From c73cd76ba5bb93ccaef5fa4a39b47ed4b3e410ca Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 29 Jul 2024 18:15:46 +0200 Subject: [PATCH 01/42] Update to Samba 4.21.0rc2 - Package libldb a public library - resolves: #2300469 Pair-Programmed-With: Andreas Schneider --- samba.spec | 384 +++++++++++++++------ sources | 4 +- sync_machine_password_script_install.patch | 91 +++++ 3 files changed, 376 insertions(+), 103 deletions(-) create mode 100644 sync_machine_password_script_install.patch diff --git a/samba.spec b/samba.spec index dcc42c3..22d0376 100644 --- a/samba.spec +++ b/samba.spec @@ -8,7 +8,7 @@ # %bcond_with testsuite -# Build with internal talloc, tevent, tdb and ldb. +# Build with internal talloc, tevent, tdb # # fedpkg mockbuild --with=testsuite --with=includelibs # or @@ -144,9 +144,15 @@ %bcond_with gpupdate %endif +%ifarch aarch64 ppc64le s390x x86_64 +%bcond lmdb 1 +%else +%bcond lmdb 0 +%endif + %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.20.4 +%global samba_version 4.21.0 # The release field is extended: # [.][.]%%{?dist}[.] @@ -161,7 +167,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release %nil +%global pre_release rc2 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif @@ -174,13 +180,14 @@ %global libdcerpc_so_version 0 %global libndr_krb5pac_so_version 0 %global libndr_nbt_so_version 0 -%global libndr_so_version 4 +%global libndr_so_version 5 %global libndr_standard_so_version 0 %global libnetapi_so_version 1 %global libsamba_credentials_so_version 1 %global libsamba_errors_so_version 1 %global libsamba_hostconfig_so_version 0 %global libsamba_passdb_so_version 0 +%global libsamba_policy_so_version 0 %global libsamba_util_so_version 0 %global libsamdb_so_version 0 %global libsmbconf_so_version 0 @@ -191,9 +198,8 @@ %global libwbclient_so_version 0 %global talloc_version 2.4.2 -%global tdb_version 1.4.10 +%global tdb_version 1.4.11 %global tevent_version 0.16.1 -%global ldb_version 2.9.1 %global required_mit_krb5 1.20.1 @@ -248,6 +254,8 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore +Patch0: sync_machine_password_script_install.patch + Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} @@ -291,6 +299,7 @@ BuildRequires: bison BuildRequires: cups-devel BuildRequires: dbus-devel BuildRequires: docbook-style-xsl +BuildRequires: doxygen BuildRequires: e2fsprogs-devel BuildRequires: flex BuildRequires: gawk @@ -309,7 +318,10 @@ BuildRequires: libcmocka-devel BuildRequires: libtirpc-devel BuildRequires: libuuid-devel BuildRequires: libxslt +%if %{with lmdb} BuildRequires: lmdb +BuildRequires: lmdb-devel >= 0.9.16 +%endif %if %{with winexe} BuildRequires: mingw32-gcc BuildRequires: mingw64-gcc @@ -389,17 +401,6 @@ BuildRequires: python3-tevent >= %{tevent_version} BuildRequires: libtdb-devel >= %{tdb_version} BuildRequires: python3-tdb >= %{tdb_version} - -BuildRequires: libldb-devel >= %{ldb_version} -BuildRequires: python3-ldb >= %{ldb_version} -BuildRequires: python3-ldb-devel >= %{ldb_version} -%endif - -%if %{with includelibs} || %{with testsuite} -# lmdb-devel is required for the mdb ldb module, if samba is configured -# to build includelibs we need lmdb-devel for building that module on our own -BuildRequires: lmdb-devel -#endif without includelibs %endif %if %{with dc} || %{with testsuite} @@ -417,7 +418,6 @@ BuildRequires: python3-setproctitle %if %{without includelibs} BuildRequires: tdb-tools -BuildRequires: ldb-tools #endif without includelibs %endif @@ -559,7 +559,9 @@ Requires: python3-%{name} = %{samba_depver} Requires: python3-%{name}-dc = %{samba_depver} %if %{with dc} # samba-tool needs mdb_copy and tdbackup for domain backup or upgrade provision +%if %{with lmdb} Requires: lmdb +%endif Requires: tdb-tools Requires: python3-gpg %endif @@ -603,11 +605,7 @@ Requires: libwbclient = %{samba_depver} Requires: ldb-tools Requires: python3-setproctitle -# Force using libldb version to be the same as build version -# Otherwise LDB modules will not be loaded and samba-tool will fail -# See bug 1507420 -%samba_requires_eq libldb - +Requires: libldb = %{samba_depver} Requires: python3-%{name} = %{samba_depver} Requires: python3-%{name}-dc = %{samba_depver} Requires: krb5-server >= %{required_mit_krb5} @@ -896,13 +894,6 @@ Provides: bundled(libreplace) The python3-%{name} package contains the Python 3 libraries needed by programs that use SMB, RPC and other Samba provided protocols in Python 3 programs. -%package -n python3-%{name}-devel -Summary: Samba python devel files -Requires: python3-%{name} = %{samba_depver} - -%description -n python3-%{name}-devel -The python3-%{name}-devel package contains the Python 3 devel files. - %package -n python3-samba-test Summary: Samba Python libraries Requires: python3-%{name} = %{samba_depver} @@ -1221,7 +1212,79 @@ Support for using an existing CEPH cluster as a mutex helper for CTDB #endif with clustering %endif +### LIBLDB +%package -n libldb +Summary: A schema-less, ldap like, API and database +License: LGPL-3.0-or-later +Requires: libtalloc%{?_isa} >= %{talloc_version} +Requires: libtdb%{?_isa} >= %{tdb_version} +Requires: libtevent%{?_isa} >= %{tevent_version} +Provides: bundled(libreplace) +Obsoletes: libldb < 2.10 +Provides: libldb = %{samba_depver} + +%description -n libldb +An extensible library that implements an LDAP like API to access remote LDAP +servers, or use local tdb databases. + +### LIBLDB-DEVEL +%package -n libldb-devel +Summary: Developer tools for the LDB library +License: LGPL-3.0-or-later +Requires: libldb%{?_isa} = %{version}-%{release} +Requires: libtdb-devel%{?_isa} >= %{tdb_version} +Requires: libtalloc-devel%{?_isa} >= %{talloc_version} +Requires: libtevent-devel%{?_isa} >= %{tevent_version} + +Obsoletes: libldb-devel < 2.10 +Provides: libldb-devel = %{samba_depver} + +%description -n libldb-devel +Header files needed to develop programs that link against the LDB library. + +### LDB-TOOLS +%package -n ldb-tools +Summary: Tools to manage LDB files +License: LGPL-3.0-or-later +Requires: libldb%{?_isa} = %{samba_release} +Obsoletes: ldb-tools < 2.10 +Provides: ldb-tools = %{samba_depver} + +%description -n ldb-tools +Tools to manage LDB files + +### PYTHON3-LDB-DEVEL-COMMON +%package -n python-ldb-devel-common +Summary: Common development files for the Python bindings for the LDB library +License: LGPL-3.0-or-later + +Provides: pyldb-devel%{?_isa} = %{version}-%{release} +%{?python_provide:%python_provide python2-ldb-devel} + +Obsoletes: python-ldb-devel-common < 2.10 +Provides: python-ldb-devel-common = %{samba_depver} + +%description -n python-ldb-devel-common +Development files for the Python bindings for the LDB library. +This package includes files that aren't specific to a Python version. + +### PYTHON3-LDB +%package -n python3-ldb +Summary: Python bindings for the LDB library +License: LGPL-3.0-or-later +Requires: libldb%{?_isa} = %{version}-%{release} +Requires: python3-tdb%{?_isa} >= %{tdb_version} +%{?python_provide:%python_provide python3-ldb} + +Obsoletes: python3-ldb < 2.10 +Provides: python3-ldb = %{samba_depver} +# These were the C bindings, only used by Samba +Obsoletes: python3-ldb-devel < 2.10 +Provides: python3-ldb-devel = %{samba_depver} + +%description -n python3-ldb +Python bindings for the LDB library %prep %if 0%{?fedora} || 0%{?rhel} >= 9 @@ -1239,16 +1302,14 @@ rm -rfv third_party/heimdal %global _talloc_lib ,talloc,pytalloc,pytalloc-util %global _tevent_lib ,tevent,pytevent %global _tdb_lib ,tdb,pytdb -%global _ldb_lib ,ldb,pyldb,pyldb-util %else %global _talloc_lib ,!talloc,!pytalloc,!pytalloc-util %global _tevent_lib ,!tevent,!pytevent %global _tdb_lib ,!tdb,!pytdb -%global _ldb_lib ,!ldb,!pyldb,!pyldb-util #endif with includelibs %endif -%global _samba_libraries !popt%{_talloc_lib}%{_tevent_lib}%{_tdb_lib}%{_ldb_lib} +%global _samba_bundled_libraries !popt%{_talloc_lib}%{_tevent_lib}%{_tdb_lib} %global _samba_idmap_modules idmap_ad,idmap_rid,idmap_ldap,idmap_hash,idmap_tdb2 %global _samba_pdb_modules pdb_tdbsam,pdb_ldap,pdb_smbpasswd,pdb_wbc_sam,pdb_samba4 @@ -1274,7 +1335,8 @@ rm -rfv third_party/heimdal %global _libwbclient wbclient, %endif -%global _samba_private_libraries %{_libsmbclient}%{_libwbclient} +%global _default_private_libraries !ldb,!dcerpc-samr,!samba-policy,!tevent-util,!dcerpc,!samba-hostconfig,!samba-credentials,!dcerpc_server,!samdb, +%global _samba_private_libraries %{_default_private_libraries}%{_libsmbclient}%{_libwbclient} # TODO: resolve underlinked python modules export python_LDFLAGS="$(echo %{__global_ldflags} | sed -e 's/-Wl,-z,defs//g')" @@ -1311,14 +1373,12 @@ fi --with-cachedir=/var/lib/samba \ --disable-rpath-install \ --with-shared-modules=%{_samba_modules} \ - --bundled-libraries=%{_samba_libraries} \ + --bundled-libraries=%{_samba_bundled_libraries} \ + --private-libraries=%{_samba_private_libraries} \ --with-pam \ --with-pie \ --with-relro \ --without-fam \ -%if (%{without libsmbclient}) || (%{without libwbclient}) - --private-libraries=%{_samba_private_libraries} \ -%endif --with-system-mitkrb5 \ --with-experimental-mit-ad-dc \ %if %{without dc} && %{without testsuite} @@ -1364,6 +1424,10 @@ pushd pidl %make_build popd +pushd lib/ldb +doxygen Doxyfile +popd + %install # Do not use %%make_install, make is just a wrapper around waf in Samba! %{__make} %{?_smp_mflags} %{_make_verbose} install DESTDIR=%{buildroot} @@ -1472,8 +1536,8 @@ rm -f %{buildroot}%{_mandir}/man8/vfs_ceph_snapshots.8* /sbin/ldconfig -N -n %{buildroot}%{_libdir} %if %{without dc} && %{without testsuite} -for f in samba/libsamba-net-samba4.so \ - samba/libsamba-python-samba4.so \ +for f in samba/libsamba-net-private-samba.so \ + samba/libsamba-python-private-samba.so \ libsamba-policy.so* \ pkgconfig/samba-policy.pc ; do rm -f %{buildroot}%{_libdir}/$f @@ -1496,6 +1560,10 @@ rm -f %{buildroot}%{perl_archlib}/vendor_perl/auto/Parse/Pidl/.packlist rm -rf %{buildroot}%{perl_vendorlib}/Parse/Yapp popd +# libldb manpages +cp -a lib/ldb/apidocs/man/* %{buildroot}%{_mandir} +rm -f %{buildroot}%{_mandir}/man3/_* + %if %{with testsuite} %check # @@ -1654,6 +1722,8 @@ fi %systemd_postun_with_restart ctdb.service %endif +%ldconfig_scriptlets -n libldb +%ldconfig_scriptlets -n python3-ldb ### SAMBA %files @@ -1954,7 +2024,6 @@ fi %{_libdir}/samba/libtdb-wrap-private-samba.so %{_libdir}/samba/libtime-basic-private-samba.so %{_libdir}/samba/libtorture-private-samba.so -%{_libdir}/samba/libtrusts-util-private-samba.so %{_libdir}/samba/libutil-reg-private-samba.so %{_libdir}/samba/libutil-setid-private-samba.so %{_libdir}/samba/libutil-tdb-private-samba.so @@ -1976,16 +2045,6 @@ fi %{_libdir}/samba/libtdb-private-samba.so %{_libdir}/samba/libtevent-private-samba.so -%{_libdir}/samba/ldb/asq.so -%{_libdir}/samba/ldb/ldb.so -%{_libdir}/samba/ldb/mdb.so -%{_libdir}/samba/ldb/paged_searches.so -%{_libdir}/samba/ldb/rdn_name.so -%{_libdir}/samba/ldb/sample.so -%{_libdir}/samba/ldb/server_sort.so -%{_libdir}/samba/ldb/skel.so -%{_libdir}/samba/ldb/tdb.so - %{_mandir}/man3/ldb.3.gz %{_mandir}/man3/talloc.3.gz #endif with includelibs @@ -2150,6 +2209,8 @@ fi %endif ### DC-LIBS %files dc-libs +%{_libdir}/libsamba-policy.so.%{libsamba_policy_so_version}* +%{_libdir}/samba/libsamba-net-private-samba.so %{_libdir}/samba/libauth4-private-samba.so %if %{with dc} || %{with testsuite} @@ -2299,6 +2360,7 @@ fi %{_libdir}/libsamba-credentials.so %{_libdir}/libsamba-errors.so %{_libdir}/libsamba-hostconfig.so +%{_libdir}/libsamba-policy.so %{_libdir}/libsamba-util.so %{_libdir}/libsamdb.so %{_libdir}/libsmbconf.so @@ -2311,6 +2373,7 @@ fi %{_libdir}/pkgconfig/ndr_standard.pc %{_libdir}/pkgconfig/samba-credentials.pc %{_libdir}/pkgconfig/samba-hostconfig.pc +%{_libdir}/pkgconfig/samba-policy.pc %{_libdir}/pkgconfig/samba-util.pc %{_libdir}/pkgconfig/samdb.pc %{_libdir}/libsamba-passdb.so @@ -2336,8 +2399,10 @@ fi %if %{with vfs_cephfs} %files vfs-cephfs %{_libdir}/samba/vfs/ceph.so +%{_libdir}/samba/vfs/ceph_new.so %{_libdir}/samba/vfs/ceph_snapshots.so %{_mandir}/man8/vfs_ceph.8* +%{_mandir}/man8/vfs_ceph_new.8* %{_mandir}/man8/vfs_ceph_snapshots.8* %endif @@ -2372,6 +2437,7 @@ fi %files ldb-ldap-modules %{_libdir}/samba/ldb/ldbsamba_extensions.so %{_libdir}/samba/ldb/ildap.so +%{_libdir}/samba/ldb/ldap.so ### LIBS %files libs @@ -2491,6 +2557,7 @@ fi %{python3_sitearch}/samba/__pycache__/hostconfig.*.pyc %{python3_sitearch}/samba/__pycache__/idmap.*.pyc %{python3_sitearch}/samba/__pycache__/join.*.pyc +%{python3_sitearch}/samba/__pycache__/lsa_utils.*.pyc %{python3_sitearch}/samba/__pycache__/logger.*.pyc %{python3_sitearch}/samba/__pycache__/mdb_util.*.pyc %{python3_sitearch}/samba/__pycache__/ms_display_specifiers.*.pyc @@ -2504,7 +2571,6 @@ fi %{python3_sitearch}/samba/__pycache__/sites.*.pyc %{python3_sitearch}/samba/__pycache__/subnets.*.pyc %{python3_sitearch}/samba/__pycache__/tdb_util.*.pyc -%{python3_sitearch}/samba/__pycache__/trust_utils.*.pyc %{python3_sitearch}/samba/__pycache__/upgrade.*.pyc %{python3_sitearch}/samba/__pycache__/upgradehelpers.*.pyc %{python3_sitearch}/samba/__pycache__/xattr.*.pyc @@ -2570,6 +2636,53 @@ fi %{python3_sitearch}/samba/dcerpc/xattr.*.so %{python3_sitearch}/samba/descriptor.py %{python3_sitearch}/samba/dnsresolver.py +%dir %{python3_sitearch}/samba/domain +%{python3_sitearch}/samba/domain/__init__.py +%{python3_sitearch}/samba/domain/__pycache__/__init__.*.pyc +%{python3_sitearch}/samba/domain/models/__init__.py +%{python3_sitearch}/samba/domain/models/__pycache__/__init__.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/auth_policy.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/auth_silo.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/claim_type.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/computer.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/constants.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/container.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/exceptions.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/fields.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/gmsa.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/group.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/model.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/org.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/person.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/query.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/registry.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/schema.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/site.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/subnet.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/types.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/user.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/value_type.*.pyc +%{python3_sitearch}/samba/domain/models/auth_policy.py +%{python3_sitearch}/samba/domain/models/auth_silo.py +%{python3_sitearch}/samba/domain/models/claim_type.py +%{python3_sitearch}/samba/domain/models/computer.py +%{python3_sitearch}/samba/domain/models/constants.py +%{python3_sitearch}/samba/domain/models/container.py +%{python3_sitearch}/samba/domain/models/exceptions.py +%{python3_sitearch}/samba/domain/models/fields.py +%{python3_sitearch}/samba/domain/models/gmsa.py +%{python3_sitearch}/samba/domain/models/group.py +%{python3_sitearch}/samba/domain/models/model.py +%{python3_sitearch}/samba/domain/models/org.py +%{python3_sitearch}/samba/domain/models/person.py +%{python3_sitearch}/samba/domain/models/query.py +%{python3_sitearch}/samba/domain/models/registry.py +%{python3_sitearch}/samba/domain/models/schema.py +%{python3_sitearch}/samba/domain/models/site.py +%{python3_sitearch}/samba/domain/models/subnet.py +%{python3_sitearch}/samba/domain/models/types.py +%{python3_sitearch}/samba/domain/models/user.py +%{python3_sitearch}/samba/domain/models/value_type.py %{python3_sitearch}/samba/drs_utils.py %{python3_sitearch}/samba/dsdb.*.so %{python3_sitearch}/samba/dsdb_dns.*.so @@ -2581,6 +2694,7 @@ fi %{python3_sitearch}/samba/hostconfig.py %{python3_sitearch}/samba/idmap.py %{python3_sitearch}/samba/join.py +%{python3_sitearch}/samba/lsa_utils.py %{python3_sitearch}/samba/messaging.*.so %{python3_sitearch}/samba/ndr.py %{python3_sitearch}/samba/net.*.so @@ -2733,12 +2847,30 @@ fi %{python3_sitearch}/samba/netcmd/domain/auth/__init__.py %dir %{python3_sitearch}/samba/netcmd/domain/auth/__pycache__ %{python3_sitearch}/samba/netcmd/domain/auth/__pycache__/__init__.*.pyc -%{python3_sitearch}/samba/netcmd/domain/auth/__pycache__/policy.*.pyc -%{python3_sitearch}/samba/netcmd/domain/auth/__pycache__/silo.*.pyc -%{python3_sitearch}/samba/netcmd/domain/auth/__pycache__/silo_member.*.pyc -%{python3_sitearch}/samba/netcmd/domain/auth/policy.py -%{python3_sitearch}/samba/netcmd/domain/auth/silo.py -%{python3_sitearch}/samba/netcmd/domain/auth/silo_member.py +%dir %{python3_sitearch}/samba/netcmd/domain/auth/policy +%{python3_sitearch}/samba/netcmd/domain/auth/policy/computer_allowed_to_authenticate_to.py +%{python3_sitearch}/samba/netcmd/domain/auth/policy/__init__.py +%{python3_sitearch}/samba/netcmd/domain/auth/policy/policy.py +%dir %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__ +%{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/computer_allowed_to_authenticate_to.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/__init__.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/policy.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/service_allowed_to_authenticate_from.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/service_allowed_to_authenticate_to.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/user_allowed_to_authenticate_from.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/user_allowed_to_authenticate_to.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/policy/service_allowed_to_authenticate_from.py +%{python3_sitearch}/samba/netcmd/domain/auth/policy/service_allowed_to_authenticate_to.py +%{python3_sitearch}/samba/netcmd/domain/auth/policy/user_allowed_to_authenticate_from.py +%{python3_sitearch}/samba/netcmd/domain/auth/policy/user_allowed_to_authenticate_to.py +%dir %{python3_sitearch}/samba/netcmd/domain/auth/silo +%{python3_sitearch}/samba/netcmd/domain/auth/silo/__init__.py +%{python3_sitearch}/samba/netcmd/domain/auth/silo/member.py +%dir %{python3_sitearch}/samba/netcmd/domain/auth/silo/__pycache__ +%{python3_sitearch}/samba/netcmd/domain/auth/silo/__pycache__/__init__.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/silo/__pycache__/member.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/silo/__pycache__/silo.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/silo/silo.py %{python3_sitearch}/samba/netcmd/domain/backup.py %dir %{python3_sitearch}/samba/netcmd/domain/claim %{python3_sitearch}/samba/netcmd/domain/claim/__init__.py @@ -2755,39 +2887,15 @@ fi %{python3_sitearch}/samba/netcmd/domain/functional_prep.py %{python3_sitearch}/samba/netcmd/domain/info.py %{python3_sitearch}/samba/netcmd/domain/join.py +%dir %{python3_sitearch}/samba/netcmd/domain/kds +%{python3_sitearch}/samba/netcmd/domain/kds/__init__.py +%dir %{python3_sitearch}/samba/netcmd/domain/kds/__pycache__ +%{python3_sitearch}/samba/netcmd/domain/kds/__pycache__/__init__.*.pyc +%{python3_sitearch}/samba/netcmd/domain/kds/__pycache__/root_key.*.pyc +%{python3_sitearch}/samba/netcmd/domain/kds/root_key.py %{python3_sitearch}/samba/netcmd/domain/keytab.py %{python3_sitearch}/samba/netcmd/domain/leave.py %{python3_sitearch}/samba/netcmd/domain/level.py -%dir %{python3_sitearch}/samba/netcmd/domain/models -%{python3_sitearch}/samba/netcmd/domain/models/__init__.py -%dir %{python3_sitearch}/samba/netcmd/domain/models/__pycache__ -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/__init__.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/auth_policy.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/auth_silo.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/claim_type.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/exceptions.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/fields.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/group.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/model.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/query.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/schema.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/site.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/subnet.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/user.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/value_type.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/auth_policy.py -%{python3_sitearch}/samba/netcmd/domain/models/auth_silo.py -%{python3_sitearch}/samba/netcmd/domain/models/claim_type.py -%{python3_sitearch}/samba/netcmd/domain/models/exceptions.py -%{python3_sitearch}/samba/netcmd/domain/models/fields.py -%{python3_sitearch}/samba/netcmd/domain/models/group.py -%{python3_sitearch}/samba/netcmd/domain/models/model.py -%{python3_sitearch}/samba/netcmd/domain/models/query.py -%{python3_sitearch}/samba/netcmd/domain/models/schema.py -%{python3_sitearch}/samba/netcmd/domain/models/site.py -%{python3_sitearch}/samba/netcmd/domain/models/subnet.py -%{python3_sitearch}/samba/netcmd/domain/models/user.py -%{python3_sitearch}/samba/netcmd/domain/models/value_type.py %{python3_sitearch}/samba/netcmd/domain/passwordsettings.py %{python3_sitearch}/samba/netcmd/domain/provision.py %{python3_sitearch}/samba/netcmd/domain/samba3upgrade.py @@ -2812,6 +2920,13 @@ fi %{python3_sitearch}/samba/netcmd/pso.py %{python3_sitearch}/samba/netcmd/rodc.py %{python3_sitearch}/samba/netcmd/schema.py +%dir %{python3_sitearch}/samba/netcmd/service_account +%{python3_sitearch}/samba/netcmd/service_account/__init__.py +%{python3_sitearch}/samba/netcmd/service_account/__pycache__/__init__.*.pyc +%{python3_sitearch}/samba/netcmd/service_account/__pycache__/group_msa_membership.*.pyc +%{python3_sitearch}/samba/netcmd/service_account/__pycache__/service_account.*.pyc +%{python3_sitearch}/samba/netcmd/service_account/group_msa_membership.py +%{python3_sitearch}/samba/netcmd/service_account/service_account.py %{python3_sitearch}/samba/netcmd/shell.py %{python3_sitearch}/samba/netcmd/sites.py %{python3_sitearch}/samba/netcmd/spn.py @@ -2908,20 +3023,17 @@ fi %{python3_sitearch}/samba/subunit/__pycache__/run.*.pyc %{python3_sitearch}/samba/subunit/run.py %{python3_sitearch}/samba/tdb_util.py -%{python3_sitearch}/samba/trust_utils.py %{python3_sitearch}/samba/upgrade.py %{python3_sitearch}/samba/upgradehelpers.py %{python3_sitearch}/samba/werror.*.so %{python3_sitearch}/samba/xattr.py %{python3_sitearch}/samba/xattr_native.*.so %{python3_sitearch}/samba/xattr_tdb.*.so -%{_libdir}/libsamba-policy.cpython*.so.* -%{_libdir}/samba/libsamba-net.cpython*.so +%{_libdir}/samba/libsamba-net-join.cpython*.so %{_libdir}/samba/libsamba-python.cpython*.so %if %{with includelibs} %{_libdir}/samba/libpyldb-util.cpython*.so -%{_libdir}/samba/libpytalloc-util.cpython*.so %{python3_sitearch}/__pycache__/_ldb_text*.pyc %{python3_sitearch}/__pycache__/_tdb_text*.pyc @@ -2930,16 +3042,13 @@ fi %{python3_sitearch}/_tdb_text.py %{python3_sitearch}/_tevent.cpython*.so %{python3_sitearch}/ldb.cpython*.so -%{python3_sitearch}/talloc.cpython*.so +#FIXME why is it missing? +#%{python3_sitearch}/talloc.cpython*.so %{python3_sitearch}/tdb.cpython*.so %{python3_sitearch}/tevent.py #endif with includelibs %endif -%files -n python3-%{name}-devel -%{_libdir}/libsamba-policy.*.so -%{_libdir}/pkgconfig/samba-policy.*.pc - %files -n python3-%{name}-dc %{python3_sitearch}/samba/samdb.py %{python3_sitearch}/samba/schema.py @@ -3038,6 +3147,8 @@ fi %{python3_sitearch}/samba/tests/__pycache__/dsdb_api.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dsdb_dns.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dsdb_lock.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/dsdb_quiet_env_tests.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/dsdb_quiet_provision_tests.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dsdb_schema_attributes.*.pyc %{python3_sitearch}/samba/tests/__pycache__/docs.*.pyc %{python3_sitearch}/samba/tests/__pycache__/domain_backup.*.pyc @@ -3156,6 +3267,7 @@ fi %{python3_sitearch}/samba/tests/blackbox/__pycache__/check_output.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/claims.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/downgradedatabase.*.pyc +%{python3_sitearch}/samba/tests/blackbox/__pycache__/gmsa.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/http_chunk.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/http_content.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/mdsearch.*.pyc @@ -3179,6 +3291,7 @@ fi %{python3_sitearch}/samba/tests/blackbox/check_output.py %{python3_sitearch}/samba/tests/blackbox/claims.py %{python3_sitearch}/samba/tests/blackbox/downgradedatabase.py +%{python3_sitearch}/samba/tests/blackbox/gmsa.py %{python3_sitearch}/samba/tests/blackbox/http_chunk.py %{python3_sitearch}/samba/tests/blackbox/http_content.py %{python3_sitearch}/samba/tests/blackbox/mdsearch.py @@ -3213,11 +3326,11 @@ fi %{python3_sitearch}/samba/tests/dcerpc/__pycache__/__init__.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/array.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/bare.*.pyc -%{python3_sitearch}/samba/tests/dcerpc/__pycache__/createtrustrelax.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/binding.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/dnsserver.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/integer.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/lsa.*.pyc +%{python3_sitearch}/samba/tests/dcerpc/__pycache__/lsa_utils.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/mdssvc.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/misc.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/raw_protocol.*.pyc @@ -3234,10 +3347,10 @@ fi %{python3_sitearch}/samba/tests/dcerpc/array.py %{python3_sitearch}/samba/tests/dcerpc/bare.py %{python3_sitearch}/samba/tests/dcerpc/binding.py -%{python3_sitearch}/samba/tests/dcerpc/createtrustrelax.py %{python3_sitearch}/samba/tests/dcerpc/dnsserver.py %{python3_sitearch}/samba/tests/dcerpc/integer.py %{python3_sitearch}/samba/tests/dcerpc/lsa.py +%{python3_sitearch}/samba/tests/dcerpc/lsa_utils.py %{python3_sitearch}/samba/tests/dcerpc/mdssvc.py %{python3_sitearch}/samba/tests/dcerpc/misc.py %{python3_sitearch}/samba/tests/dcerpc/raw_protocol.py @@ -3268,6 +3381,8 @@ fi %{python3_sitearch}/samba/tests/dsdb_dns.py %{python3_sitearch}/samba/tests/dsdb_lock.py %{python3_sitearch}/samba/tests/dsdb_schema_attributes.py +%{python3_sitearch}/samba/tests/dsdb_quiet_env_tests.py +%{python3_sitearch}/samba/tests/dsdb_quiet_provision_tests.py %{python3_sitearch}/samba/tests/docs.py %{python3_sitearch}/samba/tests/domain_backup.py %{python3_sitearch}/samba/tests/domain_backup_offline.py @@ -3318,6 +3433,7 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/etype_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/fast_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/gkdi_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/gmsa_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/group_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kcrypto.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_base_test.*.pyc @@ -3359,6 +3475,7 @@ fi %{python3_sitearch}/samba/tests/krb5/etype_tests.py %{python3_sitearch}/samba/tests/krb5/fast_tests.py %{python3_sitearch}/samba/tests/krb5/gkdi_tests.py +%{python3_sitearch}/samba/tests/krb5/gmsa_tests.py %{python3_sitearch}/samba/tests/krb5/group_tests.py %{python3_sitearch}/samba/tests/krb5/kcrypto.py %{python3_sitearch}/samba/tests/krb5/kdc_base_test.py @@ -3462,6 +3579,7 @@ fi %{python3_sitearch}/samba/tests/samba_tool/__pycache__/domain_auth_policy.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/domain_auth_silo.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/domain_claim.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/domain_kds_root_key.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/domain_models.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/drs_clone_dc_data_lmdb_size.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/dsacl.*.pyc @@ -3484,6 +3602,7 @@ fi %{python3_sitearch}/samba/tests/samba_tool/__pycache__/provision_userPassword_crypt.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/rodc.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/schema.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/service_account.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/silo_base.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/sites.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/timecmd.*.pyc @@ -3508,6 +3627,7 @@ fi %{python3_sitearch}/samba/tests/samba_tool/domain_auth_policy.py %{python3_sitearch}/samba/tests/samba_tool/domain_auth_silo.py %{python3_sitearch}/samba/tests/samba_tool/domain_claim.py +%{python3_sitearch}/samba/tests/samba_tool/domain_kds_root_key.py %{python3_sitearch}/samba/tests/samba_tool/domain_models.py %{python3_sitearch}/samba/tests/samba_tool/drs_clone_dc_data_lmdb_size.py %{python3_sitearch}/samba/tests/samba_tool/dsacl.py @@ -3530,6 +3650,7 @@ fi %{python3_sitearch}/samba/tests/samba_tool/provision_userPassword_crypt.py %{python3_sitearch}/samba/tests/samba_tool/rodc.py %{python3_sitearch}/samba/tests/samba_tool/schema.py +%{python3_sitearch}/samba/tests/samba_tool/service_account.py %{python3_sitearch}/samba/tests/samba_tool/silo_base.py %{python3_sitearch}/samba/tests/samba_tool/sites.py %{python3_sitearch}/samba/tests/samba_tool/timecmd.py @@ -3667,7 +3788,6 @@ fi %{_sysconfdir}/ctdb/functions %{_sysconfdir}/ctdb/nfs-linux-kernel-callout %{_sysconfdir}/ctdb/statd-callout -%config %{_sysconfdir}/sudoers.d/ctdb # CTDB scripts, no config files # script with executable bit means activated @@ -3707,6 +3827,8 @@ fi %{_libexecdir}/ctdb/ctdb_recovery_helper %{_libexecdir}/ctdb/ctdb_takeover_helper %{_libexecdir}/ctdb/smnotify +%{_libexecdir}/ctdb/statd_callout +%{_libexecdir}/ctdb/statd_callout_helper %{_libexecdir}/ctdb/tdb_mutex_check %dir %{_localstatedir}/lib/ctdb/ @@ -3737,7 +3859,6 @@ fi %{_datadir}/ctdb/events/legacy/00.ctdb.script %{_datadir}/ctdb/events/legacy/01.reclock.script %{_datadir}/ctdb/events/legacy/05.system.script -%{_datadir}/ctdb/events/legacy/06.nfs.script %{_datadir}/ctdb/events/legacy/10.interface.script %{_datadir}/ctdb/events/legacy/11.natgw.script %{_datadir}/ctdb/events/legacy/11.routing.script @@ -3746,6 +3867,7 @@ fi %{_datadir}/ctdb/events/legacy/31.clamd.script %{_datadir}/ctdb/events/legacy/40.vsftpd.script %{_datadir}/ctdb/events/legacy/41.httpd.script +%{_datadir}/ctdb/events/legacy/46.update-keytabs.script %{_datadir}/ctdb/events/legacy/47.samba-dcerpcd.script %{_datadir}/ctdb/events/legacy/48.netbios.script %{_datadir}/ctdb/events/legacy/49.winbind.script @@ -3753,6 +3875,8 @@ fi %{_datadir}/ctdb/events/legacy/60.nfs.script %{_datadir}/ctdb/events/legacy/70.iscsi.script %{_datadir}/ctdb/events/legacy/91.lvs.script +%dir %{_datadir}/ctdb/scripts +%{_datadir}/ctdb/scripts/winbind_ctdb_updatekeytab.sh %if %{with testsuite} %files -n ctdb-tests @@ -4605,5 +4729,63 @@ fi %{_mandir}/man1/winexe.1.gz %endif +%files -n libldb +%{_libdir}/libldb.so.* +%dir %{_libdir}/samba +%{_libdir}/samba/libldb-key-value-private-samba.so +%{_libdir}/samba/libldb-tdb-err-map-private-samba.so +%{_libdir}/samba/libldb-tdb-int-private-samba.so +%if %{with lmdb} +%{_libdir}/samba/libldb-mdb-int-private-samba.so +%endif + +%dir %{_libdir}/samba/ldb +%{_libdir}/samba/ldb/asq.so +%{_libdir}/samba/ldb/ldb.so +%{_libdir}/samba/ldb/mdb.so +%{_libdir}/samba/ldb/paged_searches.so +%{_libdir}/samba/ldb/rdn_name.so +%{_libdir}/samba/ldb/sample.so +%{_libdir}/samba/ldb/server_sort.so +%{_libdir}/samba/ldb/skel.so +%{_libdir}/samba/ldb/tdb.so + +%files -n libldb-devel +%{_includedir}/samba-4.0/ldb_module.h +%{_includedir}/samba-4.0/ldb_handlers.h +%{_includedir}/samba-4.0/ldb_errors.h +%{_includedir}/samba-4.0/ldb_version.h +%{_includedir}/samba-4.0/ldb.h +%{_libdir}/libldb.so + +%{_libdir}/pkgconfig/ldb.pc +%{_mandir}/man3/ldb*.gz +%{_mandir}/man3/ldif*.gz + +%files -n ldb-tools +%{_bindir}/ldbadd +%{_bindir}/ldbdel +%{_bindir}/ldbedit +%{_bindir}/ldbmodify +%{_bindir}/ldbrename +%{_bindir}/ldbsearch +%{_libdir}/samba/libldb-cmdline-private-samba.so +%{_mandir}/man1/ldbadd.1.* +%{_mandir}/man1/ldbdel.1.* +%{_mandir}/man1/ldbedit.1.* +%{_mandir}/man1/ldbmodify.1.* +%{_mandir}/man1/ldbrename.1.* +%{_mandir}/man1/ldbsearch.1.