From 98c6fdaeee073b3f3972467a345c7647210e801f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Fri, 10 Feb 2023 20:55:16 +0100 Subject: [PATCH 01/37] Create package samba-tools, move there samba-tool binary resolves: rhbz#2166124 --- samba.spec | 86 +++++++++++++++++------------------------------------- 1 file changed, 27 insertions(+), 59 deletions(-) diff --git a/samba.spec b/samba.spec index 562f5a2..694ceaf 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.0 -%global baserelease 3 +%global baserelease 4 # This should be rc1 or %%nil %global pre_release rc2 @@ -511,7 +511,7 @@ SMB/CIFS clients. ### COMMON-TOOLS %package common-tools -Summary: Tools for Samba servers and clients +Summary: Tools for Samba clients Requires: samba-common-libs = %{samba_depver} Requires: samba-client-libs = %{samba_depver} Requires: samba-libs = %{samba_depver} @@ -521,22 +521,28 @@ Requires: libnetapi = %{samba_depver} Requires: libwbclient = %{samba_depver} %endif +Provides: bundled(libreplace) + +%description common-tools +The samba-common-tools package contains tools for SMB/CIFS clients. + +### SAMBA-TOOLS +%package tools +Summary: Tools for Samba servers # samba-tool needs python3-samba Requires: python3-%{name} = %{samba_depver} # samba-tool needs tdbbackup Requires: tdb-tools -%if %{with dc} -# samba-tool needs python3-samba-dc on a full build +# samba-tool needs python3-samba-dc also on non-dc build Requires: python3-%{name}-dc = %{samba_depver} +%if %{with dc} # samba-tool needs mdb_copy for domain backup or upgrade provision Requires: lmdb %endif -Provides: bundled(libreplace) - -%description common-tools -The samba-common-tools package contains tools for Samba servers and -SMB/CIFS clients. +%description tools +The samba-tools package contains tools for Samba servers +and for GPO management on domain members. ### RPC %package dcerpc @@ -877,7 +883,6 @@ Requires: %{name}-libs = %{samba_depver} The python3-%{name}-test package contains the Python libraries used by the test suite of Samba. If you want to run full set of Samba tests, you need to install this package. -%if %{with dc} || %{with testsuite} %package -n python3-samba-dc Summary: Samba Python libraries for Samba AD Requires: %{name}-client-libs = %{samba_depver} @@ -887,7 +892,6 @@ Requires: python3-%{name} = %{samba_depver} %description -n python3-samba-dc The python3-%{name}-dc package contains the Python libraries needed by programs to manage Samba AD. -%endif ### PIDL %package pidl @@ -980,6 +984,7 @@ Requires(post): %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires(post): %{name}-libs = %{samba_depver} Requires: %{name}-winbind-modules = %{samba_depver} +Recommends: %{name}-tools = %{samba_depver} %if %{with libwbclient} Requires(post): libwbclient = %{samba_depver} @@ -1407,54 +1412,10 @@ touch %{buildroot}%{_libdir}/krb5/plugins/libkrb5/winbind_krb5_locator.so %if %{without dc} && %{without testsuite} for i in \ - %{_libdir}/samba/libdfs-server-ad-samba4.so \ - %{_libdir}/samba/libdsdb-garbage-collect-tombstones-samba4.so \ - %{_libdir}/samba/libscavenge-dns-records-samba4.so \ %{_mandir}/man8/samba.8 \ %{_mandir}/man8/samba_downgrade_db.8 \ %{_mandir}/man8/samba-gpupdate.8 \ %{_unitdir}/samba.service \ - %{python3_sitearch}/samba/dcerpc/dnsserver.*.so \ - %{python3_sitearch}/samba/dnsserver.py \ - %{python3_sitearch}/samba/domain_update.py \ - %{python3_sitearch}/samba/forest_update.py \ - %{python3_sitearch}/samba/kcc/__init__.py \ - %{python3_sitearch}/samba/kcc/debug.py \ - %{python3_sitearch}/samba/kcc/graph.py \ - %{python3_sitearch}/samba/kcc/graph_utils.py \ - %{python3_sitearch}/samba/kcc/kcc_utils.py \ - %{python3_sitearch}/samba/kcc/ldif_import_export.py \ - %{python3_sitearch}/samba/kcc/__pycache__/__init__.*.pyc \ - %{python3_sitearch}/samba/kcc/__pycache__/debug.*.pyc \ - %{python3_sitearch}/samba/kcc/__pycache__/graph.*.pyc \ - %{python3_sitearch}/samba/kcc/__pycache__/graph_utils.*.pyc \ - %{python3_sitearch}/samba/kcc/__pycache__/kcc_utils.*.pyc \ - %{python3_sitearch}/samba/kcc/__pycache__/ldif_import_export.*.pyc \ - %{python3_sitearch}/samba/ms_forest_updates_markdown.py \ - %{python3_sitearch}/samba/ms_schema_markdown.py \ - %{python3_sitearch}/samba/provision/__init__.py \ - %{python3_sitearch}/samba/provision/backend.py \ - %{python3_sitearch}/samba/provision/common.py \ - %{python3_sitearch}/samba/provision/kerberos_implementation.py \ - %{python3_sitearch}/samba/provision/kerberos.py \ - %{python3_sitearch}/samba/provision/sambadns.py \ - %{python3_sitearch}/samba/provision/__pycache__/__init__.*.pyc \ - %{python3_sitearch}/samba/provision/__pycache__/backend.*.pyc \ - %{python3_sitearch}/samba/provision/__pycache__/common.*.pyc \ - %{python3_sitearch}/samba/provision/__pycache__/kerberos_implementation.*.pyc \ - %{python3_sitearch}/samba/provision/__pycache__/kerberos.*.pyc \ - %{python3_sitearch}/samba/provision/__pycache__/sambadns.*.pyc \ - %{python3_sitearch}/samba/__pycache__/domain_update.*.pyc \ - %{python3_sitearch}/samba/__pycache__/forest_update.*.pyc \ - %{python3_sitearch}/samba/__pycache__/ms_forest_updates_markdown.*.pyc \ - %{python3_sitearch}/samba/__pycache__/ms_schema_markdown.*.pyc \ - %{python3_sitearch}/samba/__pycache__/remove_dc.*.pyc \ - %{python3_sitearch}/samba/__pycache__/schema.*.pyc \ - %{python3_sitearch}/samba/__pycache__/uptodateness.*.pyc \ - %{python3_sitearch}/samba/remove_dc.py \ - %{python3_sitearch}/samba/samdb.py \ - %{python3_sitearch}/samba/schema.py \ - %{python3_sitearch}/samba/uptodateness.py \ %{_sbindir}/samba-gpupdate \ ; do rm -f %{buildroot}$i @@ -2069,11 +2030,11 @@ fi %{_libdir}/samba/pdb/smbpasswd.so %{_libdir}/samba/pdb/tdbsam.so +### COMMON-TOOLS %files common-tools %{_bindir}/net %{_bindir}/pdbedit %{_bindir}/profiles -%{_bindir}/samba-tool %{_bindir}/smbcontrol %{_bindir}/smbpasswd %{_bindir}/testparm @@ -2082,9 +2043,13 @@ fi %{_mandir}/man1/testparm.1* %{_mandir}/man8/net.8* %{_mandir}/man8/pdbedit.8* -%{_mandir}/man8/samba-tool.8* %{_mandir}/man8/smbpasswd.8* +### TOOLS +%files tools +%{_bindir}/samba-tool +%{_mandir}/man8/samba-tool.8* + ### RPC %files dcerpc %dir %{_libexecdir}/samba @@ -2805,7 +2770,6 @@ fi %{_libdir}/libsamba-policy.*.so %{_libdir}/pkgconfig/samba-policy.*.pc -%if %{with dc} || %{with testsuite} %files -n python3-%{name}-dc %{python3_sitearch}/samba/samdb.py %{python3_sitearch}/samba/schema.py @@ -2821,7 +2785,9 @@ fi %{python3_sitearch}/samba/__pycache__/uptodateness.*.pyc %{python3_sitearch}/samba/dcerpc/dnsserver.*.so +%if %{with dc} || %{with testsuite} %{python3_sitearch}/samba/dckeytab.*.so +%endif %{python3_sitearch}/samba/domain_update.py %{python3_sitearch}/samba/forest_update.py %{python3_sitearch}/samba/ms_forest_updates_markdown.py @@ -2862,7 +2828,6 @@ fi %{python3_sitearch}/samba/remove_dc.py %{python3_sitearch}/samba/uptodateness.py -%endif %files -n python3-%{name}-test %dir %{python3_sitearch}/samba/tests @@ -4368,6 +4333,9 @@ fi %endif %changelog +* Tue Feb 14 2023 Pavel Filipenský - 4.18.0rc2-4 +- resolves: rhbz#2166124 - Create package samba-tools, move there samba-tool binary + * Thu Feb 02 2023 Guenther Deschner - 4.18.0rc2-3 - resolves: #2166416 - Update to version 4.18.0rc2 From 2d446a3116074ed3aab3210a0fa872686f3d0418 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 16 Feb 2023 09:11:52 +0100 Subject: [PATCH 02/37] Fix samba-tool dependencies --- samba.spec | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 694ceaf..9e61417 100644 --- a/samba.spec +++ b/samba.spec @@ -531,13 +531,12 @@ The samba-common-tools package contains tools for SMB/CIFS clients. Summary: Tools for Samba servers # samba-tool needs python3-samba Requires: python3-%{name} = %{samba_depver} -# samba-tool needs tdbbackup -Requires: tdb-tools # samba-tool needs python3-samba-dc also on non-dc build Requires: python3-%{name}-dc = %{samba_depver} %if %{with dc} -# samba-tool needs mdb_copy for domain backup or upgrade provision +# samba-tool needs mdb_copy and tdbackup for domain backup or upgrade provision Requires: lmdb +Requires: tdb-tools %endif %description tools From e8c2a9fd875def116d5ac4a5a0c3231af586b9eb Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 16 Feb 2023 09:13:28 +0100 Subject: [PATCH 03/37] Add missing Requires for samba-tool on samba-dc --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index 9e61417..564c0ac 100644 --- a/samba.spec +++ b/samba.spec @@ -565,6 +565,7 @@ Requires: %{name} = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-common-tools = %{samba_depver} +Requires: %{name}-tools = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-dc-provision = %{samba_depver} Requires: %{name}-dc-libs = %{samba_depver} From 798ea95f572256214f06b7ecf35ed90114afef0b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 15 Feb 2023 16:47:35 +0100 Subject: [PATCH 04/37] Update to version 4.18.0rc3 resolves: #2166416 Guenther --- .gitignore | 2 ++ samba.spec | 11 +++++++---- sources | 4 ++-- 3 files changed, 11 insertions(+), 6 deletions(-) diff --git a/.gitignore b/.gitignore index 1b867fd..f55b1d8 100644 --- a/.gitignore +++ b/.gitignore @@ -321,3 +321,5 @@ samba-3.6.0pre1.tar.gz /samba-4.18.0rc1.tar.asc /samba-4.18.0rc2.tar.xz /samba-4.18.0rc2.tar.asc +/samba-4.18.0rc3.tar.xz +/samba-4.18.0rc3.tar.asc diff --git a/samba.spec b/samba.spec index 564c0ac..ade4396 100644 --- a/samba.spec +++ b/samba.spec @@ -135,9 +135,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.0 -%global baserelease 4 +%global baserelease 6 # This should be rc1 or %%nil -%global pre_release rc2 +%global pre_release rc3 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -170,8 +170,8 @@ %global talloc_version 2.4.0 %global tdb_version 1.4.8 -%global tevent_version 0.14.0 -%global ldb_version 2.7.0 +%global tevent_version 0.14.1 +%global ldb_version 2.7.1 %global required_mit_krb5 1.20.1 @@ -4333,6 +4333,9 @@ fi %endif %changelog +* Wed Feb 15 2023 Guenther Deschner - 4.18.0rc3-6 +- resolves: #2166416 - Update to version 4.18.0rc3 + * Tue Feb 14 2023 Pavel Filipenský - 4.18.0rc2-4 - resolves: rhbz#2166124 - Create package samba-tools, move there samba-tool binary diff --git a/sources b/sources index 760bff2..bc6a0db 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.18.0rc2.tar.xz) = 1467ee97c5861e7306d2bf96c0c600404212d9b241cc28e5fb649f8297bdb3bb86a774cb78ccfc82a70f7b715eff7eb0de9dc3563ba0300c6a069d9609fbdef4 -SHA512 (samba-4.18.0rc2.tar.asc) = 557eec6485669b172b16fd5032750d8cfa8058d1615316d7e539924d561d7d7e7d0990bcf62f96d0ec467c8fc5e59c0bb8ea1a963396055b6af8659e166073cd +SHA512 (samba-4.18.0rc3.tar.xz) = ebcb183e4e823a6f4c7d6d483d4efd1e6da8cf5bce1d685bba7c80c7d2392ed909ab8fc14dd7f74aa10c0d1ad1e96830413bb001b4c8add8ee70f073175aab81 +SHA512 (samba-4.18.0rc3.tar.asc) = 178959b7e361655037534fd3d11648c7b5636e65547d85d2b8090a1e79a7580ac61ff35553aff1054b6031f49ad48096538a49e26f714d3ea10c493303910b91 From 2a727e7521e739a2dc06d351937dfe61167c826b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 21 Feb 2023 14:26:16 +0100 Subject: [PATCH 05/37] Remove obsolete patch --- samba-4.17-fix-changeuserpassword4.patch | 540 ----------------------- 1 file changed, 540 deletions(-) delete mode 100644 samba-4.17-fix-changeuserpassword4.patch diff --git a/samba-4.17-fix-changeuserpassword4.patch b/samba-4.17-fix-changeuserpassword4.patch deleted file mode 100644 index 7f1b482..0000000 --- a/samba-4.17-fix-changeuserpassword4.patch +++ /dev/null @@ -1,540 +0,0 @@ -From a3e3d05f35d6082ea48450060b39084e3d0e4056 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Mon, 10 Oct 2022 15:15:20 +0200 -Subject: [PATCH 1/5] s3:librpc: Improve GSE error message - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15206 - -Signed-off-by: Andreas Schneider -Reviewed-by: Noel Power ---- - source3/librpc/crypto/gse.c | 21 +++++++++++++++++++-- - 1 file changed, 19 insertions(+), 2 deletions(-) - -diff --git a/source3/librpc/crypto/gse.c b/source3/librpc/crypto/gse.c -index c50a8a036df..c2cac7abf82 100644 ---- a/source3/librpc/crypto/gse.c -+++ b/source3/librpc/crypto/gse.c -@@ -546,11 +546,28 @@ init_sec_context_done: - goto done; - case GSS_S_FAILURE: - switch (gss_min) { -- case (OM_uint32)KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN: -- DBG_NOTICE("Server principal not found\n"); -+ case (OM_uint32)KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN: { -+ gss_buffer_desc name_token = { -+ .length = 0, -+ }; -+ -+ gss_maj = gss_display_name(&gss_min, -+ gse_ctx->server_name, -+ &name_token, -+ NULL); -+ if (gss_maj == GSS_S_COMPLETE) { -+ DBG_NOTICE("Server principal %.