From d819c93793dc07535743c4e1b5393a5ac7167263 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Fri, 16 Aug 2019 11:15:00 +0300 Subject: [PATCH 01/51] Allow Windows to resolve IPA users and groups over LSA RPC Fixes: https://bugzilla.samba.org/show_bug.cgi?id=14091 (cherry picked from commit e9d6c3ff337143c3c8289d9ccaed7351e28529dd) --- samba-bz14091-v4.10-backport.patch | 650 +++++++++++++++++++++++++++++ samba.spec | 9 +- 2 files changed, 657 insertions(+), 2 deletions(-) create mode 100644 samba-bz14091-v4.10-backport.patch diff --git a/samba-bz14091-v4.10-backport.patch b/samba-bz14091-v4.10-backport.patch new file mode 100644 index 0000000..104e78e --- /dev/null +++ b/samba-bz14091-v4.10-backport.patch @@ -0,0 +1,650 @@ +From 536df2c1070d516ab95ad96b606fcc1f92c3668d Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Thu, 1 Aug 2019 21:08:52 +0300 +Subject: [PATCH 1/3] torture/rpc/lsa: allow testing different lookup levels + +Convert torture/rpc/lsa LookupNames/LookupSids code to allow testing +different LSA_LOOKUP_NAMES_* levels. Keep existing level 1 +(LSA_LOOKUP_NAMES_ALL) for the current set of tests. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14091 + +Signed-off-by: Alexander Bokovoy +Reviewed-by: Andreas Schneider + +(cherry picked from commit 317bc6a7342edfa2c503f5932142bf5883485cc9) +--- + source4/torture/rpc/lsa.c | 118 ++++++++++++++++++--------------- + source4/torture/rpc/schannel.c | 2 +- + 2 files changed, 67 insertions(+), 53 deletions(-) + +diff --git a/source4/torture/rpc/lsa.c b/source4/torture/rpc/lsa.c +index bc1e9553039..b7dd0dc8c91 100644 +--- a/source4/torture/rpc/lsa.c ++++ b/source4/torture/rpc/lsa.c +@@ -270,6 +270,7 @@ static bool test_OpenPolicy2_fail(struct dcerpc_binding_handle *b, + static bool test_LookupNames(struct dcerpc_binding_handle *b, + struct torture_context *tctx, + struct policy_handle *handle, ++ enum lsa_LookupNamesLevel level, + struct lsa_TransNameArray *tnames) + { + struct lsa_LookupNames r; +@@ -302,7 +303,7 @@ static bool test_LookupNames(struct dcerpc_binding_handle *b, + r.in.handle = handle; + r.in.names = names; + r.in.sids = &sids; +- r.in.level = 1; ++ r.in.level = level; + r.in.count = &count; + r.out.count = &count; + r.out.sids = &sids; +@@ -358,7 +359,8 @@ static bool test_LookupNames(struct dcerpc_binding_handle *b, + + static bool test_LookupNames_bogus(struct dcerpc_binding_handle *b, + struct torture_context *tctx, +- struct policy_handle *handle) ++ struct policy_handle *handle, ++ enum lsa_LookupNamesLevel level) + { + struct lsa_LookupNames r; + struct lsa_TransSidArray sids; +@@ -377,7 +379,7 @@ static bool test_LookupNames_bogus(struct dcerpc_binding_handle *b, + r.in.num_names = 1; + r.in.names = names; + r.in.sids = &sids; +- r.in.level = 1; ++ r.in.level = level; + r.in.count = &count; + r.out.count = &count; + r.out.sids = &sids; +@@ -398,7 +400,8 @@ static bool test_LookupNames_bogus(struct dcerpc_binding_handle *b, + + static bool test_LookupNames_NULL(struct dcerpc_binding_handle *b, + struct torture_context *tctx, +- struct policy_handle *handle) ++ struct policy_handle *handle, ++ enum lsa_LookupNamesLevel level) + { + struct lsa_LookupNames r; + struct lsa_TransSidArray sids; +@@ -417,7 +420,7 @@ static bool test_LookupNames_NULL(struct dcerpc_binding_handle *b, + r.in.num_names = 1; + r.in.names = names; + r.in.sids = &sids; +- r.in.level = 1; ++ r.in.level = level; + r.in.count = &count; + r.out.count = &count; + r.out.sids = &sids; +@@ -442,7 +445,8 @@ static bool test_LookupNames_NULL(struct dcerpc_binding_handle *b, + + static bool test_LookupNames_wellknown(struct dcerpc_binding_handle *b, + struct torture_context *tctx, +- struct policy_handle *handle) ++ struct policy_handle *handle, ++ enum lsa_LookupNamesLevel level) + { + struct lsa_TranslatedName name; + struct lsa_TransNameArray tnames; +@@ -454,45 +458,46 @@ static bool test_LookupNames_wellknown(struct dcerpc_binding_handle *b, + tnames.count = 1; + name.name.string = "NT AUTHORITY\\SYSTEM"; + name.sid_type = SID_NAME_WKN_GRP; +- ret &= test_LookupNames(b, tctx, handle, &tnames); ++ ret &= test_LookupNames(b, tctx, handle, level, &tnames); + + name.name.string = "NT AUTHORITY\\ANONYMOUS LOGON"; + name.sid_type = SID_NAME_WKN_GRP; +- ret &= test_LookupNames(b, tctx, handle, &tnames); ++ ret &= test_LookupNames(b, tctx, handle, level, &tnames); + + name.name.string = "NT AUTHORITY\\Authenticated Users"; + name.sid_type = SID_NAME_WKN_GRP; +- ret &= test_LookupNames(b, tctx, handle, &tnames); ++ ret &= test_LookupNames(b, tctx, handle, level, &tnames); + + #if 0 + name.name.string = "NT AUTHORITY"; +- ret &= test_LookupNames(b, tctx, handle, &tnames); ++ ret &= test_LookupNames(b, tctx, handle, level, &tnames); + + name.name.string = "NT AUTHORITY\\"; +- ret &= test_LookupNames(b, tctx, handle, &tnames); ++ ret &= test_LookupNames(b, tctx, handle, level, &tnames); + #endif + + name.name.string = "BUILTIN\\"; + name.sid_type = SID_NAME_DOMAIN; +- ret &= test_LookupNames(b, tctx, handle, &tnames); ++ ret &= test_LookupNames(b, tctx, handle, level, &tnames); + + name.name.string = "BUILTIN\\Administrators"; + name.sid_type = SID_NAME_ALIAS; +- ret &= test_LookupNames(b, tctx, handle, &tnames); ++ ret &= test_LookupNames(b, tctx, handle, level, &tnames); + + name.name.string = "SYSTEM"; + name.sid_type = SID_NAME_WKN_GRP; +- ret &= test_LookupNames(b, tctx, handle, &tnames); ++ ret &= test_LookupNames(b, tctx, handle, level, &tnames); + + name.name.string = "Everyone"; + name.sid_type = SID_NAME_WKN_GRP; +- ret &= test_LookupNames(b, tctx, handle, &tnames); ++ ret &= test_LookupNames(b, tctx, handle, level, &tnames); + return ret; + } + + static bool test_LookupNames2(struct dcerpc_binding_handle *b, + struct torture_context *tctx, + struct policy_handle *handle, ++ enum lsa_LookupNamesLevel level, + struct lsa_TransNameArray2 *tnames, + bool check_result) + { +@@ -525,7 +530,7 @@ static bool test_LookupNames2(struct dcerpc_binding_handle *b, + r.in.handle = handle; + r.in.names = names; + r.in.sids = &sids; +- r.in.level = 1; ++ r.in.level = level; + r.in.count = &count; + r.in.lookup_options = 0; + r.in.client_revision = 0; +@@ -554,6 +559,7 @@ static bool test_LookupNames2(struct dcerpc_binding_handle *b, + static bool test_LookupNames3(struct dcerpc_binding_handle *b, + struct torture_context *tctx, + struct policy_handle *handle, ++ enum lsa_LookupNamesLevel level, + struct lsa_TransNameArray2 *tnames, + bool check_result) + { +@@ -585,7 +591,7 @@ static bool test_LookupNames3(struct dcerpc_binding_handle *b, + r.in.handle = handle; + r.in.names = names; + r.in.sids = &sids; +- r.in.level = 1; ++ r.in.level = level; + r.in.count = &count; + r.in.lookup_options = 0; + r.in.client_revision = 0; +@@ -613,6 +619,7 @@ static bool test_LookupNames3(struct dcerpc_binding_handle *b, + + static bool test_LookupNames4(struct dcerpc_binding_handle *b, + struct torture_context *tctx, ++ enum lsa_LookupNamesLevel level, + struct lsa_TransNameArray2 *tnames, + bool check_result) + { +@@ -644,7 +651,7 @@ static bool test_LookupNames4(struct dcerpc_binding_handle *b, + r.in.num_names = tnames->count; + r.in.names = names; + r.in.sids = &sids; +- r.in.level = 1; ++ r.in.level = level; + r.in.count = &count; + r.in.lookup_options = 0; + r.in.client_revision = 0; +@@ -682,7 +689,8 @@ static bool test_LookupNames4(struct dcerpc_binding_handle *b, + } + + static bool test_LookupNames4_fail(struct dcerpc_binding_handle *b, +- struct torture_context *tctx) ++ struct torture_context *tctx, ++ enum lsa_LookupNamesLevel level) + { + struct lsa_LookupNames4 r; + struct lsa_TransSidArray3 sids; +@@ -701,7 +709,7 @@ static bool test_LookupNames4_fail(struct dcerpc_binding_handle *b, + r.in.num_names = count; + r.in.names = names; + r.in.sids = &sids; +- r.in.level = 1; ++ r.in.level = level; + r.in.count = &count; + r.in.lookup_options = 0; + r.in.client_revision = 0; +@@ -749,6 +757,7 @@ static bool test_LookupNames4_fail(struct dcerpc_binding_handle *b, + static bool test_LookupSids(struct dcerpc_binding_handle *b, + struct torture_context *tctx, + struct policy_handle *handle, ++ enum lsa_LookupNamesLevel level, + struct lsa_SidArray *sids) + { + struct lsa_LookupSids r; +@@ -764,7 +773,7 @@ static bool test_LookupSids(struct dcerpc_binding_handle *b, + r.in.handle = handle; + r.in.sids = sids; + r.in.names = &names; +- r.in.level = 1; ++ r.in.level = level; + r.in.count = &count; + r.out.count = &count; + r.out.names = &names; +@@ -779,7 +788,7 @@ static bool test_LookupSids(struct dcerpc_binding_handle *b, + + torture_comment(tctx, "\n"); + +- if (!test_LookupNames(b, tctx, handle, &names)) { ++ if (!test_LookupNames(b, tctx, handle, level, &names)) { + return false; + } + +@@ -790,6 +799,7 @@ static bool test_LookupSids(struct dcerpc_binding_handle *b, + static bool test_LookupSids2(struct dcerpc_binding_handle *b, + struct torture_context *tctx, + struct policy_handle *handle, ++ enum lsa_LookupNamesLevel level, + struct lsa_SidArray *sids) + { + struct lsa_LookupSids2 r; +@@ -805,7 +815,7 @@ static bool test_LookupSids2(struct dcerpc_binding_handle *b, + r.in.handle = handle; + r.in.sids = sids; + r.in.names = &names; +- r.in.level = 1; ++ r.in.level = level; + r.in.count = &count; + r.in.lookup_options = 0; + r.in.client_revision = 0; +@@ -824,11 +834,11 @@ static bool test_LookupSids2(struct dcerpc_binding_handle *b, + + torture_comment(tctx, "\n"); + +- if (!test_LookupNames2(b, tctx, handle, &names, false)) { ++ if (!test_LookupNames2(b, tctx, handle, level, &names, false)) { + return false; + } + +- if (!test_LookupNames3(b, tctx, handle, &names, false)) { ++ if (!test_LookupNames3(b, tctx, handle, level, &names, false)) { + return false; + } + +@@ -837,6 +847,7 @@ static bool test_LookupSids2(struct dcerpc_binding_handle *b, + + static bool test_LookupSids3(struct dcerpc_binding_handle *b, + struct torture_context *tctx, ++ enum lsa_LookupNamesLevel level, + struct lsa_SidArray *sids) + { + struct lsa_LookupSids3 r; +@@ -851,7 +862,7 @@ static bool test_LookupSids3(struct dcerpc_binding_handle *b, + + r.in.sids = sids; + r.in.names = &names; +- r.in.level = 1; ++ r.in.level = level; + r.in.count = &count; + r.in.lookup_options = 0; + r.in.client_revision = 0; +@@ -880,7 +891,7 @@ static bool test_LookupSids3(struct dcerpc_binding_handle *b, + + torture_comment(tctx, "\n"); + +- if (!test_LookupNames4(b, tctx, &names, true)) { ++ if (!test_LookupNames4(b, tctx, level, &names, true)) { + return false; + } + +@@ -889,6 +900,7 @@ static bool test_LookupSids3(struct dcerpc_binding_handle *b, + + static bool test_LookupSids3_fail(struct dcerpc_binding_handle *b, + struct torture_context *tctx, ++ enum lsa_LookupNamesLevel level, + struct lsa_SidArray *sids) + { + struct lsa_LookupSids3 r; +@@ -904,7 +916,7 @@ static bool test_LookupSids3_fail(struct dcerpc_binding_handle *b, + + r.in.sids = sids; + r.in.names = &names; +- r.in.level = 1; ++ r.in.level = level; + r.in.count = &count; + r.in.lookup_options = 0; + r.in.client_revision = 0; +@@ -948,7 +960,8 @@ static bool test_LookupSids3_fail(struct dcerpc_binding_handle *b, + + bool test_many_LookupSids(struct dcerpc_pipe *p, + struct torture_context *tctx, +- struct policy_handle *handle) ++ struct policy_handle *handle, ++ enum lsa_LookupNamesLevel level) + { + uint32_t count; + struct lsa_SidArray sids; +@@ -979,7 +992,7 @@ bool test_many_LookupSids(struct dcerpc_pipe *p, + r.in.handle = handle; + r.in.sids = &sids; + r.in.names = &names; +- r.in.level = 1; ++ r.in.level = level; + r.in.count = &names.count; + r.out.count = &count; + r.out.names = &names; +@@ -995,16 +1008,16 @@ bool test_many_LookupSids(struct dcerpc_pipe *p, + + torture_comment(tctx, "\n"); + +- if (!test_LookupNames(b, tctx, handle, &names)) { ++ if (!test_LookupNames(b, tctx, handle, level, &names)) { + return false; + } + } + + if (transport == NCACN_NP) { +- if (!test_LookupSids3_fail(b, tctx, &sids)) { ++ if (!test_LookupSids3_fail(b, tctx, level, &sids)) { + return false; + } +- if (!test_LookupNames4_fail(b, tctx)) { ++ if (!test_LookupNames4_fail(b, tctx, level)) { + return false; + } + } else if (transport == NCACN_IP_TCP) { +@@ -1020,10 +1033,10 @@ bool test_many_LookupSids(struct dcerpc_pipe *p, + + if (auth_type == DCERPC_AUTH_TYPE_SCHANNEL && + auth_level >= DCERPC_AUTH_LEVEL_INTEGRITY) { +- if (!test_LookupSids3(b, tctx, &sids)) { ++ if (!test_LookupSids3(b, tctx, level, &sids)) { + return false; + } +- if (!test_LookupNames4(b, tctx, &names, true)) { ++ if (!test_LookupNames4(b, tctx, level, &names, true)) { + return false; + } + } else { +@@ -1031,10 +1044,10 @@ bool test_many_LookupSids(struct dcerpc_pipe *p, + * If we don't have a secure channel these tests must + * fail with ACCESS_DENIED. + */ +- if (!test_LookupSids3_fail(b, tctx, &sids)) { ++ if (!test_LookupSids3_fail(b, tctx, level, &sids)) { + return false; + } +- if (!test_LookupNames4_fail(b, tctx)) { ++ if (!test_LookupNames4_fail(b, tctx, level)) { + return false; + } + } +@@ -1066,7 +1079,8 @@ static void lookupsids_cb(struct tevent_req *subreq) + + static bool test_LookupSids_async(struct dcerpc_binding_handle *b, + struct torture_context *tctx, +- struct policy_handle *handle) ++ struct policy_handle *handle, ++ enum lsa_LookupNamesLevel level) + { + struct lsa_SidArray sids; + struct lsa_SidPtr sidptr; +@@ -1101,7 +1115,7 @@ static bool test_LookupSids_async(struct dcerpc_binding_handle *b, + r[i].in.handle = handle; + r[i].in.sids = &sids; + r[i].in.names = &names[i]; +- r[i].in.level = 1; ++ r[i].in.level = level; + r[i].in.count = &names[i].count; + r[i].out.count = &count[i]; + r[i].out.names = &names[i]; +@@ -1912,11 +1926,11 @@ static bool test_EnumAccounts(struct dcerpc_binding_handle *b, + torture_assert_ntstatus_ok(tctx, r.out.result, + "EnumAccounts failed"); + +- if (!test_LookupSids(b, tctx, handle, &sids1)) { ++ if (!test_LookupSids(b, tctx, handle, LSA_LOOKUP_NAMES_ALL, &sids1)) { + return false; + } + +- if (!test_LookupSids2(b, tctx, handle, &sids1)) { ++ if (!test_LookupSids2(b, tctx, handle, LSA_LOOKUP_NAMES_ALL, &sids1)) { + return false; + } + +@@ -4811,7 +4825,7 @@ static bool test_QueryInfoPolicyCalls( bool version2, + tnames.names[12].sid_type = SID_NAME_USER; + tnames.names[13].name.string = talloc_asprintf(tctx, TEST_MACHINENAME "$@%s", info->dns.dns_domain.string); + tnames.names[13].sid_type = SID_NAME_USER; +- ret &= test_LookupNames(b, tctx, handle, &tnames); ++ ret &= test_LookupNames(b, tctx, handle, LSA_LOOKUP_NAMES_ALL, &tnames); + + } + } +@@ -4977,7 +4991,7 @@ bool torture_rpc_lsa(struct torture_context *tctx) + ret = false; + } + +- if (!test_many_LookupSids(p, tctx, handle)) { ++ if (!test_many_LookupSids(p, tctx, handle, LSA_LOOKUP_NAMES_ALL)) { + ret = false; + } + +@@ -4998,7 +5012,7 @@ bool torture_rpc_lsa(struct torture_context *tctx) + ret = false; + } + +- if (!test_LookupSids_async(b, tctx, handle)) { ++ if (!test_LookupSids_async(b, tctx, handle, LSA_LOOKUP_NAMES_ALL)) { + ret = false; + } + +@@ -5022,7 +5036,7 @@ bool torture_rpc_lsa(struct torture_context *tctx) + ret = false; + } + +- if (!test_many_LookupSids(p, tctx, handle)) { ++ if (!test_many_LookupSids(p, tctx, handle, LSA_LOOKUP_NAMES_ALL)) { + ret = false; + } + +@@ -5033,7 +5047,7 @@ bool torture_rpc_lsa(struct torture_context *tctx) + torture_leave_domain(tctx, join); + + } else { +- if (!test_many_LookupSids(p, tctx, handle)) { ++ if (!test_many_LookupSids(p, tctx, handle, LSA_LOOKUP_NAMES_ALL)) { + ret = false; + } + } +@@ -5108,7 +5122,7 @@ static bool testcase_LookupNames(struct torture_context *tctx, + tnames.names[0].name.string = "BUILTIN"; + tnames.names[0].sid_type = SID_NAME_DOMAIN; + +- if (!test_LookupNames(b, tctx, handle, &tnames)) { ++ if (!test_LookupNames(b, tctx, handle, LSA_LOOKUP_NAMES_ALL, &tnames)) { + ret = false; + } + +@@ -5118,23 +5132,23 @@ static bool testcase_LookupNames(struct torture_context *tctx, + tnames2.names[0].name.string = "BUILTIN"; + tnames2.names[0].sid_type = SID_NAME_DOMAIN; + +- if (!test_LookupNames2(b, tctx, handle, &tnames2, true)) { ++ if (!test_LookupNames2(b, tctx, handle, LSA_LOOKUP_NAMES_ALL, &tnames2, true)) { + ret = false; + } + +- if (!test_LookupNames3(b, tctx, handle, &tnames2, true)) { ++ if (!test_LookupNames3(b, tctx, handle, LSA_LOOKUP_NAMES_ALL, &tnames2, true)) { + ret = false; + } + +- if (!test_LookupNames_wellknown(b, tctx, handle)) { ++ if (!test_LookupNames_wellknown(b, tctx, handle, LSA_LOOKUP_NAMES_ALL)) { + ret = false; + } + +- if (!test_LookupNames_NULL(b, tctx, handle)) { ++ if (!test_LookupNames_NULL(b, tctx, handle, LSA_LOOKUP_NAMES_ALL)) { + ret = false; + } + +- if (!test_LookupNames_bogus(b, tctx, handle)) { ++ if (!test_LookupNames_bogus(b, tctx, handle, LSA_LOOKUP_NAMES_ALL)) { + ret = false; + } + +diff --git a/source4/torture/rpc/schannel.c b/source4/torture/rpc/schannel.c +index de3a36eaa4f..c237c82bbe7 100644 +--- a/source4/torture/rpc/schannel.c ++++ b/source4/torture/rpc/schannel.c +@@ -471,7 +471,7 @@ static bool test_schannel(struct torture_context *tctx, + "failed to connect lsarpc with schannel"); + + torture_assert(tctx, +- test_many_LookupSids(p_lsa, tctx, NULL), ++ test_many_LookupSids(p_lsa, tctx, NULL, LSA_LOOKUP_NAMES_ALL), + "LsaLookupSids3 failed!\n"); + + status = dcerpc_binding_set_transport(b, transport); +-- +2.21.0 + + +From e76b56290c2be142c43a3fd68584d51b9dc0efb7 Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Thu, 1 Aug 2019 15:48:58 +0300 +Subject: [PATCH 2/3] lookup_name: allow own domain lookup when flags == 0 + +In 2007, we've added support for multiple lookup levels for LSA +LookupNames family of calls. However, forest-wide lookups, as described +in MS-LSAT 2.2.16, never worked because flags passed to lookup_name() +were always set to zero, expecting at least default lookup on a DC to +apply. lookup_name() was instead treating zero flags as 'skip all +checks'. + +Allow at least own domain lookup in case domain name is the same. +This should allow FreeIPA DC to respond to LSA LookupNames3 calls from a +trusted AD DC side. + +For the reference, below is a request Windows Server 2016 domain +controller sends to FreeIPA domain controller when attempting to look up +a user from a trusted forest root domain that attemps to login to the +domain controller. Notice the level in the lsa_LookupNames3 call and +resulting flags in lookup_name(). + +[2019/08/03 07:14:24.156065, 1, pid=23639, effective(967001000, 967001000), real(967001000, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:471(ndr_print_function_debug) + lsa_LookupNames3: struct lsa_LookupNames3 + in: struct lsa_LookupNames3 + handle : * + handle: struct policy_handle + handle_type : 0x00000000 (0) + uuid : 0000004c-0000-0000-455d-3018575c0000 + num_names : 0x00000001 (1) + names: ARRAY(1) + names: struct lsa_String + length : 0x000a (10) + size : 0x000c (12) + string : * + string : 'XS\ab' + sids : * + sids: struct lsa_TransSidArray3 + count : 0x00000000 (0) + sids : NULL + level : LSA_LOOKUP_NAMES_UPLEVEL_TRUSTS_ONLY2 (6) + count : * + count : 0x00000000 (0) + lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) + client_revision : LSA_CLIENT_REVISION_2 (2) +[2019/08/03 07:14:24.156189, 6, pid=23639, effective(967001000, 967001000), real(967001000, 0), class=rpc_srv] ../../source3/rpc_server/rpc_handles.c:339(find_policy_by_hnd_internal) + Found policy hnd[0] [0000] 00 00 00 00 4C 00 00 00 00 00 00 00 45 5D 30 18 ....L... ....E]0. + [0010] 57 5C 00 00 W\.. +[2019/08/03 07:14:24.156228, 4, pid=23639, effective(967001000, 967001000), real(967001000, 0)] ../../source3/smbd/sec_ctx.c:215(push_sec_ctx) + push_sec_ctx(967001000, 967001000) : sec_ctx_stack_ndx = 2 +[2019/08/03 07:14:24.156246, 4, pid=23639, effective(967001000, 967001000), real(967001000, 0)] ../../source3/smbd/uid.c:552(push_conn_ctx) + push_conn_ctx(0) : conn_ctx_stack_ndx = 0 +[2019/08/03 07:14:24.156259, 4, pid=23639, effective(967001000, 967001000), real(967001000, 0)] ../../source3/smbd/sec_ctx.c:319(set_sec_ctx_internal) + setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 +[2019/08/03 07:14:24.156273, 5, pid=23639, effective(967001000, 967001000), real(967001000, 0)] ../../libcli/security/security_token.c:53(security_token_debug) + Security token: (NULL) +[2019/08/03 07:14:24.156285, 5, pid=23639, effective(967001000, 967001000), real(967001000, 0)] ../../source3/auth/token_util.c:865(debug_unix_user_token) + UNIX token of user 0 + Primary group is 0 and contains 0 supplementary groups +[2019/08/03 07:14:24.156311, 5, pid=23639, effective(0, 0), real(0, 0), class=rpc_srv] ../../source3/rpc_server/lsa/srv_lsa_nt.c:244(lookup_lsa_sids) + lookup_lsa_sids: looking up name XS\ab +[2019/08/03 07:14:24.156327, 10, pid=23639, effective(0, 0), real(0, 0)] ../../source3/passdb/lookup_sid.c:112(lookup_name) + lookup_name: XS\ab => domain=[XS], name=[ab] +[2019/08/03 07:14:24.156340, 10, pid=23639, effective(0, 0), real(0, 0)] ../../source3/passdb/lookup_sid.c:114(lookup_name) + lookup_name: flags = 0x00 + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14091 + +Signed-off-by: Alexander Bokovoy +Reviewed-by: Andreas Schneider + +(cherry picked from commit 685bb03de6ab733590831d1df4f5fd60d2ac427d) +--- + source3/passdb/lookup_sid.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/source3/passdb/lookup_sid.c b/source3/passdb/lookup_sid.c +index 2281bd0b64d..1bb15ccb8b4 100644 +--- a/source3/passdb/lookup_sid.c ++++ b/source3/passdb/lookup_sid.c +@@ -113,7 +113,7 @@ bool lookup_name(TALLOC_CTX *mem_ctx, + full_name, domain, name)); + DEBUG(10, ("lookup_name: flags = 0x0%x\n", flags)); + +- if ((flags & LOOKUP_NAME_DOMAIN) && ++ if (((flags & LOOKUP_NAME_DOMAIN) || (flags == 0)) && + strequal(domain, get_global_sam_name())) + { + +-- +2.21.0 + + +From 03d1a9f4f07f6e06c125875fe454925f4c1f6c2b Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Sat, 10 Aug 2019 11:53:12 +0300 +Subject: [PATCH 3/3] smbtorture: extend rpc.lsa to lookup machine over + forest-wide LookupNames + +Add a simple test to resolve DOMAIN\MACHINE$ via LSA LookupNames3 +using LSA_LOOKUP_NAMES_UPLEVEL_TRUSTS_ONLY2 level. This level would pass +zero lookup flags to lookup_name(). + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14091 + +Signed-off-by: Alexander Bokovoy +Reviewed-by: Andreas Schneider + +Autobuild-User(master): Alexander Bokovoy +Autobuild-Date(master): Wed Aug 14 13:07:42 UTC 2019 on sn-devel-184 + +(cherry picked from commit 4d276a93fc624dc04d880f5b4157f272d3555be6) +--- + source4/torture/rpc/lsa.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/source4/torture/rpc/lsa.c b/source4/torture/rpc/lsa.c +index b7dd0dc8c91..21cc16afbaf 100644 +--- a/source4/torture/rpc/lsa.c ++++ b/source4/torture/rpc/lsa.c +@@ -4794,7 +4794,7 @@ static bool test_QueryInfoPolicyCalls( bool version2, + || i == LSA_POLICY_INFO_DNS_INT)) { + /* Let's look up some of these names */ + +- struct lsa_TransNameArray tnames; ++ struct lsa_TransNameArray tnames, dnames; + tnames.count = 14; + tnames.names = talloc_zero_array(tctx, struct lsa_TranslatedName, tnames.count); + tnames.names[0].name.string = info->dns.name.string; +@@ -4827,6 +4827,12 @@ static bool test_QueryInfoPolicyCalls( bool version2, + tnames.names[13].sid_type = SID_NAME_USER; + ret &= test_LookupNames(b, tctx, handle, LSA_LOOKUP_NAMES_ALL, &tnames); + ++ /* Try to use in-forest search for the test machine */ ++ dnames.count = 1; ++ dnames.names = talloc_zero_array(tctx, struct lsa_TranslatedName, dnames.count); ++ dnames.names[0].name.string = talloc_asprintf(tctx, "%s\\"TEST_MACHINENAME "$", info->dns.name.string); ++ dnames.names[0].sid_type = SID_NAME_USER; ++ ret &= test_LookupNames(b, tctx, handle, LSA_LOOKUP_NAMES_UPLEVEL_TRUSTS_ONLY2, &dnames); + } + } + +-- +2.21.0 + diff --git a/samba.spec b/samba.spec index 3d59872..18e7c27 100644 --- a/samba.spec +++ b/samba.spec @@ -6,7 +6,7 @@ # ctdb is enabled by default, you can disable it with: --without clustering %bcond_without clustering -%define main_release 0 +%define main_release 1 %define samba_version 4.10.6 %define talloc_version 2.1.16 @@ -86,7 +86,7 @@ Name: samba Version: %{samba_version} -Release: %{samba_release}.2 +Release: %{samba_release} %if 0%{?rhel} Epoch: 0 @@ -119,6 +119,7 @@ Source14: samba.pamd Source201: README.downgrade Patch0: samba-4.10.x-waf_update.patch +Patch1: samba-bz14091-v4.10-backport.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -3439,6 +3440,10 @@ fi %endif # with_clustering_support %changelog +* Fri Aug 16 2019 Alexander Bokovoy - 2:4.10.6-1 +- Fix Samba bug https://bugzilla.samba.org/show_bug.cgi?id=14091 +- Fixes: Windows systems cannot resolve IPA users and groups over LSA RPC + * Fri Jul 26 2019 Fedora Release Engineering - 2:4.10.6-0.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild From ebd06bdd1a9d80a1d4d694804105497e7c7874e6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 29 Jul 2019 11:24:31 +0200 Subject: [PATCH 02/51] Update to Samba 4.11.0rc1 Guenther --- .gitignore | 2 + samba-4.10.x-waf_update.patch | 3300 --------------------------------- samba.spec | 20 +- sources | 4 +- 4 files changed, 15 insertions(+), 3311 deletions(-) delete mode 100644 samba-4.10.x-waf_update.patch diff --git a/.gitignore b/.gitignore index c351ef4..3f7e875 100644 --- a/.gitignore +++ b/.gitignore @@ -169,3 +169,5 @@ samba-3.6.0pre1.tar.gz /samba-4.10.5.tar.asc /samba-4.10.6.tar.xz /samba-4.10.6.tar.asc +/samba-4.11.0rc1.tar.xz +/samba-4.11.0rc1.tar.asc diff --git a/samba-4.10.x-waf_update.patch b/samba-4.10.x-waf_update.patch deleted file mode 100644 index b0ca5a3..0000000 --- a/samba-4.10.x-waf_update.patch +++ /dev/null @@ -1,3300 +0,0 @@ -From f78df958cb0a636906890ac6c823eb72ca365de3 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Mon, 3 Jun 2019 10:40:55 +0200 -Subject: [PATCH] third_party: Update waf to version 2.0.17 - -This fixes building Samba, libtalloc, libtevent, libtdb and libldb with -Python 3.8. - - wget https://waf.io/waf-2.0.17.tar.bz2 - tar -xf waf-2.0.17.tar.bz2 - git rm third_party/waf/waflib/ -r - mkdir third_party/waf -p - rsync -a waf-2.0.17/waflib/ third_party/waf/waflib/ - git add third_party/waf/waflib/ - -(Then update version number in buildtools/bin/waf and -buildtools/wafsamba/wafsamba.py) - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=13960 - -Signed-off-by: Andreas Schneider -Reviewed-by: Andrew Bartlett -Signed-off-by: Andrew Bartlett -(cherry picked from commit aabdcc91513e242c4f191e1bbbb70c890416d213) ---- - buildtools/bin/waf | 2 +- - buildtools/wafsamba/wafsamba.py | 2 +- - third_party/waf/waflib/Build.py | 62 ++++- - third_party/waf/waflib/ConfigSet.py | 4 +- - third_party/waf/waflib/Configure.py | 5 +- - third_party/waf/waflib/Context.py | 16 +- - third_party/waf/waflib/Logs.py | 9 +- - third_party/waf/waflib/Node.py | 3 +- - third_party/waf/waflib/Runner.py | 60 ++++- - third_party/waf/waflib/Scripting.py | 15 +- - third_party/waf/waflib/Task.py | 215 ++++++++++++++---- - third_party/waf/waflib/TaskGen.py | 6 +- - third_party/waf/waflib/Tools/c_config.py | 11 +- - third_party/waf/waflib/Tools/c_preproc.py | 8 +- - third_party/waf/waflib/Tools/ccroot.py | 22 +- - third_party/waf/waflib/Tools/d_scan.py | 8 +- - third_party/waf/waflib/Tools/fc.py | 24 +- - third_party/waf/waflib/Tools/fc_config.py | 6 +- - third_party/waf/waflib/Tools/fc_scan.py | 12 +- - third_party/waf/waflib/Tools/ifort.py | 2 +- - third_party/waf/waflib/Tools/javaw.py | 157 +++++++++++-- - third_party/waf/waflib/Tools/md5_tstamp.py | 6 +- - third_party/waf/waflib/Tools/msvc.py | 18 +- - third_party/waf/waflib/Tools/python.py | 18 +- - third_party/waf/waflib/Tools/qt5.py | 14 +- - third_party/waf/waflib/Tools/waf_unit_test.py | 4 +- - third_party/waf/waflib/Tools/winres.py | 4 +- - third_party/waf/waflib/Utils.py | 26 ++- - third_party/waf/waflib/ansiterm.py | 2 +- - third_party/waf/waflib/extras/buildcopy.py | 7 +- - third_party/waf/waflib/extras/clang_cross.py | 92 ++++++++ - .../waf/waflib/extras/clang_cross_common.py | 113 +++++++++ - .../waf/waflib/extras/clangxx_cross.py | 106 +++++++++ - third_party/waf/waflib/extras/color_msvc.py | 59 +++++ - third_party/waf/waflib/extras/cppcheck.py | 12 +- - third_party/waf/waflib/extras/cpplint.py | 77 +++---- - third_party/waf/waflib/extras/cython.py | 15 +- - third_party/waf/waflib/extras/distnet.py | 2 +- - third_party/waf/waflib/extras/doxygen.py | 13 +- - third_party/waf/waflib/extras/erlang.py | 2 +- - third_party/waf/waflib/extras/fast_partial.py | 3 +- - third_party/waf/waflib/extras/fc_cray.py | 2 +- - third_party/waf/waflib/extras/fc_nec.py | 2 +- - third_party/waf/waflib/extras/fc_nfort.py | 52 +++++ - third_party/waf/waflib/extras/gccdeps.py | 6 +- - third_party/waf/waflib/extras/kde4.py | 2 +- - third_party/waf/waflib/extras/msvcdeps.py | 73 +++--- - third_party/waf/waflib/extras/ocaml.py | 2 +- - .../waf/waflib/extras/parallel_debug.py | 9 +- - third_party/waf/waflib/extras/pgicc.py | 2 +- - third_party/waf/waflib/extras/protoc.py | 93 +++----- - third_party/waf/waflib/extras/pyqt5.py | 21 +- - third_party/waf/waflib/extras/qt4.py | 6 +- - third_party/waf/waflib/extras/remote.py | 2 +- - .../waf/waflib/extras/run_do_script.py | 2 +- - third_party/waf/waflib/extras/sphinx.py | 81 +++++++ - third_party/waf/waflib/extras/swig.py | 4 +- - third_party/waf/waflib/extras/syms.py | 2 +- - third_party/waf/waflib/extras/use_config.py | 2 +- - third_party/waf/waflib/extras/xcode6.py | 8 +- - third_party/waf/waflib/processor.py | 4 + - 61 files changed, 1259 insertions(+), 358 deletions(-) - create mode 100644 third_party/waf/waflib/extras/clang_cross.py - create mode 100644 third_party/waf/waflib/extras/clang_cross_common.py - create mode 100644 third_party/waf/waflib/extras/clangxx_cross.py - create mode 100644 third_party/waf/waflib/extras/color_msvc.py - create mode 100644 third_party/waf/waflib/extras/fc_nfort.py - create mode 100644 third_party/waf/waflib/extras/sphinx.py - -diff --git a/buildtools/bin/waf b/buildtools/bin/waf -index 3ee4d5bc4df..8413f2332b7 100755 ---- a/buildtools/bin/waf -+++ b/buildtools/bin/waf -@@ -32,7 +32,7 @@ POSSIBILITY OF SUCH DAMAGE. - - import os, sys, inspect - --VERSION="2.0.8" -+VERSION="2.0.17" - REVISION="x" - GIT="x" - INSTALL="x" -diff --git a/buildtools/wafsamba/wafsamba.py b/buildtools/wafsamba/wafsamba.py -index a077026c690..760430460b8 100644 ---- a/buildtools/wafsamba/wafsamba.py -+++ b/buildtools/wafsamba/wafsamba.py -@@ -37,7 +37,7 @@ LIB_PATH="shared" - - os.environ['PYTHONUNBUFFERED'] = '1' - --if Context.HEXVERSION not in (0x2000800,): -+if Context.HEXVERSION not in (0x2001100,): - Logs.error(''' - Please use the version of waf that comes with Samba, not - a system installed version. See http://wiki.samba.org/index.php/Waf -diff --git a/third_party/waf/waflib/Build.py b/third_party/waf/waflib/Build.py -index 8347a287a81..39f0991918b 100644 ---- a/third_party/waf/waflib/Build.py -+++ b/third_party/waf/waflib/Build.py -@@ -104,7 +104,7 @@ class BuildContext(Context.Context): - """Amount of jobs to run in parallel""" - - self.targets = Options.options.targets -- """List of targets to build (default: \*)""" -+ """List of targets to build (default: \\*)""" - - self.keep = Options.options.keep - """Whether the build should continue past errors""" -@@ -758,14 +758,31 @@ class BuildContext(Context.Context): - elif not ln.is_child_of(self.srcnode): - Logs.warn('CWD %s is not under %s, forcing --targets=* (run distclean?)', ln.abspath(), self.srcnode.abspath()) - ln = self.srcnode -- for tg in self.groups[self.current_group]: -+ -+ def is_post(tg, ln): - try: - p = tg.path - except AttributeError: - pass - else: - if p.is_child_of(ln): -- tgpost(tg) -+ return True -+ -+ def is_post_group(): -+ for i, g in enumerate(self.groups): -+ if i > self.current_group: -+ for tg in g: -+ if is_post(tg, ln): -+ return True -+ -+ if self.post_mode == POST_LAZY and ln != self.srcnode: -+ # partial folder builds require all targets from a previous build group -+ if is_post_group(): -+ ln = self.srcnode -+ -+ for tg in self.groups[self.current_group]: -+ if is_post(tg, ln): -+ tgpost(tg) - - def get_tasks_group(self, idx): - """ -@@ -884,7 +901,7 @@ class BuildContext(Context.Context): - - :param dest: absolute path of the symlink - :type dest: :py:class:`waflib.Node.Node` or string (absolute path) -- :param src: link contents, which is a relative or abolute path which may exist or not -+ :param src: link contents, which is a relative or absolute path which may exist or not - :type src: string - :param env: configuration set for performing substitutions in dest - :type env: :py:class:`waflib.ConfigSet.ConfigSet` -@@ -1038,12 +1055,16 @@ class inst(Task.Task): - """ - Returns the destination path where files will be installed, pre-pending `destdir`. - -+ Relative paths will be interpreted relative to `PREFIX` if no `destdir` is given. -+ - :rtype: string - """ - if isinstance(self.install_to, Node.Node): - dest = self.install_to.abspath() - else: -- dest = Utils.subst_vars(self.install_to, self.env) -+ dest = os.path.normpath(Utils.subst_vars(self.install_to, self.env)) -+ if not os.path.isabs(dest): -+ dest = os.path.join(self.env.PREFIX, dest) - if destdir and Options.options.destdir: - dest = os.path.join(Options.options.destdir, os.path.splitdrive(dest)[1].lstrip(os.sep)) - return dest -@@ -1139,11 +1160,19 @@ class inst(Task.Task): - # same size and identical timestamps -> make no copy - if st1.st_mtime + 2 >= st2.st_mtime and st1.st_size == st2.st_size: - if not self.generator.bld.progress_bar: -- Logs.info('- install %s (from %s)', tgt, lbl) -+ -+ c1 = Logs.colors.NORMAL -+ c2 = Logs.colors.BLUE -+ -+ Logs.info('%s- install %s%s%s (from %s)', c1, c2, tgt, c1, lbl) - return False - - if not self.generator.bld.progress_bar: -- Logs.info('+ install %s (from %s)', tgt, lbl) -+ -+ c1 = Logs.colors.NORMAL -+ c2 = Logs.colors.BLUE -+ -+ Logs.info('%s+ install %s%s%s (from %s)', c1, c2, tgt, c1, lbl) - - # Give best attempt at making destination overwritable, - # like the 'install' utility used by 'make install' does. -@@ -1200,14 +1229,18 @@ class inst(Task.Task): - """ - if os.path.islink(tgt) and os.readlink(tgt) == src: - if not self.generator.bld.progress_bar: -- Logs.info('- symlink %s (to %s)', tgt, src) -+ c1 = Logs.colors.NORMAL -+ c2 = Logs.colors.BLUE -+ Logs.info('%s- symlink %s%s%s (to %s)', c1, c2, tgt, c1, src) - else: - try: - os.remove(tgt) - except OSError: - pass - if not self.generator.bld.progress_bar: -- Logs.info('+ symlink %s (to %s)', tgt, src) -+ c1 = Logs.colors.NORMAL -+ c2 = Logs.colors.BLUE -+ Logs.info('%s+ symlink %s%s%s (to %s)', c1, c2, tgt, c1, src) - os.symlink(src, tgt) - self.fix_perms(tgt) - -@@ -1216,7 +1249,9 @@ class inst(Task.Task): - See :py:meth:`waflib.Build.inst.do_install` - """ - if not self.generator.bld.progress_bar: -- Logs.info('- remove %s', tgt) -+ c1 = Logs.colors.NORMAL -+ c2 = Logs.colors.BLUE -+ Logs.info('%s- remove %s%s%s', c1, c2, tgt, c1) - - #self.uninstall.append(tgt) - try: -@@ -1236,7 +1271,9 @@ class inst(Task.Task): - """ - try: - if not self.generator.bld.progress_bar: -- Logs.info('- remove %s', tgt) -+ c1 = Logs.colors.NORMAL -+ c2 = Logs.colors.BLUE -+ Logs.info('%s- remove %s%s%s', c1, c2, tgt, c1) - os.remove(tgt) - except OSError: - pass -@@ -1297,7 +1334,8 @@ class CleanContext(BuildContext): - lst = [] - for env in self.all_envs.values(): - lst.extend(self.root.find_or_declare(f) for f in env[CFG_FILES]) -- for n in self.bldnode.ant_glob('**/*', excl='.lock* *conf_check_*/** config.log c4che/*', quiet=True): -+ excluded_dirs = '.lock* *conf_check_*/** config.log %s/*' % CACHE_DIR -+ for n in self.bldnode.ant_glob('**/*', excl=excluded_dirs, quiet=True): - if n in lst: - continue - n.delete() -diff --git a/third_party/waf/waflib/ConfigSet.py b/third_party/waf/waflib/ConfigSet.py -index b300bb56b7c..901fba6c067 100644 ---- a/third_party/waf/waflib/ConfigSet.py -+++ b/third_party/waf/waflib/ConfigSet.py -@@ -11,7 +11,7 @@ The values put in :py:class:`ConfigSet` must be serializable (dicts, lists, stri - - import copy, re, os - from waflib import Logs, Utils --re_imp = re.compile('^(#)*?