* + +%files -n python-ldb-devel-common +#{_includedir}/pyldb.h +%{_mandir}/man*/Py*.gz + +%files -n python3-ldb +%{python3_sitearch}/ldb.cpython-*.so +%{_libdir}/samba/libpyldb-util.cpython-*-private-samba.so +%{python3_sitearch}/_ldb_text.py +%{python3_sitearch}/__pycache__/_ldb_text.cpython-*.py* + %changelog %autochangelog diff --git a/sources b/sources index fa51daa..153969e 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.20.4.tar.xz) = 390805d006c380e83f0a0f6f0c00cd6605c32c937f4cf11e7ac5b177abd4538b0be40c505d72c500855f28a625f60aaa007c4466c316c3f93bfb5baa583f384f -SHA512 (samba-4.20.4.tar.asc) = ff8369bf307e56fe842a101b05dcbf382779a3812763e67b573449412195777fce25864ca4e0d89c126bc46cf3a2d359c5d5bda68b60af8849cd91f9d418ee98 +SHA512 (samba-4.21.0rc2.tar.xz) = c561a1cff99fd23baa738ce304efacfab1f7033880c6b5da6c6d2fc821a751be4f3a11b6e98700192490df17a87b9d9ba24e1ce7ed17bf6710a80d3a24ee3639 +SHA512 (samba-4.21.0rc2.tar.asc) = 415abad180a9771765a3f17978b9aa8008088ef60aee4fa98a278a8d21fa8fc2cdde4d8b8b6b23ff7476d63f642ba2a0d028e63d12f8d27eddd66030dc1068b2 diff --git a/sync_machine_password_script_install.patch b/sync_machine_password_script_install.patch new file mode 100644 index 0000000..ea70c82 --- /dev/null +++ b/sync_machine_password_script_install.patch @@ -0,0 +1,91 @@ +From 7fedd0925965705e435a4bd411fdbd0e73d8b6a6 Mon Sep 17 00:00:00 2001 +From: Anoop C S +Date: Wed, 14 Aug 2024 19:47:35 +0530 +Subject: [PATCH 1/2] source3/script: Fix installation of + winbind_ctdb_updatekeytab.sh + +winbind_ctdb_updatekeytab.sh assumes the presence `onnode` utility to +execute `net ads` command on all nodes in the cluster. But `onnode` +is only built when configured with clustering support. Therefore perform +the script installation only with ctdb configuration. Also fix the +installation path to /usr/share/ctdb/scripts. + +Signed-off-by: Anoop C S +Reviewed-by: Guenther Deschner +--- + source3/script/wscript_build | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/source3/script/wscript_build b/source3/script/wscript_build +index 2b0643b0876..a634ece7ec1 100644 +--- a/source3/script/wscript_build ++++ b/source3/script/wscript_build +@@ -6,7 +6,8 @@ bld.INSTALL_FILES('${BINDIR}', + 'smbtar', + chmod=MODE_755, flat=True) + bld.INSTALL_FILES('${BINDIR}', 'samba-log-parser', chmod=MODE_755, flat=True) +-bld.INSTALL_FILES('${DATADIR}', 'winbind_ctdb_updatekeytab.sh', chmod=MODE_755, flat=True) ++if conf.env.with_ctdb: ++ bld.INSTALL_FILES(bld.env.CTDB_DATADIR+"/scripts", 'winbind_ctdb_updatekeytab.sh', chmod=MODE_755, flat=True) + + # Callout scripts for use in selftest environment + bld.SAMBA_SCRIPT('smbaddshare', pattern='smbaddshare', installdir='.') +-- +2.46.0 + + +From 24d5b7d711566297ce5db92ebc2f56ec100b1dca Mon Sep 17 00:00:00 2001 +From: Anoop C S +Date: Wed, 14 Aug 2024 19:49:04 +0530 +Subject: [PATCH 2/2] docs-xml: Fix script location in + syncmachinepasswordscript.xml + +Update the change in installation path for winbind_ctdb_updatekeytab.sh +from SAMBA_DATADIR to newly defined CTDB_DATADIR. + +Signed-off-by: Anoop C S +Reviewed-by: Guenther Deschner +--- + docs-xml/smbdotconf/security/syncmachinepasswordscript.xml | 4 ++-- + dynconfig/wscript | 5 +++++ + 2 files changed, 7 insertions(+), 2 deletions(-) + +diff --git a/docs-xml/smbdotconf/security/syncmachinepasswordscript.xml b/docs-xml/smbdotconf/security/syncmachinepasswordscript.xml +index 9a7731930d5..df98610cf36 100644 +--- a/docs-xml/smbdotconf/security/syncmachinepasswordscript.xml ++++ b/docs-xml/smbdotconf/security/syncmachinepasswordscript.xml +@@ -11,7 +11,7 @@ + + + If keytabs should be generated in clustered environments it is recommended to update them on all nodes. +- You can set the config option to &pathconfig.SAMBA_DATADIR;/scripts/winbind_ctdb_updatekeytab.sh in clustering case. ++ You can set the config option to &pathconfig.CTDB_DATADIR;/scripts/winbind_ctdb_updatekeytab.sh in clustering case. + It is also needed to activate the 46.update-keytabs.script in ctdb, + it re-creates the keytab during the ctdb recovered event: + +@@ -22,5 +22,5 @@ + + + +-&pathconfig.SAMBA_DATADIR;/scripts/winbind_ctdb_updatekeytab.sh ++&pathconfig.CTDB_DATADIR;/scripts/winbind_ctdb_updatekeytab.sh + +diff --git a/dynconfig/wscript b/dynconfig/wscript +index 2041d881546..a784dac4e6c 100644 +--- a/dynconfig/wscript ++++ b/dynconfig/wscript +@@ -105,6 +105,11 @@ dynconfig = { + 'FHS-PATH': '${DATADIR}', + 'OVERWRITE': True, + }, ++ 'CTDB_DATADIR' : { ++ 'STD-PATH': '${DATADIR}/ctdb', ++ 'FHS-PATH': '${DATADIR}/ctdb', ++ 'OVERWRITE': True, ++ }, + 'SAMBA_DATADIR' : { + 'STD-PATH': '${DATADIR}/samba', + 'FHS-PATH': '${DATADIR}/samba', +-- +2.46.0 + From 07d157869de2d834bf3d04b1489716649a3922ee Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 21 Aug 2024 07:49:11 +0200 Subject: [PATCH 02/42] Remove also python-ldb-devel-common - related: rhbz#230046 This was only used internally. --- samba.spec | 25 +++++-------------------- 1 file changed, 5 insertions(+), 20 deletions(-) diff --git a/samba.spec b/samba.spec index 22d0376..79d5769 100644 --- a/samba.spec +++ b/samba.spec @@ -1254,21 +1254,6 @@ Provides: ldb-tools = %{samba_depver} %description -n ldb-tools Tools to manage LDB files -### PYTHON3-LDB-DEVEL-COMMON -%package -n python-ldb-devel-common -Summary: Common development files for the Python bindings for the LDB library -License: LGPL-3.0-or-later - -Provides: pyldb-devel%{?_isa} = %{version}-%{release} -%{?python_provide:%python_provide python2-ldb-devel} - -Obsoletes: python-ldb-devel-common < 2.10 -Provides: python-ldb-devel-common = %{samba_depver} - -%description -n python-ldb-devel-common -Development files for the Python bindings for the LDB library. -This package includes files that aren't specific to a Python version. - ### PYTHON3-LDB %package -n python3-ldb Summary: Python bindings for the LDB library @@ -1280,6 +1265,8 @@ Requires: python3-tdb%{?_isa} >= %{tdb_version} Obsoletes: python3-ldb < 2.10 Provides: python3-ldb = %{samba_depver} # These were the C bindings, only used by Samba +Obsoletes: python-ldb-devel-common < 2.10 +Provides: python-ldb-devel-common = %{samba_depver} Obsoletes: python3-ldb-devel < 2.10 Provides: python3-ldb-devel = %{samba_depver} @@ -1560,9 +1547,11 @@ rm -f %{buildroot}%{perl_archlib}/vendor_perl/auto/Parse/Pidl/.packlist rm -rf %{buildroot}%{perl_vendorlib}/Parse/Yapp popd -# libldb manpages +# Install libldb manpages cp -a lib/ldb/apidocs/man/* %{buildroot}%{_mandir} +# Remove manpages we don't want rm -f %{buildroot}%{_mandir}/man3/_* +rm -f %{buildroot}%{_mandir}/man*/Py*.gz %if %{with testsuite} %check @@ -4777,10 +4766,6 @@ fi %{_mandir}/man1/ldbrename.1.* %{_mandir}/man1/ldbsearch.1.* -%files -n python-ldb-devel-common -#{_includedir}/pyldb.h -%{_mandir}/man*/Py*.gz - %files -n python3-ldb %{python3_sitearch}/ldb.cpython-*.so %{_libdir}/samba/libpyldb-util.cpython-*-private-samba.so From 8fa746391de4eb444e55e9704413b1c2ac447e84 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 21 Aug 2024 08:02:37 +0200 Subject: [PATCH 03/42] Update to version 4.21.0rc3 - related: rhbz#230046 --- samba.spec | 6 +- sources | 4 +- sync_machine_password_script_install.patch | 91 ---------------------- 3 files changed, 5 insertions(+), 96 deletions(-) delete mode 100644 sync_machine_password_script_install.patch diff --git a/samba.spec b/samba.spec index 79d5769..3465b9e 100644 --- a/samba.spec +++ b/samba.spec @@ -167,7 +167,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc2 +%global pre_release rc3 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif @@ -254,8 +254,6 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore -Patch0: sync_machine_password_script_install.patch - Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} @@ -4731,7 +4729,9 @@ fi %dir %{_libdir}/samba/ldb %{_libdir}/samba/ldb/asq.so %{_libdir}/samba/ldb/ldb.so +%if %{with lmdb} %{_libdir}/samba/ldb/mdb.so +%endif %{_libdir}/samba/ldb/paged_searches.so %{_libdir}/samba/ldb/rdn_name.so %{_libdir}/samba/ldb/sample.so diff --git a/sources b/sources index 153969e..f42760a 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.21.0rc2.tar.xz) = c561a1cff99fd23baa738ce304efacfab1f7033880c6b5da6c6d2fc821a751be4f3a11b6e98700192490df17a87b9d9ba24e1ce7ed17bf6710a80d3a24ee3639 -SHA512 (samba-4.21.0rc2.tar.asc) = 415abad180a9771765a3f17978b9aa8008088ef60aee4fa98a278a8d21fa8fc2cdde4d8b8b6b23ff7476d63f642ba2a0d028e63d12f8d27eddd66030dc1068b2 +SHA512 (samba-4.21.0rc3.tar.xz) = 8f4bd550e922beb4af4ddbc1a3e96169c35a348ccaa6bd5de51cc0ce9545952c5262ecbd0e3e9e37576a8346b1e0c5ab27baccf6d015208a8ed2629df64e553b +SHA512 (samba-4.21.0rc3.tar.asc) = a2cdd7d9e53f58ecd32df0d41a928a103fdf78a3885a5d74cf48b7a6e40eed263853f0fa8161f4524844391ef443736659a6c6419aad41345cdc59192db704d3 diff --git a/sync_machine_password_script_install.patch b/sync_machine_password_script_install.patch deleted file mode 100644 index ea70c82..0000000 --- a/sync_machine_password_script_install.patch +++ /dev/null @@ -1,91 +0,0 @@ -From 7fedd0925965705e435a4bd411fdbd0e73d8b6a6 Mon Sep 17 00:00:00 2001 -From: Anoop C S -Date: Wed, 14 Aug 2024 19:47:35 +0530 -Subject: [PATCH 1/2] source3/script: Fix installation of - winbind_ctdb_updatekeytab.sh - -winbind_ctdb_updatekeytab.sh assumes the presence `onnode` utility to -execute `net ads` command on all nodes in the cluster. But `onnode` -is only built when configured with clustering support. Therefore perform -the script installation only with ctdb configuration. Also fix the -installation path to /usr/share/ctdb/scripts. - -Signed-off-by: Anoop C S -Reviewed-by: Guenther Deschner ---- - source3/script/wscript_build | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/source3/script/wscript_build b/source3/script/wscript_build -index 2b0643b0876..a634ece7ec1 100644 ---- a/source3/script/wscript_build -+++ b/source3/script/wscript_build -@@ -6,7 +6,8 @@ bld.INSTALL_FILES('${BINDIR}', - 'smbtar', - chmod=MODE_755, flat=True) - bld.INSTALL_FILES('${BINDIR}', 'samba-log-parser', chmod=MODE_755, flat=True) --bld.INSTALL_FILES('${DATADIR}', 'winbind_ctdb_updatekeytab.sh', chmod=MODE_755, flat=True) -+if conf.env.with_ctdb: -+ bld.INSTALL_FILES(bld.env.CTDB_DATADIR+"/scripts", 'winbind_ctdb_updatekeytab.sh', chmod=MODE_755, flat=True) - - # Callout scripts for use in selftest environment - bld.SAMBA_SCRIPT('smbaddshare', pattern='smbaddshare', installdir='.') --- -2.46.0 - - -From 24d5b7d711566297ce5db92ebc2f56ec100b1dca Mon Sep 17 00:00:00 2001 -From: Anoop C S -Date: Wed, 14 Aug 2024 19:49:04 +0530 -Subject: [PATCH 2/2] docs-xml: Fix script location in - syncmachinepasswordscript.xml - -Update the change in installation path for winbind_ctdb_updatekeytab.sh -from SAMBA_DATADIR to newly defined CTDB_DATADIR. - -Signed-off-by: Anoop C S -Reviewed-by: Guenther Deschner ---- - docs-xml/smbdotconf/security/syncmachinepasswordscript.xml | 4 ++-- - dynconfig/wscript | 5 +++++ - 2 files changed, 7 insertions(+), 2 deletions(-) - -diff --git a/docs-xml/smbdotconf/security/syncmachinepasswordscript.xml b/docs-xml/smbdotconf/security/syncmachinepasswordscript.xml -index 9a7731930d5..df98610cf36 100644 ---- a/docs-xml/smbdotconf/security/syncmachinepasswordscript.xml -+++ b/docs-xml/smbdotconf/security/syncmachinepasswordscript.xml -@@ -11,7 +11,7 @@ - - - If keytabs should be generated in clustered environments it is recommended to update them on all nodes. -- You can set the config option to &pathconfig.SAMBA_DATADIR;/scripts/winbind_ctdb_updatekeytab.sh in clustering case. -+ You can set the config option to &pathconfig.CTDB_DATADIR;/scripts/winbind_ctdb_updatekeytab.sh in clustering case. - It is also needed to activate the 46.update-keytabs.script in ctdb, - it re-creates the keytab during the ctdb recovered event: - -@@ -22,5 +22,5 @@ - - - --&pathconfig.SAMBA_DATADIR;/scripts/winbind_ctdb_updatekeytab.sh -+&pathconfig.CTDB_DATADIR;/scripts/winbind_ctdb_updatekeytab.sh - -diff --git a/dynconfig/wscript b/dynconfig/wscript -index 2041d881546..a784dac4e6c 100644 ---- a/dynconfig/wscript -+++ b/dynconfig/wscript -@@ -105,6 +105,11 @@ dynconfig = { - 'FHS-PATH': '${DATADIR}', - 'OVERWRITE': True, - }, -+ 'CTDB_DATADIR' : { -+ 'STD-PATH': '${DATADIR}/ctdb', -+ 'FHS-PATH': '${DATADIR}/ctdb', -+ 'OVERWRITE': True, -+ }, - 'SAMBA_DATADIR' : { - 'STD-PATH': '${DATADIR}/samba', - 'FHS-PATH': '${DATADIR}/samba', --- -2.46.0 - From 0cece7c791120bfad56760993e56fb216cc07373 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 21 Aug 2024 09:29:46 +0200 Subject: [PATCH 04/42] Fix manpages for libldb related: rhbz#230046 --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 3465b9e..792808a 100644 --- a/samba.spec +++ b/samba.spec @@ -1549,7 +1549,7 @@ popd cp -a lib/ldb/apidocs/man/* %{buildroot}%{_mandir} # Remove manpages we don't want rm -f %{buildroot}%{_mandir}/man3/_* -rm -f %{buildroot}%{_mandir}/man*/Py*.gz +rm -f %{buildroot}%{_mandir}/man3/PyLdb* %if %{with testsuite} %check From 1d7601d5efebdec8b7e0589c8cde90ee4154a5b0 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 21 Aug 2024 14:55:13 +0200 Subject: [PATCH 05/42] Fix ldb requires and provides - related: rhbz#230046 --- samba.spec | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 792808a..2c36f16 100644 --- a/samba.spec +++ b/samba.spec @@ -1220,6 +1220,7 @@ Requires: libtevent%{?_isa} >= %{tevent_version} Provides: bundled(libreplace) Obsoletes: libldb < 2.10 +Provides: libldb = 2.10 Provides: libldb = %{samba_depver} %description -n libldb @@ -1230,12 +1231,13 @@ servers, or use local tdb databases. %package -n libldb-devel Summary: Developer tools for the LDB library License: LGPL-3.0-or-later -Requires: libldb%{?_isa} = %{version}-%{release} +Requires: libldb%{?_isa} = %{samba_depver} Requires: libtdb-devel%{?_isa} >= %{tdb_version} Requires: libtalloc-devel%{?_isa} >= %{talloc_version} Requires: libtevent-devel%{?_isa} >= %{tevent_version} Obsoletes: libldb-devel < 2.10 +Provides: libldb-devel = 2.10 Provides: libldb-devel = %{samba_depver} %description -n libldb-devel @@ -1245,7 +1247,7 @@ Header files needed to develop programs that link against the LDB library. %package -n ldb-tools Summary: Tools to manage LDB files License: LGPL-3.0-or-later -Requires: libldb%{?_isa} = %{samba_release} +Requires: libldb%{?_isa} = %{samba_depver} Obsoletes: ldb-tools < 2.10 Provides: ldb-tools = %{samba_depver} @@ -1256,7 +1258,7 @@ Tools to manage LDB files %package -n python3-ldb Summary: Python bindings for the LDB library License: LGPL-3.0-or-later -Requires: libldb%{?_isa} = %{version}-%{release} +Requires: libldb%{?_isa} = %{samba_depver} Requires: python3-tdb%{?_isa} >= %{tdb_version} %{?python_provide:%python_provide python3-ldb} @@ -1264,8 +1266,10 @@ Obsoletes: python3-ldb < 2.10 Provides: python3-ldb = %{samba_depver} # These were the C bindings, only used by Samba Obsoletes: python-ldb-devel-common < 2.10 +Provides: python-ldb-devel-common = 2.10 Provides: python-ldb-devel-common = %{samba_depver} Obsoletes: python3-ldb-devel < 2.10 +Provides: python3-ldb-devel = 2.10 Provides: python3-ldb-devel = %{samba_depver} %description -n python3-ldb From e6726d0366b1960c86f0ef83ea449f59a27e02e9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 28 Aug 2024 13:54:34 +0200 Subject: [PATCH 06/42] Update to version 4.21.0rc4 - resolves: rhbz#2300469 --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 2c36f16..9c94887 100644 --- a/samba.spec +++ b/samba.spec @@ -167,7 +167,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc3 +%global pre_release rc4 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif diff --git a/sources b/sources index f42760a..f6fbb9e 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.21.0rc3.tar.xz) = 8f4bd550e922beb4af4ddbc1a3e96169c35a348ccaa6bd5de51cc0ce9545952c5262ecbd0e3e9e37576a8346b1e0c5ab27baccf6d015208a8ed2629df64e553b -SHA512 (samba-4.21.0rc3.tar.asc) = a2cdd7d9e53f58ecd32df0d41a928a103fdf78a3885a5d74cf48b7a6e40eed263853f0fa8161f4524844391ef443736659a6c6419aad41345cdc59192db704d3 +SHA512 (samba-4.21.0rc4.tar.xz) = bbf3e6506b15d7a386292e84c189a8dd2136cb016df9bdb07066359b4bbce5da7e1c7f889a2de223ed83bbd8760a0e5232f5986bfd1c368b1beead4ed25c1076 +SHA512 (samba-4.21.0rc4.tar.asc) = 8a646d3e4b79886e723ad0558f0412e5033d8481ae0d9e04606204ce6af47e2eee2028a32ecd342572ee882aae798a702675d7e4e0593c83dda69edd23b30850 From cec5dad12bdba80cd2b8b4c2c3651aebd9528ba3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 2 Sep 2024 15:25:28 +0200 Subject: [PATCH 07/42] Update to version 4.21.0 - resolves: rhbz#2309153 --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 9c94887..554fa54 100644 --- a/samba.spec +++ b/samba.spec @@ -167,7 +167,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc4 +%global pre_release %nil %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif diff --git a/sources b/sources index f6fbb9e..3e8e284 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.21.0rc4.tar.xz) = bbf3e6506b15d7a386292e84c189a8dd2136cb016df9bdb07066359b4bbce5da7e1c7f889a2de223ed83bbd8760a0e5232f5986bfd1c368b1beead4ed25c1076 -SHA512 (samba-4.21.0rc4.tar.asc) = 8a646d3e4b79886e723ad0558f0412e5033d8481ae0d9e04606204ce6af47e2eee2028a32ecd342572ee882aae798a702675d7e4e0593c83dda69edd23b30850 +SHA512 (samba-4.21.0.tar.xz) = d05c823afc04669766130745c139e7d129eb9961525453d6da8b5ee6693d4c08192496d07e5c211e86d553956504fb9df16611cc9268111b71b95c7f2fa868a0 +SHA512 (samba-4.21.0.tar.asc) = 7fffbd0b88b42dd7f340e4bcae17da4a68a0f8de86a1e71534a4a02a477a746e4cdb16df7c0da33aaf13278cefb452bd9b7c61ed029e248576f7158e8bec339e From 8289664e44c45919bb740ba6ffcf62861ddeafcc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 3 Sep 2024 00:19:59 +0200 Subject: [PATCH 08/42] Update required tdb version - related: rhbz#2309153 --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 554fa54..2a18182 100644 --- a/samba.spec +++ b/samba.spec @@ -198,7 +198,7 @@ %global libwbclient_so_version 0 %global talloc_version 2.4.2 -%global tdb_version 1.4.11 +%global tdb_version 1.4.12 %global tevent_version 0.16.1 %global required_mit_krb5 1.20.1 From 01a405d43814d78a5b040e016b14dd16cfa131d3 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Fri, 13 Sep 2024 16:28:34 +0300 Subject: [PATCH 09/42] Fix Samba integration with FreeIPA - resolves: rhbz#2309199 Signed-off-by: Alexander Bokovoy --- samba-4.21.0-backport-freeipa-support.patch | 132 ++++++++++++++++++++ samba.spec | 2 + 2 files changed, 134 insertions(+) create mode 100644 samba-4.21.0-backport-freeipa-support.patch diff --git a/samba-4.21.0-backport-freeipa-support.patch b/samba-4.21.0-backport-freeipa-support.patch new file mode 100644 index 0000000..d1c5776 --- /dev/null +++ b/samba-4.21.0-backport-freeipa-support.patch @@ -0,0 +1,132 @@ +From 26797d7bd2662718b3eb795f1b8e6100d51e3ab7 Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Tue, 3 Sep 2024 08:48:24 +0300 +Subject: [PATCH] sync machine password to keytab: handle FreeIPA use case +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +FreeIPA uses own procedure to retrieve keytabs and during the setup of +Samba on FreeIPA client the keytab is already present, only machine +account needs to be set in the secrets database. + +'sync machine password to keytab' option handling broke this use case by +always attempting to contact a domain controller and failing to do so +(Fedora bug https://bugzilla.redhat.com/show_bug.cgi?id=2309199). + +The original synchronizing machine account password to keytab feature +did not have a mechanism to disable its logic at all. + +Signed-off-by: Alexander Bokovoy +Reviewed-by: Pavel Filipenský + +Autobuild-User(master): Alexander Bokovoy +Autobuild-Date(master): Fri Sep 13 13:16:09 UTC 2024 on atb-devel-224 + +(cherry picked from commit 4f577c7b6894132be4842944f2f950b087312b16) +--- + .../security/syncmachinepasswordtokeytab.xml | 29 +++++++++++++++++-- + source3/libads/kerberos_keytab.c | 5 ++++ + source3/utils/net.c | 8 +++++ + source3/utils/testparm.c | 3 +- + 4 files changed, 41 insertions(+), 4 deletions(-) + +diff --git a/docs-xml/smbdotconf/security/syncmachinepasswordtokeytab.xml b/docs-xml/smbdotconf/security/syncmachinepasswordtokeytab.xml +index 4cad9da73f2..f7dc30023d4 100644 +--- a/docs-xml/smbdotconf/security/syncmachinepasswordtokeytab.xml ++++ b/docs-xml/smbdotconf/security/syncmachinepasswordtokeytab.xml +@@ -18,7 +18,11 @@ or by winbindd doing regular updates (see ++If no value is present and is different from ++'secrets only', the behavior differs between winbind and net utility: ++ ++ ++ ++ winbind uses value ++ /path/to/keytab:sync_spns:sync_kvno:machine_password ++ where the path to the keytab is obtained either from the krb5 library or from ++ . ++ ++ ++ ++ net changesecretpw -f command uses the default 'disabled' value. ++ ++ No other net subcommands use the 'disabled' value. ++ ++ ++ ++If a single value 'disabled' is present, the synchronization process is ++disabled. This is required for FreeIPA domain member setup where keytab ++synchronization uses a protocol not implemented by Samba. + + + +diff --git a/source3/libads/kerberos_keytab.c b/source3/libads/kerberos_keytab.c +index 6ede567b75f..dbf8af44c1f 100644 +--- a/source3/libads/kerberos_keytab.c ++++ b/source3/libads/kerberos_keytab.c +@@ -904,6 +904,11 @@ NTSTATUS sync_pw2keytabs(void) + goto params_ready; + } + ++ if ((*lp_ptr != NULL) && strequal_m(*lp_ptr, "disabled")) { ++ DBG_DEBUG("'sync machine password to keytab' is explicitly disabled.\n"); ++ return NT_STATUS_OK; ++ } ++ + line = lp_ptr; + while (*line) { + DBG_DEBUG("Scanning line: %s\n", *line); +diff --git a/source3/utils/net.c b/source3/utils/net.c +index 7b40d2bee95..c432ebe991f 100644 +--- a/source3/utils/net.c ++++ b/source3/utils/net.c +@@ -207,6 +207,14 @@ static int net_changesecretpw(struct net_context *c, int argc, + struct timeval tv = timeval_current(); + NTTIME now = timeval_to_nttime(&tv); + ++#ifdef HAVE_ADS ++ if (USE_KERBEROS_KEYTAB) { ++ if (lp_sync_machine_password_to_keytab() == NULL) { ++ lp_do_parameter(-1, "sync machine password to keytab", "disabled"); ++ } ++ } ++#endif ++ + if (c->opt_stdin) { + set_line_buffering(stdin); + set_line_buffering(stdout); +diff --git a/source3/utils/testparm.c b/source3/utils/testparm.c +index e3ed336a79a..a31a7a8a30a 100644 +--- a/source3/utils/testparm.c ++++ b/source3/utils/testparm.c +@@ -803,7 +803,8 @@ static int do_global_checks(void) + "instead of 'kerberos method'.\n\n"); + } + +- if (lp_ptr != NULL) { ++ if (lp_ptr != NULL && ++ ((*lp_ptr != NULL) && !strequal_m(*lp_ptr, "disabled"))) { + while (*lp_ptr) { + ret |= pw2kt_check_line(*lp_ptr++); + } +-- +2.46.0 + diff --git a/samba.spec b/samba.spec index 2a18182..6c5f6b3 100644 --- a/samba.spec +++ b/samba.spec @@ -254,6 +254,8 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore +Patch0: samba-4.21.0-backport-freeipa-support.patch + Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} From 108ac3fce2394c2ac44e809241f99a9675586674 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 23 Sep 2024 12:58:24 +0200 Subject: [PATCH 10/42] Add cert directories to samba-common Those are created by gpupdate and we need to have them packaged that selinux can label them correctly. --- samba.spec | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/samba.spec b/samba.spec index 6c5f6b3..a5bcf9e 100644 --- a/samba.spec +++ b/samba.spec @@ -1426,9 +1426,11 @@ popd install -d -m 0755 %{buildroot}/usr/{sbin,bin} install -d -m 0755 %{buildroot}%{_libdir}/security install -d -m 0755 %{buildroot}/var/lib/samba +install -d -m 0755 %{buildroot}/var/lib/samba/certs install -d -m 0755 %{buildroot}/var/lib/samba/drivers install -d -m 0755 %{buildroot}/var/lib/samba/lock install -d -m 0755 %{buildroot}/var/lib/samba/private +install -d -m 0755 %{buildroot}/var/lib/samba/private/certs install -d -m 0755 %{buildroot}/var/lib/samba/scripts install -d -m 0755 %{buildroot}/var/lib/samba/sysvol install -d -m 0755 %{buildroot}/var/lib/samba/usershares @@ -2056,7 +2058,9 @@ fi %ghost %dir /run/samba %ghost %dir /run/winbindd %dir /var/lib/samba +%dir /var/lib/samba/certs %attr(700,root,root) %dir /var/lib/samba/private +%attr(700,root,root) %dir /var/lib/samba/private/certs %dir /var/lib/samba/lock %attr(755,root,root) %dir %{_sysconfdir}/samba %config(noreplace) %{_sysconfdir}/samba/smb.conf From 702c8faf1429ef9df873a9feda1409c65ef0c8bb Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Mon, 23 Sep 2024 19:35:26 -0400 Subject: [PATCH 11/42] Fix ELN build libsamba-policy is only built with the AD DC, but the LDB LMDB components should be built regardless: https://gitlab.com/samba-team/samba/-/merge_requests/3807 --- samba-4.21.0-ldb-lmdb.patch | 55 +++++++++++++++++++++++++++++++++++++ samba.spec | 10 ++++--- 2 files changed, 61 insertions(+), 4 deletions(-) create mode 100644 samba-4.21.0-ldb-lmdb.patch diff --git a/samba-4.21.0-ldb-lmdb.patch b/samba-4.21.0-ldb-lmdb.patch new file mode 100644 index 0000000..894014a --- /dev/null +++ b/samba-4.21.0-ldb-lmdb.patch @@ -0,0 +1,55 @@ +From 9f265d6f3b852a9eed9f19147585fe2801507f63 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 24 Sep 2024 15:48:23 +0200 +Subject: [PATCH] ldb: Build lmdb backend also in non-AD case + +We should build with lmdb support also if it is not in AD case. The lmdb +backend is also used e.g. by sssd. + +If you don't want to build it, you can always specify --without-ldb-lmdb + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15721 + +Signed-off-by: Andreas Schneider +--- + lib/ldb/wscript | 22 +++++++++------------- + 1 file changed, 9 insertions(+), 13 deletions(-) + +diff --git a/lib/ldb/wscript b/lib/ldb/wscript +index 87aa3bb6d77..f234fa79c10 100644 +--- a/lib/ldb/wscript ++++ b/lib/ldb/wscript +@@ -33,21 +33,17 @@ def configure(conf): + conf.CONFIG_GET('ENABLE_SELFTEST'): + Logs.warn("NOTE: Some AD DC parts of selftest will fail") + ++ conf.env.REQUIRE_LMDB = False ++ elif Options.options.without_ldb_lmdb: ++ if not Options.options.without_ad_dc and \ ++ conf.CONFIG_GET('ENABLE_SELFTEST'): ++ raise Errors.WafError('--without-ldb-lmdb conflicts ' ++ 'with --enable-selftest while ' ++ 'building the AD DC') ++ + conf.env.REQUIRE_LMDB = False + else: +- if Options.options.without_ad_dc: +- conf.env.REQUIRE_LMDB = False +- else: +- if Options.options.without_ldb_lmdb: +- if not Options.options.without_ad_dc and \ +- conf.CONFIG_GET('ENABLE_SELFTEST'): +- raise Errors.WafError('--without-ldb-lmdb conflicts ' +- 'with --enable-selftest while ' +- 'building the AD DC') +- +- conf.env.REQUIRE_LMDB = False +- else: +- conf.env.REQUIRE_LMDB = True ++ conf.env.REQUIRE_LMDB = True + + # if lmdb support is enabled then we require lmdb + # is present, build the mdb back end and enable lmdb support in +-- +GitLab + diff --git a/samba.spec b/samba.spec index a5bcf9e..4465c44 100644 --- a/samba.spec +++ b/samba.spec @@ -255,6 +255,8 @@ Source201: README.downgrade Source202: samba.abignore Patch0: samba-4.21.0-backport-freeipa-support.patch +# https://gitlab.com/samba-team/samba/-/merge_requests/3807 +Patch1: samba-4.21.0-ldb-lmdb.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} @@ -2206,14 +2208,14 @@ fi %endif ### DC-LIBS %files dc-libs -%{_libdir}/libsamba-policy.so.%{libsamba_policy_so_version}* -%{_libdir}/samba/libsamba-net-private-samba.so %{_libdir}/samba/libauth4-private-samba.so %if %{with dc} || %{with testsuite} +%{_libdir}/libsamba-policy.so.%{libsamba_policy_so_version}* %{_libdir}/samba/libdb-glue-private-samba.so %{_libdir}/samba/libpac-private-samba.so %{_libdir}/samba/libprocess-model-private-samba.so +%{_libdir}/samba/libsamba-net-private-samba.so %{_libdir}/samba/libservice-private-samba.so %if %{with testsuite} @@ -2357,7 +2359,6 @@ fi %{_libdir}/libsamba-credentials.so %{_libdir}/libsamba-errors.so %{_libdir}/libsamba-hostconfig.so -%{_libdir}/libsamba-policy.so %{_libdir}/libsamba-util.so %{_libdir}/libsamdb.so %{_libdir}/libsmbconf.so @@ -2370,7 +2371,6 @@ fi %{_libdir}/pkgconfig/ndr_standard.pc %{_libdir}/pkgconfig/samba-credentials.pc %{_libdir}/pkgconfig/samba-hostconfig.pc -%{_libdir}/pkgconfig/samba-policy.pc %{_libdir}/pkgconfig/samba-util.pc %{_libdir}/pkgconfig/samdb.pc %{_libdir}/libsamba-passdb.so @@ -2379,7 +2379,9 @@ fi %if %{with dc} || %{with testsuite} %{_includedir}/samba-4.0/dcerpc_server.h %{_libdir}/libdcerpc-server.so +%{_libdir}/libsamba-policy.so %{_libdir}/pkgconfig/dcerpc_server.pc +%{_libdir}/pkgconfig/samba-policy.pc %endif %if %{without libsmbclient} From 6d97717f53c1a234486a4258451cb3d05eac1bb0 Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Wed, 25 Sep 2024 18:06:49 -0400 Subject: [PATCH 12/42] Always include libsamba-policy and libsamba-net-private-samba As of 4.21, these were converted to regular C libraries to which their respective Python modules depend: https://gitlab.com/samba-team/samba/-/commit/d11b281aefa98e6850053ccd6142253c6cf0d04f https://gitlab.com/samba-team/samba/-/commit/829b52f99d5a9c9df19c9eb67611618095967edd --- samba.spec | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/samba.spec b/samba.spec index 4465c44..8ee8df5 100644 --- a/samba.spec +++ b/samba.spec @@ -1531,10 +1531,7 @@ rm -f %{buildroot}%{_mandir}/man8/vfs_ceph_snapshots.8* /sbin/ldconfig -N -n %{buildroot}%{_libdir} %if %{without dc} && %{without testsuite} -for f in samba/libsamba-net-private-samba.so \ - samba/libsamba-python-private-samba.so \ - libsamba-policy.so* \ - pkgconfig/samba-policy.pc ; do +for f in samba/libsamba-python-private-samba.so; do rm -f %{buildroot}%{_libdir}/$f done #endif without dc @@ -2208,14 +2205,14 @@ fi %endif ### DC-LIBS %files dc-libs +%{_libdir}/libsamba-policy.so.%{libsamba_policy_so_version}* %{_libdir}/samba/libauth4-private-samba.so +%{_libdir}/samba/libsamba-net-private-samba.so %if %{with dc} || %{with testsuite} -%{_libdir}/libsamba-policy.so.%{libsamba_policy_so_version}* %{_libdir}/samba/libdb-glue-private-samba.so %{_libdir}/samba/libpac-private-samba.so %{_libdir}/samba/libprocess-model-private-samba.so -%{_libdir}/samba/libsamba-net-private-samba.so %{_libdir}/samba/libservice-private-samba.so %if %{with testsuite} @@ -2371,17 +2368,17 @@ fi %{_libdir}/pkgconfig/ndr_standard.pc %{_libdir}/pkgconfig/samba-credentials.pc %{_libdir}/pkgconfig/samba-hostconfig.pc +%{_libdir}/pkgconfig/samba-policy.pc %{_libdir}/pkgconfig/samba-util.pc %{_libdir}/pkgconfig/samdb.pc %{_libdir}/libsamba-passdb.so +%{_libdir}/libsamba-policy.so %{_libdir}/libsmbldap.so %if %{with dc} || %{with testsuite} %{_includedir}/samba-4.0/dcerpc_server.h %{_libdir}/libdcerpc-server.so -%{_libdir}/libsamba-policy.so %{_libdir}/pkgconfig/dcerpc_server.pc -%{_libdir}/pkgconfig/samba-policy.pc %endif %if %{without libsmbclient} From bcab741aaaa3068a2526b76b3ba989827f8fa149 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Fri, 27 Sep 2024 13:59:42 +0200 Subject: [PATCH 13/42] Build with ceph again for ppc64le This is fixed https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104172 in gcc >= 11.3. It is ok to enable for rhel-9, rhel-10 and f41: gcc-11.5.0-2.el9 gcc-14.2.1-2.el10 gcc-14.2.1-3.fc41 --- samba.spec | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 8ee8df5..06a1376 100644 --- a/samba.spec +++ b/samba.spec @@ -55,9 +55,7 @@ # Build vfs_ceph module and ctdb cepth mutex helper by default on 64bit Fedora %if 0%{?fedora} -# ppc64le excluded pending resolution of https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104172 -#%%ifarch aarch64 ppc64le s390x x86_64 -%ifarch aarch64 s390x x86_64 riscv64 +%ifarch aarch64 ppc64le s390x x86_64 riscv64 %bcond_without vfs_cephfs %bcond_without ceph_mutex %else From aa82984a45426a9202b3b62935bfbab7731e2bfc Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 1 Oct 2024 14:11:48 +0200 Subject: [PATCH 14/42] Don't use RTLD_DEEPBIND by default in libldb - resolves: rhbz#2278016 --- samba-4-21-fix-libldb-deepbind.patch | 286 +++++++++++++++++++++++++++ samba.spec | 1 + 2 files changed, 287 insertions(+) create mode 100644 samba-4-21-fix-libldb-deepbind.patch diff --git a/samba-4-21-fix-libldb-deepbind.patch b/samba-4-21-fix-libldb-deepbind.patch new file mode 100644 index 0000000..9593482 --- /dev/null +++ b/samba-4-21-fix-libldb-deepbind.patch @@ -0,0 +1,286 @@ +From e2d3bf09d6d75c7dc009aff36119e51ea59371fc Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 25 Sep 2024 09:19:17 +0200 +Subject: [PATCH 1/4] lib:ldb: Remove trailing spaces from ldb_modules.c + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15643 + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +(cherry picked from commit 8d6b5183770895fef002b6cce84902d1874fa502) +--- + lib/ldb/common/ldb_modules.c | 34 +++++++++++++++++----------------- + 1 file changed, 17 insertions(+), 17 deletions(-) + +diff --git a/lib/ldb/common/ldb_modules.c b/lib/ldb/common/ldb_modules.c +index b5627b0d04f..5c970626206 100644 +--- a/lib/ldb/common/ldb_modules.c ++++ b/lib/ldb/common/ldb_modules.c +@@ -631,9 +631,9 @@ int ldb_next_start_trans(struct ldb_module *module) + /* Set a default error string, to place the blame somewhere */ + ldb_asprintf_errstring(module->ldb, "start_trans error in module %s: %s (%d)", module->ops->name, ldb_strerror(ret), ret); + } +- if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { +- ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_start_trans error: %s", +- ldb_errstring(module->ldb)); ++ if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { ++ ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_start_trans error: %s", ++ ldb_errstring(module->ldb)); + } + return ret; + } +@@ -650,9 +650,9 @@ int ldb_next_end_trans(struct ldb_module *module) + /* Set a default error string, to place the blame somewhere */ + ldb_asprintf_errstring(module->ldb, "end_trans error in module %s: %s (%d)", module->ops->name, ldb_strerror(ret), ret); + } +- if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { +- ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_end_trans error: %s", +- ldb_errstring(module->ldb)); ++ if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { ++ ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_end_trans error: %s", ++ ldb_errstring(module->ldb)); + } + return ret; + } +@@ -720,9 +720,9 @@ int ldb_next_prepare_commit(struct ldb_module *module) + /* Set a default error string, to place the blame somewhere */ + ldb_asprintf_errstring(module->ldb, "prepare_commit error in module %s: %s (%d)", module->ops->name, ldb_strerror(ret), ret); + } +- if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { +- ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_prepare_commit error: %s", +- ldb_errstring(module->ldb)); ++ if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { ++ ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_prepare_commit error: %s", ++ ldb_errstring(module->ldb)); + } + return ret; + } +@@ -739,9 +739,9 @@ int ldb_next_del_trans(struct ldb_module *module) + /* Set a default error string, to place the blame somewhere */ + ldb_asprintf_errstring(module->ldb, "del_trans error in module %s: %s (%d)", module->ops->name, ldb_strerror(ret), ret); + } +- if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { +- ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_del_trans error: %s", +- ldb_errstring(module->ldb)); ++ if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { ++ ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_del_trans error: %s", ++ ldb_errstring(module->ldb)); + } + return ret; + } +@@ -777,17 +777,17 @@ int ldb_module_send_entry(struct ldb_request *req, + req->handle->nesting == 0) { + char *s; + struct ldb_ldif ldif; +- ++ + ldif.changetype = LDB_CHANGETYPE_NONE; + ldif.msg = discard_const_p(struct ldb_message, msg); + + ldb_debug_add(req->handle->ldb, "ldb_trace_response: ENTRY\n"); + +- /* ++ /* + * The choice to call + * ldb_ldif_write_redacted_trace_string() is CRITICAL + * for security. It ensures that we do not output +- * passwords into debug logs ++ * passwords into debug logs + */ + + s = ldb_ldif_write_redacted_trace_string(req->handle->ldb, msg, &ldif); +@@ -1104,8 +1104,8 @@ static int ldb_modules_load_dir(const char *modules_dir, const char *version) + return LDB_SUCCESS; + } + +-/* +- load any additional modules from the given directory ++/* ++ load any additional modules from the given directory + */ + void ldb_set_modules_dir(struct ldb_context *ldb, const char *path) + { +-- +2.46.1 + + +From d0ec464cfced2654d74672846d83c19f69af622b Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 25 Sep 2024 09:19:44 +0200 +Subject: [PATCH 2/4] lib:ldb: Don't use RTLD_DEEPBIND by default + +It should be off by default, as this is not needed by default. It +crashes named on startup, if bind is built with jemalloc support. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15643 + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +(cherry picked from commit dc6927fdca2ad77dbcf212ef4d3ba0d118ec7bdf) +--- + lib/ldb/common/ldb_modules.c | 21 ++++++--------------- + selftest/selftest.pl | 6 ------ + selftest/wscript | 5 ++--- + 3 files changed, 8 insertions(+), 24 deletions(-) + +diff --git a/lib/ldb/common/ldb_modules.c b/lib/ldb/common/ldb_modules.c +index 5c970626206..08d251f9bdd 100644 +--- a/lib/ldb/common/ldb_modules.c ++++ b/lib/ldb/common/ldb_modules.c +@@ -945,7 +945,7 @@ static int ldb_modules_load_path(const char *path, const char *version) + int dlopen_flags; + + #ifdef RTLD_DEEPBIND +- bool deepbind_enabled = (getenv("LDB_MODULES_DISABLE_DEEPBIND") == NULL); ++ bool deepbind_enabled = (getenv("LDB_MODULES_ENABLE_DEEPBIND") != NULL); + #endif + + ret = stat(path, &st); +@@ -981,21 +981,12 @@ static int ldb_modules_load_path(const char *path, const char *version) + dlopen_flags = RTLD_NOW; + #ifdef RTLD_DEEPBIND + /* +- * use deepbind if possible, to avoid issues with different +- * system library variants, for example ldb modules may be linked +- * against Heimdal while the application may use MIT kerberos. ++ * On systems where e.g. different kerberos libraries are used, like a ++ * mix of Heimdal and MIT Kerberos, LDB_MODULES_ENABLE_DEEPBIND should ++ * be set to avoid issues. + * +- * See the dlopen manpage for details. +- * +- * One typical user is the bind_dlz module of Samba, +- * but symbol versioning might be enough... +- * +- * We need a way to disable this in order to allow the +- * ldb_*ldap modules to work with a preloaded socket wrapper. +- * +- * So in future we may remove this completely +- * or at least invert the default behavior. +- */ ++ * By default Linux distributions only have one Kerberos library. ++ */ + if (deepbind_enabled) { + dlopen_flags |= RTLD_DEEPBIND; + } +diff --git a/selftest/selftest.pl b/selftest/selftest.pl +index 26b1663b5b6..a0c4ec80f59 100755 +--- a/selftest/selftest.pl ++++ b/selftest/selftest.pl +@@ -433,12 +433,6 @@ $ENV{UID_WRAPPER} = 1; + # We are already hitting the limit, so double it. + $ENV{NSS_WRAPPER_MAX_HOSTENTS} = 200; + +-# Disable RTLD_DEEPBIND hack for Samba bind dlz module +-# +-# This is needed in order to allow the ldb_*ldap module +-# to work with a preloaded socket wrapper. +-$ENV{LDB_MODULES_DISABLE_DEEPBIND} = 1; +- + my $socket_wrapper_dir; + if ($opt_socket_wrapper) { + $socket_wrapper_dir = SocketWrapper::setup_dir("$prefix_abs/w", $opt_socket_wrapper_pcap); +diff --git a/selftest/wscript b/selftest/wscript +index 52c34dcb88d..95e70706e63 100644 +--- a/selftest/wscript ++++ b/selftest/wscript +@@ -333,9 +333,8 @@ def cmd_testonly(opt): + asan_options += ":suppressions=${srcdir}/selftest/sanitizer/asan.supp" + asan_options += " " + +- # And we need to disable RTLD_DEEPBIND in ldb and socket wrapper +- no_leak_check = "LDB_MODULES_DISABLE_DEEPBIND=1 " +- no_leak_check += "SOCKET_WRAPPER_DISABLE_DEEP_BIND=1" ++ # We need to disable RTLD_DEEPBIND in socket wrapper ++ no_leak_check = "SOCKET_WRAPPER_DISABLE_DEEP_BIND=1" + no_leak_check += " " + env.CORE_COMMAND = asan_options + no_leak_check + env.CORE_COMMAND + +-- +2.46.1 + + +From e6745b1444b28904258710dff1dddd18a8b9f662 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 25 Sep 2024 09:40:23 +0200 +Subject: [PATCH 3/4] lib:ldb: Remove trailing spaces from ldb.3.xml + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15643 + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +(cherry picked from commit d6ff05cb5708fb6746176821bee5f713195efa54) +--- + lib/ldb/man/ldb.3.xml | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/ldb/man/ldb.3.xml b/lib/ldb/man/ldb.3.xml +index 1c0a2ece552..1dd8b2462d4 100644 +--- a/lib/ldb/man/ldb.3.xml ++++ b/lib/ldb/man/ldb.3.xml +@@ -247,7 +247,7 @@ ldb_search(3) manual pages. + Author + + +- ldb was written by ++ ldb was written by + Andrew Tridgell. + + +-- +2.46.1 + + +From ba9918d45820fbdb864b5a1e058136eeb0cf1ce7 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 25 Sep 2024 09:22:08 +0200 +Subject: [PATCH 4/4] lib:ldb: Document environment variables in ldb manpage + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15643 + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher + +Autobuild-User(master): Andreas Schneider +Autobuild-Date(master): Fri Sep 27 09:06:43 UTC 2024 on atb-devel-224 + +(cherry picked from commit 20a3a94e06a2294206ec233ccc7f873d6ef2aca0) +--- + lib/ldb/man/ldb.3.xml | 21 +++++++++++++++++++++ + 1 file changed, 21 insertions(+) + +diff --git a/lib/ldb/man/ldb.3.xml b/lib/ldb/man/ldb.3.xml +index 1dd8b2462d4..f8d3cb50446 100644 +--- a/lib/ldb/man/ldb.3.xml ++++ b/lib/ldb/man/ldb.3.xml +@@ -243,6 +243,27 @@ ldb_search(3) manual pages. + + + ++ ++ ENVIRONMENT VARIABLES ++ ++ ++ ++ LDB_URL ++ - connect to the provided URL (cmdline tools only) ++ ++ ++ ++ LDB_MODULES_PATH ++ - path where to load ldb modules from ++ ++ ++ ++ LDB_MODULES_ENABLE_DEEPBIND ++ - enable RTLD_DEEPBIND when loading ldb modules ++ ++ ++ ++ + + Author + +-- +2.46.1 + diff --git a/samba.spec b/samba.spec index 06a1376..67e3895 100644 --- a/samba.spec +++ b/samba.spec @@ -255,6 +255,7 @@ Source202: samba.abignore Patch0: samba-4.21.0-backport-freeipa-support.patch # https://gitlab.com/samba-team/samba/-/merge_requests/3807 Patch1: samba-4.21.0-ldb-lmdb.patch +Patch2: samba-4-21-fix-libldb-deepbind.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} From 64010cc90fba1e3d7aecdd22c3da953d31eb7b67 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Mon, 14 Oct 2024 14:29:04 +0200 Subject: [PATCH 15/42] Update to version 4.21.1 - resolves: rhbz#2318518 --- samba-4-21-fix-libldb-deepbind.patch | 286 ----------- samba-4.21.0-backport-freeipa-support.patch | 132 ----- samba-4.21.0-ldb-lmdb.patch | 55 --- samba-4.21.0-s3-notifyd.patch | 513 ++++++++++++++++++++ samba.spec | 7 +- sources | 4 +- 6 files changed, 517 insertions(+), 480 deletions(-) delete mode 100644 samba-4-21-fix-libldb-deepbind.patch delete mode 100644 samba-4.21.0-backport-freeipa-support.patch delete mode 100644 samba-4.21.0-ldb-lmdb.patch create mode 100644 samba-4.21.0-s3-notifyd.patch diff --git a/samba-4-21-fix-libldb-deepbind.patch b/samba-4-21-fix-libldb-deepbind.patch deleted file mode 100644 index 9593482..0000000 --- a/samba-4-21-fix-libldb-deepbind.patch +++ /dev/null @@ -1,286 +0,0 @@ -From e2d3bf09d6d75c7dc009aff36119e51ea59371fc Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Wed, 25 Sep 2024 09:19:17 +0200 -Subject: [PATCH 1/4] lib:ldb: Remove trailing spaces from ldb_modules.c - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15643 - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher -(cherry picked from commit 8d6b5183770895fef002b6cce84902d1874fa502) ---- - lib/ldb/common/ldb_modules.c | 34 +++++++++++++++++----------------- - 1 file changed, 17 insertions(+), 17 deletions(-) - -diff --git a/lib/ldb/common/ldb_modules.c b/lib/ldb/common/ldb_modules.c -index b5627b0d04f..5c970626206 100644 ---- a/lib/ldb/common/ldb_modules.c -+++ b/lib/ldb/common/ldb_modules.c -@@ -631,9 +631,9 @@ int ldb_next_start_trans(struct ldb_module *module) - /* Set a default error string, to place the blame somewhere */ - ldb_asprintf_errstring(module->ldb, "start_trans error in module %s: %s (%d)", module->ops->name, ldb_strerror(ret), ret); - } -- if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { -- ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_start_trans error: %s", -- ldb_errstring(module->ldb)); -+ if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { -+ ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_start_trans error: %s", -+ ldb_errstring(module->ldb)); - } - return ret; - } -@@ -650,9 +650,9 @@ int ldb_next_end_trans(struct ldb_module *module) - /* Set a default error string, to place the blame somewhere */ - ldb_asprintf_errstring(module->ldb, "end_trans error in module %s: %s (%d)", module->ops->name, ldb_strerror(ret), ret); - } -- if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { -- ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_end_trans error: %s", -- ldb_errstring(module->ldb)); -+ if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { -+ ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_end_trans error: %s", -+ ldb_errstring(module->ldb)); - } - return ret; - } -@@ -720,9 +720,9 @@ int ldb_next_prepare_commit(struct ldb_module *module) - /* Set a default error string, to place the blame somewhere */ - ldb_asprintf_errstring(module->ldb, "prepare_commit error in module %s: %s (%d)", module->ops->name, ldb_strerror(ret), ret); - } -- if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { -- ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_prepare_commit error: %s", -- ldb_errstring(module->ldb)); -+ if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { -+ ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_prepare_commit error: %s", -+ ldb_errstring(module->ldb)); - } - return ret; - } -@@ -739,9 +739,9 @@ int ldb_next_del_trans(struct ldb_module *module) - /* Set a default error string, to place the blame somewhere */ - ldb_asprintf_errstring(module->ldb, "del_trans error in module %s: %s (%d)", module->ops->name, ldb_strerror(ret), ret); - } -- if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { -- ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_del_trans error: %s", -- ldb_errstring(module->ldb)); -+ if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { -+ ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_del_trans error: %s", -+ ldb_errstring(module->ldb)); - } - return ret; - } -@@ -777,17 +777,17 @@ int ldb_module_send_entry(struct ldb_request *req, - req->handle->nesting == 0) { - char *s; - struct ldb_ldif ldif; -- -+ - ldif.changetype = LDB_CHANGETYPE_NONE; - ldif.msg = discard_const_p(struct ldb_message, msg); - - ldb_debug_add(req->handle->ldb, "ldb_trace_response: ENTRY\n"); - -- /* -+ /* - * The choice to call - * ldb_ldif_write_redacted_trace_string() is CRITICAL - * for security. It ensures that we do not output -- * passwords into debug logs -+ * passwords into debug logs - */ - - s = ldb_ldif_write_redacted_trace_string(req->handle->ldb, msg, &ldif); -@@ -1104,8 +1104,8 @@ static int ldb_modules_load_dir(const char *modules_dir, const char *version) - return LDB_SUCCESS; - } - --/* -- load any additional modules from the given directory -+/* -+ load any additional modules from the given directory - */ - void ldb_set_modules_dir(struct ldb_context *ldb, const char *path) - { --- -2.46.1 - - -From d0ec464cfced2654d74672846d83c19f69af622b Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Wed, 25 Sep 2024 09:19:44 +0200 -Subject: [PATCH 2/4] lib:ldb: Don't use RTLD_DEEPBIND by default - -It should be off by default, as this is not needed by default. It -crashes named on startup, if bind is built with jemalloc support. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15643 - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher -(cherry picked from commit dc6927fdca2ad77dbcf212ef4d3ba0d118ec7bdf) ---- - lib/ldb/common/ldb_modules.c | 21 ++++++--------------- - selftest/selftest.pl | 6 ------ - selftest/wscript | 5 ++--- - 3 files changed, 8 insertions(+), 24 deletions(-) - -diff --git a/lib/ldb/common/ldb_modules.c b/lib/ldb/common/ldb_modules.c -index 5c970626206..08d251f9bdd 100644 ---- a/lib/ldb/common/ldb_modules.c -+++ b/lib/ldb/common/ldb_modules.c -@@ -945,7 +945,7 @@ static int ldb_modules_load_path(const char *path, const char *version) - int dlopen_flags; - - #ifdef RTLD_DEEPBIND -- bool deepbind_enabled = (getenv("LDB_MODULES_DISABLE_DEEPBIND") == NULL); -+ bool deepbind_enabled = (getenv("LDB_MODULES_ENABLE_DEEPBIND") != NULL); - #endif - - ret = stat(path, &st); -@@ -981,21 +981,12 @@ static int ldb_modules_load_path(const char *path, const char *version) - dlopen_flags = RTLD_NOW; - #ifdef RTLD_DEEPBIND - /* -- * use deepbind if possible, to avoid issues with different -- * system library variants, for example ldb modules may be linked -- * against Heimdal while the application may use MIT kerberos. -+ * On systems where e.g. different kerberos libraries are used, like a -+ * mix of Heimdal and MIT Kerberos, LDB_MODULES_ENABLE_DEEPBIND should -+ * be set to avoid issues. - * -- * See the dlopen manpage for details. -- * -- * One typical user is the bind_dlz module of Samba, -- * but symbol versioning might be enough... -- * -- * We need a way to disable this in order to allow the -- * ldb_*ldap modules to work with a preloaded socket wrapper. -- * -- * So in future we may remove this completely -- * or at least invert the default behavior. -- */ -+ * By default Linux distributions only have one Kerberos library. -+ */ - if (deepbind_enabled) { - dlopen_flags |= RTLD_DEEPBIND; - } -diff --git a/selftest/selftest.pl b/selftest/selftest.pl -index 26b1663b5b6..a0c4ec80f59 100755 ---- a/selftest/selftest.pl -+++ b/selftest/selftest.pl -@@ -433,12 +433,6 @@ $ENV{UID_WRAPPER} = 1; - # We are already hitting the limit, so double it. - $ENV{NSS_WRAPPER_MAX_HOSTENTS} = 200; - --# Disable RTLD_DEEPBIND hack for Samba bind dlz module --# --# This is needed in order to allow the ldb_*ldap module --# to work with a preloaded socket wrapper. --$ENV{LDB_MODULES_DISABLE_DEEPBIND} = 1; -- - my $socket_wrapper_dir; - if ($opt_socket_wrapper) { - $socket_wrapper_dir = SocketWrapper::setup_dir("$prefix_abs/w", $opt_socket_wrapper_pcap); -diff --git a/selftest/wscript b/selftest/wscript -index 52c34dcb88d..95e70706e63 100644 ---- a/selftest/wscript -+++ b/selftest/wscript -@@ -333,9 +333,8 @@ def cmd_testonly(opt): - asan_options += ":suppressions=${srcdir}/selftest/sanitizer/asan.supp" - asan_options += " " - -- # And we need to disable RTLD_DEEPBIND in ldb and socket wrapper -- no_leak_check = "LDB_MODULES_DISABLE_DEEPBIND=1 " -- no_leak_check += "SOCKET_WRAPPER_DISABLE_DEEP_BIND=1" -+ # We need to disable RTLD_DEEPBIND in socket wrapper -+ no_leak_check = "SOCKET_WRAPPER_DISABLE_DEEP_BIND=1" - no_leak_check += " " - env.CORE_COMMAND = asan_options + no_leak_check + env.CORE_COMMAND - --- -2.46.1 - - -From e6745b1444b28904258710dff1dddd18a8b9f662 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Wed, 25 Sep 2024 09:40:23 +0200 -Subject: [PATCH 3/4] lib:ldb: Remove trailing spaces from ldb.3.xml - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15643 - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher -(cherry picked from commit d6ff05cb5708fb6746176821bee5f713195efa54) ---- - lib/ldb/man/ldb.3.xml | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/lib/ldb/man/ldb.3.xml b/lib/ldb/man/ldb.3.xml -index 1c0a2ece552..1dd8b2462d4 100644 ---- a/lib/ldb/man/ldb.3.xml -+++ b/lib/ldb/man/ldb.3.xml -@@ -247,7 +247,7 @@ ldb_search(3) manual pages. - Author - - -- ldb was written by -+ ldb was written by - Andrew Tridgell. - - --- -2.46.1 - - -From ba9918d45820fbdb864b5a1e058136eeb0cf1ce7 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Wed, 25 Sep 2024 09:22:08 +0200 -Subject: [PATCH 4/4] lib:ldb: Document environment variables in ldb manpage - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15643 - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher - -Autobuild-User(master): Andreas Schneider -Autobuild-Date(master): Fri Sep 27 09:06:43 UTC 2024 on atb-devel-224 - -(cherry picked from commit 20a3a94e06a2294206ec233ccc7f873d6ef2aca0) ---- - lib/ldb/man/ldb.3.xml | 21 +++++++++++++++++++++ - 1 file changed, 21 insertions(+) - -diff --git a/lib/ldb/man/ldb.3.xml b/lib/ldb/man/ldb.3.xml -index 1dd8b2462d4..f8d3cb50446 100644 ---- a/lib/ldb/man/ldb.3.xml -+++ b/lib/ldb/man/ldb.3.xml -@@ -243,6 +243,27 @@ ldb_search(3) manual pages. - - - -+ -+ ENVIRONMENT VARIABLES -+ -+ -+ -+ LDB_URL -+ - connect to the provided URL (cmdline tools only) -+ -+ -+ -+ LDB_MODULES_PATH -+ - path where to load ldb modules from -+ -+ -+ -+ LDB_MODULES_ENABLE_DEEPBIND -+ - enable RTLD_DEEPBIND when loading ldb modules -+ -+ -+ -+ - - Author - --- -2.46.1 - diff --git a/samba-4.21.0-backport-freeipa-support.patch b/samba-4.21.0-backport-freeipa-support.patch deleted file mode 100644 index d1c5776..0000000 --- a/samba-4.21.0-backport-freeipa-support.patch +++ /dev/null @@ -1,132 +0,0 @@ -From 26797d7bd2662718b3eb795f1b8e6100d51e3ab7 Mon Sep 17 00:00:00 2001 -From: Alexander Bokovoy -Date: Tue, 3 Sep 2024 08:48:24 +0300 -Subject: [PATCH] sync machine password to keytab: handle FreeIPA use case -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -FreeIPA uses own procedure to retrieve keytabs and during the setup of -Samba on FreeIPA client the keytab is already present, only machine -account needs to be set in the secrets database. - -'sync machine password to keytab' option handling broke this use case by -always attempting to contact a domain controller and failing to do so -(Fedora bug https://bugzilla.redhat.com/show_bug.cgi?id=2309199). - -The original synchronizing machine account password to keytab feature -did not have a mechanism to disable its logic at all. - -Signed-off-by: Alexander Bokovoy -Reviewed-by: Pavel Filipenský - -Autobuild-User(master): Alexander Bokovoy -Autobuild-Date(master): Fri Sep 13 13:16:09 UTC 2024 on atb-devel-224 - -(cherry picked from commit 4f577c7b6894132be4842944f2f950b087312b16) ---- - .../security/syncmachinepasswordtokeytab.xml | 29 +++++++++++++++++-- - source3/libads/kerberos_keytab.c | 5 ++++ - source3/utils/net.c | 8 +++++ - source3/utils/testparm.c | 3 +- - 4 files changed, 41 insertions(+), 4 deletions(-) - -diff --git a/docs-xml/smbdotconf/security/syncmachinepasswordtokeytab.xml b/docs-xml/smbdotconf/security/syncmachinepasswordtokeytab.xml -index 4cad9da73f2..f7dc30023d4 100644 ---- a/docs-xml/smbdotconf/security/syncmachinepasswordtokeytab.xml -+++ b/docs-xml/smbdotconf/security/syncmachinepasswordtokeytab.xml -@@ -18,7 +18,11 @@ or by winbindd doing regular updates (see -+If no value is present and is different from -+'secrets only', the behavior differs between winbind and net utility: -+ -+ -+ -+ winbind uses value -+ /path/to/keytab:sync_spns:sync_kvno:machine_password -+ where the path to the keytab is obtained either from the krb5 library or from -+ . -+ -+ -+ -+ net changesecretpw -f command uses the default 'disabled' value. -+ -+ No other net subcommands use the 'disabled' value. -+ -+ -+ -+If a single value 'disabled' is present, the synchronization process is -+disabled. This is required for FreeIPA domain member setup where keytab -+synchronization uses a protocol not implemented by Samba. - - - -diff --git a/source3/libads/kerberos_keytab.c b/source3/libads/kerberos_keytab.c -index 6ede567b75f..dbf8af44c1f 100644 ---- a/source3/libads/kerberos_keytab.c -+++ b/source3/libads/kerberos_keytab.c -@@ -904,6 +904,11 @@ NTSTATUS sync_pw2keytabs(void) - goto params_ready; - } - -+ if ((*lp_ptr != NULL) && strequal_m(*lp_ptr, "disabled")) { -+ DBG_DEBUG("'sync machine password to keytab' is explicitly disabled.\n"); -+ return NT_STATUS_OK; -+ } -+ - line = lp_ptr; - while (*line) { - DBG_DEBUG("Scanning line: %s\n", *line); -diff --git a/source3/utils/net.c b/source3/utils/net.c -index 7b40d2bee95..c432ebe991f 100644 ---- a/source3/utils/net.c -+++ b/source3/utils/net.c -@@ -207,6 +207,14 @@ static int net_changesecretpw(struct net_context *c, int argc, - struct timeval tv = timeval_current(); - NTTIME now = timeval_to_nttime(&tv); - -+#ifdef HAVE_ADS -+ if (USE_KERBEROS_KEYTAB) { -+ if (lp_sync_machine_password_to_keytab() == NULL) { -+ lp_do_parameter(-1, "sync machine password to keytab", "disabled"); -+ } -+ } -+#endif -+ - if (c->opt_stdin) { - set_line_buffering(stdin); - set_line_buffering(stdout); -diff --git a/source3/utils/testparm.c b/source3/utils/testparm.c -index e3ed336a79a..a31a7a8a30a 100644 ---- a/source3/utils/testparm.c -+++ b/source3/utils/testparm.c -@@ -803,7 +803,8 @@ static int do_global_checks(void) - "instead of 'kerberos method'.\n\n"); - } - -- if (lp_ptr != NULL) { -+ if (lp_ptr != NULL && -+ ((*lp_ptr != NULL) && !strequal_m(*lp_ptr, "disabled"))) { - while (*lp_ptr) { - ret |= pw2kt_check_line(*lp_ptr++); - } --- -2.46.0 - diff --git a/samba-4.21.0-ldb-lmdb.patch b/samba-4.21.0-ldb-lmdb.patch deleted file mode 100644 index 894014a..0000000 --- a/samba-4.21.0-ldb-lmdb.patch +++ /dev/null @@ -1,55 +0,0 @@ -From 9f265d6f3b852a9eed9f19147585fe2801507f63 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Tue, 24 Sep 2024 15:48:23 +0200 -Subject: [PATCH] ldb: Build lmdb backend also in non-AD case - -We should build with lmdb support also if it is not in AD case. The lmdb -backend is also used e.g. by sssd. - -If you don't want to build it, you can always specify --without-ldb-lmdb - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15721 - -Signed-off-by: Andreas Schneider ---- - lib/ldb/wscript | 22 +++++++++------------- - 1 file changed, 9 insertions(+), 13 deletions(-) - -diff --git a/lib/ldb/wscript b/lib/ldb/wscript -index 87aa3bb6d77..f234fa79c10 100644 ---- a/lib/ldb/wscript -+++ b/lib/ldb/wscript -@@ -33,21 +33,17 @@ def configure(conf): - conf.CONFIG_GET('ENABLE_SELFTEST'): - Logs.warn("NOTE: Some AD DC parts of selftest will fail") - -+ conf.env.REQUIRE_LMDB = False -+ elif Options.options.without_ldb_lmdb: -+ if not Options.options.without_ad_dc and \ -+ conf.CONFIG_GET('ENABLE_SELFTEST'): -+ raise Errors.WafError('--without-ldb-lmdb conflicts ' -+ 'with --enable-selftest while ' -+ 'building the AD DC') -+ - conf.env.REQUIRE_LMDB = False - else: -- if Options.options.without_ad_dc: -- conf.env.REQUIRE_LMDB = False -- else: -- if Options.options.without_ldb_lmdb: -- if not Options.options.without_ad_dc and \ -- conf.CONFIG_GET('ENABLE_SELFTEST'): -- raise Errors.WafError('--without-ldb-lmdb conflicts ' -- 'with --enable-selftest while ' -- 'building the AD DC') -- -- conf.env.REQUIRE_LMDB = False -- else: -- conf.env.REQUIRE_LMDB = True -+ conf.env.REQUIRE_LMDB = True - - # if lmdb support is enabled then we require lmdb - # is present, build the mdb back end and enable lmdb support in --- -GitLab - diff --git a/samba-4.21.0-s3-notifyd.patch b/samba-4.21.0-s3-notifyd.patch new file mode 100644 index 0000000..31463fd --- /dev/null +++ b/samba-4.21.0-s3-notifyd.patch @@ -0,0 +1,513 @@ +From c9a7bc3e8f36cb9d6746e23ea56f9c27b82dcf49 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Mon, 22 Jul 2024 12:26:55 +0200 +Subject: [PATCH] s3:notifyd: Use a watcher per db record +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +This fixes a O(n²) performance regression in notifyd. The problem was +that we had a watcher per notify instance. This changes the code to have +a watcher per notify db entry. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14430 + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +(cherry picked from commit af011b987a4ad0d3753d83cc0b8d97ad64ba874a) +--- + source3/smbd/notifyd/notifyd.c | 214 ++++++++++++++++++------- + source3/smbd/notifyd/notifyd_db.c | 5 +- + source3/smbd/notifyd/notifyd_entry.c | 51 ++++-- + source3/smbd/notifyd/notifyd_private.h | 46 ++++-- + 4 files changed, 228 insertions(+), 88 deletions(-) + +diff --git a/source3/smbd/notifyd/notifyd.c b/source3/smbd/notifyd/notifyd.c +index 64dd26a7e11..0b07ab3e435 100644 +--- a/source3/smbd/notifyd/notifyd.c ++++ b/source3/smbd/notifyd/notifyd.c +@@ -337,6 +337,7 @@ static bool notifyd_apply_rec_change( + struct messaging_context *msg_ctx) + { + struct db_record *rec = NULL; ++ struct notifyd_watcher watcher = {}; + struct notifyd_instance *instances = NULL; + size_t num_instances; + size_t i; +@@ -344,6 +345,7 @@ static bool notifyd_apply_rec_change( + TDB_DATA value; + NTSTATUS status; + bool ok = false; ++ bool new_watcher = false; + + if (pathlen == 0) { + DBG_WARNING("pathlen==0\n"); +@@ -374,8 +376,12 @@ static bool notifyd_apply_rec_change( + value = dbwrap_record_get_value(rec); + + if (value.dsize != 0) { +- if (!notifyd_parse_entry(value.dptr, value.dsize, NULL, +- &num_instances)) { ++ ok = notifyd_parse_entry(value.dptr, ++ value.dsize, ++ &watcher, ++ NULL, ++ &num_instances); ++ if (!ok) { + goto fail; + } + } +@@ -390,8 +396,22 @@ static bool notifyd_apply_rec_change( + goto fail; + } + +- if (value.dsize != 0) { +- memcpy(instances, value.dptr, value.dsize); ++ if (num_instances > 0) { ++ struct notifyd_instance *tmp = NULL; ++ size_t num_tmp = 0; ++ ++ ok = notifyd_parse_entry(value.dptr, ++ value.dsize, ++ NULL, ++ &tmp, ++ &num_tmp); ++ if (!ok) { ++ goto fail; ++ } ++ ++ memcpy(instances, ++ tmp, ++ sizeof(struct notifyd_instance) * num_tmp); + } + + for (i=0; ifilter, +- .internal_subdir_filter = chg->subdir_filter + }; + + num_instances += 1; + } + +- if ((instance->instance.filter != 0) || +- (instance->instance.subdir_filter != 0)) { +- int ret; ++ /* ++ * Calculate an intersection of the instances filters for the watcher. ++ */ ++ if (instance->instance.filter > 0) { ++ uint32_t filter = instance->instance.filter; ++ ++ if ((watcher.filter & filter) != filter) { ++ watcher.filter |= filter; ++ ++ new_watcher = true; ++ } ++ } ++ ++ /* ++ * Calculate an intersection of the instances subdir_filters for the ++ * watcher. ++ */ ++ if (instance->instance.subdir_filter > 0) { ++ uint32_t subdir_filter = instance->instance.subdir_filter; + +- TALLOC_FREE(instance->sys_watch); ++ if ((watcher.subdir_filter & subdir_filter) != subdir_filter) { ++ watcher.subdir_filter |= subdir_filter; + +- ret = sys_notify_watch(entries, sys_notify_ctx, path, +- &instance->internal_filter, +- &instance->internal_subdir_filter, +- notifyd_sys_callback, msg_ctx, +- &instance->sys_watch); +- if (ret != 0) { +- DBG_WARNING("sys_notify_watch for [%s] returned %s\n", +- path, strerror(errno)); ++ new_watcher = true; + } + } + + if ((instance->instance.filter == 0) && + (instance->instance.subdir_filter == 0)) { ++ uint32_t tmp_filter = 0; ++ uint32_t tmp_subdir_filter = 0; ++ + /* This is a delete request */ +- TALLOC_FREE(instance->sys_watch); + *instance = instances[num_instances-1]; + num_instances -= 1; ++ ++ for (i = 0; i < num_instances; i++) { ++ struct notifyd_instance *tmp = &instances[i]; ++ ++ tmp_filter |= tmp->instance.filter; ++ tmp_subdir_filter |= tmp->instance.subdir_filter; ++ } ++ ++ /* ++ * If the filter has changed, register a new watcher with the ++ * changed filter. ++ */ ++ if (watcher.filter != tmp_filter || ++ watcher.subdir_filter != tmp_subdir_filter) ++ { ++ watcher.filter = tmp_filter; ++ watcher.subdir_filter = tmp_subdir_filter; ++ ++ new_watcher = true; ++ } ++ } ++ ++ if (new_watcher) { ++ /* ++ * In case we removed all notify instances, we want to remove ++ * the watcher. We won't register a new one, if no filters are ++ * set anymore. ++ */ ++ ++ TALLOC_FREE(watcher.sys_watch); ++ ++ watcher.sys_filter = watcher.filter; ++ watcher.sys_subdir_filter = watcher.subdir_filter; ++ ++ /* ++ * Only register a watcher if we have filter. ++ */ ++ if (watcher.filter != 0 || watcher.subdir_filter != 0) { ++ int ret = sys_notify_watch(entries, ++ sys_notify_ctx, ++ path, ++ &watcher.sys_filter, ++ &watcher.sys_subdir_filter, ++ notifyd_sys_callback, ++ msg_ctx, ++ &watcher.sys_watch); ++ if (ret != 0) { ++ DBG_WARNING("sys_notify_watch for [%s] " ++ "returned %s\n", ++ path, ++ strerror(errno)); ++ } ++ } + } + + DBG_DEBUG("%s has %zu instances\n", path, num_instances); + + if (num_instances == 0) { ++ TALLOC_FREE(watcher.sys_watch); ++ + status = dbwrap_record_delete(rec); + if (!NT_STATUS_IS_OK(status)) { + DBG_WARNING("dbwrap_record_delete returned %s\n", +@@ -456,13 +541,21 @@ static bool notifyd_apply_rec_change( + goto fail; + } + } else { +- value = make_tdb_data( +- (uint8_t *)instances, +- sizeof(struct notifyd_instance) * num_instances); ++ struct TDB_DATA iov[2] = { ++ { ++ .dptr = (uint8_t *)&watcher, ++ .dsize = sizeof(struct notifyd_watcher), ++ }, ++ { ++ .dptr = (uint8_t *)instances, ++ .dsize = sizeof(struct notifyd_instance) * ++ num_instances, ++ }, ++ }; + +- status = dbwrap_record_store(rec, value, 0); ++ status = dbwrap_record_storev(rec, iov, ARRAY_SIZE(iov), 0); + if (!NT_STATUS_IS_OK(status)) { +- DBG_WARNING("dbwrap_record_store returned %s\n", ++ DBG_WARNING("dbwrap_record_storev returned %s\n", + nt_errstr(status)); + goto fail; + } +@@ -706,12 +799,18 @@ static void notifyd_trigger_parser(TDB_DATA key, TDB_DATA data, + .when = tstate->msg->when }; + struct iovec iov[2]; + size_t path_len = key.dsize; ++ struct notifyd_watcher watcher = {}; + struct notifyd_instance *instances = NULL; + size_t num_instances = 0; + size_t i; ++ bool ok; + +- if (!notifyd_parse_entry(data.dptr, data.dsize, &instances, +- &num_instances)) { ++ ok = notifyd_parse_entry(data.dptr, ++ data.dsize, ++ &watcher, ++ &instances, ++ &num_instances); ++ if (!ok) { + DBG_DEBUG("Could not parse notifyd_entry\n"); + return; + } +@@ -734,9 +833,11 @@ static void notifyd_trigger_parser(TDB_DATA key, TDB_DATA data, + + if (tstate->covered_by_sys_notify) { + if (tstate->recursive) { +- i_filter = instance->internal_subdir_filter; ++ i_filter = watcher.sys_subdir_filter & ++ instance->instance.subdir_filter; + } else { +- i_filter = instance->internal_filter; ++ i_filter = watcher.sys_filter & ++ instance->instance.filter; + } + } else { + if (tstate->recursive) { +@@ -1146,46 +1247,39 @@ static int notifyd_add_proxy_syswatches(struct db_record *rec, + struct db_context *db = dbwrap_record_get_db(rec); + TDB_DATA key = dbwrap_record_get_key(rec); + TDB_DATA value = dbwrap_record_get_value(rec); +- struct notifyd_instance *instances = NULL; +- size_t num_instances = 0; +- size_t i; ++ struct notifyd_watcher watcher = {}; + char path[key.dsize+1]; + bool ok; ++ int ret; + + memcpy(path, key.dptr, key.dsize); + path[key.dsize] = '\0'; + +- ok = notifyd_parse_entry(value.dptr, value.dsize, &instances, +- &num_instances); ++ /* This is a remote database, we just need the watcher. */ ++ ok = notifyd_parse_entry(value.dptr, value.dsize, &watcher, NULL, NULL); + if (!ok) { + DBG_WARNING("Could not parse notifyd entry for %s\n", path); + return 0; + } + +- for (i=0; iinstance.filter; +- uint32_t subdir_filter = instance->instance.subdir_filter; +- int ret; ++ watcher.sys_watch = NULL; ++ watcher.sys_filter = watcher.filter; ++ watcher.sys_subdir_filter = watcher.subdir_filter; + +- /* +- * This is a remote database. Pointers that we were +- * given don't make sense locally. Initialize to NULL +- * in case sys_notify_watch fails. +- */ +- instances[i].sys_watch = NULL; +- +- ret = state->sys_notify_watch( +- db, state->sys_notify_ctx, path, +- &filter, &subdir_filter, +- notifyd_sys_callback, state->msg_ctx, +- &instance->sys_watch); +- if (ret != 0) { +- DBG_WARNING("inotify_watch returned %s\n", +- strerror(errno)); +- } ++ ret = state->sys_notify_watch(db, ++ state->sys_notify_ctx, ++ path, ++ &watcher.filter, ++ &watcher.subdir_filter, ++ notifyd_sys_callback, ++ state->msg_ctx, ++ &watcher.sys_watch); ++ if (ret != 0) { ++ DBG_WARNING("inotify_watch returned %s\n", strerror(errno)); + } + ++ memcpy(value.dptr, &watcher, sizeof(struct notifyd_watcher)); ++ + return 0; + } + +@@ -1193,21 +1287,17 @@ static int notifyd_db_del_syswatches(struct db_record *rec, void *private_data) + { + TDB_DATA key = dbwrap_record_get_key(rec); + TDB_DATA value = dbwrap_record_get_value(rec); +- struct notifyd_instance *instances = NULL; +- size_t num_instances = 0; +- size_t i; ++ struct notifyd_watcher watcher = {}; + bool ok; + +- ok = notifyd_parse_entry(value.dptr, value.dsize, &instances, +- &num_instances); ++ ok = notifyd_parse_entry(value.dptr, value.dsize, &watcher, NULL, NULL); + if (!ok) { + DBG_WARNING("Could not parse notifyd entry for %.