*s not found\n", -+ (int)name_token.length, -+ (char *)name_token.value); -+ gss_release_buffer(&gss_maj, &name_token); -+ } else { -+ DBG_NOTICE("Server principal not found\n"); -+ } -+ - /* Make SPNEGO ignore us, we can't go any further here */ - status = NT_STATUS_INVALID_PARAMETER; - goto done; -+ } - case (OM_uint32)KRB5KRB_AP_ERR_TKT_EXPIRED: - DBG_NOTICE("Ticket expired\n"); - /* Make SPNEGO ignore us, we can't go any further here */ --- -2.37.3 - - -From d2e2e9acd717e45806f1b19378e09f39c8fe3da8 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Fri, 7 Oct 2022 14:35:15 +0200 -Subject: [PATCH 2/5] s3:rpcclient: Pass salt down to - init_samr_CryptPasswordAES() - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15206 - -Signed-off-by: Andreas Schneider -Reviewed-by: Noel Power ---- - source3/rpc_client/init_samr.c | 15 ++++----------- - source3/rpc_client/init_samr.h | 1 + - source3/rpcclient/cmd_samr.c | 8 ++++++++ - source4/libnet/libnet_passwd.c | 13 +++++++------ - source4/torture/rpc/samr.c | 27 +++++++++++++++++++++++++++ - 5 files changed, 47 insertions(+), 17 deletions(-) - -diff --git a/source3/rpc_client/init_samr.c b/source3/rpc_client/init_samr.c -index 68f42b602b3..52fa2f90d6e 100644 ---- a/source3/rpc_client/init_samr.c -+++ b/source3/rpc_client/init_samr.c -@@ -79,6 +79,7 @@ NTSTATUS init_samr_CryptPassword(const char *pwd, - - NTSTATUS init_samr_CryptPasswordAES(TALLOC_CTX *mem_ctx, - const char *password, -+ DATA_BLOB *salt, - DATA_BLOB *session_key, - struct samr_EncryptedPasswordAES *ppwd_buf) - { -@@ -87,12 +88,6 @@ NTSTATUS init_samr_CryptPasswordAES(TALLOC_CTX *mem_ctx, - .data = pw_data, - .length = sizeof(pw_data), - }; -- size_t iv_size = gnutls_cipher_get_iv_size(GNUTLS_CIPHER_AES_256_CBC); -- uint8_t iv_data[iv_size]; -- DATA_BLOB iv = { -- .data = iv_data, -- .length = iv_size, -- }; - DATA_BLOB ciphertext = data_blob_null; - NTSTATUS status = NT_STATUS_UNSUCCESSFUL; - bool ok; -@@ -101,8 +96,6 @@ NTSTATUS init_samr_CryptPasswordAES(TALLOC_CTX *mem_ctx, - return NT_STATUS_INVALID_PARAMETER; - } - -- generate_nonce_buffer(iv.data, iv.length); -- - ok = encode_pwd_buffer514_from_str(pw_data, password, STR_UNICODE); - if (!ok) { - return NT_STATUS_INTERNAL_ERROR; -@@ -114,7 +107,7 @@ NTSTATUS init_samr_CryptPasswordAES(TALLOC_CTX *mem_ctx, - session_key, - &samr_aes256_enc_key_salt, - &samr_aes256_mac_key_salt, -- &iv, -+ salt, - &ciphertext, - ppwd_buf->auth_data); - BURN_DATA(pw_data); -@@ -126,8 +119,8 @@ NTSTATUS init_samr_CryptPasswordAES(TALLOC_CTX *mem_ctx, - ppwd_buf->cipher = ciphertext.data; - ppwd_buf->PBKDF2Iterations = 0; - -- SMB_ASSERT(iv.length == sizeof(ppwd_buf->salt)); -- memcpy(ppwd_buf->salt, iv.data, iv.length); -+ SMB_ASSERT(salt->length == sizeof(ppwd_buf->salt)); -+ memcpy(ppwd_buf->salt, salt->data, salt->length); - - return NT_STATUS_OK; - } -diff --git a/source3/rpc_client/init_samr.h b/source3/rpc_client/init_samr.h -index 940534e7168..71b4c0e573d 100644 ---- a/source3/rpc_client/init_samr.h -+++ b/source3/rpc_client/init_samr.h -@@ -47,6 +47,7 @@ NTSTATUS init_samr_CryptPassword(const char *pwd, - */ - NTSTATUS init_samr_CryptPasswordAES(TALLOC_CTX *mem_ctx, - const char *password, -+ DATA_BLOB *salt, - DATA_BLOB *session_key, - struct samr_EncryptedPasswordAES *ppwd_buf); - -diff --git a/source3/rpcclient/cmd_samr.c b/source3/rpcclient/cmd_samr.c -index 9ccd2f78a8d..8106ca90cf2 100644 ---- a/source3/rpcclient/cmd_samr.c -+++ b/source3/rpcclient/cmd_samr.c -@@ -3172,6 +3172,11 @@ static NTSTATUS cmd_samr_setuserinfo_int(struct rpc_pipe_client *cli, - uint8_t nt_hash[16]; - uint8_t lm_hash[16]; - DATA_BLOB session_key; -+ uint8_t salt_data[16]; -+ DATA_BLOB salt = { -+ .data = salt_data, -+ .length = sizeof(salt_data), -+ }; - uint8_t password_expired = 0; - struct dcerpc_binding_handle *b = cli->binding_handle; - TALLOC_CTX *frame = NULL; -@@ -3198,6 +3203,8 @@ static NTSTATUS cmd_samr_setuserinfo_int(struct rpc_pipe_client *cli, - goto done; - } - -+ generate_nonce_buffer(salt.data, salt.length); -+ - switch(level) { - case 18: - case 21: -@@ -3220,6 +3227,7 @@ static NTSTATUS cmd_samr_setuserinfo_int(struct rpc_pipe_client *cli, - case 31: - status = init_samr_CryptPasswordAES(frame, - param, -+ &salt, - &session_key, - &pwd_buf_aes); - if (!NT_STATUS_IS_OK(status)) { -diff --git a/source4/libnet/libnet_passwd.c b/source4/libnet/libnet_passwd.c -index 4f662110e55..a1672104824 100644 ---- a/source4/libnet/libnet_passwd.c -+++ b/source4/libnet/libnet_passwd.c -@@ -57,13 +57,13 @@ static NTSTATUS libnet_ChangePassword_samr_aes(TALLOC_CTX *mem_ctx, - struct samr_EncryptedPasswordAES pwd_buf = { - .cipher_len = 0 - }; -- DATA_BLOB iv = { -+ DATA_BLOB salt = { - .data = pwd_buf.salt, - .length = sizeof(pwd_buf.salt), - }; -- gnutls_datum_t iv_datum = { -- .data = iv.data, -- .size = iv.length, -+ gnutls_datum_t salt_datum = { -+ .data = pwd_buf.salt, -+ .size = sizeof(pwd_buf.salt), - }; - uint64_t pbkdf2_iterations = generate_random_u64_range(5000, 1000000); - NTSTATUS status; -@@ -71,11 +71,11 @@ static NTSTATUS libnet_ChangePassword_samr_aes(TALLOC_CTX *mem_ctx, - - E_md4hash(old_password, old_nt_key_data); - -- generate_nonce_buffer(iv.data, iv.length); -+ generate_nonce_buffer(salt.data, salt.length); - - rc = gnutls_pbkdf2(GNUTLS_MAC_SHA512, - &old_nt_key, -- &iv_datum, -+ &salt_datum, - pbkdf2_iterations, - cek.data, - cek.length); -@@ -86,6 +86,7 @@ static NTSTATUS libnet_ChangePassword_samr_aes(TALLOC_CTX *mem_ctx, - - status = init_samr_CryptPasswordAES(mem_ctx, - new_password, -+ &salt, - &cek, - &pwd_buf); - data_blob_clear(&cek); -diff --git a/source4/torture/rpc/samr.c b/source4/torture/rpc/samr.c -index de354659067..0b1880efa18 100644 ---- a/source4/torture/rpc/samr.c -+++ b/source4/torture/rpc/samr.c -@@ -783,6 +783,11 @@ static bool test_SetUserPass_32(struct dcerpc_pipe *p, struct torture_context *t - struct samr_SetUserInfo s; - union samr_UserInfo u; - DATA_BLOB session_key; -+ uint8_t salt_data[16]; -+ DATA_BLOB salt = { -+ .data = salt_data, -+ .length = sizeof(salt_data), -+ }; - char *newpass = NULL; - struct dcerpc_binding_handle *b = p->binding_handle; - struct samr_GetUserPwInfo pwp; -@@ -818,8 +823,11 @@ static bool test_SetUserPass_32(struct dcerpc_pipe *p, struct torture_context *t - return false; - } - -+ generate_nonce_buffer(salt.data, salt.length); -+ - status = init_samr_CryptPasswordAES(tctx, - newpass, -+ &salt, - &session_key, - &u.info32.password); - torture_assert_ntstatus_ok(tctx, -@@ -852,6 +860,7 @@ static bool test_SetUserPass_32(struct dcerpc_pipe *p, struct torture_context *t - - status = init_samr_CryptPasswordAES(tctx, - newpass, -+ &salt, - &session_key, - &u.info32.password); - torture_assert_ntstatus_ok(tctx, -@@ -896,6 +905,11 @@ static bool test_SetUserPass_31(struct dcerpc_pipe *p, struct torture_context *t - union samr_UserInfo u; - bool ret = true; - DATA_BLOB session_key; -+ uint8_t salt_data[16]; -+ DATA_BLOB salt = { -+ .data = salt_data, -+ .length = sizeof(salt_data), -+ }; - char *newpass; - struct dcerpc_binding_handle *b = p->binding_handle; - struct samr_GetUserPwInfo pwp; -@@ -931,8 +945,11 @@ static bool test_SetUserPass_31(struct dcerpc_pipe *p, struct torture_context *t - return false; - } - -+ generate_nonce_buffer(salt.data, salt.length); -+ - status = init_samr_CryptPasswordAES(tctx, - newpass, -+ &salt, - &session_key, - &u.info31.password); - torture_assert_ntstatus_ok(tctx, -@@ -959,6 +976,7 @@ static bool test_SetUserPass_31(struct dcerpc_pipe *p, struct torture_context *t - - status = init_samr_CryptPasswordAES(tctx, - newpass, -+ &salt, - &session_key, - &u.info31.password); - torture_assert_ntstatus_ok(tctx, -@@ -1381,6 +1399,11 @@ static bool test_SetUserPass_level_ex(struct dcerpc_pipe *p, - union samr_UserInfo u; - bool ret = true; - DATA_BLOB session_key; -+ uint8_t salt_data[16]; -+ DATA_BLOB salt = { -+ .data = salt_data, -+ .length = sizeof(salt_data), -+ }; - char *newpass; - struct dcerpc_binding_handle *b = p->binding_handle; - struct samr_GetUserPwInfo pwp; -@@ -1490,6 +1513,8 @@ static bool test_SetUserPass_level_ex(struct dcerpc_pipe *p, - return false; - } - -+ generate_nonce_buffer(salt.data, salt.length); -+ - switch (level) { - case 18: - { -@@ -1561,6 +1586,7 @@ static bool test_SetUserPass_level_ex(struct dcerpc_pipe *p, - case 31: - status = init_samr_CryptPasswordAES(tctx, - newpass, -+ &salt, - &session_key, - &u.info31.password); - -@@ -1568,6 +1594,7 @@ static bool test_SetUserPass_level_ex(struct dcerpc_pipe *p, - case 32: - status = init_samr_CryptPasswordAES(tctx, - newpass, -+ &salt, - &session_key, - &u.info32.password); - --- -2.37.3 - - -From 1d630363c9b2497266e418aad89c55d5b51a63ad Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Mon, 17 Oct 2022 09:02:28 +0200 -Subject: [PATCH 3/5] s4:libnet: If we successfully changed the password we are - done - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15206 - -Signed-off-by: Andreas Schneider -Reviewed-by: Noel Power ---- - source4/libnet/libnet_passwd.c | 32 ++++++++++++++++++-------------- - 1 file changed, 18 insertions(+), 14 deletions(-) - -diff --git a/source4/libnet/libnet_passwd.c b/source4/libnet/libnet_passwd.c -index a1672104824..b17614bcd97 100644 ---- a/source4/libnet/libnet_passwd.c -+++ b/source4/libnet/libnet_passwd.c -@@ -101,7 +101,7 @@ static NTSTATUS libnet_ChangePassword_samr_aes(TALLOC_CTX *mem_ctx, - r.in.password = &pwd_buf; - - status = dcerpc_samr_ChangePasswordUser4_r(h, mem_ctx, &r); -- if (NT_STATUS_IS_OK(status)) { -+ if (!NT_STATUS_IS_OK(status)) { - goto done; - } - if (!NT_STATUS_IS_OK(r.out.result)) { -@@ -112,6 +112,7 @@ static NTSTATUS libnet_ChangePassword_samr_aes(TALLOC_CTX *mem_ctx, - account->string, - nt_errstr(status)); - status = r.out.result; -+ goto done; - } - - done: -@@ -424,20 +425,23 @@ static NTSTATUS libnet_ChangePassword_samr(struct libnet_context *ctx, TALLOC_CT - r->samr.in.oldpassword, - r->samr.in.newpassword, - &(r->samr.out.error_string)); -- if (!NT_STATUS_IS_OK(status)) { -- if (NT_STATUS_EQUAL(status, -- NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE) || -- NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED) || -- NT_STATUS_EQUAL(status, NT_STATUS_NOT_IMPLEMENTED)) { -- /* -- * Don't fallback to RC4 based SAMR if weak crypto is not -- * allowed. -- */ -- if (lpcfg_weak_crypto(ctx->lp_ctx) == -- SAMBA_WEAK_CRYPTO_DISALLOWED) { -- goto disconnect; -- } -+ if (NT_STATUS_IS_OK(status)) { -+ goto disconnect; -+ } else if (NT_STATUS_EQUAL(status, -+ NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE) || -+ NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED) || -+ NT_STATUS_EQUAL(status, NT_STATUS_NOT_IMPLEMENTED)) { -+ /* -+ * Don't fallback to RC4 based SAMR if weak crypto is not -+ * allowed. -+ */ -+ if (lpcfg_weak_crypto(ctx->lp_ctx) == -+ SAMBA_WEAK_CRYPTO_DISALLOWED) { -+ goto disconnect; - } -+ } else { -+ /* libnet_ChangePassword_samr_aes is implemented and failed */ -+ goto disconnect; - } - - status = libnet_ChangePassword_samr_rc4( --- -2.37.3 - - -From 9a4a169ab34641afb87e7f81708c9a72b321879e Mon Sep 17 00:00:00 2001 -From: Noel Power -Date: Fri, 21 Oct 2022 17:40:36 +0100 -Subject: [PATCH 4/5] s4/rpc_server/sambr: don't mutate the return of - samdb_set_password_aes - -prior to this commit return of samdb_set_password_aes was set to -NT_STATUS_WRONG_PASSWORD on failure. Useful status that should be -returned such as NT_STATUS_PASSWORD_RESTRICTION are swallowed here -otherwise (and in this case can be partially responsible for failures -in test samba.tests.auth_log_pass_change (with later gnutls) - -Signed-off-by: Noel Power -Reviewed-by: Andreas Schneider ---- - source4/rpc_server/samr/samr_password.c | 1 - - 1 file changed, 1 deletion(-) - -diff --git a/source4/rpc_server/samr/samr_password.c b/source4/rpc_server/samr/samr_password.c -index 4691f9a47a9..b581be6361c 100644 ---- a/source4/rpc_server/samr/samr_password.c -+++ b/source4/rpc_server/samr/samr_password.c -@@ -250,7 +250,6 @@ NTSTATUS dcesrv_samr_ChangePasswordUser4(struct dcesrv_call_state *dce_call, - - if (!NT_STATUS_IS_OK(status)) { - ldb_transaction_cancel(sam_ctx); -- status = NT_STATUS_WRONG_PASSWORD; - goto done; - } - --- -2.37.3 - - -From b8b36ecba0f22dbc203c12627ebd629c2437c635 Mon Sep 17 00:00:00 2001 -From: Noel Power -Date: Fri, 21 Oct 2022 17:14:44 +0100 -Subject: [PATCH 5/5] python/samba/tests: fix samba.tests.auth_log_pass_change - for later gnutls - -later gnutls that support GNUTLS_PBKDF2 currently fail, -we need to conditionally switch test data to reflect use of -'samr_ChangePasswordUser3' or 'samr_ChangePasswordUser4' -depending on whether GNUTLS_PBKDF2 is supported or not - -Signed-off-by: Noel Power -Reviewed-by: Andreas Schneider ---- - python/samba/tests/auth_log_pass_change.py | 20 ++++++++++++++++---- - source4/selftest/tests.py | 9 ++++++--- - 2 files changed, 22 insertions(+), 7 deletions(-) - -diff --git a/python/samba/tests/auth_log_pass_change.py b/python/samba/tests/auth_log_pass_change.py -index 972af2158dd..1ca46c586b3 100644 ---- a/python/samba/tests/auth_log_pass_change.py -+++ b/python/samba/tests/auth_log_pass_change.py -@@ -72,6 +72,18 @@ class AuthLogPassChangeTests(samba.tests.auth_log_base.AuthLogTestBase): - - # discard any auth log messages for the password setup - self.discardMessages() -+ gnutls_pbkdf2_support = samba.tests.env_get_var_value( -+ 'GNUTLS_PBKDF2_SUPPORT', -+ allow_missing=True) -+ if gnutls_pbkdf2_support is None: -+ gnutls_pbkdf2_support = '0' -+ self.gnutls_pbkdf2_support = bool(int(gnutls_pbkdf2_support)) -+ -+ def _authDescription(self): -+ if self.gnutls_pbkdf2_support: -+ return "samr_ChangePasswordUser4" -+ else: -+ return "samr_ChangePasswordUser3" - - def tearDown(self): - super(AuthLogPassChangeTests, self).tearDown() -@@ -83,7 +95,7 @@ class AuthLogPassChangeTests(samba.tests.auth_log_base.AuthLogTestBase): - (msg["Authentication"]["serviceDescription"] == - "SAMR Password Change") and - (msg["Authentication"]["authDescription"] == -- "samr_ChangePasswordUser3") and -+ self._authDescription()) and - (msg["Authentication"]["eventId"] == - EVT_ID_SUCCESSFUL_LOGON) and - (msg["Authentication"]["logonType"] == -@@ -109,7 +121,7 @@ class AuthLogPassChangeTests(samba.tests.auth_log_base.AuthLogTestBase): - (msg["Authentication"]["serviceDescription"] == - "SAMR Password Change") and - (msg["Authentication"]["authDescription"] == -- "samr_ChangePasswordUser3") and -+ self._authDescription()) and - (msg["Authentication"]["eventId"] == - EVT_ID_UNSUCCESSFUL_LOGON) and - (msg["Authentication"]["logonType"] == -@@ -141,7 +153,7 @@ class AuthLogPassChangeTests(samba.tests.auth_log_base.AuthLogTestBase): - (msg["Authentication"]["serviceDescription"] == - "SAMR Password Change") and - (msg["Authentication"]["authDescription"] == -- "samr_ChangePasswordUser3") and -+ self._authDescription()) and - (msg["Authentication"]["eventId"] == - EVT_ID_UNSUCCESSFUL_LOGON) and - (msg["Authentication"]["logonType"] == -@@ -174,7 +186,7 @@ class AuthLogPassChangeTests(samba.tests.auth_log_base.AuthLogTestBase): - (msg["Authentication"]["serviceDescription"] == - "SAMR Password Change") and - (msg["Authentication"]["authDescription"] == -- "samr_ChangePasswordUser3") and -+ self._authDescription()) and - (msg["Authentication"]["eventId"] == - EVT_ID_UNSUCCESSFUL_LOGON) and - (msg["Authentication"]["logonType"] == -diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py -index a803d4704ea..c92105586a7 100755 ---- a/source4/selftest/tests.py -+++ b/source4/selftest/tests.py -@@ -1094,9 +1094,11 @@ if have_heimdal_support: - environ={'CLIENT_IP': '10.53.57.11', - 'SOCKET_WRAPPER_DEFAULT_IFACE': 11}) - planoldpythontestsuite("ad_dc_smb1", "samba.tests.auth_log_pass_change", -- extra_args=['-U"$USERNAME%$PASSWORD"']) -+ extra_args=['-U"$USERNAME%$PASSWORD"'], -+ environ={'GNUTLS_PBKDF2_SUPPORT': gnutls_pbkdf2_support}) - planoldpythontestsuite("ad_dc_ntvfs", "samba.tests.auth_log_pass_change", -- extra_args=['-U"$USERNAME%$PASSWORD"']) -+ extra_args=['-U"$USERNAME%$PASSWORD"'], -+ environ={'GNUTLS_PBKDF2_SUPPORT': gnutls_pbkdf2_support}) - - # these tests use a NCA local RPC connection, so always run on the - # :local testenv, and so don't need to fake a client connection -@@ -1113,7 +1115,8 @@ if have_heimdal_support: - "samba.tests.auth_log_winbind", - extra_args=['-U"$DC_USERNAME%$DC_PASSWORD"']) - planoldpythontestsuite("ad_dc", "samba.tests.audit_log_pass_change", -- extra_args=['-U"$USERNAME%$PASSWORD"']) -+ extra_args=['-U"$USERNAME%$PASSWORD"'], -+ environ={'GNUTLS_PBKDF2_SUPPORT': gnutls_pbkdf2_support}) - planoldpythontestsuite("ad_dc", "samba.tests.audit_log_dsdb", - extra_args=['-U"$USERNAME%$PASSWORD"']) - planoldpythontestsuite("ad_dc", "samba.tests.group_audit", --- -2.37.3 - From a6e266bad86a9d48723244c39218b2af10ee6739 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 23 Feb 2023 15:15:37 +0100 Subject: [PATCH 06/37] Update License to SPDX expressions https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_1 --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index ade4396..b235d79 100644 --- a/samba.spec +++ b/samba.spec @@ -210,7 +210,7 @@ Epoch: 0 %global samba_depver %{epoch}:%{version}-%{release} Summary: Server and Client software to interoperate with Windows machines -License: GPLv3+ and LGPLv3+ +License: GPL-3.0-or-later AND LGPL-3.0-or-later URL: https://www.samba.org # This is a xz recompressed file of https://ftp.samba.org/pub/samba/samba-%%{version}%%{pre_release}.tar.gz From 6da3682bce18ae0a2bc63152463629e16f20c660 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Thu, 23 Feb 2023 15:18:11 +0100 Subject: [PATCH 07/37] SPDX migration --- samba.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index b235d79..5505001 100644 --- a/samba.spec +++ b/samba.spec @@ -1075,7 +1075,7 @@ necessary to communicate to the Winbind Daemon %if %{with winexe} %package winexe Summary: Samba Winexe Windows Binary -License: GPLv3 +License: GPL-3.0-only Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} @@ -4333,6 +4333,9 @@ fi %endif %changelog +* Thu Feb 23 2023 Pavel Filipenský - 4.18.0-0.6.rc3 +- SPDX migration + * Wed Feb 15 2023 Guenther Deschner - 4.18.0rc3-6 - resolves: #2166416 - Update to version 4.18.0rc3 From 5a778122c6aa12e7e052415983cf3c6f0b83c001 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 28 Feb 2023 07:55:19 +0100 Subject: [PATCH 08/37] Add missing Requires for glibc-gconv-extra resolves: #2173619 --- samba.spec | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 5505001..53f3a83 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.0 -%global baserelease 6 +%global baserelease 7 # This should be rc1 or %%nil %global pre_release rc3 @@ -270,6 +270,7 @@ Provides: bundled(libreplace) BuildRequires: make BuildRequires: gcc +BuildRequires: glibc-gconv-extra BuildRequires: avahi-devel BuildRequires: bison BuildRequires: cups-devel @@ -448,6 +449,8 @@ Requires: %{name}-common-libs = %{samba_depver} Requires: libwbclient = %{samba_depver} %endif Requires: krb5-libs >= %{required_mit_krb5} +# This is needed for charset conversion +Requires: glibc-gconv-extra %description client-libs The samba-client-libs package contains internal libraries needed by the @@ -4333,6 +4336,9 @@ fi %endif %changelog +* Tue Feb 28 2023 Andreas Schneider - 4.18.0-0.7.rc3 +- resolves: #2173619 - Add missing Requires for glibc-gconv-extra + * Thu Feb 23 2023 Pavel Filipenský - 4.18.0-0.6.rc3 - SPDX migration From a739d7195b09955df06a3200c6ca246e2f260c51 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 1 Mar 2023 15:38:16 +0100 Subject: [PATCH 09/37] Update to version 4.18.0rc4 resolves: #2174415 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index f55b1d8..dcf49fc 100644 --- a/.gitignore +++ b/.gitignore @@ -323,3 +323,5 @@ samba-3.6.0pre1.tar.gz /samba-4.18.0rc2.tar.asc /samba-4.18.0rc3.tar.xz /samba-4.18.0rc3.tar.asc +/samba-4.18.0rc4.tar.xz +/samba-4.18.0rc4.tar.asc diff --git a/samba.spec b/samba.spec index 53f3a83..2f68413 100644 --- a/samba.spec +++ b/samba.spec @@ -135,9 +135,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.0 -%global baserelease 7 +%global baserelease 8 # This should be rc1 or %%nil -%global pre_release rc3 +%global pre_release rc4 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4336,6 +4336,9 @@ fi %endif %changelog +* Wed Mar 01 2023 Guenther Deschner - 4.18.0rc4-8 +- resolves: #2174415 - Update to version 4.18.0rc4 + * Tue Feb 28 2023 Andreas Schneider - 4.18.0-0.7.rc3 - resolves: #2173619 - Add missing Requires for glibc-gconv-extra diff --git a/sources b/sources index bc6a0db..f683831 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.18.0rc3.tar.xz) = ebcb183e4e823a6f4c7d6d483d4efd1e6da8cf5bce1d685bba7c80c7d2392ed909ab8fc14dd7f74aa10c0d1ad1e96830413bb001b4c8add8ee70f073175aab81 -SHA512 (samba-4.18.0rc3.tar.asc) = 178959b7e361655037534fd3d11648c7b5636e65547d85d2b8090a1e79a7580ac61ff35553aff1054b6031f49ad48096538a49e26f714d3ea10c493303910b91 +SHA512 (samba-4.18.0rc4.tar.xz) = f0231ffaecc4264766d5bd8569fc7ca7c8821f31999931b4d94d4228955221567a14cf9df8cda9a2bf833f375b0a9b414ec3a804e2ca9f5088ef60e982f775fa +SHA512 (samba-4.18.0rc4.tar.asc) = 343b61f33381d026a724faf0f06110b5fa173f626db2e5263ad991ca97bcc1314aa2124694dda4e7f1aca31b8f7bcb3fd20222b42aad20b51a3579cdba194303 From 714a18ed412d751be9c63588832f70be352349fc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 8 Mar 2023 14:20:08 +0100 Subject: [PATCH 10/37] Update to version 4.18.0 resolves: #2176469 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index dcf49fc..550a6cc 100644 --- a/.gitignore +++ b/.gitignore @@ -325,3 +325,5 @@ samba-3.6.0pre1.tar.gz /samba-4.18.0rc3.tar.asc /samba-4.18.0rc4.tar.xz /samba-4.18.0rc4.tar.asc +/samba-4.18.0.tar.xz +/samba-4.18.0.tar.asc diff --git a/samba.spec b/samba.spec index 2f68413..ffc1c9e 100644 --- a/samba.spec +++ b/samba.spec @@ -135,9 +135,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.0 -%global baserelease 8 +%global baserelease 9 # This should be rc1 or %%nil -%global pre_release rc4 +%global pre_release %nil %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4336,6 +4336,9 @@ fi %endif %changelog +* Wed Mar 08 2023 Guenther Deschner - 4.18.0-9 +- resolves: #2176469 - Update to version 4.18.0 + * Wed Mar 01 2023 Guenther Deschner - 4.18.0rc4-8 - resolves: #2174415 - Update to version 4.18.0rc4 diff --git a/sources b/sources index f683831..588b398 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.18.0rc4.tar.xz) = f0231ffaecc4264766d5bd8569fc7ca7c8821f31999931b4d94d4228955221567a14cf9df8cda9a2bf833f375b0a9b414ec3a804e2ca9f5088ef60e982f775fa -SHA512 (samba-4.18.0rc4.tar.asc) = 343b61f33381d026a724faf0f06110b5fa173f626db2e5263ad991ca97bcc1314aa2124694dda4e7f1aca31b8f7bcb3fd20222b42aad20b51a3579cdba194303 +SHA512 (samba-4.18.0.tar.xz) = bb4947335bd1fc501c29a62b413a9c3a1bbaf162d6965a4b2eeb65bf74363c300234b5c73d09e826e596989cd8afdee41b2470647bfdf8f7c42b998e7d367a64 +SHA512 (samba-4.18.0.tar.asc) = 1a478fd0e863e6b6874b703e04f449872b4d581e4c32c853ee4111bc94d1addcf3047331a288e8115a20d9ea22d8e04aade918e8623bd3d08d5122baf4ef0f3d From bf99358854c60e7ffe7857c8921ffe27a848a398 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 10 Mar 2023 10:32:14 +0100 Subject: [PATCH 11/37] Add missing Requires for python3-gpg to samba-tools --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index ffc1c9e..dc206e0 100644 --- a/samba.spec +++ b/samba.spec @@ -540,6 +540,7 @@ Requires: python3-%{name}-dc = %{samba_depver} # samba-tool needs mdb_copy and tdbackup for domain backup or upgrade provision Requires: lmdb Requires: tdb-tools +Requires: python3-gpg %endif %description tools From c9961d895d8bb032aba2b3710f57ebb822a27712 Mon Sep 17 00:00:00 2001 From: Kalev Lember Date: Fri, 17 Mar 2023 21:07:11 +0100 Subject: [PATCH 12/37] Move libstable-sort-samba4.so to samba-client-libs subpackage libndr-samba-samba4.so that's already in -client-libs subpackage links with libstable-sort-samba4.so, which means that we need to put both in -client-libs to avoid -client-libs suddenly starting to depend on -libs. --- samba.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index dc206e0..b61d78f 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.0 -%global baserelease 9 +%global baserelease 10 # This should be rc1 or %%nil %global pre_release %nil @@ -1955,6 +1955,7 @@ fi %{_libdir}/samba/libsmbd-base-samba4.so %{_libdir}/samba/libsmbd-shim-samba4.so %{_libdir}/samba/libsmbldaphelper-samba4.so +%{_libdir}/samba/libstable-sort-samba4.so %{_libdir}/samba/libsys-rw-samba4.so %{_libdir}/samba/libsocket-blocking-samba4.so %{_libdir}/samba/libtalloc-report-printf-samba4.so @@ -2380,7 +2381,6 @@ fi %{_libdir}/samba/libdnsserver-common-samba4.so %{_libdir}/samba/libshares-samba4.so %{_libdir}/samba/libsmbpasswdparser-samba4.so -%{_libdir}/samba/libstable-sort-samba4.so %{_libdir}/samba/libxattr-tdb-samba4.so %{_libdir}/samba/libREG-FULL-samba4.so %{_libdir}/samba/libRPC-SERVER-LOOP-samba4.so @@ -4337,6 +4337,9 @@ fi %endif %changelog +* Fri Mar 17 2023 Kalev Lember - 4.18.0-10 +- Move libstable-sort-samba4.so to samba-client-libs subpackage + * Wed Mar 08 2023 Guenther Deschner - 4.18.0-9 - resolves: #2176469 - Update to version 4.18.0 From 05a137e929e53708655907a73f974310f956683e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 21 Mar 2023 11:01:43 +0100 Subject: [PATCH 13/37] Fix file list --- samba.spec | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) diff --git a/samba.spec b/samba.spec index b61d78f..651c013 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.0 -%global baserelease 10 +%global baserelease 11 # This should be rc1 or %%nil %global pre_release %nil @@ -3656,7 +3656,6 @@ fi %{_datadir}/ctdb/tests/INTEGRATION/simple/basics.005.process_exists.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/basics.010.statistics.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/basics.011.statistics_reset.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.002.recmaster_yield.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.010.getrelock.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.012.reclock_command.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.015.reclock_remove_lock.sh @@ -3793,10 +3792,6 @@ fi %{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.init.007.sh %{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.init.008.sh %{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.init.009.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.setup.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.setup.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.setup.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.setup.004.sh %{_datadir}/ctdb/tests/UNIT/eventscripts/01.reclock.init.001.sh %{_datadir}/ctdb/tests/UNIT/eventscripts/01.reclock.init.002.sh %{_datadir}/ctdb/tests/UNIT/eventscripts/01.reclock.init.003.sh @@ -4071,7 +4066,6 @@ fi %{_datadir}/ctdb/tests/UNIT/onnode/stubs/ssh %dir %{_datadir}/ctdb/tests/UNIT/shellcheck %{_datadir}/ctdb/tests/UNIT/shellcheck/base_scripts.sh -%{_datadir}/ctdb/tests/UNIT/shellcheck/ctdbd_wrapper.sh %{_datadir}/ctdb/tests/UNIT/shellcheck/ctdb_helpers.sh %{_datadir}/ctdb/tests/UNIT/shellcheck/event_scripts.sh %{_datadir}/ctdb/tests/UNIT/shellcheck/functions.sh @@ -4242,8 +4236,6 @@ fi %{_datadir}/ctdb/tests/UNIT/tool/ctdb.pstore.001.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.ptrans.001.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.readkey.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.recmaster.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.recmaster.002.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.recover.001.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.001.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.002.sh @@ -4337,6 +4329,9 @@ fi %endif %changelog +* Tue Mar 21 2023 Andreas Schneider - 4.18.0-11 +- Fix file list + * Fri Mar 17 2023 Kalev Lember - 4.18.0-10 - Move libstable-sort-samba4.so to samba-client-libs subpackage From b1405f81340c0be335c3826a248b0976c6cd84d3 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 21 Mar 2023 15:20:25 +0100 Subject: [PATCH 14/37] Fix ctdb file lists when built with test suite enabled --- samba.spec | 51 +++++++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 45 insertions(+), 6 deletions(-) diff --git a/samba.spec b/samba.spec index 651c013..6d1ee70 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.0 -%global baserelease 11 +%global baserelease 12 # This should be rc1 or %%nil %global pre_release %nil @@ -3352,6 +3352,7 @@ fi %{_mandir}/man1/smbtorture.1* %if %{with testsuite} +%{_mandir}/man1/vfstest.1* # files to ignore in testsuite mode %{_libdir}/samba/libnss-wrapper.so %{_libdir}/samba/libsocket-wrapper.so @@ -3569,7 +3570,10 @@ fi %{_libexecdir}/ctdb/tests/sock_io_test %{_libexecdir}/ctdb/tests/srvid_test %{_libexecdir}/ctdb/tests/system_socket_test +%{_libexecdir}/ctdb/tests/tmon_ping_test +%{_libexecdir}/ctdb/tests/tmon_test %{_libexecdir}/ctdb/tests/transaction_loop +%{_libexecdir}/ctdb/tests/tunable_test %{_libexecdir}/ctdb/tests/tunnel_cmd %{_libexecdir}/ctdb/tests/tunnel_test %{_libexecdir}/ctdb/tests/update_record @@ -3656,12 +3660,19 @@ fi %{_datadir}/ctdb/tests/INTEGRATION/simple/basics.005.process_exists.