([^#=]*?)\ =\ (.*?)$', re.M) -+re_imp = re.compile(r'^(#)*?([^#=]*?)\ =\ (.*?)$', re.M) - - class ConfigSet(object): - """ -@@ -312,7 +312,7 @@ class ConfigSet(object): - :type filename: string - """ - tbl = self.table -- code = Utils.readf(filename, m='rU') -+ code = Utils.readf(filename, m='r') - for m in re_imp.finditer(code): - g = m.group - tbl[g(2)] = eval(g(3)) -diff --git a/third_party/waf/waflib/Configure.py b/third_party/waf/waflib/Configure.py -index 20ca705e696..db09c0e3a40 100644 ---- a/third_party/waf/waflib/Configure.py -+++ b/third_party/waf/waflib/Configure.py -@@ -125,7 +125,7 @@ class ConfigurationContext(Context.Context): - self.bldnode.mkdir() - - if not os.path.isdir(self.bldnode.abspath()): -- conf.fatal('Could not create the build directory %s' % self.bldnode.abspath()) -+ self.fatal('Could not create the build directory %s' % self.bldnode.abspath()) - - def execute(self): - """ -@@ -180,6 +180,7 @@ class ConfigurationContext(Context.Context): - env.hash = self.hash - env.files = self.files - env.environ = dict(self.environ) -+ env.launch_dir = Context.launch_dir - - if not (self.env.NO_LOCK_IN_RUN or env.environ.get('NO_LOCK_IN_RUN') or getattr(Options.options, 'no_lock_in_run')): - env.store(os.path.join(Context.run_dir, Options.lockfile)) -@@ -286,7 +287,7 @@ class ConfigurationContext(Context.Context): - - def eval_rules(self, rules): - """ -- Execute configuration tests provided as list of funcitons to run -+ Execute configuration tests provided as list of functions to run - - :param rules: list of configuration method names - :type rules: list of string -diff --git a/third_party/waf/waflib/Context.py b/third_party/waf/waflib/Context.py -index 3222fb1551c..d0759aada58 100644 ---- a/third_party/waf/waflib/Context.py -+++ b/third_party/waf/waflib/Context.py -@@ -11,13 +11,13 @@ from waflib import Utils, Errors, Logs - import waflib.Node - - # the following 3 constants are updated on each new release (do not touch) --HEXVERSION=0x2000800 -+HEXVERSION=0x2001100 - """Constant updated on new releases""" - --WAFVERSION="2.0.8" -+WAFVERSION="2.0.17" - """Constant updated on new releases""" - --WAFREVISION="f78fbc32bb355a3291c9b5f79bbe0c8dfe81282a" -+WAFREVISION="6bc6cb599c702e985780e9f705b291b812123693" - """Git revision when the waf version is updated""" - - ABI = 20 -@@ -266,7 +266,7 @@ class Context(ctx): - cache[node] = True - self.pre_recurse(node) - try: -- function_code = node.read('rU', encoding) -+ function_code = node.read('r', encoding) - exec(compile(function_code, node.abspath(), 'exec'), self.exec_dict) - finally: - self.post_recurse(node) -@@ -502,7 +502,7 @@ class Context(ctx): - def build(bld): - bld.to_log('starting the build') - -- Provide a logger on the context class or override this methid if necessary. -+ Provide a logger on the context class or override this method if necessary. - - :param msg: message - :type msg: string -@@ -613,7 +613,7 @@ class Context(ctx): - is typically called once for a programming language group, see for - example :py:mod:`waflib.Tools.compiler_c` - -- :param var: glob expression, for example 'cxx\_\*.py' -+ :param var: glob expression, for example 'cxx\\_\\*.py' - :type var: string - :param ban: list of exact file names to exclude - :type ban: list of string -@@ -662,7 +662,7 @@ def load_module(path, encoding=None): - - module = imp.new_module(WSCRIPT_FILE) - try: -- code = Utils.readf(path, m='rU', encoding=encoding) -+ code = Utils.readf(path, m='r', encoding=encoding) - except EnvironmentError: - raise Errors.WafError('Could not read the file %r' % path) - -@@ -678,7 +678,7 @@ def load_module(path, encoding=None): - - def load_tool(tool, tooldir=None, ctx=None, with_sys_path=True): - """ -- Importx a Waf tool as a python module, and stores it in the dict :py:const:`waflib.Context.Context.tools` -+ Imports a Waf tool as a python module, and stores it in the dict :py:const:`waflib.Context.Context.tools` - - :type tool: string - :param tool: Name of the tool -diff --git a/third_party/waf/waflib/Logs.py b/third_party/waf/waflib/Logs.py -index 2a475169b9b..298411db51e 100644 ---- a/third_party/waf/waflib/Logs.py -+++ b/third_party/waf/waflib/Logs.py -@@ -237,7 +237,10 @@ class formatter(logging.Formatter): - if rec.levelno >= logging.INFO: - # the goal of this is to format without the leading "Logs, hour" prefix - if rec.args: -- return msg % rec.args -+ try: -+ return msg % rec.args -+ except UnicodeDecodeError: -+ return msg.encode('utf-8') % rec.args - return msg - - rec.msg = msg -@@ -276,9 +279,9 @@ def error(*k, **kw): - - def warn(*k, **kw): - """ -- Wraps logging.warn -+ Wraps logging.warning - """ -- log.warn(*k, **kw) -+ log.warning(*k, **kw) - - def info(*k, **kw): - """ -diff --git a/third_party/waf/waflib/Node.py b/third_party/waf/waflib/Node.py -index 4ac1ea8a0b8..2ad18466970 100644 ---- a/third_party/waf/waflib/Node.py -+++ b/third_party/waf/waflib/Node.py -@@ -73,7 +73,7 @@ def ant_matcher(s, ignorecase): - if k == '**': - accu.append(k) - else: -- k = k.replace('.', '[.]').replace('*','.*').replace('?', '.').replace('+', '\\+') -+ k = k.replace('.', '[.]').replace('*', '.*').replace('?', '.').replace('+', '\\+') - k = '^%s$' % k - try: - exp = re.compile(k, flags=reflags) -@@ -595,7 +595,6 @@ class Node(object): - :rtype: iterator - """ - dircont = self.listdir() -- dircont.sort() - - try: - lst = set(self.children.keys()) -diff --git a/third_party/waf/waflib/Runner.py b/third_party/waf/waflib/Runner.py -index 7535c83de9e..91d55479e20 100644 ---- a/third_party/waf/waflib/Runner.py -+++ b/third_party/waf/waflib/Runner.py -@@ -37,6 +37,8 @@ class PriorityTasks(object): - return len(self.lst) - def __iter__(self): - return iter(self.lst) -+ def __str__(self): -+ return 'PriorityTasks: [%s]' % '\n '.join(str(x) for x in self.lst) - def clear(self): - self.lst = [] - def append(self, task): -@@ -181,10 +183,12 @@ class Parallel(object): - The reverse dependency graph of dependencies obtained from Task.run_after - """ - -- self.spawner = Spawner(self) -+ self.spawner = None - """ - Coordinating daemon thread that spawns thread consumers - """ -+ if self.numjobs > 1: -+ self.spawner = Spawner(self) - - def get_next_task(self): - """ -@@ -226,6 +230,10 @@ class Parallel(object): - pass - else: - if cond: -+ # The most common reason is conflicting build order declaration -+ # for example: "X run_after Y" and "Y run_after X" -+ # Another can be changing "run_after" dependencies while the build is running -+ # for example: updating "tsk.run_after" in the "runnable_status" method - lst = [] - for tsk in self.postponed: - deps = [id(x) for x in tsk.run_after if not x.hasrun] -@@ -250,6 +258,8 @@ class Parallel(object): - self.outstanding.append(x) - break - else: -+ if self.stop or self.error: -+ break - raise Errors.WafError('Broken revdeps detected on %r' % self.incomplete) - else: - tasks = next(self.biter) -@@ -298,6 +308,8 @@ class Parallel(object): - def mark_finished(self, tsk): - def try_unfreeze(x): - # DAG ancestors are likely to be in the incomplete set -+ # This assumes that the run_after contents have not changed -+ # after the build starts, else a deadlock may occur - if x in self.incomplete: - # TODO remove dependencies to free some memory? - # x.run_after.remove(tsk) -@@ -323,6 +335,19 @@ class Parallel(object): - try_unfreeze(x) - del self.revdeps[tsk] - -+ if hasattr(tsk, 'semaphore'): -+ sem = tsk.semaphore -+ try: -+ sem.release(tsk) -+ except KeyError: -+ # TODO -+ pass -+ else: -+ while sem.waiting and not sem.is_locked(): -+ # take a frozen task, make it ready to run -+ x = sem.waiting.pop() -+ self._add_task(x) -+ - def get_out(self): - """ - Waits for a Task that task consumers add to :py:attr:`waflib.Runner.Parallel.out` after execution. -@@ -346,8 +371,29 @@ class Parallel(object): - :param tsk: task instance - :type tsk: :py:attr:`waflib.Task.Task` - """ -+ # TODO change in waf 2.1 - self.ready.put(tsk) - -+ def _add_task(self, tsk): -+ if hasattr(tsk, 'semaphore'): -+ sem = tsk.semaphore -+ try: -+ sem.acquire(tsk) -+ except IndexError: -+ sem.waiting.add(tsk) -+ return -+ -+ self.count += 1 -+ self.processed += 1 -+ if self.numjobs == 1: -+ tsk.log_display(tsk.generator.bld) -+ try: -+ self.process_task(tsk) -+ finally: -+ self.out.put(tsk) -+ else: -+ self.add_task(tsk) -+ - def process_task(self, tsk): - """ - Processes a task and attempts to stop the build in case of errors -@@ -447,17 +493,7 @@ class Parallel(object): - - st = self.task_status(tsk) - if st == Task.RUN_ME: -- self.count += 1 -- self.processed += 1 -- -- if self.numjobs == 1: -- tsk.log_display(tsk.generator.bld) -- try: -- self.process_task(tsk) -- finally: -- self.out.put(tsk) -- else: -- self.add_task(tsk) -+ self._add_task(tsk) - elif st == Task.ASK_LATER: - self.postpone(tsk) - elif st == Task.SKIP_ME: -diff --git a/third_party/waf/waflib/Scripting.py b/third_party/waf/waflib/Scripting.py -index 18203d52701..ae17a8b4503 100644 ---- a/third_party/waf/waflib/Scripting.py -+++ b/third_party/waf/waflib/Scripting.py -@@ -122,7 +122,8 @@ def waf_entry_point(current_directory, version, wafdir): - if no_climb: - break - -- if not Context.run_dir: -+ wscript = os.path.normpath(os.path.join(Context.run_dir, Context.WSCRIPT_FILE)) -+ if not os.path.exists(wscript): - if options.whelp: - Logs.warn('These are the generic options (no wscript/project found)') - ctx.parser.print_help() -@@ -137,7 +138,7 @@ def waf_entry_point(current_directory, version, wafdir): - sys.exit(1) - - try: -- set_main_module(os.path.normpath(os.path.join(Context.run_dir, Context.WSCRIPT_FILE))) -+ set_main_module(wscript) - except Errors.WafError as e: - Logs.pprint('RED', e.verbose_msg) - Logs.error(str(e)) -@@ -215,7 +216,10 @@ def parse_options(): - ctx = Context.create_context('options') - ctx.execute() - if not Options.commands: -- Options.commands.append(default_cmd) -+ if isinstance(default_cmd, list): -+ Options.commands.extend(default_cmd) -+ else: -+ Options.commands.append(default_cmd) - if Options.options.whelp: - ctx.parser.print_help() - sys.exit(0) -@@ -279,7 +283,7 @@ def distclean_dir(dirname): - pass - - try: -- shutil.rmtree('c4che') -+ shutil.rmtree(Build.CACHE_DIR) - except OSError: - pass - -@@ -597,12 +601,15 @@ def autoconfigure(execute_method): - cmd = env.config_cmd or 'configure' - if Configure.autoconfig == 'clobber': - tmp = Options.options.__dict__ -+ launch_dir_tmp = Context.launch_dir - if env.options: - Options.options.__dict__ = env.options -+ Context.launch_dir = env.launch_dir - try: - run_command(cmd) - finally: - Options.options.__dict__ = tmp -+ Context.launch_dir = launch_dir_tmp - else: - run_command(cmd) - run_command(self.cmd) -diff --git a/third_party/waf/waflib/Task.py b/third_party/waf/waflib/Task.py -index c4642443f55..cb49a7394df 100644 ---- a/third_party/waf/waflib/Task.py -+++ b/third_party/waf/waflib/Task.py -@@ -50,6 +50,9 @@ def f(tsk): - bld = gen.bld - cwdx = tsk.get_cwd() - p = env.get_flat -+ def to_list(xx): -+ if isinstance(xx, str): return [xx] -+ return xx - tsk.last_cmd = cmd = \'\'\' %s \'\'\' % s - return tsk.exec_command(cmd, cwd=cwdx, env=env.env or None) - ''' -@@ -75,6 +78,20 @@ def f(tsk): - return tsk.exec_command(lst, cwd=cwdx, env=env.env or None) - ''' - -+COMPILE_TEMPLATE_SIG_VARS = ''' -+def f(tsk): -+ sig = tsk.generator.bld.hash_env_vars(tsk.env, tsk.vars) -+ tsk.m.update(sig) -+ env = tsk.env -+ gen = tsk.generator -+ bld = gen.bld -+ cwdx = tsk.get_cwd() -+ p = env.get_flat -+ buf = [] -+ %s -+ tsk.m.update(repr(buf).encode()) -+''' -+ - classes = {} - """ - The metaclass :py:class:`waflib.Task.store_task_type` stores all class tasks -@@ -101,8 +118,13 @@ class store_task_type(type): - # change the name of run_str or it is impossible to subclass with a function - cls.run_str = None - cls.run = f -+ # process variables - cls.vars = list(set(cls.vars + dvars)) - cls.vars.sort() -+ if cls.vars: -+ fun = compile_sig_vars(cls.vars) -+ if fun: -+ cls.sig_vars = fun - elif getattr(cls, 'run', None) and not 'hcode' in cls.__dict__: - # getattr(cls, 'hcode') would look in the upper classes - cls.hcode = Utils.h_cmd(cls.run) -@@ -115,10 +137,12 @@ evil = store_task_type('evil', (object,), {}) - - class Task(evil): - """ -- This class deals with the filesystem (:py:class:`waflib.Node.Node`). The method :py:class:`waflib.Task.Task.runnable_status` -- uses a hash value (from :py:class:`waflib.Task.Task.signature`) which is persistent from build to build. When the value changes, -- the task has to be executed. The method :py:class:`waflib.Task.Task.post_run` will assign the task signature to the output -- nodes (if present). -+ Task objects represents actions to perform such as commands to execute by calling the `run` method. -+ -+ Detecting when to execute a task occurs in the method :py:meth:`waflib.Task.Task.runnable_status`. -+ -+ Detecting which tasks to execute is performed through a hash value returned by -+ :py:meth:`waflib.Task.Task.signature`. The task signature is persistent from build to build. - """ - vars = [] - """ConfigSet variables that should trigger a rebuild (class attribute used for :py:meth:`waflib.Task.Task.sig_vars`)""" -@@ -139,10 +163,10 @@ class Task(evil): - """File extensions that objects of this task class may create""" - - before = [] -- """List of task class names to execute before instances of this class""" -+ """The instances of this class are executed before the instances of classes whose names are in this list""" - - after = [] -- """List of task class names to execute after instances of this class""" -+ """The instances of this class are executed after the instances of classes whose names are in this list""" - - hcode = Utils.SIG_NIL - """String representing an additional hash for the class representation""" -@@ -282,25 +306,31 @@ class Task(evil): - if hasattr(self, 'stderr'): - kw['stderr'] = self.stderr - -- # workaround for command line length limit: -- # http://support.microsoft.com/kb/830473 -- if not isinstance(cmd, str) and (len(repr(cmd)) >= 8192 if Utils.is_win32 else len(cmd) > 200000): -- cmd, args = self.split_argfile(cmd) -- try: -- (fd, tmp) = tempfile.mkstemp() -- os.write(fd, '\r\n'.join(args).encode()) -- os.close(fd) -- if Logs.verbose: -- Logs.debug('argfile: @%r -> %r', tmp, args) -- return self.generator.bld.exec_command(cmd + ['@' + tmp], **kw) -- finally: -+ if not isinstance(cmd, str): -+ if Utils.is_win32: -+ # win32 compares the resulting length http://support.microsoft.com/kb/830473 -+ too_long = sum([len(arg) for arg in cmd]) + len(cmd) > 8192 -+ else: -+ # non-win32 counts the amount of arguments (200k) -+ too_long = len(cmd) > 200000 -+ -+ if too_long and getattr(self, 'allow_argsfile', True): -+ # Shunt arguments to a temporary file if the command is too long. -+ cmd, args = self.split_argfile(cmd) - try: -- os.remove(tmp) -- except OSError: -- # anti-virus and indexers can keep files open -_- -- pass -- else: -- return self.generator.bld.exec_command(cmd, **kw) -+ (fd, tmp) = tempfile.mkstemp() -+ os.write(fd, '\r\n'.join(args).encode()) -+ os.close(fd) -+ if Logs.verbose: -+ Logs.debug('argfile: @%r -> %r', tmp, args) -+ return self.generator.bld.exec_command(cmd + ['@' + tmp], **kw) -+ finally: -+ try: -+ os.remove(tmp) -+ except OSError: -+ # anti-virus and indexers can keep files open -_- -+ pass -+ return self.generator.bld.exec_command(cmd, **kw) - - def process(self): - """ -@@ -572,6 +602,9 @@ class Task(evil): - """ - Run this task only after the given *task*. - -+ Calling this method from :py:meth:`waflib.Task.Task.runnable_status` may cause -+ build deadlocks; see :py:meth:`waflib.Tools.fc.fc.runnable_status` for details. -+ - :param task: task - :type task: :py:class:`waflib.Task.Task` - """ -@@ -751,6 +784,10 @@ class Task(evil): - def sig_vars(self): - """ - Used by :py:meth:`waflib.Task.Task.signature`; it hashes :py:attr:`waflib.Task.Task.env` variables/values -+ When overriding this method, and if scriptlet expressions are used, make sure to follow -+ the code in :py:meth:`waflib.Task.Task.compile_sig_vars` to enable dependencies on scriptlet results. -+ -+ This method may be replaced on subclasses by the metaclass to force dependencies on scriptlet code. - """ - sig = self.generator.bld.hash_env_vars(self.env, self.vars) - self.m.update(sig) -@@ -1013,7 +1050,7 @@ def funex(c): - exec(c, dc) - return dc['f'] - --re_cond = re.compile('(?P\w+)|(?P\|)|(?P&)') -+re_cond = re.compile(r'(?P\w+)|(?P\|)|(?P&)') - re_novar = re.compile(r'^(SRC|TGT)\W+.*?$') - reg_act = re.compile(r'(?P\\)|(?P\$\$)|(?P\$\{(?P\w+)(?P.*?)\})', re.M) - def compile_fun_shell(line): -@@ -1033,6 +1070,9 @@ def compile_fun_shell(line): - return None - line = reg_act.sub(repl, line) or line - dvars = [] -+ def add_dvar(x): -+ if x not in dvars: -+ dvars.append(x) - - def replc(m): - # performs substitutions and populates dvars -@@ -1042,8 +1082,7 @@ def compile_fun_shell(line): - return ' or ' - else: - x = m.group('var') -- if x not in dvars: -- dvars.append(x) -+ add_dvar(x) - return 'env[%r]' % x - - parm = [] -@@ -1061,8 +1100,7 @@ def compile_fun_shell(line): - app('" ".join([a.path_from(cwdx) for a in tsk.outputs])') - elif meth: - if meth.startswith(':'): -- if var not in dvars: -- dvars.append(var) -+ add_dvar(var) - m = meth[1:] - if m == 'SRC': - m = '[a.path_from(cwdx) for a in tsk.inputs]' -@@ -1072,19 +1110,21 @@ def compile_fun_shell(line): - m = '[tsk.inputs%s]' % m[3:] - elif re_novar.match(m): - m = '[tsk.outputs%s]' % m[3:] -- elif m[:3] not in ('tsk', 'gen', 'bld'): -- dvars.append(meth[1:]) -- m = '%r' % m -+ else: -+ add_dvar(m) -+ if m[:3] not in ('tsk', 'gen', 'bld'): -+ m = '%r' % m - app('" ".join(tsk.colon(%r, %s))' % (var, m)) - elif meth.startswith('?'): - # In A?B|C output env.A if one of env.B or env.C is non-empty - expr = re_cond.sub(replc, meth[1:]) - app('p(%r) if (%s) else ""' % (var, expr)) - else: -- app('%s%s' % (var, meth)) -+ call = '%s%s' % (var, meth) -+ add_dvar(call) -+ app(call) - else: -- if var not in dvars: -- dvars.append(var) -+ add_dvar(var) - app("p('%s')" % var) - if parm: - parm = "%% (%s) " % (',\n\t\t'.join(parm)) -@@ -1105,6 +1145,10 @@ def compile_fun_noshell(line): - merge = False - app = buf.append - -+ def add_dvar(x): -+ if x not in dvars: -+ dvars.append(x) -+ - def replc(m): - # performs substitutions and populates dvars - if m.group('and'): -@@ -1113,8 +1157,7 @@ def compile_fun_noshell(line): - return ' or ' - else: - x = m.group('var') -- if x not in dvars: -- dvars.append(x) -+ add_dvar(x) - return 'env[%r]' % x - - for m in reg_act_noshell.finditer(line): -@@ -1139,8 +1182,7 @@ def compile_fun_noshell(line): - elif code: - if code.startswith(':'): - # a composed variable ${FOO:OUT} -- if not var in dvars: -- dvars.append(var) -+ add_dvar(var) - m = code[1:] - if m == 'SRC': - m = '[a.path_from(cwdx) for a in tsk.inputs]' -@@ -1150,9 +1192,10 @@ def compile_fun_noshell(line): - m = '[tsk.inputs%s]' % m[3:] - elif re_novar.match(m): - m = '[tsk.outputs%s]' % m[3:] -- elif m[:3] not in ('tsk', 'gen', 'bld'): -- dvars.append(m) -- m = '%r' % m -+ else: -+ add_dvar(m) -+ if m[:3] not in ('tsk', 'gen', 'bld'): -+ m = '%r' % m - app('tsk.colon(%r, %s)' % (var, m)) - elif code.startswith('?'): - # In A?B|C output env.A if one of env.B or env.C is non-empty -@@ -1160,12 +1203,13 @@ def compile_fun_noshell(line): - app('to_list(env[%r] if (%s) else [])' % (var, expr)) - else: - # plain code such as ${tsk.inputs[0].abspath()} -- app('gen.to_list(%s%s)' % (var, code)) -+ call = '%s%s' % (var, code) -+ add_dvar(call) -+ app('to_list(%s)' % call) - else: - # a plain variable such as # a plain variable like ${AR} - app('to_list(env[%r])' % var) -- if not var in dvars: -- dvars.append(var) -+ add_dvar(var) - if merge: - tmp = 'merge(%s, %s)' % (buf[-2], buf[-1]) - del buf[-1] -@@ -1222,6 +1266,36 @@ def compile_fun(line, shell=False): - else: - return compile_fun_noshell(line) - -+def compile_sig_vars(vars): -+ """ -+ This method produces a sig_vars method suitable for subclasses that provide -+ scriptlet code in their run_str code. -+ If no such method can be created, this method returns None. -+ -+ The purpose of the sig_vars method returned is to ensures -+ that rebuilds occur whenever the contents of the expression changes. -+ This is the case B below:: -+ -+ import time -+ # case A: regular variables -+ tg = bld(rule='echo ${FOO}') -+ tg.env.FOO = '%s' % time.time() -+ # case B -+ bld(rule='echo ${gen.foo}', foo='%s' % time.time()) -+ -+ :param vars: env variables such as CXXFLAGS or gen.foo -+ :type vars: list of string -+ :return: A sig_vars method relevant for dependencies if adequate, else None -+ :rtype: A function, or None in most cases -+ """ -+ buf = [] -+ for x in sorted(vars): -+ if x[:3] in ('tsk', 'gen', 'bld'): -+ buf.append('buf.append(%s)' % x) -+ if buf: -+ return funex(COMPILE_TEMPLATE_SIG_VARS % '\n\t'.join(buf)) -+ return None -+ - def task_factory(name, func=None, vars=None, color='GREEN', ext_in=[], ext_out=[], before=[], after=[], shell=False, scan=None): - """ - Returns a new task subclass with the function ``run`` compiled from the line given. -@@ -1279,3 +1353,54 @@ def deep_inputs(cls): - TaskBase = Task - "Provided for compatibility reasons, TaskBase should not be used" - -+class TaskSemaphore(object): -+ """ -+ Task semaphores provide a simple and efficient way of throttling the amount of -+ a particular task to run concurrently. The throttling value is capped -+ by the amount of maximum jobs, so for example, a `TaskSemaphore(10)` -+ has no effect in a `-j2` build. -+ -+ Task semaphores are typically specified on the task class level:: -+ -+ class compile(waflib.Task.Task): -+ semaphore = waflib.Task.TaskSemaphore(2) -+ run_str = 'touch ${TGT}' -+ -+ Task semaphores are meant to be used by the build scheduler in the main -+ thread, so there are no guarantees of thread safety. -+ """ -+ def __init__(self, num): -+ """ -+ :param num: maximum value of concurrent tasks -+ :type num: int -+ """ -+ self.num = num -+ self.locking = set() -+ self.waiting = set() -+ -+ def is_locked(self): -+ """Returns True if this semaphore cannot be acquired by more tasks""" -+ return len(self.locking) >= self.num -+ -+ def acquire(self, tsk): -+ """ -+ Mark the semaphore as used by the given task (not re-entrant). -+ -+ :param tsk: task object -+ :type tsk: :py:class:`waflib.Task.Task` -+ :raises: :py:class:`IndexError` in case the resource is already acquired -+ """ -+ if self.is_locked(): -+ raise IndexError('Cannot lock more %r' % self.locking) -+ self.locking.add(tsk) -+ -+ def release(self, tsk): -+ """ -+ Mark the semaphore as unused by the given task. -+ -+ :param tsk: task object -+ :type tsk: :py:class:`waflib.Task.Task` -+ :raises: :py:class:`KeyError` in case the resource is not acquired by the task -+ """ -+ self.locking.remove(tsk) -+ -diff --git a/third_party/waf/waflib/TaskGen.py b/third_party/waf/waflib/TaskGen.py -index 40007b55ca7..532b7d5cdb4 100644 ---- a/third_party/waf/waflib/TaskGen.py -+++ b/third_party/waf/waflib/TaskGen.py -@@ -74,7 +74,7 @@ class task_gen(object): - else: - self.bld = kw['bld'] - self.env = self.bld.env.derive() -- self.path = self.bld.path # emulate chdir when reading scripts -+ self.path = kw.get('path', self.bld.path) # by default, emulate chdir when reading scripts - - # Provide a unique index per folder - # This is part of a measure to prevent output file name collisions -@@ -556,7 +556,7 @@ def process_rule(self): - * chmod: permissions for the resulting files (integer value such as Utils.O755) - * shell: set to False to execute the command directly (default is True to use a shell) - * scan: scanner function -- * vars: list of variables to trigger rebuilts, such as CFLAGS -+ * vars: list of variables to trigger rebuilds, such as CFLAGS - * cls_str: string to display when executing the task - * cls_keyword: label to display when executing the task - * cache_rule: by default, try to re-use similar classes, set to False to disable -@@ -727,7 +727,7 @@ def sequence_order(self): - self.bld.prev = self - - --re_m4 = re.compile('@(\w+)@', re.M) -+re_m4 = re.compile(r'@(\w+)@', re.M) - - class subst_pc(Task.Task): - """ -diff --git a/third_party/waf/waflib/Tools/c_config.py b/third_party/waf/waflib/Tools/c_config.py -index 76082152cd9..d546be95614 100644 ---- a/third_party/waf/waflib/Tools/c_config.py -+++ b/third_party/waf/waflib/Tools/c_config.py -@@ -250,9 +250,9 @@ def exec_cfg(self, kw): - :type atleast_pkgconfig_version: string - :param package: package name, for example *gtk+-2.0* - :type package: string -- :param uselib_store: if the test is successful, define HAVE\_*name*. It is also used to define *conf.env.FLAGS_name* variables. -+ :param uselib_store: if the test is successful, define HAVE\\_*name*. It is also used to define *conf.env.FLAGS_name* variables. - :type uselib_store: string -- :param modversion: if provided, return the version of the given module and define *name*\_VERSION -+ :param modversion: if provided, return the version of the given module and define *name*\\_VERSION - :type modversion: string - :param args: arguments to give to *package* when retrieving flags - :type args: list of string -@@ -358,13 +358,12 @@ def check_cfg(self, *k, **kw): - ret = None - try: - ret = self.exec_cfg(kw) -- except self.errors.WafError: -+ except self.errors.WafError as e: - if 'errmsg' in kw: - self.end_msg(kw['errmsg'], 'YELLOW', **kw) - if Logs.verbose > 1: -- raise -- else: -- self.fatal('The configuration failed') -+ self.to_log('Command failure: %s' % e) -+ self.fatal('The configuration failed') - else: - if not ret: - ret = True -diff --git a/third_party/waf/waflib/Tools/c_preproc.py b/third_party/waf/waflib/Tools/c_preproc.py -index c2c239baa26..68e5f5aea29 100644 ---- a/third_party/waf/waflib/Tools/c_preproc.py -+++ b/third_party/waf/waflib/Tools/c_preproc.py -@@ -75,13 +75,13 @@ re_lines = re.compile( - re.IGNORECASE | re.MULTILINE) - """Match #include lines""" - --re_mac = re.compile("^[a-zA-Z_]\w*") -+re_mac = re.compile(r"^[a-zA-Z_]\w*") - """Match macro definitions""" - - re_fun = re.compile('^[a-zA-Z_][a-zA-Z0-9_]*[(]') - """Match macro functions""" - --re_pragma_once = re.compile('^\s*once\s*', re.IGNORECASE) -+re_pragma_once = re.compile(r'^\s*once\s*', re.IGNORECASE) - """Match #pragma once statements""" - - re_nl = re.compile('\\\\\r*\n', re.MULTILINE) -@@ -146,7 +146,7 @@ def repl(m): - - prec = {} - """ --Operator precendence rules required for parsing expressions of the form:: -+Operator precedence rules required for parsing expressions of the form:: - - #if 1 && 2 != 0 - """ -@@ -660,7 +660,7 @@ def extract_macro(txt): - # empty define, assign an empty token - return (v, [[], [('T','')]]) - --re_include = re.compile('^\s*(<(?:.*)>|"(?:.*)")') -+re_include = re.compile(r'^\s*(<(?:.*)>|"(?:.*)")') - def extract_include(txt, defs): - """ - Process a line in the form:: -diff --git a/third_party/waf/waflib/Tools/ccroot.py b/third_party/waf/waflib/Tools/ccroot.py -index 394f36b8e12..579d5b2b72b 100644 ---- a/third_party/waf/waflib/Tools/ccroot.py -+++ b/third_party/waf/waflib/Tools/ccroot.py -@@ -111,7 +111,7 @@ def apply_incpaths(self): - tg = bld(features='includes', includes='.') - - The folders only need to be relative to the current directory, the equivalent build directory is -- added automatically (for headers created in the build directory). This enable using a build directory -+ added automatically (for headers created in the build directory). This enables using a build directory - or not (``top == out``). - - This method will add a list of nodes read by :py:func:`waflib.Tools.ccroot.to_incnodes` in ``tg.env.INCPATHS``, -@@ -161,7 +161,7 @@ class link_task(Task.Task): - nums = self.generator.vnum.split('.') - if self.env.DEST_BINFMT == 'pe': - # include the version in the dll file name, -- # the import lib file name stays unversionned. -+ # the import lib file name stays unversioned. - name = name + '-' + nums[0] - elif self.env.DEST_OS == 'openbsd': - pattern = '%s.%s' % (pattern, nums[0]) -@@ -238,6 +238,17 @@ def rm_tgt(cls): - setattr(cls, 'run', wrap) - rm_tgt(stlink_task) - -+@feature('skip_stlib_link_deps') -+@before_method('process_use') -+def apply_skip_stlib_link_deps(self): -+ """ -+ This enables an optimization in the :py:func:wafilb.Tools.ccroot.processes_use: method that skips dependency and -+ link flag optimizations for targets that generate static libraries (via the :py:class:Tools.ccroot.stlink_task task). -+ The actual behavior is implemented in :py:func:wafilb.Tools.ccroot.processes_use: method so this feature only tells waf -+ to enable the new behavior. -+ """ -+ self.env.SKIP_STLIB_LINK_DEPS = True -+ - @feature('c', 'cxx', 'd', 'fc', 'asm') - @after_method('process_source') - def apply_link(self): -@@ -386,7 +397,11 @@ def process_use(self): - y = self.bld.get_tgen_by_name(x) - var = y.tmp_use_var - if var and link_task: -- if var == 'LIB' or y.tmp_use_stlib or x in names: -+ if self.env.SKIP_STLIB_LINK_DEPS and isinstance(link_task, stlink_task): -+ # If the skip_stlib_link_deps feature is enabled then we should -+ # avoid adding lib deps to the stlink_task instance. -+ pass -+ elif var == 'LIB' or y.tmp_use_stlib or x in names: - self.env.append_value(var, [y.target[y.target.rfind(os.sep) + 1:]]) - self.link_task.dep_nodes.extend(y.link_task.outputs) - tmp_path = y.link_task.outputs[0].parent.path_from(self.get_cwd()) -@@ -600,6 +615,7 @@ def apply_vnum(self): - - if getattr(self, 'install_task', None): - self.install_task.hasrun = Task.SKIPPED -+ self.install_task.no_errcheck_out = True - path = self.install_task.install_to - if self.env.DEST_OS == 'openbsd': - libname = self.link_task.outputs[0].name -diff --git a/third_party/waf/waflib/Tools/d_scan.py b/third_party/waf/waflib/Tools/d_scan.py -index 14c6c313e9a..4e807a6b9fc 100644 ---- a/third_party/waf/waflib/Tools/d_scan.py -+++ b/third_party/waf/waflib/Tools/d_scan.py -@@ -93,8 +93,8 @@ class d_parser(object): - - self.allnames = [] - -- self.re_module = re.compile("module\s+([^;]+)") -- self.re_import = re.compile("import\s+([^;]+)") -+ self.re_module = re.compile(r"module\s+([^;]+)") -+ self.re_import = re.compile(r"import\s+([^;]+)") - self.re_import_bindings = re.compile("([^:]+):(.*)") - self.re_import_alias = re.compile("[^=]+=(.+)") - -@@ -138,7 +138,7 @@ class d_parser(object): - - mod_name = self.re_module.search(code) - if mod_name: -- self.module = re.sub('\s+', '', mod_name.group(1)) # strip all whitespaces -+ self.module = re.sub(r'\s+', '', mod_name.group(1)) # strip all whitespaces - - # go through the code, have a look at all import occurrences - -@@ -146,7 +146,7 @@ class d_parser(object): - import_iterator = self.re_import.finditer(code) - if import_iterator: - for import_match in import_iterator: -- import_match_str = re.sub('\s+', '', import_match.group(1)) # strip all whitespaces -+ import_match_str = re.sub(r'\s+', '', import_match.group(1)) # strip all whitespaces - - # does this end with an import bindings declaration? - # (import bindings always terminate the list of imports) -diff --git a/third_party/waf/waflib/Tools/fc.py b/third_party/waf/waflib/Tools/fc.py -index 621eb5029df..fd4d39c90ae 100644 ---- a/third_party/waf/waflib/Tools/fc.py -+++ b/third_party/waf/waflib/Tools/fc.py -@@ -28,10 +28,24 @@ def modfile(conf, name): - Turns a module name into the right module file name. - Defaults to all lower case. - """ -- return {'lower' :name.lower() + '.mod', -- 'lower.MOD' :name.lower() + '.MOD', -- 'UPPER.mod' :name.upper() + '.mod', -- 'UPPER' :name.upper() + '.MOD'}[conf.env.FC_MOD_CAPITALIZATION or 'lower'] -+ if name.find(':') >= 0: -+ # Depending on a submodule! -+ separator = conf.env.FC_SUBMOD_SEPARATOR or '@' -+ # Ancestors of the submodule will be prefixed to the -+ # submodule name, separated by a colon. -+ modpath = name.split(':') -+ # Only the ancestor (actual) module and the submodule name -+ # will be used for the filename. -+ modname = modpath[0] + separator + modpath[-1] -+ suffix = conf.env.FC_SUBMOD_SUFFIX or '.smod' -+ else: -+ modname = name -+ suffix = '.mod' -+ -+ return {'lower' :modname.lower() + suffix.lower(), -+ 'lower.MOD' :modname.lower() + suffix.upper(), -+ 'UPPER.mod' :modname.upper() + suffix.lower(), -+ 'UPPER' :modname.upper() + suffix.upper()}[conf.env.FC_MOD_CAPITALIZATION or 'lower'] - - def get_fortran_tasks(tsk): - """ -@@ -121,6 +135,8 @@ class fc(Task.Task): - for k in ins.keys(): - for a in ins[k]: - a.run_after.update(outs[k]) -+ for x in outs[k]: -+ self.generator.bld.producer.revdeps[x].add(a) - - # the scanner cannot output nodes, so we have to set them - # ourselves as task.dep_nodes (additional input nodes) -diff --git a/third_party/waf/waflib/Tools/fc_config.py b/third_party/waf/waflib/Tools/fc_config.py -index 0df460b5d1e..dc5e5c9e9a2 100644 ---- a/third_party/waf/waflib/Tools/fc_config.py -+++ b/third_party/waf/waflib/Tools/fc_config.py -@@ -178,8 +178,8 @@ def check_fortran_dummy_main(self, *k, **kw): - # ------------------------------------------------------------------------ - - GCC_DRIVER_LINE = re.compile('^Driving:') --POSIX_STATIC_EXT = re.compile('\S+\.a') --POSIX_LIB_FLAGS = re.compile('-l\S+') -+POSIX_STATIC_EXT = re.compile(r'\S+\.a') -+POSIX_LIB_FLAGS = re.compile(r'-l\S+') - - @conf - def is_link_verbose(self, txt): -@@ -281,7 +281,7 @@ def _parse_flink_token(lexer, token, tmp_flags): - elif POSIX_LIB_FLAGS.match(token): - tmp_flags.append(token) - else: -- # ignore anything not explicitely taken into account -+ # ignore anything not explicitly taken into account - pass - - t = lexer.get_token() -diff --git a/third_party/waf/waflib/Tools/fc_scan.py b/third_party/waf/waflib/Tools/fc_scan.py -index 12cb0fc041e..0824c92b7ee 100644 ---- a/third_party/waf/waflib/Tools/fc_scan.py -+++ b/third_party/waf/waflib/Tools/fc_scan.py -@@ -5,13 +5,15 @@ - - import re - --INC_REGEX = """(?:^|['">]\s*;)\s*(?:|#\s*)INCLUDE\s+(?:\w+_)?[<"'](.+?)(?=["'>])""" --USE_REGEX = """(?:^|;)\s*USE(?:\s+|(?:(?:\s*,\s*(?:NON_)?INTRINSIC)?\s*::))\s*(\w+)""" --MOD_REGEX = """(?:^|;)\s*MODULE(?!\s*PROCEDURE)(?:\s+|(?:(?:\s*,\s*(?:NON_)?INTRINSIC)?\s*::))\s*(\w+)""" -+INC_REGEX = r"""(?:^|['">]\s*;)\s*(?:|#\s*)INCLUDE\s+(?:\w+_)?[<"'](.+?)(?=["'>])""" -+USE_REGEX = r"""(?:^|;)\s*USE(?:\s+|(?:(?:\s*,\s*(?:NON_)?INTRINSIC)?\s*::))\s*(\w+)""" -+MOD_REGEX = r"""(?:^|;)\s*MODULE(?!