndr-standard.so.%{libndr_standard_so_version}* %{_libdir}/libsamba-credentials.so.%{libsamba_credentials_so_version}* %{_libdir}/libsamba-hostconfig.so.%{libsamba_hostconfig_so_version}* %{_libdir}/libsamba-passdb.so.%{libsamba_passdb_so_version}* @@ -2139,7 +2177,6 @@ fi # %dir %{_libdir}/samba/ldb %dir %{_libdir}/samba/pdb -%{_libdir}/samba/pdb/ldapsam.so %{_libdir}/samba/pdb/smbpasswd.so %{_libdir}/samba/pdb/tdbsam.so @@ -2192,42 +2229,6 @@ fi %{_mandir}/man5/smbpasswd.5* %{_mandir}/man7/samba.7* -### COMMON-LIBS -%files common-libs - -# -# Tier 0: libc only dependencies -# -%{_libdir}/samba/libutil-setid-private-samba.so -%{_libdir}/samba/libutil-tdb-private-samba.so - -# -# Tier 1: system libs only (libtalloc) -# -%{_libdir}/samba/libiov-buf-private-samba.so -%{_libdir}/samba/libstable-sort-private-samba.so -%{_libdir}/samba/libtalloc-report-private-samba.so -%{_libdir}/samba/libtalloc-report-printf-private-samba.so - -# -# Tier 2: depends on core-libs (debug, replace) -# -%{_libdir}/samba/libflag-mapping-private-samba.so -%{_libdir}/samba/libinterfaces-private-samba.so -%{_libdir}/samba/libtdb-wrap-private-samba.so - -# -# Tier 3: depends on core-libs (util, errors, ndr) -# -%{_libdir}/samba/libdbwrap-private-samba.so -%{_libdir}/samba/libsamba3-util-private-samba.so -%{_libdir}/samba/libutil-reg-private-samba.so - -# -# Tier 4: depends on core-libs + Tier 3 libs -# -%{_libdir}/samba/libsamba-security-private-samba.so - ### COMMON-TOOLS %files common-tools %{_bindir}/net @@ -2601,6 +2602,11 @@ fi %{_libdir}/samba/libtorture-private-samba.so %{_libdir}/samba/libutil-crypt-private-samba.so +# +# Password database modules (server-side, links to libsmbldaphelper) +# +%{_libdir}/samba/pdb/ldapsam.so + ### LIBNETAPI %files -n libnetapi %{_libdir}/libnetapi.so.%{libnetapi_so_version}* diff --git a/tests/deps-check.fmf b/tests/deps-check.fmf index 959093e..c1452d0 100644 --- a/tests/deps-check.fmf +++ b/tests/deps-check.fmf @@ -2,18 +2,20 @@ summary: Check samba package dependency structure description: | Verify that samba library packages maintain correct dependency hierarchy: - samba-core-libs has no samba-*-libs dependencies - - samba-common-libs depends on samba-core-libs (not samba-client-libs) - - samba-client-libs depends on core-libs + common-libs (not samba-libs) - - libwbclient has no samba-*-libs dependencies + - samba-ndr-libs depends on samba-core-libs (not samba-client-libs or samba-libs) + - samba-client-libs depends on core-libs + ndr-libs (not samba-libs) - samba-client depends on samba-client-libs (not samba-libs) + - samba-libs does not depend on samba-dc-libs - libsmbclient depends on samba-client-libs (not samba-libs) + - libwbclient has no samba-*-libs dependencies - libldb has no samba-*-libs dependencies test: ./deps-check.sh framework: shell require: - samba-core-libs - - samba-common-libs + - samba-ndr-libs - samba-client-libs + - samba-libs - samba-client - libwbclient - libsmbclient diff --git a/tests/deps-check.sh b/tests/deps-check.sh index 017c01d..ce49074 100755 --- a/tests/deps-check.sh +++ b/tests/deps-check.sh @@ -8,10 +8,10 @@ # samba-core-libs (no samba-*-libs dependencies) # ^ # | -# samba-common-libs (depends on samba-core-libs only) +# samba-ndr-libs (depends on samba-core-libs only) # ^ # | -# samba-client-libs (depends on samba-core-libs + samba-common-libs) +# samba-client-libs (depends on samba-core-libs + samba-ndr-libs) # # libwbclient (no samba-*-libs dependencies - only links to libc) # @@ -32,14 +32,14 @@ ERRORS=0 get_resolved_deps() { local pkg="$1" - rpm -qR "$pkg" 2>/dev/null | while read -r req; do + rpm --query --requires "$pkg" 2>/dev/null | while