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/basics.010.statistics.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/basics.011.statistics_reset.sh +%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.001.stop_leader_yield.sh +%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.002.ban_leader_yield.sh +%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.003.capability_leader_yield.sh +%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.006.stop_leader_yield_no_lock.sh +%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.007.ban_leader_yield_no_lock.sh +%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.008.capability_leader_yield_no_lock.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.010.getrelock.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.012.reclock_command.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.015.reclock_remove_lock.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.016.reclock_move_lock_dir.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.020.message_ring.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.021.tunnel_ring.sh +%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.030.node_stall_leader_timeout.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.090.unreachable.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.091.version_check.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/debug.001.getdebug.sh @@ -3687,6 +3698,7 @@ fi %{_datadir}/ctdb/tests/UNIT/cunit/cmdline_test_001.sh %{_datadir}/ctdb/tests/UNIT/cunit/comm_test_001.sh %{_datadir}/ctdb/tests/UNIT/cunit/comm_test_002.sh +%{_datadir}/ctdb/tests/UNIT/cunit/conf_test_001.sh %{_datadir}/ctdb/tests/UNIT/cunit/config_test_001.sh %{_datadir}/ctdb/tests/UNIT/cunit/config_test_002.sh %{_datadir}/ctdb/tests/UNIT/cunit/config_test_003.sh @@ -3694,7 +3706,6 @@ fi %{_datadir}/ctdb/tests/UNIT/cunit/config_test_005.sh %{_datadir}/ctdb/tests/UNIT/cunit/config_test_006.sh %{_datadir}/ctdb/tests/UNIT/cunit/config_test_007.sh -%{_datadir}/ctdb/tests/UNIT/cunit/conf_test_001.sh %{_datadir}/ctdb/tests/UNIT/cunit/ctdb_io_test_001.sh %{_datadir}/ctdb/tests/UNIT/cunit/db_hash_test_001.sh %{_datadir}/ctdb/tests/UNIT/cunit/event_protocol_test_001.sh @@ -3722,6 +3733,9 @@ fi %{_datadir}/ctdb/tests/UNIT/cunit/system_socket_test_001.sh %{_datadir}/ctdb/tests/UNIT/cunit/system_socket_test_002.sh %{_datadir}/ctdb/tests/UNIT/cunit/system_socket_test_003.sh +%{_datadir}/ctdb/tests/UNIT/cunit/tmon_test_001.sh +%{_datadir}/ctdb/tests/UNIT/cunit/tmon_test_002.sh +%{_datadir}/ctdb/tests/UNIT/cunit/tunable_test_001.sh %dir %{_datadir}/ctdb/tests/UNIT/eventd %dir %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/ctdb.conf @@ -3968,6 +3982,22 @@ fi %{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.shutdown.002.sh %{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.startup.001.sh %{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.startup.002.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.001.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.002.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.003.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.004.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.005.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.006.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.007.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.008.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.021.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.022.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.023.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.024.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.025.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.026.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.027.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.028.sh %dir %{_datadir}/ctdb/tests/UNIT/eventscripts/etc %dir %{_datadir}/ctdb/tests/UNIT/eventscripts/etc-ctdb %{_datadir}/ctdb/tests/UNIT/eventscripts/etc-ctdb/public_addresses @@ -3997,6 +4027,7 @@ fi %{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/50.samba.sh %{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/60.nfs.sh %{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/91.lvs.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/debug_locks.sh %{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/local.sh %{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/statd-callout.sh %{_datadir}/ctdb/tests/UNIT/eventscripts/statd-callout.001.sh @@ -4016,6 +4047,7 @@ fi %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/df %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ethtool %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/exportfs +%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/gstack %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/id %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ip %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ip6tables @@ -4024,21 +4056,24 @@ fi %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/kill %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/killall %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/multipath -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/nfsconf %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/net +%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/nfs-fake-callout +%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/nfsconf %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/pidof %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/pkill %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ps %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/rm -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/rpcinfo %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/rpc.lockd %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/rpc.mountd %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/rpc.rquotad %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/rpc.statd +%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/rpcinfo %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/service %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/sleep %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/smnotify %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ss +%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/stat +%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/tdb_mutex_check %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/tdbdump %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/tdbtool %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/testparm @@ -4200,6 +4235,8 @@ fi %{_datadir}/ctdb/tests/UNIT/tool/ctdb.ipinfo.001.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.ipinfo.002.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.ipinfo.003.sh +%{_datadir}/ctdb/tests/UNIT/tool/ctdb.leader.001.sh +%{_datadir}/ctdb/tests/UNIT/tool/ctdb.leader.002.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.listnodes.001.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.listnodes.002.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.listvars.001.sh @@ -4227,6 +4264,7 @@ fi %{_datadir}/ctdb/tests/UNIT/tool/ctdb.nodestatus.004.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.nodestatus.005.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.nodestatus.006.sh +%{_datadir}/ctdb/tests/UNIT/tool/ctdb.nodestatus.007.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.pdelete.001.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.ping.001.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.pnn.001.sh @@ -4277,6 +4315,7 @@ fi %{_datadir}/ctdb/tests/UNIT/tool/ctdb.setvar.002.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.status.001.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.status.002.sh +%{_datadir}/ctdb/tests/UNIT/tool/ctdb.status.003.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.stop.001.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.stop.002.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.stop.003.sh @@ -4329,8 +4368,8 @@ fi %endif %changelog -* Tue Mar 21 2023 Andreas Schneider - 4.18.0-11 -- Fix file list +* Tue Mar 21 2023 Andreas Schneider - 4.18.0-12 +- Fix ctdb file lists when built with test suite enabled * Fri Mar 17 2023 Kalev Lember - 4.18.0-10 - Move libstable-sort-samba4.so to samba-client-libs subpackage From c1f661c579dc57da7049f4a5f73c1b87c9125cb0 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 28 Mar 2023 09:01:24 +0200 Subject: [PATCH 15/37] Add missing Requires for bind-utils samba_dnsupdate uses nsupdate from bind-utils --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index 6d1ee70..b36fd8b 100644 --- a/samba.spec +++ b/samba.spec @@ -590,6 +590,7 @@ Requires: python3-setproctitle Requires: python3-%{name} = %{samba_depver} Requires: python3-%{name}-dc = %{samba_depver} Requires: krb5-server >= %{required_mit_krb5} +Requires: bind-utils Provides: samba4-dc = %{samba_depver} Obsoletes: samba4-dc < %{samba_depver} From 5a73fdbc90633cd9bde7536ce2c1b062ff78adf3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 29 Mar 2023 16:12:36 +0200 Subject: [PATCH 16/37] Update to version 4.18.1 resolves: #2182787 - Update to version 4.18.1 resolves: #2182772, #2182773 - Security fixes for CVE-2023-0225 resolves: #2182774, #2182775 - Security fixes for CVE-2023-0922 resolves: #2182776, #2182777 - Security fixes for CVE-2023-0614 Guenther --- .gitignore | 2 ++ samba.spec | 12 +++++++++--- sources | 4 ++-- 3 files changed, 13 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 550a6cc..53a513a 100644 --- a/.gitignore +++ b/.gitignore @@ -327,3 +327,5 @@ samba-3.6.0pre1.tar.gz /samba-4.18.0rc4.tar.asc /samba-4.18.0.tar.xz /samba-4.18.0.tar.asc +/samba-4.18.1.tar.xz +/samba-4.18.1.tar.asc diff --git a/samba.spec b/samba.spec index b36fd8b..ab766b3 100644 --- a/samba.spec +++ b/samba.spec @@ -134,8 +134,8 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.18.0 -%global baserelease 12 +%global samba_version 4.18.1 +%global baserelease 0 # This should be rc1 or %%nil %global pre_release %nil @@ -171,7 +171,7 @@ %global talloc_version 2.4.0 %global tdb_version 1.4.8 %global tevent_version 0.14.1 -%global ldb_version 2.7.1 +%global ldb_version 2.7.2 %global required_mit_krb5 1.20.1 @@ -4369,6 +4369,12 @@ fi %endif %changelog +* Wed Mar 29 2023 Guenther Deschner - 4.18.1-0 +- resolves: #2182787 - Update to version 4.18.1 +- resolves: #2182772, #2182773 - Security fixes for CVE-2023-0225 +- resolves: #2182774, #2182775 - Security fixes for CVE-2023-0922 +- resolves: #2182776, #2182777 - Security fixes for CVE-2023-0614 + * Tue Mar 21 2023 Andreas Schneider - 4.18.0-12 - Fix ctdb file lists when built with test suite enabled diff --git a/sources b/sources index 588b398..3681b3c 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.18.0.tar.xz) = bb4947335bd1fc501c29a62b413a9c3a1bbaf162d6965a4b2eeb65bf74363c300234b5c73d09e826e596989cd8afdee41b2470647bfdf8f7c42b998e7d367a64 -SHA512 (samba-4.18.0.tar.asc) = 1a478fd0e863e6b6874b703e04f449872b4d581e4c32c853ee4111bc94d1addcf3047331a288e8115a20d9ea22d8e04aade918e8623bd3d08d5122baf4ef0f3d +SHA512 (samba-4.18.1.tar.xz) = 110c6c110277337d714c3636a060895a4c01f118f639a978dc71de18285a8fea3e9071c846dbadbd0a1e3f9fe3e2208ecb0065b007fafeb96f8746a1d691be35 +SHA512 (samba-4.18.1.tar.asc) = 0eb125d8ff20c08e42d18fe2d04467b8ee6ab8fe80cce381697fb09d56200873fa63e6eeb6fd9cdfcee457668feed68c0967d7141b0cc040e0e28a9606518a58 From b4c89569651d469675cea80315c53656a2a38aec Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 19 Apr 2023 14:34:42 +0200 Subject: [PATCH 17/37] Update to version 4.18.2 resolves: #2187991 Guenther --- .gitignore | 2 ++ samba.spec | 5 ++++- sources | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 53a513a..c09c477 100644 --- a/.gitignore +++ b/.gitignore @@ -329,3 +329,5 @@ samba-3.6.0pre1.tar.gz /samba-4.18.0.tar.asc /samba-4.18.1.tar.xz /samba-4.18.1.tar.asc +/samba-4.18.2.tar.xz +/samba-4.18.2.tar.asc diff --git a/samba.spec b/samba.spec index ab766b3..29af276 100644 --- a/samba.spec +++ b/samba.spec @@ -134,7 +134,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.18.1 +%global samba_version 4.18.2 %global baserelease 0 # This should be rc1 or %%nil %global pre_release %nil @@ -4369,6 +4369,9 @@ fi %endif %changelog +* Wed Apr 19 2023 Guenther Deschner - 4.18.2-0 +- resolves: #2187991 - Update to version 4.18.2 + * Wed Mar 29 2023 Guenther Deschner - 4.18.1-0 - resolves: #2182787 - Update to version 4.18.1 - resolves: #2182772, #2182773 - Security fixes for CVE-2023-0225 diff --git a/sources b/sources index 3681b3c..4111daa 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.18.1.tar.xz) = 110c6c110277337d714c3636a060895a4c01f118f639a978dc71de18285a8fea3e9071c846dbadbd0a1e3f9fe3e2208ecb0065b007fafeb96f8746a1d691be35 -SHA512 (samba-4.18.1.tar.asc) = 0eb125d8ff20c08e42d18fe2d04467b8ee6ab8fe80cce381697fb09d56200873fa63e6eeb6fd9cdfcee457668feed68c0967d7141b0cc040e0e28a9606518a58 +SHA512 (samba-4.18.2.tar.xz) = edb2e9b7faa25243c8434f08885aa92a7f55cb218d141892f595b1319e8ccb8f0e978b0ab37537a9290fa2721f7cc186f3f66a732c22cb6fecb3056027618693 +SHA512 (samba-4.18.2.tar.asc) = 0f718b12da5e6cc7c770e58cc415b62a3a4226ab93d72fc6e3315af2cc925e17a23b1d168c252b375a8520df24d6fed64730a2585bcac8259dc8c724edc463fb From ce3477778fb9c37f83adfc6b5ced1208292e2d65 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 28 Mar 2023 09:55:56 +0200 Subject: [PATCH 18/37] Add support for mock ccache plugin --- samba.spec | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/samba.spec b/samba.spec index 29af276..09a7dfb 100644 --- a/samba.spec +++ b/samba.spec @@ -1262,6 +1262,13 @@ export python_LDFLAGS="$(echo ${LDFLAGS} | sed -e 's/-Wl,-z,defs//g')" export python_LDFLAGS="$(echo %{__global_ldflags} | sed -e 's/-Wl,-z,defs//g')" %endif +# Add support for mock ccache plugin +CCACHE="$(command -v ccache)" +if [ -n "${CCACHE}" ]; then + ${CCACHE} -s + export CC="${CCACHE} gcc" +fi + %configure \ --enable-fhs \ --with-piddir=/run \ From 1f372c56a19f1648087fc9198dcef6ccb8925eb3 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 20 Apr 2023 14:38:04 +0200 Subject: [PATCH 19/37] Let samba-winbind just suggest samba-tool --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 09a7dfb..9940c5d 100644 --- a/samba.spec +++ b/samba.spec @@ -989,7 +989,7 @@ Requires(post): %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires(post): %{name}-libs = %{samba_depver} Requires: %{name}-winbind-modules = %{samba_depver} -Recommends: %{name}-tools = %{samba_depver} +Suggests: %{name}-tools = %{samba_depver} %if %{with libwbclient} Requires(post): libwbclient = %{samba_depver} From b3b4ac21f0b318648d3bfec276c1b1e56b42b1aa Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 5 May 2023 13:53:47 +0200 Subject: [PATCH 20/37] Fix ccache support --- samba.spec | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index 9940c5d..ea7c125 100644 --- a/samba.spec +++ b/samba.spec @@ -2,7 +2,7 @@ # # To build and run the tests use: # -# fedpkg local --with testsuite +# fedpkg mockbuild --with testsuite # or # rpmbuild --rebuild --with testsuite samba.src.rpm # @@ -10,12 +10,15 @@ # Build with internal talloc, tevent, tdb and ldb. # -# fedpkg local --with=testsuite --with=includelibs +# fedpkg mockbuild --with=testsuite --with=includelibs # or # rpmbuild --rebuild --with=testsuite --with=includelibs samba.src.rpm # %bcond_with includelibs +# fedpkg mockbuild --with=ccache +%bcond_with ccache + # ctdb is enabled by default, you can disable it with: --without clustering %bcond_without clustering @@ -1263,11 +1266,13 @@ export python_LDFLAGS="$(echo %{__global_ldflags} | sed -e 's/-Wl,-z,defs//g')" %endif # Add support for mock ccache plugin +%if %{with ccache} CCACHE="$(command -v ccache)" if [ -n "${CCACHE}" ]; then ${CCACHE} -s export CC="${CCACHE} gcc" fi +%endif %configure \ --enable-fhs \ From b21cedb5ab44c3dd378d5f3d34fdcb5915fbc079 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 1 Jun 2023 10:45:55 +0200 Subject: [PATCH 21/37] Update to version 4.18.3 resolves: #2211453 Guenther --- .gitignore | 2 ++ samba.spec | 5 ++++- sources | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index c09c477..b8bc24c 100644 --- a/.gitignore +++ b/.gitignore @@ -331,3 +331,5 @@ samba-3.6.0pre1.tar.gz /samba-4.18.1.tar.asc /samba-4.18.2.tar.xz /samba-4.18.2.tar.asc +/samba-4.18.3.tar.xz +/samba-4.18.3.tar.asc diff --git a/samba.spec b/samba.spec index ea7c125..fdfe264 100644 --- a/samba.spec +++ b/samba.spec @@ -137,7 +137,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.18.2 +%global samba_version 4.18.3 %global baserelease 0 # This should be rc1 or %%nil %global pre_release %nil @@ -4381,6 +4381,9 @@ fi %endif %changelog +* Thu Jun 01 2023 Guenther Deschner - 4.18.3-0 +- resolves: #2211453 - Update to version 4.18.3 + * Wed Apr 19 2023 Guenther Deschner - 4.18.2-0 - resolves: #2187991 - Update to version 4.18.2 diff --git a/sources b/sources index 4111daa..f7f8e3a 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.18.2.tar.xz) = edb2e9b7faa25243c8434f08885aa92a7f55cb218d141892f595b1319e8ccb8f0e978b0ab37537a9290fa2721f7cc186f3f66a732c22cb6fecb3056027618693 -SHA512 (samba-4.18.2.tar.asc) = 0f718b12da5e6cc7c770e58cc415b62a3a4226ab93d72fc6e3315af2cc925e17a23b1d168c252b375a8520df24d6fed64730a2585bcac8259dc8c724edc463fb +SHA512 (samba-4.18.3.tar.xz) = 792d32d9d0ca61b1a2216709b24e31195ad7c695bfbb42d4b61734c3d801b4dbf984da586b6736f184708c53599db82f36a593444af9321d87005d2a1656418d +SHA512 (samba-4.18.3.tar.asc) = e3197a55f6ea7104ee22572dc559c9a0909513f445389121ac703d7273c6cb260ea715134a10a01e05505c16937a8919f0bd6a095187bf8b338229c07ece3fe2 From c29c69ac175b4cb1cda1b59a62bb9f27b169cff3 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 15 Jun 2023 10:21:23 +0200 Subject: [PATCH 22/37] logrotate: Also cover mit_kdc.log resolves: rhbz#2203539 --- samba.logrotate | 2 +- samba.spec | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.logrotate b/samba.logrotate index 40f85aa..43bef68 100644 --- a/samba.logrotate +++ b/samba.logrotate @@ -1,4 +1,4 @@ -/var/log/samba/log.* { +/var/log/samba/*log* { compress dateext maxage 365 diff --git a/samba.spec b/samba.spec index fdfe264..61b1f1f 100644 --- a/samba.spec +++ b/samba.spec @@ -4381,6 +4381,9 @@ fi %endif %changelog +* Thu Jun 15 2023 Andreas Schneider - 4.18.3-1 +- resolves: #2203539 - Also cover mit_kdc.log by logrotate + * Thu Jun 01 2023 Guenther Deschner - 4.18.3-0 - resolves: #2211453 - Update to version 4.18.3 From 9eea8321594783ce239ad1da245fd36f2b90b2b0 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 15 Jun 2023 12:32:01 +0200 Subject: [PATCH 23/37] Bump baserelease Forgotten in previous commit. --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 61b1f1f..25f868c 100644 --- a/samba.spec +++ b/samba.spec @@ -138,7 +138,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.3 -%global baserelease 0 +%global baserelease 1 # This should be rc1 or %%nil %global pre_release %nil From ef4fbddd6f4183e1e3e986a7233dd0a79d2f8e49 Mon Sep 17 00:00:00 2001 From: "FeRD (Frank Dana)" Date: Sat, 17 Jun 2023 11:18:44 -0400 Subject: [PATCH 24/37] =?UTF-8?q?Remove=20=C2=AE=20symbol=20from=20winexe'?= =?UTF-8?q?s=20description?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 25f868c..616f846 100644 --- a/samba.spec +++ b/samba.spec @@ -1090,7 +1090,7 @@ Requires: %{name}-common-libs = %{samba_depver} Provides: bundled(libreplace) %description winexe -Winexe is a Remote Windows®-command executor +Winexe is a Remote Windows-command executor %endif ### CTDB From a169b258ee3c28ccbe91fd8a9bfa471fe564b246 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Thu, 15 Jun 2023 13:18:39 +0200 Subject: [PATCH 25/37] Rebuilt for Python 3.12 --- samba.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 616f846..1c0a387 100644 --- a/samba.spec +++ b/samba.spec @@ -138,7 +138,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.3 -%global baserelease 1 +%global baserelease 2 # This should be rc1 or %%nil %global pre_release %nil @@ -4381,6 +4381,9 @@ fi %endif %changelog +* Thu Jun 15 2023 Python Maint - 2:4.18.3-2 +- Rebuilt for Python 3.12 + * Thu Jun 15 2023 Andreas Schneider - 4.18.3-1 - resolves: #2203539 - Also cover mit_kdc.log by logrotate From 2d8a4bb6f8c2ca646f533cef47b4922e2c028863 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 23 Jun 2023 10:45:43 +0200 Subject: [PATCH 26/37] Fix libwbclient package upgrades resolves: rhbz#2211577 --- samba.spec | 71 +++++++++--------------------------------------------- 1 file changed, 12 insertions(+), 59 deletions(-) diff --git a/samba.spec b/samba.spec index 1c0a387..5d8c229 100644 --- a/samba.spec +++ b/samba.spec @@ -138,7 +138,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.3 -%global baserelease 2 +%global baserelease 3 # This should be rc1 or %%nil %global pre_release %nil @@ -829,6 +829,7 @@ suite. %package -n libwbclient Summary: The winbind client library Requires: %{name}-client-libs = %{samba_depver} +Conflicts: sssd-libwbclient %description -n libwbclient The libwbclient package contains the winbind client library from the Samba @@ -837,6 +838,7 @@ suite. %package -n libwbclient-devel Summary: Developer tools for the winbind library Requires: libwbclient = %{samba_depver} +Conflicts: sssd-libwbclient-devel Provides: samba-winbind-devel = %{samba_depver} Obsoletes: samba-winbind-devel < %{samba_depver} @@ -1359,17 +1361,6 @@ install -d -m 0755 %{buildroot}/%{_libdir}/samba install -d -m 0755 %{buildroot}/%{_libdir}/samba/ldb install -d -m 0755 %{buildroot}/%{_libdir}/pkgconfig -# Move libwbclient.so* into private directory, it cannot be just libdir/samba -# because samba uses rpath with this directory. -install -d -m 0755 %{buildroot}/%{_libdir}/samba/wbclient -mv %{buildroot}/%{_libdir}/libwbclient.so* %{buildroot}/%{_libdir}/samba/wbclient -if [ ! -f %{buildroot}/%{_libdir}/samba/wbclient/libwbclient.so.%{libwbc_alternatives_version} ] -then - echo "Expected libwbclient version not found, please check if version has changed." - exit -1 -fi - - touch %{buildroot}%{_libexecdir}/samba/cups_backend_smb # Install other stuff @@ -1576,52 +1567,11 @@ fi %endif %if %{with libwbclient} -%posttrans -n libwbclient -# It has to be posttrans here to make sure all files of a previous version -# without alternatives support are removed -%{_sbindir}/update-alternatives \ - --install \ - %{_libdir}/libwbclient.so.%{libwbc_alternatives_version} \ - libwbclient.so.%{libwbc_alternatives_version}%{libwbc_alternatives_suffix} \ - %{_libdir}/samba/wbclient/libwbclient.so.%{libwbc_alternatives_version} \ - 10 +%pre -n libwbclient +rm -rf %{_libdir}/samba/wbclient/ +rm -f /etc/alternatives/libwbclient.so* +rm -f /var/lib/alternatives/libwbclient.so* %{?ldconfig} - -%preun -n libwbclient -if [ $1 -eq 0 ]; then - %{_sbindir}/update-alternatives \ - --remove \ - libwbclient.so.%{libwbc_alternatives_version}%{libwbc_alternatives_suffix} \ - %{_libdir}/samba/wbclient/libwbclient.so.%{libwbc_alternatives_version} -fi -/sbin/ldconfig - -%posttrans -n libwbclient-devel -%{_sbindir}/update-alternatives \ - --install %{_libdir}/libwbclient.so \ - libwbclient.so%{libwbc_alternatives_suffix} \ - %{_libdir}/samba/wbclient/libwbclient.so \ - 10 - -%preun -n libwbclient-devel -# alternatives checks if the file which should be removed is a link or not, but -# not if it points to the /etc/alternatives directory or to some other place. -# When downgrading to a version where alternatives is not used and -# libwbclient.so is a link and not a file it will be removed. The following -# check removes the alternatives files manually if that is the case. -if [ $1 -eq 0 ]; then - if [ "`readlink %{_libdir}/libwbclient.so`" == "libwbclient.so.%{libwbc_alternatives_version}" ]; then - /bin/rm -f \ - /etc/alternatives/libwbclient.so%{libwbc_alternatives_suffix} \ - /var/lib/alternatives/libwbclient.so%{libwbc_alternatives_suffix} 2> /dev/null - else - %{_sbindir}/update-alternatives \ - --remove \ - libwbclient.so%{libwbc_alternatives_suffix} \ - %{_libdir}/samba/wbclient/libwbclient.so - fi -fi - #endif {with libwbclient} %endif @@ -2426,12 +2376,12 @@ fi ### LIBWBCLIENT %if %{with libwbclient} %files -n libwbclient -%{_libdir}/samba/wbclient/libwbclient.so.%{libwbclient_so_version}* +%{_libdir}/libwbclient.so.%{libwbclient_so_version}* ### LIBWBCLIENT-DEVEL %files -n libwbclient-devel %{_includedir}/samba-4.0/wbclient.h -%{_libdir}/samba/wbclient/libwbclient.so +%{_libdir}/libwbclient.so %{_libdir}/pkgconfig/wbclient.pc #endif {with libwbclient} %endif @@ -4381,6 +4331,9 @@ fi %endif %changelog +* Fri Jun 23 2023 Andreas Schneider - 4.18.3-3 +- resolves: rhbz#2211577 - Fix libwbclient package upgrades + * Thu Jun 15 2023 Python Maint - 2:4.18.3-2 - Rebuilt for Python 3.12 From 711f5d0200b1bca896fe4d3f3bf837370acc3bae Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Mon, 26 Jun 2023 01:02:08 +0200 Subject: [PATCH 27/37] Only run libwbclient %pre on upgrade, not fresh install This seems to be breaking live image build tests because the script is running before `rm` is installed. I do not know why it didn't fail the tests run *on the update itself*, but it's now causing tests of subsequent updates to fail, which is a problem. Probably an ordering issue. AFAIK, this script is meant to clean up stuff from earlier versions of the package, so it's not relevant on fresh installs, and we can just skip it and avoid any problems in the fresh install case. --- samba.spec | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/samba.spec b/samba.spec index 5d8c229..1221ec8 100644 --- a/samba.spec +++ b/samba.spec @@ -138,7 +138,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.3 -%global baserelease 3 +%global baserelease 4 # This should be rc1 or %%nil %global pre_release %nil @@ -1568,9 +1568,11 @@ fi %if %{with libwbclient} %pre -n libwbclient -rm -rf %{_libdir}/samba/wbclient/ -rm -f /etc/alternatives/libwbclient.so* -rm -f /var/lib/alternatives/libwbclient.so* +if [ $1 -gt 1 ] ; then + rm -rf %{_libdir}/samba/wbclient/ + rm -f /etc/alternatives/libwbclient.so* + rm -f /var/lib/alternatives/libwbclient.so* +fi %{?ldconfig} #endif {with libwbclient} %endif @@ -4331,6 +4333,9 @@ fi %endif %changelog +* Mon Jun 26 2023 Adam Williamson - 4.18.3-4 +- Only run libwbclient %pre on upgrade, not fresh install + * Fri Jun 23 2023 Andreas Schneider - 4.18.3-3 - resolves: rhbz#2211577 - Fix libwbclient package upgrades From e3eff07bfe32dd106e3f11ef972794ce945e8121 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 5 Jul 2023 14:10:53 +0200 Subject: [PATCH 28/37] Update to version 4.18.4 resolves: #2219799 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index b8bc24c..1849014 100644 --- a/.gitignore +++ b/.gitignore @@ -333,3 +333,5 @@ samba-3.6.0pre1.tar.gz /samba-4.18.2.tar.asc /samba-4.18.3.tar.xz /samba-4.18.3.tar.asc +/samba-4.18.4.tar.xz +/samba-4.18.4.tar.asc diff --git a/samba.spec b/samba.spec index 1221ec8..8a72ccb 100644 --- a/samba.spec +++ b/samba.spec @@ -137,8 +137,8 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.18.3 -%global baserelease 4 +%global samba_version 4.18.4 +%global baserelease 0 # This should be rc1 or %%nil %global pre_release %nil @@ -4333,6 +4333,9 @@ fi %endif %changelog +* Wed Jul 05 2023 Guenther Deschner - 4.18.4-0 +- resolves: #2219799 - Update to version 4.18.4 + * Mon Jun 26 2023 Adam Williamson - 4.18.3-4 - Only run libwbclient %pre on upgrade, not fresh install diff --git a/sources b/sources index f7f8e3a..e1b7b1c 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.18.3.tar.xz) = 792d32d9d0ca61b1a2216709b24e31195ad7c695bfbb42d4b61734c3d801b4dbf984da586b6736f184708c53599db82f36a593444af9321d87005d2a1656418d -SHA512 (samba-4.18.3.tar.asc) = e3197a55f6ea7104ee22572dc559c9a0909513f445389121ac703d7273c6cb260ea715134a10a01e05505c16937a8919f0bd6a095187bf8b338229c07ece3fe2 +SHA512 (samba-4.18.4.tar.xz) = 9b9ed3111e8c1f8fbb990e2cf78bdd00bbe03e79247ec87a3ee51744acfbc6692f110dc88ccb1049b7d9c6aaa8fd6ba3ab4acd7ad0480dbb9df8b61980c0da83 +SHA512 (samba-4.18.4.tar.asc) = bc13d14b8da6a05494a79b8a8fb35fc27670f7ab8609eaeb3f3df49dd04bdb1389e77c2d571db5efcdd85532971c423eb977d46c2a5cbee3daadd6c6eca721ec From e98c05fb49bd5ac3c428b9cd50aa923b81cbb66e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Sat, 15 Jul 2023 15:17:52 +0200 Subject: [PATCH 29/37] Fix netlogon LogonGetCapabilities level 2 error handling resolves: #2223091 Guenther --- master-netlogongetcaps.patch | 351 +++++++++++++++++++++++++++++++++++ samba.spec | 7 +- 2 files changed, 357 insertions(+), 1 deletion(-) create mode 100644 master-netlogongetcaps.patch diff --git a/master-netlogongetcaps.patch b/master-netlogongetcaps.patch new file mode 100644 index 0000000..dd0f6b1 --- /dev/null +++ b/master-netlogongetcaps.patch @@ -0,0 +1,351 @@ +From 5f87888ed53320538cf773d64868390d8641a40e Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Sat, 15 Jul 2023 17:20:32 +0200 +Subject: [PATCH 1/4] netlogon.idl: add support for netr_LogonGetCapabilities + response level 2 + +We don't have any documentation about this yet, but tests against +a Windows Server 2022 patched with KB5028166 revealed that +the response for query_level=2 is exactly the same as +for querey_level=1. + +Until we know the reason for query_level=2 we won't +use it as client nor support it in the server, but +we want ndrdump to work. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15418 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Andrew Bartlett +--- + librpc/idl/netlogon.idl | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/librpc/idl/netlogon.idl b/librpc/idl/netlogon.idl +index 48a8c8f9310..85dd73ee7e4 100644 +--- a/librpc/idl/netlogon.idl ++++ b/librpc/idl/netlogon.idl +@@ -1236,6 +1236,7 @@ interface netlogon + /* Function 0x15 */ + typedef [switch_type(uint32)] union { + [case(1)] netr_NegotiateFlags server_capabilities; ++ [case(2)] netr_NegotiateFlags server_capabilities; + } netr_Capabilities; + + NTSTATUS netr_LogonGetCapabilities( +-- +2.41.0 + + +From 404ce08e9088968311c714e756f5d58ce2cef715 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Sat, 15 Jul 2023 17:25:05 +0200 +Subject: [PATCH 2/4] s4:torture/rpc: let rpc.schannel also check + netr_LogonGetCapabilities with different levels + +The important change it that we expect DCERPC_NCA_S_FAULT_INVALID_TAG +for unsupported query_levels, we allow it to work with servers +with or without support for query_level=2. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15418 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Andrew Bartlett +--- + .../knownfail.d/netr_LogonGetCapabilities | 3 + + source4/torture/rpc/netlogon.c | 77 ++++++++++++++++++- + 2 files changed, 79 insertions(+), 1 deletion(-) + create mode 100644 selftest/knownfail.d/netr_LogonGetCapabilities + +diff --git a/selftest/knownfail.d/netr_LogonGetCapabilities b/selftest/knownfail.d/netr_LogonGetCapabilities +new file mode 100644 +index 00000000000..30aadf3bb9d +--- /dev/null ++++ b/selftest/knownfail.d/netr_LogonGetCapabilities +@@ -0,0 +1,3 @@ ++^samba3.rpc.schannel.*\.schannel\(nt4_dc ++^samba3.rpc.schannel.*\.schannel\(ad_dc ++^samba4.rpc.schannel.*\.schannel\(ad_dc +diff --git a/source4/torture/rpc/netlogon.c b/source4/torture/rpc/netlogon.c +index 1f068eb7826..a3d190f13dd 100644 +--- a/source4/torture/rpc/netlogon.c ++++ b/source4/torture/rpc/netlogon.c +@@ -2056,8 +2056,47 @@ bool test_netlogon_capabilities(struct dcerpc_pipe *p, struct torture_context *t + r.out.capabilities = &capabilities; + r.out.return_authenticator = &return_auth; + +- torture_comment(tctx, "Testing LogonGetCapabilities\n"); ++ torture_comment(tctx, "Testing LogonGetCapabilities with query_level=0\n"); + ++ r.in.query_level = 0; ++ ZERO_STRUCT(return_auth); ++ ++ /* ++ * we need to operate on a temporary copy of creds ++ * because dcerpc_netr_LogonGetCapabilities with ++ * an unknown query level returns DCERPC_NCA_S_FAULT_INVALID_TAG ++ * => NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE ++ * without looking a the authenticator. ++ */ ++ tmp_creds = *creds; ++ netlogon_creds_client_authenticator(&tmp_creds, &auth); ++ ++ status = dcerpc_netr_LogonGetCapabilities_r(b, tctx, &r); ++ torture_assert_ntstatus_equal(tctx, status, NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE, ++ "LogonGetCapabilities query_level=0 failed"); ++ ++ torture_comment(tctx, "Testing LogonGetCapabilities with query_level=3\n"); ++ ++ r.in.query_level = 3; ++ ZERO_STRUCT(return_auth); ++ ++ /* ++ * we need to operate on a temporary copy of creds ++ * because dcerpc_netr_LogonGetCapabilities with ++ * an unknown query level returns DCERPC_NCA_S_FAULT_INVALID_TAG ++ * => NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE ++ * without looking a the authenticator. ++ */ ++ tmp_creds = *creds; ++ netlogon_creds_client_authenticator(&tmp_creds, &auth); ++ ++ status = dcerpc_netr_LogonGetCapabilities_r(b, tctx, &r); ++ torture_assert_ntstatus_equal(tctx, status, NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE, ++ "LogonGetCapabilities query_level=0 failed"); ++ ++ torture_comment(tctx, "Testing LogonGetCapabilities with query_level=1\n"); ++ ++ r.in.query_level = 1; + ZERO_STRUCT(return_auth); + + /* +@@ -2077,6 +2116,42 @@ bool test_netlogon_capabilities(struct dcerpc_pipe *p, struct torture_context *t + + *creds = tmp_creds; + ++ torture_assert(tctx, netlogon_creds_client_check(creds, ++ &r.out.return_authenticator->cred), ++ "Credential chaining failed"); ++ ++ torture_assert_int_equal(tctx, creds->negotiate_flags, ++ capabilities.server_capabilities, ++ "negotiate flags"); ++ ++ torture_comment(tctx, "Testing LogonGetCapabilities with query_level=2\n"); ++ ++ r.in.query_level = 2; ++ ZERO_STRUCT(return_auth); ++ ++ /* ++ * we need to operate on a temporary copy of creds ++ * because dcerpc_netr_LogonGetCapabilities with ++ * an query level 2 may returns DCERPC_NCA_S_FAULT_INVALID_TAG ++ * => NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE ++ * without looking a the authenticator. ++ */ ++ tmp_creds = *creds; ++ netlogon_creds_client_authenticator(&tmp_creds, &auth); ++ ++ status = dcerpc_netr_LogonGetCapabilities_r(b, tctx, &r); ++ if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE)) { ++ /* ++ * an server without KB5028166 returns ++ * DCERPC_NCA_S_FAULT_INVALID_TAG => ++ * NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE ++ */ ++ return true; ++ } ++ torture_assert_ntstatus_ok(tctx, status, "LogonGetCapabilities query_level=2 failed"); ++ ++ *creds = tmp_creds; ++ + torture_assert(tctx, netlogon_creds_client_check(creds, + &r.out.return_authenticator->cred), + "Credential chaining failed"); +-- +2.41.0 + + +From d5f1097b6220676d56ed5fc6707acf667b704518 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Sat, 15 Jul 2023 16:11:48 +0200 +Subject: [PATCH 3/4] s4:rpc_server:netlogon: generate FAULT_INVALID_TAG for + invalid netr_LogonGetCapabilities levels + +This is important as Windows clients with KB5028166 seem to +call netr_LogonGetCapabilities with query_level=2 after +a call with query_level=1. + +An unpatched Windows Server returns DCERPC_NCA_S_FAULT_INVALID_TAG +for query_level values other than 1. +While Samba tries to return NT_STATUS_NOT_SUPPORTED, but +later fails to marshall the response, which results +in DCERPC_FAULT_BAD_STUB_DATA instead. + +Because we don't have any documentation for level 2 yet, +we just try to behave like an unpatched server and +generate DCERPC_NCA_S_FAULT_INVALID_TAG instead of +DCERPC_FAULT_BAD_STUB_DATA. +Which allows patched Windows clients to keep working +against a Samba DC. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15418 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Andrew Bartlett +--- + .../knownfail.d/netr_LogonGetCapabilities | 2 -- + source4/rpc_server/netlogon/dcerpc_netlogon.c | 28 ++++++++++++++++--- + 2 files changed, 24 insertions(+), 6 deletions(-) + +diff --git a/selftest/knownfail.d/netr_LogonGetCapabilities b/selftest/knownfail.d/netr_LogonGetCapabilities +index 30aadf3bb9d..99c7ac711ed 100644 +--- a/selftest/knownfail.d/netr_LogonGetCapabilities ++++ b/selftest/knownfail.d/netr_LogonGetCapabilities +@@ -1,3 +1 @@ + ^samba3.rpc.schannel.*\.schannel\(nt4_dc +-^samba3.rpc.schannel.*\.schannel\(ad_dc +-^samba4.rpc.schannel.*\.schannel\(ad_dc +diff --git a/source4/rpc_server/netlogon/dcerpc_netlogon.c b/source4/rpc_server/netlogon/dcerpc_netlogon.c +index 6ccba65d3bf..dc2167f08b2 100644 +--- a/source4/rpc_server/netlogon/dcerpc_netlogon.c ++++ b/source4/rpc_server/netlogon/dcerpc_netlogon.c +@@ -2364,6 +2364,30 @@ static NTSTATUS dcesrv_netr_LogonGetCapabilities(struct dcesrv_call_state *dce_c + struct netlogon_creds_CredentialState *creds; + NTSTATUS status; + ++ switch (r->in.query_level) { ++ case 1: ++ break; ++ case 2: ++ /* ++ * Until we know the details behind KB5028166 ++ * just return DCERPC_NCA_S_FAULT_INVALID_TAG ++ * like an unpatched Windows Server. ++ */ ++ FALL_THROUGH; ++ default: ++ /* ++ * There would not be a way to marshall the ++ * the response. Which would mean our final ++ * ndr_push would fail an we would return ++ * an RPC-level fault with DCERPC_FAULT_BAD_STUB_DATA. ++ * ++ * But it's important to match a Windows server ++ * especially before KB5028166, see also our bug #15418 ++ * Otherwise Windows client would stop talking to us. ++ */ ++ DCESRV_FAULT(DCERPC_NCA_S_FAULT_INVALID_TAG); ++ } ++ + status = dcesrv_netr_creds_server_step_check(dce_call, + mem_ctx, + r->in.computer_name, +@@ -2375,10 +2399,6 @@ static NTSTATUS dcesrv_netr_LogonGetCapabilities(struct dcesrv_call_state *dce_c + } + NT_STATUS_NOT_OK_RETURN(status); + +- if (r->in.query_level != 1) { +- return NT_STATUS_NOT_SUPPORTED; +- } +- + r->out.capabilities->server_capabilities = creds->negotiate_flags; + + return NT_STATUS_OK; +-- +2.41.0 + + +From dfeabce44fbb78083fbbb2aa634fc4172cf83db9 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Sat, 15 Jul 2023 16:11:48 +0200 +Subject: [PATCH 4/4] s3:rpc_server:netlogon: generate FAULT_INVALID_TAG for + invalid netr_LogonGetCapabilities levels + +This is important as Windows clients with KB5028166 seem to +call netr_LogonGetCapabilities with query_level=2 after +a call with query_level=1. + +An unpatched Windows Server returns DCERPC_NCA_S_FAULT_INVALID_TAG +for query_level values other than 1. +While Samba tries to return NT_STATUS_NOT_SUPPORTED, but +later fails to marshall the response, which results +in DCERPC_FAULT_BAD_STUB_DATA instead. + +Because we don't have any documentation for level 2 yet, +we just try to behave like an unpatched server and +generate DCERPC_NCA_S_FAULT_INVALID_TAG instead of +DCERPC_FAULT_BAD_STUB_DATA. +Which allows patched Windows clients to keep working +against a Samba DC. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15418 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Andrew Bartlett + +Autobuild-User(master): Stefan Metzmacher +Autobuild-Date(master): Mon Jul 17 07:35:09 UTC 2023 on atb-devel-224 +--- + .../knownfail.d/netr_LogonGetCapabilities | 1 - + source3/rpc_server/netlogon/srv_netlog_nt.c | 29 ++++++++++++++++--- + 2 files changed, 25 insertions(+), 5 deletions(-) + delete mode 100644 selftest/knownfail.d/netr_LogonGetCapabilities + +diff --git a/selftest/knownfail.d/netr_LogonGetCapabilities b/selftest/knownfail.d/netr_LogonGetCapabilities +deleted file mode 100644 +index 99c7ac711ed..00000000000 +--- a/selftest/knownfail.d/netr_LogonGetCapabilities ++++ /dev/null +@@ -1 +0,0 @@ +-^samba3.rpc.schannel.