\s+(?:PROCEDURE|SUBROUTINE|FUNCTION))\s+(\w+)""" -+SMD_REGEX = r"""(?:^|;)\s*SUBMODULE\s*\(([\w:]+)\)\s*(\w+)""" - - re_inc = re.compile(INC_REGEX, re.I) - re_use = re.compile(USE_REGEX, re.I) - re_mod = re.compile(MOD_REGEX, re.I) -+re_smd = re.compile(SMD_REGEX, re.I) - - class fortran_parser(object): - """ -@@ -58,6 +60,10 @@ class fortran_parser(object): - m = re_mod.search(line) - if m: - mods.append(m.group(1)) -+ m = re_smd.search(line) -+ if m: -+ uses.append(m.group(1)) -+ mods.append('{0}:{1}'.format(m.group(1),m.group(2))) - return (incs, uses, mods) - - def start(self, node): -diff --git a/third_party/waf/waflib/Tools/ifort.py b/third_party/waf/waflib/Tools/ifort.py -index 74934f3f661..17d3052910f 100644 ---- a/third_party/waf/waflib/Tools/ifort.py -+++ b/third_party/waf/waflib/Tools/ifort.py -@@ -107,7 +107,7 @@ def gather_ifort_versions(conf, versions): - """ - List compiler versions by looking up registry keys - """ -- version_pattern = re.compile('^...?.?\....?.?') -+ version_pattern = re.compile(r'^...?.?\....?.?') - try: - all_versions = Utils.winreg.OpenKey(Utils.winreg.HKEY_LOCAL_MACHINE, 'SOFTWARE\\Wow6432node\\Intel\\Compilers\\Fortran') - except OSError: -diff --git a/third_party/waf/waflib/Tools/javaw.py b/third_party/waf/waflib/Tools/javaw.py -index f6fd20cc689..fd1cf469abf 100644 ---- a/third_party/waf/waflib/Tools/javaw.py -+++ b/third_party/waf/waflib/Tools/javaw.py -@@ -24,12 +24,95 @@ You would have to run:: - java -jar /path/to/jython.jar waf configure - - [1] http://www.jython.org/ -+ -+Usage -+===== -+ -+Load the "java" tool. -+ -+def configure(conf): -+ conf.load('java') -+ -+Java tools will be autodetected and eventually, if present, the quite -+standard JAVA_HOME environment variable will be used. The also standard -+CLASSPATH variable is used for library searching. -+ -+In configuration phase checks can be done on the system environment, for -+example to check if a class is known in the classpath:: -+ -+ conf.check_java_class('java.io.FileOutputStream') -+ -+or if the system supports JNI applications building:: -+ -+ conf.check_jni_headers() -+ -+ -+The java tool supports compiling java code, creating jar files and -+creating javadoc documentation. This can be either done separately or -+together in a single definition. For example to manage them separately:: -+ -+ bld(features = 'javac', -+ srcdir = 'src', -+ compat = '1.7', -+ use = 'animals', -+ name = 'cats-src', -+ ) -+ -+ bld(features = 'jar', -+ basedir = '.', -+ destfile = '../cats.jar', -+ name = 'cats', -+ use = 'cats-src' -+ ) -+ -+ -+Or together by defining all the needed attributes:: -+ -+ bld(features = 'javac jar javadoc', -+ srcdir = 'src/', # folder containing the sources to compile -+ outdir = 'src', # folder where to output the classes (in the build directory) -+ compat = '1.6', # java compatibility version number -+ classpath = ['.', '..'], -+ -+ # jar -+ basedir = 'src', # folder containing the classes and other files to package (must match outdir) -+ destfile = 'foo.jar', # do not put the destfile in the folder of the java classes! -+ use = 'NNN', -+ jaropts = ['-C', 'default/src/', '.'], # can be used to give files -+ manifest = 'src/Manifest.mf', # Manifest file to include -+ -+ # javadoc -+ javadoc_package = ['com.meow' , 'com.meow.truc.bar', 'com.meow.truc.foo'], -+ javadoc_output = 'javadoc', -+ ) -+ -+External jar dependencies can be mapped to a standard waf "use" dependency by -+setting an environment variable with a CLASSPATH prefix in the configuration, -+for example:: -+ -+ conf.env.CLASSPATH_NNN = ['aaaa.jar', 'bbbb.jar'] -+ -+and then NNN can be freely used in rules as:: -+ -+ use = 'NNN', -+ -+In the java tool the dependencies via use are not transitive by default, as -+this necessity depends on the code. To enable recursive dependency scanning -+use on a specific rule: -+ -+ recurse_use = True -+ -+Or build-wise by setting RECURSE_JAVA: -+ -+ bld.env.RECURSE_JAVA = True -+ -+Unit tests can be integrated in the waf unit test environment using the javatest extra. - """ - - import os, shutil - from waflib import Task, Utils, Errors, Node - from waflib.Configure import conf --from waflib.TaskGen import feature, before_method, after_method -+from waflib.TaskGen import feature, before_method, after_method, taskgen_method - - from waflib.Tools import ccroot - ccroot.USELIB_VARS['javac'] = set(['CLASSPATH', 'JAVACFLAGS']) -@@ -107,6 +190,37 @@ def apply_java(self): - if names: - tsk.env.append_value('JAVACFLAGS', ['-sourcepath', names]) - -+ -+@taskgen_method -+def java_use_rec(self, name, **kw): -+ """ -+ Processes recursively the *use* attribute for each referred java compilation -+ """ -+ if name in self.tmp_use_seen: -+ return -+ -+ self.tmp_use_seen.append(name) -+ -+ try: -+ y = self.bld.get_tgen_by_name(name) -+ except Errors.WafError: -+ self.uselib.append(name) -+ return -+ else: -+ y.post() -+ # Add generated JAR name for CLASSPATH. Task ordering (set_run_after) -+ # is already guaranteed by ordering done between the single tasks -+ if hasattr(y, 'jar_task'): -+ self.use_lst.append(y.jar_task.outputs[0].abspath()) -+ else: -+ if hasattr(y,'outdir'): -+ self.use_lst.append(y.outdir.abspath()) -+ else: -+ self.use_lst.append(y.path.get_bld().abspath()) -+ -+ for x in self.to_list(getattr(y, 'use', [])): -+ self.java_use_rec(x) -+ - @feature('javac') - @before_method('propagate_uselib_vars') - @after_method('apply_java') -@@ -114,24 +228,39 @@ def use_javac_files(self): - """ - Processes the *use* attribute referring to other java compilations - """ -- lst = [] -+ self.use_lst = [] -+ self.tmp_use_seen = [] - self.uselib = self.to_list(getattr(self, 'uselib', [])) - names = self.to_list(getattr(self, 'use', [])) - get = self.bld.get_tgen_by_name - for x in names: - try: -- y = get(x) -+ tg = get(x) - except Errors.WafError: - self.uselib.append(x) - else: -- y.post() -- if hasattr(y, 'jar_task'): -- lst.append(y.jar_task.outputs[0].abspath()) -- self.javac_task.set_run_after(y.jar_task) -+ tg.post() -+ if hasattr(tg, 'jar_task'): -+ self.use_lst.append(tg.jar_task.outputs[0].abspath()) -+ self.javac_task.set_run_after(tg.jar_task) -+ self.javac_task.dep_nodes.extend(tg.jar_task.outputs) - else: -- for tsk in y.tasks: -+ if hasattr(tg, 'outdir'): -+ base_node = tg.outdir.abspath() -+ else: -+ base_node = tg.path.get_bld() -+ -+ self.use_lst.append(base_node.abspath()) -+ self.javac_task.dep_nodes.extend([x for x in base_node.ant_glob(JAR_RE, remove=False, quiet=True)]) -+ -+ for tsk in tg.tasks: - self.javac_task.set_run_after(tsk) -- self.env.append_value('CLASSPATH', lst) -+ -+ # If recurse use scan is enabled recursively add use attribute for each used one -+ if getattr(self, 'recurse_use', False) or self.bld.env.RECURSE_JAVA: -+ self.java_use_rec(x) -+ -+ self.env.append_value('CLASSPATH', self.use_lst) - - @feature('javac') - @after_method('apply_java', 'propagate_uselib_vars', 'use_javac_files') -@@ -245,7 +374,7 @@ class jar_create(JTask): - return Task.ASK_LATER - if not self.inputs: - try: -- self.inputs = [x for x in self.basedir.ant_glob(JAR_RE, remove=False) if id(x) != id(self.outputs[0])] -+ self.inputs = [x for x in self.basedir.ant_glob(JAR_RE, remove=False, quiet=True) if id(x) != id(self.outputs[0])] - except Exception: - raise Errors.WafError('Could not find the basedir %r for %r' % (self.basedir, self)) - return super(jar_create, self).runnable_status() -@@ -279,14 +408,14 @@ class javac(JTask): - self.inputs = [] - for x in self.srcdir: - if x.exists(): -- self.inputs.extend(x.ant_glob(SOURCE_RE, remove=False)) -+ self.inputs.extend(x.ant_glob(SOURCE_RE, remove=False, quiet=True)) - return super(javac, self).runnable_status() - - def post_run(self): - """ - List class files created - """ -- for node in self.generator.outdir.ant_glob('**/*.class'): -+ for node in self.generator.outdir.ant_glob('**/*.class', quiet=True): - self.generator.bld.node_sigs[node] = self.uid() - self.generator.bld.task_sigs[self.uid()] = self.cache_sig - -@@ -338,7 +467,7 @@ class javadoc(Task.Task): - self.generator.bld.cmd_and_log(lst, cwd=wd, env=env.env or None, quiet=0) - - def post_run(self): -- nodes = self.generator.javadoc_output.ant_glob('**') -+ nodes = self.generator.javadoc_output.ant_glob('**', quiet=True) - for node in nodes: - self.generator.bld.node_sigs[node] = self.uid() - self.generator.bld.task_sigs[self.uid()] = self.cache_sig -@@ -356,7 +485,7 @@ def configure(self): - self.env.JAVA_HOME = [self.environ['JAVA_HOME']] - - for x in 'javac java jar javadoc'.split(): -- self.find_program(x, var=x.upper(), path_list=java_path) -+ self.find_program(x, var=x.upper(), path_list=java_path, mandatory=(x not in ('javadoc'))) - - if 'CLASSPATH' in self.environ: - v.CLASSPATH = self.environ['CLASSPATH'] -diff --git a/third_party/waf/waflib/Tools/md5_tstamp.py b/third_party/waf/waflib/Tools/md5_tstamp.py -index 6428e46024e..d1569fa9ec1 100644 ---- a/third_party/waf/waflib/Tools/md5_tstamp.py -+++ b/third_party/waf/waflib/Tools/md5_tstamp.py -@@ -2,8 +2,10 @@ - # encoding: utf-8 - - """ --Re-calculate md5 hashes of files only when the file times or the file --size have changed. -+Re-calculate md5 hashes of files only when the file time have changed:: -+ -+ def options(opt): -+ opt.load('md5_tstamp') - - The hashes can also reflect either the file contents (STRONGEST=True) or the - file time and file size. -diff --git a/third_party/waf/waflib/Tools/msvc.py b/third_party/waf/waflib/Tools/msvc.py -index 17b347d4583..f169c7f441b 100644 ---- a/third_party/waf/waflib/Tools/msvc.py -+++ b/third_party/waf/waflib/Tools/msvc.py -@@ -281,7 +281,7 @@ def gather_wince_supported_platforms(): - - def gather_msvc_detected_versions(): - #Detected MSVC versions! -- version_pattern = re.compile('^(\d\d?\.\d\d?)(Exp)?$') -+ version_pattern = re.compile(r'^(\d\d?\.\d\d?)(Exp)?$') - detected_versions = [] - for vcver,vcvar in (('VCExpress','Exp'), ('VisualStudio','')): - prefix = 'SOFTWARE\\Wow6432node\\Microsoft\\' + vcver -@@ -367,7 +367,7 @@ def gather_wsdk_versions(conf, versions): - :param versions: list to modify - :type versions: list - """ -- version_pattern = re.compile('^v..?.?\...?.?') -+ version_pattern = re.compile(r'^v..?.?\...?.?') - try: - all_versions = Utils.winreg.OpenKey(Utils.winreg.HKEY_LOCAL_MACHINE, 'SOFTWARE\\Wow6432node\\Microsoft\\Microsoft SDKs\\Windows') - except OSError: -@@ -525,7 +525,7 @@ def gather_icl_versions(conf, versions): - :param versions: list to modify - :type versions: list - """ -- version_pattern = re.compile('^...?.?\....?.?') -+ version_pattern = re.compile(r'^...?.?\....?.?') - try: - all_versions = Utils.winreg.OpenKey(Utils.winreg.HKEY_LOCAL_MACHINE, 'SOFTWARE\\Wow6432node\\Intel\\Compilers\\C++') - except OSError: -@@ -579,7 +579,7 @@ def gather_intel_composer_versions(conf, versions): - :param versions: list to modify - :type versions: list - """ -- version_pattern = re.compile('^...?.?\...?.?.?') -+ version_pattern = re.compile(r'^...?.?\...?.?.?') - try: - all_versions = Utils.winreg.OpenKey(Utils.winreg.HKEY_LOCAL_MACHINE, 'SOFTWARE\\Wow6432node\\Intel\\Suites') - except OSError: -@@ -683,7 +683,7 @@ def find_lt_names_msvc(self, libname, is_static=False): - if not is_static and ltdict.get('library_names', ''): - dllnames=ltdict['library_names'].split() - dll=dllnames[0].lower() -- dll=re.sub('\.dll$', '', dll) -+ dll=re.sub(r'\.dll$', '', dll) - return (lt_libdir, dll, False) - elif ltdict.get('old_library', ''): - olib=ltdict['old_library'] -@@ -700,7 +700,7 @@ def find_lt_names_msvc(self, libname, is_static=False): - @conf - def libname_msvc(self, libname, is_static=False): - lib = libname.lower() -- lib = re.sub('\.lib$','',lib) -+ lib = re.sub(r'\.lib$','',lib) - - if lib in g_msvc_systemlibs: - return lib -@@ -747,11 +747,11 @@ def libname_msvc(self, libname, is_static=False): - for libn in libnames: - if os.path.exists(os.path.join(path, libn)): - Logs.debug('msvc: lib found: %s', os.path.join(path,libn)) -- return re.sub('\.lib$', '',libn) -+ return re.sub(r'\.lib$', '',libn) - - #if no lib can be found, just return the libname as msvc expects it - self.fatal('The library %r could not be found' % libname) -- return re.sub('\.lib$', '', libname) -+ return re.sub(r'\.lib$', '', libname) - - @conf - def check_lib_msvc(self, libname, is_static=False, uselib_store=None): -@@ -969,7 +969,7 @@ def apply_flags_msvc(self): - if not is_static: - for f in self.env.LINKFLAGS: - d = f.lower() -- if d[1:] == 'debug': -+ if d[1:] in ('debug', 'debug:full', 'debug:fastlink'): - pdbnode = self.link_task.outputs[0].change_ext('.pdb') - self.link_task.outputs.append(pdbnode) - -diff --git a/third_party/waf/waflib/Tools/python.py b/third_party/waf/waflib/Tools/python.py -index 52a05c668e3..63a8917d7c1 100644 ---- a/third_party/waf/waflib/Tools/python.py -+++ b/third_party/waf/waflib/Tools/python.py -@@ -329,6 +329,10 @@ def check_python_headers(conf, features='pyembed pyext'): - conf.find_program([''.join(pybin) + '-config', 'python%s-config' % num, 'python-config-%s' % num, 'python%sm-config' % num], var='PYTHON_CONFIG', msg="python-config", mandatory=False) - - if env.PYTHON_CONFIG: -+ # check python-config output only once -+ if conf.env.HAVE_PYTHON_H: -+ return -+ - # python2.6-config requires 3 runs - all_flags = [['--cflags', '--libs', '--ldflags']] - if sys.hexversion < 0x2070000: -@@ -338,7 +342,13 @@ def check_python_headers(conf, features='pyembed pyext'): - - if 'pyembed' in features: - for flags in all_flags: -- conf.check_cfg(msg='Asking python-config for pyembed %r flags' % ' '.join(flags), path=env.PYTHON_CONFIG, package='', uselib_store='PYEMBED', args=flags) -+ # Python 3.8 has different flags for pyembed, needs --embed -+ embedflags = flags + ['--embed'] -+ try: -+ conf.check_cfg(msg='Asking python-config for pyembed %r flags' % ' '.join(embedflags), path=env.PYTHON_CONFIG, package='', uselib_store='PYEMBED', args=embedflags) -+ except conf.errors.ConfigurationError: -+ # However Python < 3.8 doesn't accept --embed, so we need a fallback -+ conf.check_cfg(msg='Asking python-config for pyembed %r flags' % ' '.join(flags), path=env.PYTHON_CONFIG, package='', uselib_store='PYEMBED', args=flags) - - try: - conf.test_pyembed(xx) -@@ -446,9 +456,9 @@ def check_python_version(conf, minver=None): - Check if the python interpreter is found matching a given minimum version. - minver should be a tuple, eg. to check for python >= 2.4.2 pass (2,4,2) as minver. - -- If successful, PYTHON_VERSION is defined as 'MAJOR.MINOR' -- (eg. '2.4') of the actual python version found, and PYTHONDIR is -- defined, pointing to the site-packages directory appropriate for -+ If successful, PYTHON_VERSION is defined as 'MAJOR.MINOR' (eg. '2.4') -+ of the actual python version found, and PYTHONDIR and PYTHONARCHDIR -+ are defined, pointing to the site-packages directories appropriate for - this python version, where modules/packages/extensions should be - installed. - -diff --git a/third_party/waf/waflib/Tools/qt5.py b/third_party/waf/waflib/Tools/qt5.py -index 4f9c6908fc5..287c25374a4 100644 ---- a/third_party/waf/waflib/Tools/qt5.py -+++ b/third_party/waf/waflib/Tools/qt5.py -@@ -74,7 +74,7 @@ else: - - import os, sys, re - from waflib.Tools import cxx --from waflib import Task, Utils, Options, Errors, Context -+from waflib import Build, Task, Utils, Options, Errors, Context - from waflib.TaskGen import feature, after_method, extension, before_method - from waflib.Configure import conf - from waflib import Logs -@@ -167,6 +167,10 @@ class qxx(Task.classes['cxx']): - node = self.inputs[0] - bld = self.generator.bld - -+ # skip on uninstall due to generated files -+ if bld.is_install == Build.UNINSTALL: -+ return -+ - try: - # compute the signature once to know if there is a moc file to create - self.signature() -@@ -313,11 +317,11 @@ def apply_qt5(self): - - The additional parameters are: - -- :param lang: list of translation files (\*.ts) to process -+ :param lang: list of translation files (\\*.ts) to process - :type lang: list of :py:class:`waflib.Node.Node` or string without the .ts extension -- :param update: whether to process the C++ files to update the \*.ts files (use **waf --translate**) -+ :param update: whether to process the C++ files to update the \\*.ts files (use **waf --translate**) - :type update: bool -- :param langname: if given, transform the \*.ts files into a .qrc files to include in the binary file -+ :param langname: if given, transform the \\*.ts files into a .qrc files to include in the binary file - :type langname: :py:class:`waflib.Node.Node` or string without the .qrc extension - """ - if getattr(self, 'lang', None): -@@ -762,7 +766,7 @@ def set_qt5_libs_to_check(self): - if self.environ.get('QT5_FORCE_STATIC'): - pat = self.env.cxxstlib_PATTERN - if Utils.unversioned_sys_platform() == 'darwin': -- pat = "%s\.framework" -+ pat = r"%s\.framework" - re_qt = re.compile(pat%'Qt5?(?P.*)'+'$') - for x in dirlst: - m = re_qt.match(x) -diff --git a/third_party/waf/waflib/Tools/waf_unit_test.py b/third_party/waf/waflib/Tools/waf_unit_test.py -index a71ed1c0909..6ff6f72739f 100644 ---- a/third_party/waf/waflib/Tools/waf_unit_test.py -+++ b/third_party/waf/waflib/Tools/waf_unit_test.py -@@ -205,7 +205,7 @@ class utest(Task.Task): - return self.exec_command(self.ut_exec) - - def exec_command(self, cmd, **kw): -- Logs.debug('runner: %r', cmd) -+ self.generator.bld.log_command(cmd, kw) - if getattr(Options.options, 'dump_test_scripts', False): - script_code = SCRIPT_TEMPLATE % { - 'python': sys.executable, -@@ -214,7 +214,7 @@ class utest(Task.Task): - 'cmd': cmd - } - script_file = self.inputs[0].abspath() + '_run.py' -- Utils.writef(script_file, script_code) -+ Utils.writef(script_file, script_code, encoding='utf-8') - os.chmod(script_file, Utils.O755) - if Logs.verbose > 1: - Logs.info('Test debug file written as %r' % script_file) -diff --git a/third_party/waf/waflib/Tools/winres.py b/third_party/waf/waflib/Tools/winres.py -index 586c596cf93..9be1ed66009 100644 ---- a/third_party/waf/waflib/Tools/winres.py -+++ b/third_party/waf/waflib/Tools/winres.py -@@ -24,8 +24,8 @@ def rc_file(self, node): - self.compiled_tasks = [rctask] - - re_lines = re.compile( -- '(?:^[ \t]*(#|%:)[ \t]*(ifdef|ifndef|if|else|elif|endif|include|import|define|undef|pragma)[ \t]*(.*?)\s*$)|'\ -- '(?:^\w+[ \t]*(ICON|BITMAP|CURSOR|HTML|FONT|MESSAGETABLE|TYPELIB|REGISTRY|D3DFX)[ \t]*(.*?)\s*$)', -+ r'(?:^[ \t]*(#|%:)[ \t]*(ifdef|ifndef|if|else|elif|endif|include|import|define|undef|pragma)[ \t]*(.*?)\s*$)|'\ -+ r'(?:^\w+[ \t]*(ICON|BITMAP|CURSOR|HTML|FONT|MESSAGETABLE|TYPELIB|REGISTRY|D3DFX)[ \t]*(.*?)\s*$)', - re.IGNORECASE | re.MULTILINE) - - class rc_parser(c_preproc.c_parser): -diff --git a/third_party/waf/waflib/Utils.py b/third_party/waf/waflib/Utils.py -index b4665c4dc2b..7472226da58 100644 ---- a/third_party/waf/waflib/Utils.py -+++ b/third_party/waf/waflib/Utils.py -@@ -49,10 +49,16 @@ try: - from hashlib import md5 - except ImportError: - try: -- from md5 import md5 -+ from hashlib import sha1 as md5 - except ImportError: -- # never fail to enable fixes from another module -+ # never fail to enable potential fixes from another module - pass -+else: -+ try: -+ md5().digest() -+ except ValueError: -+ # Fips? #2213 -+ from hashlib import sha1 as md5 - - try: - import threading -@@ -202,7 +208,7 @@ class lazy_generator(object): - - next = __next__ - --is_win32 = os.sep == '\\' or sys.platform == 'win32' # msys2 -+is_win32 = os.sep == '\\' or sys.platform == 'win32' or os.name == 'nt' # msys2 - """ - Whether this system is a Windows series - """ -@@ -484,7 +490,9 @@ def split_path_msys(path): - if sys.platform == 'cygwin': - split_path = split_path_cygwin - elif is_win32: -- if os.environ.get('MSYSTEM'): -+ # Consider this an MSYSTEM environment if $MSYSTEM is set and python -+ # reports is executable from a unix like path on a windows host. -+ if os.environ.get('MSYSTEM') and sys.executable.startswith('/'): - split_path = split_path_msys - else: - split_path = split_path_win32 -@@ -596,6 +604,12 @@ def h_list(lst): - """ - return md5(repr(lst).encode()).digest() - -+if sys.hexversion < 0x3000000: -+ def h_list_python2(lst): -+ return md5(repr(lst)).digest() -+ h_list_python2.__doc__ = h_list.__doc__ -+ h_list = h_list_python2 -+ - def h_fun(fun): - """ - Hash functions -@@ -730,7 +744,7 @@ def unversioned_sys_platform(): - if s == 'cli' and os.name == 'nt': - # ironpython is only on windows as far as we know - return 'win32' -- return re.split('\d+$', s)[0] -+ return re.split(r'\d+$', s)[0] - - def nada(*k, **kw): - """ -@@ -871,7 +885,7 @@ def get_process(): - except IndexError: - filepath = os.path.dirname(os.path.abspath(__file__)) + os.sep + 'processor.py' - cmd = [sys.executable, '-c', readf(filepath)] -- return subprocess.Popen(cmd, stdout=subprocess.PIPE, stdin=subprocess.PIPE, bufsize=0) -+ return subprocess.Popen(cmd, stdout=subprocess.PIPE, stdin=subprocess.PIPE, bufsize=0, close_fds=not is_win32) - - def run_prefork_process(cmd, kwargs, cargs): - """ -diff --git a/third_party/waf/waflib/ansiterm.py b/third_party/waf/waflib/ansiterm.py -index 0d20c6374b7..027f0ad68a3 100644 ---- a/third_party/waf/waflib/ansiterm.py -+++ b/third_party/waf/waflib/ansiterm.py -@@ -264,7 +264,7 @@ else: - 'u': pop_cursor, - } - # Match either the escape sequence or text not containing escape sequence -- ansi_tokens = re.compile('(?:\x1b\[([0-9?;]*)([a-zA-Z])|([^\x1b]+))') -+ ansi_tokens = re.compile(r'(?:\x1b\[([0-9?;]*)([a-zA-Z])|([^\x1b]+))') - def write(self, text): - try: - wlock.acquire() -diff --git a/third_party/waf/waflib/extras/buildcopy.py b/third_party/waf/waflib/extras/buildcopy.py -index a6d9ac83114..eaff7e605a6 100644 ---- a/third_party/waf/waflib/extras/buildcopy.py -+++ b/third_party/waf/waflib/extras/buildcopy.py -@@ -22,7 +22,7 @@ Examples:: - - """ - import os, shutil --from waflib import Errors, Task, TaskGen, Utils, Node -+from waflib import Errors, Task, TaskGen, Utils, Node, Logs - - @TaskGen.before_method('process_source') - @TaskGen.feature('buildcopy') -@@ -58,10 +58,13 @@ def make_buildcopy(self): - raise Errors.WafError('buildcopy: File not found in src: %s'%os.path.join(*lst)) - - nodes = [ to_src_nodes(n) for n in getattr(self, 'buildcopy_source', getattr(self, 'source', [])) ] -+ if not nodes: -+ Logs.warn('buildcopy: No source files provided to buildcopy in %s (set `buildcopy_source` or `source`)', -+ self) -+ return - node_pairs = [(n, n.get_bld()) for n in nodes] - self.create_task('buildcopy', [n[0] for n in node_pairs], [n[1] for n in node_pairs], node_pairs=node_pairs) - -- - class buildcopy(Task.Task): - """ - Copy for each pair `n` in `node_pairs`: n[0] -> n[1]. -diff --git a/third_party/waf/waflib/extras/clang_cross.py b/third_party/waf/waflib/extras/clang_cross.py -new file mode 100644 -index 00000000000..1b51e2886cb ---- /dev/null -+++ b/third_party/waf/waflib/extras/clang_cross.py -@@ -0,0 +1,92 @@ -+#!/usr/bin/env python -+# encoding: utf-8 -+# Krzysztof Kosiński 2014 -+# DragoonX6 2018 -+ -+""" -+Detect the Clang C compiler -+This version is an attempt at supporting the -target and -sysroot flag of Clang. -+""" -+ -+from waflib.Tools import ccroot, ar, gcc -+from waflib.Configure import conf -+import waflib.Context -+import waflib.extras.clang_cross_common -+ -+def options(opt): -+ """ -+ Target triplet for clang:: -+ $ waf configure --clang-target-triple=x86_64-pc-linux-gnu -+ """ -+ cc_compiler_opts = opt.add_option_group('Configuration options') -+ cc_compiler_opts.add_option('--clang-target-triple', default=None, -+ help='Target triple for clang', -+ dest='clang_target_triple') -+ cc_compiler_opts.add_option('--clang-sysroot', default=None, -+ help='Sysroot for clang', -+ dest='clang_sysroot') -+ -+@conf -+def find_clang(conf): -+ """ -+ Finds the program clang and executes it to ensure it really is clang -+ """ -+ -+ import os -+ -+ cc = conf.find_program('clang', var='CC') -+ -+ if conf.options.clang_target_triple != None: -+ conf.env.append_value('CC', ['-target', conf.options.clang_target_triple]) -+ -+ if conf.options.clang_sysroot != None: -+ sysroot = str() -+ -+ if os.path.isabs(conf.options.clang_sysroot): -+ sysroot = conf.options.clang_sysroot -+ else: -+ sysroot = os.path.normpath(os.path.join(os.getcwd(), conf.options.clang_sysroot)) -+ -+ conf.env.append_value('CC', ['--sysroot', sysroot]) -+ -+ conf.get_cc_version(cc, clang=True) -+ conf.env.CC_NAME = 'clang' -+ -+@conf -+def clang_modifier_x86_64_w64_mingw32(conf): -+ conf.gcc_modifier_win32() -+ -+@conf -+def clang_modifier_i386_w64_mingw32(conf): -+ conf.gcc_modifier_win32() -+ -+@conf -+def clang_modifier_x86_64_windows_msvc(conf): -+ conf.clang_modifier_msvc() -+ -+ # Allow the user to override any flags if they so desire. -+ clang_modifier_user_func = getattr(conf, 'clang_modifier_x86_64_windows_msvc_user', None) -+ if clang_modifier_user_func: -+ clang_modifier_user_func() -+ -+@conf -+def clang_modifier_i386_windows_msvc(conf): -+ conf.clang_modifier_msvc() -+ -+ # Allow the user to override any flags if they so desire. -+ clang_modifier_user_func = getattr(conf, 'clang_modifier_i386_windows_msvc_user', None) -+ if clang_modifier_user_func: -+ clang_modifier_user_func() -+ -+def configure(conf): -+ conf.find_clang() -+ conf.find_program(['llvm-ar', 'ar'], var='AR') -+ conf.find_ar() -+ conf.gcc_common_flags() -+ # Allow the user to provide flags for the target platform. -+ conf.gcc_modifier_platform() -+ # And allow more fine grained control based on the compiler's triplet. -+ conf.clang_modifier_target_triple() -+ conf.cc_load_tools() -+ conf.cc_add_flags() -+ conf.link_add_flags() -diff --git a/third_party/waf/waflib/extras/clang_cross_common.py b/third_party/waf/waflib/extras/clang_cross_common.py -new file mode 100644 -index 00000000000..b76a070065c ---- /dev/null -+++ b/third_party/waf/waflib/extras/clang_cross_common.py -@@ -0,0 +1,113 @@ -+#!/usr/bin/env python -+# encoding: utf-8 -+# DragoonX6 2018 -+ -+""" -+Common routines for cross_clang.py and cross_clangxx.py -+""" -+ -+from waflib.Configure import conf -+import waflib.Context -+ -+def normalize_target_triple(target_triple): -+ target_triple = target_triple[:-1] -+ normalized_triple = target_triple.replace('--', '-unknown-') -+ -+ if normalized_triple.startswith('-'): -+ normalized_triple = 'unknown' + normalized_triple -+ -+ if normalized_triple.endswith('-'): -+ normalized_triple += 'unknown' -+ -+ # Normalize MinGW builds to *arch*-w64-mingw32 -+ if normalized_triple.endswith('windows-gnu'): -+ normalized_triple = normalized_triple[:normalized_triple.index('-')] + '-w64-mingw32' -+ -+ # Strip the vendor when doing msvc builds, since it's unused anyway. -+ if normalized_triple.endswith('windows-msvc'): -+ normalized_triple = normalized_triple[:normalized_triple.index('-')] + '-windows-msvc' -+ -+ return normalized_triple.replace('-', '_') -+ -+@conf -+def clang_modifier_msvc(conf): -+ import os -+ -+ """ -+ Really basic setup to use clang in msvc mode. -+ We actually don't really want to do a lot, even though clang is msvc compatible -+ in this mode, that doesn't mean we're actually using msvc. -+ It's probably the best to leave it to the user, we can assume msvc mode if the user -+ uses the clang-cl frontend, but this module only concerns itself with the gcc-like frontend. -+ """ -+ v = conf.env -+ v.cprogram_PATTERN = '%s.exe' -+ -+ v.cshlib_PATTERN = '%s.dll' -+ v.implib_PATTERN = '%s.lib' -+ v.IMPLIB_ST = '-Wl,-IMPLIB:%s' -+ v.SHLIB_MARKER = [] -+ -+ v.CFLAGS_cshlib = [] -+ v.LINKFLAGS_cshlib = ['-Wl,-DLL'] -+ v.cstlib_PATTERN = '%s.lib' -+ v.STLIB_MARKER = [] -+ -+ del(v.AR) -+ conf.find_program(['llvm-lib', 'lib'], var='AR') -+ v.ARFLAGS = ['-nologo'] -+ v.AR_TGT_F = ['-out:'] -+ -+ # Default to the linker supplied with llvm instead of link.exe or ld -+ v.LINK_CC = v.CC + ['-fuse-ld=lld', '-nostdlib'] -+ v.CCLNK_TGT_F = ['-o'] -+ v.def_PATTERN = '-Wl,-def:%s' -+ -+ v.LINKFLAGS = [] -+ -+ v.LIB_ST = '-l%s' -+ v.LIBPATH_ST = '-Wl,-LIBPATH:%s' -+ v.STLIB_ST = '-l%s' -+ v.STLIBPATH_ST = '-Wl,-LIBPATH:%s' -+ -+ CFLAGS_CRT_COMMON = [ -+ '-Xclang', '--dependent-lib=oldnames', -+ '-Xclang', '-fno-rtti-data', -+ '-D_MT' -+ ] -+ -+ v.CFLAGS_CRT_MULTITHREADED = CFLAGS_CRT_COMMON + [ -+ '-Xclang', '-flto-visibility-public-std', -+ '-Xclang', '--dependent-lib=libcmt', -+ ] -+ v.CXXFLAGS_CRT_MULTITHREADED = v.CFLAGS_CRT_MULTITHREADED -+ -+ v.CFLAGS_CRT_MULTITHREADED_DBG = CFLAGS_CRT_COMMON + [ -+ '-D_DEBUG', -+ '-Xclang', '-flto-visibility-public-std', -+ '-Xclang', '--dependent-lib=libcmtd', -+ ] -+ v.CXXFLAGS_CRT_MULTITHREADED_DBG = v.CFLAGS_CRT_MULTITHREADED_DBG -+ -+ v.CFLAGS_CRT_MULTITHREADED_DLL = CFLAGS_CRT_COMMON + [ -+ '-D_DLL', -+ '-Xclang', '--dependent-lib=msvcrt' -+ ] -+ v.CXXFLAGS_CRT_MULTITHREADED_DLL = v.CFLAGS_CRT_MULTITHREADED_DLL -+ -+ v.CFLAGS_CRT_MULTITHREADED_DLL_DBG = CFLAGS_CRT_COMMON + [ -+ '-D_DLL', -+ '-D_DEBUG', -+ '-Xclang', '--dependent-lib=msvcrtd', -+ ] -+ v.CXXFLAGS_CRT_MULTITHREADED_DLL_DBG = v.CFLAGS_CRT_MULTITHREADED_DLL_DBG -+ -+@conf -+def clang_modifier_target_triple(conf, cpp=False): -+ compiler = conf.env.CXX if cpp else conf.env.CC -+ output = conf.cmd_and_log(compiler + ['-dumpmachine'], output=waflib.Context.STDOUT) -+ -+ modifier = ('clangxx' if cpp else 'clang') + '_modifier_' -+ clang_modifier_func = getattr(conf, modifier + normalize_target_triple(output), None) -+ if clang_modifier_func: -+ clang_modifier_func() -diff --git a/third_party/waf/waflib/extras/clangxx_cross.py b/third_party/waf/waflib/extras/clangxx_cross.py -new file mode 100644 -index 00000000000..0ad38ad46c0 ---- /dev/null -+++ b/third_party/waf/waflib/extras/clangxx_cross.py -@@ -0,0 +1,106 @@ -+#!/usr/bin/env python -+# encoding: utf-8 -+# Thomas Nagy 2009-2018 (ita) -+# DragoonX6 2018 -+ -+""" -+Detect the Clang++ C++ compiler -+This version is an attempt at supporting the -target and -sysroot flag of Clang++. -+""" -+ -+from waflib.Tools import ccroot, ar, gxx -+from waflib.Configure import conf -+import waflib.extras.clang_cross_common -+ -+def options(opt): -+ """ -+ Target triplet for clang++:: -+ $ waf configure --clangxx-target-triple=x86_64-pc-linux-gnu -+ """ -+ cxx_compiler_opts = opt.add_option_group('Configuration options') -+ cxx_compiler_opts.add_option('--clangxx-target-triple', default=None, -+ help='Target triple for clang++', -+ dest='clangxx_target_triple') -+ cxx_compiler_opts.add_option('--clangxx-sysroot', default=None, -+ help='Sysroot for clang++', -+ dest='clangxx_sysroot') -+ -+@conf -+def find_clangxx(conf): -+ """ -+ Finds the program clang++, and executes it to ensure it really is clang++ -+ """ -+ -+ import os -+ -+ cxx = conf.find_program('clang++', var='CXX') -+ -+ if conf.options.clangxx_target_triple != None: -+ conf.env.append_value('CXX', ['-target', conf.options.clangxx_target_triple]) -+ -+ if conf.options.clangxx_sysroot != None: -+ sysroot = str() -+ -+ if os.path.isabs(conf.options.clangxx_sysroot): -+ sysroot = conf.options.clangxx_sysroot -+ else: -+ sysroot = os.path.normpath(os.path.join(os.getcwd(), conf.options.clangxx_sysroot)) -+ -+ conf.env.append_value('CXX', ['--sysroot', sysroot]) -+ -+ conf.get_cc_version(cxx, clang=True) -+ conf.env.CXX_NAME = 'clang' -+ -+@conf -+def clangxx_modifier_x86_64_w64_mingw32(conf): -+ conf.gcc_modifier_win32() -+ -+@conf -+def clangxx_modifier_i386_w64_mingw32(conf): -+ conf.gcc_modifier_win32() -+ -+@conf -+def clangxx_modifier_msvc(conf): -+ v = conf.env -+ v.cxxprogram_PATTERN = v.cprogram_PATTERN -+ v.cxxshlib_PATTERN = v.cshlib_PATTERN -+ -+ v.CXXFLAGS_cxxshlib = [] -+ v.LINKFLAGS_cxxshlib = v.LINKFLAGS_cshlib -+ v.cxxstlib_PATTERN = v.cstlib_PATTERN -+ -+ v.LINK_CXX = v.CXX + ['-fuse-ld=lld', '-nostdlib'] -+ v.CXXLNK_TGT_F = v.CCLNK_TGT_F -+ -+@conf -+def clangxx_modifier_x86_64_windows_msvc(conf): -+ conf.clang_modifier_msvc() -+ conf.clangxx_modifier_msvc() -+ -+ # Allow the user to override any flags if they so desire. -+ clang_modifier_user_func = getattr(conf, 'clangxx_modifier_x86_64_windows_msvc_user', None) -+ if clang_modifier_user_func: -+ clang_modifier_user_func() -+ -+@conf -+def clangxx_modifier_i386_windows_msvc(conf): -+ conf.clang_modifier_msvc() -+ conf.clangxx_modifier_msvc() -+ -+ # Allow the user to override any flags if they so desire. -+ clang_modifier_user_func = getattr(conf, 'clangxx_modifier_i386_windows_msvc_user', None) -+ if clang_modifier_user_func: -+ clang_modifier_user_func() -+ -+def configure(conf): -+ conf.find_clangxx() -+ conf.find_program(['llvm-ar', 'ar'], var='AR') -+ conf.find_ar() -+ conf.gxx_common_flags() -+ # Allow the user to provide flags for the target platform. -+ conf.gxx_modifier_platform() -+ # And allow more fine grained control based on the compiler's triplet. -+ conf.clang_modifier_target_triple(cpp=True) -+ conf.cxx_load_tools() -+ conf.cxx_add_flags() -+ conf.link_add_flags() -diff --git a/third_party/waf/waflib/extras/color_msvc.py b/third_party/waf/waflib/extras/color_msvc.py -new file mode 100644 -index 00000000000..60bacb7b240 ---- /dev/null -+++ b/third_party/waf/waflib/extras/color_msvc.py -@@ -0,0 +1,59 @@ -+#!/usr/bin/env python -+# encoding: utf-8 -+ -+# Replaces the default formatter by one which understands MSVC output and colorizes it. -+# Modified from color_gcc.py -+ -+__author__ = __maintainer__ = "Alibek Omarov " -+__copyright__ = "Alibek Omarov, 2019" -+ -+import sys -+from waflib import Logs -+ -+class ColorMSVCFormatter(Logs.formatter): -+ def __init__(self, colors): -+ self.colors = colors -+ Logs.formatter.__init__(self) -+ -+ def parseMessage(self, line, color): -+ # Split messaage from 'disk:filepath: type: message' -+ arr = line.split(':', 3) -+ if len(arr) < 4: -+ return line -+ -+ colored = self.colors.BOLD + arr[0] + ':' + arr[1] + ':' + self.colors.NORMAL -+ colored += color + arr[2] + ':' + self.colors.NORMAL -+ colored += arr[3] -+ return colored -+ -+ def format(self, rec): -+ frame = sys._getframe() -+ while frame: -+ func = frame.f_code.co_name -+ if func == 'exec_command': -+ cmd = frame.f_locals.get('cmd') -+ if isinstance(cmd, list): -+ # Fix file case, it may be CL.EXE or cl.exe -+ argv0 = cmd[0].lower() -+ if 'cl.exe' in argv0: -+ lines = [] -+ # This will not work with "localized" versions -+ # of MSVC -+ for line in rec.msg.splitlines(): -+ if ': warning ' in line: -+ lines.append(self.parseMessage(line, self.colors.YELLOW)) -+ elif ': error ' in line: -+ lines.append(self.parseMessage(line, self.colors.RED)) -+ elif ': fatal error ' in line: -+ lines.append(self.parseMessage(line, self.colors.RED + self.colors.BOLD)) -+ elif ': note: ' in line: -+ lines.append(self.parseMessage(line, self.colors.CYAN)) -+ else: -+ lines.append(line) -+ rec.msg = "\n".join(lines) -+ frame = frame.f_back -+ return Logs.formatter.format(self, rec) -+ -+def options(opt): -+ Logs.log.handlers[0].setFormatter(ColorMSVCFormatter(Logs.colors)) -+ -diff --git a/third_party/waf/waflib/extras/cppcheck.py b/third_party/waf/waflib/extras/cppcheck.py -index 43dc544df73..13ff42477fd 100644 ---- a/third_party/waf/waflib/extras/cppcheck.py -+++ b/third_party/waf/waflib/extras/cppcheck.py -@@ -205,11 +205,17 @@ def _tgen_create_cmd(self): - args.append('--enable=%s' % lib_enable) - - for src in self.to_list(getattr(self, 'source', [])): -- args.append('%r' % src) -+ if not isinstance(src, str): -+ src = repr(src) -+ args.append(src) - for inc in self.to_incnodes(self.to_list(getattr(self, 'includes', []))): -- args.append('-I%r' % inc) -+ if not isinstance(inc, str): -+ inc = repr(inc) -+ args.append('-I%s' % inc) - for inc in self.to_incnodes(self.to_list(self.env.INCLUDES)): -- args.append('-I%r' % inc) -+ if not isinstance(inc, str): -+ inc = repr(inc) -+ args.append('-I%s' % inc) - return cmd + args - - -diff --git a/third_party/waf/waflib/extras/cpplint.py b/third_party/waf/waflib/extras/cpplint.py -index fc914c2450b..8cdd6ddacb3 100644 ---- a/third_party/waf/waflib/extras/cpplint.py -+++ b/third_party/waf/waflib/extras/cpplint.py -@@ -38,26 +38,25 @@ When using this tool, the wscript will look like: - from __future__ import absolute_import - import sys, re - import logging --import threading --from waflib import Task, TaskGen, Logs, Options, Node --try: -- import cpplint.cpplint as cpplint_tool --except ImportError: -- try: -- import cpplint as cpplint_tool -- except ImportError: -- pass -+from waflib import Errors, Task, TaskGen, Logs, Options, Node, Utils - - - critical_errors = 0 - CPPLINT_FORMAT = '[CPPLINT] %(filename)s:\nline %(linenum)s, severity %(confidence)s, category: %(category)s\n%(message)s\n' --RE_EMACS = re.compile('(?P.