read -r req; do # Skip rpmlib and config requirements [[ "$req" =~ ^rpmlib ]] && continue [[ "$req" =~ ^config ]] && continue [[ "$req" =~ ^/ ]] && continue # Get the package that provides this requirement - provider=$(rpm -q --whatprovides "$req" 2>/dev/null | head -1) + provider=$(rpm --query --whatprovides "$req" 2>/dev/null | head -1) if [ -n "$provider" ] && [ "$provider" != "no package provides $req" ]; then # Extract just the package name (remove version-release.arch) echo "${provider%%-[0-9]*}" @@ -54,7 +54,7 @@ check_no_resolved_dep() { local pattern="$2" local description="$3" - if ! rpm -q "$pkg" &>/dev/null; then + if ! rpm --query "$pkg" &>/dev/null; then echo "SKIP: $pkg not installed" return 0 fi @@ -78,7 +78,7 @@ check_has_resolved_dep() { local pkg="$1" local expected="$2" - if ! rpm -q "$pkg" &>/dev/null; then + if ! rpm --query "$pkg" &>/dev/null; then echo "SKIP: $pkg not installed" return 0 fi @@ -99,30 +99,31 @@ echo "" # 1. samba-core-libs must NOT depend on any samba-*-libs packages echo "--- samba-core-libs ---" -check_no_resolved_dep samba-core-libs "^samba-.*-libs$" "any samba-*-libs package" +check_no_resolved_dep samba-core-libs "^samba-.*-libs$" "any samba*-libs package" echo "" -# 2. samba-common-libs must depend on samba-core-libs -# but NOT samba-client-libs -echo "--- samba-common-libs ---" -check_has_resolved_dep samba-common-libs "samba-core-libs" -check_no_resolved_dep samba-common-libs "^samba-client-libs$" "samba-client-libs" +# 2. samba-ndr-libs must depend on samba-core-libs +# but NOT samba-client-libs or samba-libs +echo "--- samba-ndr-libs ---" +check_has_resolved_dep samba-ndr-libs "samba-core-libs" +check_no_resolved_dep samba-ndr-libs "^samba-client-libs$" "samba-client-libs" +check_no_resolved_dep samba-ndr-libs "^samba-libs$" "samba-libs" echo "" -# 3. samba-client-libs must depend on samba-core-libs and samba-common-libs +# 3. samba-client-libs must depend on samba-core-libs and samba-ndr-libs # but NOT samba-libs echo "--- samba-client-libs ---" check_has_resolved_dep samba-client-libs "samba-core-libs" -check_has_resolved_dep samba-client-libs "samba-common-libs" +check_has_resolved_dep samba-client-libs "samba-ndr-libs" check_no_resolved_dep samba-client-libs "^samba-libs$" "samba-libs" echo "" # 4. libwbclient must NOT depend on any samba-*-libs packages echo "--- libwbclient ---" -check_no_resolved_dep libwbclient "^samba-.*-libs$" "any samba-*-libs package" +check_no_resolved_dep libwbclient "^samba-.*-libs$" "any samba*-libs package" echo "" @@ -145,7 +146,14 @@ echo "" # 7. libldb must NOT depend on any samba-*-libs packages # (libldb is a standalone database library) echo "--- libldb ---" -check_no_resolved_dep libldb "^samba-.*-libs$" "any samba-*-libs package" +check_no_resolved_dep libldb "^samba-.*-libs$" "any samba*-libs package" + +echo "" + +# 8. samba-libs must NOT depend on samba-dc-libs +# (server libraries should not pull in DC-specific libraries) +echo "--- samba-libs ---" +check_no_resolved_dep samba-libs "^samba-dc-libs$" "samba-dc-libs" echo "" echo "=== Summary ===" From da7dc3fa610fd20c6e5a2776fc3bec213c1163b6 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 14 Jan 2026 14:28:18 +0100 Subject: [PATCH 421/425] Add missing tmt files [skip changelog] --- .fmf/version | 1 + plans.fmf | 4 ++++ 2 files changed, 5 insertions(+) create mode 100644 .fmf/version create mode 100644 plans.fmf diff --git a/.fmf/version b/.fmf/version new file mode 100644 index 0000000..d00491f --- /dev/null +++ b/.fmf/version @@ -0,0 +1 @@ +1 diff --git a/plans.fmf b/plans.fmf new file mode 100644 index 0000000..e6427de --- /dev/null +++ b/plans.fmf @@ -0,0 +1,4 @@ +discover: + how: fmf +execute: + how: tmt From 6af45b81d32d8b941a8bfcadc8cf302ad2bbdd0b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 14 Jan 2026 16:11:15 +0100 Subject: [PATCH 422/425] Add /usr/bin/nmbd to rpminspect.yml /usr/sbin/nmbd is a symlink to /usr/bin/nmbd on Fedora. [skip changelog] --- rpminspect.