*s\n", + (int)key.dsize, (char *)key.dptr); + return 0; + } +- for (i=0; ientries database + */ + +-bool notifyd_parse_entry( +- uint8_t *buf, +- size_t buflen, +- struct notifyd_instance **instances, +- size_t *num_instances) ++/** ++ * @brief Parse a notifyd database entry. ++ * ++ * The memory we pass down needs to be aligned. If it isn't aligned we can run ++ * into obscure errors as we just point into the data buffer. ++ * ++ * @param data The data to parse ++ * @param data_len The length of the data to parse ++ * @param watcher A pointer to store the watcher data or NULL. ++ * @param instances A pointer to store the array of notify instances or NULL. ++ * @param pnum_instances The number of elements in the array. If you just want ++ * the number of elements pass NULL for the watcher and instances pointers. ++ * ++ * @return true on success, false if an error occurred. ++ */ ++bool notifyd_parse_entry(uint8_t *data, ++ size_t data_len, ++ struct notifyd_watcher *watcher, ++ struct notifyd_instance **instances, ++ size_t *pnum_instances) + { +- if ((buflen % sizeof(struct notifyd_instance)) != 0) { +- DBG_WARNING("invalid buffer size: %zu\n", buflen); ++ size_t ilen; ++ ++ if (data_len < sizeof(struct notifyd_watcher)) { + return false; + } + +- if (instances != NULL) { +- *instances = (struct notifyd_instance *)buf; ++ if (watcher != NULL) { ++ *watcher = *((struct notifyd_watcher *)(uintptr_t)data); + } +- if (num_instances != NULL) { +- *num_instances = buflen / sizeof(struct notifyd_instance); ++ ++ ilen = data_len - sizeof(struct notifyd_watcher); ++ if ((ilen % sizeof(struct notifyd_instance)) != 0) { ++ return false; ++ } ++ ++ if (pnum_instances != NULL) { ++ *pnum_instances = ilen / sizeof(struct notifyd_instance); + } ++ if (instances != NULL) { ++ /* The (uintptr_t) cast removes a warning from -Wcast-align. */ ++ *instances = ++ (struct notifyd_instance *)(uintptr_t) ++ (data + sizeof(struct notifyd_watcher)); ++ } ++ + return true; + } +diff --git a/source3/smbd/notifyd/notifyd_private.h b/source3/smbd/notifyd/notifyd_private.h +index 36c08f47c54..db8e6e1c005 100644 +--- a/source3/smbd/notifyd/notifyd_private.h ++++ b/source3/smbd/notifyd/notifyd_private.h +@@ -20,30 +20,48 @@ + #include "lib/util/server_id.h" + #include "notifyd.h" + ++ + /* +- * notifyd's representation of a notify instance ++ * Representation of a watcher for a path ++ * ++ * This will be stored in the db. + */ +-struct notifyd_instance { +- struct server_id client; +- struct notify_instance instance; +- +- void *sys_watch; /* inotify/fam/etc handle */ ++struct notifyd_watcher { ++ /* ++ * This is an intersections of the filter the watcher is listening for. ++ */ ++ uint32_t filter; ++ uint32_t subdir_filter; + + /* +- * Filters after sys_watch took responsibility of some bits ++ * Those are inout variables passed to the sys_watcher. The sys_watcher ++ * will remove the bits it can't handle. + */ +- uint32_t internal_filter; +- uint32_t internal_subdir_filter; ++ uint32_t sys_filter; ++ uint32_t sys_subdir_filter; ++ ++ /* The handle for inotify/fam etc. */ ++ void *sys_watch; ++}; ++ ++/* ++ * Representation of a notifyd instance ++ * ++ * This will be stored in the db. ++ */ ++struct notifyd_instance { ++ struct server_id client; ++ struct notify_instance instance; + }; + + /* + * Parse an entry in the notifyd_context->entries database + */ + +-bool notifyd_parse_entry( +- uint8_t *buf, +- size_t buflen, +- struct notifyd_instance **instances, +- size_t *num_instances); ++bool notifyd_parse_entry(uint8_t *data, ++ size_t data_len, ++ struct notifyd_watcher *watcher, ++ struct notifyd_instance **instances, ++ size_t *num_instances); + + #endif +-- +2.46.1 + diff --git a/samba.spec b/samba.spec index 67e3895..0de5d76 100644 --- a/samba.spec +++ b/samba.spec @@ -150,7 +150,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.21.0 +%global samba_version 4.21.1 # The release field is extended: # [.][.]%%{?dist}[.] @@ -252,10 +252,7 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore -Patch0: samba-4.21.0-backport-freeipa-support.patch -# https://gitlab.com/samba-team/samba/-/merge_requests/3807 -Patch1: samba-4.21.0-ldb-lmdb.patch -Patch2: samba-4-21-fix-libldb-deepbind.patch +Patch0: samba-4.21.0-s3-notifyd.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} diff --git a/sources b/sources index 3e8e284..a1c1a28 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.21.0.tar.xz) = d05c823afc04669766130745c139e7d129eb9961525453d6da8b5ee6693d4c08192496d07e5c211e86d553956504fb9df16611cc9268111b71b95c7f2fa868a0 -SHA512 (samba-4.21.0.tar.asc) = 7fffbd0b88b42dd7f340e4bcae17da4a68a0f8de86a1e71534a4a02a477a746e4cdb16df7c0da33aaf13278cefb452bd9b7c61ed029e248576f7158e8bec339e +SHA512 (samba-4.21.1.tar.xz) = 182759820708c9df26fbcb09e755e81236ecacf543f3e18a05dbd0ea551ab072d338fe239eb99ff506f158ec45e981a893ce46eacdde6e073ee85ceb43e2669a +SHA512 (samba-4.21.1.tar.asc) = 2c1e4b347044e15a852ced8bb412a3f372fd2c2b5e0001b1a773f7283f2d8fa62942143b46cbc3f16b18882255cf0aac4426002453971361b0002357657484f1 From 6c34873d0af189e14bf2747e9311178f8ccca4ef Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 15 Oct 2024 11:33:45 +0200 Subject: [PATCH 16/42] rpminspect: Disable inspection of disttag rpminspect just reads the file an doesn't expand it so it doesn't understand: Release: %{samba_release} [skip changelog] --- rpminspect.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/rpminspect.yaml b/rpminspect.yaml index 75d7856..c1455e2 100644 --- a/rpminspect.yaml +++ b/rpminspect.yaml @@ -1,4 +1,7 @@ --- +inspections: + disttag: off + badfuncs: ignore: - /usr/bin/nmblookup From 9bbdd0241ea9d9c8003ed7ae332951e49bfffcac Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 15 Oct 2024 11:57:41 +0200 Subject: [PATCH 17/42] Fix several rpminspect warnings --- samba.spec | 31 +++++++++++++++++++++++++++---- 1 file changed, 27 insertions(+), 4 deletions(-) diff --git a/samba.spec b/samba.spec index 0de5d76..e44cdd5 100644 --- a/samba.spec +++ b/samba.spec @@ -261,6 +261,7 @@ Requires: %{name}-common-tools = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-dcerpc = %{samba_depver} +Requires: libldb = %{samba_depver} Requires: libnetapi = %{samba_depver} %if %{with libwbclient} Requires(post): libwbclient = %{samba_depver} @@ -438,6 +439,7 @@ Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} +Requires: libldb = %{samba_depver} %if %{with libsmbclient} Requires: libsmbclient = %{samba_depver} %endif @@ -464,6 +466,7 @@ Summary: Samba client libraries Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} +Requires: libldb = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} %endif @@ -498,6 +501,7 @@ Summary: Libraries used by both Samba servers and clients Requires(pre): samba-common = %{samba_depver} Requires: samba-common = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} +Requires: libldb = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} %endif @@ -538,6 +542,7 @@ Requires: samba-common-libs = %{samba_depver} Requires: samba-client-libs = %{samba_depver} Requires: samba-libs = %{samba_depver} Requires: samba-ldb-ldap-modules = %{samba_depver} +Requires: libldb = %{samba_depver} Requires: libnetapi = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} @@ -574,6 +579,7 @@ Summary: DCE RPC binaries Requires: samba-common-libs = %{samba_depver} Requires: samba-client-libs = %{samba_depver} Requires: samba-libs = %{samba_depver} +Requires: libldb = %{samba_depver} Requires: libnetapi = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} @@ -634,6 +640,7 @@ Summary: Samba AD Domain Controller Libraries Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} +Requires: libldb = %{samba_depver} Provides: samba4-dc-libs = %{samba_depver} Obsoletes: samba4-dc-libs < %{samba_depver} @@ -654,6 +661,7 @@ Requires: %{name}-dc-libs = %{samba_depver} Requires: %{name}-dc = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: bind +Requires: libldb = %{samba_depver} Provides: bundled(libreplace) @@ -688,6 +696,7 @@ Summary: Samba VFS module for Ceph distributed storage system Requires: %{name} = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} +Requires: libldb = %{samba_depver} Provides: bundled(libreplace) @@ -703,6 +712,7 @@ Summary: Samba VFS module for io_uring Requires: %{name} = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} +Requires: libldb = %{samba_depver} Provides: bundled(libreplace) @@ -721,6 +731,7 @@ Requires: %{name} = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} +Requires: libldb = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} %endif @@ -772,6 +783,7 @@ the Kerberos credentials cache of the user issuing the print job. Summary: Samba ldap modules for ldb Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} +Requires: libldb = %{samba_depver} %description ldb-ldap-modules This package contains the ldb ldap modules required by samba-tool and @@ -782,6 +794,7 @@ samba-gpupdate. Summary: Samba libraries Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} +Requires: libldb = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} %endif @@ -802,6 +815,7 @@ Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} +Requires: libldb = %{samba_depver} %description -n libnetapi This contains the NETAPI library from the Samba suite. @@ -822,6 +836,7 @@ Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} +Requires: libldb = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} %endif @@ -879,6 +894,7 @@ Requires: python3-requests Requires: python3-talloc Requires: python3-tdb Requires: python3-tevent +Requires: libldb = %{samba_depver} %if %{with libsmbclient} Requires: libsmbclient = %{samba_depver} %endif @@ -909,6 +925,7 @@ Requires: %{name}-dc-libs = %{samba_depver} Requires: python3-%{name} = %{samba_depver} # for ms_forest_updates_markdown.py and ms_schema_markdown.py Requires: python3-markdown +Requires: libldb = %{samba_depver} %description -n python3-samba-dc The python3-%{name}-dc package contains the Python libraries needed by programs @@ -944,6 +961,7 @@ Requires: %{name}-test-libs = %{samba_depver} Requires: %{name}-dc-libs = %{samba_depver} %endif Requires: %{name}-libs = %{samba_depver} +Requires: libldb = %{samba_depver} Requires: libnetapi = %{samba_depver} %if %{with libsmbclient} Requires: libsmbclient = %{samba_depver} @@ -969,6 +987,7 @@ Summary: Libraries need by the testing tools for Samba servers and clients Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} +Requires: libldb = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} %endif @@ -1006,6 +1025,7 @@ Requires: %{name}-libs = %{samba_depver} Requires(post): %{name}-libs = %{samba_depver} Requires: %{name}-winbind-modules = %{samba_depver} Suggests: %{name}-tools = %{samba_depver} +Requires: libldb = %{samba_depver} %if %{with libwbclient} Requires(post): libwbclient = %{samba_depver} @@ -1034,6 +1054,7 @@ Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-winbind = %{samba_depver} +Requires: libldb = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} %endif @@ -1057,6 +1078,7 @@ Requires: %{name}-winbind = %{samba_depver} Requires: %{name}-libs = %{samba_depver} %endif Requires: samba-client-libs = %{samba_depver} +Requires: libldb = %{samba_depver} Provides: samba4-winbind-krb5-locator = %{samba_depver} Obsoletes: samba4-winbind-krb5-locator < %{samba_depver} @@ -1099,6 +1121,7 @@ Summary: Samba Winexe Windows Binary License: GPL-3.0-only Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} +Requires: libldb = %{samba_depver} Provides: bundled(libreplace) @@ -1219,8 +1242,8 @@ Requires: libtdb%{?_isa} >= %{tdb_version} Requires: libtevent%{?_isa} >= %{tevent_version} Provides: bundled(libreplace) -Obsoletes: libldb < 2.10 -Provides: libldb = 2.10 +Obsoletes: libldb < 0:2.10 +Provides: libldb = 0:2.10 Provides: libldb = %{samba_depver} %description -n libldb @@ -1236,8 +1259,8 @@ Requires: libtdb-devel%{?_isa} >= %{tdb_version} Requires: libtalloc-devel%{?_isa} >= %{talloc_version} Requires: libtevent-devel%{?_isa} >= %{tevent_version} -Obsoletes: libldb-devel < 2.10 -Provides: libldb-devel = 2.10 +Obsoletes: libldb-devel < 0:2.10 +Provides: libldb-devel = 0:2.10 Provides: libldb-devel = %{samba_depver} %description -n libldb-devel From 4c61ea4add2fdd3103bfda13e8d93e83fd79ab6d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 15 Oct 2024 13:19:08 +0200 Subject: [PATCH 18/42] Fix some more rpminspect warnings --- samba.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index e44cdd5..5258f94 100644 --- a/samba.spec +++ b/samba.spec @@ -1271,7 +1271,7 @@ Header files needed to develop programs that link against the LDB library. Summary: Tools to manage LDB files License: LGPL-3.0-or-later Requires: libldb%{?_isa} = %{samba_depver} -Obsoletes: ldb-tools < 2.10 +Obsoletes: ldb-tools < 0:2.10 Provides: ldb-tools = %{samba_depver} %description -n ldb-tools @@ -1285,7 +1285,7 @@ Requires: libldb%{?_isa} = %{samba_depver} Requires: python3-tdb%{?_isa} >= %{tdb_version} %{?python_provide:%python_provide python3-ldb} -Obsoletes: python3-ldb < 2.10 +Obsoletes: python3-ldb < 0:2.10 Provides: python3-ldb = %{samba_depver} # These were the C bindings, only used by Samba Obsoletes: python-ldb-devel-common < 2.10 From a1db4cc5abe4cd5a35063e2c4cd215f2f23d0384 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Wed, 16 Oct 2024 10:17:10 +0200 Subject: [PATCH 19/42] Fix even more rpminspect warnings --- samba.spec | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/samba.spec b/samba.spec index 5258f94..acaed49 100644 --- a/samba.spec +++ b/samba.spec @@ -641,6 +641,7 @@ Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: libldb = %{samba_depver} +Requires: libwbclient = %{samba_depver} Provides: samba4-dc-libs = %{samba_depver} Obsoletes: samba4-dc-libs < %{samba_depver} @@ -662,6 +663,7 @@ Requires: %{name}-dc = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: bind Requires: libldb = %{samba_depver} +Requires: libwbclient = %{samba_depver} Provides: bundled(libreplace) @@ -697,6 +699,7 @@ Requires: %{name} = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: libldb = %{samba_depver} +Requires: libwbclient = %{samba_depver} Provides: bundled(libreplace) @@ -713,6 +716,7 @@ Requires: %{name} = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: libldb = %{samba_depver} +Requires: libwbclient = %{samba_depver} Provides: bundled(libreplace) @@ -784,6 +788,7 @@ Summary: Samba ldap modules for ldb Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: libldb = %{samba_depver} +Requires: libwbclient = %{samba_depver} %description ldb-ldap-modules This package contains the ldb ldap modules required by samba-tool and @@ -816,6 +821,7 @@ Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: libldb = %{samba_depver} +Requires: libwbclient = %{samba_depver} %description -n libnetapi This contains the NETAPI library from the Samba suite. @@ -926,6 +932,7 @@ Requires: python3-%{name} = %{samba_depver} # for ms_forest_updates_markdown.py and ms_schema_markdown.py Requires: python3-markdown Requires: libldb = %{samba_depver} +Requires: libwbclient = %{samba_depver} %description -n python3-samba-dc The python3-%{name}-dc package contains the Python libraries needed by programs @@ -1122,6 +1129,7 @@ License: GPL-3.0-only Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: libldb = %{samba_depver} +Requires: libwbclient = %{samba_depver} Provides: bundled(libreplace) @@ -1283,6 +1291,7 @@ Summary: Python bindings for the LDB library License: LGPL-3.0-or-later Requires: libldb%{?_isa} = %{samba_depver} Requires: python3-tdb%{?_isa} >= %{tdb_version} +Requires: samba-client-libs = %{samba_depver} %{?python_provide:%python_provide python3-ldb} Obsoletes: python3-ldb < 0:2.10 From 4605e2b34afd9dec51856fe1244b089e690c7ea9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Thu, 17 Oct 2024 11:39:31 +0200 Subject: [PATCH 20/42] Revert "Re-enable linking with mold on i686" This reverts commit ac58d580e8ff60046b6600a1f6c843391ae1ffdd. This is to address debuginfo issue reported by rpminspect for i686: https://bugzilla.redhat.com/show_bug.cgi?id=2318727 --- samba.spec | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index acaed49..4001c34 100644 --- a/samba.spec +++ b/samba.spec @@ -353,7 +353,7 @@ BuildRequires: zlib-devel >= 1.2.3 BuildRequires: pkgconfig(libsystemd) -%ifnarch riscv64 +%ifnarch i686 riscv64 %if 0%{?fedora} >= 37 BuildRequires: mold %endif @@ -1365,13 +1365,13 @@ export python_LDFLAGS="$(echo %{__global_ldflags} | sed -e 's/-Wl,-z,defs//g')" # Use the mold linker if possible export python_LDFLAGS="$(echo %{__global_ldflags} | sed -e 's/-Wl,-z,defs//g')" -%ifnarch riscv64 +%ifnarch i686 riscv64 %if 0%{?fedora} >= 37 export LDFLAGS="%{__global_ldflags} -fuse-ld=mold" export python_LDFLAGS="$(echo ${LDFLAGS} | sed -e 's/-Wl,-z,defs//g')" #endif fedora >= 37 %endif -#endif narch riscv64 +#endif narch i686 %endif # Add support for mock ccache plugin From 302f30bcdef96e2dc91b8738556c22f5dede1cf2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 22 Oct 2024 11:02:58 +0200 Subject: [PATCH 21/42] Fix samba 4.20 -> 4.21 upgrade for the removed python3-samba-devel --- samba.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/samba.spec b/samba.spec index 4001c34..cee1bec 100644 --- a/samba.spec +++ b/samba.spec @@ -685,6 +685,8 @@ Requires: libnetapi = %{samba_depver} Provides: samba4-devel = %{samba_depver} Obsoletes: samba4-devel < %{samba_depver} +Provides: python3-samba-devel = %{samba_depver} +Obsoletes: python3-samba-devel < %{samba_depver} %description devel The %{name}-devel package contains the header files for the libraries From b0aafc1e0d7679905c01823c9cf7ae385edcf080 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 25 Nov 2024 18:55:39 +0100 Subject: [PATCH 22/42] Update to version 4.21.2 - resolves: rhbz#2328717 --- samba.spec | 11 +++++++++-- sources | 4 ++-- 2 files changed, 11 insertions(+), 4 deletions(-) diff --git a/samba.spec b/samba.spec index cee1bec..6d68525 100644 --- a/samba.spec +++ b/samba.spec @@ -150,7 +150,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.21.1 +%global samba_version 4.21.2 # The release field is extended: # [.][.]%%{?dist}[.] @@ -1588,6 +1588,12 @@ cp -a lib/ldb/apidocs/man/* %{buildroot}%{_mandir} rm -f %{buildroot}%{_mandir}/man3/_* rm -f %{buildroot}%{_mandir}/man3/PyLdb* +# CTDB +%if %{with clustering} +touch %{buildroot}%{_libexecdir}/ctdb/statd_callout +#endif with clustering +%endif + %if %{with testsuite} %check # @@ -2644,6 +2650,7 @@ fi %{python3_sitearch}/samba/dcerpc/ntlmssp.*.so %{python3_sitearch}/samba/dcerpc/preg.*.so %{python3_sitearch}/samba/dcerpc/samr.*.so +%{python3_sitearch}/samba/dcerpc/schannel.*.so %{python3_sitearch}/samba/dcerpc/security.*.so %{python3_sitearch}/samba/dcerpc/server_id.*.so %{python3_sitearch}/samba/dcerpc/smb_acl.*.so @@ -3813,7 +3820,7 @@ fi %{_sysconfdir}/ctdb/functions %{_sysconfdir}/ctdb/nfs-linux-kernel-callout -%{_sysconfdir}/ctdb/statd-callout +%ghost %{_sysconfdir}/ctdb/statd-callout # CTDB scripts, no config files # script with executable bit means activated diff --git a/sources b/sources index a1c1a28..285808c 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.21.1.tar.xz) = 182759820708c9df26fbcb09e755e81236ecacf543f3e18a05dbd0ea551ab072d338fe239eb99ff506f158ec45e981a893ce46eacdde6e073ee85ceb43e2669a -SHA512 (samba-4.21.1.tar.asc) = 2c1e4b347044e15a852ced8bb412a3f372fd2c2b5e0001b1a773f7283f2d8fa62942143b46cbc3f16b18882255cf0aac4426002453971361b0002357657484f1 +SHA512 (samba-4.21.2.tar.xz) = c26311a60d3994561aa12c36e54bc37d1161ec1063aa9876ea03dee24984e9c827e5836dc86bc392e37193010275a642b960e775b5a9e029246ba56ae1697682 +SHA512 (samba-4.21.2.tar.asc) = f3da123d2e86a7e07c4fcb83924edd29195d865091d80125f3531c463662a8a38ba6d8c467932af8cd065d0cc4467131c83a4e3783573b757f6ed9c2bde0befc From 81247ae725765a9df95f19bd83b5901d3174697c Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 26 Nov 2024 14:52:12 +0100 Subject: [PATCH 23/42] Add python3-crypt-r as requirement for samba-tool --- samba.spec | 3 +++ 1 file changed, 3 insertions(+) diff --git a/samba.spec b/samba.spec index 6d68525..3348ee6 100644 --- a/samba.spec +++ b/samba.spec @@ -567,6 +567,9 @@ Requires: lmdb %endif Requires: tdb-tools Requires: python3-gpg +# The `crypt` module has been removed in Python 3.13, this is a copy +# See also python3-crypt-r.x86_64 +Requires: python3-crypt-r %endif %description tools From 39a4587665e78c49aa7705f795499ad2040e03b1 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 27 Nov 2024 17:45:39 +0100 Subject: [PATCH 24/42] Add missing BuildRequires for running the testsuite [skip changelog] --- samba.spec | 32 +++++++++++++++++++++++++++++++- 1 file changed, 31 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 3348ee6..3915b53 100644 --- a/samba.spec +++ b/samba.spec @@ -421,6 +421,36 @@ BuildRequires: tdb-tools %endif #endif with dc || with testsuite + +%if %{with testsuite} +BuildRequires: bind-utils +BuildRequires: glibc-langpack-en +BuildRequires: git +BuildRequires: gnutls-utils +BuildRequires: jq +BuildRequires: krb5-pkinit +BuildRequires: krb5-workstation +BuildRequires: lmdb +BuildRequires: nss_wrapper +BuildRequires: pam_wrapper +BuildRequires: perl-Archive-Tar +BuildRequires: perl-Digest-MD5 +BuildRequires: perl-ExtUtils-MakeMaker +BuildRequires: perl-JSON +BuildRequires: perl-JSON-Parse +BuildRequires: perl-Parse-Yapp +BuildRequires: perl-Test-Base +BuildRequires: psmisc +BuildRequires: python3-libpamtest +# The `crypt` module has been removed in Python 3.13, this is a copy +# See also https://bugzilla.samba.org/show_bug.cgi?id=15756 +BuildRequires: python3-crypt-r +BuildRequires: resolv_wrapper +BuildRequires: rsync +BuildRequires: socket_wrapper +BuildRequires: sudo +BuildRequires: uid_wrapper +#endif with testsuite %endif # filter out perl requirements pulled in from examples in the docdir. @@ -568,7 +598,7 @@ Requires: lmdb Requires: tdb-tools Requires: python3-gpg # The `crypt` module has been removed in Python 3.13, this is a copy -# See also python3-crypt-r.x86_64 +# See also https://bugzilla.samba.org/show_bug.cgi?id=15756 Requires: python3-crypt-r %endif From 338a7f2577534826866f6eab9aeb535877b58c2e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 27 Nov 2024 17:48:35 +0100 Subject: [PATCH 25/42] Rework 'with testsuite' In case we run the testsuite, the %install part will be skipped. Without the testsuite, the %check section will be skipped. [skip changelog] --- samba.spec | 896 ++--------------------------------------------------- 1 file changed, 21 insertions(+), 875 deletions(-) diff --git a/samba.spec b/samba.spec index 3915b53..a505e41 100644 --- a/samba.spec +++ b/samba.spec @@ -402,7 +402,7 @@ BuildRequires: libtdb-devel >= %{tdb_version} BuildRequires: python3-tdb >= %{tdb_version} %endif -%if %{with dc} || %{with testsuite} +%if %{with dc} BuildRequires: bind BuildRequires: krb5-server >= %{required_mit_krb5} %if 0%{?fedora} || 0%{?rhel} >= 9 @@ -420,7 +420,8 @@ BuildRequires: tdb-tools #endif without includelibs %endif -#endif with dc || with testsuite +#endif with dc +%endif %if %{with testsuite} BuildRequires: bind-utils @@ -1210,30 +1211,6 @@ projects to store temporary data. If an application is already using TDB for temporary data it is very easy to convert that application to be cluster aware and use CTDB instead. -%if %{with testsuite} -### CTDB-TEST -%package -n ctdb-tests -Summary: CTDB clustered database test suite - -Requires: %{name}-common-libs = %{samba_depver} -Requires: %{name}-client-libs = %{samba_depver} - -Requires: ctdb = %{samba_depver} -Recommends: nc - -Provides: ctdb-devel = %{samba_depver} -Obsoletes: ctdb-devel < %{samba_depver} - -%description -n ctdb-tests -Test suite for CTDB. -CTDB is a cluster implementation of the TDB database used by Samba and other -projects to store temporary data. If an application is already using TDB for -temporary data it is very easy to convert that application to be cluster aware -and use CTDB instead. - -#endif with testsuite -%endif - %if %{with pcp_pmda} %package -n ctdb-pcp-pmda @@ -1485,6 +1462,7 @@ doxygen Doxyfile popd %install +%if !%{with testsuite} # Do not use %%make_install, make is just a wrapper around waf in Samba! %{__make} %{?_smp_mflags} %{_make_verbose} install DESTDIR=%{buildroot} @@ -1627,8 +1605,11 @@ touch %{buildroot}%{_libexecdir}/ctdb/statd_callout #endif with clustering %endif -%if %{with testsuite} +#endif !with testsuite +%endif + %check +%if %{with testsuite} # # samba3.smb2.timestamps.*: # @@ -1652,6 +1633,7 @@ export WINBINDD_DONT_LOG_STDOUT=1 #endif with testsuite %endif +%if !%{with testsuite} %post %systemd_post samba-bgqd.service %systemd_post smb.service @@ -1695,7 +1677,7 @@ fi %ldconfig_scriptlets common-libs -%if %{with dc} || %{with testsuite} +%if %{with dc} %ldconfig_scriptlets dc-libs %post dc @@ -1797,7 +1779,7 @@ fi %{_sbindir}/eventlogadm %{_sbindir}/nmbd %{_sbindir}/smbd -%if %{with dc} || %{with testsuite} +%if %{with dc} # This is only used by vfs_dfs_samba4 %{_libdir}/samba/libdfs-server-ad-private-samba.so %endif @@ -1815,7 +1797,7 @@ fi %{_libdir}/samba/vfs/commit.so %{_libdir}/samba/vfs/crossrename.so %{_libdir}/samba/vfs/default_quota.so -%if %{with dc} || %{with testsuite} +%if %{with dc} %{_libdir}/samba/vfs/dfs_samba4.so %endif %{_libdir}/samba/vfs/dirsort.so @@ -1848,10 +1830,6 @@ fi %{_libdir}/samba/vfs/worm.so %{_libdir}/samba/vfs/xattr_tdb.so -%if %{with testsuite} -%{_libdir}/samba/vfs/nfs4acl_xattr.so -%endif - %dir %{_libexecdir}/samba %{_libexecdir}/samba/samba-bgqd @@ -2183,16 +2161,13 @@ fi %{_libexecdir}/samba/rpcd_fsrvp %{_libexecdir}/samba/rpcd_lsad %{_libexecdir}/samba/rpcd_mdssvc -%if %{with testsuite} -%{_libexecdir}/samba/rpcd_rpcecho -%endif %{_libexecdir}/samba/rpcd_spoolss %{_libexecdir}/samba/rpcd_winreg %{_libexecdir}/samba/rpcd_witness %{_mandir}/man8/samba-dcerpcd.8* ### DC -%if %{with dc} || %{with testsuite} +%if %{with dc} %files dc %{_unitdir}/samba.service %{_sbindir}/samba @@ -2270,7 +2245,7 @@ fi %license source4/setup/ad-schema/licence.txt %{_datadir}/samba/setup -#endif with dc || with testsuite +#endif with dc %endif ### DC-LIBS %files dc-libs @@ -2278,16 +2253,12 @@ fi %{_libdir}/samba/libauth4-private-samba.so %{_libdir}/samba/libsamba-net-private-samba.so -%if %{with dc} || %{with testsuite} +%if %{with dc} %{_libdir}/samba/libdb-glue-private-samba.so %{_libdir}/samba/libpac-private-samba.so %{_libdir}/samba/libprocess-model-private-samba.so %{_libdir}/samba/libservice-private-samba.so -%if %{with testsuite} -%{_libdir}/samba/libntvfs-private-samba.so -%endif - %dir %{_libdir}/samba/process_model %{_libdir}/samba/process_model/prefork.so %{_libdir}/samba/process_model/standard.so @@ -2306,10 +2277,6 @@ fi %{_libdir}/samba/service/winbindd.so %{_libdir}/samba/service/wrepl.so -%if %{with testsuite} -%{_libdir}/samba/service/smb.so -%endif - %{_libdir}/libdcerpc-server.so.* %{_libdir}/samba/libad-claims-private-samba.so %{_libdir}/samba/libauthn-policy-util-private-samba.so @@ -2444,7 +2411,7 @@ fi %{_libdir}/libsamba-policy.so %{_libdir}/libsmbldap.so -%if %{with dc} || %{with testsuite} +%if %{with dc} %{_includedir}/samba-4.0/dcerpc_server.h %{_libdir}/libdcerpc-server.so %{_libdir}/pkgconfig/dcerpc_server.pc @@ -3130,7 +3097,7 @@ fi %{python3_sitearch}/samba/__pycache__/uptodateness.*.pyc %{python3_sitearch}/samba/dcerpc/dnsserver.*.so -%if %{with dc} || %{with testsuite} +%if %{with dc} %{python3_sitearch}/samba/dckeytab.*.so %endif %{python3_sitearch}/samba/domain_update.py @@ -3774,21 +3741,12 @@ fi %{_mandir}/man1/ndrdump.1* %{_mandir}/man1/smbtorture.1* -%if %{with testsuite} -%{_mandir}/man1/vfstest.1* -# files to ignore in testsuite mode -%{_libdir}/samba/libnss-wrapper.so -%{_libdir}/samba/libsocket-wrapper.so -%{_libdir}/samba/libuid-wrapper.so -%endif - ### TEST-LIBS %files test-libs -%if %{with dc} || %{with testsuite} +%if %{with dc} %{_libdir}/samba/libdlz-bind9-for-torture-private-samba.so -%else -%{_libdir}/samba/libdsdb-module-private-samba.so %endif +%{_libdir}/samba/libdsdb-module-private-samba.so ### USERSHARES %files usershares @@ -3944,820 +3902,6 @@ fi %dir %{_datadir}/ctdb/scripts %{_datadir}/ctdb/scripts/winbind_ctdb_updatekeytab.sh -%if %{with testsuite} -%files -n ctdb-tests -%doc ctdb/tests/README -%{_bindir}/ctdb_local_daemons -%{_bindir}/ctdb_run_tests -%{_bindir}/ctdb_run_cluster_tests - -%dir %{_libexecdir}/ctdb -%dir %{_libexecdir}/ctdb/tests -%{_libexecdir}/ctdb/tests/cluster_mutex_test -%{_libexecdir}/ctdb/tests/cmdline_test -%{_libexecdir}/ctdb/tests/comm_client_test -%{_libexecdir}/ctdb/tests/comm_server_test -%{_libexecdir}/ctdb/tests/comm_test -%{_libexecdir}/ctdb/tests/conf_test -%{_libexecdir}/ctdb/tests/ctdb-db-test -%{_libexecdir}/ctdb/tests/ctdb_io_test -%{_libexecdir}/ctdb/tests/ctdb_packet_parse -%{_libexecdir}/ctdb/tests/ctdb_takeover_tests -%{_libexecdir}/ctdb/tests/db_hash_test -%{_libexecdir}/ctdb/tests/dummy_client -%{_libexecdir}/ctdb/tests/errcode -%{_libexecdir}/ctdb/tests/event_protocol_test -%{_libexecdir}/ctdb/tests/event_script_test -%{_libexecdir}/ctdb/tests/fake_ctdbd -%{_libexecdir}/ctdb/tests/fetch_loop -%{_libexecdir}/ctdb/tests/fetch_loop_key -%{_libexecdir}/ctdb/tests/fetch_readonly -%{_libexecdir}/ctdb/tests/fetch_readonly_loop -%{_libexecdir}/ctdb/tests/fetch_ring -%{_libexecdir}/ctdb/tests/g_lock_loop -%{_libexecdir}/ctdb/tests/hash_count_test -%{_libexecdir}/ctdb/tests/line_test -%{_libexecdir}/ctdb/tests/lock_tdb -%{_libexecdir}/ctdb/tests/message_ring -%{_libexecdir}/ctdb/tests/pidfile_test -%{_libexecdir}/ctdb/tests/pkt_read_test -%{_libexecdir}/ctdb/tests/pkt_write_test -%{_libexecdir}/ctdb/tests/porting_tests -%{_libexecdir}/ctdb/tests/protocol_basic_test -%{_libexecdir}/ctdb/tests/protocol_ctdb_compat_test -%{_libexecdir}/ctdb/tests/protocol_ctdb_test -%{_libexecdir}/ctdb/tests/protocol_types_compat_test -%{_libexecdir}/ctdb/tests/protocol_types_test -%{_libexecdir}/ctdb/tests/protocol_util_test -%{_libexecdir}/ctdb/tests/rb_test -%{_libexecdir}/ctdb/tests/reqid_test -%{_libexecdir}/ctdb/tests/run_event_test -%{_libexecdir}/ctdb/tests/run_proc_test -%{_libexecdir}/ctdb/tests/sigcode -%{_libexecdir}/ctdb/tests/sock_daemon_test -%{_libexecdir}/ctdb/tests/sock_io_test -%{_libexecdir}/ctdb/tests/srvid_test -%{_libexecdir}/ctdb/tests/system_socket_test -%{_libexecdir}/ctdb/tests/tmon_ping_test -%{_libexecdir}/ctdb/tests/tmon_test -%{_libexecdir}/ctdb/tests/transaction_loop -%{_libexecdir}/ctdb/tests/tunable_test -%{_libexecdir}/ctdb/tests/tunnel_cmd -%{_libexecdir}/ctdb/tests/tunnel_test -%{_libexecdir}/ctdb/tests/update_record -%{_libexecdir}/ctdb/tests/update_record_persistent - -%dir %{_datadir}/ctdb/tests -%dir %{_datadir}/ctdb/tests/CLUSTER -%dir %{_datadir}/ctdb/tests/CLUSTER/complex -%{_datadir}/ctdb/tests/CLUSTER/complex/11_ctdb_delip_removes_ip.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/18_ctdb_reloadips.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/30_nfs_tickle_killtcp.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/31_nfs_tickle.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/32_cifs_tickle.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/33_gratuitous_arp.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/34_nfs_tickle_restart.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/36_smb_reset_server.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/37_nfs_reset_server.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/41_failover_ping_discrete.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/42_failover_ssh_hostname.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/43_failover_nfs_basic.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/44_failover_nfs_oneway.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/45_failover_nfs_kill.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/60_rogueip_releaseip.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/61_rogueip_takeip.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/README - -%dir %{_datadir}/ctdb/tests/CLUSTER/complex/scripts -%{_datadir}/ctdb/tests/CLUSTER/complex/scripts/local.bash - -%dir %{_datadir}/ctdb/tests/etc-ctdb -%dir %{_datadir}/ctdb/tests/etc-ctdb/events -%dir %{_datadir}/ctdb/tests/etc-ctdb/events/legacy -%{_datadir}/ctdb/tests/etc-ctdb/events/legacy/00.test.script -%dir %{_datadir}/ctdb/tests/INTEGRATION -%dir %{_datadir}/ctdb/tests/INTEGRATION/database -%{_datadir}/ctdb/tests/INTEGRATION/database/basics.001.attach.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/basics.002.attach.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/basics.003.detach.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/basics.004.wipe.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/basics.010.backup_restore.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/fetch.001.ring.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/fetch.002.ring-hotkeys.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/readonly.001.basic.