*):(?P\d+): (?P.*) \[(?P.*)\] \[(?P\d+)\]') -+RE_EMACS = re.compile(r'(?P.*):(?P\d+): (?P.*) \[(?P.*)\] \[(?P\d+)\]') - CPPLINT_RE = { - 'waf': RE_EMACS, - 'emacs': RE_EMACS, -- 'vs7': re.compile('(?P.*)\((?P\d+)\): (?P.*) \[(?P.*)\] \[(?P\d+)\]'), -- 'eclipse': re.compile('(?P.*):(?P\d+): warning: (?P.*) \[(?P.*)\] \[(?P\d+)\]'), -+ 'vs7': re.compile(r'(?P.*)\((?P\d+)\): (?P.*) \[(?P.*)\] \[(?P\d+)\]'), -+ 'eclipse': re.compile(r'(?P.*):(?P\d+): warning: (?P.*) \[(?P.*)\] \[(?P\d+)\]'), - } -+CPPLINT_STR = ('${CPPLINT} ' -+ '--verbose=${CPPLINT_LEVEL} ' -+ '--output=${CPPLINT_OUTPUT} ' -+ '--filter=${CPPLINT_FILTERS} ' -+ '--root=${CPPLINT_ROOT} ' -+ '--linelength=${CPPLINT_LINE_LENGTH} ') -+ - - def options(opt): - opt.add_option('--cpplint-filters', type='string', -@@ -71,24 +70,21 @@ def options(opt): - opt.add_option('--cpplint-break', default=5, type='int', dest='CPPLINT_BREAK', - help='break the build if error >= level (default: 5)') - opt.add_option('--cpplint-root', type='string', -- default=None, dest='CPPLINT_ROOT', -+ default='', dest='CPPLINT_ROOT', - help='root directory used to derive header guard') - opt.add_option('--cpplint-skip', action='store_true', - default=False, dest='CPPLINT_SKIP', - help='skip cpplint during build') - opt.add_option('--cpplint-output', type='string', - default='waf', dest='CPPLINT_OUTPUT', -- help='select output format (waf, emacs, vs7)') -+ help='select output format (waf, emacs, vs7, eclipse)') - - - def configure(conf): -- conf.start_msg('Checking cpplint') - try: -- cpplint_tool._cpplint_state -- conf.end_msg('ok') -- except NameError: -+ conf.find_program('cpplint', var='CPPLINT') -+ except Errors.ConfigurationError: - conf.env.CPPLINT_SKIP = True -- conf.end_msg('not found, skipping it.') - - - class cpplint_formatter(Logs.formatter, object): -@@ -117,34 +113,22 @@ class cpplint_handler(Logs.log_handler, object): - - - class cpplint_wrapper(object): -- stream = None -- tasks_count = 0 -- lock = threading.RLock() -- - def __init__(self, logger, threshold, fmt): - self.logger = logger - self.threshold = threshold -- self.error_count = 0 - self.fmt = fmt - - def __enter__(self): -- with cpplint_wrapper.lock: -- cpplint_wrapper.tasks_count += 1 -- if cpplint_wrapper.tasks_count == 1: -- sys.stderr.flush() -- cpplint_wrapper.stream = sys.stderr -- sys.stderr = self -- return self -+ return self - - def __exit__(self, exc_type, exc_value, traceback): -- with cpplint_wrapper.lock: -- cpplint_wrapper.tasks_count -= 1 -- if cpplint_wrapper.tasks_count == 0: -- sys.stderr = cpplint_wrapper.stream -- sys.stderr.flush() -- -- def isatty(self): -- return True -+ if isinstance(exc_value, Utils.subprocess.CalledProcessError): -+ messages = [m for m in exc_value.output.splitlines() -+ if 'Done processing' not in m -+ and 'Total errors found' not in m] -+ for message in messages: -+ self.write(message) -+ return True - - def write(self, message): - global critical_errors -@@ -184,12 +168,15 @@ class cpplint(Task.Task): - def run(self): - global critical_errors - with cpplint_wrapper(get_cpplint_logger(self.env.CPPLINT_OUTPUT), self.env.CPPLINT_BREAK, self.env.CPPLINT_OUTPUT): -- if self.env.CPPLINT_OUTPUT != 'waf': -- cpplint_tool._SetOutputFormat(self.env.CPPLINT_OUTPUT) -- cpplint_tool._SetFilters(self.env.CPPLINT_FILTERS) -- cpplint_tool._line_length = self.env.CPPLINT_LINE_LENGTH -- cpplint_tool._root = self.env.CPPLINT_ROOT -- cpplint_tool.ProcessFile(self.inputs[0].abspath(), self.env.CPPLINT_LEVEL) -+ params = {key: str(self.env[key]) for key in self.env if 'CPPLINT_' in key} -+ if params['CPPLINT_OUTPUT'] is 'waf': -+ params['CPPLINT_OUTPUT'] = 'emacs' -+ params['CPPLINT'] = self.env.get_flat('CPPLINT') -+ cmd = Utils.subst_vars(CPPLINT_STR, params) -+ env = self.env.env or None -+ Utils.subprocess.check_output(cmd + self.inputs[0].abspath(), -+ stderr=Utils.subprocess.STDOUT, -+ env=env, shell=True) - return critical_errors - - @TaskGen.extension('.h', '.hh', '.hpp', '.hxx') -diff --git a/third_party/waf/waflib/extras/cython.py b/third_party/waf/waflib/extras/cython.py -index 2b2c7ccc265..591c274d950 100644 ---- a/third_party/waf/waflib/extras/cython.py -+++ b/third_party/waf/waflib/extras/cython.py -@@ -8,8 +8,9 @@ from waflib.TaskGen import extension - - cy_api_pat = re.compile(r'\s*?cdef\s*?(public|api)\w*') - re_cyt = re.compile(r""" -- (?:from\s+(\w+)\s+)? # optionally match "from foo" and capture foo -- c?import\s(\w+|[*]) # require "import bar" and capture bar -+ ^\s* # must begin with some whitespace characters -+ (?:from\s+(\w+)(?:\.\w+)*\s+)? # optionally match "from foo(.baz)" and capture foo -+ c?import\s(\w+|[*]) # require "import bar" and capture bar - """, re.M | re.VERBOSE) - - @extension('.pyx') -@@ -85,12 +86,12 @@ class cython(Task.Task): - node = self.inputs[0] - txt = node.read() - -- mods = [] -+ mods = set() - for m in re_cyt.finditer(txt): - if m.group(1): # matches "from foo import bar" -- mods.append(m.group(1)) -+ mods.add(m.group(1)) - else: -- mods.append(m.group(2)) -+ mods.add(m.group(2)) - - Logs.debug('cython: mods %r', mods) - incs = getattr(self.generator, 'cython_includes', []) -@@ -99,7 +100,7 @@ class cython(Task.Task): - - found = [] - missing = [] -- for x in mods: -+ for x in sorted(mods): - for y in incs: - k = y.find_resource(x + '.pxd') - if k: -@@ -141,6 +142,6 @@ def configure(ctx): - if not ctx.env.PYTHON: - ctx.fatal('Load the python tool first!') - ctx.find_program('cython', var='CYTHON') -- if ctx.options.cython_flags: -+ if hasattr(ctx.options, 'cython_flags'): - ctx.env.CYTHONFLAGS = ctx.options.cython_flags - -diff --git a/third_party/waf/waflib/extras/distnet.py b/third_party/waf/waflib/extras/distnet.py -index 09a31a6d437..ff3ed8e1146 100644 ---- a/third_party/waf/waflib/extras/distnet.py -+++ b/third_party/waf/waflib/extras/distnet.py -@@ -44,7 +44,7 @@ TARFORMAT = 'w:bz2' - TIMEOUT = 60 - REQUIRES = 'requires.txt' - --re_com = re.compile('\s*#.*', re.M) -+re_com = re.compile(r'\s*#.*', re.M) - - def total_version_order(num): - lst = num.split('.') -diff --git a/third_party/waf/waflib/extras/doxygen.py b/third_party/waf/waflib/extras/doxygen.py -index 3eae22fe179..423d8455025 100644 ---- a/third_party/waf/waflib/extras/doxygen.py -+++ b/third_party/waf/waflib/extras/doxygen.py -@@ -27,6 +27,7 @@ When using this tool, the wscript will look like: - """ - - import os, os.path, re -+from collections import OrderedDict - from waflib import Task, Utils, Node - from waflib.TaskGen import feature - -@@ -40,7 +41,13 @@ inc m mm py f90c cc cxx cpp c++ java ii ixx ipp i++ inl h hh hxx - re_rl = re.compile('\\\\\r*\n', re.MULTILINE) - re_nl = re.compile('\r*\n', re.M) - def parse_doxy(txt): -- tbl = {} -+ ''' -+ Parses a doxygen file. -+ Returns an ordered dictionary. We cannot return a default dictionary, as the -+ order in which the entries are reported does matter, especially for the -+ '@INCLUDE' lines. -+ ''' -+ tbl = OrderedDict() - txt = re_rl.sub('', txt) - lines = re_nl.split(txt) - for x in lines: -@@ -190,13 +197,13 @@ class tar(Task.Task): - @feature('doxygen') - def process_doxy(self): - if not getattr(self, 'doxyfile', None): -- self.generator.bld.fatal('no doxyfile??') -+ self.bld.fatal('no doxyfile variable specified??') - - node = self.doxyfile - if not isinstance(node, Node.Node): - node = self.path.find_resource(node) - if not node: -- raise ValueError('doxygen file not found') -+ self.bld.fatal('doxygen file %s not found' % self.doxyfile) - - # the task instance - dsk = self.create_task('doxygen', node) -diff --git a/third_party/waf/waflib/extras/erlang.py b/third_party/waf/waflib/extras/erlang.py -index 49f6d5b475b..0b93d9a4f46 100644 ---- a/third_party/waf/waflib/extras/erlang.py -+++ b/third_party/waf/waflib/extras/erlang.py -@@ -51,7 +51,7 @@ class erl(Task.Task): - if n.abspath() in scanned: - continue - -- for i in re.findall('-include\("(.*)"\)\.', n.read()): -+ for i in re.findall(r'-include\("(.*)"\)\.', n.read()): - for d in task.erlc_incnodes: - r = d.find_node(i) - if r: -diff --git a/third_party/waf/waflib/extras/fast_partial.py b/third_party/waf/waflib/extras/fast_partial.py -index b3af513b255..71b8318eecb 100644 ---- a/third_party/waf/waflib/extras/fast_partial.py -+++ b/third_party/waf/waflib/extras/fast_partial.py -@@ -17,8 +17,9 @@ Usage:: - def options(opt): - opt.load('fast_partial') - --Assuptions: -+Assumptions: - * Mostly for C/C++/Fortran targets with link tasks (object-only targets are not handled) -+ try it in the folder generated by utils/genbench.py - * For full project builds: no --targets and no pruning from subfolders - * The installation phase is ignored - * `use=` dependencies are specified up front even across build groups -diff --git a/third_party/waf/waflib/extras/fc_cray.py b/third_party/waf/waflib/extras/fc_cray.py -index ec2906742b4..da733fade3d 100644 ---- a/third_party/waf/waflib/extras/fc_cray.py -+++ b/third_party/waf/waflib/extras/fc_cray.py -@@ -20,7 +20,7 @@ def find_crayftn(conf): - @conf - def crayftn_flags(conf): - v = conf.env -- v['_FCMODOUTFLAGS'] = ['-em', '-J.'] # enable module files and put them in the current directoy -+ v['_FCMODOUTFLAGS'] = ['-em', '-J.'] # enable module files and put them in the current directory - v['FCFLAGS_DEBUG'] = ['-m1'] # more verbose compiler warnings - v['FCFLAGS_fcshlib'] = ['-h pic'] - v['LINKFLAGS_fcshlib'] = ['-h shared'] -diff --git a/third_party/waf/waflib/extras/fc_nec.py b/third_party/waf/waflib/extras/fc_nec.py -index 4b70f3dcccd..67c86808985 100644 ---- a/third_party/waf/waflib/extras/fc_nec.py -+++ b/third_party/waf/waflib/extras/fc_nec.py -@@ -20,7 +20,7 @@ def find_sxfc(conf): - @conf - def sxfc_flags(conf): - v = conf.env -- v['_FCMODOUTFLAGS'] = [] # enable module files and put them in the current directoy -+ v['_FCMODOUTFLAGS'] = [] # enable module files and put them in the current directory - v['FCFLAGS_DEBUG'] = [] # more verbose compiler warnings - v['FCFLAGS_fcshlib'] = [] - v['LINKFLAGS_fcshlib'] = [] -diff --git a/third_party/waf/waflib/extras/fc_nfort.py b/third_party/waf/waflib/extras/fc_nfort.py -new file mode 100644 -index 00000000000..c25886b8e70 ---- /dev/null -+++ b/third_party/waf/waflib/extras/fc_nfort.py -@@ -0,0 +1,52 @@ -+#! /usr/bin/env python -+# encoding: utf-8 -+# Detection of the NEC Fortran compiler for Aurora Tsubasa -+ -+import re -+from waflib.Tools import fc,fc_config,fc_scan -+from waflib.Configure import conf -+from waflib.Tools.compiler_fc import fc_compiler -+fc_compiler['linux'].append('fc_nfort') -+ -+@conf -+def find_nfort(conf): -+ fc=conf.find_program(['nfort'],var='FC') -+ conf.get_nfort_version(fc) -+ conf.env.FC_NAME='NFORT' -+ conf.env.FC_MOD_CAPITALIZATION='lower' -+ -+@conf -+def nfort_flags(conf): -+ v=conf.env -+ v['_FCMODOUTFLAGS']=[] -+ v['FCFLAGS_DEBUG']=[] -+ v['FCFLAGS_fcshlib']=[] -+ v['LINKFLAGS_fcshlib']=[] -+ v['FCSTLIB_MARKER']='' -+ v['FCSHLIB_MARKER']='' -+ -+@conf -+def get_nfort_version(conf,fc): -+ version_re=re.compile(r"nfort\s*\(NFORT\)\s*(?P\d+)\.(?P\d+)\.",re.I).search -+ cmd=fc+['--version'] -+ out,err=fc_config.getoutput(conf,cmd,stdin=False) -+ if out: -+ match=version_re(out) -+ else: -+ match=version_re(err) -+ if not match: -+ return(False) -+ conf.fatal('Could not determine the NEC NFORT Fortran compiler version.') -+ else: -+ k=match.groupdict() -+ conf.env['FC_VERSION']=(k['major'],k['minor']) -+ -+def configure(conf): -+ conf.find_nfort() -+ conf.find_program('nar',var='AR') -+ conf.add_os_flags('ARFLAGS') -+ if not conf.env.ARFLAGS: -+ conf.env.ARFLAGS=['rcs'] -+ conf.fc_flags() -+ conf.fc_add_flags() -+ conf.nfort_flags() -diff --git a/third_party/waf/waflib/extras/gccdeps.py b/third_party/waf/waflib/extras/gccdeps.py -index d9758ab34d5..bfabe72e6fd 100644 ---- a/third_party/waf/waflib/extras/gccdeps.py -+++ b/third_party/waf/waflib/extras/gccdeps.py -@@ -36,7 +36,7 @@ def scan(self): - names = [] - return (nodes, names) - --re_o = re.compile("\.o$") -+re_o = re.compile(r"\.o$") - re_splitter = re.compile(r'(? '2': -- m = re.search(r'^message\s+(\w*)\s*{*', line) -- if m: -- messages.append(m.groups()[0]) -- -- if javapkg: -- nodename = javapkg -- elif pkgname: -- nodename = pkgname -- else: -- raise Errors.WafError('Cannot derive java name from protoc file') -- -- nodename = nodename.replace('.',os.sep) + os.sep -- if javacn: -- nodename += javacn + '.java' -- else: -- if self.env.PROTOC_MAJOR > '2' and node.abspath()[node.abspath().rfind(os.sep)+1:node.abspath().rfind('.')].title() in messages: -- nodename += node.abspath()[node.abspath().rfind(os.sep)+1:node.abspath().rfind('.')].title().replace('_','') + 'OuterClass.java' -- else: -- nodename += node.abspath()[node.abspath().rfind(os.sep)+1:node.abspath().rfind('.')].title().replace('_','') + '.java' -- -- java_node = node.parent.find_or_declare(nodename) -- out_nodes.append(java_node) -- protoc_flags.append('--java_out=%s' % node.parent.get_bld().bldpath()) -- - # Make javac get also pick java code generated in build - if not node.parent.get_bld() in self.javac_task.srcdir: - self.javac_task.srcdir.append(node.parent.get_bld()) - -- if not out_nodes: -- raise Errors.WafError('Feature %r not supported by protoc extra' % self.features) -+ protoc_flags.append('--java_out=%s' % node.parent.get_bld().bldpath()) -+ node.parent.get_bld().mkdir() - - tsk = self.create_task('protoc', node, out_nodes) - tsk.env.append_value('PROTOC_FLAGS', protoc_flags) -@@ -219,9 +187,22 @@ def process_protoc(self, node): - # For C++ standard include files dirs are used, - # but this doesn't apply to Python for example - for incpath in getattr(self, 'protoc_includes', []): -- incdirs.append(self.path.find_node(incpath).bldpath()) -+ incpath_node = self.path.find_node(incpath) -+ if incpath_node: -+ incdirs.append(incpath_node.bldpath()) -+ else: -+ # Check if relative to top-level for extra tg dependencies -+ incpath_node = self.bld.path.find_node(incpath) -+ if incpath_node: -+ incdirs.append(incpath_node.bldpath()) -+ else: -+ raise Errors.WafError('protoc: include path %r does not exist' % incpath) -+ - tsk.env.PROTOC_INCPATHS = incdirs - -+ # Include paths external to the waf project (ie. shared pb repositories) -+ tsk.env.PROTOC_EXTINCPATHS = getattr(self, 'protoc_extincludes', []) -+ - # PR2115: protoc generates output of .proto files in nested - # directories by canonicalizing paths. To avoid this we have to pass - # as first include the full directory file of the .proto file -diff --git a/third_party/waf/waflib/extras/pyqt5.py b/third_party/waf/waflib/extras/pyqt5.py -index c21dfa72048..9c941764cc2 100644 ---- a/third_party/waf/waflib/extras/pyqt5.py -+++ b/third_party/waf/waflib/extras/pyqt5.py -@@ -1,6 +1,6 @@ - #!/usr/bin/env python - # encoding: utf-8 --# Federico Pellegrin, 2016-2018 (fedepell) adapted for Python -+# Federico Pellegrin, 2016-2019 (fedepell) adapted for Python - - """ - This tool helps with finding Python Qt5 tools and libraries, -@@ -30,7 +30,7 @@ Load the "pyqt5" tool. - - Add into the sources list also the qrc resources files or ui5 - definition files and they will be translated into python code --with the system tools (PyQt5, pyside2, PyQt4 are searched in this -+with the system tools (PyQt5, PySide2, PyQt4 are searched in this - order) and then compiled - """ - -@@ -111,9 +111,9 @@ def apply_pyqt5(self): - """ - The additional parameters are: - -- :param lang: list of translation files (\*.ts) to process -+ :param lang: list of translation files (\\*.ts) to process - :type lang: list of :py:class:`waflib.Node.Node` or string without the .ts extension -- :param langname: if given, transform the \*.ts files into a .qrc files to include in the binary file -+ :param langname: if given, transform the \\*.ts files into a .qrc files to include in the binary file - :type langname: :py:class:`waflib.Node.Node` or string without the .qrc extension - """ - if getattr(self, 'lang', None): -@@ -207,11 +207,15 @@ def configure(self): - @conf - def find_pyqt5_binaries(self): - """ -- Detects PyQt5 or pyside2 programs such as pyuic5/pyside2-uic, pyrcc5/pyside2-rcc -+ Detects PyQt5 or PySide2 programs such as pyuic5/pyside2-uic, pyrcc5/pyside2-rcc - """ - env = self.env - -- if getattr(Options.options, 'want_pyside2', True): -+ if getattr(Options.options, 'want_pyqt5', True): -+ self.find_program(['pyuic5'], var='QT_PYUIC') -+ self.find_program(['pyrcc5'], var='QT_PYRCC') -+ self.find_program(['pylupdate5'], var='QT_PYLUPDATE') -+ elif getattr(Options.options, 'want_pyside2', True): - self.find_program(['pyside2-uic'], var='QT_PYUIC') - self.find_program(['pyside2-rcc'], var='QT_PYRCC') - self.find_program(['pyside2-lupdate'], var='QT_PYLUPDATE') -@@ -227,7 +231,7 @@ def find_pyqt5_binaries(self): - if not env.QT_PYUIC: - self.fatal('cannot find the uic compiler for python for qt5') - -- if not env.QT_PYUIC: -+ if not env.QT_PYRCC: - self.fatal('cannot find the rcc compiler for python for qt5') - - self.find_program(['lrelease-qt5', 'lrelease'], var='QT_LRELEASE') -@@ -237,5 +241,6 @@ def options(opt): - Command-line options - """ - pyqt5opt=opt.add_option_group("Python QT5 Options") -- pyqt5opt.add_option('--pyqt5-pyside2', action='store_true', default=False, dest='want_pyside2', help='use pyside2 bindings as python QT5 bindings (default PyQt5 is searched first, PySide2 after)') -+ pyqt5opt.add_option('--pyqt5-pyqt5', action='store_true', default=False, dest='want_pyqt5', help='use PyQt5 bindings as python QT5 bindings (default PyQt5 is searched first, PySide2 after, PyQt4 last)') -+ pyqt5opt.add_option('--pyqt5-pyside2', action='store_true', default=False, dest='want_pyside2', help='use PySide2 bindings as python QT5 bindings (default PyQt5 is searched first, PySide2 after, PyQt4 last)') - pyqt5opt.add_option('--pyqt5-pyqt4', action='store_true', default=False, dest='want_pyqt4', help='use PyQt4 bindings as python QT5 bindings (default PyQt5 is searched first, PySide2 after, PyQt4 last)') -diff --git a/third_party/waf/waflib/extras/qt4.py b/third_party/waf/waflib/extras/qt4.py -index 90cae7e0ae5..d19a4ddac3f 100644 ---- a/third_party/waf/waflib/extras/qt4.py -+++ b/third_party/waf/waflib/extras/qt4.py -@@ -290,11 +290,11 @@ def apply_qt4(self): - - The additional parameters are: - -- :param lang: list of translation files (\*.ts) to process -+ :param lang: list of translation files (\\*.ts) to process - :type lang: list of :py:class:`waflib.Node.Node` or string without the .ts extension -- :param update: whether to process the C++ files to update the \*.ts files (use **waf --translate**) -+ :param update: whether to process the C++ files to update the \\*.ts files (use **waf --translate**) - :type update: bool -- :param langname: if given, transform the \*.ts files into a .qrc files to include in the binary file -+ :param langname: if given, transform the \\*.ts files into a .qrc files to include in the binary file - :type langname: :py:class:`waflib.Node.Node` or string without the .qrc extension - """ - if getattr(self, 'lang', None): -diff --git a/third_party/waf/waflib/extras/remote.py b/third_party/waf/waflib/extras/remote.py -index 3b038f772b5..f43b600f023 100644 ---- a/third_party/waf/waflib/extras/remote.py -+++ b/third_party/waf/waflib/extras/remote.py -@@ -203,7 +203,7 @@ class remote(BuildContext): - Options.commands.remove(k) - - def login_to_host(self, login): -- return re.sub('(\w+@)', '', login) -+ return re.sub(r'(\w+@)', '', login) - - def variant_to_login(self, variant): - """linux_32_debug -> search env.LINUX_32 and then env.LINUX""" -diff --git a/third_party/waf/waflib/extras/run_do_script.py b/third_party/waf/waflib/extras/run_do_script.py -index f3c58122c9b..07e3aa2591c 100644 ---- a/third_party/waf/waflib/extras/run_do_script.py -+++ b/third_party/waf/waflib/extras/run_do_script.py -@@ -101,7 +101,7 @@ class run_do_script(run_do_script_base): - with open(**kwargs) as log: - log_tail = log.readlines()[-10:] - for line in log_tail: -- error_found = re.match("r\(([0-9]+)\)", line) -+ error_found = re.match(r"r\(([0-9]+)\)", line) - if error_found: - return error_found.group(1), ''.join(log_tail) - else: -diff --git a/third_party/waf/waflib/extras/sphinx.py b/third_party/waf/waflib/extras/sphinx.py -new file mode 100644 -index 00000000000..ce11110e634 ---- /dev/null -+++ b/third_party/waf/waflib/extras/sphinx.py -@@ -0,0 +1,81 @@ -+"""Support for Sphinx documentation -+ -+This is a wrapper for sphinx-build program. Please note that sphinx-build supports only one output format which can -+passed to build via sphinx_output_format attribute. The default output format is html. -+ -+Example wscript: -+ -+def configure(cnf): -+ conf.load('sphinx') -+ -+def build(bld): -+ bld( -+ features='sphinx', -+ sphinx_source='sources', # path to source directory -+ sphinx_options='-a -v', # sphinx-build program additional options -+ sphinx_output_format='man' # output format of sphinx documentation -+ ) -+ -+""" -+ -+from waflib.Node import Node -+from waflib import Utils -+from waflib.Task import Task -+from waflib.TaskGen import feature, after_method -+ -+ -+def configure(cnf): -+ """Check if sphinx-build program is available and loads gnu_dirs tool.""" -+ cnf.find_program('sphinx-build', var='SPHINX_BUILD', mandatory=False) -+ cnf.load('gnu_dirs') -+ -+ -+@feature('sphinx') -+def build_sphinx(self): -+ """Builds sphinx sources. -+ """ -+ if not self.env.SPHINX_BUILD: -+ self.bld.fatal('Program SPHINX_BUILD not defined.') -+ if not getattr(self, 'sphinx_source', None): -+ self.bld.fatal('Attribute sphinx_source not defined.') -+ if not isinstance(self.sphinx_source, Node): -+ self.sphinx_source = self.path.find_node(self.sphinx_source) -+ if not self.sphinx_source: -+ self.bld.fatal('Can\'t find sphinx_source: %r' % self.sphinx_source) -+ -+ Utils.def_attrs(self, sphinx_output_format='html') -+ self.env.SPHINX_OUTPUT_FORMAT = self.sphinx_output_format -+ self.env.SPHINX_OPTIONS = getattr(self, 'sphinx_options', []) -+ -+ for source_file in self.sphinx_source.ant_glob('**/*'): -+ self.bld.add_manual_dependency(self.sphinx_source, source_file) -+ -+ sphinx_build_task = self.create_task('SphinxBuildingTask') -+ sphinx_build_task.set_inputs(self.sphinx_source) -+ sphinx_build_task.set_outputs(self.path.get_bld()) -+ -+ # the sphinx-build results are in directory -+ sphinx_output_directory = self.path.get_bld().make_node(self.env.SPHINX_OUTPUT_FORMAT) -+ sphinx_output_directory.mkdir() -+ Utils.def_attrs(self, install_path=get_install_path(self)) -+ self.add_install_files(install_to=self.install_path, -+ install_from=sphinx_output_directory.ant_glob('**/*'), -+ cwd=sphinx_output_directory, -+ relative_trick=True) -+ -+ -+def get_install_path(tg): -+ if tg.env.SPHINX_OUTPUT_FORMAT == 'man': -+ return tg.env.MANDIR -+ elif tg.env.SPHINX_OUTPUT_FORMAT == 'info': -+ return tg.env.INFODIR -+ else: -+ return tg.env.DOCDIR -+ -+ -+class SphinxBuildingTask(Task): -+ color = 'BOLD' -+ run_str = '${SPHINX_BUILD} -M ${SPHINX_OUTPUT_FORMAT} ${SRC} ${TGT} ${SPHINX_OPTIONS}' -+ -+ def keyword(self): -+ return 'Compiling (%s)' % self.env.SPHINX_OUTPUT_FORMAT -diff --git a/third_party/waf/waflib/extras/swig.py b/third_party/waf/waflib/extras/swig.py -index fd3d6d2c995..740ab46d963 100644 ---- a/third_party/waf/waflib/extras/swig.py -+++ b/third_party/waf/waflib/extras/swig.py -@@ -17,10 +17,10 @@ tasks have to be added dynamically: - - SWIG_EXTS = ['.swig', '.i'] - --re_module = re.compile('%module(?:\s*\(.*\))?\s+(.+)', re.M) -+re_module = re.compile(r'%module(?:\s*\(.*\))?\s+(.+)', re.M) - - re_1 = re.compile(r'^%module.*?\s+([\w]+)\s*?$', re.M) --re_2 = re.compile('[#%]include [<"](.*)[">]', re.M) -+re_2 = re.compile(r'[#%](?:include|import(?:\(module=".*"\))+|python(?:begin|code)) [<"](.*)[">]', re.M) - - class swig(Task.Task): - color = 'BLUE' -diff --git a/third_party/waf/waflib/extras/syms.py b/third_party/waf/waflib/extras/syms.py -index dfa005930e4..562f708e1ea 100644 ---- a/third_party/waf/waflib/extras/syms.py -+++ b/third_party/waf/waflib/extras/syms.py -@@ -31,7 +31,7 @@ class gen_sym(Task): - if self.env.DEST_BINFMT == 'pe': #gcc uses nm, and has a preceding _ on windows - re_nm = re.compile(r'(T|D)\s+_(?P%s)\b' % reg) - elif self.env.DEST_BINFMT=='mac-o': -- re_nm=re.compile(r'(T|D)\s+(?P_?%s)\b' % reg) -+ re_nm=re.compile(r'(T|D)\s+(?P_?(%s))\b' % reg) - else: - re_nm = re.compile(r'(T|D)\s+(?P%s)\b' % reg) - cmd = (self.env.NM or ['nm']) + ['-g', obj.abspath()] -diff --git a/third_party/waf/waflib/extras/use_config.py b/third_party/waf/waflib/extras/use_config.py -index 71df793a2a3..ef5129f219b 100644 ---- a/third_party/waf/waflib/extras/use_config.py -+++ b/third_party/waf/waflib/extras/use_config.py -@@ -52,7 +52,7 @@ import os - - local_repo = '' - """Local repository containing additional Waf tools (plugins)""" --remote_repo = 'https://raw.githubusercontent.com/waf-project/waf/master/' -+remote_repo = 'https://gitlab.com/ita1024/waf/raw/master/' - """ - Remote directory containing downloadable waf tools. The missing tools can be downloaded by using:: - -diff --git a/third_party/waf/waflib/extras/xcode6.py b/third_party/waf/waflib/extras/xcode6.py -index c062a74e4fc..91bbff181ec 100644 ---- a/third_party/waf/waflib/extras/xcode6.py -+++ b/third_party/waf/waflib/extras/xcode6.py -@@ -147,7 +147,7 @@ def newid(): - Represents a tree node in the XCode project plist file format. - When written to a file, all attributes of XCodeNode are stringified together with - its value. However, attributes starting with an underscore _ are ignored --during that process and allows you to store arbitray values that are not supposed -+during that process and allows you to store arbitrary values that are not supposed - to be written out. - """ - class XCodeNode(object): -@@ -247,7 +247,7 @@ class PBXBuildFile(XCodeNode): - # fileRef is a reference to a PBXFileReference object - self.fileRef = fileRef - -- # A map of key/value pairs for additionnal settings. -+ # A map of key/value pairs for additional settings. - self.settings = settings - - def __hash__(self): -@@ -435,8 +435,8 @@ class PBXProject(XCodeNode): - def create_target_dependency(self, target, name): - """ : param target : PXBNativeTarget """ - proxy = PBXContainerItemProxy(self, target, name) -- dependecy = PBXTargetDependency(target, proxy) -- return dependecy -+ dependency = PBXTargetDependency(target, proxy) -+ return dependency - - def write(self, file): - -diff --git a/third_party/waf/waflib/processor.py b/third_party/waf/waflib/processor.py -index 2eecf3bd93f..eff2e69adfb 100755 ---- a/third_party/waf/waflib/processor.py -+++ b/third_party/waf/waflib/processor.py -@@ -27,6 +27,10 @@ def run(): - [cmd, kwargs, cargs] = cPickle.loads(base64.b64decode(txt)) - cargs = cargs or {} - -+ if not 'close_fds' in kwargs: -+ # workers have no fds -+ kwargs['close_fds'] = False -+ - ret = 1 - out, err, ex, trace = (None, None, None, None) - try: --- -2.21.0 - diff --git a/samba.spec b/samba.spec index 18e7c27..8691f44 100644 --- a/samba.spec +++ b/samba.spec @@ -6,15 +6,15 @@ # ctdb is enabled by default, you can disable it with: --without clustering %bcond_without clustering -%define main_release 1 +%define main_release 0 -%define samba_version 4.10.6 -%define talloc_version 2.1.16 -%define tdb_version 1.3.18 -%define tevent_version 0.9.39 -%define ldb_version 1.5.5 +%define samba_version 4.11.0 +%define talloc_version 2.2.0 +%define tdb_version 1.4.1 +%define tevent_version 0.10.0 +%define ldb_version 2.0.5 # This should be rc1 or nil -%define pre_release %nil +%define pre_release rc1 %if "x%{?pre_release}" != "x" %define samba_release 0.%{main_release}.%{pre_release}%{?dist} @@ -118,8 +118,7 @@ Source14: samba.pamd Source201: README.downgrade -Patch0: samba-4.10.x-waf_update.patch -Patch1: samba-bz14091-v4.10-backport.patch +Patch0: samba-bz14091-v4.10-backport.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -3440,6 +3439,9 @@ fi %endif # with_clustering_support %changelog +* Tue Aug 20 2019 Guenther Deschner - 4.11.0rc1-0 +- Update to Samba 4.11.0rc1 + * Fri Aug 16 2019 Alexander Bokovoy - 2:4.10.6-1 - Fix Samba bug https://bugzilla.samba.org/show_bug.cgi?id=14091 - Fixes: Windows systems cannot resolve IPA users and groups over LSA RPC diff --git a/sources b/sources index d8fd22b..1b19fc6 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.10.6.tar.xz) = 1189e25271d3f708efebe99e840028dd82f82de458771bf9e8373c6b21643e3968165963b4a9efb5eac356734a4b4c7857f6fb2a077f3c8ca463ebae5a889cfc -SHA512 (samba-4.10.6.tar.asc) = 21dc113313d98185ee97be1c59e791862d55dcd509b82f98d8fb5f2123b09c7be7265305734b0b17fb95aca729c1b7df48751cb6d6b645dbfbf092e174e07cbc +SHA512 (samba-4.11.0rc1.tar.xz) = 618e96d39eeada94675bde0c7ab287fdb59674bb5fe3ae75f62723f87554d3302c1afc00894fe8dea0e227c1e5db07f222307e0062dc0db4ffb885441facbc94 +SHA512 (samba-4.11.0rc1.tar.asc) = eb18a854b7145711ae0a3da32a6006e4bee36d13a74800748521432728f1ba6eca7bdcf94ce1ec3b17d6849527fcf37300a0b5f7ce2e0aa50009de66352cc72a From f297ac882f3cf8371138a1e5e0a2037ff6a6ab95 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 21 Aug 2019 16:07:07 +0200 Subject: [PATCH 03/51] Update to Samba 4.11.0rc2 Thanks to Lukas Slebodnik Guenther --- .gitignore | 2 + samba-bz14091-v4.10-backport.patch | 650 ----------------------------- samba.spec | 104 ++--- sources | 4 +- 4 files changed, 40 insertions(+), 720 deletions(-) delete mode 100644 samba-bz14091-v4.10-backport.patch diff --git a/.gitignore b/.gitignore index 3f7e875..90e2be2 100644 --- a/.gitignore +++ b/.gitignore @@ -171,3 +171,5 @@ samba-3.6.0pre1.tar.gz /samba-4.10.6.tar.asc /samba-4.11.0rc1.tar.xz /samba-4.11.0rc1.tar.asc +/samba-4.11.0rc2.tar.xz +/samba-4.11.0rc2.tar.asc diff --git a/samba-bz14091-v4.10-backport.patch b/samba-bz14091-v4.10-backport.patch deleted file mode 100644 index 104e78e..0000000 --- a/samba-bz14091-v4.10-backport.patch +++ /dev/null @@ -1,650 +0,0 @@ -From 536df2c1070d516ab95ad96b606fcc1f92c3668d Mon Sep 17 00:00:00 2001 -From: Alexander Bokovoy -Date: Thu, 1 Aug 2019 21:08:52 +0300 -Subject: [PATCH 1/3] torture/rpc/lsa: allow testing different lookup levels - -Convert torture/rpc/lsa LookupNames/LookupSids code to allow testing -different LSA_LOOKUP_NAMES_* levels. Keep existing level 1 -(LSA_LOOKUP_NAMES_ALL) for the current set of tests. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14091 - -Signed-off-by: Alexander Bokovoy -Reviewed-by: Andreas Schneider - -(cherry picked from commit 317bc6a7342edfa2c503f5932142bf5883485cc9) ---- - source4/torture/rpc/lsa.c | 118 ++++++++++++++++++--------------- - source4/torture/rpc/schannel.c | 2 +- - 2 files changed, 67 insertions(+), 53 deletions(-) - -diff --git a/source4/torture/rpc/lsa.c b/source4/torture/rpc/lsa.c -index bc1e9553039..b7dd0dc8c91 100644 ---- a/source4/torture/rpc/lsa.c -+++ b/source4/torture/rpc/lsa.c -@@ -270,6 +270,7 @@ static bool test_OpenPolicy2_fail(struct dcerpc_binding_handle *b, - static bool test_LookupNames(struct dcerpc_binding_handle *b, - struct torture_context *tctx, - struct policy_handle *handle, -+ enum lsa_LookupNamesLevel level, - struct lsa_TransNameArray *tnames) - { - struct lsa_LookupNames r; -@@ -302,7 +303,7 @@ static bool test_LookupNames(struct dcerpc_binding_handle *b, - r.in.handle = handle; - r.in.names = names; - r.in.sids = &sids; -- r.in.level = 1; -+ r.in.level = level; - r.in.count = &count; - r.out.count = &count; - r.out.sids = &sids; -@@ -358,7 +359,8 @@ static bool test_LookupNames(struct dcerpc_binding_handle *b, - - static bool test_LookupNames_bogus(struct dcerpc_binding_handle *b, - struct torture_context *tctx, -- struct policy_handle *handle) -+ struct policy_handle *handle, -+ enum lsa_LookupNamesLevel level) - { - struct lsa_LookupNames r; - struct lsa_TransSidArray sids; -@@ -377,7 +379,7 @@ static bool test_LookupNames_bogus(struct dcerpc_binding_handle *b, - r.in.num_names = 1; - r.in.names = names; - r.in.sids = &sids; -- r.in.level = 1; -+ r.in.level = level; - r.in.count = &count; - r.out.count = &count; - r.out.sids = &sids; -@@ -398,7 +400,8 @@ static bool test_LookupNames_bogus(struct dcerpc_binding_handle *b, - - static bool test_LookupNames_NULL(struct dcerpc_binding_handle *b, - struct torture_context *tctx, -- struct policy_handle *handle) -+ struct policy_handle *handle, -+ enum lsa_LookupNamesLevel level) - { - struct lsa_LookupNames r; - struct lsa_TransSidArray sids; -@@ -417,7 +420,7 @@ static bool test_LookupNames_NULL(struct dcerpc_binding_handle *b, - r.in.num_names = 1; - r.in.names = names; - r.in.sids = &sids; -- r.in.level = 1; -+ r.in.level = level; - r.in.count = &count; - r.out.count = &count; - r.out.sids = &sids; -@@ -442,7 +445,8 @@ static bool test_LookupNames_NULL(struct dcerpc_binding_handle *b, - - static bool test_LookupNames_wellknown(struct dcerpc_binding_handle *b, - struct torture_context *tctx, -- struct policy_handle *handle) -+ struct policy_handle *handle, -+ enum lsa_LookupNamesLevel level) - { - struct lsa_TranslatedName name; - struct lsa_TransNameArray tnames; -@@ -454,45 +458,46 @@ static bool test_LookupNames_wellknown(struct dcerpc_binding_handle *b, - tnames.count = 1; - name.name.string = "NT AUTHORITY\\SYSTEM"; - name.sid_type = SID_NAME_WKN_GRP; -- ret &= test_LookupNames(b, tctx, handle, &tnames); -+ ret &= test_LookupNames(b, tctx, handle, level, &tnames); - - name.name.string = "NT AUTHORITY\\ANONYMOUS LOGON"; - name.sid_type = SID_NAME_WKN_GRP; -- ret &= test_LookupNames(b, tctx, handle, &tnames); -+ ret &= test_LookupNames(b, tctx, handle, level, &tnames); - - name.name.string = "NT AUTHORITY\\Authenticated Users"; - name.sid_type = SID_NAME_WKN_GRP; -- ret &= test_LookupNames(b, tctx, handle, &tnames); -+ ret &= test_LookupNames(b, tctx, handle, level, &tnames); - - #if 0 - name.name.string = "NT AUTHORITY"; -- ret &= test_LookupNames(b, tctx, handle, &tnames); -+ ret &= test_LookupNames(b, tctx, handle, level, &tnames); - - name.name.string = "NT AUTHORITY\\"; -- ret &= test_LookupNames(b, tctx, handle, &tnames); -+ ret &= test_LookupNames(b, tctx, handle, level, &tnames); - #endif - - name.name.string = "BUILTIN\\"; - name.sid_type = SID_NAME_DOMAIN; -- ret &= test_LookupNames(b, tctx, handle, &tnames); -+ ret &= test_LookupNames(b, tctx, handle, level, &tnames); - - name.name.string = "BUILTIN\\Administrators"; - name.sid_type = SID_NAME_ALIAS; -- ret &= test_LookupNames(b, tctx, handle, &tnames); -+ ret &= test_LookupNames(b, tctx, handle, level, &tnames); - - name.name.string = "SYSTEM"; - name.sid_type = SID_NAME_WKN_GRP; -- ret &= test_LookupNames(b, tctx, handle, &tnames); -+ ret &= test_LookupNames(b, tctx, handle, level, &tnames); - - name.name.string = "Everyone"; - name.sid_type = SID_NAME_WKN_GRP; -- ret &= test_LookupNames(b, tctx, handle, &tnames); -+ ret &= test_LookupNames(b, tctx, handle, level, &tnames); - return ret; - } - - static bool test_LookupNames2(struct dcerpc_binding_handle *b, - struct torture_context *tctx, - struct policy_handle *handle, -+ enum lsa_LookupNamesLevel level, - struct lsa_TransNameArray2 *tnames, - bool check_result) - { -@@ -525,7 +530,7 @@ static bool test_LookupNames2(struct dcerpc_binding_handle *b, - r.in.handle = handle; - r.in.names = names; - r.in.sids = &sids; -- r.in.level = 1; -+ r.in.level = level; - r.in.count = &count; - r.in.lookup_options = 0; - r.in.client_revision = 0; -@@ -554,6 +559,7 @@ static bool test_LookupNames2(struct dcerpc_binding_handle *b, - static bool test_LookupNames3(struct dcerpc_binding_handle *b, - struct torture_context *tctx, - struct policy_handle *handle, -+ enum lsa_LookupNamesLevel level, - struct lsa_TransNameArray2 *tnames, - bool check_result) - { -@@ -585,7 +591,7 @@ static bool test_LookupNames3(struct dcerpc_binding_handle *b, - r.in.handle = handle; - r.in.names = names; - r.in.sids = &sids; -- r.in.level = 1; -+ r.in.level = level; - r.in.count = &count; - r.in.lookup_options = 0; - r.in.client_revision = 0; -@@ -613,6 +619,7 @@ static bool test_LookupNames3(struct dcerpc_binding_handle *b, - - static bool test_LookupNames4(struct dcerpc_binding_handle *b, - struct torture_context *tctx, -+ enum lsa_LookupNamesLevel level, - struct lsa_TransNameArray2 *tnames, - bool check_result) - { -@@ -644,7 +651,7 @@ static bool test_LookupNames4(struct dcerpc_binding_handle *b, - r.in.num_names = tnames->count; - r.in.names = names; - r.in.sids = &sids; -- r.in.level = 1; -+ r.in.level = level; - r.in.count = &count; - r.in.lookup_options = 0; - r.in.client_revision = 0; -@@ -682,7 +689,8 @@ static bool test_LookupNames4(struct dcerpc_binding_handle *b, - } - - static bool test_LookupNames4_fail(struct dcerpc_binding_handle *b, -- struct torture_context *tctx) -+ struct torture_context *tctx, -+ enum lsa_LookupNamesLevel level) - { - struct lsa_LookupNames4 r; - struct lsa_TransSidArray3 sids; -@@ -701,7 +709,7 @@ static bool test_LookupNames4_fail(struct dcerpc_binding_handle *b, - r.in.num_names = count; - r.in.names = names; - r.in.sids = &sids; -- r.in.level = 1; -+ r.in.level = level; - r.in.count = &count; - r.in.lookup_options = 0; - r.in.client_revision = 0; -@@ -749,6 +757,7 @@ static bool test_LookupNames4_fail(struct dcerpc_binding_handle *b, - static bool test_LookupSids(struct dcerpc_binding_handle *b, - struct torture_context *tctx, - struct policy_handle *handle, -+ enum lsa_LookupNamesLevel level, - struct lsa_SidArray *sids) - { - struct lsa_LookupSids r; -@@ -764,7 +773,7 @@ static bool test_LookupSids(struct dcerpc_binding_handle *b, - r.in.handle = handle; - r.in.sids = sids; - r.in.names = &names; -- r.in.level = 1; -+ r.in.level = level; - r.in.count = &count; - r.out.count = &count; - r.out.names = &names; -@@ -779,7 +788,7 @@ static bool test_LookupSids(struct dcerpc_binding_handle *b, - - torture_comment(tctx, "\n"); - -- if (!test_LookupNames(b, tctx, handle, &names)) { -+ if (!test_LookupNames(b, tctx, handle, level, &names)) { - return false; - } - -@@ -790,6 +799,7 @@ static bool test_LookupSids(struct dcerpc_binding_handle *b, - static bool test_LookupSids2(struct dcerpc_binding_handle *b, - struct torture_context *tctx, - struct policy_handle *handle, -+ enum lsa_LookupNamesLevel level, - struct lsa_SidArray *sids) - { - struct lsa_LookupSids2 r; -@@ -805,7 +815,7 @@ static bool test_LookupSids2(struct dcerpc_binding_handle *b, - r.in.handle = handle; - r.in.sids = sids; - r.in.names = &names; -- r.in.level = 1; -+ r.in.level = level; - r.in.count = &count; - r.in.lookup_options = 0; - r.in.client_revision = 0; -@@ -824,11 +834,11 @@ static bool test_LookupSids2(struct dcerpc_binding_handle *b, - - torture_comment(tctx, "\n"); - -- if (!test_LookupNames2(b, tctx, handle, &names, false)) { -+ if (!test_LookupNames2(b, tctx, handle, level, &names, false)) { - return false; - } - -- if (!test_LookupNames3(b, tctx, handle, &names, false)) { -+ if (!test_LookupNames3(b, tctx, handle, level, &names, false)) { - return false; - } - -@@ -837,6 +847,7 @@ static bool test_LookupSids2(struct dcerpc_binding_handle *b, - - static bool test_LookupSids3(struct dcerpc_binding_handle *b, - struct torture_context *tctx, -+ enum lsa_LookupNamesLevel level, - struct lsa_SidArray *sids) - { - struct lsa_LookupSids3 r; -@@ -851,7 +862,7 @@ static bool test_LookupSids3(struct dcerpc_binding_handle *b, - - r.in.sids = sids; - r.in.names = &names; -- r.in.level = 1; -+ r.in.level = level; - r.in.count = &count; - r.in.lookup_options = 0; - r.in.client_revision = 0; -@@ -880,7 +891,7 @@ static bool test_LookupSids3(struct dcerpc_binding_handle *b, - - torture_comment(tctx, "\n"); - -- if (!test_LookupNames4(b, tctx, &names, true)) { -+ if (!test_LookupNames4(b, tctx, level, &names, true)) { - return false; - } - -@@ -889,6 +900,7 @@ static bool test_LookupSids3(struct dcerpc_binding_handle *b, - - static bool test_LookupSids3_fail(struct dcerpc_binding_handle *b, - struct torture_context *tctx, -+ enum lsa_LookupNamesLevel level, - struct lsa_SidArray *sids) - { - struct lsa_LookupSids3 r; -@@ -904,7 +916,7 @@ static bool test_LookupSids3_fail(struct dcerpc_binding_handle *b, - - r.in.sids = sids; - r.in.names = &names; -- r.in.level = 1; -+ r.in.level = level; - r.in.count = &count; - r.in.lookup_options = 0; - r.in.client_revision = 0; -@@ -948,7 +960,8 @@ static bool test_LookupSids3_fail(struct dcerpc_binding_handle *b, - - bool test_many_LookupSids(struct dcerpc_pipe *p, - struct torture_context *tctx, -- struct policy_handle *handle) -+ struct policy_handle *handle, -+ enum lsa_LookupNamesLevel level) - { - uint32_t count; - struct lsa_SidArray sids; -@@ -979,7 +992,7 @@ bool test_many_LookupSids(struct dcerpc_pipe *p, - r.in.handle = handle; - r.in.sids = &sids; - r.in.names = &names; -- r.in.level = 1; -+ r.in.level = level; - r.in.count = &names.count; - r.out.count = &count; - r.out.names = &names; -@@ -995,16 +1008,16 @@ bool test_many_LookupSids(struct dcerpc_pipe *p, - - torture_comment(tctx, "\n"); - -- if (!test_LookupNames(b, tctx, handle, &names)) { -+ if (!test_LookupNames(b, tctx, handle, level, &names)) { - return false; - } - } - - if (transport == NCACN_NP) { -- if (!test_LookupSids3_fail(b, tctx, &sids)) { -+ if (!test_LookupSids3_fail(b, tctx, level, &sids)) { - return false; - } -- if (!test_LookupNames4_fail(b, tctx)) { -+ if (!test_LookupNames4_fail(b, tctx, level)) { - return false; - } - } else if (transport == NCACN_IP_TCP) { -@@ -1020,10 +1033,10 @@ bool test_many_LookupSids(struct dcerpc_pipe *p, - - if (auth_type == DCERPC_AUTH_TYPE_SCHANNEL && - auth_level >= DCERPC_AUTH_LEVEL_INTEGRITY) { -- if (!test_LookupSids3(b, tctx, &sids)) { -+ if (!test_LookupSids3(b, tctx, level, &sids)) { - return false; - } -- if (!test_LookupNames4(b, tctx, &names, true)) { -+ if (!test_LookupNames4(b, tctx, level, &names, true)) { - return false; - } - } else { -@@ -1031,10 +1044,10 @@ bool test_many_LookupSids(struct dcerpc_pipe *p, - * If we don't have a secure channel these tests must - * fail with ACCESS_DENIED. - */ -- if (!test_LookupSids3_fail(b, tctx, &sids)) { -+ if (!test_LookupSids3_fail(b, tctx, level, &sids)) { - return false; - } -- if (!test_LookupNames4_fail(b, tctx)) { -+ if (!test_LookupNames4_fail(b, tctx, level)) { - return false; - } - } -@@ -1066,7 +1079,8 @@ static void lookupsids_cb(struct tevent_req *subreq) - - static bool test_LookupSids_async(struct dcerpc_binding_handle *b, - struct torture_context *tctx, -- struct policy_handle *handle) -+ struct policy_handle *handle, -+ enum lsa_LookupNamesLevel level) - { - struct lsa_SidArray sids; - struct lsa_SidPtr sidptr; -@@ -1101,7 +1115,7 @@ static bool test_LookupSids_async(struct dcerpc_binding_handle *b, - r[i].in.handle = handle; - r[i].in.sids = &sids; - r[i].in.names = &names[i]; -- r[i].in.level = 1; -+ r[i].in.level = level; - r[i].in.count = &names[i].count; - r[i].out.count = &count[i]; - r[i].out.names = &names[i]; -@@ -1912,11 +1926,11 @@ static bool test_EnumAccounts(struct dcerpc_binding_handle *b, - torture_assert_ntstatus_ok(tctx, r.out.result, - "EnumAccounts failed"); - -- if (!test_LookupSids(b, tctx, handle, &sids1)) { -+ if (!test_LookupSids(b, tctx, handle, LSA_LOOKUP_NAMES_ALL, &sids1)) { - return false; - } - -- if (!test_LookupSids2(b, tctx, handle, &sids1)) { -+ if (!test_LookupSids2(b, tctx, handle, LSA_LOOKUP_NAMES_ALL, &sids1)) { - return false; - } - -@@ -4811,7 +4825,7 @@ static bool test_QueryInfoPolicyCalls( bool version2, - tnames.names[12].sid_type = SID_NAME_USER; - tnames.names[13].name.string = talloc_asprintf(tctx, TEST_MACHINENAME "$@%s", info->dns.dns_domain.string); - tnames.names[13].sid_type = SID_NAME_USER; -- ret &= test_LookupNames(b, tctx, handle, &tnames); -+ ret &= test_LookupNames(b, tctx, handle, LSA_LOOKUP_NAMES_ALL, &tnames); - - } - } -@@ -4977,7 +4991,7 @@ bool torture_rpc_lsa(struct torture_context *tctx) - ret = false; - } - -- if (!test_many_LookupSids(p, tctx, handle)) { -+ if (!test_many_LookupSids(p, tctx, handle, LSA_LOOKUP_NAMES_ALL)) { - ret = false; - } - -@@ -4998,7 +5012,7 @@ bool torture_rpc_lsa(struct torture_context *tctx) - ret = false; - } - -- if (!test_LookupSids_async(b, tctx, handle)) { -+ if (!test_LookupSids_async(b, tctx, handle, LSA_LOOKUP_NAMES_ALL)) { - ret = false; - } - -@@ -5022,7 +5036,7 @@ bool torture_rpc_lsa(struct torture_context *tctx) - ret = false; - } - -- if (!test_many_LookupSids(p, tctx, handle)) { -+ if (!test_many_LookupSids(p, tctx, handle, LSA_LOOKUP_NAMES_ALL)) { - ret = false; - } - -@@ -5033,7 +5047,7 @@ bool torture_rpc_lsa(struct torture_context *tctx) - torture_leave_domain(tctx, join); - - } else { -- if (!test_many_LookupSids(p, tctx, handle)) { -+ if (!test_many_LookupSids(p, tctx, handle, LSA_LOOKUP_NAMES_ALL)) { - ret = false; - } - } -@@ -5108,7 +5122,7 @@ static bool testcase_LookupNames(struct torture_context *tctx, - tnames.names[0].name.string = "BUILTIN"; - tnames.names[0].sid_type = SID_NAME_DOMAIN; - -- if (!test_LookupNames(b, tctx, handle, &tnames)) { -+ if (!test_LookupNames(b, tctx, handle, LSA_LOOKUP_NAMES_ALL, &tnames)) { - ret = false; - } - -@@ -5118,23 +5132,23 @@ static bool testcase_LookupNames(struct torture_context *tctx, - tnames2.names[0].name.string = "BUILTIN"; - tnames2.names[0].sid_type = SID_NAME_DOMAIN; - -- if (!test_LookupNames2(b, tctx, handle, &tnames2, true)) { -+ if (!test_LookupNames2(b, tctx, handle, LSA_LOOKUP_NAMES_ALL, &tnames2, true)) { - ret = false; - } - -- if (!test_LookupNames3(b, tctx, handle, &tnames2, true)) { -+ if (!test_LookupNames3(b, tctx, handle, LSA_LOOKUP_NAMES_ALL, &tnames2, true)) { - ret = false; - } - -- if (!test_LookupNames_wellknown(b, tctx, handle)) { -+ if (!test_LookupNames_wellknown(b, tctx, handle, LSA_LOOKUP_NAMES_ALL)) { - ret = false; - } - -- if (!test_LookupNames_NULL(b, tctx, handle)) { -+ if (!test_LookupNames_NULL(b, tctx, handle, LSA_LOOKUP_NAMES_ALL)) { - ret = false; - } - -- if (!test_LookupNames_bogus(b, tctx, handle)) { -+ if (!test_LookupNames_bogus(b, tctx, handle, LSA_LOOKUP_NAMES_ALL)) { - ret = false; - } - -diff --git a/source4/torture/rpc/schannel.c b/source4/torture/rpc/schannel.c -index de3a36eaa4f..c237c82bbe7 100644 ---- a/source4/torture/rpc/schannel.c -+++ b/source4/torture/rpc/schannel.c -@@ -471,7 +471,7 @@ static bool test_schannel(struct torture_context *tctx, - "failed to connect lsarpc with schannel"); - - torture_assert(tctx, -- test_many_LookupSids(p_lsa, tctx, NULL), -+ test_many_LookupSids(p_lsa, tctx, NULL, LSA_LOOKUP_NAMES_ALL), - "LsaLookupSids3 failed!\n"); - - status = dcerpc_binding_set_transport(b, transport); --- -2.21.0 - - -From e76b56290c2be142c43a3fd68584d51b9dc0efb7 Mon Sep 17 00:00:00 2001 -From: Alexander Bokovoy -Date: Thu, 1 Aug 2019 15:48:58 +0300 -Subject: [PATCH 2/3] lookup_name: allow own domain lookup when flags == 0 - -In 2007, we've added support for multiple lookup levels for LSA -LookupNames family of calls. However, forest-wide lookups, as described -in MS-LSAT 2.2.16, never worked because flags passed to lookup_name() -were always set to zero, expecting at least default lookup on a DC to -apply. lookup_name() was instead treating zero flags as 'skip all -checks'. - -Allow at least own domain lookup in case domain name is the same. -This should allow FreeIPA DC to respond to LSA LookupNames3 calls from a -trusted AD DC side. - -For the reference, below is a request Windows Server 2016 domain -controller sends to FreeIPA domain controller when attempting to look up -a user from a trusted forest root domain that attemps to login to the -domain controller. Notice the level in the lsa_LookupNames3 call and -resulting flags in lookup_name(). - -[2019/08/03 07:14:24.156065, 1, pid=23639, effective(967001000, 967001000), real(967001000, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:471(ndr_print_function_debug) - lsa_LookupNames3: struct lsa_LookupNames3 - in: struct lsa_LookupNames3 - handle : * - handle: struct policy_handle - handle_type : 0x00000000 (0) - uuid : 0000004c-0000-0000-455d-3018575c0000 - num_names : 0x00000001 (1) - names: ARRAY(1) - names: struct lsa_String - length : 0x000a (10) - size : 0x000c (12) - string : * - string : 'XS\ab' - sids : * - sids: struct lsa_TransSidArray3 - count : 0x00000000 (0) - sids : NULL - level : LSA_LOOKUP_NAMES_UPLEVEL_TRUSTS_ONLY2 (6) - count : * - count : 0x00000000 (0) - lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) - client_revision : LSA_CLIENT_REVISION_2 (2) -[2019/08/03 07:14:24.156189, 6, pid=23639, effective(967001000, 967001000), real(967001000, 0), class=rpc_srv] ../../source3/rpc_server/rpc_handles.c:339(find_policy_by_hnd_internal) - Found policy hnd[0] [0000] 00 00 00 00 4C 00 00 00 00 00 00 00 45 5D 30 18 ....L... ....E]0. - [0010] 57 5C 00 00 W\.. -[2019/08/03 07:14:24.156228, 4, pid=23639, effective(967001000, 967001000), real(967001000, 0)] ../../source3/smbd/sec_ctx.c:215(push_sec_ctx) - push_sec_ctx(967001000, 967001000) : sec_ctx_stack_ndx = 2 -[2019/08/03 07:14:24.156246, 4, pid=23639, effective(967001000, 967001000), real(967001000, 0)] ../../source3/smbd/uid.c:552(push_conn_ctx) - push_conn_ctx(0) : conn_ctx_stack_ndx = 0 -[2019/08/03 07:14:24.156259, 4, pid=23639, effective(967001000, 967001000), real(967001000, 0)] ../../source3/smbd/sec_ctx.c:319(set_sec_ctx_internal) - setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 -[2019/08/03 07:14:24.156273, 5, pid=23639, effective(967001000, 967001000), real(967001000, 0)] ../../libcli/security/security_token.c:53(security_token_debug) - Security token: (NULL) -[2019/08/03 07:14:24.156285, 5, pid=23639, effective(967001000, 967001000), real(967001000, 0)] ../../source3/auth/token_util.c:865(debug_unix_user_token) - UNIX token of user 0 - Primary group is 0 and contains 0 supplementary groups -[2019/08/03 07:14:24.156311, 5, pid=23639, effective(0, 0), real(0, 0), class=rpc_srv] ../../source3/rpc_server/lsa/srv_lsa_nt.c:244(lookup_lsa_sids) - lookup_lsa_sids: looking up name XS\ab -[2019/08/03 07:14:24.156327, 10, pid=23639, effective(0, 0), real(0, 0)] ../../source3/passdb/lookup_sid.c:112(lookup_name) - lookup_name: XS\ab => domain=[XS], name=[ab] -[2019/08/03 07:14:24.156340, 10, pid=23639, effective(0, 0), real(0, 0)] ../../source3/passdb/lookup_sid.c:114(lookup_name) - lookup_name: flags = 0x00 - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14091 - -Signed-off-by: Alexander Bokovoy -Reviewed-by: Andreas Schneider - -(cherry picked from commit 685bb03de6ab733590831d1df4f5fd60d2ac427d) ---- - source3/passdb/lookup_sid.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/source3/passdb/lookup_sid.c b/source3/passdb/lookup_sid.c -index 2281bd0b64d..1bb15ccb8b4 100644 ---- a/source3/passdb/lookup_sid.c -+++ b/source3/passdb/lookup_sid.c -@@ -113,7 +113,7 @@ bool lookup_name(TALLOC_CTX *mem_ctx, - full_name, domain, name)); - DEBUG(10, ("lookup_name: flags = 0x0%x\n", flags)); - -- if ((flags & LOOKUP_NAME_DOMAIN) && -+ if (((flags & LOOKUP_NAME_DOMAIN) || (flags == 0)) && - strequal(domain, get_global_sam_name())) - { - --- -2.21.0 - - -From 03d1a9f4f07f6e06c125875fe454925f4c1f6c2b Mon Sep 17 00:00:00 2001 -From: Alexander Bokovoy -Date: Sat, 10 Aug 2019 11:53:12 +0300 -Subject: [PATCH 3/3] smbtorture: extend rpc.lsa to lookup machine over - forest-wide LookupNames - -Add a simple test to resolve DOMAIN\MACHINE$ via LSA LookupNames3 -using LSA_LOOKUP_NAMES_UPLEVEL_TRUSTS_ONLY2 level. This level would pass -zero lookup flags to lookup_name(). - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14091 - -Signed-off-by: Alexander Bokovoy -Reviewed-by: Andreas Schneider - -Autobuild-User(master): Alexander Bokovoy -Autobuild-Date(master): Wed Aug 14 13:07:42 UTC 2019 on sn-devel-184 - -(cherry picked from commit 4d276a93fc624dc04d880f5b4157f272d3555be6) ---- - source4/torture/rpc/lsa.c | 8 +++++++- - 1 file changed, 7 insertions(+), 1 deletion(-) - -diff --git a/source4/torture/rpc/lsa.c b/source4/torture/rpc/lsa.c -index b7dd0dc8c91..21cc16afbaf 100644 ---- a/source4/torture/rpc/lsa.c -+++ b/source4/torture/rpc/lsa.c -@@ -4794,7 +4794,7 @@ static bool test_QueryInfoPolicyCalls( bool version2, - || i == LSA_POLICY_INFO_DNS_INT)) { - /* Let's look up some of these names */ - -- struct lsa_TransNameArray tnames; -+ struct lsa_TransNameArray tnames, dnames; - tnames.count = 14; - tnames.names = talloc_zero_array(tctx, struct lsa_TranslatedName, tnames.count); - tnames.names[0].name.string = info->dns.name.string; -@@ -4827,6 +4827,12 @@ static bool test_QueryInfoPolicyCalls( bool version2, - tnames.names[13].sid_type = SID_NAME_USER; - ret &= test_LookupNames(b, tctx, handle, LSA_LOOKUP_NAMES_ALL, &tnames); - -+ /* Try to use in-forest search for the test machine */ -+ dnames.count = 1; -+ dnames.names = talloc_zero_array(tctx, struct lsa_TranslatedName, dnames.count); -+ dnames.names[0].name.string = talloc_asprintf(tctx, "%s\\"TEST_MACHINENAME "$", info->dns.name.string); -+ dnames.names[0].sid_type = SID_NAME_USER; -+ ret &= test_LookupNames(b, tctx, handle, LSA_LOOKUP_NAMES_UPLEVEL_TRUSTS_ONLY2, &dnames); - } - } - --- -2.21.0 - diff --git a/samba.spec b/samba.spec index 8691f44..97d8737 100644 --- a/samba.spec +++ b/samba.spec @@ -10,11 +10,11 @@ %define samba_version 4.11.0 %define talloc_version 2.2.0 -%define tdb_version 1.4.1 +%define tdb_version 1.4.2 %define tevent_version 0.10.0 %define ldb_version 2.0.5 # This should be rc1 or nil -%define pre_release rc1 +%define pre_release rc2 %if "x%{?pre_release}" != "x" %define samba_release 0.%{main_release}.%{pre_release}%{?dist} @@ -118,8 +118,6 @@ Source14: samba.pamd Source201: README.downgrade -Patch0: samba-bz14091-v4.10-backport.patch - Requires(pre): /usr/sbin/groupadd Requires(post): systemd Requires(preun): systemd @@ -574,21 +572,6 @@ The python3-%{name}-dc package contains the Python libraries needed by programs to manage Samba AD. %endif -### PIDL -%package pidl -Summary: Perl IDL compiler -Requires: perl-interpreter -Requires: perl(Parse::Yapp) -Requires: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version)) -BuildArch: noarch - -Provides: samba4-pidl = %{samba_depver} -Obsoletes: samba4-pidl < %{samba_depver} - -%description pidl -The %{name}-pidl package contains the Perl IDL compiler used by Samba -and Wireshark to parse IDL and similar protocols - ### TEST %package test Summary: Testing tools for Samba servers and clients @@ -1232,6 +1215,7 @@ fi %{_libdir}/samba/vfs/fileid.so %{_libdir}/samba/vfs/fruit.so %{_libdir}/samba/vfs/full_audit.so +%{_libdir}/samba/vfs/gpfs.so %{_libdir}/samba/vfs/glusterfs_fuse.so %{_libdir}/samba/vfs/linux_xfs_sgid.so %{_libdir}/samba/vfs/media_harmony.so @@ -1281,6 +1265,7 @@ fi %{_mandir}/man8/vfs_fileid.8* %{_mandir}/man8/vfs_fruit.8* %{_mandir}/man8/vfs_full_audit.8* +%{_mandir}/man8/vfs_gpfs.8* %{_mandir}/man8/vfs_glusterfs_fuse.8* %{_mandir}/man8/vfs_linux_xfs_sgid.8* %{_mandir}/man8/vfs_media_harmony.8* @@ -1309,6 +1294,7 @@ fi %if ! %{with_vfs_cephfs} %exclude %{_mandir}/man8/vfs_ceph.8* +%exclude %{_mandir}/man8/vfs_ceph_snapshots.8* %endif %attr(775,root,printadmin) %dir /var/lib/samba/drivers @@ -1411,6 +1397,7 @@ fi %{_libdir}/samba/libgenrand-samba4.so %{_libdir}/samba/libgensec-samba4.so %{_libdir}/samba/libgpext-samba4.so +%{_libdir}/samba/libgpo-samba4.so %{_libdir}/samba/libgse-samba4.so %{_libdir}/samba/libhttp-samba4.so %{_libdir}/samba/libinterfaces-samba4.so @@ -1431,6 +1418,7 @@ fi %{_libdir}/samba/libnetif-samba4.so %{_libdir}/samba/libnpa-tstream-samba4.so %{_libdir}/samba/libposix-eadb-samba4.so +%{_libdir}/samba/libprinter-driver-samba4.so %{_libdir}/samba/libprinting-migrate-samba4.so %{_libdir}/samba/libreplace-samba4.so %{_libdir}/samba/libregistry-samba4.so @@ -1546,6 +1534,7 @@ fi %{_libdir}/samba/ldb/aclread.so %{_libdir}/samba/ldb/anr.so %{_libdir}/samba/ldb/audit_log.so +%{_libdir}/samba/ldb/count_attrs.so %{_libdir}/samba/ldb/descriptor.so %{_libdir}/samba/ldb/dirsync.so %{_libdir}/samba/ldb/dns_notify.so @@ -1618,7 +1607,6 @@ fi %{_libdir}/samba/service/nbtd.so %{_libdir}/samba/service/ntp_signd.so %{_libdir}/samba/service/s3fs.so -%{_libdir}/samba/service/web.so %{_libdir}/samba/service/winbindd.so %{_libdir}/samba/service/wrepl.so %{_libdir}/libdcerpc-server.so.* @@ -1769,7 +1757,9 @@ fi %if %{with_vfs_cephfs} %files vfs-cephfs %{_libdir}/samba/vfs/ceph.so +%{_libdir}/samba/vfs/ceph_snapshots.so %{_mandir}/man8/vfs_ceph.8* +%{_mandir}/man8/vfs_ceph_snapshots.8* %endif ### VFS-GLUSTERFS @@ -1793,7 +1783,6 @@ fi %{_libdir}/samba/libauth4-samba4.so %{_libdir}/samba/libauth-unix-token-samba4.so %{_libdir}/samba/libdcerpc-samba4.so -%{_libdir}/samba/libnon-posix-acls-samba4.so %{_libdir}/samba/libshares-samba4.so %{_libdir}/samba/libsmbpasswdparser-samba4.so %{_libdir}/samba/libxattr-tdb-samba4.so @@ -1824,44 +1813,6 @@ fi %{_libdir}/pkgconfig/wbclient.pc %endif # with_libwbclient -### PIDL -%files pidl -%attr(755,root,root) %{_bindir}/pidl -%dir %{perl_vendorlib}/Parse -%{perl_vendorlib}/Parse/Pidl.pm -%dir %{perl_vendorlib}/Parse/Pidl -%{perl_vendorlib}/Parse/Pidl/CUtil.pm -%{perl_vendorlib}/Parse/Pidl/Samba4.pm -%{perl_vendorlib}/Parse/Pidl/Expr.pm -%{perl_vendorlib}/Parse/Pidl/ODL.pm -%{perl_vendorlib}/Parse/Pidl/Typelist.pm -%{perl_vendorlib}/Parse/Pidl/IDL.pm -%{perl_vendorlib}/Parse/Pidl/Compat.pm -%dir %{perl_vendorlib}/Parse/Pidl/Wireshark -%{perl_vendorlib}/Parse/Pidl/Wireshark/Conformance.pm -%{perl_vendorlib}/Parse/Pidl/Wireshark/NDR.pm -%{perl_vendorlib}/Parse/Pidl/Dump.pm -%dir %{perl_vendorlib}/Parse/Pidl/Samba3 -%{perl_vendorlib}/Parse/Pidl/Samba3/ServerNDR.pm -%{perl_vendorlib}/Parse/Pidl/Samba3/ClientNDR.pm -%dir %{perl_vendorlib}/Parse/Pidl/Samba4 -%{perl_vendorlib}/Parse/Pidl/Samba4/Header.pm -%dir %{perl_vendorlib}/Parse/Pidl/Samba4/COM -%{perl_vendorlib}/Parse/Pidl/Samba4/COM/Header.pm -%{perl_vendorlib}/Parse/Pidl/Samba4/COM/Proxy.pm -%{perl_vendorlib}/Parse/Pidl/Samba4/COM/Stub.pm -%{perl_vendorlib}/Parse/Pidl/Samba4/Python.pm -%{perl_vendorlib}/Parse/Pidl/Samba4/Template.pm -%dir %{perl_vendorlib}/Parse/Pidl/Samba4/NDR -%{perl_vendorlib}/Parse/Pidl/Samba4/NDR/Server.pm -%{perl_vendorlib}/Parse/Pidl/Samba4/NDR/Client.pm -%{perl_vendorlib}/Parse/Pidl/Samba4/NDR/Parser.pm -%{perl_vendorlib}/Parse/Pidl/Samba4/TDR.pm -%{perl_vendorlib}/Parse/Pidl/NDR.pm -%{perl_vendorlib}/Parse/Pidl/Util.pm -%{_mandir}/man1/pidl* -%{_mandir}/man3/Parse::Pidl* - ### PYTHON3 %files -n python3-%{name} %dir %{python3_sitearch}/samba/ @@ -1996,6 +1947,7 @@ fi %{python3_sitearch}/samba/netcmd/__pycache__/__init__.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/common.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/computer.*.pyc +%{python3_sitearch}/samba/netcmd/__pycache__/contact.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/dbcheck.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/delegation.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/dns.*.pyc @@ -2023,6 +1975,7 @@ fi %{python3_sitearch}/samba/netcmd/__pycache__/visualize.*.pyc %{python3_sitearch}/samba/netcmd/common.py %{python3_sitearch}/samba/netcmd/computer.py +%{python3_sitearch}/samba/netcmd/contact.py %{python3_sitearch}/samba/netcmd/dbcheck.py %{python3_sitearch}/samba/netcmd/delegation.py %{python3_sitearch}/samba/netcmd/dns.py @@ -2063,7 +2016,6 @@ fi %{python3_sitearch}/samba/samba3/smbd.*.so %{python3_sitearch}/samba/sd_utils.py %{python3_sitearch}/samba/sites.py -%{python3_sitearch}/samba/smb.*.so %{python3_sitearch}/samba/subnets.py %dir %{python3_sitearch}/samba/subunit %{python3_sitearch}/samba/subunit/__init__.py @@ -2078,10 +2030,6 @@ fi %{python3_sitearch}/samba/third_party/__pycache__/__init__.*.pyc %{python3_sitearch}/samba/upgrade.py %{python3_sitearch}/samba/upgradehelpers.py -%dir %{python3_sitearch}/samba/web_server -%{python3_sitearch}/samba/web_server/__init__.py -%dir %{python3_sitearch}/samba/web_server/__pycache__ -%{python3_sitearch}/samba/web_server/__pycache__/__init__.*.pyc %{python3_sitearch}/samba/werror.*.so %{python3_sitearch}/samba/xattr.py %{python3_sitearch}/samba/xattr_native.*.so @@ -2177,6 +2125,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/auth_log_netlogon.*.pyc %{python3_sitearch}/samba/tests/__pycache__/auth_log_netlogon_bad_creds.*.pyc %{python3_sitearch}/samba/tests/__pycache__/auth_log_samlogon.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/auth_log_winbind.*.pyc %{python3_sitearch}/samba/tests/__pycache__/common.*.pyc %{python3_sitearch}/samba/tests/__pycache__/complex_expressions.*.pyc %{python3_sitearch}/samba/tests/__pycache__/core.*.pyc @@ -2249,6 +2198,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/samdb.*.pyc %{python3_sitearch}/samba/tests/__pycache__/samdb_api.*.pyc %{python3_sitearch}/samba/tests/__pycache__/security.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/segfault.*.pyc %{python3_sitearch}/samba/tests/__pycache__/smb.*.pyc %{python3_sitearch}/samba/tests/__pycache__/smbd_base.*.pyc %{python3_sitearch}/samba/tests/__pycache__/source.*.pyc @@ -2258,6 +2208,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/upgrade.*.pyc %{python3_sitearch}/samba/tests/__pycache__/upgradeprovision.*.pyc %{python3_sitearch}/samba/tests/__pycache__/upgradeprovisionneeddc.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/usage.*.pyc %{python3_sitearch}/samba/tests/__pycache__/xattr.*.pyc %{python3_sitearch}/samba/tests/audit_log_base.py %{python3_sitearch}/samba/tests/audit_log_dsdb.py @@ -2270,12 +2221,14 @@ fi %{python3_sitearch}/samba/tests/auth_log_netlogon.py %{python3_sitearch}/samba/tests/auth_log_pass_change.py %{python3_sitearch}/samba/tests/auth_log_samlogon.py +%{python3_sitearch}/samba/tests/auth_log_winbind.py %dir %{python3_sitearch}/samba/tests/blackbox %{python3_sitearch}/samba/tests/blackbox/__init__.py %dir %{python3_sitearch}/samba/tests/blackbox/__pycache__ %{python3_sitearch}/samba/tests/blackbox/__pycache__/__init__.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/bug13653.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/check_output.*.pyc +%{python3_sitearch}/samba/tests/blackbox/__pycache__/downgradedatabase.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/ndrdump.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/netads_json.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/samba_dnsupdate.*.pyc @@ -2286,6 +2239,7 @@ fi %{python3_sitearch}/samba/tests/blackbox/__pycache__/traffic_summary.*.pyc %{python3_sitearch}/samba/tests/blackbox/bug13653.py %{python3_sitearch}/samba/tests/blackbox/check_output.py +%{python3_sitearch}/samba/tests/blackbox/downgradedatabase.py %{python3_sitearch}/samba/tests/blackbox/ndrdump.py %{python3_sitearch}/samba/tests/blackbox/netads_json.py %{python3_sitearch}/samba/tests/blackbox/samba_dnsupdate.py @@ -2337,9 +2291,7 @@ fi %{python3_sitearch}/samba/tests/dns_base.py %{python3_sitearch}/samba/tests/dns_forwarder.py %dir %{python3_sitearch}/samba/tests/dns_forwarder_helpers -%{python3_sitearch}/samba/tests/dns_forwarder_helpers/__pycache__/dns_hub.*.pyc %{python3_sitearch}/samba/tests/dns_forwarder_helpers/__pycache__/server.*.pyc -%{python3_sitearch}/samba/tests/dns_forwarder_helpers/dns_hub.py %{python3_sitearch}/samba/tests/dns_forwarder_helpers/server.py %{python3_sitearch}/samba/tests/dns_invalid.py %{python3_sitearch}/samba/tests/dns_tkey.py @@ -2428,18 +2380,24 @@ fi %{python3_sitearch}/samba/tests/samba_tool/__pycache__/__init__.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/base.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/computer.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/contact.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/demote.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/dnscmd.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/drs_clone_dc_data_lmdb_size.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/dsacl.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/forest.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/fsmo.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/gpo.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/group.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/help.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/join.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/join_lmdb_size.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/ntacl.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/ou.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/passwordsettings.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/processes.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/promote_dc_lmdb_size.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/provision_lmdb_size.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/provision_password_check.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/rodc.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/schema.*.pyc @@ -2453,18 +2411,24 @@ fi %{python3_sitearch}/samba/tests/samba_tool/__pycache__/visualize_drs.*.pyc %{python3_sitearch}/samba/tests/samba_tool/base.py %{python3_sitearch}/samba/tests/samba_tool/computer.py +%{python3_sitearch}/samba/tests/samba_tool/contact.py %{python3_sitearch}/samba/tests/samba_tool/demote.py %{python3_sitearch}/samba/tests/samba_tool/dnscmd.py +%{python3_sitearch}/samba/tests/samba_tool/drs_clone_dc_data_lmdb_size.py +%{python3_sitearch}/samba/tests/samba_tool/dsacl.py %{python3_sitearch}/samba/tests/samba_tool/forest.py %{python3_sitearch}/samba/tests/samba_tool/fsmo.py %{python3_sitearch}/samba/tests/samba_tool/gpo.py %{python3_sitearch}/samba/tests/samba_tool/group.py %{python3_sitearch}/samba/tests/samba_tool/help.py %{python3_sitearch}/samba/tests/samba_tool/join.py +%{python3_sitearch}/samba/tests/samba_tool/join_lmdb_size.py %{python3_sitearch}/samba/tests/samba_tool/ntacl.py %{python3_sitearch}/samba/tests/samba_tool/ou.py %{python3_sitearch}/samba/tests/samba_tool/passwordsettings.py %{python3_sitearch}/samba/tests/samba_tool/processes.py +%{python3_sitearch}/samba/tests/samba_tool/promote_dc_lmdb_size.py +%{python3_sitearch}/samba/tests/samba_tool/provision_lmdb_size.py %{python3_sitearch}/samba/tests/samba_tool/provision_password_check.py %{python3_sitearch}/samba/tests/samba_tool/rodc.py %{python3_sitearch}/samba/tests/samba_tool/schema.py @@ -2479,6 +2443,7 @@ fi %{python3_sitearch}/samba/tests/samdb.py %{python3_sitearch}/samba/tests/samdb_api.py %{python3_sitearch}/samba/tests/security.py +%{python3_sitearch}/samba/tests/segfault.py %{python3_sitearch}/samba/tests/smb.py %{python3_sitearch}/samba/tests/smbd_base.py %{python3_sitearch}/samba/tests/source.py @@ -2488,6 +2453,7 @@ fi %{python3_sitearch}/samba/tests/upgrade.py %{python3_sitearch}/samba/tests/upgradeprovision.py %{python3_sitearch}/samba/tests/upgradeprovisionneeddc.py +%{python3_sitearch}/samba/tests/usage.py %{python3_sitearch}/samba/tests/xattr.py ### TEST @@ -2872,10 +2838,8 @@ fi %{_datadir}/ctdb/tests/eventscripts/05.system.monitor.007.sh %{_datadir}/ctdb/tests/eventscripts/05.system.monitor.011.sh %{_datadir}/ctdb/tests/eventscripts/05.system.monitor.012.sh -%{_datadir}/ctdb/tests/eventscripts/05.system.monitor.013.sh %{_datadir}/ctdb/tests/eventscripts/05.system.monitor.014.sh %{_datadir}/ctdb/tests/eventscripts/05.system.monitor.015.sh -%{_datadir}/ctdb/tests/eventscripts/05.system.monitor.016.sh %{_datadir}/ctdb/tests/eventscripts/05.system.monitor.017.sh %{_datadir}/ctdb/tests/eventscripts/05.system.monitor.018.sh %{_datadir}/ctdb/tests/eventscripts/06.nfs.releaseip.001.sh @@ -3211,6 +3175,7 @@ fi %{_datadir}/ctdb/tests/simple/80_ctdb_traverse.sh %{_datadir}/ctdb/tests/simple/81_tunnel_ring.sh %{_datadir}/ctdb/tests/simple/90_debug_hung_script.sh +%{_datadir}/ctdb/tests/simple/91_version_check.sh %dir %{_datadir}/ctdb/tests/simple/scripts @@ -3439,6 +3404,9 @@ fi %endif # with_clustering_support %changelog +* Wed Aug 21 2019 Guenther Deschner - 4.11.0rc2-0 +- Update to Samba 4.11.0rc2 + * Tue Aug 20 2019 Guenther Deschner - 4.11.0rc1-0 - Update to Samba 4.11.0rc1 diff --git a/sources b/sources index 1b19fc6..423a539 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.11.0rc1.tar.xz) = 618e96d39eeada94675bde0c7ab287fdb59674bb5fe3ae75f62723f87554d3302c1afc00894fe8dea0e227c1e5db07f222307e0062dc0db4ffb885441facbc94 -SHA512 (samba-4.11.0rc1.tar.asc) = eb18a854b7145711ae0a3da32a6006e4bee36d13a74800748521432728f1ba6eca7bdcf94ce1ec3b17d6849527fcf37300a0b5f7ce2e0aa50009de66352cc72a +SHA512 (samba-4.11.0rc2.tar.xz) = bc91fa6d6de0af44a3f8e8438281c7d9e74e7fed981e65f7cd4e9f1ebbc11d25b1cab3dd22fd375f81d620d0f128b0c879028448bdb6a918cd89682a3f828ed8 +SHA512 (samba-4.11.0rc2.tar.asc) = 0472840871106f89e3695098a064004bbcab5e0950252ac41c613f4610a0239471dfa34bae452abf417496eaa3025afc35a28f449f28ba97f4c731e2b4e3390b From 7b283dee16c4d18cb7b6248c4a54d581c1bcd154 Mon Sep 17 00:00:00 2001 From: Lubomir Rintel Date: Thu, 22 Aug 2019 17:36:25 +0200 Subject: [PATCH 04/51] Move the NetworkManager dispatcher script out of /etc It's not user configuration and shouldn't ever have been there. Except for that it used to be the only location NetworkManager looked into. With NetworkManager 1.20 that is no longer the case and the dispatcher scripts can be moved to /usr/lib. --- samba.spec | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/samba.spec b/samba.spec index 97d8737..ad1cdcb 100644 --- a/samba.spec +++ b/samba.spec @@ -6,7 +6,7 @@ # ctdb is enabled by default, you can disable it with: --without clustering %bcond_without clustering -%define main_release 0 +%define main_release 1 %define samba_version 4.11.0 %define talloc_version 2.2.0 @@ -634,6 +634,9 @@ Requires: libwbclient = %{samba_depver} Provides: samba4-winbind = %{samba_depver} Obsoletes: samba4-winbind < %{samba_depver} +# Old NetworkManager expects the dispatcher scripts in a different place +Conflicts: NetworkManager < 1.20 + %description winbind The samba-winbind package provides the winbind NSS library, and some client tools. Winbind enables Linux to be a full member in Windows domains and to use @@ -930,9 +933,9 @@ install -m 0644 ctdb/config/ctdb.service %{buildroot}%{_unitdir} %endif # NetworkManager online/offline script -install -d -m 0755 %{buildroot}%{_sysconfdir}/NetworkManager/dispatcher.d/ +install -d -m 0755 %{buildroot}%{_prefix}/lib/NetworkManager/dispatcher.d/ install -m 0755 packaging/NetworkManager/30-winbind-systemd \ - %{buildroot}%{_sysconfdir}/NetworkManager/dispatcher.d/30-winbind + %{buildroot}%{_prefix}/lib/NetworkManager/dispatcher.d/30-winbind # winbind krb5 plugins install -d -m 0755 %{buildroot}%{_libdir}/krb5/plugins/libkrb5 @@ -2494,7 +2497,7 @@ fi %{_sbindir}/winbindd %attr(750,root,wbpriv) %dir /var/lib/samba/winbindd_privileged %{_unitdir}/winbind.service -%{_sysconfdir}/NetworkManager/dispatcher.d/30-winbind +%{_prefix}/lib/NetworkManager %{_mandir}/man8/winbindd.8* %{_mandir}/man8/idmap_*.8* @@ -3404,6 +3407,9 @@ fi %endif # with_clustering_support %changelog +* Mon Aug 26 2019 Lubomir Rintel - 2:4.11.0-0.1.rc2 +- Move the NetworkManager dispatcher script out of /etc + * Wed Aug 21 2019 Guenther Deschner - 4.11.0rc2-0 - Update to Samba 4.11.0rc2 From ddcbb021850cda13ac3cc3d75da71832f2bf36aa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 29 Aug 2019 13:26:24 +0200 Subject: [PATCH 05/51] re-add pidl resolves: #1746014 Guenther --- pidl.patch | 119 +++++++++++++++++++++++++++++++++++++++++++++++++++++ samba.spec | 60 ++++++++++++++++++++++++++- 2 files changed, 178 insertions(+), 1 deletion(-) create mode 100644 pidl.patch diff --git a/pidl.patch b/pidl.patch new file mode 100644 index 0000000..d61ca6a --- /dev/null +++ b/pidl.patch @@ -0,0 +1,119 @@ +From 838457ac4f9f3f6c1bb5936738566210a62cbdc5 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?G=C3=BCnther=20Deschner?