*\.schannel\(nt4_dc +diff --git a/source3/rpc_server/netlogon/srv_netlog_nt.c b/source3/rpc_server/netlogon/srv_netlog_nt.c +index 3ba58e61206..e8aa14167fc 100644 +--- a/source3/rpc_server/netlogon/srv_netlog_nt.c ++++ b/source3/rpc_server/netlogon/srv_netlog_nt.c +@@ -2284,6 +2284,31 @@ NTSTATUS _netr_LogonGetCapabilities(struct pipes_struct *p, + struct netlogon_creds_CredentialState *creds; + NTSTATUS status; + ++ switch (r->in.query_level) { ++ case 1: ++ break; ++ case 2: ++ /* ++ * Until we know the details behind KB5028166 ++ * just return DCERPC_NCA_S_FAULT_INVALID_TAG ++ * like an unpatched Windows Server. ++ */ ++ FALL_THROUGH; ++ default: ++ /* ++ * There would not be a way to marshall the ++ * the response. Which would mean our final ++ * ndr_push would fail an we would return ++ * an RPC-level fault with DCERPC_FAULT_BAD_STUB_DATA. ++ * ++ * But it's important to match a Windows server ++ * especially before KB5028166, see also our bug #15418 ++ * Otherwise Windows client would stop talking to us. ++ */ ++ p->fault_state = DCERPC_NCA_S_FAULT_INVALID_TAG; ++ return NT_STATUS_NOT_SUPPORTED; ++ } ++ + become_root(); + status = dcesrv_netr_creds_server_step_check(p->dce_call, + p->mem_ctx, +@@ -2296,10 +2321,6 @@ NTSTATUS _netr_LogonGetCapabilities(struct pipes_struct *p, + return status; + } + +- if (r->in.query_level != 1) { +- return NT_STATUS_NOT_SUPPORTED; +- } +- + r->out.capabilities->server_capabilities = creds->negotiate_flags; + + return NT_STATUS_OK; +-- +2.41.0 + diff --git a/samba.spec b/samba.spec index 8a72ccb..3134ee6 100644 --- a/samba.spec +++ b/samba.spec @@ -138,7 +138,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.4 -%global baserelease 0 +%global baserelease 1 # This should be rc1 or %%nil %global pre_release %nil @@ -234,6 +234,8 @@ Source17: samba-usershares-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore +Patch0: master-netlogongetcaps.patch + Requires(pre): /usr/sbin/groupadd Requires(pre): %{name}-common = %{samba_depver} @@ -4333,6 +4335,9 @@ fi %endif %changelog +* Sat Jul 15 2023 Guenther Deschner - 4.18.4-1 +- resolves: #2223091 - Fix netlogon LogonGetCapabilities level 2 error handling + * Wed Jul 05 2023 Guenther Deschner - 4.18.4-0 - resolves: #2219799 - Update to version 4.18.4 From da59c65fac160d633a775d5bf074d185c39c0700 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 20 Jul 2023 10:21:05 +0200 Subject: [PATCH 30/37] Update to version 4.18.5 resolves: #2224040 Security fix for CVE-2022-2127 resolves: #2222791, #2224254 Security fix for CVE-2023-3347 resolves: #2222792, #2224255 Security fix for CVE-2023-34966 resolves: #2222793, #2224253 Security fix for CVE-2023-34967 resolves: #2222794, #2224252 Security fix for CVE-2023-34968 resolves: #2222795, #2224250 Guenther --- .gitignore | 2 + master-netlogongetcaps.patch | 351 ----------------------------------- samba.spec | 14 +- sources | 4 +- 4 files changed, 14 insertions(+), 357 deletions(-) delete mode 100644 master-netlogongetcaps.patch diff --git a/.gitignore b/.gitignore index 1849014..7d7069f 100644 --- a/.gitignore +++ b/.gitignore @@ -335,3 +335,5 @@ samba-3.6.0pre1.tar.gz /samba-4.18.3.tar.asc /samba-4.18.4.tar.xz /samba-4.18.4.tar.asc +/samba-4.18.5.tar.xz +/samba-4.18.5.tar.asc diff --git a/master-netlogongetcaps.patch b/master-netlogongetcaps.patch deleted file mode 100644 index dd0f6b1..0000000 --- a/master-netlogongetcaps.patch +++ /dev/null @@ -1,351 +0,0 @@ -From 5f87888ed53320538cf773d64868390d8641a40e Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Sat, 15 Jul 2023 17:20:32 +0200 -Subject: [PATCH 1/4] netlogon.idl: add support for netr_LogonGetCapabilities - response level 2 - -We don't have any documentation about this yet, but tests against -a Windows Server 2022 patched with KB5028166 revealed that -the response for query_level=2 is exactly the same as -for querey_level=1. - -Until we know the reason for query_level=2 we won't -use it as client nor support it in the server, but -we want ndrdump to work. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15418 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Andrew Bartlett ---- - librpc/idl/netlogon.idl | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/librpc/idl/netlogon.idl b/librpc/idl/netlogon.idl -index 48a8c8f9310..85dd73ee7e4 100644 ---- a/librpc/idl/netlogon.idl -+++ b/librpc/idl/netlogon.idl -@@ -1236,6 +1236,7 @@ interface netlogon - /* Function 0x15 */ - typedef [switch_type(uint32)] union { - [case(1)] netr_NegotiateFlags server_capabilities; -+ [case(2)] netr_NegotiateFlags server_capabilities; - } netr_Capabilities; - - NTSTATUS netr_LogonGetCapabilities( --- -2.41.0 - - -From 404ce08e9088968311c714e756f5d58ce2cef715 Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Sat, 15 Jul 2023 17:25:05 +0200 -Subject: [PATCH 2/4] s4:torture/rpc: let rpc.schannel also check - netr_LogonGetCapabilities with different levels - -The important change it that we expect DCERPC_NCA_S_FAULT_INVALID_TAG -for unsupported query_levels, we allow it to work with servers -with or without support for query_level=2. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15418 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Andrew Bartlett ---- - .../knownfail.d/netr_LogonGetCapabilities | 3 + - source4/torture/rpc/netlogon.c | 77 ++++++++++++++++++- - 2 files changed, 79 insertions(+), 1 deletion(-) - create mode 100644 selftest/knownfail.d/netr_LogonGetCapabilities - -diff --git a/selftest/knownfail.d/netr_LogonGetCapabilities b/selftest/knownfail.d/netr_LogonGetCapabilities -new file mode 100644 -index 00000000000..30aadf3bb9d ---- /dev/null -+++ b/selftest/knownfail.d/netr_LogonGetCapabilities -@@ -0,0 +1,3 @@ -+^samba3.rpc.schannel.*\.schannel\(nt4_dc -+^samba3.rpc.schannel.*\.schannel\(ad_dc -+^samba4.rpc.schannel.*\.schannel\(ad_dc -diff --git a/source4/torture/rpc/netlogon.c b/source4/torture/rpc/netlogon.c -index 1f068eb7826..a3d190f13dd 100644 ---- a/source4/torture/rpc/netlogon.c -+++ b/source4/torture/rpc/netlogon.c -@@ -2056,8 +2056,47 @@ bool test_netlogon_capabilities(struct dcerpc_pipe *p, struct torture_context *t - r.out.capabilities = &capabilities; - r.out.return_authenticator = &return_auth; - -- torture_comment(tctx, "Testing LogonGetCapabilities\n"); -+ torture_comment(tctx, "Testing LogonGetCapabilities with query_level=0\n"); - -+ r.in.query_level = 0; -+ ZERO_STRUCT(return_auth); -+ -+ /* -+ * we need to operate on a temporary copy of creds -+ * because dcerpc_netr_LogonGetCapabilities with -+ * an unknown query level returns DCERPC_NCA_S_FAULT_INVALID_TAG -+ * => NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE -+ * without looking a the authenticator. -+ */ -+ tmp_creds = *creds; -+ netlogon_creds_client_authenticator(&tmp_creds, &auth); -+ -+ status = dcerpc_netr_LogonGetCapabilities_r(b, tctx, &r); -+ torture_assert_ntstatus_equal(tctx, status, NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE, -+ "LogonGetCapabilities query_level=0 failed"); -+ -+ torture_comment(tctx, "Testing LogonGetCapabilities with query_level=3\n"); -+ -+ r.in.query_level = 3; -+ ZERO_STRUCT(return_auth); -+ -+ /* -+ * we need to operate on a temporary copy of creds -+ * because dcerpc_netr_LogonGetCapabilities with -+ * an unknown query level returns DCERPC_NCA_S_FAULT_INVALID_TAG -+ * => NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE -+ * without looking a the authenticator. -+ */ -+ tmp_creds = *creds; -+ netlogon_creds_client_authenticator(&tmp_creds, &auth); -+ -+ status = dcerpc_netr_LogonGetCapabilities_r(b, tctx, &r); -+ torture_assert_ntstatus_equal(tctx, status, NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE, -+ "LogonGetCapabilities query_level=0 failed"); -+ -+ torture_comment(tctx, "Testing LogonGetCapabilities with query_level=1\n"); -+ -+ r.in.query_level = 1; - ZERO_STRUCT(return_auth); - - /* -@@ -2077,6 +2116,42 @@ bool test_netlogon_capabilities(struct dcerpc_pipe *p, struct torture_context *t - - *creds = tmp_creds; - -+ torture_assert(tctx, netlogon_creds_client_check(creds, -+ &r.out.return_authenticator->cred), -+ "Credential chaining failed"); -+ -+ torture_assert_int_equal(tctx, creds->negotiate_flags, -+ capabilities.server_capabilities, -+ "negotiate flags"); -+ -+ torture_comment(tctx, "Testing LogonGetCapabilities with query_level=2\n"); -+ -+ r.in.query_level = 2; -+ ZERO_STRUCT(return_auth); -+ -+ /* -+ * we need to operate on a temporary copy of creds -+ * because dcerpc_netr_LogonGetCapabilities with -+ * an query level 2 may returns DCERPC_NCA_S_FAULT_INVALID_TAG -+ * => NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE -+ * without looking a the authenticator. -+ */ -+ tmp_creds = *creds; -+ netlogon_creds_client_authenticator(&tmp_creds, &auth); -+ -+ status = dcerpc_netr_LogonGetCapabilities_r(b, tctx, &r); -+ if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE)) { -+ /* -+ * an server without KB5028166 returns -+ * DCERPC_NCA_S_FAULT_INVALID_TAG => -+ * NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE -+ */ -+ return true; -+ } -+ torture_assert_ntstatus_ok(tctx, status, "LogonGetCapabilities query_level=2 failed"); -+ -+ *creds = tmp_creds; -+ - torture_assert(tctx, netlogon_creds_client_check(creds, - &r.out.return_authenticator->cred), - "Credential chaining failed"); --- -2.41.0 - - -From d5f1097b6220676d56ed5fc6707acf667b704518 Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Sat, 15 Jul 2023 16:11:48 +0200 -Subject: [PATCH 3/4] s4:rpc_server:netlogon: generate FAULT_INVALID_TAG for - invalid netr_LogonGetCapabilities levels - -This is important as Windows clients with KB5028166 seem to -call netr_LogonGetCapabilities with query_level=2 after -a call with query_level=1. - -An unpatched Windows Server returns DCERPC_NCA_S_FAULT_INVALID_TAG -for query_level values other than 1. -While Samba tries to return NT_STATUS_NOT_SUPPORTED, but -later fails to marshall the response, which results -in DCERPC_FAULT_BAD_STUB_DATA instead. - -Because we don't have any documentation for level 2 yet, -we just try to behave like an unpatched server and -generate DCERPC_NCA_S_FAULT_INVALID_TAG instead of -DCERPC_FAULT_BAD_STUB_DATA. -Which allows patched Windows clients to keep working -against a Samba DC. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15418 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Andrew Bartlett ---- - .../knownfail.d/netr_LogonGetCapabilities | 2 -- - source4/rpc_server/netlogon/dcerpc_netlogon.c | 28 ++++++++++++++++--- - 2 files changed, 24 insertions(+), 6 deletions(-) - -diff --git a/selftest/knownfail.d/netr_LogonGetCapabilities b/selftest/knownfail.d/netr_LogonGetCapabilities -index 30aadf3bb9d..99c7ac711ed 100644 ---- a/selftest/knownfail.d/netr_LogonGetCapabilities -+++ b/selftest/knownfail.d/netr_LogonGetCapabilities -@@ -1,3 +1 @@ - ^samba3.rpc.schannel.*\.schannel\(nt4_dc --^samba3.rpc.schannel.*\.schannel\(ad_dc --^samba4.rpc.schannel.*\.schannel\(ad_dc -diff --git a/source4/rpc_server/netlogon/dcerpc_netlogon.c b/source4/rpc_server/netlogon/dcerpc_netlogon.c -index 6ccba65d3bf..dc2167f08b2 100644 ---- a/source4/rpc_server/netlogon/dcerpc_netlogon.c -+++ b/source4/rpc_server/netlogon/dcerpc_netlogon.c -@@ -2364,6 +2364,30 @@ static NTSTATUS dcesrv_netr_LogonGetCapabilities(struct dcesrv_call_state *dce_c - struct netlogon_creds_CredentialState *creds; - NTSTATUS status; - -+ switch (r->in.query_level) { -+ case 1: -+ break; -+ case 2: -+ /* -+ * Until we know the details behind KB5028166 -+ * just return DCERPC_NCA_S_FAULT_INVALID_TAG -+ * like an unpatched Windows Server. -+ */ -+ FALL_THROUGH; -+ default: -+ /* -+ * There would not be a way to marshall the -+ * the response. Which would mean our final -+ * ndr_push would fail an we would return -+ * an RPC-level fault with DCERPC_FAULT_BAD_STUB_DATA. -+ * -+ * But it's important to match a Windows server -+ * especially before KB5028166, see also our bug #15418 -+ * Otherwise Windows client would stop talking to us. -+ */ -+ DCESRV_FAULT(DCERPC_NCA_S_FAULT_INVALID_TAG); -+ } -+ - status = dcesrv_netr_creds_server_step_check(dce_call, - mem_ctx, - r->in.computer_name, -@@ -2375,10 +2399,6 @@ static NTSTATUS dcesrv_netr_LogonGetCapabilities(struct dcesrv_call_state *dce_c - } - NT_STATUS_NOT_OK_RETURN(status); - -- if (r->in.query_level != 1) { -- return NT_STATUS_NOT_SUPPORTED; -- } -- - r->out.capabilities->server_capabilities = creds->negotiate_flags; - - return NT_STATUS_OK; --- -2.41.0 - - -From dfeabce44fbb78083fbbb2aa634fc4172cf83db9 Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Sat, 15 Jul 2023 16:11:48 +0200 -Subject: [PATCH 4/4] s3:rpc_server:netlogon: generate FAULT_INVALID_TAG for - invalid netr_LogonGetCapabilities levels - -This is important as Windows clients with KB5028166 seem to -call netr_LogonGetCapabilities with query_level=2 after -a call with query_level=1. - -An unpatched Windows Server returns DCERPC_NCA_S_FAULT_INVALID_TAG -for query_level values other than 1. -While Samba tries to return NT_STATUS_NOT_SUPPORTED, but -later fails to marshall the response, which results -in DCERPC_FAULT_BAD_STUB_DATA instead. - -Because we don't have any documentation for level 2 yet, -we just try to behave like an unpatched server and -generate DCERPC_NCA_S_FAULT_INVALID_TAG instead of -DCERPC_FAULT_BAD_STUB_DATA. -Which allows patched Windows clients to keep working -against a Samba DC. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15418 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Andrew Bartlett - -Autobuild-User(master): Stefan Metzmacher -Autobuild-Date(master): Mon Jul 17 07:35:09 UTC 2023 on atb-devel-224 ---- - .../knownfail.d/netr_LogonGetCapabilities | 1 - - source3/rpc_server/netlogon/srv_netlog_nt.c | 29 ++++++++++++++++--- - 2 files changed, 25 insertions(+), 5 deletions(-) - delete mode 100644 selftest/knownfail.d/netr_LogonGetCapabilities - -diff --git a/selftest/knownfail.d/netr_LogonGetCapabilities b/selftest/knownfail.d/netr_LogonGetCapabilities -deleted file mode 100644 -index 99c7ac711ed..00000000000 ---- a/selftest/knownfail.d/netr_LogonGetCapabilities -+++ /dev/null -@@ -1 +0,0 @@ --^samba3.rpc.schannel.