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/recovery.001.volatile.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/recovery.002.large.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/recovery.003.no_resurrect.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/recovery.010.persistent.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/recovery.011.continue.sh -%dir %{_datadir}/ctdb/tests/INTEGRATION/database/scripts -%{_datadir}/ctdb/tests/INTEGRATION/database/scripts/local.bash -%{_datadir}/ctdb/tests/INTEGRATION/database/transaction.001.ptrans.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/transaction.002.loop.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/transaction.003.loop_recovery.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/transaction.004.update_record.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/transaction.010.loop_recovery.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/traverse.001.one.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/traverse.002.many.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/vacuum.001.fast.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/vacuum.002.full.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/vacuum.003.recreate.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/vacuum.030.locked.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/vacuum.031.locked.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/vacuum.032.locked.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/vacuum.033.locked.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/vacuum.034.locked.sh -%dir %{_datadir}/ctdb/tests/INTEGRATION/failover -%{_datadir}/ctdb/tests/INTEGRATION/failover/pubips.001.list.sh -%{_datadir}/ctdb/tests/INTEGRATION/failover/pubips.010.addip.sh -%{_datadir}/ctdb/tests/INTEGRATION/failover/pubips.011.delip.sh -%{_datadir}/ctdb/tests/INTEGRATION/failover/pubips.012.reloadips.sh -%{_datadir}/ctdb/tests/INTEGRATION/failover/pubips.013.failover_noop.sh -%{_datadir}/ctdb/tests/INTEGRATION/failover/pubips.014.iface_gc.sh -%{_datadir}/ctdb/tests/INTEGRATION/failover/pubips.020.moveip.sh -%{_datadir}/ctdb/tests/INTEGRATION/failover/pubips.030.disable_enable.sh -%{_datadir}/ctdb/tests/INTEGRATION/failover/pubips.032.stop_continue.sh -%{_datadir}/ctdb/tests/INTEGRATION/failover/pubips.040.NoIPTakeover.sh -%{_datadir}/ctdb/tests/INTEGRATION/failover/pubips.050.missing_ip.sh -%dir %{_datadir}/ctdb/tests/INTEGRATION/simple -%{_datadir}/ctdb/tests/INTEGRATION/simple/basics.000.onnode.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/basics.001.listnodes.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/basics.002.tunables.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/basics.003.ping.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/basics.004.getpid.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/basics.005.process_exists.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/basics.010.statistics.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/basics.011.statistics_reset.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.001.stop_leader_yield.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.002.ban_leader_yield.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.003.capability_leader_yield.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.006.stop_leader_yield_no_lock.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.007.ban_leader_yield_no_lock.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.008.capability_leader_yield_no_lock.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.010.getrelock.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.012.reclock_command.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.015.reclock_remove_lock.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.016.reclock_move_lock_dir.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.020.message_ring.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.021.tunnel_ring.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.030.node_stall_leader_timeout.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.090.unreachable.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.091.version_check.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/debug.001.getdebug.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/debug.002.setdebug.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/debug.003.dumpmemory.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/eventscripts.001.zero_scripts.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/eventscripts.090.debug_hung.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/README -%dir %{_datadir}/ctdb/tests/scripts -%{_datadir}/ctdb/tests/scripts/cluster.bash -%{_datadir}/ctdb/tests/scripts/common.sh -%{_datadir}/ctdb/tests/scripts/integration.bash -%{_datadir}/ctdb/tests/scripts/integration_local_daemons.bash -%{_datadir}/ctdb/tests/scripts/integration_real_cluster.bash -%{_datadir}/ctdb/tests/scripts/script_install_paths.sh -%{_datadir}/ctdb/tests/scripts/test_wrap -%{_datadir}/ctdb/tests/scripts/unit.sh -%dir %{_datadir}/ctdb/tests/UNIT -%dir %{_datadir}/ctdb/tests/UNIT/cunit -%{_datadir}/ctdb/tests/UNIT/cunit/cluster_mutex_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/cluster_mutex_002.sh -%{_datadir}/ctdb/tests/UNIT/cunit/cluster_mutex_003.sh -%{_datadir}/ctdb/tests/UNIT/cunit/cmdline_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/comm_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/comm_test_002.sh -%{_datadir}/ctdb/tests/UNIT/cunit/conf_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/config_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/config_test_002.sh -%{_datadir}/ctdb/tests/UNIT/cunit/config_test_003.sh -%{_datadir}/ctdb/tests/UNIT/cunit/config_test_004.sh -%{_datadir}/ctdb/tests/UNIT/cunit/config_test_005.sh -%{_datadir}/ctdb/tests/UNIT/cunit/config_test_006.sh -%{_datadir}/ctdb/tests/UNIT/cunit/config_test_007.sh -%{_datadir}/ctdb/tests/UNIT/cunit/ctdb_io_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/db_hash_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/event_protocol_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/event_script_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/hash_count_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/line_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/path_tests_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/pidfile_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/pkt_read_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/pkt_write_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/porting_tests_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/protocol_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/protocol_test_002.sh -%{_datadir}/ctdb/tests/UNIT/cunit/protocol_test_012.sh -%{_datadir}/ctdb/tests/UNIT/cunit/protocol_test_101.sh -%{_datadir}/ctdb/tests/UNIT/cunit/protocol_test_111.sh -%{_datadir}/ctdb/tests/UNIT/cunit/protocol_test_201.sh -%{_datadir}/ctdb/tests/UNIT/cunit/rb_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/reqid_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/run_event_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/run_proc_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/sock_daemon_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/sock_io_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/srvid_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/system_socket_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/system_socket_test_002.sh -%{_datadir}/ctdb/tests/UNIT/cunit/system_socket_test_003.sh -%{_datadir}/ctdb/tests/UNIT/cunit/tmon_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/tmon_test_002.sh -%{_datadir}/ctdb/tests/UNIT/cunit/tunable_test_001.sh -%dir %{_datadir}/ctdb/tests/UNIT/eventd -%dir %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/ctdb.conf -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/debug-script.sh -%dir %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events -%dir %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/data -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/data/03.notalink.script -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/data/README -%dir %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/empty -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/empty/README -%dir %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/multi -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/multi/01.test.script -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/multi/02.test.script -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/multi/03.test.script -%dir %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/random -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/random/01.disabled.script -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/random/02.enabled.script -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/random/a.script -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/random/README.script -%dir %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/share -%dir %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/share/events -%dir %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/share/events/data -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/share/events/data/01.dummy.script -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/share/events/data/02.disabled.script -%dir %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/share/events/empty -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/share/events/empty/README -%dir %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/share/events/random -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/share/events/random/01.disabled.script -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/share/events/random/02.enabled.script -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/share/events/random/a.script -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/share/events/random/README.script -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_001.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_002.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_003.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_004.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_005.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_006.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_007.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_008.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_009.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_011.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_012.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_013.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_014.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_021.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_022.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_023.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_024.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_031.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_032.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_033.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_041.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_042.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_043.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_044.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_051.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_052.sh -%{_datadir}/ctdb/tests/UNIT/eventd/README -%dir %{_datadir}/ctdb/tests/UNIT/eventd/scripts -%{_datadir}/ctdb/tests/UNIT/eventd/scripts/local.sh -%dir %{_datadir}/ctdb/tests/UNIT/eventscripts -%{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.init.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.init.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.init.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.init.004.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.init.005.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.init.006.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.init.007.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.init.008.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.init.009.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/01.reclock.init.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/01.reclock.init.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/01.reclock.init.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.004.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.005.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.006.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.007.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.011.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.012.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.014.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.015.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.017.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.018.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/06.nfs.releaseip.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/06.nfs.releaseip.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/06.nfs.takeip.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/06.nfs.takeip.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.010.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.011.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.012.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.013.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.init.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.init.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.init.021.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.init.022.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.init.023.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.004.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.005.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.006.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.009.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.010.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.011.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.012.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.013.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.014.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.015.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.016.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.017.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.018.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.multi.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.releaseip.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.releaseip.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.startup.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.startup.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.takeip.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.takeip.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.takeip.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.004.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.011.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.012.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.013.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.014.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.015.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.021.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.022.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.023.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.024.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.025.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.031.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.041.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.042.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.051.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.052.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.053.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.054.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.004.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.005.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.006.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.007.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.008.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.009.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.010.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.011.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.012.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.013.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.014.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.015.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.016.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.017.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.018.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.019.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.021.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.022.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.023.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.024.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/20.multipathd.monitor.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/20.multipathd.monitor.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/20.multipathd.monitor.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/20.multipathd.monitor.004.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/31.clamd.monitor.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/31.clamd.monitor.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/40.vsftpd.monitor.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/40.vsftpd.shutdown.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/40.vsftpd.startup.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/41.httpd.monitor.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/41.httpd.shutdown.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/41.httpd.startup.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/48.netbios.shutdown.011.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/48.netbios.startup.011.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/49.winbind.monitor.101.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/49.winbind.monitor.102.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/49.winbind.shutdown.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/49.winbind.startup.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.monitor.101.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.monitor.103.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.monitor.104.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.monitor.105.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.monitor.106.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.monitor.110.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.monitor.111.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.monitor.112.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.monitor.113.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.shutdown.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.shutdown.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.shutdown.011.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.startup.011.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.101.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.102.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.103.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.104.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.105.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.106.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.107.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.108.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.109.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.111.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.112.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.113.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.114.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.121.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.122.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.131.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.132.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.141.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.142.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.143.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.144.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.151.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.152.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.153.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.161.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.162.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.multi.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.multi.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.releaseip.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.releaseip.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.shutdown.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.shutdown.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.startup.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.startup.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.takeip.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.takeip.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.ipreallocated.011.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.ipreallocated.012.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.ipreallocated.013.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.ipreallocated.014.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.monitor.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.monitor.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.monitor.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.shutdown.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.shutdown.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.startup.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.startup.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.004.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.005.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.006.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.007.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.008.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.021.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.022.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.023.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.024.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.025.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.026.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.027.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.028.sh -%dir %{_datadir}/ctdb/tests/UNIT/eventscripts/etc -%dir %{_datadir}/ctdb/tests/UNIT/eventscripts/etc-ctdb -%{_datadir}/ctdb/tests/UNIT/eventscripts/etc-ctdb/public_addresses -%{_datadir}/ctdb/tests/UNIT/eventscripts/etc-ctdb/rc.local -%dir %{_datadir}/ctdb/tests/UNIT/eventscripts/etc/init.d -%{_datadir}/ctdb/tests/UNIT/eventscripts/etc/init.d/nfs -%{_datadir}/ctdb/tests/UNIT/eventscripts/etc/init.d/nfslock -%dir %{_datadir}/ctdb/tests/UNIT/eventscripts/etc/samba -%{_datadir}/ctdb/tests/UNIT/eventscripts/etc/samba/smb.conf -%dir %{_datadir}/ctdb/tests/UNIT/eventscripts/etc/sysconfig -%{_datadir}/ctdb/tests/UNIT/eventscripts/etc/sysconfig/nfs -%{_datadir}/ctdb/tests/UNIT/eventscripts/README -%dir %{_datadir}/ctdb/tests/UNIT/eventscripts/scripts -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/00.ctdb.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/01.reclock.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/05.system.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/06.nfs.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/10.interface.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/11.natgw.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/13.per_ip_routing.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/20.multipathd.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/31.clamd.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/40.vsftpd.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/41.httpd.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/48.netbios.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/49.winbind.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/50.samba.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/60.nfs.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/91.lvs.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/debug_locks.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/local.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/statd-callout.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/statd-callout.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/statd-callout.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/statd-callout.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/statd-callout.004.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/statd-callout.005.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/statd-callout.006.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/statd-callout.007.sh -%dir %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ctdb -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ctdb-config -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ctdb_killtcp -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ctdb_lvs -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ctdb_natgw -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/date -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/df -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ethtool -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/exportfs -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/gstack -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/id -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ip -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ip6tables -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/iptables -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ipvsadm -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/kill -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/killall -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/multipath -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/net -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/nfs-fake-callout -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/nfsconf -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/pidof -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/pkill -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ps -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/rm -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/rpc.lockd -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/rpc.mountd -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/rpc.rquotad -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/rpc.statd -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/rpcinfo -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/service -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/sleep -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/smnotify -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ss -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/stat -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/tdb_mutex_check -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/tdbdump -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/tdbtool -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/testparm -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/timeout -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/wbinfo -%dir %{_datadir}/ctdb/tests/UNIT/onnode -%{_datadir}/ctdb/tests/UNIT/onnode/0001.sh -%{_datadir}/ctdb/tests/UNIT/onnode/0002.sh -%{_datadir}/ctdb/tests/UNIT/onnode/0003.sh -%{_datadir}/ctdb/tests/UNIT/onnode/0004.sh -%{_datadir}/ctdb/tests/UNIT/onnode/0005.sh -%{_datadir}/ctdb/tests/UNIT/onnode/0006.sh -%{_datadir}/ctdb/tests/UNIT/onnode/0010.sh -%{_datadir}/ctdb/tests/UNIT/onnode/0011.sh -%{_datadir}/ctdb/tests/UNIT/onnode/0070.sh -%{_datadir}/ctdb/tests/UNIT/onnode/0071.sh -%{_datadir}/ctdb/tests/UNIT/onnode/0072.sh -%{_datadir}/ctdb/tests/UNIT/onnode/0075.sh -%dir %{_datadir}/ctdb/tests/UNIT/onnode/etc-ctdb -%{_datadir}/ctdb/tests/UNIT/onnode/etc-ctdb/nodes -%dir %{_datadir}/ctdb/tests/UNIT/onnode/scripts -%{_datadir}/ctdb/tests/UNIT/onnode/scripts/local.sh -%dir %{_datadir}/ctdb/tests/UNIT/onnode/stubs -%{_datadir}/ctdb/tests/UNIT/onnode/stubs/ctdb -%{_datadir}/ctdb/tests/UNIT/onnode/stubs/ssh -%dir %{_datadir}/ctdb/tests/UNIT/shellcheck -%{_datadir}/ctdb/tests/UNIT/shellcheck/base_scripts.sh -%{_datadir}/ctdb/tests/UNIT/shellcheck/ctdb_helpers.sh -%{_datadir}/ctdb/tests/UNIT/shellcheck/event_scripts.sh -%{_datadir}/ctdb/tests/UNIT/shellcheck/functions.sh -%{_datadir}/ctdb/tests/UNIT/shellcheck/init_script.sh -%dir %{_datadir}/ctdb/tests/UNIT/shellcheck/scripts -%{_datadir}/ctdb/tests/UNIT/shellcheck/scripts/local.sh -%{_datadir}/ctdb/tests/UNIT/shellcheck/tests.sh -%{_datadir}/ctdb/tests/UNIT/shellcheck/tools.sh -%dir %{_datadir}/ctdb/tests/UNIT/takeover -%{_datadir}/ctdb/tests/UNIT/takeover/det.001.sh -%{_datadir}/ctdb/tests/UNIT/takeover/det.002.sh -%{_datadir}/ctdb/tests/UNIT/takeover/det.003.sh -%dir %{_datadir}/ctdb/tests/UNIT/takeover_helper -%{_datadir}/ctdb/tests/UNIT/takeover_helper/000.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/010.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/011.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/012.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/013.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/014.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/016.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/017.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/018.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/019.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/021.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/022.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/023.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/024.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/025.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/026.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/027.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/028.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/030.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/031.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/110.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/111.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/120.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/121.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/122.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/130.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/131.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/132.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/140.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/150.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/160.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/210.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/211.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/220.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/230.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/240.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/250.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/260.sh -%dir %{_datadir}/ctdb/tests/UNIT/takeover_helper/scripts -%{_datadir}/ctdb/tests/UNIT/takeover_helper/scripts/local.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.001.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.002.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.003.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.004.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.005.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.006.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.007.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.008.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.009.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.010.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.011.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.012.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.013.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.014.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.015.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.016.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.024.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.025.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.027.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.028.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.029.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.030.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.031.