= +Date: Tue, 27 Aug 2019 15:25:13 +0200 +Subject: [PATCH] Revert "waf: install: Remove installation of PIDL and + manpages." + +This reverts commit e24e344d0da58013fd5fa404529fe1d25ef403bf. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14103 + +Guenther + +Signed-off-by: Guenther Deschner +--- + pidl/lib/wscript_build | 37 +++++++++++++++++++++++++++++++++++++ + pidl/wscript | 38 ++++++++++++++++++++++++++++++++++++++ + 2 files changed, 75 insertions(+) + create mode 100644 pidl/lib/wscript_build + +diff --git a/pidl/lib/wscript_build b/pidl/lib/wscript_build +new file mode 100644 +index 00000000000..54b3170c4e2 +--- /dev/null ++++ b/pidl/lib/wscript_build +@@ -0,0 +1,37 @@ ++#!/usr/bin/env python ++ ++# install the pidl modules ++bld.INSTALL_FILES(bld.env.PERL_LIB_INSTALL_DIR, ++ ''' ++ Parse/Pidl.pm ++ Parse/Pidl/Samba4.pm ++ Parse/Pidl/CUtil.pm ++ Parse/Pidl/Expr.pm ++ Parse/Pidl/Wireshark/Conformance.pm ++ Parse/Pidl/Wireshark/NDR.pm ++ Parse/Pidl/ODL.pm ++ Parse/Pidl/Dump.pm ++ Parse/Pidl/Util.pm ++ Parse/Pidl/Samba4/Header.pm ++ Parse/Pidl/Samba4/COM/Header.pm ++ Parse/Pidl/Samba4/COM/Proxy.pm ++ Parse/Pidl/Samba4/COM/Stub.pm ++ Parse/Pidl/Samba4/TDR.pm ++ Parse/Pidl/Samba4/NDR/Server.pm ++ Parse/Pidl/Samba4/NDR/Client.pm ++ Parse/Pidl/Samba4/NDR/Parser.pm ++ Parse/Pidl/Samba4/Python.pm ++ Parse/Pidl/Samba4/Template.pm ++ Parse/Pidl/IDL.pm ++ Parse/Pidl/Typelist.pm ++ Parse/Pidl/Samba3/ClientNDR.pm ++ Parse/Pidl/Samba3/ServerNDR.pm ++ Parse/Pidl/Compat.pm ++ Parse/Pidl/NDR.pm ++ ''', ++ flat=False) ++ ++if not bld.CONFIG_SET('USING_SYSTEM_PARSE_YAPP_DRIVER'): ++ bld.INSTALL_FILES(bld.env.PERL_LIB_INSTALL_DIR, ++ 'Parse/Yapp/Driver.pm', ++ flat=False) +diff --git a/pidl/wscript b/pidl/wscript +index 01b71bd8b27..a2a15d36851 100644 +--- a/pidl/wscript ++++ b/pidl/wscript +@@ -32,11 +32,49 @@ def configure(conf): + # Check if perl(Parse::Yapp::Driver) is available. + check_system_perl_module(conf, "Parse::Yapp::Driver", 1.05) + ++ # we need a recent version of MakeMaker to get the right man page names ++ if conf.CHECK_PERL_MANPAGE(): ++ conf.env.PERLMAN1EXT = conf.CHECK_PERL_MANPAGE(section='1') ++ conf.env.PERLMAN3EXT = conf.CHECK_PERL_MANPAGE(section='3') ++ conf.DEFINE('HAVE_PERL_MAKEMAKER', 1) ++ + # yapp is used for building the parser + conf.find_program('yapp', var='YAPP') + conf.find_program('pod2man', var='POD2MAN') + + def build(bld): ++ bld.INSTALL_FILES('${BINDIR}', 'pidl', chmod=MODE_755, perl_fixup=True) ++ ++ bld.RECURSE('lib') ++ ++ if not bld.CONFIG_SET('HAVE_PERL_MAKEMAKER'): ++ return ++ ++ pidl_manpages = { ++ 'pidl': 'man1/pidl.${PERLMAN1EXT}', ++ 'lib/Parse/Pidl/NDR.pm': 'man3/Parse::Pidl::NDR.${PERLMAN3EXT}', ++ 'lib/Parse/Pidl/Wireshark/Conformance.pm': 'man3/Parse::Pidl::Wireshark::Conformance.${PERLMAN3EXT}', ++ 'lib/Parse/Pidl/Dump.pm': 'man3/Parse::Pidl::Dump.${PERLMAN3EXT}', ++ 'lib/Parse/Pidl/Util.pm': 'man3/Parse::Pidl::Util.${PERLMAN3EXT}', ++ 'lib/Parse/Pidl/Wireshark/NDR.pm': 'man3/Parse::Pidl::Wireshark::NDR.${PERLMAN3EXT}' ++ } ++ ++ for k in pidl_manpages.keys(): ++ pidl_manpages[k] = bld.EXPAND_VARIABLES(pidl_manpages[k]) ++ ++ # use perl to build the manpages ++ bld.env.pidl_srcdir = os.path.join(bld.srcnode.abspath(), 'pidl') ++ ++ bld.SET_BUILD_GROUP('final') ++ if 'POD2MAN' in bld.env and bld.env['POD2MAN'] != '': ++ for src in pidl_manpages.keys(): ++ manpage = pidl_manpages[src] ++ section = manpage.rsplit( ".", 1)[1] ++ bld(rule='${POD2MAN} -c "Samba Documentation" -s %s ${SRC} ${TGT}' % section, ++ shell=True, ++ source=src, ++ install_path=os.path.dirname(bld.EXPAND_VARIABLES('${MANDIR}/'+manpage)), ++ target=os.path.basename(manpage)) + + # we want to prefer the git version of the parsers if we can. + # Only if the source has changed do we want to re-run yapp +-- +2.21.0 + diff --git a/samba.spec b/samba.spec index ad1cdcb..9a88518 100644 --- a/samba.spec +++ b/samba.spec @@ -6,7 +6,7 @@ # ctdb is enabled by default, you can disable it with: --without clustering %bcond_without clustering -%define main_release 1 +%define main_release 2 %define samba_version 4.11.0 %define talloc_version 2.2.0 @@ -118,6 +118,8 @@ Source14: samba.pamd Source201: README.downgrade +Patch0: pidl.patch + Requires(pre): /usr/sbin/groupadd Requires(post): systemd Requires(preun): systemd @@ -572,6 +574,21 @@ The python3-%{name}-dc package contains the Python libraries needed by programs to manage Samba AD. %endif +### PIDL +%package pidl +Summary: Perl IDL compiler +Requires: perl-interpreter +Requires: perl(Parse::Yapp) +Requires: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version)) +BuildArch: noarch + +Provides: samba4-pidl = %{samba_depver} +Obsoletes: samba4-pidl < %{samba_depver} + +%description pidl +The %{name}-pidl package contains the Perl IDL compiler used by Samba +and Wireshark to parse IDL and similar protocols + ### TEST %package test Summary: Testing tools for Samba servers and clients @@ -1816,6 +1833,44 @@ fi %{_libdir}/pkgconfig/wbclient.pc %endif # with_libwbclient +### PIDL +%files pidl +%attr(755,root,root) %{_bindir}/pidl +%dir %{perl_vendorlib}/Parse +%{perl_vendorlib}/Parse/Pidl.pm +%dir %{perl_vendorlib}/Parse/Pidl +%{perl_vendorlib}/Parse/Pidl/CUtil.pm +%{perl_vendorlib}/Parse/Pidl/Samba4.pm +%{perl_vendorlib}/Parse/Pidl/Expr.pm +%{perl_vendorlib}/Parse/Pidl/ODL.pm +%{perl_vendorlib}/Parse/Pidl/Typelist.pm +%{perl_vendorlib}/Parse/Pidl/IDL.pm +%{perl_vendorlib}/Parse/Pidl/Compat.pm +%dir %{perl_vendorlib}/Parse/Pidl/Wireshark +%{perl_vendorlib}/Parse/Pidl/Wireshark/Conformance.pm +%{perl_vendorlib}/Parse/Pidl/Wireshark/NDR.pm +%{perl_vendorlib}/Parse/Pidl/Dump.pm +%dir %{perl_vendorlib}/Parse/Pidl/Samba3 +%{perl_vendorlib}/Parse/Pidl/Samba3/ServerNDR.pm +%{perl_vendorlib}/Parse/Pidl/Samba3/ClientNDR.pm +%dir %{perl_vendorlib}/Parse/Pidl/Samba4 +%{perl_vendorlib}/Parse/Pidl/Samba4/Header.pm +%dir %{perl_vendorlib}/Parse/Pidl/Samba4/COM +%{perl_vendorlib}/Parse/Pidl/Samba4/COM/Header.pm +%{perl_vendorlib}/Parse/Pidl/Samba4/COM/Proxy.pm +%{perl_vendorlib}/Parse/Pidl/Samba4/COM/Stub.pm +%{perl_vendorlib}/Parse/Pidl/Samba4/Python.pm +%{perl_vendorlib}/Parse/Pidl/Samba4/Template.pm +%dir %{perl_vendorlib}/Parse/Pidl/Samba4/NDR +%{perl_vendorlib}/Parse/Pidl/Samba4/NDR/Server.pm +%{perl_vendorlib}/Parse/Pidl/Samba4/NDR/Client.pm +%{perl_vendorlib}/Parse/Pidl/Samba4/NDR/Parser.pm +%{perl_vendorlib}/Parse/Pidl/Samba4/TDR.pm +%{perl_vendorlib}/Parse/Pidl/NDR.pm +%{perl_vendorlib}/Parse/Pidl/Util.pm +%{_mandir}/man1/pidl* +%{_mandir}/man3/Parse::Pidl* + ### PYTHON3 %files -n python3-%{name} %dir %{python3_sitearch}/samba/ @@ -3407,6 +3462,9 @@ fi %endif # with_clustering_support %changelog +* Tue Aug 27 2019 Guenther Deschner - 4.11.0rc2-2 +- resolves: #1746014 - re-add pidl + * Mon Aug 26 2019 Lubomir Rintel - 2:4.11.0-0.1.rc2 - Move the NetworkManager dispatcher script out of /etc From 7e06ae540c408c063b7c750e2b59caf5db074306 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 3 Sep 2019 14:31:58 +0200 Subject: [PATCH 06/51] Update to Samba 4.11.0rc3 resolves: #1746225, #1748308 - Security fixes for CVE-2019-10197 Guenther --- .gitignore | 2 ++ samba.spec | 6 +++++- sources | 4 ++-- 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 90e2be2..891f1df 100644 --- a/.gitignore +++ b/.gitignore @@ -173,3 +173,5 @@ samba-3.6.0pre1.tar.gz /samba-4.11.0rc1.tar.asc /samba-4.11.0rc2.tar.xz /samba-4.11.0rc2.tar.asc +/samba-4.11.0rc3.tar.xz +/samba-4.11.0rc3.tar.asc diff --git a/samba.spec b/samba.spec index 9a88518..c344b33 100644 --- a/samba.spec +++ b/samba.spec @@ -14,7 +14,7 @@ %define tevent_version 0.10.0 %define ldb_version 2.0.5 # This should be rc1 or nil -%define pre_release rc2 +%define pre_release rc3 %if "x%{?pre_release}" != "x" %define samba_release 0.%{main_release}.%{pre_release}%{?dist} @@ -3462,6 +3462,10 @@ fi %endif # with_clustering_support %changelog +* Tue Sep 03 2019 Guenther Deschner - 4.11.0rc3-2 +- Update to Samba 4.11.0rc3 +- resolves: #1746225, #1748308 - Security fixes for CVE-2019-10197 + * Tue Aug 27 2019 Guenther Deschner - 4.11.0rc2-2 - resolves: #1746014 - re-add pidl diff --git a/sources b/sources index 423a539..bcc26d1 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.11.0rc2.tar.xz) = bc91fa6d6de0af44a3f8e8438281c7d9e74e7fed981e65f7cd4e9f1ebbc11d25b1cab3dd22fd375f81d620d0f128b0c879028448bdb6a918cd89682a3f828ed8 -SHA512 (samba-4.11.0rc2.tar.asc) = 0472840871106f89e3695098a064004bbcab5e0950252ac41c613f4610a0239471dfa34bae452abf417496eaa3025afc35a28f449f28ba97f4c731e2b4e3390b +SHA512 (samba-4.11.0rc3.tar.xz) = 75a68eb8e800e67d926abb49da9beaaf99af7064d4731348f05b5857a6b5a2a03e5c8790267491f1f7baec129e22634a9b04cd5d97d2c59f6ec8cef455eecb60 +SHA512 (samba-4.11.0rc3.tar.asc) = acc56ff0acbb95592867201957c6c179e59a619a15b5345868de21ba3c79c5163f576bcdfce2531112db32d67caaf44a42583900fca768ad0a9fc6dbddc9658e From 068248bedae7479fff38f3f8a04b19d33e846354 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 3 Sep 2019 14:44:38 +0200 Subject: [PATCH 07/51] Fix ldb version dependency Guenther --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index c344b33..b97765a 100644 --- a/samba.spec +++ b/samba.spec @@ -12,7 +12,7 @@ %define talloc_version 2.2.0 %define tdb_version 1.4.2 %define tevent_version 0.10.0 -%define ldb_version 2.0.5 +%define ldb_version 2.0.6 # This should be rc1 or nil %define pre_release rc3 From 5e86fbcc8ae717c49bf88a7229c1a6cfceb24f66 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 4 Sep 2019 09:13:29 +0200 Subject: [PATCH 08/51] Add missing files Guenther --- samba.spec | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index b97765a..b67b732 100644 --- a/samba.spec +++ b/samba.spec @@ -1538,9 +1538,10 @@ fi %{_unitdir}/samba.service %{_bindir}/samba-tool %{_sbindir}/samba -%{_sbindir}/samba_kcc %{_sbindir}/samba_dnsupdate +%{_sbindir}/samba_downgrade_db %{_sbindir}/samba-gpupdate +%{_sbindir}/samba_kcc %{_sbindir}/samba_spnupdate %{_sbindir}/samba_upgradedns @@ -1604,6 +1605,7 @@ fi %dir /var/lib/samba/sysvol %{_datadir}/samba/setup %{_mandir}/man8/samba.8* +%{_mandir}/man8/samba_downgrade_db.8* %{_mandir}/man8/samba-gpupdate.8* %{_mandir}/man8/samba-tool.8* From 203ce796bb192410bbae7d37938cf19d5b1c05bf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 11 Sep 2019 10:34:28 +0200 Subject: [PATCH 09/51] Update to Samba 4.11.0rc4 Guenther Signed-off-by: Guenther Deschner --- .gitignore | 2 ++ samba.spec | 8 +++++--- sources | 4 ++-- 3 files changed, 9 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 891f1df..0974f8f 100644 --- a/.gitignore +++ b/.gitignore @@ -175,3 +175,5 @@ samba-3.6.0pre1.tar.gz /samba-4.11.0rc2.tar.asc /samba-4.11.0rc3.tar.xz /samba-4.11.0rc3.tar.asc +/samba-4.11.0rc4.tar.xz +/samba-4.11.0rc4.tar.asc diff --git a/samba.spec b/samba.spec index b67b732..be3ad90 100644 --- a/samba.spec +++ b/samba.spec @@ -12,9 +12,9 @@ %define talloc_version 2.2.0 %define tdb_version 1.4.2 %define tevent_version 0.10.0 -%define ldb_version 2.0.6 +%define ldb_version 2.0.7 # This should be rc1 or nil -%define pre_release rc3 +%define pre_release rc4 %if "x%{?pre_release}" != "x" %define samba_release 0.%{main_release}.%{pre_release}%{?dist} @@ -2736,7 +2736,6 @@ fi %{_libexecdir}/ctdb/tests/sock_io_test %{_libexecdir}/ctdb/tests/srvid_test %{_libexecdir}/ctdb/tests/system_socket_test -%{_libexecdir}/ctdb/tests/test_mutex_raw %{_libexecdir}/ctdb/tests/transaction_loop %{_libexecdir}/ctdb/tests/tunnel_cmd %{_libexecdir}/ctdb/tests/tunnel_test @@ -3464,6 +3463,9 @@ fi %endif # with_clustering_support %changelog +* Wed Sep 11 2019 Guenther Deschner - 4.11.0rc4-2 +- Update to Samba 4.11.0rc4 + * Tue Sep 03 2019 Guenther Deschner - 4.11.0rc3-2 - Update to Samba 4.11.0rc3 - resolves: #1746225, #1748308 - Security fixes for CVE-2019-10197 diff --git a/sources b/sources index bcc26d1..4860408 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.11.0rc3.tar.xz) = 75a68eb8e800e67d926abb49da9beaaf99af7064d4731348f05b5857a6b5a2a03e5c8790267491f1f7baec129e22634a9b04cd5d97d2c59f6ec8cef455eecb60 -SHA512 (samba-4.11.0rc3.tar.asc) = acc56ff0acbb95592867201957c6c179e59a619a15b5345868de21ba3c79c5163f576bcdfce2531112db32d67caaf44a42583900fca768ad0a9fc6dbddc9658e +SHA512 (samba-4.11.0rc4.tar.xz) = 630ac4f80cc385bd2a168cd0f97b923cf4d8dfb64c7e0540cdc98261b17b1ce6e754f8e6fcecc662c1baf2e2f0c70556ce5f7a2cc6f133199fee821be3210883 +SHA512 (samba-4.11.0rc4.tar.asc) = c1e9eb34ce44195b4e653a024b07d816180ef5a2e6165e41bafc0bfe6b9d9b30bd15813b841e8ea2a85e7432f83dc28501fb9b84fb9c19179071fff3df6a13e1 From 4c73b568ce7649ce722549652a15f3e387e6b2e5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 17 Sep 2019 15:35:18 +0200 Subject: [PATCH 10/51] Update to Samba 4.11.0 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 0974f8f..3a6011f 100644 --- a/.gitignore +++ b/.gitignore @@ -177,3 +177,5 @@ samba-3.6.0pre1.tar.gz /samba-4.11.0rc3.tar.asc /samba-4.11.0rc4.tar.xz /samba-4.11.0rc4.tar.asc +/samba-4.11.0.tar.xz +/samba-4.11.0.tar.asc diff --git a/samba.spec b/samba.spec index be3ad90..3182702 100644 --- a/samba.spec +++ b/samba.spec @@ -6,7 +6,7 @@ # ctdb is enabled by default, you can disable it with: --without clustering %bcond_without clustering -%define main_release 2 +%define main_release 3 %define samba_version 4.11.0 %define talloc_version 2.2.0 @@ -14,7 +14,7 @@ %define tevent_version 0.10.0 %define ldb_version 2.0.7 # This should be rc1 or nil -%define pre_release rc4 +%define pre_release %nil %if "x%{?pre_release}" != "x" %define samba_release 0.%{main_release}.%{pre_release}%{?dist} @@ -3463,6 +3463,9 @@ fi %endif # with_clustering_support %changelog +* Tue Sep 17 2019 Guenther Deschner - 4.11.0-3 +- Update to Samba 4.11.0 + * Wed Sep 11 2019 Guenther Deschner - 4.11.0rc4-2 - Update to Samba 4.11.0rc4 diff --git a/sources b/sources index 4860408..549c831 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.11.0rc4.tar.xz) = 630ac4f80cc385bd2a168cd0f97b923cf4d8dfb64c7e0540cdc98261b17b1ce6e754f8e6fcecc662c1baf2e2f0c70556ce5f7a2cc6f133199fee821be3210883 -SHA512 (samba-4.11.0rc4.tar.asc) = c1e9eb34ce44195b4e653a024b07d816180ef5a2e6165e41bafc0bfe6b9d9b30bd15813b841e8ea2a85e7432f83dc28501fb9b84fb9c19179071fff3df6a13e1 +SHA512 (samba-4.11.0.tar.xz) = 7e044c761c342030930f7988f484657664aad269236cb9103aa029540417e34263e47b5910aff8ef3e913fd00bdd375d940b4d24d09ab9244b05ab79c0814ae2 +SHA512 (samba-4.11.0.tar.asc) = 09dfb708b691d3e4d460f8c08b353c6d511c60176b6ff29f4723ea905b05fdd6bcd2a68d62d52f6bcf9514ad6feaf75e1d08b76136852e6f1a944fe814ab763b From b55713591ea719f70d15c443d93f5be5b132e42b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 18 Oct 2019 15:33:17 +0200 Subject: [PATCH 11/51] Update to Samba 4.11.1 Guenther --- .gitignore | 2 ++ pidl.patch | 7 ++----- samba.spec | 7 +++++-- sources | 4 ++-- 4 files changed, 11 insertions(+), 9 deletions(-) diff --git a/.gitignore b/.gitignore index 3a6011f..e48b52c 100644 --- a/.gitignore +++ b/.gitignore @@ -179,3 +179,5 @@ samba-3.6.0pre1.tar.gz /samba-4.11.0rc4.tar.asc /samba-4.11.0.tar.xz /samba-4.11.0.tar.asc +/samba-4.11.1.tar.xz +/samba-4.11.1.tar.asc diff --git a/pidl.patch b/pidl.patch index d61ca6a..889aeb0 100644 --- a/pidl.patch +++ b/pidl.patch @@ -64,7 +64,7 @@ diff --git a/pidl/wscript b/pidl/wscript index 01b71bd8b27..a2a15d36851 100644 --- a/pidl/wscript +++ b/pidl/wscript -@@ -32,11 +32,49 @@ def configure(conf): +@@ -32,10 +32,49 @@ # Check if perl(Parse::Yapp::Driver) is available. check_system_perl_module(conf, "Parse::Yapp::Driver", 1.05) @@ -76,7 +76,7 @@ index 01b71bd8b27..a2a15d36851 100644 + # yapp is used for building the parser conf.find_program('yapp', var='YAPP') - conf.find_program('pod2man', var='POD2MAN') ++ conf.find_program('pod2man', var='POD2MAN') def build(bld): + bld.INSTALL_FILES('${BINDIR}', 'pidl', chmod=MODE_755, perl_fixup=True) @@ -114,6 +114,3 @@ index 01b71bd8b27..a2a15d36851 100644 # we want to prefer the git version of the parsers if we can. # Only if the source has changed do we want to re-run yapp --- -2.21.0 - diff --git a/samba.spec b/samba.spec index 3182702..ef80103 100644 --- a/samba.spec +++ b/samba.spec @@ -6,9 +6,9 @@ # ctdb is enabled by default, you can disable it with: --without clustering %bcond_without clustering -%define main_release 3 +%define main_release 0 -%define samba_version 4.11.0 +%define samba_version 4.11.1 %define talloc_version 2.2.0 %define tdb_version 1.4.2 %define tevent_version 0.10.0 @@ -3463,6 +3463,9 @@ fi %endif # with_clustering_support %changelog +* Fri Oct 18 2019 Guenther Deschner - 4.11.1-0 +- Update to Samba 4.11.1 + * Tue Sep 17 2019 Guenther Deschner - 4.11.0-3 - Update to Samba 4.11.0 diff --git a/sources b/sources index 549c831..aabe097 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.11.0.tar.xz) = 7e044c761c342030930f7988f484657664aad269236cb9103aa029540417e34263e47b5910aff8ef3e913fd00bdd375d940b4d24d09ab9244b05ab79c0814ae2 -SHA512 (samba-4.11.0.tar.asc) = 09dfb708b691d3e4d460f8c08b353c6d511c60176b6ff29f4723ea905b05fdd6bcd2a68d62d52f6bcf9514ad6feaf75e1d08b76136852e6f1a944fe814ab763b +SHA512 (samba-4.11.1.tar.xz) = 4dfdfffdf6412dde7794fae34984b64bed2714b6b6a5e566c93ec00f299b97cf6ceefd362ba98d4b35335f85c8351a644ac54c66955dbf7bf1df7cd30e5274fb +SHA512 (samba-4.11.1.tar.asc) = 7a83c2ddf40bb1095823f2b297af3b7ede686f4e1d81327dc3db358c758a194dac7c243bfe4dae032594998e8a90f50bfc8bc710ef89fc9328a5082db0d4df5d From ffa2b389dc28b701999dd32a37d617e84f9d0591 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Sun, 27 Oct 2019 12:26:30 +0200 Subject: [PATCH 12/51] Both testsuite and AD DC builds require ldb/tdb-tools and python modules (cherry picked from commit e5c09f56c53434005c3ebd929f6f51c33ee2ac65) --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index ef80103..0bfc3e3 100644 --- a/samba.spec +++ b/samba.spec @@ -243,7 +243,7 @@ BuildRequires: python3-tdb >= %{tdb_version} BuildRequires: libldb-devel >= %{ldb_version} BuildRequires: python3-ldb-devel >= %{ldb_version} -%if %{with testsuite} +%if %{with testsuite} || %{with_dc} BuildRequires: ldb-tools BuildRequires: tdb-tools BuildRequires: python3-gpg From 8e580cc182dba1849ab2ec484a1b967523fbbe94 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Sun, 27 Oct 2019 13:23:45 +0200 Subject: [PATCH 13/51] Do not allow DES encryption when using Kerberos MIT Kerberos did remove support for DES. Without removing DES from the default encryption types list we cannot proceed with Samba AD DC creation. Convert internal DES implementation to use GnuTLS instead. (cherry picked from commit e9627e790b9bd71a810531902bc6ab055fbbc392) --- 0000-use-gnutls-for-des-cbc.patch | 371 ++++++++++++++++++ ...andle-removal-des-enctypes-from-krb5.patch | 269 +++++++++++++ samba.spec | 2 + 3 files changed, 642 insertions(+) create mode 100644 0000-use-gnutls-for-des-cbc.patch create mode 100644 0001-handle-removal-des-enctypes-from-krb5.patch diff --git a/0000-use-gnutls-for-des-cbc.patch b/0000-use-gnutls-for-des-cbc.patch new file mode 100644 index 0000000..9180a64 --- /dev/null +++ b/0000-use-gnutls-for-des-cbc.patch @@ -0,0 +1,371 @@ +From 21073bff847fbc41d3dab0a649fa400d8188fa16 Mon Sep 17 00:00:00 2001 +From: Isaac Boukris +Date: Sat, 19 Oct 2019 23:48:19 +0300 +Subject: [PATCH 1/2] smbdes: add des_crypt56_gnutls() using use DES-CBC with + zeroed IV + +Signed-off-by: Isaac Boukris +--- + libcli/auth/smbdes.c | 47 ++++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 47 insertions(+) + +diff --git a/libcli/auth/smbdes.c b/libcli/auth/smbdes.c +index 6d9a6dc2ce8..37ede91ad22 100644 +--- a/libcli/auth/smbdes.c ++++ b/libcli/auth/smbdes.c +@@ -23,6 +23,9 @@ + #include "includes.h" + #include "libcli/auth/libcli_auth.h" + ++#include ++#include ++ + /* NOTES: + + This code makes no attempt to be fast! In fact, it is a very +@@ -273,6 +276,50 @@ static void str_to_key(const uint8_t *str,uint8_t *key) + } + } + ++static int des_crypt56_gnutls(uint8_t out[8], const uint8_t in[8], ++ const uint8_t key_in[7], bool enc) ++{ ++ static uint8_t iv8[8]; ++ gnutls_datum_t iv = { iv8, 8 }; ++ gnutls_datum_t key; ++ gnutls_cipher_hd_t ctx; ++ uint8_t key2[8]; ++ uint8_t outb[8]; ++ int ret; ++ ++ memset(out, 0, 8); ++ ++ str_to_key(key_in, key2); ++ ++ key.data = key2; ++ key.size = 8; ++ ++ ret = gnutls_global_init(); ++ if (ret != 0) { ++ return ret; ++ } ++ ++ ret = gnutls_cipher_init(&ctx, GNUTLS_CIPHER_DES_CBC, &key, &iv); ++ if (ret != 0) { ++ return ret; ++ } ++ ++ memcpy(outb, in, 8); ++ if (enc) { ++ ret = gnutls_cipher_encrypt(ctx, outb, 8); ++ } else { ++ ret = gnutls_cipher_decrypt(ctx, outb, 8); ++ } ++ ++ if (ret == 0) { ++ memcpy(out, outb, 8); ++ } ++ ++ gnutls_cipher_deinit(ctx); ++ ++ return ret; ++} ++ + /* + basic des crypt using a 56 bit (7 byte) key + */ +-- +2.22.0 + + +From 6d6651213f391840e3004ec3b055f8f25be9b360 Mon Sep 17 00:00:00 2001 +From: Isaac Boukris +Date: Mon, 21 Oct 2019 20:03:04 +0300 +Subject: [PATCH 2/2] smbdes: use the new des_crypt56_gnutls() + +and remove builtin DES crypto. + +Signed-off-by: Isaac Boukris +--- + libcli/auth/smbdes.c | 258 +------------------------------------------ + 1 file changed, 1 insertion(+), 257 deletions(-) + +diff --git a/libcli/auth/smbdes.c b/libcli/auth/smbdes.c +index 37ede91ad22..7de05b75303 100644 +--- a/libcli/auth/smbdes.c ++++ b/libcli/auth/smbdes.c +@@ -26,239 +26,6 @@ + #include + #include + +-/* NOTES: +- +- This code makes no attempt to be fast! In fact, it is a very +- slow implementation +- +- This code is NOT a complete DES implementation. It implements only +- the minimum necessary for SMB authentication, as used by all SMB +- products (including every copy of Microsoft Windows95 ever sold) +- +- In particular, it can only do a unchained forward DES pass. This +- means it is not possible to use this code for encryption/decryption +- of data, instead it is only useful as a "hash" algorithm. +- +- There is no entry point into this code that allows normal DES operation. +- +- I believe this means that this code does not come under ITAR +- regulations but this is NOT a legal opinion. If you are concerned +- about the applicability of ITAR regulations to this code then you +- should confirm it for yourself (and maybe let me know if you come +- up with a different answer to the one above) +-*/ +- +- +-static const uint8_t perm1[56] = {57, 49, 41, 33, 25, 17, 9, +- 1, 58, 50, 42, 34, 26, 18, +- 10, 2, 59, 51, 43, 35, 27, +- 19, 11, 3, 60, 52, 44, 36, +- 63, 55, 47, 39, 31, 23, 15, +- 7, 62, 54, 46, 38, 30, 22, +- 14, 6, 61, 53, 45, 37, 29, +- 21, 13, 5, 28, 20, 12, 4}; +- +-static const uint8_t perm2[48] = {14, 17, 11, 24, 1, 5, +- 3, 28, 15, 6, 21, 10, +- 23, 19, 12, 4, 26, 8, +- 16, 7, 27, 20, 13, 2, +- 41, 52, 31, 37, 47, 55, +- 30, 40, 51, 45, 33, 48, +- 44, 49, 39, 56, 34, 53, +- 46, 42, 50, 36, 29, 32}; +- +-static const uint8_t perm3[64] = {58, 50, 42, 34, 26, 18, 10, 2, +- 60, 52, 44, 36, 28, 20, 12, 4, +- 62, 54, 46, 38, 30, 22, 14, 6, +- 64, 56, 48, 40, 32, 24, 16, 8, +- 57, 49, 41, 33, 25, 17, 9, 1, +- 59, 51, 43, 35, 27, 19, 11, 3, +- 61, 53, 45, 37, 29, 21, 13, 5, +- 63, 55, 47, 39, 31, 23, 15, 7}; +- +-static const uint8_t perm4[48] = { 32, 1, 2, 3, 4, 5, +- 4, 5, 6, 7, 8, 9, +- 8, 9, 10, 11, 12, 13, +- 12, 13, 14, 15, 16, 17, +- 16, 17, 18, 19, 20, 21, +- 20, 21, 22, 23, 24, 25, +- 24, 25, 26, 27, 28, 29, +- 28, 29, 30, 31, 32, 1}; +- +-static const uint8_t perm5[32] = { 16, 7, 20, 21, +- 29, 12, 28, 17, +- 1, 15, 23, 26, +- 5, 18, 31, 10, +- 2, 8, 24, 14, +- 32, 27, 3, 9, +- 19, 13, 30, 6, +- 22, 11, 4, 25}; +- +- +-static const uint8_t perm6[64] ={ 40, 8, 48, 16, 56, 24, 64, 32, +- 39, 7, 47, 15, 55, 23, 63, 31, +- 38, 6, 46, 14, 54, 22, 62, 30, +- 37, 5, 45, 13, 53, 21, 61, 29, +- 36, 4, 44, 12, 52, 20, 60, 28, +- 35, 3, 43, 11, 51, 19, 59, 27, +- 34, 2, 42, 10, 50, 18, 58, 26, +- 33, 1, 41, 9, 49, 17, 57, 25}; +- +- +-static const uint8_t sc[16] = {1, 1, 2, 2, 2, 2, 2, 2, 1, 2, 2, 2, 2, 2, 2, 1}; +- +-static const uint8_t sbox[8][4][16] = { +- {{14, 4, 13, 1, 2, 15, 11, 8, 3, 10, 6, 12, 5, 9, 0, 7}, +- {0, 15, 7, 4, 14, 2, 13, 1, 10, 6, 12, 11, 9, 5, 3, 8}, +- {4, 1, 14, 8, 13, 6, 2, 11, 15, 12, 9, 7, 3, 10, 5, 0}, +- {15, 12, 8, 2, 4, 9, 1, 7, 5, 11, 3, 14, 10, 0, 6, 13}}, +- +- {{15, 1, 8, 14, 6, 11, 3, 4, 9, 7, 2, 13, 12, 0, 5, 10}, +- {3, 13, 4, 7, 15, 2, 8, 14, 12, 0, 1, 10, 6, 9, 11, 5}, +- {0, 14, 7, 11, 10, 4, 13, 1, 5, 8, 12, 6, 9, 3, 2, 15}, +- {13, 8, 10, 1, 3, 15, 4, 2, 11, 6, 7, 12, 0, 5, 14, 9}}, +- +- {{10, 0, 9, 14, 6, 3, 15, 5, 1, 13, 12, 7, 11, 4, 2, 8}, +- {13, 7, 0, 9, 3, 4, 6, 10, 2, 8, 5, 14, 12, 11, 15, 1}, +- {13, 6, 4, 9, 8, 15, 3, 0, 11, 1, 2, 12, 5, 10, 14, 7}, +- {1, 10, 13, 0, 6, 9, 8, 7, 4, 15, 14, 3, 11, 5, 2, 12}}, +- +- {{7, 13, 14, 3, 0, 6, 9, 10, 1, 2, 8, 5, 11, 12, 4, 15}, +- {13, 8, 11, 5, 6, 15, 0, 3, 4, 7, 2, 12, 1, 10, 14, 9}, +- {10, 6, 9, 0, 12, 11, 7, 13, 15, 1, 3, 14, 5, 2, 8, 4}, +- {3, 15, 0, 6, 10, 1, 13, 8, 9, 4, 5, 11, 12, 7, 2, 14}}, +- +- {{2, 12, 4, 1, 7, 10, 11, 6, 8, 5, 3, 15, 13, 0, 14, 9}, +- {14, 11, 2, 12, 4, 7, 13, 1, 5, 0, 15, 10, 3, 9, 8, 6}, +- {4, 2, 1, 11, 10, 13, 7, 8, 15, 9, 12, 5, 6, 3, 0, 14}, +- {11, 8, 12, 7, 1, 14, 2, 13, 6, 15, 0, 9, 10, 4, 5, 3}}, +- +- {{12, 1, 10, 15, 9, 2, 6, 8, 0, 13, 3, 4, 14, 7, 5, 11}, +- {10, 15, 4, 2, 7, 12, 9, 5, 6, 1, 13, 14, 0, 11, 3, 8}, +- {9, 14, 15, 5, 2, 8, 12, 3, 7, 0, 4, 10, 1, 13, 11, 6}, +- {4, 3, 2, 12, 9, 5, 15, 10, 11, 14, 1, 7, 6, 0, 8, 13}}, +- +- {{4, 11, 2, 14, 15, 0, 8, 13, 3, 12, 9, 7, 5, 10, 6, 1}, +- {13, 0, 11, 7, 4, 9, 1, 10, 14, 3, 5, 12, 2, 15, 8, 6}, +- {1, 4, 11, 13, 12, 3, 7, 14, 10, 15, 6, 8, 0, 5, 9, 2}, +- {6, 11, 13, 8, 1, 4, 10, 7, 9, 5, 0, 15, 14, 2, 3, 12}}, +- +- {{13, 2, 8, 4, 6, 15, 11, 1, 10, 9, 3, 14, 5, 0, 12, 7}, +- {1, 15, 13, 8, 10, 3, 7, 4, 12, 5, 6, 11, 0, 14, 9, 2}, +- {7, 11, 4, 1, 9, 12, 14, 2, 0, 6, 10, 13, 15, 3, 5, 8}, +- {2, 1, 14, 7, 4, 10, 8, 13, 15, 12, 9, 0, 3, 5, 6, 11}}}; +- +-static void permute(char *out, const char *in, const uint8_t *p, int n) +-{ +- int i; +- for (i=0;i +Date: Mon, 16 Sep 2019 15:17:08 +0300 +Subject: [PATCH 1/5] wip: mit des deprecation: make domain join work + +Signed-off-by: Isaac Boukris +--- + source3/passdb/machine_account_secrets.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/source3/passdb/machine_account_secrets.c b/source3/passdb/machine_account_secrets.c +index dfc21f295a1..8a5cead161c 100644 +--- a/source3/passdb/machine_account_secrets.c ++++ b/source3/passdb/machine_account_secrets.c +@@ -1031,7 +1031,9 @@ static int secrets_domain_info_kerberos_keys(struct secrets_domain_info1_passwor + krb5_keyblock key; + DATA_BLOB aes_256_b = data_blob_null; + DATA_BLOB aes_128_b = data_blob_null; ++#ifdef _KRB5_HAVE_DES + DATA_BLOB des_md5_b = data_blob_null; ++#endif + bool ok; + #endif /* HAVE_ADS */ + DATA_BLOB arc4_b = data_blob_null; +@@ -1177,6 +1179,7 @@ static int secrets_domain_info_kerberos_keys(struct secrets_domain_info1_passwor + return ENOMEM; + } + ++#ifdef _KRB5_HAVE_DES + krb5_ret = smb_krb5_create_key_from_string(krb5_ctx, + NULL, + &salt, +@@ -1202,6 +1205,7 @@ static int secrets_domain_info_kerberos_keys(struct secrets_domain_info1_passwor + TALLOC_FREE(salt_data); + return ENOMEM; + } ++#endif /* _KRB5_HAVE_DES */ + + krb5_free_context(krb5_ctx); + no_kerberos: +@@ -1227,6 +1231,7 @@ no_kerberos: + keys[idx].value = arc4_b; + idx += 1; + ++#ifdef _KRB5_HAVE_DES + #ifdef HAVE_ADS + if (des_md5_b.length != 0) { + keys[idx].keytype = ENCTYPE_DES_CBC_MD5; +@@ -1235,6 +1240,7 @@ no_kerberos: + idx += 1; + } + #endif /* HAVE_ADS */ ++#endif /* _KRB5_HAVE_DES */ + + p->salt_data = salt_data; + p->default_iteration_count = 4096; +-- +2.22.0 + + +From 87be14b6527355e0e85a6cc79f86aee203f2788b Mon Sep 17 00:00:00 2001 +From: Isaac Boukris +Date: Mon, 16 Sep 2019 15:19:05 +0300 +Subject: [PATCH 2/5] wip: mit des deprecation: make provision ad-dc work + +Signed-off-by: Isaac Boukris +--- + source4/auth/kerberos/srv_keytab.c | 11 +++++++++-- + source4/dsdb/samdb/ldb_modules/password_hash.c | 4 ++++ + 2 files changed, 13 insertions(+), 2 deletions(-) + +diff --git a/source4/auth/kerberos/srv_keytab.c b/source4/auth/kerberos/srv_keytab.c +index 52e1e228669..1d2d1bc4fb3 100644 +--- a/source4/auth/kerberos/srv_keytab.c ++++ b/source4/auth/kerberos/srv_keytab.c +@@ -67,6 +67,12 @@ static krb5_error_code keytab_add_keys(TALLOC_CTX *parent_ctx, + for (i = 0; enctypes[i]; i++) { + krb5_keytab_entry entry; + ++#ifndef _KRB5_HAVE_DES ++ if (enctypes[i] == (krb5_enctype) ENCTYPE_DES_CBC_CRC || ++ enctypes[i] == (krb5_enctype) ENCTYPE_DES_CBC_MD5) ++ continue; ++#endif ++ + ZERO_STRUCT(entry); + + ret = smb_krb5_create_key_from_string(context, +@@ -76,8 +82,9 @@ static krb5_error_code keytab_add_keys(TALLOC_CTX *parent_ctx, + enctypes[i], + KRB5_KT_KEY(&entry)); + if (ret != 0) { +- *error_string = talloc_strdup(parent_ctx, +- "Failed to create key from string"); ++ *error_string = talloc_asprintf(parent_ctx, ++ "Failed to create key from string" ++ ", etype: %d", enctypes[i]); + return ret; + } + +diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c +index 006e35c46d5..b1110bb880c 100644 +--- a/source4/dsdb/samdb/ldb_modules/password_hash.c ++++ b/source4/dsdb/samdb/ldb_modules/password_hash.c +@@ -782,6 +782,8 @@ static int setup_kerberos_keys(struct setup_password_fields_io *io) + return ldb_oom(ldb); + } + ++#ifdef _KRB5_HAVE_DES ++ + /* + * create ENCTYPE_DES_CBC_MD5 key out of + * the salt and the cleartext password +@@ -834,6 +836,8 @@ static int setup_kerberos_keys(struct setup_password_fields_io *io) + return ldb_oom(ldb); + } + ++#endif /* _KRB5_HAVE_DES */ ++ + return LDB_SUCCESS; + } + +-- +2.22.0 + + +From 23103018ab1ea0b44e83386e2a451e1aa264ce43 Mon Sep 17 00:00:00 2001 +From: Isaac Boukris +Date: Mon, 16 Sep 2019 15:20:10 +0300 +Subject: [PATCH 3/5] wip: mit des deprecation: make export keytab work + +Signed-off-by: Isaac Boukris +--- + source3/libads/kerberos_keytab.c | 2 ++ + source4/libnet/libnet_export_keytab.c | 6 ++++++ + 2 files changed, 8 insertions(+) + +diff --git a/source3/libads/kerberos_keytab.c b/source3/libads/kerberos_keytab.c +index 97d5535041c..c3b77af7555 100644 +--- a/source3/libads/kerberos_keytab.c ++++ b/source3/libads/kerberos_keytab.c +@@ -240,8 +240,10 @@ int ads_keytab_add_entry(ADS_STRUCT *ads, const char *srvPrinc, bool update_ads) + krb5_data password; + krb5_kvno kvno; + krb5_enctype enctypes[6] = { ++#ifdef _KRB5_HAVE_DES + ENCTYPE_DES_CBC_CRC, + ENCTYPE_DES_CBC_MD5, ++#endif + #ifdef HAVE_ENCTYPE_AES128_CTS_HMAC_SHA1_96 + ENCTYPE_AES128_CTS_HMAC_SHA1_96, + #endif +diff --git a/source4/libnet/libnet_export_keytab.c b/source4/libnet/libnet_export_keytab.c +index 580281a2062..a35f8faeafa 100644 +--- a/source4/libnet/libnet_export_keytab.c ++++ b/source4/libnet/libnet_export_keytab.c +@@ -108,6 +108,12 @@ static NTSTATUS sdb_kt_copy(TALLOC_CTX *mem_ctx, + password.length = KRB5_KEY_LENGTH(&s->key); + password.data = (char *)KRB5_KEY_DATA(&s->key); + ++#ifndef _KRB5_HAVE_DES ++ if (enctype == (krb5_enctype) ENCTYPE_DES_CBC_CRC || ++ enctype == (krb5_enctype) ENCTYPE_DES_CBC_MD5) ++ continue; ++#endif ++ + DBG_INFO("smb_krb5_kt_add_entry for enctype=0x%04x\n", + (int)enctype); + code = smb_krb5_kt_add_entry(context, +-- +2.22.0 + + +From ee9cfc701993c59cea74281b0dcfbfa0f73e7ffd Mon Sep 17 00:00:00 2001 +From: Isaac Boukris +Date: Wed, 2 Oct 2019 13:11:39 +0300 +Subject: [PATCH 4/5] wip: mit des deprecation: skip krb5 DES tests + +Signed-off-by: Isaac Boukris +--- + source4/torture/rpc/remote_pac.c | 5 ++++- + testprogs/blackbox/test_export_keytab_heimdal.sh | 9 +++++---- + 2 files changed, 9 insertions(+), 5 deletions(-) + +diff --git a/source4/torture/rpc/remote_pac.c b/source4/torture/rpc/remote_pac.c +index 7a5cda74b74..50153c113e8 100644 +--- a/source4/torture/rpc/remote_pac.c ++++ b/source4/torture/rpc/remote_pac.c +@@ -581,6 +581,7 @@ static bool test_PACVerify_workstation_aes(struct torture_context *tctx, + NETLOGON_NEG_AUTH2_ADS_FLAGS | NETLOGON_NEG_SUPPORTS_AES); + } + ++#ifdef _KRB5_HAVE_DES + static bool test_PACVerify_workstation_des(struct torture_context *tctx, + struct dcerpc_pipe *p, struct cli_credentials *credentials, struct test_join *join_ctx) + { +@@ -613,6 +614,7 @@ static bool test_PACVerify_workstation_des(struct torture_context *tctx, + TEST_MACHINE_NAME_WKSTA_DES, + NETLOGON_NEG_AUTH2_ADS_FLAGS); + } ++#endif + + #ifdef SAMBA4_USES_HEIMDAL + static NTSTATUS check_primary_group_in_validation(TALLOC_CTX *mem_ctx, +@@ -999,10 +1001,11 @@ struct torture_suite *torture_rpc_remote_pac(TALLOC_CTX *mem_ctx) + tcase = torture_suite_add_machine_workstation_rpc_iface_tcase(suite, "netr-mem-aes", + &ndr_table_netlogon, TEST_MACHINE_NAME_WKSTA); + torture_rpc_tcase_add_test_creds(tcase, "verify-sig-aes", test_PACVerify_workstation_aes); +- ++#ifdef _KRB5_HAVE_DES + tcase = torture_suite_add_machine_workstation_rpc_iface_tcase(suite, "netlogon-member-des", + &ndr_table_netlogon, TEST_MACHINE_NAME_WKSTA_DES); + torture_rpc_tcase_add_test_join(tcase, "verify-sig", test_PACVerify_workstation_des); ++#endif + #ifdef SAMBA4_USES_HEIMDAL + tcase = torture_suite_add_machine_bdc_rpc_iface_tcase(suite, "netr-bdc-arcfour", + &ndr_table_netlogon, TEST_MACHINE_NAME_S4U2SELF_BDC); +diff --git a/testprogs/blackbox/test_export_keytab_heimdal.sh b/testprogs/blackbox/test_export_keytab_heimdal.sh +index cfa245fd4de..6b350d38ca7 100755 +--- a/testprogs/blackbox/test_export_keytab_heimdal.sh ++++ b/testprogs/blackbox/test_export_keytab_heimdal.sh +@@ -50,10 +50,11 @@ test_keytab() { + return $status + fi + +- if [ x$NKEYS != x$expected_nkeys ] ; then +- echo "failure: $testname" +- return 1 +- fi ++ # TODO: get expected_nkeys as script parameter and possibly skip DES ++ #if [ x$NKEYS != x$expected_nkeys ] ; then ++ # echo "failure: $testname" ++ # return 1 ++ #fi + echo "success: $testname" + return 0 + } +-- +2.22.0 + + +From 218369814760c170b2ca95f9d3cbde14dccd8292 Mon Sep 17 00:00:00 2001 +From: Isaac Boukris +Date: Wed, 2 Oct 2019 13:19:38 +0300 +Subject: [PATCH 5/5] wip: mit des deprecation: skip fetching DES keys + +Signed-off-by: Isaac Boukris +--- + source4/kdc/db-glue.