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/rpminspect.yaml b/rpminspect.yaml index c1455e2..b30fdbe 100644 --- a/rpminspect.yaml +++ b/rpminspect.yaml @@ -4,6 +4,7 @@ inspections: badfuncs: ignore: + - /usr/bin/nmbd - /usr/bin/nmblookup - /usr/bin/smbtorture - /usr/lib*/libndr.so.* From dca7b1cb88abf129b7f421b1b867d5eb068de56e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 14 Jan 2026 16:35:54 +0100 Subject: [PATCH 423/425] Move Obsoletes to ndr-package which more or less was common-libs [skip changelog] --- samba.spec | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/samba.spec b/samba.spec index da855ba..cdeefca 100644 --- a/samba.spec +++ b/samba.spec @@ -496,6 +496,21 @@ Requires: %{name}-common = %{samba_depver} Provides: bundled(libreplace) = %{samba_depver} +%description core-libs +The samba-core-libs package contains foundational libraries needed by +both Samba servers and clients. This includes error handling, utilities, +and basic support libraries. + +### NDR-LIBS +%package ndr-libs +Summary: Samba NDR libraries +Requires(pre): %{name}-common = %{samba_depver} +Requires: %{name}-common = %{samba_depver} +Requires: %{name}-core-libs = %{samba_depver} + +Provides: %{name}-common-libs = %{samba_depver} +Obsoletes: %{name}-common-libs < %{samba_depver} + %if %{without dc} && %{without testsuite} Obsoletes: samba-dc < %{samba_depver} Obsoletes: samba-dc-libs < %{samba_depver} @@ -519,21 +534,6 @@ Obsoletes: samba-vfs-glusterfs < %{samba_depver} # endif without vfs_glusterfs %endif -%description core-libs -The samba-core-libs package contains foundational libraries needed by -both Samba servers and clients. This includes error handling, utilities, -and basic support libraries. - -### NDR-LIBS -%package ndr-libs -Summary: Samba NDR libraries -Requires(pre): %{name}-common = %{samba_depver} -Requires: %{name}-common = %{samba_depver} -Requires: %{name}-core-libs = %{samba_depver} - -Provides: %{name}-common-libs = %{samba_depver} -Obsoletes: %{name}-common-libs < %{samba_depver} - %description ndr-libs The samba-ndr-libs package contains NDR (Network Data Representation) encoding libraries used by both Samba servers and clients. From 1f4ee5276f515f685bd1ba2f03eaed47402514ac Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 14 Jan 2026 16:10:15 +0100 Subject: [PATCH 424/425] Remove duplicate libdsdb-module-private-samba.so --- samba.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/samba.spec b/samba.spec index cdeefca..b49a21a 100644 --- a/samba.spec +++ b/samba.spec @@ -3904,7 +3904,6 @@ fi %if %{with dc} %{_libdir}/samba/libdlz-bind9-for-torture-private-samba.so %endif -%{_libdir}/samba/libdsdb-module-private-samba.so ### USERSHARES %files usershares From 58df5ed52bbd18e89ba9316f9f8a69ab4800910b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 15 Jan 2026 17:21:14 +0100 Subject: [PATCH 425/425] rpminspect: Don't run annocheck on test binaries [skip changelog] --- rpminspect.yaml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/rpminspect.yaml b/rpminspect.yaml index b30fdbe..f736bfa 100644 --- a/rpminspect.yaml +++ b/rpminspect.yaml @@ -26,3 +26,10 @@ abidiff: debuginfo: ignore: - /usr/lib*/libdcerpc-samr.so.* + +annocheck: + ignore: + - /usr/bin/gentest + - /usr/bin/locktest + - /usr/bin/masktest + - /usr/bin/smbtorture