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.032.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.033.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.034.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.035.sh -%{_datadir}/ctdb/tests/UNIT/takeover/nondet.001.sh -%{_datadir}/ctdb/tests/UNIT/takeover/nondet.002.sh -%{_datadir}/ctdb/tests/UNIT/takeover/nondet.003.sh -%{_datadir}/ctdb/tests/UNIT/takeover/README -%dir %{_datadir}/ctdb/tests/UNIT/takeover/scripts -%{_datadir}/ctdb/tests/UNIT/takeover/scripts/local.sh -%dir %{_datadir}/ctdb/tests/UNIT/tool -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.attach.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.attach.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.attach.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ban.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ban.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ban.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.catdb.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.catdb.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.cattdb.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.cattdb.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.continue.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.continue.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.continue.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.deletekey.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.disable.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.disable.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.disable.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.disable.004.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.enable.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.enable.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.enable.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getcapabilities.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getcapabilities.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getcapabilities.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getcapabilities.004.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getdbmap.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getdbseqnum.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getdbseqnum.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getdbstatus.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getdbstatus.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getpid.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getpid.010.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getreclock.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getreclock.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getvar.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getvar.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ifaces.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ip.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ip.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ip.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ip.004.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ip.005.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ip.006.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ip.007.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ipinfo.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ipinfo.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ipinfo.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.leader.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.leader.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.listnodes.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.listnodes.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.listvars.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.lvs.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.lvs.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.lvs.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.lvs.004.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.lvs.005.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.lvs.006.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.lvs.007.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.lvs.008.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.lvs.010.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.natgw.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.natgw.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.natgw.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.natgw.004.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.natgw.005.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.natgw.006.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.natgw.007.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.natgw.008.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.natgw.010.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.nodestatus.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.nodestatus.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.nodestatus.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.nodestatus.004.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.nodestatus.005.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.nodestatus.006.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.nodestatus.007.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.pdelete.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ping.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.pnn.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.process-exists.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.process-exists.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.process-exists.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.pstore.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ptrans.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.readkey.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.recover.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.011.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.012.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.013.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.014.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.015.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.016.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.017.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.018.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.019.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.020.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.021.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.023.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.024.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.runstate.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.runstate.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.runstate.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.runstate.004.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.runstate.005.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdbreadonly.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdbreadonly.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdbreadonly.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdbreadonly.004.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdbreadonly.005.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdbsticky.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdbsticky.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdbsticky.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdbsticky.004.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdbsticky.005.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdebug.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdebug.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdebug.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setifacelink.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setifacelink.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setvar.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setvar.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.status.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.status.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.status.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.stop.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.stop.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.stop.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.unban.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.unban.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.unban.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.uptime.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.writekey.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/README -%dir %{_datadir}/ctdb/tests/UNIT/tool/scripts -%{_datadir}/ctdb/tests/UNIT/tool/scripts/local.sh -#endif with selftest -%endif - %if %{with pcp_pmda} %files -n ctdb-pcp-pmda %dir %{_localstatedir}/lib/pcp/pmdas/ctdb @@ -4850,6 +3994,8 @@ fi %{_libdir}/samba/libpyldb-util.cpython-*-private-samba.so %{python3_sitearch}/_ldb_text.py %{python3_sitearch}/__pycache__/_ldb_text.cpython-*.py* +#endif !with testsuite +%endif %changelog %autochangelog From e26ae3b50323de622d206e7827b489bee5c97280 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 27 Nov 2024 17:50:17 +0100 Subject: [PATCH 26/42] Add missing SAMBA_DCERPCD_DONT_LOG_STDOUT=1 for the testsuite [skip changelog] --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index a505e41..c0367cb 100644 --- a/samba.spec +++ b/samba.spec @@ -1629,6 +1629,7 @@ export TDB_NO_FSYNC=1 export NMBD_DONT_LOG_STDOUT=1 export SMBD_DONT_LOG_STDOUT=1 export WINBINDD_DONT_LOG_STDOUT=1 +export SAMBA_DCERPCD_DONT_LOG_STDOUT=1 %{__make} %{?_smp_mflags} test FAIL_IMMEDIATELY=1 #endif with testsuite %endif From 3a48ae6a5d4d661d884c8e192ad2588cf231e468 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Fri, 25 Oct 2024 19:42:31 +0200 Subject: [PATCH 27/42] Add always to samba-devel: Requires: samba-dc-libs --- samba.spec | 2 -- 1 file changed, 2 deletions(-) diff --git a/samba.spec b/samba.spec index c0367cb..a6f1159 100644 --- a/samba.spec +++ b/samba.spec @@ -712,9 +712,7 @@ name server related details of Samba AD. Summary: Developer tools for Samba libraries Requires: %{name}-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} -%if %{with dc} Requires: %{name}-dc-libs = %{samba_depver} -%endif Requires: libnetapi = %{samba_depver} Provides: samba4-devel = %{samba_depver} From 9935f1728abfb576eefab297ab1103b9d07e2382 Mon Sep 17 00:00:00 2001 From: Anoop C S Date: Wed, 13 Nov 2024 11:29:47 +0530 Subject: [PATCH 28/42] Remove unused macro samba_requires_eq This was previously used to force the installation of a matching libldb version from build time. With libldb now versioned along with Samba as a public library its usage got removed in d0472882 but the definition remained as a left over. Signed-off-by: Anoop C S --- samba.spec | 2 -- 1 file changed, 2 deletions(-) diff --git a/samba.spec b/samba.spec index a6f1159..c45bb11 100644 --- a/samba.spec +++ b/samba.spec @@ -148,8 +148,6 @@ %bcond lmdb 0 %endif -%define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") - %global samba_version 4.21.2 # The release field is extended: From 54ec9c3af699cfbc8ba7ae71bf9fb44402ad1c29 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 7 Jan 2025 10:42:42 +0100 Subject: [PATCH 29/42] Update to version 4.21.3 - resolves: rhbz#2335911 --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index c45bb11..b956d6d 100644 --- a/samba.spec +++ b/samba.spec @@ -148,7 +148,7 @@ %bcond lmdb 0 %endif -%global samba_version 4.21.2 +%global samba_version 4.21.3 # The release field is extended: # [.][.]%%{?dist}[.] diff --git a/sources b/sources index 285808c..1055c45 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.21.2.tar.xz) = c26311a60d3994561aa12c36e54bc37d1161ec1063aa9876ea03dee24984e9c827e5836dc86bc392e37193010275a642b960e775b5a9e029246ba56ae1697682 -SHA512 (samba-4.21.2.tar.asc) = f3da123d2e86a7e07c4fcb83924edd29195d865091d80125f3531c463662a8a38ba6d8c467932af8cd065d0cc4467131c83a4e3783573b757f6ed9c2bde0befc +SHA512 (samba-4.21.3.tar.xz) = 62eb3bfe1aa1cc8aa68055d4caf21bdea6d6f5b0f767566bef1da210100b5dd17b7d60f5c47da01b0123d3a2c1c3689b1960ef2c2cbd4f804ff998ead994fc3f +SHA512 (samba-4.21.3.tar.asc) = 11e40d32b783b7d57d3f35fe96a17e897719f65d796d965b371dfb58b8cf1f8ffe60c3047bea8c2b2b0d475fa55cd25237b9ba84d44b3d65a8cd53c6af760957 From 20aeb05ae6d30e73696f7edcf0e9f236338964ab Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 7 Jan 2025 13:27:35 +0100 Subject: [PATCH 30/42] Use upstream Patch instead of python3-crypt-r --- samba-4-21-pycrypt.patch | 853 +++++++++++++++++++++++++++++++++++++++ samba.spec | 5 +- 2 files changed, 855 insertions(+), 3 deletions(-) create mode 100644 samba-4-21-pycrypt.patch diff --git a/samba-4-21-pycrypt.patch b/samba-4-21-pycrypt.patch new file mode 100644 index 0000000..8c197fc --- /dev/null +++ b/samba-4-21-pycrypt.patch @@ -0,0 +1,853 @@ +From 93bc860e8f344a96d0496edbc5d463f2c5411fcd Mon Sep 17 00:00:00 2001 +From: Douglas Bagnall +Date: Thu, 5 Dec 2024 16:35:51 +1300 +Subject: [PATCH 01/10] util: add a crypt wrapper, derived from + dsdb:password_hash + +This is going to be used by the dsdb password_hash module, and exposed +to Python via pyglue. + +We're doing this because Python 3.13 has dropped crypt from the Python +standard library. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 + +Reviewed-by: Andreas Schneider +--- + lib/util/util_crypt.c | 90 ++++++++++++++++++++++++++++++++++++++++++ + lib/util/util_crypt.h | 5 +++ + lib/util/wscript_build | 6 +++ + 3 files changed, 101 insertions(+) + create mode 100644 lib/util/util_crypt.c + create mode 100644 lib/util/util_crypt.h + +diff --git a/lib/util/util_crypt.c b/lib/util/util_crypt.c +new file mode 100644 +index 00000000000..0f7b2d0fd31 +--- /dev/null ++++ b/lib/util/util_crypt.c +@@ -0,0 +1,90 @@ ++#include ++#include "data_blob.h" ++#include ++#include ++#include "util_crypt.h" ++ ++ ++static int crypt_as_best_we_can(const char *phrase, ++ const char *setting, ++ const char **hashp) ++{ ++ int ret = 0; ++ const char *hash = NULL; ++ ++#if defined(HAVE_CRYPT_R) || defined(HAVE_CRYPT_RN) ++ struct crypt_data crypt_data = { ++ .initialized = 0 /* working storage used by crypt */ ++ }; ++#endif ++ ++ /* ++ * crypt_r() and crypt() may return a null pointer upon error ++ * depending on how libcrypt was configured, so we prefer ++ * crypt_rn() from libcrypt / libxcrypt which always returns ++ * NULL on error. ++ * ++ * POSIX specifies returning a null pointer and setting ++ * errno. ++ * ++ * RHEL 7 (which does not use libcrypt / libxcrypt) returns a ++ * non-NULL pointer from crypt_r() on success but (always?) ++ * sets errno during internal processing in the NSS crypto ++ * subsystem. ++ * ++ * By preferring crypt_rn we avoid the 'return non-NULL but ++ * set-errno' that we otherwise cannot tell apart from the ++ * RHEL 7 behaviour. ++ */ ++ errno = 0; ++ ++#ifdef HAVE_CRYPT_RN ++ hash = crypt_rn(phrase, setting, ++ &crypt_data, ++ sizeof(crypt_data)); ++#elif HAVE_CRYPT_R ++ hash = crypt_r(phrase, setting, &crypt_data); ++#else ++ /* ++ * No crypt_r falling back to crypt, which is NOT thread safe ++ * Thread safety MT-Unsafe race:crypt ++ */ ++ hash = crypt(phrase, setting); ++#endif ++ /* ++ * On error, crypt() and crypt_r() may return a null pointer, ++ * or a pointer to an invalid hash beginning with a '*'. ++ */ ++ ret = errno; ++ errno = 0; ++ if (hash == NULL || hash[0] == '*') { ++ if (ret == 0) { ++ /* this is annoying */ ++ ret = ENOTRECOVERABLE; ++ } ++ } ++ ++ *hashp = hash; ++ return ret; ++} ++ ++ ++int talloc_crypt_blob(TALLOC_CTX *mem_ctx, ++ const char *phrase, ++ const char *setting, ++ DATA_BLOB *blob) ++{ ++ const char *hash = NULL; ++ int ret = crypt_as_best_we_can(phrase, setting, &hash); ++ if (ret != 0) { ++ blob->data = NULL; ++ blob->length = 0; ++ return ret; ++ } ++ blob->length = strlen(hash); ++ blob->data = talloc_memdup(mem_ctx, hash, blob->length); ++ if (blob->data == NULL) { ++ return ENOMEM; ++ } ++ return 0; ++} +diff --git a/lib/util/util_crypt.h b/lib/util/util_crypt.h +new file mode 100644 +index 00000000000..8c289e489e8 +--- /dev/null ++++ b/lib/util/util_crypt.h +@@ -0,0 +1,5 @@ ++ ++int talloc_crypt_blob(TALLOC_CTX *mem_ctx, ++ const char *phrase, ++ const char *cmd, ++ DATA_BLOB *blob); +diff --git a/lib/util/wscript_build b/lib/util/wscript_build +index b4fcfeaba07..7de9c0b7b17 100644 +--- a/lib/util/wscript_build ++++ b/lib/util/wscript_build +@@ -253,6 +253,12 @@ else: + private_library=True, + local_include=False) + ++ bld.SAMBA_LIBRARY('util_crypt', ++ source='util_crypt.c', ++ deps='talloc crypt', ++ private_library=True, ++ local_include=False) ++ + + bld.SAMBA_SUBSYSTEM('UNIX_PRIVS', + source='unix_privs.c', +-- +2.34.1 + + +From c8c1de1ac3b715e76cb987525197209e453cdd50 Mon Sep 17 00:00:00 2001 +From: Douglas Bagnall +Date: Wed, 11 Dec 2024 14:29:21 +1300 +Subject: [PATCH 02/10] dsdb:password_hash: move hash_blob allocation up + +This will make the next patch simpler. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 + +Signed-off-by: Douglas Bagnall +Reviewed-by: Andreas Schneider +--- + source4/dsdb/samdb/ldb_modules/password_hash.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c +index 1d1267624e2..c1902126a72 100644 +--- a/source4/dsdb/samdb/ldb_modules/password_hash.c ++++ b/source4/dsdb/samdb/ldb_modules/password_hash.c +@@ -1649,6 +1649,13 @@ static int setup_primary_userPassword_hash( + } + } + ++ hash_blob = talloc_zero(ctx, DATA_BLOB); ++ ++ if (hash_blob == NULL) { ++ TALLOC_FREE(frame); ++ return ldb_oom(ldb); ++ } ++ + /* + * Relies on the assertion that cleartext_utf8->data is a zero + * terminated UTF-8 string +@@ -1712,15 +1719,10 @@ static int setup_primary_userPassword_hash( + scheme, + reason); + TALLOC_FREE(frame); ++ TALLOC_FREE(hash_blob); + return LDB_ERR_OPERATIONS_ERROR; + } + +- hash_blob = talloc_zero(ctx, DATA_BLOB); +- +- if (hash_blob == NULL) { +- TALLOC_FREE(frame); +- return ldb_oom(ldb); +- } + + *hash_blob = data_blob_talloc(hash_blob, + (const uint8_t *)hash, +-- +2.34.1 + + +From ac5008598e4a4d3dbf5d58f4b4a2c6fc25195775 Mon Sep 17 00:00:00 2001 +From: Douglas Bagnall +Date: Thu, 12 Dec 2024 11:16:22 +1300 +Subject: [PATCH 03/10] dsdb:password_hash: use talloc_crypt_blob() + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 + +Signed-off-by: Douglas Bagnall +Reviewed-by: Andreas Schneider +--- + .../dsdb/samdb/ldb_modules/password_hash.c | 68 ++++--------------- + .../samdb/ldb_modules/wscript_build_server | 2 +- + 2 files changed, 13 insertions(+), 57 deletions(-) + +diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c +index c1902126a72..7a7114c1caa 100644 +--- a/source4/dsdb/samdb/ldb_modules/password_hash.c ++++ b/source4/dsdb/samdb/ldb_modules/password_hash.c +@@ -51,6 +51,7 @@ + #include "auth/common_auth.h" + #include "lib/messaging/messaging.h" + #include "lib/param/loadparm.h" ++#include "lib/util/util_crypt.h" + + #include "lib/crypto/gnutls_helpers.h" + #include +@@ -1592,16 +1593,11 @@ static int setup_primary_userPassword_hash( + struct ldb_context *ldb = ldb_module_get_ctx(io->ac->module); + const char *salt = NULL; /* Randomly generated salt */ + const char *cmd = NULL; /* command passed to crypt */ +- const char *hash = NULL; /* password hash generated by crypt */ + int algorithm = 0; /* crypt hash algorithm number */ + int rounds = 0; /* The number of hash rounds */ ++ int ret; + DATA_BLOB *hash_blob = NULL; + TALLOC_CTX *frame = talloc_stackframe(); +-#if defined(HAVE_CRYPT_R) || defined(HAVE_CRYPT_RN) +- struct crypt_data crypt_data = { +- .initialized = 0 /* working storage used by crypt */ +- }; +-#endif + + /* Generate a random password salt */ + salt = generate_random_str_list(frame, +@@ -1660,52 +1656,20 @@ static int setup_primary_userPassword_hash( + * Relies on the assertion that cleartext_utf8->data is a zero + * terminated UTF-8 string + */ +- +- /* +- * crypt_r() and crypt() may return a null pointer upon error +- * depending on how libcrypt was configured, so we prefer +- * crypt_rn() from libcrypt / libxcrypt which always returns +- * NULL on error. +- * +- * POSIX specifies returning a null pointer and setting +- * errno. +- * +- * RHEL 7 (which does not use libcrypt / libxcrypt) returns a +- * non-NULL pointer from crypt_r() on success but (always?) +- * sets errno during internal processing in the NSS crypto +- * subsystem. +- * +- * By preferring crypt_rn we avoid the 'return non-NULL but +- * set-errno' that we otherwise cannot tell apart from the +- * RHEL 7 behaviour. +- */ +- errno = 0; +- +-#ifdef HAVE_CRYPT_RN +- hash = crypt_rn((char *)io->n.cleartext_utf8->data, +- cmd, +- &crypt_data, +- sizeof(crypt_data)); +-#elif HAVE_CRYPT_R +- hash = crypt_r((char *)io->n.cleartext_utf8->data, cmd, &crypt_data); +-#else +- /* +- * No crypt_r falling back to crypt, which is NOT thread safe +- * Thread safety MT-Unsafe race:crypt +- */ +- hash = crypt((char *)io->n.cleartext_utf8->data, cmd); +-#endif +- /* +- * On error, crypt() and crypt_r() may return a null pointer, +- * or a pointer to an invalid hash beginning with a '*'. +- */ +- if (hash == NULL || hash[0] == '*') { ++ ret = talloc_crypt_blob(hash_blob, ++ (char *)io->n.cleartext_utf8->data, ++ cmd, ++ hash_blob); ++ if (ret != 0) { + char buf[1024]; + const char *reason = NULL; +- if (errno == ERANGE) { ++ if (ret == ERANGE) { + reason = "Password exceeds maximum length allowed for crypt() hashing"; ++ } else if (ret == ENOTRECOVERABLE) { ++ /* probably weird RHEL7 crypt, see talloc_crypt_blob() */ ++ reason = "Unknown error"; + } else { +- int err = strerror_r(errno, buf, sizeof(buf)); ++ int err = strerror_r(ret, buf, sizeof(buf)); + if (err == 0) { + reason = buf; + } else { +@@ -1723,14 +1687,6 @@ static int setup_primary_userPassword_hash( + return LDB_ERR_OPERATIONS_ERROR; + } + +- +- *hash_blob = data_blob_talloc(hash_blob, +- (const uint8_t *)hash, +- strlen(hash)); +- if (hash_blob->data == NULL) { +- TALLOC_FREE(frame); +- return ldb_oom(ldb); +- } + hash_value->value = hash_blob; + TALLOC_FREE(frame); + return LDB_SUCCESS; +diff --git a/source4/dsdb/samdb/ldb_modules/wscript_build_server b/source4/dsdb/samdb/ldb_modules/wscript_build_server +index 9c1eb12a7c2..16d9b31a982 100644 +--- a/source4/dsdb/samdb/ldb_modules/wscript_build_server ++++ b/source4/dsdb/samdb/ldb_modules/wscript_build_server +@@ -195,7 +195,7 @@ bld.SAMBA_MODULE('ldb_password_hash', + init_function='ldb_password_hash_module_init', + module_init_name='ldb_init_module', + internal_module=False, +- deps='talloc samdb LIBCLI_AUTH NDR_DRSBLOBS authkrb5 krb5 gpgme DSDB_MODULE_HELPERS crypt db-glue' ++ deps='talloc samdb LIBCLI_AUTH NDR_DRSBLOBS authkrb5 krb5 gpgme DSDB_MODULE_HELPERS util_crypt db-glue' + ) + + +-- +2.34.1 + + +From 0f19a12e9f28dd78e5108eeb22950eff48202d97 Mon Sep 17 00:00:00 2001 +From: Douglas Bagnall +Date: Wed, 11 Dec 2024 14:30:04 +1300 +Subject: [PATCH 04/10] util: add a crypt strerror helper + +This will be used by Python also. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 + +Signed-off-by: Douglas Bagnall +Reviewed-by: Andreas Schneider +--- + lib/util/util_crypt.c | 24 +++++++++++++++++++ + lib/util/util_crypt.h | 2 ++ + .../dsdb/samdb/ldb_modules/password_hash.c | 16 +------------ + 3 files changed, 27 insertions(+), 15 deletions(-) + +diff --git a/lib/util/util_crypt.c b/lib/util/util_crypt.c +index 0f7b2d0fd31..09cd47597d1 100644 +--- a/lib/util/util_crypt.c ++++ b/lib/util/util_crypt.c +@@ -88,3 +88,27 @@ int talloc_crypt_blob(TALLOC_CTX *mem_ctx, + } + return 0; + } ++ ++ ++char *talloc_crypt_errstring(TALLOC_CTX *mem_ctx, int error) ++{ ++ char buf[1024]; ++ int err; ++ if (error == ERANGE) { ++ return talloc_strdup( ++ mem_ctx, ++ "Password exceeds maximum length allowed for crypt() hashing"); ++ } ++ if (error == ENOTRECOVERABLE) { ++ /* probably weird RHEL7 crypt, see crypt_as_best_we_can() */ ++ goto unknown; ++ } ++ ++ err = strerror_r(error, buf, sizeof(buf)); ++ if (err != 0) { ++ goto unknown; ++ } ++ return talloc_strndup(mem_ctx, buf, sizeof(buf)); ++unknown: ++ return talloc_strdup(mem_ctx, "Unknown error"); ++} +diff --git a/lib/util/util_crypt.h b/lib/util/util_crypt.h +index 8c289e489e8..ca1a58e922c 100644 +--- a/lib/util/util_crypt.h ++++ b/lib/util/util_crypt.h +@@ -3,3 +3,5 @@ int talloc_crypt_blob(TALLOC_CTX *mem_ctx, + const char *phrase, + const char *cmd, + DATA_BLOB *blob); ++ ++char *talloc_crypt_errstring(TALLOC_CTX *mem_ctx, int error); +diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c +index 7a7114c1caa..6949a92fc3e 100644 +--- a/source4/dsdb/samdb/ldb_modules/password_hash.c ++++ b/source4/dsdb/samdb/ldb_modules/password_hash.c +@@ -1661,21 +1661,7 @@ static int setup_primary_userPassword_hash( + cmd, + hash_blob); + if (ret != 0) { +- char buf[1024]; +- const char *reason = NULL; +- if (ret == ERANGE) { +- reason = "Password exceeds maximum length allowed for crypt() hashing"; +- } else if (ret == ENOTRECOVERABLE) { +- /* probably weird RHEL7 crypt, see talloc_crypt_blob() */ +- reason = "Unknown error"; +- } else { +- int err = strerror_r(ret, buf, sizeof(buf)); +- if (err == 0) { +- reason = buf; +- } else { +- reason = "Unknown error"; +- } +- } ++ const char *reason = talloc_crypt_errstring(frame, ret); + ldb_asprintf_errstring( + ldb, + "setup_primary_userPassword: generation of a %s " +-- +2.34.1 + + +From 354ea5b1e69e27bfdd2d0b5ae8157790ba1bb590 Mon Sep 17 00:00:00 2001 +From: Douglas Bagnall +Date: Wed, 11 Dec 2024 14:30:15 +1300 +Subject: [PATCH 05/10] pyglue: add crypt() function + +This wraps talloc_crypt_blob() from lib/util/util_crypt.c which in +turn wraps the system crypt[_r[n]]. + +We want this because the Python standard library crypt module is going +away. That one also wrapped the system crypt or crypt_r, so there +should be no change. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 + +Signed-off-by: Douglas Bagnall +Reviewed-by: Andreas Schneider +--- + python/pyglue.c | 41 +++++++++++++++++++++++++++++++++++++++++ + python/wscript | 1 + + 2 files changed, 42 insertions(+) + +diff --git a/python/pyglue.c b/python/pyglue.c +index 042bf9e14f3..fcccb849f5e 100644 +--- a/python/pyglue.c ++++ b/python/pyglue.c +@@ -18,6 +18,7 @@ + */ + + #include "lib/replace/system/python.h" ++#include "pyerrors.h" + #include "python/py3compat.h" + #include "includes.h" + #include "python/modules.h" +@@ -25,6 +26,7 @@ + #include "param/pyparam.h" + #include "lib/socket/netif.h" + #include "lib/util/debug.h" ++#include "lib/util/util_crypt.h" + #include "librpc/ndr/ndr_private.h" + #include "lib/cmdline/cmdline.h" + #include "lib/crypto/gkdi.h" +@@ -519,6 +521,42 @@ static PyObject *py_get_burnt_commandline(PyObject *self, PyObject *args) + return ret; + } + ++static PyObject *py_crypt(PyObject *self, PyObject *args) ++{ ++ PyObject *py_hash = NULL; ++ char *phrase = NULL; ++ char *setting = NULL; ++ TALLOC_CTX *frame = NULL; ++ int ret; ++ DATA_BLOB hash = {}; ++ ++ if (!PyArg_ParseTuple(args, "ss", &phrase, &setting)) { ++ TALLOC_FREE(frame); ++ return NULL; ++ } ++ frame = talloc_stackframe(); ++ ret = talloc_crypt_blob(frame, phrase, setting, &hash); ++ if (ret != 0) { ++ const char *errstr = talloc_crypt_errstring(frame, ret); ++ if (ret == EINVAL || ret == ERANGE || ret == ENOTRECOVERABLE) { ++ PyErr_Format(PyExc_ValueError, ++ "could not crypt(): %s", ++ errstr); ++ } else { ++ PyErr_Format(PyExc_OSError, ++ "could not crypt(): %s", ++ errstr); ++ } ++ TALLOC_FREE(frame); ++ return NULL; ++ } ++ ++ py_hash = PyUnicode_FromStringAndSize((char *)hash.data, hash.length); ++ TALLOC_FREE(frame); ++ return py_hash; ++} ++ ++ + static PyMethodDef py_misc_methods[] = { + { "generate_random_str", (PyCFunction)py_generate_random_str, METH_VARARGS, + "generate_random_str(len) -> string\n" +@@ -580,6 +618,9 @@ static PyMethodDef py_misc_methods[] = { + METH_NOARGS, "How many NDR internal tokens is too many for this build?" }, + { "get_burnt_commandline", (PyCFunction)py_get_burnt_commandline, + METH_VARARGS, "Return a redacted commandline to feed to setproctitle (None if no redaction required)" }, ++ { "crypt", (PyCFunction)py_crypt, ++ METH_VARARGS, ++ "encrypt as phrase, per crypt(3), as determined by setting." }, + {0} + }; + +diff --git a/python/wscript b/python/wscript +index 3e6439930e9..7c17e390dc7 100644 +--- a/python/wscript ++++ b/python/wscript +@@ -119,6 +119,7 @@ def build(bld): + ndr + cmdline + gkdi ++ util_crypt + %s + ''' % (pyparam_util, pytalloc_util), + realname='samba/_glue.so') +-- +2.34.1 + + +From fec10dfe574a8acef0646a666fd4ff54ef11adf6 Mon Sep 17 00:00:00 2001 +From: Douglas Bagnall +Date: Thu, 12 Dec 2024 10:44:07 +1300 +Subject: [PATCH 06/10] pytest: test that _glue.crypt works + +The test vectors were generated via Python 3.10 crypt module, which +directly wraps crypt(3), which in this case is from glibc 2.39-0ubuntu8.3. + +We mainly test the sha256 and sha512 vectors, which seems to be all we +use, and which are said to be widely supported. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 + +Signed-off-by: Douglas Bagnall +Reviewed-by: Andreas Schneider +--- + python/samba/tests/glue.py | 65 ++++++++++++++++++++++++++++++++++++++ + 1 file changed, 65 insertions(+) + +diff --git a/python/samba/tests/glue.py b/python/samba/tests/glue.py +index ac504b3f366..824f5ca0c81 100644 +--- a/python/samba/tests/glue.py ++++ b/python/samba/tests/glue.py +@@ -88,3 +88,68 @@ class GlueTests(samba.tests.TestCase): + self.assertEqual(_glue.strstr_m(string, '_'), '_string_num__one') + self.assertEqual(_glue.strstr_m(string, '__'), '__one') + self.assertEqual(_glue.strstr_m(string, 'ring'), 'ring_num__one') ++ ++ def test_crypt(self): ++ # We hopefully only use schemes 5 and 6 (sha256 and sha512), ++ # which are OK and also quite widely supported according to ++ # https://en.wikipedia.org/wiki/Crypt_(C) ++ for phrase, setting, expected in [ ++ ("a", "$5$aaaaaa", ++ "$5$aaaaaa$F4lxguL7mZR7TGlvukPTJIxoRhVmHMZs8ZdH8oDP0.6"), ++ # with scheme 5, 5000 rounds is default, so hash is the same as above ++ ('a', '$5$rounds=5000$aaaaaa', ++ '$5$rounds=5000$aaaaaa$F4lxguL7mZR7TGlvukPTJIxoRhVmHMZs8ZdH8oDP0.6'), ++ ('a', ++ '$5$rounds=4999$aaaaaa', ++ '$5$rounds=4999$aaaaaa$FiP70gtxOJUFLokUJvET06E7jbL6aNmF6Wtv2ddzjY8'), ++ ('a', '$5$aaaaab', ++ '$5$aaaaab$e9qR2F833/JyuMu.nkQc9kn184vBWLo0ODqnCe./mj0'), ++ ++ ('', '$5$aaaaaa', '$5$aaaaaa$5B4WTdWp5n/v/aNUw2N8RsEitqvlZJEaAKhH/pOkGg4'), ++ ++ ("a", "$6$aaaaaa", ++ "$6$aaaaaa$KHs/Ez7X/I5/K.V8FR7kEsx9rOvjXnEDUmGC.dLBWP87XWy.oUEAM7QYcZQRVhiDwGepOF2pKrCVETYLyASh60"), ++ ++ ('', '$5$', '$5$$3c2QQ0KjIU1OLtB29cl8Fplc2WN7X89bnoEjaR7tWu.'), ++ ++ # scheme 1 (md5) should be supported if not used ++ ('a', '$1$aaaaaa', ++ '$1$aaaaaa$MUMWPbGfzrHFCNm7ZHg31.'), ++ ++ ('', '$6$', ++ '$6$$/chiBau24cE26QQVW3IfIe68Xu5.JQ4E8Ie7lcRLwqxO5cxGuBhqF2HmTL.zWJ9zjChg3yJYFXeGBQ2y3Ba1d1'), ++ (' ', ++ '$6$6', ++ '$6$6$asLnbxf0obyuv3ybNvDE9ZcdwGFkDhLe7uW.wzdOdKCm4/M3vGFKq4Ttk1tBQrOn4wALZ3tj1L8IarIu5i8hR/'), ++ ++ # original DES scheme, 12 bits of salt ++ ("a", "lalala", "laKGbFzgh./R2"), ++ ("a", "lalalaLALALAla", "laKGbFzgh./R2"), ++ ("a", "arrgh", "ar7VUiUvDhX2c"), ++ ("a", "arrggghhh", "ar7VUiUvDhX2c"), ++ ]: ++ hash = _glue.crypt(phrase, setting) ++ self.assertEqual(hash, expected) ++ ++ def test_crypt_bad(self): ++ # We can't be too strident in our assertions, because every ++ # system allows a different set of algorithms, and some have ++ # different ideas of how to parse. ++ for phrase, setting, exception in [ ++ ("a", "$5", ValueError), ++ ("a", "$0$", ValueError), ++ ("a", None, TypeError), ++ (None, "", TypeError), ++ ('a', '$66$', ValueError), ++ ('a', '$$', ValueError), ++ ('a', '*0', ValueError), ++ ('a', '*', ValueError), ++ ('a', '++', ValueError), ++ # this next one is too long, except on Rocky Linux 8. ++ #('a' * 10000, '$5$5', ValueError), ++ # this is invalid, except on Debian 11. ++ # (' ', '$6$ ', ValueError), ++ ]: ++ with self.assertRaises(exception, ++ msg=f"crypt({phrase!r}, {setting!r}) didn't fail"): ++ _glue.crypt(phrase, setting) +-- +2.34.1 + + +From 7d1fa8cdc52423bd53de4314a62e2c2b2e0b2aa7 Mon Sep 17 00:00:00 2001 +From: Douglas Bagnall +Date: Wed, 11 Dec 2024 15:54:48 +1300 +Subject: [PATCH 07/10] samba-tool user: use _glue.crypt, not crypt.crypt + +Because we know we have _glue.crypt, and we know it raises exceptions +rather than returning None, we can simplify the checks. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 + +Signed-off-by: Douglas Bagnall +Reviewed-by: Andreas Schneider +--- + .../samba/netcmd/user/readpasswords/common.py | 21 ++++++------------- + 1 file changed, 6 insertions(+), 15 deletions(-) + +diff --git a/python/samba/netcmd/user/readpasswords/common.py b/python/samba/netcmd/user/readpasswords/common.py +index 7944d4e1682..68befb3f356 100644 +--- a/python/samba/netcmd/user/readpasswords/common.py ++++ b/python/samba/netcmd/user/readpasswords/common.py +@@ -37,6 +37,7 @@ from samba.netcmd import Command, CommandError + from samba.samdb import SamDB + from samba.nt_time import timedelta_from_nt_time_delta, nt_time_from_datetime + from samba.gkdi import MAX_CLOCK_SKEW ++from samba._glue import crypt + + # python[3]-gpgme is abandoned since ubuntu 1804 and debian 9 + # have to use python[3]-gpg instead +@@ -132,9 +133,7 @@ def get_crypt_value(alg, utf8pw, rounds=0): + else: + crypt_salt = "$%s$%s$" % (alg, b64salt) + +- crypt_value = crypt.crypt(utf8pw, crypt_salt) +- if crypt_value is None: +- raise NotImplementedError("crypt.crypt(%s) returned None" % (crypt_salt)) ++ crypt_value = crypt(utf8pw, crypt_salt) + expected_len = len(crypt_salt) + algs[alg]["length"] + if len(crypt_value) != expected_len: + raise NotImplementedError("crypt.crypt(%s) returned a value with length %d, expected length is %d" % ( +@@ -156,21 +155,13 @@ except ImportError as e: + + for (alg, attr) in [("5", "virtualCryptSHA256"), ("6", "virtualCryptSHA512")]: + try: +- import crypt + get_crypt_value(alg, "") +- virtual_attributes[attr] = { +- } +- except ImportError as e: +- reason = "crypt" +- reason += " required" +- disabled_virtual_attributes[attr] = { +- "reason": reason, +- } +- except NotImplementedError as e: +- reason = "modern '$%s$' salt in crypt(3) required" % (alg) ++ except (ValueError, OSError): + disabled_virtual_attributes[attr] = { +- "reason": reason, ++ "reason": f"modern '${alg}$' salt in crypt(3) required" + } ++ continue ++ virtual_attributes[attr] = {} + + # Add the wDigest virtual attributes, virtualWDigest01 to virtualWDigest29 + for x in range(1, 30): +-- +2.34.1 + + +From dde9d1c473ac2fccfc123cfe2ca224da59042c6d Mon Sep 17 00:00:00 2001 +From: Douglas Bagnall +Date: Wed, 11 Dec 2024 15:56:20 +1300 +Subject: [PATCH 08/10] samba-tool user: hashlib.sha1 is always present + +We maybe thought we were checking that sha1 was in hashlib, but we were +only checking that hashlib is in the Python library (`hashlib.sha1()` +would not raise ImportError). + +The documentation says hashlib always contains sha1 -- if that +changes, it is better we know by failing noisily with the import error +at the top of the file. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 + +Signed-off-by: Douglas Bagnall +Reviewed-by: Andreas Schneider +--- + python/samba/netcmd/user/readpasswords/common.py | 16 ++++------------ + 1 file changed, 4 insertions(+), 12 deletions(-) + +diff --git a/python/samba/netcmd/user/readpasswords/common.py b/python/samba/netcmd/user/readpasswords/common.py +index 68befb3f356..3043525874e 100644 +--- a/python/samba/netcmd/user/readpasswords/common.py ++++ b/python/samba/netcmd/user/readpasswords/common.py +@@ -26,6 +26,7 @@ import datetime + import errno + import io + import os ++from hashlib import sha1 + + import ldb + from samba import credentials, nttime2float +@@ -141,17 +142,8 @@ def get_crypt_value(alg, utf8pw, rounds=0): + return crypt_value + + +-try: +- import hashlib +- hashlib.sha1() +- virtual_attributes["virtualSSHA"] = { +- } +-except ImportError as e: +- reason = "hashlib.sha1()" +- reason += " required" +- disabled_virtual_attributes["virtualSSHA"] = { +- "reason": reason, +- } ++ ++virtual_attributes["virtualSSHA"] = {} + + for (alg, attr) in [("5", "virtualCryptSHA256"), ("6", "virtualCryptSHA512")]: + try: +@@ -736,7 +728,7 @@ class GetPasswordCommand(Command): + if u8 is None: + continue + salt = os.urandom(4) +- h = hashlib.sha1() ++ h = sha1() + h.update(u8) + h.update(salt) + bv = h.digest() + salt +-- +2.34.1 + + +From 361a7bcfc203c8cf4884c3f35e7147b59c0e4116 Mon Sep 17 00:00:00 2001 +From: Douglas Bagnall +Date: Thu, 12 Dec 2024 10:46:16 +1300 +Subject: [PATCH 09/10] pytest: password_hash uses internal _glue.crypt + +This will remove an external dependency. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 + +Signed-off-by: Douglas Bagnall +Reviewed-by: Andreas Schneider +--- + python/samba/tests/password_hash.py | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/python/samba/tests/password_hash.py b/python/samba/tests/password_hash.py +index 1b7af7de7b8..39ef13fd7b2 100644 +--- a/python/samba/tests/password_hash.py ++++ b/python/samba/tests/password_hash.py +@@ -30,11 +30,11 @@ from samba.dcerpc.samr import DOMAIN_PASSWORD_STORE_CLEARTEXT + from samba.dsdb import UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED + from samba.tests import delete_force + from samba.tests.password_test import PasswordCommon ++from samba._glue import crypt + import ldb + import samba + import binascii + from hashlib import md5 +-import crypt + + + USER_NAME = "PasswordHashTestUser" +@@ -321,7 +321,7 @@ class PassWordHashTests(TestCase): + cmd = "$%s$rounds=%d$%s" % (alg, rounds, data[3]) + + # Calculate the expected hash value +- expected = crypt.crypt(USER_PASS, cmd) ++ expected = crypt(USER_PASS, cmd) + self.assertEqual(expected, up.hashes[i].value.decode('utf8')) + i += 1 + +-- +2.34.1 + + +From 11ec542b49c4fe165ce717b0f978439ed717f3e0 Mon Sep 17 00:00:00 2001 +From: Douglas Bagnall +Date: Wed, 11 Dec 2024 14:31:18 +1300 +Subject: [PATCH 10/10] util:datablob: data_blob_pad checks its alignment + assumption + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 + +Signed-off-by: Douglas Bagnall +Reviewed-by: Andreas Schneider + +Autobuild-User(master): Andreas Schneider +Autobuild-Date(master): Fri Dec 20 07:59:51 UTC 2024 on atb-devel-224 +--- + lib/util/data_blob.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/util/data_blob.c b/lib/util/data_blob.c +index b5b78bc7a8a..0522e7755af 100644 +--- a/lib/util/data_blob.c ++++ b/lib/util/data_blob.c +@@ -286,7 +286,7 @@ _PUBLIC_ bool data_blob_pad(TALLOC_CTX *mem_ctx, DATA_BLOB *blob, + size_t old_len = blob->length; + size_t new_len = (old_len + pad - 1) & ~(pad - 1); + +- if (new_len < old_len) { ++ if (new_len < old_len || (pad & (pad - 1)) != 0) { + return false; + } + +-- +2.34.1 + diff --git a/samba.spec b/samba.spec index b956d6d..68977a3 100644 --- a/samba.spec +++ b/samba.spec @@ -251,6 +251,7 @@ Source201: README.downgrade Source202: samba.abignore Patch0: samba-4.21.0-s3-notifyd.patch +Patch1: samba-4-21-pycrypt.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} @@ -441,9 +442,6 @@ BuildRequires: perl-Parse-Yapp BuildRequires: perl-Test-Base BuildRequires: psmisc BuildRequires: python3-libpamtest -# The `crypt` module has been removed in Python 3.13, this is a copy -# See also https://bugzilla.samba.org/show_bug.cgi?id=15756 -BuildRequires: python3-crypt-r BuildRequires: resolv_wrapper BuildRequires: rsync BuildRequires: socket_wrapper @@ -2062,6 +2060,7 @@ fi %{_libdir}/samba/libtdb-wrap-private-samba.so %{_libdir}/samba/libtime-basic-private-samba.so %{_libdir}/samba/libtorture-private-samba.so +%{_libdir}/samba/libutil-crypt-private-samba.so %{_libdir}/samba/libutil-reg-private-samba.so %{_libdir}/samba/libutil-setid-private-samba.so %{_libdir}/samba/libutil-tdb-private-samba.so From 583aead91f9af35554452dd6df9490506908dc0f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 7 Jan 2025 14:23:35 +0100 Subject: [PATCH 31/42] Remove 'Requires: python3-crypt-r' also from samba-tools --- samba.spec | 3 --- 1 file changed, 3 deletions(-) diff --git a/samba.spec b/samba.spec index 68977a3..30fdeb5 100644 --- a/samba.spec +++ b/samba.spec @@ -594,9 +594,6 @@ Requires: lmdb %endif Requires: tdb-tools Requires: python3-gpg -# The `crypt` module has been removed in Python 3.13, this is a copy -# See also https://bugzilla.samba.org/show_bug.cgi?id=15756 -Requires: python3-crypt-r %endif %description tools From c1659867035982c7563d10db6691fac792ba06fa Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 22 Jan 2025 09:00:27 +0100 Subject: [PATCH 32/42] Fix stack use after return in new crypt module --- samba-4-21-pycrypt.patch | 150 +++++++++++++++++++++++++++++++-------- 1 file changed, 120 insertions(+), 30 deletions(-) diff --git a/samba-4-21-pycrypt.patch b/samba-4-21-pycrypt.patch index 8c197fc..bf4c1e5 100644 --- a/samba-4-21-pycrypt.patch +++ b/samba-4-21-pycrypt.patch @@ -1,7 +1,7 @@ -From 93bc860e8f344a96d0496edbc5d463f2c5411fcd Mon Sep 17 00:00:00 2001 +From 07fe7b437c695c7a715418d4414c930b72758dab Mon Sep 17 00:00:00 2001 From: Douglas Bagnall Date: Thu, 5 Dec 2024 16:35:51 +1300 -Subject: [PATCH 01/10] util: add a crypt wrapper, derived from +Subject: [PATCH 01/11] util: add a crypt wrapper, derived from dsdb:password_hash This is going to be used by the dsdb password_hash module, and exposed @@ -13,6 +13,7 @@ standard library. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 Reviewed-by: Andreas Schneider +(cherry picked from commit 833455c7f9f71583d567e3a53e854567cd8c3b0b) --- lib/util/util_crypt.c | 90 ++++++++++++++++++++++++++++++++++++++++++ lib/util/util_crypt.h | 5 +++ @@ -146,13 +147,13 @@ index b4fcfeaba07..7de9c0b7b17 100644 bld.SAMBA_SUBSYSTEM('UNIX_PRIVS', source='unix_privs.c', -- -2.34.1 +2.48.1 -From c8c1de1ac3b715e76cb987525197209e453cdd50 Mon Sep 17 00:00:00 2001 +From adf180613e4172292090d4c3573a439388a09788 Mon Sep 17 00:00:00 2001 From: Douglas Bagnall Date: Wed, 11 Dec 2024 14:29:21 +1300 -Subject: [PATCH 02/10] dsdb:password_hash: move hash_blob allocation up +Subject: [PATCH 02/11] dsdb:password_hash: move hash_blob allocation up This will make the next patch simpler. @@ -160,6 +161,7 @@ BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 Signed-off-by: Douglas Bagnall Reviewed-by: Andreas Schneider +(cherry picked from commit 1edb12f79593d0b2aac36d5acdaaae6f495772f6) --- source4/dsdb/samdb/ldb_modules/password_hash.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) @@ -200,18 +202,19 @@ index 1d1267624e2..c1902126a72 100644 *hash_blob = data_blob_talloc(hash_blob, (const uint8_t *)hash, -- -2.34.1 +2.48.1 -From ac5008598e4a4d3dbf5d58f4b4a2c6fc25195775 Mon Sep 17 00:00:00 2001 +From 9d43e4d649db23549bbb230ed60426fa286b7ab7 Mon Sep 17 00:00:00 2001 From: Douglas Bagnall Date: Thu, 12 Dec 2024 11:16:22 +1300 -Subject: [PATCH 03/10] dsdb:password_hash: use talloc_crypt_blob() +Subject: [PATCH 03/11] dsdb:password_hash: use talloc_crypt_blob() BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 Signed-off-by: Douglas Bagnall Reviewed-by: Andreas Schneider +(cherry picked from commit c7597380b479208e33a403211cec9b3c7bd3f034) --- .../dsdb/samdb/ldb_modules/password_hash.c | 68 ++++--------------- .../samdb/ldb_modules/wscript_build_server | 2 +- @@ -339,13 +342,13 @@ index 9c1eb12a7c2..16d9b31a982 100644 -- -2.34.1 +2.48.1 -From 0f19a12e9f28dd78e5108eeb22950eff48202d97 Mon Sep 17 00:00:00 2001 +From 1c94645881bd5130c67bfee96aa463f360df300a Mon Sep 17 00:00:00 2001 From: Douglas Bagnall Date: Wed, 11 Dec 2024 14:30:04 +1300 -Subject: [PATCH 04/10] util: add a crypt strerror helper +Subject: [PATCH 04/11] util: add a crypt strerror helper This will be used by Python also. @@ -353,6 +356,7 @@ BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 Signed-off-by: Douglas Bagnall Reviewed-by: Andreas Schneider +(cherry picked from commit 5f365e71c1fa8cdc533159283a5977164b5d39f2) --- lib/util/util_crypt.c | 24 +++++++++++++++++++ lib/util/util_crypt.h | 2 ++ @@ -429,13 +433,13 @@ index 7a7114c1caa..6949a92fc3e 100644 ldb, "setup_primary_userPassword: generation of a %s " -- -2.34.1 +2.48.1 -From 354ea5b1e69e27bfdd2d0b5ae8157790ba1bb590 Mon Sep 17 00:00:00 2001 +From ce70e852783ec69104d274def931e7d39f17576a Mon Sep 17 00:00:00 2001 From: Douglas Bagnall Date: Wed, 11 Dec 2024 14:30:15 +1300 -Subject: [PATCH 05/10] pyglue: add crypt() function +Subject: [PATCH 05/11] pyglue: add crypt() function This wraps talloc_crypt_blob() from lib/util/util_crypt.c which in turn wraps the system crypt[_r[n]]. @@ -448,6 +452,7 @@ BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 Signed-off-by: Douglas Bagnall Reviewed-by: Andreas Schneider +(backported from commit 88e3c82d88a68cf972f8189e1c3718698b49974a) --- python/pyglue.c | 41 +++++++++++++++++++++++++++++++++++++++++ python/wscript | 1 + @@ -539,13 +544,13 @@ index 3e6439930e9..7c17e390dc7 100644 ''' % (pyparam_util, pytalloc_util), realname='samba/_glue.so') -- -2.34.1 +2.48.1 -From fec10dfe574a8acef0646a666fd4ff54ef11adf6 Mon Sep 17 00:00:00 2001 +From 9a0dc2db7cde22f36583159c0d697a3de6640990 Mon Sep 17 00:00:00 2001 From: Douglas Bagnall Date: Thu, 12 Dec 2024 10:44:07 +1300 -Subject: [PATCH 06/10] pytest: test that _glue.crypt works +Subject: [PATCH 06/11] pytest: test that _glue.crypt works The test vectors were generated via Python 3.10 crypt module, which directly wraps crypt(3), which in this case is from glibc 2.39-0ubuntu8.3. @@ -557,6 +562,7 @@ BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 Signed-off-by: Douglas Bagnall Reviewed-by: Andreas Schneider +(cherry picked from commit 5636d30c0959fd4a211ee7b8d1b267dcdbf0b963) --- python/samba/tests/glue.py | 65 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 65 insertions(+) @@ -635,13 +641,13 @@ index ac504b3f366..824f5ca0c81 100644 + msg=f"crypt({phrase!r}, {setting!r}) didn't fail"): + _glue.crypt(phrase, setting) -- -2.34.1 +2.48.1 -From 7d1fa8cdc52423bd53de4314a62e2c2b2e0b2aa7 Mon Sep 17 00:00:00 2001 +From 6425e2514052027ee2269e15e0e0dff1686fa34e Mon Sep 17 00:00:00 2001 From: Douglas Bagnall Date: Wed, 11 Dec 2024 15:54:48 +1300 -Subject: [PATCH 07/10] samba-tool user: use _glue.crypt, not crypt.crypt +Subject: [PATCH 07/11] samba-tool user: use _glue.crypt, not crypt.crypt Because we know we have _glue.crypt, and we know it raises exceptions rather than returning None, we can simplify the checks. @@ -650,6 +656,7 @@ BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 Signed-off-by: Douglas Bagnall Reviewed-by: Andreas Schneider +(cherry picked from commit 405187d2ef4920a9a284649c9c3287f5844d5180) --- .../samba/netcmd/user/readpasswords/common.py | 21 ++++++------------- 1 file changed, 6 insertions(+), 15 deletions(-) @@ -704,13 +711,13 @@ index 7944d4e1682..68befb3f356 100644 # Add the wDigest virtual attributes, virtualWDigest01 to virtualWDigest29 for x in range(1, 30): -- -2.34.1 +2.48.1 -From dde9d1c473ac2fccfc123cfe2ca224da59042c6d Mon Sep 17 00:00:00 2001 +From a2a04286e13676177c952e67363fc7502f544861 Mon Sep 17 00:00:00 2001 From: Douglas Bagnall Date: Wed, 11 Dec 2024 15:56:20 +1300 -Subject: [PATCH 08/10] samba-tool user: hashlib.sha1 is always present +Subject: [PATCH 08/11] samba-tool user: hashlib.sha1 is always present We maybe thought we were checking that sha1 was in hashlib, but we were only checking that hashlib is in the Python library (`hashlib.sha1()` @@ -724,6 +731,7 @@ BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 Signed-off-by: Douglas Bagnall Reviewed-by: Andreas Schneider +(cherry picked from commit 4af4dd8135e8edbe2a16cfdfc7ded8c145c82e98) --- python/samba/netcmd/user/readpasswords/common.py | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-) @@ -770,13 +778,13 @@ index 68befb3f356..3043525874e 100644 h.update(salt) bv = h.digest() + salt -- -2.34.1 +2.48.1 -From 361a7bcfc203c8cf4884c3f35e7147b59c0e4116 Mon Sep 17 00:00:00 2001 +From e9a8748f3cc4ba74f8b0d75e7a01866e7c12a0a4 Mon Sep 17 00:00:00 2001 From: Douglas Bagnall Date: Thu, 12 Dec 2024 10:46:16 +1300 -Subject: [PATCH 09/10] pytest: password_hash uses internal _glue.crypt +Subject: [PATCH 09/11] pytest: password_hash uses internal _glue.crypt This will remove an external dependency. @@ -784,6 +792,7 @@ BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 Signed-off-by: Douglas Bagnall Reviewed-by: Andreas Schneider +(cherry picked from commit 552053b6445611ecef6ac4c11c55ebf92f03571d) --- python/samba/tests/password_hash.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) @@ -815,13 +824,13 @@ index 1b7af7de7b8..39ef13fd7b2 100644 i += 1 -- -2.34.1 +2.48.1 -From 11ec542b49c4fe165ce717b0f978439ed717f3e0 Mon Sep 17 00:00:00 2001 +From 0e01dc4f1fabfd2c3f21f724c05d94227a278b20 Mon Sep 17 00:00:00 2001 From: Douglas Bagnall Date: Wed, 11 Dec 2024 14:31:18 +1300 -Subject: [PATCH 10/10] util:datablob: data_blob_pad checks its alignment +Subject: [PATCH 10/11] util:datablob: data_blob_pad checks its alignment assumption BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 @@ -831,6 +840,8 @@ Reviewed-by: Andreas Schneider Autobuild-User(master): Andreas Schneider Autobuild-Date(master): Fri Dec 20 07:59:51 UTC 2024 on atb-devel-224 + +(cherry picked from commit 8b84282008dc372d67ba01c8fe256ef756c3dcfb) --- lib/util/data_blob.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) @@ -849,5 +860,84 @@ index b5b78bc7a8a..0522e7755af 100644 } -- -2.34.1 +2.48.1 + + +From 8cfae9f33fb1c170c3fe937be200490597e9e4c2 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Fri, 17 Jan 2025 13:28:30 +0100 +Subject: [PATCH 11/11] lib:util: Fix stack-use-after-return in + crypt_as_best_we_can() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15784 + +Signed-off-by: Andreas Schneider +Reviewed-by: Douglas Bagnall +Reviewed-by: Pavel Filipenský + +Autobuild-User(master): Douglas Bagnall +Autobuild-Date(master): Fri Jan 17 23:21:13 UTC 2025 on atb-devel-224 + +(cherry picked from commit 6cd9849b58ec653cbffc602e3c96996a082faf53) +--- + lib/util/util_crypt.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +diff --git a/lib/util/util_crypt.c b/lib/util/util_crypt.c +index 09cd47597d1..9ac6e1cfd0e 100644 +--- a/lib/util/util_crypt.c ++++ b/lib/util/util_crypt.c +@@ -1,11 +1,13 @@ + #include + #include "data_blob.h" ++#include "discard.h" + #include + #include + #include "util_crypt.h" + + +-static int crypt_as_best_we_can(const char *phrase, ++static int crypt_as_best_we_can(TALLOC_CTX *mem_ctx, ++ const char *phrase, + const char *setting, + const char **hashp) + { +@@ -63,8 +65,14 @@ static int crypt_as_best_we_can(const char *phrase, + ret = ENOTRECOVERABLE; + } + } ++ if (ret != 0) { ++ return ret; ++ } + +- *hashp = hash; ++ *hashp = talloc_strdup(mem_ctx, hash); ++ if (*hashp == NULL) { ++ ret = -1; ++ } + return ret; + } + +@@ -75,14 +83,14 @@ int talloc_crypt_blob(TALLOC_CTX *mem_ctx, + DATA_BLOB *blob) + { + const char *hash = NULL; +- int ret = crypt_as_best_we_can(phrase, setting, &hash); ++ int ret = crypt_as_best_we_can(mem_ctx, phrase, setting, &hash); + if (ret != 0) { + blob->data = NULL; + blob->length = 0; + return ret; + } + blob->length = strlen(hash); +- blob->data = talloc_memdup(mem_ctx, hash, blob->length); ++ blob->data = discard_const_p(uint8_t, hash); + if (blob->data == NULL) { + return ENOMEM; + } +-- +2.48.1 From 04909c8df21662d0ad1cd7780f21a453190a6775 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 22 Jan 2025 09:03:43 +0100 Subject: [PATCH 33/42] Fix building with gcc 15 --- samba-4-21-fix-smbreadline.patch | 112 +++++++++++++++++++++++++++++++ samba.spec | 1 + 2 files changed, 113 insertions(+) create mode 100644 samba-4-21-fix-smbreadline.patch diff --git a/samba-4-21-fix-smbreadline.patch b/samba-4-21-fix-smbreadline.patch new file mode 100644 index 0000000..9fd288d --- /dev/null +++ b/samba-4-21-fix-smbreadline.patch @@ -0,0 +1,112 @@ +From 36e3944418789f5d2018063fa3988c318baa0a35 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 21 Jan 2025 17:59:12 +0100 +Subject: [PATCH 1/2] lib:replace: Remove trailing spaces from readline.h + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15788 + +Signed-off-by: Andreas Schneider +Reviewed-by: Alexander Bokovoy +(cherry picked from commit dbff53f77680f0ccd022f2d864ba6ae7585a34b7) +--- + lib/replace/system/readline.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/lib/replace/system/readline.h b/lib/replace/system/readline.h +index 29379626e0d..9a9af266ca6 100644 +--- a/lib/replace/system/readline.h ++++ b/lib/replace/system/readline.h +@@ -1,14 +1,14 @@ + #ifndef _system_readline_h + #define _system_readline_h +-/* ++/* + Unix SMB/CIFS implementation. + + Readline wrappers +- ++ + ** NOTE! The following LGPL license applies to the replace + ** library. This does NOT imply that all of Samba is released + ** under the LGPL +- ++ + This library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either +-- +2.48.1 + + +From 6944f700dcd4ad795652070dfb04135d602622a2 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 21 Jan 2025 17:59:27 +0100 +Subject: [PATCH 2/2] lib:replace: Don't use deprecated readline CPPFunction + cast +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +HAVE_RL_COMPLETION_FUNC_T was unused and not checking for the right +function. + +libcli/smbreadline/smbreadline.c: In function ‘smb_readline’: +libcli/smbreadline/smbreadline.c:139:17: warning: ‘CPPFunction’ is deprecated [-Wdeprecated-declarations] + 139 | rl_attempted_completion_function = RL_COMPLETION_CAST completion_fn; + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +libcli/smbreadline/smbreadline.c:139:50: error: assignment to ‘char ** (*)(const char *, int, int)’ from incompatible pointer type ‘char ** (*)(void)’ [-Wincompatible-pointer-types] + 139 | rl_attempted_completion_function = RL_COMPLETION_CAST completion_fn; + | ^ + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15788 + +Signed-off-by: Andreas Schneider +Reviewed-by: Alexander Bokovoy + +Autobuild-User(master): Andreas Schneider +Autobuild-Date(master): Tue Jan 21 19:38:37 UTC 2025 on atb-devel-224 + +(cherry picked from commit 9aa5c43315d83c19514251a11c4fba5a137f2821) +--- + lib/replace/system/readline.h | 4 +++- + libcli/smbreadline/wscript_configure | 8 +++++--- + 2 files changed, 8 insertions(+), 4 deletions(-) + +diff --git a/lib/replace/system/readline.h b/lib/replace/system/readline.h +index 9a9af266ca6..ac3604fc12e 100644 +--- a/lib/replace/system/readline.h ++++ b/lib/replace/system/readline.h +@@ -46,7 +46,9 @@ + #endif + + #ifdef HAVE_NEW_LIBREADLINE +-#ifdef HAVE_CPPFUNCTION ++#if defined(HAVE_RL_COMPLETION_FUNC_T) ++# define RL_COMPLETION_CAST (rl_completion_func_t *) ++#elif defined(HAVE_CPPFUNCTION) + # define RL_COMPLETION_CAST (CPPFunction *) + #elif defined(HAVE_RL_COMPLETION_T) + # define RL_COMPLETION_CAST (rl_completion_t *) +diff --git a/libcli/smbreadline/wscript_configure b/libcli/smbreadline/wscript_configure +index 912ff53a150..f5a401ebae0 100644 +--- a/libcli/smbreadline/wscript_configure ++++ b/libcli/smbreadline/wscript_configure +@@ -51,10 +51,12 @@ conf.CHECK_CODE(''' + # endif + # endif + #endif +-int main(void) {rl_completion_t f; return 0;} ++int main(void) {rl_completion_func_t f; return 0;} + ''', +-'HAVE_RL_COMPLETION_FUNC_T', execute=False, addmain=False, +-msg='Checking for rl_completion_t') ++ 'HAVE_RL_COMPLETION_FUNC_T', ++ execute=False, ++ addmain=False, ++ msg='Checking for rl_completion_func_t') + + conf.CHECK_CODE(''' + #ifdef HAVE_READLINE_READLINE_H +-- +2.48.1 + diff --git a/samba.spec b/samba.spec index 30fdeb5..0852641 100644 --- a/samba.spec +++ b/samba.spec @@ -252,6 +252,7 @@ Source202: samba.abignore Patch0: samba-4.21.0-s3-notifyd.patch Patch1: samba-4-21-pycrypt.patch +Patch2: samba-4-21-fix-smbreadline.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} From 0818e0561de305da087f054d522d0bf72c21c39e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 17 Feb 2025 19:11:57 +0100 Subject: [PATCH 34/42] Update to version 4.21.4 Guenther --- samba-4-21-fix-smbreadline.patch | 112 ---- samba-4-21-pycrypt.patch | 943 ------------------------------- samba.spec | 6 +- sources | 4 +- 4 files changed, 5 insertions(+), 1060 deletions(-) delete mode 100644 samba-4-21-fix-smbreadline.patch delete mode 100644 samba-4-21-pycrypt.patch diff --git a/samba-4-21-fix-smbreadline.patch b/samba-4-21-fix-smbreadline.patch deleted file mode 100644 index 9fd288d..0000000 --- a/samba-4-21-fix-smbreadline.patch +++ /dev/null @@ -1,112 +0,0 @@ -From 36e3944418789f5d2018063fa3988c318baa0a35 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Tue, 21 Jan 2025 17:59:12 +0100 -Subject: [PATCH 1/2] lib:replace: Remove trailing spaces from readline.h - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15788 - -Signed-off-by: Andreas Schneider -Reviewed-by: Alexander Bokovoy -(cherry picked from commit dbff53f77680f0ccd022f2d864ba6ae7585a34b7) ---- - lib/replace/system/readline.h | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/lib/replace/system/readline.h b/lib/replace/system/readline.h -index 29379626e0d..9a9af266ca6 100644 ---- a/lib/replace/system/readline.h -+++ b/lib/replace/system/readline.h -@@ -1,14 +1,14 @@ - #ifndef _system_readline_h - #define _system_readline_h --/* -+/* - Unix SMB/CIFS implementation. - - Readline wrappers -- -+ - ** NOTE! The following LGPL license applies to the replace - ** library. This does NOT imply that all of Samba is released - ** under the LGPL -- -+ - This library is free software; you can redistribute it and/or - modify it under the terms of the GNU Lesser General Public - License as published by the Free Software Foundation; either --- -2.48.1 - - -From 6944f700dcd4ad795652070dfb04135d602622a2 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Tue, 21 Jan 2025 17:59:27 +0100 -Subject: [PATCH 2/2] lib:replace: Don't use deprecated readline CPPFunction - cast -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -HAVE_RL_COMPLETION_FUNC_T was unused and not checking for the right -function. - -libcli/smbreadline/smbreadline.c: In function ‘smb_readline’: -libcli/smbreadline/smbreadline.c:139:17: warning: ‘CPPFunction’ is deprecated [-Wdeprecated-declarations] - 139 | rl_attempted_completion_function = RL_COMPLETION_CAST completion_fn; - | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -libcli/smbreadline/smbreadline.c:139:50: error: assignment to ‘char ** (*)(const char *, int, int)’ from incompatible pointer type ‘char ** (*)(void)’ [-Wincompatible-pointer-types] - 139 | rl_attempted_completion_function = RL_COMPLETION_CAST completion_fn; - | ^ - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15788 - -Signed-off-by: Andreas Schneider -Reviewed-by: Alexander Bokovoy - -Autobuild-User(master): Andreas Schneider -Autobuild-Date(master): Tue Jan 21 19:38:37 UTC 2025 on atb-devel-224 - -(cherry picked from commit 9aa5c43315d83c19514251a11c4fba5a137f2821) ---- - lib/replace/system/readline.h | 4 +++- - libcli/smbreadline/wscript_configure | 8 +++++--- - 2 files changed, 8 insertions(+), 4 deletions(-) - -diff --git a/lib/replace/system/readline.h b/lib/replace/system/readline.h -index 9a9af266ca6..ac3604fc12e 100644 ---- a/lib/replace/system/readline.h -+++ b/lib/replace/system/readline.h -@@ -46,7 +46,9 @@ - #endif - - #ifdef HAVE_NEW_LIBREADLINE --#ifdef HAVE_CPPFUNCTION -+#if defined(HAVE_RL_COMPLETION_FUNC_T) -+# define RL_COMPLETION_CAST (rl_completion_func_t *) -+#elif defined(HAVE_CPPFUNCTION) - # define RL_COMPLETION_CAST (CPPFunction *) - #elif defined(HAVE_RL_COMPLETION_T) - # define RL_COMPLETION_CAST (rl_completion_t *) -diff --git a/libcli/smbreadline/wscript_configure b/libcli/smbreadline/wscript_configure -index 912ff53a150..f5a401ebae0 100644 ---- a/libcli/smbreadline/wscript_configure -+++ b/libcli/smbreadline/wscript_configure -@@ -51,10 +51,12 @@ conf.CHECK_CODE(''' - # endif - # endif - #endif --int main(void) {rl_completion_t f; return 0;} -+int main(void) {rl_completion_func_t f; return 0;} - ''', --'HAVE_RL_COMPLETION_FUNC_T', execute=False, addmain=False, --msg='Checking for rl_completion_t') -+ 'HAVE_RL_COMPLETION_FUNC_T', -+ execute=False, -+ addmain=False, -+ msg='Checking for rl_completion_func_t') - - conf.CHECK_CODE(''' - #ifdef HAVE_READLINE_READLINE_H --- -2.48.1 - diff --git a/samba-4-21-pycrypt.patch b/samba-4-21-pycrypt.patch deleted file mode 100644 index bf4c1e5..0000000 --- a/samba-4-21-pycrypt.patch +++ /dev/null @@ -1,943 +0,0 @@ -From 07fe7b437c695c7a715418d4414c930b72758dab Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Thu, 5 Dec 2024 16:35:51 +1300 -Subject: [PATCH 01/11] util: add a crypt wrapper, derived from - dsdb:password_hash - -This is going to be used by the dsdb password_hash module, and exposed -to Python via pyglue. - -We're doing this because Python 3.13 has dropped crypt from the Python -standard library. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Reviewed-by: Andreas Schneider -(cherry picked from commit 833455c7f9f71583d567e3a53e854567cd8c3b0b) ---- - lib/util/util_crypt.c | 90 ++++++++++++++++++++++++++++++++++++++++++ - lib/util/util_crypt.h | 5 +++ - lib/util/wscript_build | 6 +++ - 3 files changed, 101 insertions(+) - create mode 100644 lib/util/util_crypt.c - create mode 100644 lib/util/util_crypt.h - -diff --git a/lib/util/util_crypt.c b/lib/util/util_crypt.c -new file mode 100644 -index 00000000000..0f7b2d0fd31 ---- /dev/null -+++ b/lib/util/util_crypt.c -@@ -0,0 +1,90 @@ -+#include -+#include "data_blob.h" -+#include -+#include -+#include "util_crypt.h" -+ -+ -+static int crypt_as_best_we_can(const char *phrase, -+ const char *setting, -+ const char **hashp) -+{ -+ int ret = 0; -+ const char *hash = NULL; -+ -+#if defined(HAVE_CRYPT_R) || defined(HAVE_CRYPT_RN) -+ struct crypt_data crypt_data = { -+ .initialized = 0 /* working storage used by crypt */ -+ }; -+#endif -+ -+ /* -+ * crypt_r() and crypt() may return a null pointer upon error -+ * depending on how libcrypt was configured, so we prefer -+ * crypt_rn() from libcrypt / libxcrypt which always returns -+ * NULL on error. -+ * -+ * POSIX specifies returning a null pointer and setting -+ * errno. -+ * -+ * RHEL 7 (which does not use libcrypt / libxcrypt) returns a -+ * non-NULL pointer from crypt_r() on success but (always?) -+ * sets errno during internal processing in the NSS crypto -+ * subsystem. -+ * -+ * By preferring crypt_rn we avoid the 'return non-NULL but -+ * set-errno' that we otherwise cannot tell apart from the -+ * RHEL 7 behaviour. -+ */ -+ errno = 0; -+ -+#ifdef HAVE_CRYPT_RN -+ hash = crypt_rn(phrase, setting, -+ &crypt_data, -+ sizeof(crypt_data)); -+#elif HAVE_CRYPT_R -+ hash = crypt_r(phrase, setting, &crypt_data); -+#else -+ /* -+ * No crypt_r falling back to crypt, which is NOT thread safe -+ * Thread safety MT-Unsafe race:crypt -+ */ -+ hash = crypt(phrase, setting); -+#endif -+ /* -+ * On error, crypt() and crypt_r() may return a null pointer, -+ * or a pointer to an invalid hash beginning with a '*'. -+ */ -+ ret = errno; -+ errno = 0; -+ if (hash == NULL || hash[0] == '*') { -+ if (ret == 0) { -+ /* this is annoying */ -+ ret = ENOTRECOVERABLE; -+ } -+ } -+ -+ *hashp = hash; -+ return ret; -+} -+ -+ -+int talloc_crypt_blob(TALLOC_CTX *mem_ctx, -+ const char *phrase, -+ const char *setting, -+ DATA_BLOB *blob) -+{ -+ const char *hash = NULL; -+ int ret = crypt_as_best_we_can(phrase, setting, &hash); -+ if (ret != 0) { -+ blob->data = NULL; -+ blob->length = 0; -+ return ret; -+ } -+ blob->length = strlen(hash); -+ blob->data = talloc_memdup(mem_ctx, hash, blob->length); -+ if (blob->data == NULL) { -+ return ENOMEM; -+ } -+ return 0; -+} -diff --git a/lib/util/util_crypt.h b/lib/util/util_crypt.h -new file mode 100644 -index 00000000000..8c289e489e8 ---- /dev/null -+++ b/lib/util/util_crypt.h -@@ -0,0 +1,5 @@ -+ -+int talloc_crypt_blob(TALLOC_CTX *mem_ctx, -+ const char *phrase, -+ const char *cmd, -+ DATA_BLOB *blob); -diff --git a/lib/util/wscript_build b/lib/util/wscript_build -index b4fcfeaba07..7de9c0b7b17 100644 ---- a/lib/util/wscript_build -+++ b/lib/util/wscript_build -@@ -253,6 +253,12 @@ else: - private_library=True, - local_include=False) - -+ bld.SAMBA_LIBRARY('util_crypt', -+ source='util_crypt.c', -+ deps='talloc crypt', -+ private_library=True, -+ local_include=False) -+ - - bld.SAMBA_SUBSYSTEM('UNIX_PRIVS', - source='unix_privs.c', --- -2.48.1 - - -From adf180613e4172292090d4c3573a439388a09788 Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Wed, 11 Dec 2024 14:29:21 +1300 -Subject: [PATCH 02/11] dsdb:password_hash: move hash_blob allocation up - -This will make the next patch simpler. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider -(cherry picked from commit 1edb12f79593d0b2aac36d5acdaaae6f495772f6) ---- - source4/dsdb/samdb/ldb_modules/password_hash.c | 14 ++++++++------ - 1 file changed, 8 insertions(+), 6 deletions(-) - -diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c -index 1d1267624e2..c1902126a72 100644 ---- a/source4/dsdb/samdb/ldb_modules/password_hash.c -+++ b/source4/dsdb/samdb/ldb_modules/password_hash.c -@@ -1649,6 +1649,13 @@ static int setup_primary_userPassword_hash( - } - } - -+ hash_blob = talloc_zero(ctx, DATA_BLOB); -+ -+ if (hash_blob == NULL) { -+ TALLOC_FREE(frame); -+ return ldb_oom(ldb); -+ } -+ - /* - * Relies on the assertion that cleartext_utf8->data is a zero - * terminated UTF-8 string -@@ -1712,15 +1719,10 @@ static int setup_primary_userPassword_hash( - scheme, - reason); - TALLOC_FREE(frame); -+ TALLOC_FREE(hash_blob); - return LDB_ERR_OPERATIONS_ERROR; - } - -- hash_blob = talloc_zero(ctx, DATA_BLOB); -- -- if (hash_blob == NULL) { -- TALLOC_FREE(frame); -- return ldb_oom(ldb); -- } - - *hash_blob = data_blob_talloc(hash_blob, - (const uint8_t *)hash, --- -2.48.1 - - -From 9d43e4d649db23549bbb230ed60426fa286b7ab7 Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Thu, 12 Dec 2024 11:16:22 +1300 -Subject: [PATCH 03/11] dsdb:password_hash: use talloc_crypt_blob() - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider -(cherry picked from commit c7597380b479208e33a403211cec9b3c7bd3f034) ---- - .../dsdb/samdb/ldb_modules/password_hash.c | 68 ++++--------------- - .../samdb/ldb_modules/wscript_build_server | 2 +- - 2 files changed, 13 insertions(+), 57 deletions(-) - -diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c -index c1902126a72..7a7114c1caa 100644 ---- a/source4/dsdb/samdb/ldb_modules/password_hash.c -+++ b/source4/dsdb/samdb/ldb_modules/password_hash.c -@@ -51,6 +51,7 @@ - #include "auth/common_auth.h" - #include "lib/messaging/messaging.h" - #include "lib/param/loadparm.h" -+#include "lib/util/util_crypt.h" - - #include "lib/crypto/gnutls_helpers.h" - #include -@@ -1592,16 +1593,11 @@ static int setup_primary_userPassword_hash( - struct ldb_context *ldb = ldb_module_get_ctx(io->ac->module); - const char *salt = NULL; /* Randomly generated salt */ - const char *cmd = NULL; /* command passed to crypt */ -- const char *hash = NULL; /* password hash generated by crypt */ - int algorithm = 0; /* crypt hash algorithm number */ - int rounds = 0; /* The number of hash rounds */ -+ int ret; - DATA_BLOB *hash_blob = NULL; - TALLOC_CTX *frame = talloc_stackframe(); --#if defined(HAVE_CRYPT_R) || defined(HAVE_CRYPT_RN) -- struct crypt_data crypt_data = { -- .initialized = 0 /* working storage used by crypt */ -- }; --#endif - - /* Generate a random password salt */ - salt = generate_random_str_list(frame, -@@ -1660,52 +1656,20 @@ static int setup_primary_userPassword_hash( - * Relies on the assertion that cleartext_utf8->data is a zero - * terminated UTF-8 string - */ -- -- /* -- * crypt_r() and crypt() may return a null pointer upon error -- * depending on how libcrypt was configured, so we prefer -- * crypt_rn() from libcrypt / libxcrypt which always returns -- * NULL on error. -- * -- * POSIX specifies returning a null pointer and setting -- * errno. -- * -- * RHEL 7 (which does not use libcrypt / libxcrypt) returns a -- * non-NULL pointer from crypt_r() on success but (always?) -- * sets errno during internal processing in the NSS crypto -- * subsystem. -- * -- * By preferring crypt_rn we avoid the 'return non-NULL but -- * set-errno' that we otherwise cannot tell apart from the -- * RHEL 7 behaviour. -- */ -- errno = 0; -- --#ifdef HAVE_CRYPT_RN -- hash = crypt_rn((char *)io->n.cleartext_utf8->data, -- cmd, -- &crypt_data, -- sizeof(crypt_data)); --#elif HAVE_CRYPT_R -- hash = crypt_r((char *)io->n.cleartext_utf8->data, cmd, &crypt_data); --#else -- /* -- * No crypt_r falling back to crypt, which is NOT thread safe -- * Thread safety MT-Unsafe race:crypt -- */ -- hash = crypt((char *)io->n.cleartext_utf8->data, cmd); --#endif -- /* -- * On error, crypt() and crypt_r() may return a null pointer, -- * or a pointer to an invalid hash beginning with a '*'. -- */ -- if (hash == NULL || hash[0] == '*') { -+ ret = talloc_crypt_blob(hash_blob, -+ (char *)io->n.cleartext_utf8->data, -+ cmd, -+ hash_blob); -+ if (ret != 0) { - char buf[1024]; - const char *reason = NULL; -- if (errno == ERANGE) { -+ if (ret == ERANGE) { - reason = "Password exceeds maximum length allowed for crypt() hashing"; -+ } else if (ret == ENOTRECOVERABLE) { -+ /* probably weird RHEL7 crypt, see talloc_crypt_blob() */ -+ reason = "Unknown error"; - } else { -- int err = strerror_r(errno, buf, sizeof(buf)); -+ int err = strerror_r(ret, buf, sizeof(buf)); - if (err == 0) { - reason = buf; - } else { -@@ -1723,14 +1687,6 @@ static int setup_primary_userPassword_hash( - return LDB_ERR_OPERATIONS_ERROR; - } - -- -- *hash_blob = data_blob_talloc(hash_blob, -- (const uint8_t *)hash, -- strlen(hash)); -- if (hash_blob->data == NULL) { -- TALLOC_FREE(frame); -- return ldb_oom(ldb); -- } - hash_value->value = hash_blob; - TALLOC_FREE(frame); - return LDB_SUCCESS; -diff --git a/source4/dsdb/samdb/ldb_modules/wscript_build_server b/source4/dsdb/samdb/ldb_modules/wscript_build_server -index 9c1eb12a7c2..16d9b31a982 100644 ---- a/source4/dsdb/samdb/ldb_modules/wscript_build_server -+++ b/source4/dsdb/samdb/ldb_modules/wscript_build_server -@@ -195,7 +195,7 @@ bld.SAMBA_MODULE('ldb_password_hash', - init_function='ldb_password_hash_module_init', - module_init_name='ldb_init_module', - internal_module=False, -- deps='talloc samdb LIBCLI_AUTH NDR_DRSBLOBS authkrb5 krb5 gpgme DSDB_MODULE_HELPERS crypt db-glue' -+ deps='talloc samdb LIBCLI_AUTH NDR_DRSBLOBS authkrb5 krb5 gpgme DSDB_MODULE_HELPERS util_crypt db-glue' - ) - - --- -2.48.1 - - -From 1c94645881bd5130c67bfee96aa463f360df300a Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Wed, 11 Dec 2024 14:30:04 +1300 -Subject: [PATCH 04/11] util: add a crypt strerror helper - -This will be used by Python also. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider -(cherry picked from commit 5f365e71c1fa8cdc533159283a5977164b5d39f2) ---- - lib/util/util_crypt.c | 24 +++++++++++++++++++ - lib/util/util_crypt.h | 2 ++ - .../dsdb/samdb/ldb_modules/password_hash.c | 16 +------------ - 3 files changed, 27 insertions(+), 15 deletions(-) - -diff --git a/lib/util/util_crypt.c b/lib/util/util_crypt.c -index 0f7b2d0fd31..09cd47597d1 100644 ---- a/lib/util/util_crypt.c -+++ b/lib/util/util_crypt.c -@@ -88,3 +88,27 @@ int talloc_crypt_blob(TALLOC_CTX *mem_ctx, - } - return 0; - } -+ -+ -+char *talloc_crypt_errstring(TALLOC_CTX *mem_ctx, int error) -+{ -+ char buf[1024]; -+ int err; -+ if (error == ERANGE) { -+ return talloc_strdup( -+ mem_ctx, -+ "Password exceeds maximum length allowed for crypt() hashing"); -+ } -+ if (error == ENOTRECOVERABLE) { -+ /* probably weird RHEL7 crypt, see crypt_as_best_we_can() */ -+ goto unknown; -+ } -+ -+ err = strerror_r(error, buf, sizeof(buf)); -+ if (err != 0) { -+ goto unknown; -+ } -+ return talloc_strndup(mem_ctx, buf, sizeof(buf)); -+unknown: -+ return talloc_strdup(mem_ctx, "Unknown error"); -+} -diff --git a/lib/util/util_crypt.h b/lib/util/util_crypt.h -index 8c289e489e8..ca1a58e922c 100644 ---- a/lib/util/util_crypt.h -+++ b/lib/util/util_crypt.h -@@ -3,3 +3,5 @@ int talloc_crypt_blob(TALLOC_CTX *mem_ctx, - const char *phrase, - const char *cmd, - DATA_BLOB *blob); -+ -+char *talloc_crypt_errstring(TALLOC_CTX *mem_ctx, int error); -diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c -index 7a7114c1caa..6949a92fc3e 100644 ---- a/source4/dsdb/samdb/ldb_modules/password_hash.c -+++ b/source4/dsdb/samdb/ldb_modules/password_hash.c -@@ -1661,21 +1661,7 @@ static int setup_primary_userPassword_hash( - cmd, - hash_blob); - if (ret != 0) { -- char buf[1024]; -- const char *reason = NULL; -- if (ret == ERANGE) { -- reason = "Password exceeds maximum length allowed for crypt() hashing"; -- } else if (ret == ENOTRECOVERABLE) { -- /* probably weird RHEL7 crypt, see talloc_crypt_blob() */ -- reason = "Unknown error"; -- } else { -- int err = strerror_r(ret, buf, sizeof(buf)); -- if (err == 0) { -- reason = buf; -- } else { -- reason = "Unknown error"; -- } -- } -+ const char *reason = talloc_crypt_errstring(frame, ret); - ldb_asprintf_errstring( - ldb, - "setup_primary_userPassword: generation of a %s " --- -2.48.1 - - -From ce70e852783ec69104d274def931e7d39f17576a Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Wed, 11 Dec 2024 14:30:15 +1300 -Subject: [PATCH 05/11] pyglue: add crypt() function - -This wraps talloc_crypt_blob() from lib/util/util_crypt.c which in -turn wraps the system crypt[_r[n]]. - -We want this because the Python standard library crypt module is going -away. That one also wrapped the system crypt or crypt_r, so there -should be no change. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider -(backported from commit 88e3c82d88a68cf972f8189e1c3718698b49974a) ---- - python/pyglue.c | 41 +++++++++++++++++++++++++++++++++++++++++ - python/wscript | 1 + - 2 files changed, 42 insertions(+) - -diff --git a/python/pyglue.c b/python/pyglue.c -index 042bf9e14f3..fcccb849f5e 100644 ---- a/python/pyglue.c -+++ b/python/pyglue.c -@@ -18,6 +18,7 @@ - */ - - #include "lib/replace/system/python.h" -+#include "pyerrors.h" - #include "python/py3compat.h" - #include "includes.h" - #include "python/modules.h" -@@ -25,6 +26,7 @@ - #include "param/pyparam.h" - #include "lib/socket/netif.h" - #include "lib/util/debug.h" -+#include "lib/util/util_crypt.h" - #include "librpc/ndr/ndr_private.h" - #include "lib/cmdline/cmdline.h" - #include "lib/crypto/gkdi.h" -@@ -519,6 +521,42 @@ static PyObject *py_get_burnt_commandline(PyObject *self, PyObject *args) - return ret; - } - -+static PyObject *py_crypt(PyObject *self, PyObject *args) -+{ -+ PyObject *py_hash = NULL; -+ char *phrase = NULL; -+ char *setting = NULL; -+ TALLOC_CTX *frame = NULL; -+ int ret; -+ DATA_BLOB hash = {}; -+ -+ if (!PyArg_ParseTuple(args, "ss", &phrase, &setting)) { -+ TALLOC_FREE(frame); -+ return NULL; -+ } -+ frame = talloc_stackframe(); -+ ret = talloc_crypt_blob(frame, phrase, setting, &hash); -+ if (ret != 0) { -+ const char *errstr = talloc_crypt_errstring(frame, ret); -+ if (ret == EINVAL || ret == ERANGE || ret == ENOTRECOVERABLE) { -+ PyErr_Format(PyExc_ValueError, -+ "could not crypt(): %s", -+ errstr); -+ } else { -+ PyErr_Format(PyExc_OSError, -+ "could not crypt(): %s", -+ errstr); -+ } -+ TALLOC_FREE(frame); -+ return NULL; -+ } -+ -+ py_hash = PyUnicode_FromStringAndSize((char *)hash.data, hash.length); -+ TALLOC_FREE(frame); -+ return py_hash; -+} -+ -+ - static PyMethodDef py_misc_methods[] = { - { "generate_random_str", (PyCFunction)py_generate_random_str, METH_VARARGS, - "generate_random_str(len) -> string\n" -@@ -580,6 +618,9 @@ static PyMethodDef py_misc_methods[] = { - METH_NOARGS, "How many NDR internal tokens is too many for this build?" }, - { "get_burnt_commandline", (PyCFunction)py_get_burnt_commandline, - METH_VARARGS, "Return a redacted commandline to feed to setproctitle (None if no redaction required)" }, -+ { "crypt", (PyCFunction)py_crypt, -+ METH_VARARGS, -+ "encrypt as phrase, per crypt(3), as determined by setting." }, - {0} - }; - -diff --git a/python/wscript b/python/wscript -index 3e6439930e9..7c17e390dc7 100644 ---- a/python/wscript -+++ b/python/wscript -@@ -119,6 +119,7 @@ def build(bld): - ndr - cmdline - gkdi -+ util_crypt - %s - ''' % (pyparam_util, pytalloc_util), - realname='samba/_glue.so') --- -2.48.1 - - -From 9a0dc2db7cde22f36583159c0d697a3de6640990 Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Thu, 12 Dec 2024 10:44:07 +1300 -Subject: [PATCH 06/11] pytest: test that _glue.crypt works - -The test vectors were generated via Python 3.10 crypt module, which -directly wraps crypt(3), which in this case is from glibc 2.39-0ubuntu8.3. - -We mainly test the sha256 and sha512 vectors, which seems to be all we -use, and which are said to be widely supported. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider -(cherry picked from commit 5636d30c0959fd4a211ee7b8d1b267dcdbf0b963) ---- - python/samba/tests/glue.py | 65 ++++++++++++++++++++++++++++++++++++++ - 1 file changed, 65 insertions(+) - -diff --git a/python/samba/tests/glue.py b/python/samba/tests/glue.py -index ac504b3f366..824f5ca0c81 100644 ---- a/python/samba/tests/glue.py -+++ b/python/samba/tests/glue.py -@@ -88,3 +88,68 @@ class GlueTests(samba.tests.TestCase): - self.assertEqual(_glue.strstr_m(string, '_'), '_string_num__one') - self.assertEqual(_glue.strstr_m(string, '__'), '__one') - self.assertEqual(_glue.strstr_m(string, 'ring'), 'ring_num__one') -+ -+ def test_crypt(self): -+ # We hopefully only use schemes 5 and 6 (sha256 and sha512), -+ # which are OK and also quite widely supported according to -+ # https://en.wikipedia.org/wiki/Crypt_(C) -+ for phrase, setting, expected in [ -+ ("a", "$5$aaaaaa", -+ "$5$aaaaaa$F4lxguL7mZR7TGlvukPTJIxoRhVmHMZs8ZdH8oDP0.6"), -+ # with scheme 5, 5000 rounds is default, so hash is the same as above -+ ('a', '$5$rounds=5000$aaaaaa', -+ '$5$rounds=5000$aaaaaa$F4lxguL7mZR7TGlvukPTJIxoRhVmHMZs8ZdH8oDP0.6'), -+ ('a', -+ '$5$rounds=4999$aaaaaa', -+ '$5$rounds=4999$aaaaaa$FiP70gtxOJUFLokUJvET06E7jbL6aNmF6Wtv2ddzjY8'), -+ ('a', '$5$aaaaab', -+ '$5$aaaaab$e9qR2F833/JyuMu.nkQc9kn184vBWLo0ODqnCe./mj0'), -+ -+ ('', '$5$aaaaaa', '$5$aaaaaa$5B4WTdWp5n/v/aNUw2N8RsEitqvlZJEaAKhH/pOkGg4'), -+ -+ ("a", "$6$aaaaaa", -+ "$6$aaaaaa$KHs/Ez7X/I5/K.V8FR7kEsx9rOvjXnEDUmGC.dLBWP87XWy.oUEAM7QYcZQRVhiDwGepOF2pKrCVETYLyASh60"), -+ -+ ('', '$5$', '$5$$3c2QQ0KjIU1OLtB29cl8Fplc2WN7X89bnoEjaR7tWu.'), -+ -+ # scheme 1 (md5) should be supported if not used -+ ('a', '$1$aaaaaa', -+ '$1$aaaaaa$MUMWPbGfzrHFCNm7ZHg31.'), -+ -+ ('', '$6$', -+ '$6$$/chiBau24cE26QQVW3IfIe68Xu5.JQ4E8Ie7lcRLwqxO5cxGuBhqF2HmTL.zWJ9zjChg3yJYFXeGBQ2y3Ba1d1'), -+ (' ', -+ '$6$6', -+ '$6$6$asLnbxf0obyuv3ybNvDE9ZcdwGFkDhLe7uW.wzdOdKCm4/M3vGFKq4Ttk1tBQrOn4wALZ3tj1L8IarIu5i8hR/'), -+ -+ # original DES scheme, 12 bits of salt -+ ("a", "lalala", "laKGbFzgh./R2"), -+ ("a", "lalalaLALALAla", "laKGbFzgh./R2"), -+ ("a", "arrgh", "ar7VUiUvDhX2c"), -+ ("a", "arrggghhh", "ar7VUiUvDhX2c"), -+ ]: -+ hash = _glue.crypt(phrase, setting) -+ self.assertEqual(hash, expected) -+ -+ def test_crypt_bad(self): -+ # We can't be too strident in our assertions, because every -+ # system allows a different set of algorithms, and some have -+ # different ideas of how to parse. -+ for phrase, setting, exception in [ -+ ("a", "$5", ValueError), -+ ("a", "$0$", ValueError), -+ ("a", None, TypeError), -+ (None, "", TypeError), -+ ('a', '$66$', ValueError), -+ ('a', '$$', ValueError), -+ ('a', '*0', ValueError), -+ ('a', '*', ValueError), -+ ('a', '++', ValueError), -+ # this next one is too long, except on Rocky Linux 8. -+ #('a' * 10000, '$5$5', ValueError), -+ # this is invalid, except on Debian 11. -+ # (' ', '$6$ ', ValueError), -+ ]: -+ with self.assertRaises(exception, -+ msg=f"crypt({phrase!r}, {setting!r}) didn't fail"): -+ _glue.crypt(phrase, setting) --- -2.48.1 - - -From 6425e2514052027ee2269e15e0e0dff1686fa34e Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Wed, 11 Dec 2024 15:54:48 +1300 -Subject: [PATCH 07/11] samba-tool user: use _glue.crypt, not crypt.crypt - -Because we know we have _glue.crypt, and we know it raises exceptions -rather than returning None, we can simplify the checks. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider -(cherry picked from commit 405187d2ef4920a9a284649c9c3287f5844d5180) ---- - .../samba/netcmd/user/readpasswords/common.py | 21 ++++++------------- - 1 file changed, 6 insertions(+), 15 deletions(-) - -diff --git a/python/samba/netcmd/user/readpasswords/common.py b/python/samba/netcmd/user/readpasswords/common.py -index 7944d4e1682..68befb3f356 100644 ---- a/python/samba/netcmd/user/readpasswords/common.py -+++ b/python/samba/netcmd/user/readpasswords/common.py -@@ -37,6 +37,7 @@ from samba.netcmd import Command, CommandError - from samba.samdb import SamDB - from samba.nt_time import timedelta_from_nt_time_delta, nt_time_from_datetime - from samba.gkdi import MAX_CLOCK_SKEW -+from samba._glue import crypt - - # python[3]-gpgme is abandoned since ubuntu 1804 and debian 9 - # have to use python[3]-gpg instead -@@ -132,9 +133,7 @@ def get_crypt_value(alg, utf8pw, rounds=0): - else: - crypt_salt = "$%s$%s$" % (alg, b64salt) - -- crypt_value = crypt.crypt(utf8pw, crypt_salt) -- if crypt_value is None: -- raise NotImplementedError("crypt.crypt(%s) returned None" % (crypt_salt)) -+ crypt_value = crypt(utf8pw, crypt_salt) - expected_len = len(crypt_salt) + algs[alg]["length"] - if len(crypt_value) != expected_len: - raise NotImplementedError("crypt.crypt(%s) returned a value with length %d, expected length is %d" % ( -@@ -156,21 +155,13 @@ except ImportError as e: - - for (alg, attr) in [("5", "virtualCryptSHA256"), ("6", "virtualCryptSHA512")]: - try: -- import crypt - get_crypt_value(alg, "") -- virtual_attributes[attr] = { -- } -- except ImportError as e: -- reason = "crypt" -- reason += " required" -- disabled_virtual_attributes[attr] = { -- "reason": reason, -- } -- except NotImplementedError as e: -- reason = "modern '$%s$' salt in crypt(3) required" % (alg) -+ except (ValueError, OSError): - disabled_virtual_attributes[attr] = { -- "reason": reason, -+ "reason": f"modern '${alg}$' salt in crypt(3) required" - } -+ continue -+ virtual_attributes[attr] = {} - - # Add the wDigest virtual attributes, virtualWDigest01 to virtualWDigest29 - for x in range(1, 30): --- -2.48.1 - - -From a2a04286e13676177c952e67363fc7502f544861 Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Wed, 11 Dec 2024 15:56:20 +1300 -Subject: [PATCH 08/11] samba-tool user: hashlib.sha1 is always present - -We maybe thought we were checking that sha1 was in hashlib, but we were -only checking that hashlib is in the Python library (`hashlib.sha1()` -would not raise ImportError). - -The documentation says hashlib always contains sha1 -- if that -changes, it is better we know by failing noisily with the import error -at the top of the file. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider -(cherry picked from commit 4af4dd8135e8edbe2a16cfdfc7ded8c145c82e98) ---- - python/samba/netcmd/user/readpasswords/common.py | 16 ++++------------ - 1 file changed, 4 insertions(+), 12 deletions(-) - -diff --git a/python/samba/netcmd/user/readpasswords/common.py b/python/samba/netcmd/user/readpasswords/common.py -index 68befb3f356..3043525874e 100644 ---- a/python/samba/netcmd/user/readpasswords/common.py -+++ b/python/samba/netcmd/user/readpasswords/common.py -@@ -26,6 +26,7 @@ import datetime - import errno - import io - import os -+from hashlib import sha1 - - import ldb - from samba import credentials, nttime2float -@@ -141,17 +142,8 @@ def get_crypt_value(alg, utf8pw, rounds=0): - return crypt_value - - --try: -- import hashlib -- hashlib.sha1() -- virtual_attributes["virtualSSHA"] = { -- } --except ImportError as e: -- reason = "hashlib.sha1()" -- reason += " required" -- disabled_virtual_attributes["virtualSSHA"] = { -- "reason": reason, -- } -+ -+virtual_attributes["virtualSSHA"] = {} - - for (alg, attr) in [("5", "virtualCryptSHA256"), ("6", "virtualCryptSHA512")]: - try: -@@ -736,7 +728,7 @@ class GetPasswordCommand(Command): - if u8 is None: - continue - salt = os.urandom(4) -- h = hashlib.sha1() -+ h = sha1() - h.update(u8) - h.update(salt) - bv = h.digest() + salt --- -2.48.1 - - -From e9a8748f3cc4ba74f8b0d75e7a01866e7c12a0a4 Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Thu, 12 Dec 2024 10:46:16 +1300 -Subject: [PATCH 09/11] pytest: password_hash uses internal _glue.crypt - -This will remove an external dependency. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider -(cherry picked from commit 552053b6445611ecef6ac4c11c55ebf92f03571d) ---- - python/samba/tests/password_hash.py | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/python/samba/tests/password_hash.py b/python/samba/tests/password_hash.py -index 1b7af7de7b8..39ef13fd7b2 100644 ---- a/python/samba/tests/password_hash.py -+++ b/python/samba/tests/password_hash.py -@@ -30,11 +30,11 @@ from samba.dcerpc.samr import DOMAIN_PASSWORD_STORE_CLEARTEXT - from samba.dsdb import UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED - from samba.tests import delete_force - from samba.tests.password_test import PasswordCommon -+from samba._glue import crypt - import ldb - import samba - import binascii - from hashlib import md5 --import crypt - - - USER_NAME = "PasswordHashTestUser" -@@ -321,7 +321,7 @@ class PassWordHashTests(TestCase): - cmd = "$%s$rounds=%d$%s" % (alg, rounds, data[3]) - - # Calculate the expected hash value -- expected = crypt.crypt(USER_PASS, cmd) -+ expected = crypt(USER_PASS, cmd) - self.assertEqual(expected, up.hashes[i].value.decode('utf8')) - i += 1 - --- -2.48.1 - - -From 0e01dc4f1fabfd2c3f21f724c05d94227a278b20 Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Wed, 11 Dec 2024 14:31:18 +1300 -Subject: [PATCH 10/11] util:datablob: data_blob_pad checks its alignment - assumption - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider - -Autobuild-User(master): Andreas Schneider -Autobuild-Date(master): Fri Dec 20 07:59:51 UTC 2024 on atb-devel-224 - -(cherry picked from commit 8b84282008dc372d67ba01c8fe256ef756c3dcfb) ---- - lib/util/data_blob.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/lib/util/data_blob.c b/lib/util/data_blob.c -index b5b78bc7a8a..0522e7755af 100644 ---- a/lib/util/data_blob.c -+++ b/lib/util/data_blob.c -@@ -286,7 +286,7 @@ _PUBLIC_ bool data_blob_pad(TALLOC_CTX *mem_ctx, DATA_BLOB *blob, - size_t old_len = blob->length; - size_t new_len = (old_len + pad - 1) & ~(pad - 1); - -- if (new_len < old_len) { -+ if (new_len < old_len || (pad & (pad - 1)) != 0) { - return false; - } - --- -2.48.1 - - -From 8cfae9f33fb1c170c3fe937be200490597e9e4c2 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Fri, 17 Jan 2025 13:28:30 +0100 -Subject: [PATCH 11/11] lib:util: Fix stack-use-after-return in - crypt_as_best_we_can() -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15784 - -Signed-off-by: Andreas Schneider -Reviewed-by: Douglas Bagnall -Reviewed-by: Pavel Filipenský - -Autobuild-User(master): Douglas Bagnall -Autobuild-Date(master): Fri Jan 17 23:21:13 UTC 2025 on atb-devel-224 - -(cherry picked from commit 6cd9849b58ec653cbffc602e3c96996a082faf53) ---- - lib/util/util_crypt.c | 16 ++++++++++++---- - 1 file changed, 12 insertions(+), 4 deletions(-) - -diff --git a/lib/util/util_crypt.c b/lib/util/util_crypt.c -index 09cd47597d1..9ac6e1cfd0e 100644 ---- a/lib/util/util_crypt.c -+++ b/lib/util/util_crypt.c -@@ -1,11 +1,13 @@ - #include - #include "data_blob.h" -+#include "discard.h" - #include - #include - #include "util_crypt.h" - - --static int crypt_as_best_we_can(const char *phrase, -+static int crypt_as_best_we_can(TALLOC_CTX *mem_ctx, -+ const char *phrase, - const char *setting, - const char **hashp) - { -@@ -63,8 +65,14 @@ static int crypt_as_best_we_can(const char *phrase, - ret = ENOTRECOVERABLE; - } - } -+ if (ret != 0) { -+ return ret; -+ } - -- *hashp = hash; -+ *hashp = talloc_strdup(mem_ctx, hash); -+ if (*hashp == NULL) { -+ ret = -1; -+ } - return ret; - } - -@@ -75,14 +83,14 @@ int talloc_crypt_blob(TALLOC_CTX *mem_ctx, - DATA_BLOB *blob) - { - const char *hash = NULL; -- int ret = crypt_as_best_we_can(phrase, setting, &hash); -+ int ret = crypt_as_best_we_can(mem_ctx, phrase, setting, &hash); - if (ret != 0) { - blob->data = NULL; - blob->length = 0; - return ret; - } - blob->length = strlen(hash); -- blob->data = talloc_memdup(mem_ctx, hash, blob->length); -+ blob->data = discard_const_p(uint8_t, hash); - if (blob->data == NULL) { - return ENOMEM; - } --- -2.48.1 - diff --git a/samba.spec b/samba.spec index 0852641..d30274d 100644 --- a/samba.spec +++ b/samba.spec @@ -148,7 +148,7 @@ %bcond lmdb 0 %endif -%global samba_version 4.21.3 +%global samba_version 4.21.4 # The release field is extended: # [.][.]%%{?dist}[.] @@ -251,8 +251,6 @@ Source201: README.downgrade Source202: samba.abignore Patch0: samba-4.21.0-s3-notifyd.patch -Patch1: samba-4-21-pycrypt.patch -Patch2: samba-4-21-fix-smbreadline.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} @@ -3547,9 +3545,11 @@ fi %dir %{python3_sitearch}/samba/tests/ndr %{python3_sitearch}/samba/tests/ndr/gkdi.py %{python3_sitearch}/samba/tests/ndr/gmsa.py +%{python3_sitearch}/samba/tests/ndr/sd.py %dir %{python3_sitearch}/samba/tests/ndr/__pycache__ %{python3_sitearch}/samba/tests/ndr/__pycache__/gkdi.*.pyc %{python3_sitearch}/samba/tests/ndr/__pycache__/gmsa.*.pyc +%{python3_sitearch}/samba/tests/ndr/__pycache__/sd.*.pyc %{python3_sitearch}/samba/tests/ndr/__pycache__/wbint.*.pyc %{python3_sitearch}/samba/tests/ndr/wbint.py %{python3_sitearch}/samba/tests/netbios.py diff --git a/sources b/sources index 1055c45..ebed3b4 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.21.3.tar.xz) = 62eb3bfe1aa1cc8aa68055d4caf21bdea6d6f5b0f767566bef1da210100b5dd17b7d60f5c47da01b0123d3a2c1c3689b1960ef2c2cbd4f804ff998ead994fc3f -SHA512 (samba-4.21.3.tar.asc) = 11e40d32b783b7d57d3f35fe96a17e897719f65d796d965b371dfb58b8cf1f8ffe60c3047bea8c2b2b0d475fa55cd25237b9ba84d44b3d65a8cd53c6af760957 +SHA512 (samba-4.21.4.tar.xz) = 2ab7d505238ec0064c35161aab9f06e909e10510ad1bc521dd1402d6db0a71e86591bf1ad3031e00a79edfff82e0aeafcee416ac3433259e228c89803d78ef96 +SHA512 (samba-4.21.4.tar.asc) = 23f66fadb9adc0307c8f29ff83984fa315703dd654c4fdafb73606fb8df64765191e595a3de9db50f4e4832aa3d1cffa64172b66a1a4b8629de30cc38267f326 From 46945a69259996ca069c2785d4da9b5c7eac6972 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 31 Mar 2025 21:07:21 +0200 Subject: [PATCH 35/42] Update to version 4.21.5 Guenther --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index d30274d..aad1acd 100644 --- a/samba.spec +++ b/samba.spec @@ -148,7 +148,7 @@ %bcond lmdb 0 %endif -%global samba_version 4.21.4 +%global samba_version 4.21.5 # The release field is extended: # [.][.]%%{?dist}[.] diff --git a/sources b/sources index ebed3b4..50afe6d 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.21.4.tar.xz) = 2ab7d505238ec0064c35161aab9f06e909e10510ad1bc521dd1402d6db0a71e86591bf1ad3031e00a79edfff82e0aeafcee416ac3433259e228c89803d78ef96 -SHA512 (samba-4.21.4.tar.asc) = 23f66fadb9adc0307c8f29ff83984fa315703dd654c4fdafb73606fb8df64765191e595a3de9db50f4e4832aa3d1cffa64172b66a1a4b8629de30cc38267f326 +SHA512 (samba-4.21.5.tar.xz) = a5d4ba36e62cd1d618f50a9b52eeeefa770d3449ce3dec5cfa39e7c3cffc3136b8e514298557d53d190c826560f8137c69310bd398b96ae4622d4465460b3f3b +SHA512 (samba-4.21.5.tar.asc) = 58642f02cbe7f14a7af4369da5f509b1df7c6c8be24f5ef6dc83f0de9a97c9945e4c22063c0b4158660952449a623d62901eb1f9c0d2cbb465eee5a26208300d From 9ab4fb18f401f12369a0f7dbc2b90305611f30ea Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 3 Jun 2025 13:51:41 +0200 Subject: [PATCH 36/42] Update to version 4.21.6 Guenther --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index aad1acd..93017ef 100644 --- a/samba.spec +++ b/samba.spec @@ -148,7 +148,7 @@ %bcond lmdb 0 %endif -%global samba_version 4.21.5 +%global samba_version 4.21.6 # The release field is extended: # [.][.]%%{?dist}[.] diff --git a/sources b/sources index 50afe6d..9732080 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.21.5.tar.xz) = a5d4ba36e62cd1d618f50a9b52eeeefa770d3449ce3dec5cfa39e7c3cffc3136b8e514298557d53d190c826560f8137c69310bd398b96ae4622d4465460b3f3b -SHA512 (samba-4.21.5.tar.asc) = 58642f02cbe7f14a7af4369da5f509b1df7c6c8be24f5ef6dc83f0de9a97c9945e4c22063c0b4158660952449a623d62901eb1f9c0d2cbb465eee5a26208300d +SHA512 (samba-4.21.6.tar.xz) = 0edec52fb2b6440f66c9dc5491381deaaa1e8c406561394a859704d45c4b6f3cec7e16a8da285a17229224832d361a209b9c91be295dcfa101ecf2289ba29fa0 +SHA512 (samba-4.21.6.tar.asc) = c1928e4145807bf3f7fb2a1218b147023fadbdf2b77f487b08016b42b1d6a8e5e0d2c29cafc0acfda985195f224064aebc99df95170eebdb488b66f9fb03868f From c1a9007eafeba4a3f202db96271370b33d056c02 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 8 Jul 2025 01:31:46 +0200 Subject: [PATCH 37/42] Update to version 4.21.7 Guenther --- sources | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sources b/sources index 9732080..578fc67 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.21.6.tar.xz) = 0edec52fb2b6440f66c9dc5491381deaaa1e8c406561394a859704d45c4b6f3cec7e16a8da285a17229224832d361a209b9c91be295dcfa101ecf2289ba29fa0 -SHA512 (samba-4.21.6.tar.asc) = c1928e4145807bf3f7fb2a1218b147023fadbdf2b77f487b08016b42b1d6a8e5e0d2c29cafc0acfda985195f224064aebc99df95170eebdb488b66f9fb03868f +SHA512 (samba-4.21.7.tar.xz) = c81d8654386c4caecc12ac4e392e708a92bb655a6051ae6b5ee1a4628daeef8492006cab96542ba64ae3eb1b4f1e51b8eb3c71eda80da3805323a93aeb903c38 +SHA512 (samba-4.21.7.tar.asc) = 186b5651ea26f864e802bc24d2628da7693587832b8ab38cddcf7eadf47e3a258c709274186286f4f696f54b9562c4e903d08e635db0cb25c3760f70d5dfd2e6 From 5afe88c2d4b5197ff8b4a2da8316d62f006ba913 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 8 Jul 2025 01:36:43 +0200 Subject: [PATCH 38/42] Update to version 4.21.7 Guenther --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 93017ef..b975293 100644 --- a/samba.spec +++ b/samba.spec @@ -148,7 +148,7 @@ %bcond lmdb 0 %endif -%global samba_version 4.21.6 +%global samba_version 4.21.7 # The release field is extended: # [.][.]%%{?dist}[.] From 532cb5d3328586e056c9944f21cd1d5424db66bc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 10 Jul 2025 21:46:16 +0200 Subject: [PATCH 39/42] Fix get_kdc_ip_string handling for secondary KDCs - resolves: bzso#15881 Guenther --- samba-4.22.x-get_kdc_ip_string.patch | 34 ++++++++++++++++++++++++++++ samba.spec | 1 + 2 files changed, 35 insertions(+) create mode 100644 samba-4.22.x-get_kdc_ip_string.patch diff --git a/samba-4.22.x-get_kdc_ip_string.patch b/samba-4.22.x-get_kdc_ip_string.patch new file mode 100644 index 0000000..9277c9b --- /dev/null +++ b/samba-4.22.x-get_kdc_ip_string.patch @@ -0,0 +1,34 @@ +From 88572cc8f629a737a1d5b33d5800f3692895233f Mon Sep 17 00:00:00 2001 +From: Ralph Boehme +Date: Fri, 4 Jul 2025 17:50:40 +0200 +Subject: [PATCH] libads: fix get_kdc_ip_string() ... +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15881 + +Signed-off-by: Ralph Boehme +Reviewed-by: Guenther Deschner + +Autobuild-User(master): Günther Deschner +Autobuild-Date(master): Mon Jul 7 16:46:29 UTC 2025 on atb-devel-224 +--- + source3/libads/kerberos.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/source3/libads/kerberos.c b/source3/libads/kerberos.c +index 75803500d31..145bc36cdb2 100644 +--- a/source3/libads/kerberos.c ++++ b/source3/libads/kerberos.c +@@ -1230,6 +1230,7 @@ static char *get_kdc_ip_string(char *mem_ctx, + + if (!NT_STATUS_IS_OK(status)) { + DBG_DEBUG("netlogon_pings failed: %s\n", nt_errstr(status)); ++ result = talloc_move(mem_ctx, &kdc_str); + goto out; + } + +-- +2.50.0 + diff --git a/samba.spec b/samba.spec index b975293..37c6eee 100644 --- a/samba.spec +++ b/samba.spec @@ -251,6 +251,7 @@ Source201: README.downgrade Source202: samba.abignore Patch0: samba-4.21.0-s3-notifyd.patch +Patch1: samba-4.22.x-get_kdc_ip_string.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} From 13836b4c6a2ded09f296b7e58e10f77b26801269 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 10 Sep 2025 10:47:51 +0200 Subject: [PATCH 40/42] Update to version 4.21.8 Guenther --- samba-4.22.x-get_kdc_ip_string.patch | 34 ---------------------------- samba.spec | 3 +-- sources | 4 ++-- 3 files changed, 3 insertions(+), 38 deletions(-) delete mode 100644 samba-4.22.x-get_kdc_ip_string.patch diff --git a/samba-4.22.x-get_kdc_ip_string.patch b/samba-4.22.x-get_kdc_ip_string.patch deleted file mode 100644 index 9277c9b..0000000 --- a/samba-4.22.x-get_kdc_ip_string.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 88572cc8f629a737a1d5b33d5800f3692895233f Mon Sep 17 00:00:00 2001 -From: Ralph Boehme -Date: Fri, 4 Jul 2025 17:50:40 +0200 -Subject: [PATCH] libads: fix get_kdc_ip_string() ... -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15881 - -Signed-off-by: Ralph Boehme -Reviewed-by: Guenther Deschner - -Autobuild-User(master): Günther Deschner -Autobuild-Date(master): Mon Jul 7 16:46:29 UTC 2025 on atb-devel-224 ---- - source3/libads/kerberos.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/source3/libads/kerberos.c b/source3/libads/kerberos.c -index 75803500d31..145bc36cdb2 100644 ---- a/source3/libads/kerberos.c -+++ b/source3/libads/kerberos.c -@@ -1230,6 +1230,7 @@ static char *get_kdc_ip_string(char *mem_ctx, - - if (!NT_STATUS_IS_OK(status)) { - DBG_DEBUG("netlogon_pings failed: %s\n", nt_errstr(status)); -+ result = talloc_move(mem_ctx, &kdc_str); - goto out; - } - --- -2.50.0 - diff --git a/samba.spec b/samba.spec index 37c6eee..9d64609 100644 --- a/samba.spec +++ b/samba.spec @@ -148,7 +148,7 @@ %bcond lmdb 0 %endif -%global samba_version 4.21.7 +%global samba_version 4.21.8 # The release field is extended: # [.][.]%%{?dist}[.] @@ -251,7 +251,6 @@ Source201: README.downgrade Source202: samba.abignore Patch0: samba-4.21.0-s3-notifyd.patch -Patch1: samba-4.22.x-get_kdc_ip_string.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} diff --git a/sources b/sources index 578fc67..c87ef76 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.21.7.tar.xz) = c81d8654386c4caecc12ac4e392e708a92bb655a6051ae6b5ee1a4628daeef8492006cab96542ba64ae3eb1b4f1e51b8eb3c71eda80da3805323a93aeb903c38 -SHA512 (samba-4.21.7.tar.asc) = 186b5651ea26f864e802bc24d2628da7693587832b8ab38cddcf7eadf47e3a258c709274186286f4f696f54b9562c4e903d08e635db0cb25c3760f70d5dfd2e6 +SHA512 (samba-4.21.8.tar.xz) = 820d589d2541e4a24a8189392e0c03d2dc51ea1a830cb1c7438d513452ec70c3d9e48b7a087dd7d67c9cfe1342222f0fc0ab2fb5f46813f698c851c102352170 +SHA512 (samba-4.21.8.tar.asc) = 985d1592de9be0440a7b316658416e286b93b12225deec407c47ae2c4c2829244991fd0203cc4b00c36b547aa8b728ec781531c5ab927a3c3c6dfadab19b8904 From ce1b624df9c50d62db1501ef5102f63446af6306 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 15 Oct 2025 23:36:34 +0200 Subject: [PATCH 41/42] Update to Samba 4.21.9 - resolves: rhbz#2391698 - Security fix for CVE-2025-9640 - resolves: rhbz#2394377 - Security fix for CVE-2025-10230 Guenther --- sources | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sources b/sources index c87ef76..be4ad7c 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.21.8.tar.xz) = 820d589d2541e4a24a8189392e0c03d2dc51ea1a830cb1c7438d513452ec70c3d9e48b7a087dd7d67c9cfe1342222f0fc0ab2fb5f46813f698c851c102352170 -SHA512 (samba-4.21.8.tar.asc) = 985d1592de9be0440a7b316658416e286b93b12225deec407c47ae2c4c2829244991fd0203cc4b00c36b547aa8b728ec781531c5ab927a3c3c6dfadab19b8904 +SHA512 (samba-4.21.9.tar.xz) = 64c9b2b4eb2f1bd9ac2578d2a5e858565a25b8b2bbde1f12a698fb675da8e0a311119eadbcd1be7f063bf985110bfc4fd35f1408a7e4095fa004cda81aa3d26c +SHA512 (samba-4.21.9.tar.asc) = e395b02bcf979813329add3e2c7ffcf91f121670a5101d9e07af312bbf6b4ac2edac86c25050effca733113d35aa441200a90164d9ddf1313e2ec2e28065c725 From 1a464950e228861b657c281e43d97bf32259906c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 17 Oct 2025 21:15:56 +0200 Subject: [PATCH 42/42] Fix version --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 9d64609..a10701d 100644 --- a/samba.spec +++ b/samba.spec @@ -148,7 +148,7 @@ %bcond lmdb 0 %endif -%global samba_version 4.21.8 +%global samba_version 4.21.9 # The release field is extended: # [.][.]%%{?dist}[.]