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c +index f62a633c6c7..37e3855423a 100644 +--- a/source4/kdc/db-glue.c ++++ b/source4/kdc/db-glue.c +@@ -365,6 +365,10 @@ static krb5_error_code samba_kdc_message2entry_keys(krb5_context context, + supported_enctypes |= ENC_CRC32 | ENC_RSA_MD5 | ENC_RC4_HMAC_MD5; + } + ++#ifndef _KRB5_HAVE_DES ++ supported_enctypes &= ~(ENC_CRC32 | ENC_RSA_MD5); ++#endif ++ + /* Is this the krbtgt or a RODC krbtgt */ + if (is_rodc) { + rodc_krbtgt_number = ldb_msg_find_attr_as_int(msg, "msDS-SecondaryKrbTgtNumber", -1); +-- +2.22.0 + diff --git a/samba.spec b/samba.spec index 0bfc3e3..05e721c 100644 --- a/samba.spec +++ b/samba.spec @@ -119,6 +119,8 @@ Source14: samba.pamd Source201: README.downgrade Patch0: pidl.patch +Patch100: 0000-use-gnutls-for-des-cbc.patch +Patch101: 0001-handle-removal-des-enctypes-from-krb5.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd From f9f065ecbc55ec5dcecfdf3eb92ca3fb5edff769 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Sun, 27 Oct 2019 13:27:03 +0200 Subject: [PATCH 14/51] Correct generated krb5.conf file to actually find own realm (cherry picked from commit a744fc01174aabe29c9c97b81e932d388953456d) --- ...ool-create-working-private-krb5.conf.patch | 42 +++++++++++++++++++ samba.spec | 1 + 2 files changed, 43 insertions(+) create mode 100644 0002-samba-tool-create-working-private-krb5.conf.patch diff --git a/0002-samba-tool-create-working-private-krb5.conf.patch b/0002-samba-tool-create-working-private-krb5.conf.patch new file mode 100644 index 0000000..643d367 --- /dev/null +++ b/0002-samba-tool-create-working-private-krb5.conf.patch @@ -0,0 +1,42 @@ +From 5a084994144704a6c146b94f8a22cf57ce08deab Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Mon, 7 Oct 2019 18:24:28 +0300 +Subject: [PATCH] samba-tool: create working private krb5.conf + +DNS update tool uses private krb5.conf which should have enough details +to authenticate with GSS-TSIG when running nsupdate. + +Unfortunately, the configuration we provide is not enough. We set +defaults to not lookup REALM via DNS but at the same time we don't +provide any realm definition. As result, MIT Kerberos cannot actually +find a working realm for Samba AD deployment because it cannot query DNS +for a realm discovery or pick it up from the configuration. + +Extend private krb5.conf with a realm definition that will allow MIT +Kerberos to look up KDC over DNS. + +Signed-off-by: Alexander Bokovoy +Reviewed-by: Andreas Schneider +--- + source4/setup/krb5.conf | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/source4/setup/krb5.conf b/source4/setup/krb5.conf +index b1bf6cf907d..ad6f2818fb5 100644 +--- a/source4/setup/krb5.conf ++++ b/source4/setup/krb5.conf +@@ -2,3 +2,11 @@ + default_realm = ${REALM} + dns_lookup_realm = false + dns_lookup_kdc = true ++ ++[realms] ++${REALM} = { ++ default_domain = ${DNSDOMAIN} ++} ++ ++[domain_realm] ++ ${HOSTNAME} = ${REALM} +-- +2.21.0 + diff --git a/samba.spec b/samba.spec index 05e721c..6c991ed 100644 --- a/samba.spec +++ b/samba.spec @@ -121,6 +121,7 @@ Source201: README.downgrade Patch0: pidl.patch Patch100: 0000-use-gnutls-for-des-cbc.patch Patch101: 0001-handle-removal-des-enctypes-from-krb5.patch +Patch102: 0002-samba-tool-create-working-private-krb5.conf.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd From 0efc6d4556c7ce1169dc8f38561de9cdfb6d3ee2 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Sun, 27 Oct 2019 13:31:38 +0200 Subject: [PATCH 15/51] Fix deployment of Samba AD DC with MIT Kerberos When DES encryption is not supported in MIT Kerberos, deployment of Samba AD DC fails with "ERROR(ldb): uncaught exception - setup_kerberos_keys: generation of a des-cbc-md5 key failed: Bad encryption type" Fix it by not using DES encryption types in MIT build. Resolves #1757071 (cherry picked from commit 03a27a2599d9b8e7fd9ed38a9f47277c49575968) --- samba.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 6c991ed..af1302c 100644 --- a/samba.spec +++ b/samba.spec @@ -6,7 +6,7 @@ # ctdb is enabled by default, you can disable it with: --without clustering %bcond_without clustering -%define main_release 0 +%define main_release 1 %define samba_version 4.11.1 %define talloc_version 2.2.0 @@ -3466,6 +3466,9 @@ fi %endif # with_clustering_support %changelog +* Sun Oct 27 2019 Alexander Bokovoy - 4.11.1-1 +- resolves: #1757071 - Deploy new samba DC fails + * Fri Oct 18 2019 Guenther Deschner - 4.11.1-0 - Update to Samba 4.11.1 From 581d9525fe221768fd1fa51e1e6839e317b676da Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 29 Oct 2019 11:04:55 +0100 Subject: [PATCH 16/51] Update to Samba 4.11.2 resolves: #1763137, #1766558 - Security fixes for CVE-2019-10218 resolves: #1764126, #1766559 - Security fixes for CVE-2019-14833 Guenther --- .gitignore | 2 ++ samba.spec | 9 +++++++-- sources | 4 ++-- 3 files changed, 11 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index e48b52c..3f4c455 100644 --- a/.gitignore +++ b/.gitignore @@ -181,3 +181,5 @@ samba-3.6.0pre1.tar.gz /samba-4.11.0.tar.asc /samba-4.11.1.tar.xz /samba-4.11.1.tar.asc +/samba-4.11.2.tar.xz +/samba-4.11.2.tar.asc diff --git a/samba.spec b/samba.spec index af1302c..f014520 100644 --- a/samba.spec +++ b/samba.spec @@ -6,9 +6,9 @@ # ctdb is enabled by default, you can disable it with: --without clustering %bcond_without clustering -%define main_release 1 +%define main_release 0 -%define samba_version 4.11.1 +%define samba_version 4.11.2 %define talloc_version 2.2.0 %define tdb_version 1.4.2 %define tevent_version 0.10.0 @@ -3466,6 +3466,11 @@ fi %endif # with_clustering_support %changelog +* Tue Oct 29 2019 Guenther Deschner - 4.11.2-0 +- Update to Samba 4.11.2 +- resolves: #1763137, #1766558 - Security fixes for CVE-2019-10218 +- resolves: #1764126, #1766559 - Security fixes for CVE-2019-14833 + * Sun Oct 27 2019 Alexander Bokovoy - 4.11.1-1 - resolves: #1757071 - Deploy new samba DC fails diff --git a/sources b/sources index aabe097..7c95f4a 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.11.1.tar.xz) = 4dfdfffdf6412dde7794fae34984b64bed2714b6b6a5e566c93ec00f299b97cf6ceefd362ba98d4b35335f85c8351a644ac54c66955dbf7bf1df7cd30e5274fb -SHA512 (samba-4.11.1.tar.asc) = 7a83c2ddf40bb1095823f2b297af3b7ede686f4e1d81327dc3db358c758a194dac7c243bfe4dae032594998e8a90f50bfc8bc710ef89fc9328a5082db0d4df5d +SHA512 (samba-4.11.2.tar.xz) = 077fa15f8c25560592b4270c2c5b356c4b2f8d63bba664dca67bf7def0b4cf4f2275984c56796161166b9835f4e388c411fb91f3c17537c4b5fb566a21795d12 +SHA512 (samba-4.11.2.tar.asc) = 95c6225008cb3a2361cfab0f9d7138b012e053cb66e2a40a27abc103064b96e05e969d53a31a5c64096a669654564329e4b94dc9f6c99342b53d1def76a6c65f From edd18636524d7d8aa1c021055769620e70ee41ab Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 30 Oct 2019 14:07:14 +0100 Subject: [PATCH 17/51] Fix building without addc --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index f014520..1b2cad8 100644 --- a/samba.spec +++ b/samba.spec @@ -968,6 +968,7 @@ for i in \ %{_libdir}/samba/libdsdb-garbage-collect-tombstones-samba4.so \ %{_libdir}/samba/libscavenge-dns-records-samba4.so \ %{_mandir}/man8/samba.8 \ + %{_mandir}/man8/samba_downgrade_db.8 \ %{_mandir}/man8/samba-tool.8 \ %{_mandir}/man8/samba-gpupdate.8 \ %{_libdir}/samba/ldb/ildap.so \ From 0316af4dc419a4936b64ffd1200143d73c843136 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Wed, 6 Nov 2019 12:43:05 +0200 Subject: [PATCH 18/51] Rebase no-DES patch for 4.11.2 --- ...andle-removal-des-enctypes-from-krb5.patch | 511 ++++++++++-------- samba.spec | 5 +- 2 files changed, 282 insertions(+), 234 deletions(-) diff --git a/0001-handle-removal-des-enctypes-from-krb5.patch b/0001-handle-removal-des-enctypes-from-krb5.patch index 1049051..0475323 100644 --- a/0001-handle-removal-des-enctypes-from-krb5.patch +++ b/0001-handle-removal-des-enctypes-from-krb5.patch @@ -1,269 +1,314 @@ -From a0c67e662ba353f7dbc5bde7192bfd790722090f Mon Sep 17 00:00:00 2001 +From 3828e798da8e0b44356039dd927f0624d5d182f9 Mon Sep 17 00:00:00 2001 From: Isaac Boukris -Date: Mon, 16 Sep 2019 15:17:08 +0300 -Subject: [PATCH 1/5] wip: mit des deprecation: make domain join work +Date: Wed, 6 Nov 2019 12:12:55 +0200 +Subject: [PATCH] Remove DES support if MIT Kerberos version does not support + it -Signed-off-by: Isaac Boukris --- - source3/passdb/machine_account_secrets.c | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/source3/passdb/machine_account_secrets.c b/source3/passdb/machine_account_secrets.c -index dfc21f295a1..8a5cead161c 100644 ---- a/source3/passdb/machine_account_secrets.c -+++ b/source3/passdb/machine_account_secrets.c -@@ -1031,7 +1031,9 @@ static int secrets_domain_info_kerberos_keys(struct secrets_domain_info1_passwor - krb5_keyblock key; - DATA_BLOB aes_256_b = data_blob_null; - DATA_BLOB aes_128_b = data_blob_null; -+#ifdef _KRB5_HAVE_DES - DATA_BLOB des_md5_b = data_blob_null; -+#endif - bool ok; - #endif /* HAVE_ADS */ - DATA_BLOB arc4_b = data_blob_null; -@@ -1177,6 +1179,7 @@ static int secrets_domain_info_kerberos_keys(struct secrets_domain_info1_passwor - return ENOMEM; - } - -+#ifdef _KRB5_HAVE_DES - krb5_ret = smb_krb5_create_key_from_string(krb5_ctx, - NULL, - &salt, -@@ -1202,6 +1205,7 @@ static int secrets_domain_info_kerberos_keys(struct secrets_domain_info1_passwor - TALLOC_FREE(salt_data); - return ENOMEM; - } -+#endif /* _KRB5_HAVE_DES */ - - krb5_free_context(krb5_ctx); - no_kerberos: -@@ -1227,6 +1231,7 @@ no_kerberos: - keys[idx].value = arc4_b; - idx += 1; - -+#ifdef _KRB5_HAVE_DES - #ifdef HAVE_ADS - if (des_md5_b.length != 0) { - keys[idx].keytype = ENCTYPE_DES_CBC_MD5; -@@ -1235,6 +1240,7 @@ no_kerberos: - idx += 1; - } - #endif /* HAVE_ADS */ -+#endif /* _KRB5_HAVE_DES */ - - p->salt_data = salt_data; - p->default_iteration_count = 4096; --- -2.22.0 - - -From 87be14b6527355e0e85a6cc79f86aee203f2788b Mon Sep 17 00:00:00 2001 -From: Isaac Boukris -Date: Mon, 16 Sep 2019 15:19:05 +0300 -Subject: [PATCH 2/5] wip: mit des deprecation: make provision ad-dc work - -Signed-off-by: Isaac Boukris ---- - source4/auth/kerberos/srv_keytab.c | 11 +++++++++-- - source4/dsdb/samdb/ldb_modules/password_hash.c | 4 ++++ - 2 files changed, 13 insertions(+), 2 deletions(-) - -diff --git a/source4/auth/kerberos/srv_keytab.c b/source4/auth/kerberos/srv_keytab.c -index 52e1e228669..1d2d1bc4fb3 100644 ---- a/source4/auth/kerberos/srv_keytab.c -+++ b/source4/auth/kerberos/srv_keytab.c -@@ -67,6 +67,12 @@ static krb5_error_code keytab_add_keys(TALLOC_CTX *parent_ctx, - for (i = 0; enctypes[i]; i++) { - krb5_keytab_entry entry; - -+#ifndef _KRB5_HAVE_DES -+ if (enctypes[i] == (krb5_enctype) ENCTYPE_DES_CBC_CRC || -+ enctypes[i] == (krb5_enctype) ENCTYPE_DES_CBC_MD5) -+ continue; -+#endif -+ - ZERO_STRUCT(entry); - - ret = smb_krb5_create_key_from_string(context, -@@ -76,8 +82,9 @@ static krb5_error_code keytab_add_keys(TALLOC_CTX *parent_ctx, - enctypes[i], - KRB5_KT_KEY(&entry)); - if (ret != 0) { -- *error_string = talloc_strdup(parent_ctx, -- "Failed to create key from string"); -+ *error_string = talloc_asprintf(parent_ctx, -+ "Failed to create key from string" -+ ", etype: %d", enctypes[i]); - return ret; - } - -diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c -index 006e35c46d5..b1110bb880c 100644 ---- a/source4/dsdb/samdb/ldb_modules/password_hash.c -+++ b/source4/dsdb/samdb/ldb_modules/password_hash.c -@@ -782,6 +782,8 @@ static int setup_kerberos_keys(struct setup_password_fields_io *io) - return ldb_oom(ldb); - } - -+#ifdef _KRB5_HAVE_DES -+ - /* - * create ENCTYPE_DES_CBC_MD5 key out of - * the salt and the cleartext password -@@ -834,6 +836,8 @@ static int setup_kerberos_keys(struct setup_password_fields_io *io) - return ldb_oom(ldb); - } - -+#endif /* _KRB5_HAVE_DES */ -+ - return LDB_SUCCESS; - } - --- -2.22.0 - - -From 23103018ab1ea0b44e83386e2a451e1aa264ce43 Mon Sep 17 00:00:00 2001 -From: Isaac Boukris -Date: Mon, 16 Sep 2019 15:20:10 +0300 -Subject: [PATCH 3/5] wip: mit des deprecation: make export keytab work - -Signed-off-by: Isaac Boukris ---- - source3/libads/kerberos_keytab.c | 2 ++ - source4/libnet/libnet_export_keytab.c | 6 ++++++ - 2 files changed, 8 insertions(+) + source3/libads/kerberos_keytab.c | 2 - + source3/passdb/machine_account_secrets.c | 36 ------------------ + source4/auth/kerberos/kerberos.h | 2 +- + .../dsdb/samdb/ldb_modules/password_hash.c | 12 ++++++ + source4/kdc/db-glue.c | 4 +- + source4/torture/rpc/remote_pac.c | 37 ------------------- + testprogs/blackbox/dbcheck-oldrelease.sh | 2 +- + testprogs/blackbox/functionalprep.sh | 2 +- + .../blackbox/test_export_keytab_heimdal.sh | 16 ++++---- + .../blackbox/upgradeprovision-oldrelease.sh | 2 +- + 10 files changed, 26 insertions(+), 89 deletions(-) diff --git a/source3/libads/kerberos_keytab.c b/source3/libads/kerberos_keytab.c -index 97d5535041c..c3b77af7555 100644 +index 97d5535041c..7d193e1a600 100644 --- a/source3/libads/kerberos_keytab.c +++ b/source3/libads/kerberos_keytab.c -@@ -240,8 +240,10 @@ int ads_keytab_add_entry(ADS_STRUCT *ads, const char *srvPrinc, bool update_ads) +@@ -240,8 +240,6 @@ int ads_keytab_add_entry(ADS_STRUCT *ads, const char *srvPrinc, bool update_ads) krb5_data password; krb5_kvno kvno; krb5_enctype enctypes[6] = { -+#ifdef _KRB5_HAVE_DES - ENCTYPE_DES_CBC_CRC, - ENCTYPE_DES_CBC_MD5, -+#endif +- ENCTYPE_DES_CBC_CRC, +- ENCTYPE_DES_CBC_MD5, #ifdef HAVE_ENCTYPE_AES128_CTS_HMAC_SHA1_96 ENCTYPE_AES128_CTS_HMAC_SHA1_96, #endif -diff --git a/source4/libnet/libnet_export_keytab.c b/source4/libnet/libnet_export_keytab.c -index 580281a2062..a35f8faeafa 100644 ---- a/source4/libnet/libnet_export_keytab.c -+++ b/source4/libnet/libnet_export_keytab.c -@@ -108,6 +108,12 @@ static NTSTATUS sdb_kt_copy(TALLOC_CTX *mem_ctx, - password.length = KRB5_KEY_LENGTH(&s->key); - password.data = (char *)KRB5_KEY_DATA(&s->key); +diff --git a/source3/passdb/machine_account_secrets.c b/source3/passdb/machine_account_secrets.c +index dfc21f295a1..efba80f1474 100644 +--- a/source3/passdb/machine_account_secrets.c ++++ b/source3/passdb/machine_account_secrets.c +@@ -1031,7 +1031,6 @@ static int secrets_domain_info_kerberos_keys(struct secrets_domain_info1_passwor + krb5_keyblock key; + DATA_BLOB aes_256_b = data_blob_null; + DATA_BLOB aes_128_b = data_blob_null; +- DATA_BLOB des_md5_b = data_blob_null; + bool ok; + #endif /* HAVE_ADS */ + DATA_BLOB arc4_b = data_blob_null; +@@ -1177,32 +1176,6 @@ static int secrets_domain_info_kerberos_keys(struct secrets_domain_info1_passwor + return ENOMEM; + } -+#ifndef _KRB5_HAVE_DES -+ if (enctype == (krb5_enctype) ENCTYPE_DES_CBC_CRC || -+ enctype == (krb5_enctype) ENCTYPE_DES_CBC_MD5) -+ continue; +- krb5_ret = smb_krb5_create_key_from_string(krb5_ctx, +- NULL, +- &salt, +- &cleartext_utf8, +- ENCTYPE_DES_CBC_MD5, +- &key); +- if (krb5_ret != 0) { +- DBG_ERR("generation of a des-cbc-md5 key failed: %s\n", +- smb_get_krb5_error_message(krb5_ctx, krb5_ret, keys)); +- krb5_free_context(krb5_ctx); +- TALLOC_FREE(keys); +- TALLOC_FREE(salt_data); +- return krb5_ret; +- } +- des_md5_b = data_blob_talloc(keys, +- KRB5_KEY_DATA(&key), +- KRB5_KEY_LENGTH(&key)); +- krb5_free_keyblock_contents(krb5_ctx, &key); +- if (des_md5_b.data == NULL) { +- DBG_ERR("data_blob_talloc failed for des-cbc-md5.\n"); +- krb5_free_context(krb5_ctx); +- TALLOC_FREE(keys); +- TALLOC_FREE(salt_data); +- return ENOMEM; +- } +- + krb5_free_context(krb5_ctx); + no_kerberos: + +@@ -1227,15 +1200,6 @@ no_kerberos: + keys[idx].value = arc4_b; + idx += 1; + +-#ifdef HAVE_ADS +- if (des_md5_b.length != 0) { +- keys[idx].keytype = ENCTYPE_DES_CBC_MD5; +- keys[idx].iteration_count = 4096; +- keys[idx].value = des_md5_b; +- idx += 1; +- } +-#endif /* HAVE_ADS */ +- + p->salt_data = salt_data; + p->default_iteration_count = 4096; + p->num_keys = idx; +diff --git a/source4/auth/kerberos/kerberos.h b/source4/auth/kerberos/kerberos.h +index 2ff9e3868af..1dd63acc838 100644 +--- a/source4/auth/kerberos/kerberos.h ++++ b/source4/auth/kerberos/kerberos.h +@@ -50,7 +50,7 @@ struct keytab_container { + #define TOK_ID_GSS_GETMIC ((const uint8_t *)"\x01\x01") + #define TOK_ID_GSS_WRAP ((const uint8_t *)"\x02\x01") + +-#define ENC_ALL_TYPES (ENC_CRC32 | ENC_RSA_MD5 | ENC_RC4_HMAC_MD5 | \ ++#define ENC_ALL_TYPES (ENC_RC4_HMAC_MD5 | \ + ENC_HMAC_SHA1_96_AES128 | ENC_HMAC_SHA1_96_AES256) + + #ifndef HAVE_KRB5_SET_DEFAULT_TGS_KTYPES +diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c +index 006e35c46d5..f16937c6cab 100644 +--- a/source4/dsdb/samdb/ldb_modules/password_hash.c ++++ b/source4/dsdb/samdb/ldb_modules/password_hash.c +@@ -786,6 +786,7 @@ static int setup_kerberos_keys(struct setup_password_fields_io *io) + * create ENCTYPE_DES_CBC_MD5 key out of + * the salt and the cleartext password + */ ++#ifdef SAMBA4_USES_HEIMDAL + krb5_ret = smb_krb5_create_key_from_string(io->smb_krb5_context->krb5_context, + NULL, + &salt, +@@ -804,6 +805,11 @@ static int setup_kerberos_keys(struct setup_password_fields_io *io) + KRB5_KEY_DATA(&key), + KRB5_KEY_LENGTH(&key)); + krb5_free_keyblock_contents(io->smb_krb5_context->krb5_context, &key); ++#else ++ /* MIT has dropped support for DES enctypes, store a random key instead. */ ++ io->g.des_md5 = data_blob_talloc(io->ac, NULL, 8); ++ generate_secret_buffer(io->g.des_md5.data, 8); +#endif -+ - DBG_INFO("smb_krb5_kt_add_entry for enctype=0x%04x\n", - (int)enctype); - code = smb_krb5_kt_add_entry(context, --- -2.22.0 - - -From ee9cfc701993c59cea74281b0dcfbfa0f73e7ffd Mon Sep 17 00:00:00 2001 -From: Isaac Boukris -Date: Wed, 2 Oct 2019 13:11:39 +0300 -Subject: [PATCH 4/5] wip: mit des deprecation: skip krb5 DES tests - -Signed-off-by: Isaac Boukris ---- - source4/torture/rpc/remote_pac.c | 5 ++++- - testprogs/blackbox/test_export_keytab_heimdal.sh | 9 +++++---- - 2 files changed, 9 insertions(+), 5 deletions(-) - + if (!io->g.des_md5.data) { + return ldb_oom(ldb); + } +@@ -812,6 +818,7 @@ static int setup_kerberos_keys(struct setup_password_fields_io *io) + * create ENCTYPE_DES_CBC_CRC key out of + * the salt and the cleartext password + */ ++#ifdef SAMBA4_USES_HEIMDAL + krb5_ret = smb_krb5_create_key_from_string(io->smb_krb5_context->krb5_context, + NULL, + &salt, +@@ -830,6 +837,11 @@ static int setup_kerberos_keys(struct setup_password_fields_io *io) + KRB5_KEY_DATA(&key), + KRB5_KEY_LENGTH(&key)); + krb5_free_keyblock_contents(io->smb_krb5_context->krb5_context, &key); ++#else ++ /* MIT has dropped support for DES enctypes, store a random key instead. */ ++ io->g.des_crc = data_blob_talloc(io->ac, NULL, 8); ++ generate_secret_buffer(io->g.des_crc.data, 8); ++#endif + if (!io->g.des_crc.data) { + return ldb_oom(ldb); + } +diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c +index f62a633c6c7..023ae7b580d 100644 +--- a/source4/kdc/db-glue.c ++++ b/source4/kdc/db-glue.c +@@ -359,10 +359,10 @@ static krb5_error_code samba_kdc_message2entry_keys(krb5_context context, + + /* If UF_USE_DES_KEY_ONLY has been set, then don't allow use of the newer enc types */ + if (userAccountControl & UF_USE_DES_KEY_ONLY) { +- supported_enctypes = ENC_CRC32|ENC_RSA_MD5; ++ supported_enctypes = 0; + } else { + /* Otherwise, add in the default enc types */ +- supported_enctypes |= ENC_CRC32 | ENC_RSA_MD5 | ENC_RC4_HMAC_MD5; ++ supported_enctypes |= ENC_RC4_HMAC_MD5; + } + + /* Is this the krbtgt or a RODC krbtgt */ diff --git a/source4/torture/rpc/remote_pac.c b/source4/torture/rpc/remote_pac.c -index 7a5cda74b74..50153c113e8 100644 +index 7a5cda74b74..f12060e3c8f 100644 --- a/source4/torture/rpc/remote_pac.c +++ b/source4/torture/rpc/remote_pac.c -@@ -581,6 +581,7 @@ static bool test_PACVerify_workstation_aes(struct torture_context *tctx, +@@ -38,7 +38,6 @@ + + #define TEST_MACHINE_NAME_BDC "torturepacbdc" + #define TEST_MACHINE_NAME_WKSTA "torturepacwksta" +-#define TEST_MACHINE_NAME_WKSTA_DES "torturepacwkdes" + #define TEST_MACHINE_NAME_S4U2SELF_BDC "tests4u2selfbdc" + #define TEST_MACHINE_NAME_S4U2SELF_WKSTA "tests4u2selfwk" + +@@ -581,39 +580,6 @@ static bool test_PACVerify_workstation_aes(struct torture_context *tctx, NETLOGON_NEG_AUTH2_ADS_FLAGS | NETLOGON_NEG_SUPPORTS_AES); } -+#ifdef _KRB5_HAVE_DES - static bool test_PACVerify_workstation_des(struct torture_context *tctx, - struct dcerpc_pipe *p, struct cli_credentials *credentials, struct test_join *join_ctx) - { -@@ -613,6 +614,7 @@ static bool test_PACVerify_workstation_des(struct torture_context *tctx, - TEST_MACHINE_NAME_WKSTA_DES, - NETLOGON_NEG_AUTH2_ADS_FLAGS); - } -+#endif - +-static bool test_PACVerify_workstation_des(struct torture_context *tctx, +- struct dcerpc_pipe *p, struct cli_credentials *credentials, struct test_join *join_ctx) +-{ +- struct samr_SetUserInfo r; +- union samr_UserInfo user_info; +- struct dcerpc_pipe *samr_pipe = torture_join_samr_pipe(join_ctx); +- struct smb_krb5_context *smb_krb5_context; +- krb5_error_code ret; +- +- ret = cli_credentials_get_krb5_context(popt_get_cmdline_credentials(), +- tctx->lp_ctx, &smb_krb5_context); +- torture_assert_int_equal(tctx, ret, 0, "cli_credentials_get_krb5_context() failed"); +- +- if (smb_krb5_get_allowed_weak_crypto(smb_krb5_context->krb5_context) == FALSE) { +- torture_skip(tctx, "Cannot test DES without [libdefaults] allow_weak_crypto = yes"); +- } +- +- /* Mark this workstation with DES-only */ +- user_info.info16.acct_flags = ACB_USE_DES_KEY_ONLY | ACB_WSTRUST; +- r.in.user_handle = torture_join_samr_user_policy(join_ctx); +- r.in.level = 16; +- r.in.info = &user_info; +- +- torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo_r(samr_pipe->binding_handle, tctx, &r), +- "failed to set DES info account flags"); +- torture_assert_ntstatus_ok(tctx, r.out.result, +- "failed to set DES into account flags"); +- +- return test_PACVerify(tctx, p, credentials, SEC_CHAN_WKSTA, +- TEST_MACHINE_NAME_WKSTA_DES, +- NETLOGON_NEG_AUTH2_ADS_FLAGS); +-} +- #ifdef SAMBA4_USES_HEIMDAL static NTSTATUS check_primary_group_in_validation(TALLOC_CTX *mem_ctx, -@@ -999,10 +1001,11 @@ struct torture_suite *torture_rpc_remote_pac(TALLOC_CTX *mem_ctx) - tcase = torture_suite_add_machine_workstation_rpc_iface_tcase(suite, "netr-mem-aes", + uint16_t validation_level, +@@ -1000,9 +966,6 @@ struct torture_suite *torture_rpc_remote_pac(TALLOC_CTX *mem_ctx) &ndr_table_netlogon, TEST_MACHINE_NAME_WKSTA); torture_rpc_tcase_add_test_creds(tcase, "verify-sig-aes", test_PACVerify_workstation_aes); -- -+#ifdef _KRB5_HAVE_DES - tcase = torture_suite_add_machine_workstation_rpc_iface_tcase(suite, "netlogon-member-des", - &ndr_table_netlogon, TEST_MACHINE_NAME_WKSTA_DES); - torture_rpc_tcase_add_test_join(tcase, "verify-sig", test_PACVerify_workstation_des); -+#endif + +- tcase = torture_suite_add_machine_workstation_rpc_iface_tcase(suite, "netlogon-member-des", +- &ndr_table_netlogon, TEST_MACHINE_NAME_WKSTA_DES); +- torture_rpc_tcase_add_test_join(tcase, "verify-sig", test_PACVerify_workstation_des); #ifdef SAMBA4_USES_HEIMDAL tcase = torture_suite_add_machine_bdc_rpc_iface_tcase(suite, "netr-bdc-arcfour", &ndr_table_netlogon, TEST_MACHINE_NAME_S4U2SELF_BDC); +diff --git a/testprogs/blackbox/dbcheck-oldrelease.sh b/testprogs/blackbox/dbcheck-oldrelease.sh +index 3d0ee2c165a..41c55178d4e 100755 +--- a/testprogs/blackbox/dbcheck-oldrelease.sh ++++ b/testprogs/blackbox/dbcheck-oldrelease.sh +@@ -388,7 +388,7 @@ referenceprovision() { + + ldapcmp() { + if [ x$RELEASE = x"release-4-0-0" ]; then +- $PYTHON $BINDIR/samba-tool ldapcmp tdb://$PREFIX_ABS/${RELEASE}_reference/private/sam.ldb tdb://$PREFIX_ABS/${RELEASE}/private/sam.ldb --two --skip-missing-dn --filter=dnsRecord,displayName ++ $PYTHON $BINDIR/samba-tool ldapcmp tdb://$PREFIX_ABS/${RELEASE}_reference/private/sam.ldb tdb://$PREFIX_ABS/${RELEASE}/private/sam.ldb --two --skip-missing-dn --filter=dnsRecord,displayName,msDS-SupportedEncryptionTypes + fi + } + +diff --git a/testprogs/blackbox/functionalprep.sh b/testprogs/blackbox/functionalprep.sh +index 80e82252d45..1d37611ef7a 100755 +--- a/testprogs/blackbox/functionalprep.sh ++++ b/testprogs/blackbox/functionalprep.sh +@@ -61,7 +61,7 @@ provision_2012r2() { + ldapcmp_ignore() { + # At some point we will need to ignore, but right now, it should be perfect + IGNORE_ATTRS=$1 +- $PYTHON $BINDIR/samba-tool ldapcmp tdb://$PREFIX_ABS/$2/private/sam.ldb tdb://$PREFIX_ABS/$3/private/sam.ldb --two --skip-missing-dn ++ $PYTHON $BINDIR/samba-tool ldapcmp tdb://$PREFIX_ABS/$2/private/sam.ldb tdb://$PREFIX_ABS/$3/private/sam.ldb --two --skip-missing-dn --filter msDS-SupportedEncryptionTypes + } + + ldapcmp() { diff --git a/testprogs/blackbox/test_export_keytab_heimdal.sh b/testprogs/blackbox/test_export_keytab_heimdal.sh -index cfa245fd4de..6b350d38ca7 100755 +index cfa245fd4de..6a2595cd684 100755 --- a/testprogs/blackbox/test_export_keytab_heimdal.sh +++ b/testprogs/blackbox/test_export_keytab_heimdal.sh -@@ -50,10 +50,11 @@ test_keytab() { - return $status - fi +@@ -43,7 +43,7 @@ test_keytab() { -- if [ x$NKEYS != x$expected_nkeys ] ; then -- echo "failure: $testname" -- return 1 -- fi -+ # TODO: get expected_nkeys as script parameter and possibly skip DES -+ #if [ x$NKEYS != x$expected_nkeys ] ; then -+ # echo "failure: $testname" -+ # return 1 -+ #fi - echo "success: $testname" - return 0 + echo "test: $testname" + +- NKEYS=$($VALGRIND $samba4ktutil $keytab | grep -i "$principal" | egrep -c "des|aes|arcfour") ++ NKEYS=$($VALGRIND $samba4ktutil $keytab | grep -i "$principal" | egrep -c "aes|arcfour") + status=$? + if [ x$status != x0 ]; then + echo "failure: $testname" +@@ -64,22 +64,22 @@ unc="//$SERVER/tmp" + testit "create user locally" $VALGRIND $PYTHON $newuser nettestuser $USERPASS $@ || failed=`expr $failed + 1` + + testit "dump keytab from domain" $VALGRIND $PYTHON $samba_tool domain exportkeytab $PREFIX/tmpkeytab $@ || failed=`expr $failed + 1` +-test_keytab "read keytab from domain" "$PREFIX/tmpkeytab" "$SERVER\\\$" 5 ++test_keytab "read keytab from domain" "$PREFIX/tmpkeytab" "$SERVER\\\$" 3 + testit "dump keytab from domain (2nd time)" $VALGRIND $PYTHON $samba_tool domain exportkeytab $PREFIX/tmpkeytab $@ || failed=`expr $failed + 1` +-test_keytab "read keytab from domain (2nd time)" "$PREFIX/tmpkeytab" "$SERVER\\\$" 5 ++test_keytab "read keytab from domain (2nd time)" "$PREFIX/tmpkeytab" "$SERVER\\\$" 3 + + testit "dump keytab from domain for cifs principal" $VALGRIND $PYTHON $samba_tool domain exportkeytab $PREFIX/tmpkeytab-server --principal=cifs/$SERVER_FQDN $@ || failed=`expr $failed + 1` +-test_keytab "read keytab from domain for cifs principal" "$PREFIX/tmpkeytab-server" "cifs/$SERVER_FQDN" 5 ++test_keytab "read keytab from domain for cifs principal" "$PREFIX/tmpkeytab-server" "cifs/$SERVER_FQDN" 3 + testit "dump keytab from domain for cifs principal (2nd time)" $VALGRIND $PYTHON $samba_tool domain exportkeytab $PREFIX/tmpkeytab-server --principal=cifs/$SERVER_FQDN $@ || failed=`expr $failed + 1` +-test_keytab "read keytab from domain for cifs principal (2nd time)" "$PREFIX/tmpkeytab-server" "cifs/$SERVER_FQDN" 5 ++test_keytab "read keytab from domain for cifs principal (2nd time)" "$PREFIX/tmpkeytab-server" "cifs/$SERVER_FQDN" 3 + + testit "dump keytab from domain for user principal" $VALGRIND $PYTHON $samba_tool domain exportkeytab $PREFIX/tmpkeytab-2 --principal=nettestuser $@ || failed=`expr $failed + 1` +-test_keytab "dump keytab from domain for user principal" "$PREFIX/tmpkeytab-2" "nettestuser@$REALM" 5 ++test_keytab "dump keytab from domain for user principal" "$PREFIX/tmpkeytab-2" "nettestuser@$REALM" 3 + testit "dump keytab from domain for user principal (2nd time)" $VALGRIND $PYTHON $samba_tool domain exportkeytab $PREFIX/tmpkeytab-2 --principal=nettestuser@$REALM $@ || failed=`expr $failed + 1` +-test_keytab "dump keytab from domain for user principal (2nd time)" "$PREFIX/tmpkeytab-2" "nettestuser@$REALM" 5 ++test_keytab "dump keytab from domain for user principal (2nd time)" "$PREFIX/tmpkeytab-2" "nettestuser@$REALM" 3 + + testit "dump keytab from domain for user principal with SPN as UPN" $VALGRIND $PYTHON $samba_tool domain exportkeytab $PREFIX/tmpkeytab-3 --principal=http/testupnspn.$DNSDOMAIN $@ || failed=`expr $failed + 1` +-test_keytab "dump keytab from domain for user principal" "$PREFIX/tmpkeytab-3" "http/testupnspn.$DNSDOMAIN@$REALM" 5 ++test_keytab "dump keytab from domain for user principal" "$PREFIX/tmpkeytab-3" "http/testupnspn.$DNSDOMAIN@$REALM" 3 + + KRB5CCNAME="$PREFIX/tmpuserccache" + export KRB5CCNAME +diff --git a/testprogs/blackbox/upgradeprovision-oldrelease.sh b/testprogs/blackbox/upgradeprovision-oldrelease.sh +index 76276168011..208baa54a02 100755 +--- a/testprogs/blackbox/upgradeprovision-oldrelease.sh ++++ b/testprogs/blackbox/upgradeprovision-oldrelease.sh +@@ -106,7 +106,7 @@ referenceprovision() { + + ldapcmp() { + if [ x$RELEASE != x"alpha13" ]; then +- $PYTHON $BINDIR/samba-tool ldapcmp tdb://$PREFIX_ABS/${RELEASE}_upgrade_reference/private/sam.ldb tdb://$PREFIX_ABS/${RELEASE}_upgrade/private/sam.ldb --two --skip-missing-dn --filter=dnsRecord,displayName ++ $PYTHON $BINDIR/samba-tool ldapcmp tdb://$PREFIX_ABS/${RELEASE}_upgrade_reference/private/sam.ldb tdb://$PREFIX_ABS/${RELEASE}_upgrade/private/sam.ldb --two --skip-missing-dn --filter=dnsRecord,displayName,msDS-SupportedEncryptionTypes + fi } --- -2.22.0 - - -From 218369814760c170b2ca95f9d3cbde14dccd8292 Mon Sep 17 00:00:00 2001 -From: Isaac Boukris -Date: Wed, 2 Oct 2019 13:19:38 +0300 -Subject: [PATCH 5/5] wip: mit des deprecation: skip fetching DES keys - -Signed-off-by: Isaac Boukris ---- - source4/kdc/db-glue.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c -index f62a633c6c7..37e3855423a 100644 ---- a/source4/kdc/db-glue.c -+++ b/source4/kdc/db-glue.c -@@ -365,6 +365,10 @@ static krb5_error_code samba_kdc_message2entry_keys(krb5_context context, - supported_enctypes |= ENC_CRC32 | ENC_RSA_MD5 | ENC_RC4_HMAC_MD5; - } -+#ifndef _KRB5_HAVE_DES -+ supported_enctypes &= ~(ENC_CRC32 | ENC_RSA_MD5); -+#endif -+ - /* Is this the krbtgt or a RODC krbtgt */ - if (is_rodc) { - rodc_krbtgt_number = ldb_msg_find_attr_as_int(msg, "msDS-SecondaryKrbTgtNumber", -1); -- -2.22.0 +2.23.0 diff --git a/samba.spec b/samba.spec index 1b2cad8..4836979 100644 --- a/samba.spec +++ b/samba.spec @@ -6,7 +6,7 @@ # ctdb is enabled by default, you can disable it with: --without clustering %bcond_without clustering -%define main_release 0 +%define main_release 1 %define samba_version 4.11.2 %define talloc_version 2.2.0 @@ -3467,6 +3467,9 @@ fi %endif # with_clustering_support %changelog +* Wed Nov 06 2019 Alexander Bokovoy - 4.11.2-1 +- Update DES removal patch + * Tue Oct 29 2019 Guenther Deschner - 4.11.2-0 - Update to Samba 4.11.2 - resolves: #1763137, #1766558 - Security fixes for CVE-2019-10218 From e7b3b0387a2dfaabe255fa259391e362ac543daf Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 25 Nov 2019 11:57:08 +0100 Subject: [PATCH 19/51] Restart the winbind service on upgrade --- samba.spec | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index 4836979..99c2eb6 100644 --- a/samba.spec +++ b/samba.spec @@ -1165,8 +1165,7 @@ fi %systemd_preun winbind.service %postun winbind -%systemd_postun_with_restart smb.service -%systemd_postun_with_restart nmb.service +%systemd_postun_with_restart winbind.service %postun winbind-krb5-locator if [ "$1" -ge "1" ]; then From d32eb4651ce56467601e2b8c9a67898ae709fdca Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 29 Nov 2019 11:19:17 +0100 Subject: [PATCH 20/51] Remove the pidl patch and build pidl using its Makefile.PL --- pidl.patch | 116 ----------------------------------------------------- samba.spec | 28 ++++++++++--- 2 files changed, 23 insertions(+), 121 deletions(-) delete mode 100644 pidl.patch diff --git a/pidl.patch b/pidl.patch deleted file mode 100644 index 889aeb0..0000000 --- a/pidl.patch +++ /dev/null @@ -1,116 +0,0 @@ -From 838457ac4f9f3f6c1bb5936738566210a62cbdc5 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?G=C3=BCnther=20Deschner?= -Date: Tue, 27 Aug 2019 15:25:13 +0200 -Subject: [PATCH] Revert "waf: install: Remove installation of PIDL and - manpages." - -This reverts commit e24e344d0da58013fd5fa404529fe1d25ef403bf. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14103 - -Guenther - -Signed-off-by: Guenther Deschner ---- - pidl/lib/wscript_build | 37 +++++++++++++++++++++++++++++++++++++ - pidl/wscript | 38 ++++++++++++++++++++++++++++++++++++++ - 2 files changed, 75 insertions(+) - create mode 100644 pidl/lib/wscript_build - -diff --git a/pidl/lib/wscript_build b/pidl/lib/wscript_build -new file mode 100644 -index 00000000000..54b3170c4e2 ---- /dev/null -+++ b/pidl/lib/wscript_build -@@ -0,0 +1,37 @@ -+#!/usr/bin/env python -+ -+# install the pidl modules -+bld.INSTALL_FILES(bld.env.PERL_LIB_INSTALL_DIR, -+ ''' -+ Parse/Pidl.pm -+ Parse/Pidl/Samba4.pm -+ Parse/Pidl/CUtil.pm -+ Parse/Pidl/Expr.pm -+ Parse/Pidl/Wireshark/Conformance.pm -+ Parse/Pidl/Wireshark/NDR.pm -+ Parse/Pidl/ODL.pm -+ Parse/Pidl/Dump.pm -+ Parse/Pidl/Util.pm -+ Parse/Pidl/Samba4/Header.pm -+ Parse/Pidl/Samba4/COM/Header.pm -+ Parse/Pidl/Samba4/COM/Proxy.pm -+ Parse/Pidl/Samba4/COM/Stub.pm -+ Parse/Pidl/Samba4/TDR.pm -+ Parse/Pidl/Samba4/NDR/Server.pm -+ Parse/Pidl/Samba4/NDR/Client.pm -+ Parse/Pidl/Samba4/NDR/Parser.pm -+ Parse/Pidl/Samba4/Python.pm -+ Parse/Pidl/Samba4/Template.pm -+ Parse/Pidl/IDL.pm -+ Parse/Pidl/Typelist.pm -+ Parse/Pidl/Samba3/ClientNDR.pm -+ Parse/Pidl/Samba3/ServerNDR.pm -+ Parse/Pidl/Compat.pm -+ Parse/Pidl/NDR.pm -+ ''', -+ flat=False) -+ -+if not bld.CONFIG_SET('USING_SYSTEM_PARSE_YAPP_DRIVER'): -+ bld.INSTALL_FILES(bld.env.PERL_LIB_INSTALL_DIR, -+ 'Parse/Yapp/Driver.pm', -+ flat=False) -diff --git a/pidl/wscript b/pidl/wscript -index 01b71bd8b27..a2a15d36851 100644 ---- a/pidl/wscript -+++ b/pidl/wscript -@@ -32,10 +32,49 @@ - # Check if perl(Parse::Yapp::Driver) is available. - check_system_perl_module(conf, "Parse::Yapp::Driver", 1.05) - -+ # we need a recent version of MakeMaker to get the right man page names -+ if conf.CHECK_PERL_MANPAGE(): -+ conf.env.PERLMAN1EXT = conf.CHECK_PERL_MANPAGE(section='1') -+ conf.env.PERLMAN3EXT = conf.CHECK_PERL_MANPAGE(section='3') -+ conf.DEFINE('HAVE_PERL_MAKEMAKER', 1) -+ - # yapp is used for building the parser - conf.find_program('yapp', var='YAPP') -+ conf.find_program('pod2man', var='POD2MAN') - - def build(bld): -+ bld.INSTALL_FILES('${BINDIR}', 'pidl', chmod=MODE_755, perl_fixup=True) -+ -+ bld.RECURSE('lib') -+ -+ if not bld.CONFIG_SET('HAVE_PERL_MAKEMAKER'): -+ return -+ -+ pidl_manpages = { -+ 'pidl': 'man1/pidl.${PERLMAN1EXT}', -+ 'lib/Parse/Pidl/NDR.pm': 'man3/Parse::Pidl::NDR.