*\.schannel\(nt4_dc -diff --git a/source3/rpc_server/netlogon/srv_netlog_nt.c b/source3/rpc_server/netlogon/srv_netlog_nt.c -index 3ba58e61206..e8aa14167fc 100644 ---- a/source3/rpc_server/netlogon/srv_netlog_nt.c -+++ b/source3/rpc_server/netlogon/srv_netlog_nt.c -@@ -2284,6 +2284,31 @@ NTSTATUS _netr_LogonGetCapabilities(struct pipes_struct *p, - struct netlogon_creds_CredentialState *creds; - NTSTATUS status; - -+ switch (r->in.query_level) { -+ case 1: -+ break; -+ case 2: -+ /* -+ * Until we know the details behind KB5028166 -+ * just return DCERPC_NCA_S_FAULT_INVALID_TAG -+ * like an unpatched Windows Server. -+ */ -+ FALL_THROUGH; -+ default: -+ /* -+ * There would not be a way to marshall the -+ * the response. Which would mean our final -+ * ndr_push would fail an we would return -+ * an RPC-level fault with DCERPC_FAULT_BAD_STUB_DATA. -+ * -+ * But it's important to match a Windows server -+ * especially before KB5028166, see also our bug #15418 -+ * Otherwise Windows client would stop talking to us. -+ */ -+ p->fault_state = DCERPC_NCA_S_FAULT_INVALID_TAG; -+ return NT_STATUS_NOT_SUPPORTED; -+ } -+ - become_root(); - status = dcesrv_netr_creds_server_step_check(p->dce_call, - p->mem_ctx, -@@ -2296,10 +2321,6 @@ NTSTATUS _netr_LogonGetCapabilities(struct pipes_struct *p, - return status; - } - -- if (r->in.query_level != 1) { -- return NT_STATUS_NOT_SUPPORTED; -- } -- - r->out.capabilities->server_capabilities = creds->negotiate_flags; - - return NT_STATUS_OK; --- -2.41.0 - diff --git a/samba.spec b/samba.spec index 3134ee6..bfdb829 100644 --- a/samba.spec +++ b/samba.spec @@ -137,8 +137,8 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.18.4 -%global baserelease 1 +%global samba_version 4.18.5 +%global baserelease 0 # This should be rc1 or %%nil %global pre_release %nil @@ -234,8 +234,6 @@ Source17: samba-usershares-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore -Patch0: master-netlogongetcaps.patch - Requires(pre): /usr/sbin/groupadd Requires(pre): %{name}-common = %{samba_depver} @@ -4335,6 +4333,14 @@ fi %endif %changelog +* Thu Jul 20 2023 Guenther Deschner - 4.18.5-0 +- resolves: #2224040 - Update to version 4.18.5 +- resolves: #2222791, #2224254 - Security fix for CVE-2022-2127 +- resolves: #2222792, #2224255 - Security fix for CVE-2023-3347 +- resolves: #2222793, #2224253 - Security fix for CVE-2023-34966 +- resolves: #2222794, #2224252 - Security fix for CVE-2023-34967 +- resolves: #2222795, #2224250 - Security fix for CVE-2023-34968 + * Sat Jul 15 2023 Guenther Deschner - 4.18.4-1 - resolves: #2223091 - Fix netlogon LogonGetCapabilities level 2 error handling diff --git a/sources b/sources index e1b7b1c..d77b19c 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.18.4.tar.xz) = 9b9ed3111e8c1f8fbb990e2cf78bdd00bbe03e79247ec87a3ee51744acfbc6692f110dc88ccb1049b7d9c6aaa8fd6ba3ab4acd7ad0480dbb9df8b61980c0da83 -SHA512 (samba-4.18.4.tar.asc) = bc13d14b8da6a05494a79b8a8fb35fc27670f7ab8609eaeb3f3df49dd04bdb1389e77c2d571db5efcdd85532971c423eb977d46c2a5cbee3daadd6c6eca721ec +SHA512 (samba-4.18.5.tar.xz) = 3e405731813d5b0937e6c16938c6dcf8e182dafd29010dc75711afc397a63ee459fda04e78ff24e31fa0efd213e25a7e6c214a5bdf82d4d0f0123f2c6a8ebdd6 +SHA512 (samba-4.18.5.tar.asc) = 29b541a95dc565e541526a9aeecff5d4df4e7df38c5c00ec8cc848b13c683c0d0c7dee442ab1a2d03e0f88b960cec7fb5a2cb8ea44c53ce29c858f5a058e7f84 From d4a36122de08bf1c415aacea38a3c80427a34af6 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 17 Aug 2023 09:05:55 +0200 Subject: [PATCH 31/37] Update to version 4.18.6 --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 7d7069f..fe5c57b 100644 --- a/.gitignore +++ b/.gitignore @@ -337,3 +337,5 @@ samba-3.6.0pre1.tar.gz /samba-4.18.4.tar.asc /samba-4.18.5.tar.xz /samba-4.18.5.tar.asc +/samba-4.18.6.tar.xz +/samba-4.18.6.tar.asc diff --git a/samba.spec b/samba.spec index bfdb829..1900715 100644 --- a/samba.spec +++ b/samba.spec @@ -137,8 +137,8 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.18.5 -%global baserelease 0 +%global samba_version 4.18.6 +%global baserelease 1 # This should be rc1 or %%nil %global pre_release %nil @@ -4333,6 +4333,9 @@ fi %endif %changelog +* Thu Aug 17 2023 Andreas Schneider - 4.18.6-1 +- Update to version 4.18.6 + * Thu Jul 20 2023 Guenther Deschner - 4.18.5-0 - resolves: #2224040 - Update to version 4.18.5 - resolves: #2222791, #2224254 - Security fix for CVE-2022-2127 diff --git a/sources b/sources index d77b19c..18c8d6c 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.18.5.tar.xz) = 3e405731813d5b0937e6c16938c6dcf8e182dafd29010dc75711afc397a63ee459fda04e78ff24e31fa0efd213e25a7e6c214a5bdf82d4d0f0123f2c6a8ebdd6 -SHA512 (samba-4.18.5.tar.asc) = 29b541a95dc565e541526a9aeecff5d4df4e7df38c5c00ec8cc848b13c683c0d0c7dee442ab1a2d03e0f88b960cec7fb5a2cb8ea44c53ce29c858f5a058e7f84 +SHA512 (samba-4.18.6.tar.xz) = 019c66aafe4a8c83da096ff264836c73a56e388ff7fa2d97587f4fb77b08d382146cac807f01e8c35fe873e938501a70d68f0e0947f8856d99c0dfc4ab3f4d94 +SHA512 (samba-4.18.6.tar.asc) = b7d7198a536c47cae8b44f0c2b9ad528f0b9422fb6b6bec93ce44b6f7fcb894f6622fa5de67654f6d435f922666328408ea2be82ebf50f46b4651ee21f129896 From 5e99e503d01cbcdf23cfe79f27187f264ac51a61 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 27 Sep 2023 14:34:31 +0200 Subject: [PATCH 32/37] Update to version 4.18.7 Guenther --- .gitignore | 2 ++ samba.spec | 5 ++++- sources | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index fe5c57b..7568b4d 100644 --- a/.gitignore +++ b/.gitignore @@ -339,3 +339,5 @@ samba-3.6.0pre1.tar.gz /samba-4.18.5.tar.asc /samba-4.18.6.tar.xz /samba-4.18.6.tar.asc +/samba-4.18.7.tar.xz +/samba-4.18.7.tar.asc diff --git a/samba.spec b/samba.spec index 1900715..3cd9ba5 100644 --- a/samba.spec +++ b/samba.spec @@ -137,7 +137,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.18.6 +%global samba_version 4.18.7 %global baserelease 1 # This should be rc1 or %%nil %global pre_release %nil @@ -4333,6 +4333,9 @@ fi %endif %changelog +* Wed Sep 27 2023 Guenther Deschner - 4.18.7-1 +- Update to version 4.18.7 + * Thu Aug 17 2023 Andreas Schneider - 4.18.6-1 - Update to version 4.18.6 diff --git a/sources b/sources index 18c8d6c..2bd61f6 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.18.6.tar.xz) = 019c66aafe4a8c83da096ff264836c73a56e388ff7fa2d97587f4fb77b08d382146cac807f01e8c35fe873e938501a70d68f0e0947f8856d99c0dfc4ab3f4d94 -SHA512 (samba-4.18.6.tar.asc) = b7d7198a536c47cae8b44f0c2b9ad528f0b9422fb6b6bec93ce44b6f7fcb894f6622fa5de67654f6d435f922666328408ea2be82ebf50f46b4651ee21f129896 +SHA512 (samba-4.18.7.tar.xz) = e34fc239c245f2fa1c8e9c6f4c2f4c7d149cef0802de6e6fbba34670ba708973ec5e841730d7859fa0d56d133bc534dd13eca18e8afef5331572c999637c084b +SHA512 (samba-4.18.7.tar.asc) = ed3312f59063c9839930da03892f886070c1b642daa050d6364d00add0114c036b170ca25a21de75b6557d05928ca3a0263ae923cd9e1b6c2996f91faca8b46d From ac1a8f451afb4ecec724c7bd3654635ed2faccea Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 10 Oct 2023 17:40:20 +0200 Subject: [PATCH 33/37] Update to 4.18.8 resolves: #2241881, #2243228: Security fix for CVE-2023-3961 resolves: #2241882, #2243231: Security fix for CVE-2023-4091 resolves: #2241883, #2243230: Security fix for CVE-2023-4154 resolves: #2241884, #2243229: Security fix for CVE-2023-42669 resolves: #2241885, #2243232: Security fix for CVE-2023-42670 Guenther --- .gitignore | 2 ++ samba.spec | 11 +++++++++-- sources | 4 ++-- 3 files changed, 13 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 7568b4d..880d1d3 100644 --- a/.gitignore +++ b/.gitignore @@ -341,3 +341,5 @@ samba-3.6.0pre1.tar.gz /samba-4.18.6.tar.asc /samba-4.18.7.tar.xz /samba-4.18.7.tar.asc +/samba-4.18.8.tar.xz +/samba-4.18.8.tar.asc diff --git a/samba.spec b/samba.spec index 3cd9ba5..cbf4fd9 100644 --- a/samba.spec +++ b/samba.spec @@ -137,7 +137,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.18.7 +%global samba_version 4.18.8 %global baserelease 1 # This should be rc1 or %%nil %global pre_release %nil @@ -2029,7 +2029,6 @@ fi %{_libexecdir}/samba/rpcd_fsrvp %{_libexecdir}/samba/rpcd_lsad %{_libexecdir}/samba/rpcd_mdssvc -%{_libexecdir}/samba/rpcd_rpcecho %{_libexecdir}/samba/rpcd_spoolss %{_libexecdir}/samba/rpcd_winreg %{_mandir}/man8/samba-dcerpcd.8* @@ -4333,6 +4332,14 @@ fi %endif %changelog +* Tue Oct 10 2023 Guenther Deschner - 4.18.8-1 +- Update to 4.18.8 +- resolves: #2241881, #2243228: Security fix for CVE-2023-3961 +- resolves: #2241882, #2243231: Security fix for CVE-2023-4091 +- resolves: #2241883, #2243230: Security fix for CVE-2023-4154 +- resolves: #2241884, #2243229: Security fix for CVE-2023-42669 +- resolves: #2241885, #2243232: Security fix for CVE-2023-42670 + * Wed Sep 27 2023 Guenther Deschner - 4.18.7-1 - Update to version 4.18.7 diff --git a/sources b/sources index 2bd61f6..ff7c6bd 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.18.7.tar.xz) = e34fc239c245f2fa1c8e9c6f4c2f4c7d149cef0802de6e6fbba34670ba708973ec5e841730d7859fa0d56d133bc534dd13eca18e8afef5331572c999637c084b -SHA512 (samba-4.18.7.tar.asc) = ed3312f59063c9839930da03892f886070c1b642daa050d6364d00add0114c036b170ca25a21de75b6557d05928ca3a0263ae923cd9e1b6c2996f91faca8b46d +SHA512 (samba-4.18.8.tar.xz) = f458b3d3322aa338696c9e3b98486b004d9b68b00158290af95a0e9ac80eabc96bdb515bd0ddc7b33b5d9be826db211db2a16fdf918bcaae0d730a4533ce43a7 +SHA512 (samba-4.18.8.tar.asc) = 28afbafbce38e196135ee2868520ca48dfef1cd12f81ac3d42073a71756c25978ba952220c8b67e95f0da8e9241a5fb29e90842f61815be5ee91398dedb6fa59 From de03a1e62823fde5c0b832a91436566d00d26acd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 13 Oct 2023 11:43:02 +0200 Subject: [PATCH 34/37] When built with testsuite rpcd_echo is built as well Guenther --- samba.spec | 3 +++ 1 file changed, 3 insertions(+) diff --git a/samba.spec b/samba.spec index cbf4fd9..b68240c 100644 --- a/samba.spec +++ b/samba.spec @@ -2029,6 +2029,9 @@ fi %{_libexecdir}/samba/rpcd_fsrvp %{_libexecdir}/samba/rpcd_lsad %{_libexecdir}/samba/rpcd_mdssvc +%if %{with testsuite} +%{_libexecdir}/samba/rpcd_rpcecho +%endif %{_libexecdir}/samba/rpcd_spoolss %{_libexecdir}/samba/rpcd_winreg %{_mandir}/man8/samba-dcerpcd.8* From e02bfeee31d102f7441571f573c2003c97cd8a61 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 30 Nov 2023 09:06:29 +0100 Subject: [PATCH 35/37] Update to 4.18.9 Security fix for CVE-2018-14628 resolves: #1625445, #2160799 Guenther --- .gitignore | 2 ++ samba.spec | 6 +++++- sources | 4 ++-- 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 880d1d3..104b086 100644 --- a/.gitignore +++ b/.gitignore @@ -343,3 +343,5 @@ samba-3.6.0pre1.tar.gz /samba-4.18.7.tar.asc /samba-4.18.8.tar.xz /samba-4.18.8.tar.asc +/samba-4.18.9.tar.xz +/samba-4.18.9.tar.asc diff --git a/samba.spec b/samba.spec index b68240c..e6a0dec 100644 --- a/samba.spec +++ b/samba.spec @@ -137,7 +137,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.18.8 +%global samba_version 4.18.9 %global baserelease 1 # This should be rc1 or %%nil %global pre_release %nil @@ -4335,6 +4335,10 @@ fi %endif %changelog +* Thu Nov 30 2023 Guenther Deschner - 4.18.9-1 +- Update to 4.18.9 +- resolves: #1625445, #2160799: Security fix for CVE-2018-14628 + * Tue Oct 10 2023 Guenther Deschner - 4.18.8-1 - Update to 4.18.8 - resolves: #2241881, #2243228: Security fix for CVE-2023-3961 diff --git a/sources b/sources index ff7c6bd..c32dd9b 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.18.8.tar.xz) = f458b3d3322aa338696c9e3b98486b004d9b68b00158290af95a0e9ac80eabc96bdb515bd0ddc7b33b5d9be826db211db2a16fdf918bcaae0d730a4533ce43a7 -SHA512 (samba-4.18.8.tar.asc) = 28afbafbce38e196135ee2868520ca48dfef1cd12f81ac3d42073a71756c25978ba952220c8b67e95f0da8e9241a5fb29e90842f61815be5ee91398dedb6fa59 +SHA512 (samba-4.18.9.tar.xz) = a4b571a892f3af9e78fd15c6b6fbd8f9e0a101e3944ea8354d6cf9376e5ff82ab83b86f24d4f55fdb22f81c1a0ca9b42042b7087301e274290d78d30f977dc08 +SHA512 (samba-4.18.9.tar.asc) = 56ca4f81f48c07448f77c5071756c0bc7ccd5b6c5952c1f540e30714d252736165fe9c216fc92f1206a70a6e8cd6855a4310c7c8fbcab7067e70441b43b09e27 From f033fe856114e369a6ec4245ee11bfb6709840c3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 1 Feb 2024 08:05:20 +0100 Subject: [PATCH 36/37] Update to 4.18.10 Guenther --- .gitignore | 2 ++ samba.spec | 5 ++++- sources | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 104b086..2132873 100644 --- a/.gitignore +++ b/.gitignore @@ -345,3 +345,5 @@ samba-3.6.0pre1.tar.gz /samba-4.18.8.tar.asc /samba-4.18.9.tar.xz /samba-4.18.9.tar.asc +/samba-4.18.10.tar.xz +/samba-4.18.10.tar.asc diff --git a/samba.spec b/samba.spec index e6a0dec..5310a1a 100644 --- a/samba.spec +++ b/samba.spec @@ -137,7 +137,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.18.9 +%global samba_version 4.18.10 %global baserelease 1 # This should be rc1 or %%nil %global pre_release %nil @@ -4335,6 +4335,9 @@ fi %endif %changelog +* Thu Feb 01 2024 Guenther Deschner - 4.18.10-1 +- Update to 4.18.10 + * Thu Nov 30 2023 Guenther Deschner - 4.18.9-1 - Update to 4.18.9 - resolves: #1625445, #2160799: Security fix for CVE-2018-14628 diff --git a/sources b/sources index c32dd9b..06a8d71 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.18.9.tar.xz) = a4b571a892f3af9e78fd15c6b6fbd8f9e0a101e3944ea8354d6cf9376e5ff82ab83b86f24d4f55fdb22f81c1a0ca9b42042b7087301e274290d78d30f977dc08 -SHA512 (samba-4.18.9.tar.asc) = 56ca4f81f48c07448f77c5071756c0bc7ccd5b6c5952c1f540e30714d252736165fe9c216fc92f1206a70a6e8cd6855a4310c7c8fbcab7067e70441b43b09e27 +SHA512 (samba-4.18.10.tar.xz) = 28c258fa733114a35ccd64cfc80d4255810ec591a4c062b28c89bda41dfc52f3ff9ad97bcb716a3d82917bca140b1d0d05638d81683dc83e60a0198861963ad7 +SHA512 (samba-4.18.10.tar.asc) = 8116ff3ae0ad91ac8f48f03f741b3ed964fedf04bfece6fb71fb7ee701058c7df654a0f0d05559a9c100de1ef6350b905c25850141215d6f95a688a230b7da9e From 00a843e9b5eae119b5eed60b73442d43cf1e8e4e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 13 Mar 2024 18:14:30 +0100 Subject: [PATCH 37/37] Update to 4.18.11 Guenther --- .gitignore | 2 ++ samba.spec | 5 ++++- sources | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 2132873..e96658d 100644 --- a/.gitignore +++ b/.gitignore @@ -347,3 +347,5 @@ samba-3.6.0pre1.tar.gz /samba-4.18.9.tar.asc /samba-4.18.10.tar.xz /samba-4.18.10.tar.asc +/samba-4.18.11.tar.xz +/samba-4.18.11.tar.asc diff --git a/samba.spec b/samba.spec index 5310a1a..69a8658 100644 --- a/samba.spec +++ b/samba.spec @@ -137,7 +137,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.18.10 +%global samba_version 4.18.11 %global baserelease 1 # This should be rc1 or %%nil %global pre_release %nil @@ -4335,6 +4335,9 @@ fi %endif %changelog +* Wed Mar 13 2024 Guenther Deschner - 4.18.11-1 +- Update to 4.18.11 + * Thu Feb 01 2024 Guenther Deschner - 4.18.10-1 - Update to 4.18.10 diff --git a/sources b/sources index 06a8d71..985905c 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.18.10.tar.xz) = 28c258fa733114a35ccd64cfc80d4255810ec591a4c062b28c89bda41dfc52f3ff9ad97bcb716a3d82917bca140b1d0d05638d81683dc83e60a0198861963ad7 -SHA512 (samba-4.18.10.tar.asc) = 8116ff3ae0ad91ac8f48f03f741b3ed964fedf04bfece6fb71fb7ee701058c7df654a0f0d05559a9c100de1ef6350b905c25850141215d6f95a688a230b7da9e +SHA512 (samba-4.18.11.tar.xz) = 96c90d249316d5c609041366a476996f227a97d2b36b6b06b2e7fb45efc3088d5bf8b9be5e078e483141a2ee31b47496dc8eff4ecefae0542cf87541bbb14c06 +SHA512 (samba-4.18.11.tar.asc) = e18915c229fb67d1cb401802c0bfd54d0a77f42f418c8c84a5408237b59f95421221b35d577e052e127b80ac419bea50c5f6924ef2bfef36fec26fa6c9858400