${PERLMAN3EXT}', -+ 'lib/Parse/Pidl/Wireshark/Conformance.pm': 'man3/Parse::Pidl::Wireshark::Conformance.${PERLMAN3EXT}', -+ 'lib/Parse/Pidl/Dump.pm': 'man3/Parse::Pidl::Dump.${PERLMAN3EXT}', -+ 'lib/Parse/Pidl/Util.pm': 'man3/Parse::Pidl::Util.${PERLMAN3EXT}', -+ 'lib/Parse/Pidl/Wireshark/NDR.pm': 'man3/Parse::Pidl::Wireshark::NDR.${PERLMAN3EXT}' -+ } -+ -+ for k in pidl_manpages.keys(): -+ pidl_manpages[k] = bld.EXPAND_VARIABLES(pidl_manpages[k]) -+ -+ # use perl to build the manpages -+ bld.env.pidl_srcdir = os.path.join(bld.srcnode.abspath(), 'pidl') -+ -+ bld.SET_BUILD_GROUP('final') -+ if 'POD2MAN' in bld.env and bld.env['POD2MAN'] != '': -+ for src in pidl_manpages.keys(): -+ manpage = pidl_manpages[src] -+ section = manpage.rsplit( ".", 1)[1] -+ bld(rule='${POD2MAN} -c "Samba Documentation" -s %s ${SRC} ${TGT}' % section, -+ shell=True, -+ source=src, -+ install_path=os.path.dirname(bld.EXPAND_VARIABLES('${MANDIR}/'+manpage)), -+ target=os.path.basename(manpage)) - - # we want to prefer the git version of the parsers if we can. - # Only if the source has changed do we want to re-run yapp diff --git a/samba.spec b/samba.spec index 99c2eb6..9fef23a 100644 --- a/samba.spec +++ b/samba.spec @@ -118,7 +118,6 @@ Source14: samba.pamd Source201: README.downgrade -Patch0: pidl.patch Patch100: 0000-use-gnutls-for-des-cbc.patch Patch101: 0001-handle-removal-des-enctypes-from-krb5.patch Patch102: 0002-samba-tool-create-working-private-krb5.conf.patch @@ -186,8 +185,6 @@ BuildRequires: pam-devel BuildRequires: perl-interpreter BuildRequires: perl-generators BuildRequires: perl(Archive::Tar) -BuildRequires: perl(ExtUtils::MakeMaker) -BuildRequires: perl(Parse::Yapp) BuildRequires: perl(Test::More) BuildRequires: popt-devel BuildRequires: python3-devel @@ -232,6 +229,7 @@ BuildRequires: gnutls-devel >= 3.2.0 %endif # pidl requirements +BuildRequires: perl(ExtUtils::MakeMaker) BuildRequires: perl(Parse::Yapp) BuildRequires: libtalloc-devel >= %{talloc_version} @@ -872,6 +870,12 @@ export LDFLAGS="%{__global_ldflags} -fuse-ld=gold" make %{?_smp_mflags} +pushd pidl +%__perl Makefile.PL PREFIX=%{_prefix} INSTALLSITELIB=%{perl_vendorlib} + +make %{?_smp_mflags} +popd + %install rm -rf %{buildroot} @@ -1040,6 +1044,13 @@ for f in samba/libsamba-net-samba4.so \ done %endif # ! with_dc +pushd pidl +make DESTDIR=%{buildroot} install + +rm -f %{buildroot}%{perl_archlib}/perllocal.pod +rm -f %{buildroot}%{perl_vendorlib}/auto/Parse/Pidl/.packlist +popd + %if %{with testsuite} %check TDB_NO_FSYNC=1 make %{?_smp_mflags} test @@ -1858,6 +1869,7 @@ fi %dir %{perl_vendorlib}/Parse/Pidl/Samba3 %{perl_vendorlib}/Parse/Pidl/Samba3/ServerNDR.pm %{perl_vendorlib}/Parse/Pidl/Samba3/ClientNDR.pm +%{perl_vendorlib}/Parse/Pidl/Samba3/Template.pm %dir %{perl_vendorlib}/Parse/Pidl/Samba4 %{perl_vendorlib}/Parse/Pidl/Samba4/Header.pm %dir %{perl_vendorlib}/Parse/Pidl/Samba4/COM @@ -1873,8 +1885,14 @@ fi %{perl_vendorlib}/Parse/Pidl/Samba4/TDR.pm %{perl_vendorlib}/Parse/Pidl/NDR.pm %{perl_vendorlib}/Parse/Pidl/Util.pm -%{_mandir}/man1/pidl* -%{_mandir}/man3/Parse::Pidl* +%dir %{perl_vendorlib}/Parse/Yapp +%{perl_vendorlib}/Parse/Yapp/Driver.pm +%{_mandir}/man1/pidl.1* +%{_mandir}/man3/Parse::Pidl::Dump.3pm* +%{_mandir}/man3/Parse::Pidl::NDR.3pm* +%{_mandir}/man3/Parse::Pidl::Util.3pm* +%{_mandir}/man3/Parse::Pidl::Wireshark::Conformance.3pm* +%{_mandir}/man3/Parse::Pidl::Wireshark::NDR.3pm* ### PYTHON3 %files -n python3-%{name} From 024853af7b23cf4ca0a73f3e6eaf01d2575c6cba Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 2 Dec 2019 12:06:24 +0100 Subject: [PATCH 21/51] Fix pidl packageing --- samba.spec | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 9fef23a..6be6598 100644 --- a/samba.spec +++ b/samba.spec @@ -1049,6 +1049,9 @@ make DESTDIR=%{buildroot} install rm -f %{buildroot}%{perl_archlib}/perllocal.pod rm -f %{buildroot}%{perl_vendorlib}/auto/Parse/Pidl/.packlist + +# packaged by Parse:Yapp +rm -f %{buildroot}%{perl_vendorlib}/Parse/Yapp/Driver.pm popd %if %{with testsuite} @@ -1886,7 +1889,6 @@ fi %{perl_vendorlib}/Parse/Pidl/NDR.pm %{perl_vendorlib}/Parse/Pidl/Util.pm %dir %{perl_vendorlib}/Parse/Yapp -%{perl_vendorlib}/Parse/Yapp/Driver.pm %{_mandir}/man1/pidl.1* %{_mandir}/man3/Parse::Pidl::Dump.3pm* %{_mandir}/man3/Parse::Pidl::NDR.3pm* From c800abd9c39f198e813eef0ec17c6c9c7d766d06 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 5 Dec 2019 15:04:18 +0100 Subject: [PATCH 22/51] More fixes for pidl packaging MakeMaker installs files with 0444: https://bugzilla.redhat.com/show_bug.cgi?id=1780126 Define permissions when packaging files as a workaround. --- samba.spec | 75 +++++++++++++++++++++++++++--------------------------- 1 file changed, 37 insertions(+), 38 deletions(-) diff --git a/samba.spec b/samba.spec index 6be6598..1ba6ba1 100644 --- a/samba.spec +++ b/samba.spec @@ -871,7 +871,7 @@ export LDFLAGS="%{__global_ldflags} -fuse-ld=gold" make %{?_smp_mflags} pushd pidl -%__perl Makefile.PL PREFIX=%{_prefix} INSTALLSITELIB=%{perl_vendorlib} +%__perl Makefile.PL PREFIX=%{_prefix} make %{?_smp_mflags} popd @@ -1045,13 +1045,13 @@ done %endif # ! with_dc pushd pidl -make DESTDIR=%{buildroot} install +make DESTDIR=%{buildroot} install_vendor rm -f %{buildroot}%{perl_archlib}/perllocal.pod -rm -f %{buildroot}%{perl_vendorlib}/auto/Parse/Pidl/.packlist +rm -f %{buildroot}%{perl_archlib}/vendor_perl/auto/Parse/Pidl/.packlist -# packaged by Parse:Yapp -rm -f %{buildroot}%{perl_vendorlib}/Parse/Yapp/Driver.pm +# Already packaged by perl Parse:Yapp +rm -rf %{buildroot}%{perl_vendorlib}/Parse/Yapp popd %if %{with testsuite} @@ -1856,45 +1856,44 @@ fi %files pidl %attr(755,root,root) %{_bindir}/pidl %dir %{perl_vendorlib}/Parse -%{perl_vendorlib}/Parse/Pidl.pm +%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl.pm %dir %{perl_vendorlib}/Parse/Pidl -%{perl_vendorlib}/Parse/Pidl/CUtil.pm -%{perl_vendorlib}/Parse/Pidl/Samba4.pm -%{perl_vendorlib}/Parse/Pidl/Expr.pm -%{perl_vendorlib}/Parse/Pidl/ODL.pm -%{perl_vendorlib}/Parse/Pidl/Typelist.pm -%{perl_vendorlib}/Parse/Pidl/IDL.pm -%{perl_vendorlib}/Parse/Pidl/Compat.pm +%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/CUtil.pm +%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/Samba4.pm +%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/Expr.pm +%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/ODL.pm +%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/Typelist.pm +%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/IDL.pm +%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/Compat.pm %dir %{perl_vendorlib}/Parse/Pidl/Wireshark -%{perl_vendorlib}/Parse/Pidl/Wireshark/Conformance.pm -%{perl_vendorlib}/Parse/Pidl/Wireshark/NDR.pm -%{perl_vendorlib}/Parse/Pidl/Dump.pm +%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/Wireshark/Conformance.pm +%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/Wireshark/NDR.pm +%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/Dump.pm %dir %{perl_vendorlib}/Parse/Pidl/Samba3 -%{perl_vendorlib}/Parse/Pidl/Samba3/ServerNDR.pm -%{perl_vendorlib}/Parse/Pidl/Samba3/ClientNDR.pm -%{perl_vendorlib}/Parse/Pidl/Samba3/Template.pm +%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/Samba3/ServerNDR.pm +%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/Samba3/ClientNDR.pm +%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/Samba3/Template.pm %dir %{perl_vendorlib}/Parse/Pidl/Samba4 -%{perl_vendorlib}/Parse/Pidl/Samba4/Header.pm +%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/Samba4/Header.pm %dir %{perl_vendorlib}/Parse/Pidl/Samba4/COM -%{perl_vendorlib}/Parse/Pidl/Samba4/COM/Header.pm -%{perl_vendorlib}/Parse/Pidl/Samba4/COM/Proxy.pm -%{perl_vendorlib}/Parse/Pidl/Samba4/COM/Stub.pm -%{perl_vendorlib}/Parse/Pidl/Samba4/Python.pm -%{perl_vendorlib}/Parse/Pidl/Samba4/Template.pm +%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/Samba4/COM/Header.pm +%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/Samba4/COM/Proxy.pm +%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/Samba4/COM/Stub.pm +%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/Samba4/Python.pm +%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/Samba4/Template.pm %dir %{perl_vendorlib}/Parse/Pidl/Samba4/NDR -%{perl_vendorlib}/Parse/Pidl/Samba4/NDR/Server.pm -%{perl_vendorlib}/Parse/Pidl/Samba4/NDR/Client.pm -%{perl_vendorlib}/Parse/Pidl/Samba4/NDR/Parser.pm -%{perl_vendorlib}/Parse/Pidl/Samba4/TDR.pm -%{perl_vendorlib}/Parse/Pidl/NDR.pm -%{perl_vendorlib}/Parse/Pidl/Util.pm -%dir %{perl_vendorlib}/Parse/Yapp -%{_mandir}/man1/pidl.1* -%{_mandir}/man3/Parse::Pidl::Dump.3pm* -%{_mandir}/man3/Parse::Pidl::NDR.3pm* -%{_mandir}/man3/Parse::Pidl::Util.3pm* -%{_mandir}/man3/Parse::Pidl::Wireshark::Conformance.3pm* -%{_mandir}/man3/Parse::Pidl::Wireshark::NDR.3pm* +%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/Samba4/NDR/Server.pm +%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/Samba4/NDR/Client.pm +%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/Samba4/NDR/Parser.pm +%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/Samba4/TDR.pm +%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/NDR.pm +%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/Util.pm +%attr(644,root,root) %{_mandir}/man1/pidl.1* +%attr(644,root,root) %{_mandir}/man3/Parse::Pidl::Dump.3pm* +%attr(644,root,root) %{_mandir}/man3/Parse::Pidl::NDR.3pm* +%attr(644,root,root) %{_mandir}/man3/Parse::Pidl::Util.3pm* +%attr(644,root,root) %{_mandir}/man3/Parse::Pidl::Wireshark::Conformance.3pm* +%attr(644,root,root) %{_mandir}/man3/Parse::Pidl::Wireshark::NDR.3pm* ### PYTHON3 %files -n python3-%{name} From f2018e5930191ffd6f15eac35be596231682d61b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 5 Dec 2019 15:19:28 +0100 Subject: [PATCH 23/51] Use an URL for Source0. This makes our tools happy and you can use it as a link to get the tar.gz. --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 1ba6ba1..b2aee97 100644 --- a/samba.spec +++ b/samba.spec @@ -105,7 +105,7 @@ License: GPLv3+ and LGPLv3+ URL: http://www.samba.org/ # This is a xz recompressed file of https://ftp.samba.org/pub/samba/samba-%%{version}%%{pre_release}.tar.gz -Source0: samba-%{version}%{pre_release}.tar.xz +Source0: https://ftp.samba.org/pub/samba/samba-%{version}%{pre_release}.tar.gz#/samba-%{version}%{pre_release}.tar.xz Source1: https://ftp.samba.org/pub/samba/samba-%{version}%{pre_release}.tar.asc Source2: gpgkey-52FBC0B86D954B0843324CDC6F33915B6568B7EA.gpg From 08266200dc27a8054f0fb0cc6b91a1a0fa8f421b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 5 Dec 2019 16:31:27 +0100 Subject: [PATCH 24/51] libMESSAGING is needed by samba-client-libs now Found by rpmdiff --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index b2aee97..c1a0a07 100644 --- a/samba.spec +++ b/samba.spec @@ -1409,6 +1409,7 @@ fi %dir %{_libdir}/samba %{_libdir}/samba/libCHARSET3-samba4.so %{_libdir}/samba/libMESSAGING-SEND-samba4.so +%{_libdir}/samba/libMESSAGING-samba4.so %{_libdir}/samba/libaddns-samba4.so %{_libdir}/samba/libads-samba4.so %{_libdir}/samba/libasn1util-samba4.so @@ -1817,7 +1818,6 @@ fi %files libs %{_libdir}/libdcerpc-samr.so.* -%{_libdir}/samba/libMESSAGING-samba4.so %{_libdir}/samba/libLIBWBCLIENT-OLD-samba4.so %{_libdir}/samba/libauth4-samba4.so %{_libdir}/samba/libauth-unix-token-samba4.so From 7496562e11ea2e7ff28df8c14d1f7e60b9d86ebb Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 5 Dec 2019 16:35:06 +0100 Subject: [PATCH 25/51] Bump release for new build --- samba.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index c1a0a07..9f08255 100644 --- a/samba.spec +++ b/samba.spec @@ -6,7 +6,7 @@ # ctdb is enabled by default, you can disable it with: --without clustering %bcond_without clustering -%define main_release 1 +%define main_release 2 %define samba_version 4.11.2 %define talloc_version 2.2.0 @@ -3485,6 +3485,9 @@ fi %endif # with_clustering_support %changelog +* Thu Dec 05 2019 Andreas Schneider - 4.11.2-2 +- Restart winbindd on samba-winbind package upgrade + * Wed Nov 06 2019 Alexander Bokovoy - 4.11.2-1 - Update DES removal patch From d521ae1c6576fcedaff51e28fb7a08f7e94ae889 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 5 Dec 2019 18:09:34 +0100 Subject: [PATCH 26/51] Update logrotate script --- samba.log => samba.logrotate | 7 +++++-- samba.spec | 3 ++- 2 files changed, 7 insertions(+), 3 deletions(-) rename samba.log => samba.logrotate (50%) diff --git a/samba.log b/samba.logrotate similarity index 50% rename from samba.log rename to samba.logrotate index 6ccd04d..40f85aa 100644 --- a/samba.log +++ b/samba.logrotate @@ -1,7 +1,10 @@ -/var/log/samba/* { +/var/log/samba/log.* { + compress + dateext + maxage 365 + rotate 99 notifempty olddir /var/log/samba/old missingok - sharedscripts copytruncate } diff --git a/samba.spec b/samba.spec index 9f08255..410b100 100644 --- a/samba.spec +++ b/samba.spec @@ -110,7 +110,7 @@ Source1: https://ftp.samba.org/pub/samba/samba-%{version}%{pre_release}.t Source2: gpgkey-52FBC0B86D954B0843324CDC6F33915B6568B7EA.gpg # Red Hat specific replacement-files -Source10: samba.log +Source10: samba.logrotate Source11: smb.conf.vendor Source12: smb.conf.example Source13: pam_winbind.conf @@ -311,6 +311,7 @@ Summary: Files used by both Samba servers and clients BuildArch: noarch Requires(post): systemd +Recommends: logrotate Provides: samba4-common = %{samba_depver} Obsoletes: samba4-common < %{samba_depver} From a6e5467a7f93206cf52f274416949d9fd6c574ed Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 5 Dec 2019 18:09:57 +0100 Subject: [PATCH 27/51] Add missing README files --- samba.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/samba.spec b/samba.spec index 410b100..f1fc69a 100644 --- a/samba.spec +++ b/samba.spec @@ -1339,6 +1339,7 @@ fi ### CLIENT %files client +%doc source3/client/README.smbspool %{_bindir}/cifsdd %{_bindir}/dbwrap_tool %{_bindir}/dumpmscat @@ -1855,6 +1856,7 @@ fi ### PIDL %files pidl +%doc pidl/README %attr(755,root,root) %{_bindir}/pidl %dir %{perl_vendorlib}/Parse %attr(644,root,root) %{perl_vendorlib}/Parse/Pidl.pm From 19616dde1bc2c0e5d88f8068e14aa19333e216b8 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 5 Dec 2019 18:22:07 +0100 Subject: [PATCH 28/51] Fix spec file issues --- samba.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index f1fc69a..c3fe949 100644 --- a/samba.spec +++ b/samba.spec @@ -842,7 +842,7 @@ export LDFLAGS="%{__global_ldflags} -fuse-ld=gold" --private-libraries=%{_samba_private_libraries} \ %endif --with-system-mitkrb5 \ - --with-experimental-mit-ad-dc \ + --with-experimental-mit-ad-dc \ %if ! %with_dc --without-ad-dc \ %endif @@ -944,7 +944,7 @@ install -d -m 0755 %{buildroot}%{_sysconfdir}/sysconfig install -m 0644 packaging/systemd/samba.sysconfig %{buildroot}%{_sysconfdir}/sysconfig/samba %if %with_clustering_support cat > %{buildroot}%{_sysconfdir}/sysconfig/ctdb < Date: Thu, 5 Dec 2019 18:27:25 +0100 Subject: [PATCH 29/51] Create a samba-dc-provision subpackage This includes only ldif files for provisioning => noarch --- samba.spec | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index c3fe949..e7e7b1a 100644 --- a/samba.spec +++ b/samba.spec @@ -360,6 +360,7 @@ SMB/CIFS clients. Summary: Samba AD Domain Controller Requires: %{name} = %{samba_depver} Requires: %{name}-libs = %{samba_depver} +Requires: %{name}-dc-provision = %{samba_depver} Requires: %{name}-dc-libs = %{samba_depver} Requires: %{name}-winbind = %{samba_depver} # samba-tool needs tdbbackup @@ -383,6 +384,14 @@ Obsoletes: samba4-dc < %{samba_depver} %description dc The samba-dc package provides AD Domain Controller functionality +### DC-PROVISION +%package dc-provision +Summary: Samba AD files to provision a DC +BuildArch: noarch + +%description dc-provision +The samba-dc-provision package provides files to setup a domoin controller + ### DC-LIBS %package dc-libs Summary: Samba AD Domain Controller Libraries @@ -1623,12 +1632,14 @@ fi %{_libdir}/samba/ldb/wins_ldb.so %{_libdir}/samba/vfs/posix_eadb.so %dir /var/lib/samba/sysvol -%{_datadir}/samba/setup %{_mandir}/man8/samba.8* %{_mandir}/man8/samba_downgrade_db.8* %{_mandir}/man8/samba-gpupdate.8* %{_mandir}/man8/samba-tool.8* +%files dc-provision +%{_datadir}/samba/setup + ### DC-LIBS %files dc-libs %{_libdir}/samba/libdb-glue-samba4.so From d3255f4ba650c90bbe1bcbec9e237664bc9cfab4 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 6 Dec 2019 09:46:03 +0100 Subject: [PATCH 30/51] Fix python3-samba requirement of smaba-test --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index e7e7b1a..8dc79da 100644 --- a/samba.spec +++ b/samba.spec @@ -621,7 +621,7 @@ Requires: libsmbclient = %{samba_depver} %if %with_libwbclient Requires: libwbclient = %{samba_depver} %endif -Requires: python3-%{name} = %{version}-%{release} +Requires: python3-%{name} = %{samba_depver} Requires: perl(Archive::Tar) Provides: samba4-test = %{samba_depver} From 6f0a1892de1807c2aee6134a64f7f40209ea748e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 6 Dec 2019 09:50:31 +0100 Subject: [PATCH 31/51] Always require gnutls >= 3.4.7 --- samba.spec | 22 +++++++++------------- 1 file changed, 9 insertions(+), 13 deletions(-) diff --git a/samba.spec b/samba.spec index 8dc79da..801c721 100644 --- a/samba.spec +++ b/samba.spec @@ -165,6 +165,7 @@ BuildRequires: docbook-style-xsl BuildRequires: e2fsprogs-devel BuildRequires: gawk BuildRequires: gnupg2 +BuildRequires: gnutls-devel >= 3.4.7 BuildRequires: gpgme-devel BuildRequires: jansson-devel BuildRequires: krb5-devel >= %{required_mit_krb5} @@ -188,12 +189,6 @@ BuildRequires: perl(Archive::Tar) BuildRequires: perl(Test::More) BuildRequires: popt-devel BuildRequires: python3-devel -%if %{with_dc} -# Add python3-iso8601 to avoid that the -# version in Samba is being packaged -BuildRequires: python3-iso8601 -BuildRequires: python3-subunit-test -%endif # with_dc BuildRequires: quota-devel BuildRequires: readline-devel BuildRequires: rpcgen @@ -218,15 +213,16 @@ BuildRequires: libcephfs-devel %endif %if %{with_dc} -BuildRequires: bind -BuildRequires: gnutls-devel >= 3.4.7 -BuildRequires: krb5-server >= %{required_mit_krb5} - +# Add python3-iso8601 to avoid that the +# version in Samba is being packaged +BuildRequires: python3-iso8601 +BuildRequires: python3-subunit-test # Required by samba-tool to run tests BuildRequires: python3-crypto -%else -BuildRequires: gnutls-devel >= 3.2.0 -%endif + +BuildRequires: bind +BuildRequires: krb5-server >= %{required_mit_krb5} +%endif # with_dc # pidl requirements BuildRequires: perl(ExtUtils::MakeMaker) From 75fbee791b3cd91f7a505ff28b8e1ca93bf355d7 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 6 Dec 2019 09:58:30 +0100 Subject: [PATCH 32/51] Fix spec file warnings Mark end of %endif with a comment in an extra line --- samba.spec | 56 +++++++++++++++++++++++++++++++++++++----------------- 1 file changed, 39 insertions(+), 17 deletions(-) diff --git a/samba.spec b/samba.spec index 801c721..27ec54b 100644 --- a/samba.spec +++ b/samba.spec @@ -41,7 +41,9 @@ %if 0%{?fedora} %ifarch aarch64 ppc64le s390x x86_64 %global with_vfs_cephfs 1 +#endifarch %endif +#endif fedora %endif %global with_vfs_glusterfs 1 @@ -50,7 +52,9 @@ # Only enable on x86_64 %ifarch x86_64 %global with_vfs_glusterfs 1 +#endif arch %endif +#endif rhel %endif %global with_intel_aes_accel 0 @@ -222,7 +226,8 @@ BuildRequires: python3-crypto BuildRequires: bind BuildRequires: krb5-server >= %{required_mit_krb5} -%endif # with_dc +#endif with_dc +%endif # pidl requirements BuildRequires: perl(ExtUtils::MakeMaker) @@ -412,7 +417,8 @@ Requires: bind %description dc-bind-dlz The %{name}-dc-bind-dlz package contains the libraries for bind to manage all name server related details of Samba AD. -%endif # with_dc +#endif with_dc +%endif ### DEVEL %package devel @@ -437,6 +443,7 @@ Requires: %{name}-libs = %{samba_depver} %description vfs-cephfs Samba VFS module for Ceph distributed storage system integration. +#endif with_vfs_cephfs %endif ### GLUSTER @@ -514,7 +521,8 @@ Requires: libsmbclient = %{samba_depver} The libsmbclient-devel package contains the header files and libraries needed to develop programs that link against the SMB client library in the Samba suite. -%endif # with_libsmbclient +#endif with_libsmbclient +%endif ### LIBWBCLIENT %if %with_libwbclient @@ -536,7 +544,8 @@ Obsoletes: samba-winbind-devel < %{samba_depver} %description -n libwbclient-devel The libwbclient-devel package provides developer tools for the wbclient library. -%endif # with_libwbclient +#endif with_libwbclient +%endif ### PYTHON3 %package -n python3-%{name} @@ -780,7 +789,8 @@ CTDB is a cluster implementation of the TDB database used by Samba and other projects to store temporary data. If an application is already using TDB for temporary data it is very easy to convert that application to be cluster aware and use CTDB instead. -%endif # with_clustering_support +#endif with_clustering_support +%endif @@ -1048,7 +1058,8 @@ for f in samba/libsamba-net-samba4.so \ pkgconfig/samba-policy.pc ; do rm -f %{buildroot}%{_libdir}/$f done -%endif # ! with_dc +#endif ! with_dc +%endif pushd pidl make DESTDIR=%{buildroot} install_vendor @@ -1063,7 +1074,8 @@ popd %if %{with testsuite} %check TDB_NO_FSYNC=1 make %{?_smp_mflags} test -%endif # with testsuite +#endif with testsuite +%endif %post %systemd_post smb.service @@ -1115,7 +1127,8 @@ fi %postun dc %systemd_postun_with_restart samba.service -%endif # with_dc +#endif with_dc +%endif %post krb5-printing %{_sbindir}/update-alternatives --install %{_libexecdir}/samba/cups_backend_smb \ @@ -1171,7 +1184,8 @@ else %{_sbindir}/update-alternatives --remove libwbclient.so%{libwbc_alternatives_suffix} %{_libdir}/samba/wbclient/libwbclient.so fi -%endif # with_libwbclient +#endif with_libwbclient +%endif %ldconfig_scriptlets test @@ -1498,12 +1512,14 @@ fi %if ! %with_libwbclient %{_libdir}/samba/libwbclient.so.* %{_libdir}/samba/libwinbind-client-samba4.so -%endif # ! with_libwbclient +#endif ! with_libwbclient +%endif %if ! %with_libsmbclient %{_libdir}/samba/libsmbclient.so.* %{_mandir}/man7/libsmbclient.7* -%endif # ! with_libsmbclient +#endif ! with_libsmbclient +%endif ### COMMON %files common @@ -1673,7 +1689,8 @@ fi %{_libdir}/samba/bind9/dlz_bind9_10.so %{_libdir}/samba/bind9/dlz_bind9_11.so %{_libdir}/samba/bind9/dlz_bind9_12.so -%endif # with_dc +#endif with_dc +%endif ### DEVEL %files devel @@ -1796,11 +1813,13 @@ fi %if ! %with_libsmbclient %{_includedir}/samba-4.0/libsmbclient.h -%endif # ! with_libsmbclient +#endif ! with_libsmbclient +%endif %if ! %with_libwbclient %{_includedir}/samba-4.0/wbclient.h -%endif # ! with_libwbclient +#endif ! with_libwbclient +%endif ### VFS-CEPHFS %if %{with_vfs_cephfs} @@ -1846,7 +1865,8 @@ fi %{_libdir}/libsmbclient.so %{_libdir}/pkgconfig/smbclient.pc %{_mandir}/man7/libsmbclient.7* -%endif # with_libsmbclient +#endif with_libsmbclient +%endif ### LIBWBCLIENT %if %with_libwbclient @@ -1859,7 +1879,8 @@ fi %{_includedir}/samba-4.0/wbclient.h %{_libdir}/samba/wbclient/libwbclient.so %{_libdir}/pkgconfig/wbclient.pc -%endif # with_libwbclient +#endif with_libwbclient +%endif ### PIDL %files pidl @@ -3492,7 +3513,8 @@ fi %dir %{_datadir}/ctdb/tests/tool/scripts %{_datadir}/ctdb/tests/tool/scripts/local.sh -%endif # with_clustering_support +#endif with_clustering_support +%endif %changelog * Thu Dec 05 2019 Andreas Schneider - 4.11.2-2 From b25be670594599b2a5d2a2cca7298e844a2e659a Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 6 Dec 2019 11:24:03 +0100 Subject: [PATCH 33/51] Fix URL --- samba.spec | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 27ec54b..0c792e1 100644 --- a/samba.spec +++ b/samba.spec @@ -106,7 +106,7 @@ Epoch: 2 Summary: Server and Client software to interoperate with Windows machines License: GPLv3+ and LGPLv3+ -URL: http://www.samba.org/ +URL: https://www.samba.org # This is a xz recompressed file of https://ftp.samba.org/pub/samba/samba-%%{version}%%{pre_release}.tar.gz Source0: https://ftp.samba.org/pub/samba/samba-%{version}%{pre_release}.tar.gz#/samba-%{version}%{pre_release}.tar.xz @@ -1650,6 +1650,7 @@ fi %{_mandir}/man8/samba-tool.8* %files dc-provision +%license source4/setup/ad-schema/licence.txt %{_datadir}/samba/setup ### DC-LIBS From 5c144e4c79bff9201fd268283cbc02446003f642 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 10 Dec 2019 12:47:52 +0100 Subject: [PATCH 34/51] Update to Samba 4.11.3 resolves: #1778586, #1781542 - Security fixes for CVE-2019-14861 resolves: #1778589, #1781545 - Security fixes for CVE-2019-14870 Guenther --- .gitignore | 2 ++ samba.spec | 9 +++++++-- sources | 4 ++-- 3 files changed, 11 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 3f4c455..5a97d67 100644 --- a/.gitignore +++ b/.gitignore @@ -183,3 +183,5 @@ samba-3.6.0pre1.tar.gz /samba-4.11.1.tar.asc /samba-4.11.2.tar.xz /samba-4.11.2.tar.asc +/samba-4.11.3.tar.xz +/samba-4.11.3.tar.asc diff --git a/samba.spec b/samba.spec index 0c792e1..57576fa 100644 --- a/samba.spec +++ b/samba.spec @@ -6,9 +6,9 @@ # ctdb is enabled by default, you can disable it with: --without clustering %bcond_without clustering -%define main_release 2 +%define main_release 0 -%define samba_version 4.11.2 +%define samba_version 4.11.3 %define talloc_version 2.2.0 %define tdb_version 1.4.2 %define tevent_version 0.10.0 @@ -3518,6 +3518,11 @@ fi %endif %changelog +* Tue Dec 10 2019 Guenther Deschner - 4.11.3-0 +- Update to Samba 4.11.3 +- resolves: #1778586, #1781542 - Security fixes for CVE-2019-14861 +- resolves: #1778589, #1781545 - Security fixes for CVE-2019-14870 + * Thu Dec 05 2019 Andreas Schneider - 4.11.2-2 - Restart winbindd on samba-winbind package upgrade diff --git a/sources b/sources index 7c95f4a..7264c8c 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.11.2.tar.xz) = 077fa15f8c25560592b4270c2c5b356c4b2f8d63bba664dca67bf7def0b4cf4f2275984c56796161166b9835f4e388c411fb91f3c17537c4b5fb566a21795d12 -SHA512 (samba-4.11.2.tar.asc) = 95c6225008cb3a2361cfab0f9d7138b012e053cb66e2a40a27abc103064b96e05e969d53a31a5c64096a669654564329e4b94dc9f6c99342b53d1def76a6c65f +SHA512 (samba-4.11.3.tar.xz) = 5a68491af4c4cd53843df7ea12ebd5217776b348c6e1a1023518ac5737615606ed19ab416918e4b43461852b99d1894d0a88fd17420e398a13b273ab869a199e +SHA512 (samba-4.11.3.tar.asc) = 47e5f538b7e6c182717d29aebf50f0d5e5c0b3ba479b57d8587da2c3f97c865cf02303ec03ed5ac93f098ebc8825b830307844419cfa3e7e89a3fe7b0375251b From 4fcec48e5400a7dc98cb67fd06e67e71da86fe88 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 16 Dec 2019 16:21:48 +0100 Subject: [PATCH 35/51] Update to Samba 4.11.4 Guenther --- .gitignore | 2 ++ samba.spec | 9 +++++++-- sources | 4 ++-- 3 files changed, 11 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 5a97d67..7fd324b 100644 --- a/.gitignore +++ b/.gitignore @@ -185,3 +185,5 @@ samba-3.6.0pre1.tar.gz /samba-4.11.2.tar.asc /samba-4.11.3.tar.xz /samba-4.11.3.tar.asc +/samba-4.11.4.tar.xz +/samba-4.11.4.tar.asc diff --git a/samba.spec b/samba.spec index 57576fa..0c538c1 100644 --- a/samba.spec +++ b/samba.spec @@ -8,11 +8,11 @@ %define main_release 0 -%define samba_version 4.11.3 +%define samba_version 4.11.4 %define talloc_version 2.2.0 %define tdb_version 1.4.2 %define tevent_version 0.10.0 -%define ldb_version 2.0.7 +%define ldb_version 2.0.8 # This should be rc1 or nil %define pre_release %nil @@ -2315,6 +2315,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/segfault.*.pyc %{python3_sitearch}/samba/tests/__pycache__/smb.*.pyc %{python3_sitearch}/samba/tests/__pycache__/smbd_base.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/smbd_fuzztest.*.pyc %{python3_sitearch}/samba/tests/__pycache__/source.*.pyc %{python3_sitearch}/samba/tests/__pycache__/strings.*.pyc %{python3_sitearch}/samba/tests/__pycache__/subunitrun.*.pyc @@ -2560,6 +2561,7 @@ fi %{python3_sitearch}/samba/tests/segfault.py %{python3_sitearch}/samba/tests/smb.py %{python3_sitearch}/samba/tests/smbd_base.py +%{python3_sitearch}/samba/tests/smbd_fuzztest.py %{python3_sitearch}/samba/tests/source.py %{python3_sitearch}/samba/tests/strings.py %{python3_sitearch}/samba/tests/subunitrun.py @@ -3518,6 +3520,9 @@ fi %endif %changelog +* Mon Dec 16 2019 Guenther Deschner - 4.11.4-0 +- Update to Samba 4.11.4 + * Tue Dec 10 2019 Guenther Deschner - 4.11.3-0 - Update to Samba 4.11.3 - resolves: #1778586, #1781542 - Security fixes for CVE-2019-14861 diff --git a/sources b/sources index 7264c8c..76a0369 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.11.3.tar.xz) = 5a68491af4c4cd53843df7ea12ebd5217776b348c6e1a1023518ac5737615606ed19ab416918e4b43461852b99d1894d0a88fd17420e398a13b273ab869a199e -SHA512 (samba-4.11.3.tar.asc) = 47e5f538b7e6c182717d29aebf50f0d5e5c0b3ba479b57d8587da2c3f97c865cf02303ec03ed5ac93f098ebc8825b830307844419cfa3e7e89a3fe7b0375251b +SHA512 (samba-4.11.4.tar.xz) = dd6509bd9b0cd79842e39c87f749ee2eaf88ceb4866c2a8cd68be6b5d012406456d783e2e60d6f15af5d9d7be40e73a7e478a19ba94decfccb381270ba71c507 +SHA512 (samba-4.11.4.tar.asc) = 204e1781e20e148bea763c31debc1c2d7df78de96308f55cc185617d79d32b7921aea5cdccff8c70c1709169f3a8a9701a9a2e80466b7c12cbba04b234525ba6 From 64f225a13b2d6cc0b5cb94137ded3f8eaa974457 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 10 Jan 2020 15:11:17 +0100 Subject: [PATCH 36/51] Fix manual libwbclient alternative settings --- samba.spec | 25 +++++++++++++++++-------- 1 file changed, 17 insertions(+), 8 deletions(-) diff --git a/samba.spec b/samba.spec index 0c538c1..d1f2e80 100644 --- a/samba.spec +++ b/samba.spec @@ -1159,10 +1159,12 @@ fi %{?ldconfig} %preun -n libwbclient -%{_sbindir}/update-alternatives \ - --remove \ - libwbclient.so.%{libwbc_alternatives_version}%{libwbc_alternatives_suffix} \ - %{_libdir}/samba/wbclient/libwbclient.so.%{libwbc_alternatives_version} +if [ $1 -eq 0 ]; then + %{_sbindir}/update-alternatives \ + --remove \ + libwbclient.so.%{libwbc_alternatives_version}%{libwbc_alternatives_suffix} \ + %{_libdir}/samba/wbclient/libwbclient.so.%{libwbc_alternatives_version} +fi /sbin/ldconfig %posttrans -n libwbclient-devel @@ -1178,10 +1180,17 @@ fi # When downgrading to a version where alternatives is not used and # libwbclient.so is a link and not a file it will be removed. The following # check removes the alternatives files manually if that is the case. -if [ "`readlink %{_libdir}/libwbclient.so`" == "libwbclient.so.%{libwbc_alternatives_version}" ]; then - /bin/rm -f /etc/alternatives/libwbclient.so%{libwbc_alternatives_suffix} /var/lib/alternatives/libwbclient.so%{libwbc_alternatives_suffix} 2> /dev/null -else - %{_sbindir}/update-alternatives --remove libwbclient.so%{libwbc_alternatives_suffix} %{_libdir}/samba/wbclient/libwbclient.so +if [ $1 -eq 0 ]; then + if [ "`readlink %{_libdir}/libwbclient.so`" == "libwbclient.so.%{libwbc_alternatives_version}" ]; then + /bin/rm -f \ + /etc/alternatives/libwbclient.so%{libwbc_alternatives_suffix} \ + /var/lib/alternatives/libwbclient.so%{libwbc_alternatives_suffix} 2> /dev/null + else + %{_sbindir}/update-alternatives \ + --remove \ + libwbclient.so%{libwbc_alternatives_suffix} \ + %{_libdir}/samba/wbclient/libwbclient.so + fi fi #endif with_libwbclient From e655147cf1d62afd373441a02669fc11bc6bb7c1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 21 Jan 2020 11:40:10 +0100 Subject: [PATCH 37/51] Update to Samba 4.11.5 resolves: #1791201, #1793405 - Security fixes for CVE-2019-14902 resolves: #1791207, #1793407 - Security fixes for CVE-2019-14907 resolves: #1791204, #1793406 - Security fixes for CVE-2019-19344 Guenther --- .gitignore | 2 ++ samba.spec | 8 +++++++- sources | 4 ++-- 3 files changed, 11 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 7fd324b..5f58832 100644 --- a/.gitignore +++ b/.gitignore @@ -187,3 +187,5 @@ samba-3.6.0pre1.tar.gz /samba-4.11.3.tar.asc /samba-4.11.4.tar.xz /samba-4.11.4.tar.asc +/samba-4.11.5.tar.xz +/samba-4.11.5.tar.asc diff --git a/samba.spec b/samba.spec index d1f2e80..f98630c 100644 --- a/samba.spec +++ b/samba.spec @@ -8,7 +8,7 @@ %define main_release 0 -%define samba_version 4.11.4 +%define samba_version 4.11.5 %define talloc_version 2.2.0 %define tdb_version 1.4.2 %define tevent_version 0.10.0 @@ -3529,6 +3529,12 @@ fi %endif %changelog +* Tue Jan 21 2020 Guenther Deschner - 4.11.5-0 +- Update to Samba 4.11.5 +- resolves: #1791201, #1793405 - Security fixes for CVE-2019-14902 +- resolves: #1791207, #1793407 - Security fixes for CVE-2019-14907 +- resolves: #1791204, #1793406 - Security fixes for CVE-2019-19344 + * Mon Dec 16 2019 Guenther Deschner - 4.11.4-0 - Update to Samba 4.11.4 diff --git a/sources b/sources index 76a0369..9681c2e 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.11.4.tar.xz) = dd6509bd9b0cd79842e39c87f749ee2eaf88ceb4866c2a8cd68be6b5d012406456d783e2e60d6f15af5d9d7be40e73a7e478a19ba94decfccb381270ba71c507 -SHA512 (samba-4.11.4.tar.asc) = 204e1781e20e148bea763c31debc1c2d7df78de96308f55cc185617d79d32b7921aea5cdccff8c70c1709169f3a8a9701a9a2e80466b7c12cbba04b234525ba6 +SHA512 (samba-4.11.5.tar.xz) = 476a6f9104c4fe80ac6390c862403f0cb27be7ce4d70d510b773d9339f315fd88bcad82a087b4d5b1939eb3346b861fec3522faae92b1e13eb42fdc19425d48e +SHA512 (samba-4.11.5.tar.asc) = 0cb45e512046c3668c64a5e1e80eb0d0200281093d1c6bd3f924a332c220c23c913b1333d9a2a2623d232d2fbe269baf2b5fce3b9f2a16d785bd84282255577b From 9e7933acd08152db4a41816db50f5e2154742f61 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 21 Jan 2020 15:36:57 +0100 Subject: [PATCH 38/51] Fix typo in package description Guenther --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index f98630c..d7d2463 100644 --- a/samba.spec +++ b/samba.spec @@ -391,7 +391,7 @@ Summary: Samba AD files to provision a DC BuildArch: noarch %description dc-provision -The samba-dc-provision package provides files to setup a domoin controller +The samba-dc-provision package provides files to setup a domain controller ### DC-LIBS %package dc-libs From 35ba9ba00d4e4d34d246b7c0f9b3e46b9e5adad2 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 23 Jan 2020 12:04:39 +0100 Subject: [PATCH 39/51] Fail 'make test' immediately --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index d7d2463..dab8475 100644 --- a/samba.spec +++ b/samba.spec @@ -1073,7 +1073,7 @@ popd %if %{with testsuite} %check -TDB_NO_FSYNC=1 make %{?_smp_mflags} test +TDB_NO_FSYNC=1 make %{?_smp_mflags} test FAIL_IMMEDIATELY=1 #endif with testsuite %endif From b9cfd9a1021ff8c628b196d29da28662d55f1e08 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 23 Jan 2020 12:05:57 +0100 Subject: [PATCH 40/51] Remove obsolete python3 requirements --- samba.spec | 3 --- 1 file changed, 3 deletions(-) diff --git a/samba.spec b/samba.spec index dab8475..1560af9 100644 --- a/samba.spec +++ b/samba.spec @@ -220,9 +220,6 @@ BuildRequires: libcephfs-devel # Add python3-iso8601 to avoid that the # version in Samba is being packaged BuildRequires: python3-iso8601 -BuildRequires: python3-subunit-test -# Required by samba-tool to run tests -BuildRequires: python3-crypto BuildRequires: bind BuildRequires: krb5-server >= %{required_mit_krb5} From 11d719327d005def7eaef8042b4e382a05eed5ca Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 28 Jan 2020 13:07:13 +0100 Subject: [PATCH 41/51] Update to Samba 4.11.6 Guenther --- .gitignore | 2 ++ samba.spec | 7 ++++++- sources | 4 ++-- 3 files changed, 10 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 5f58832..d385f00 100644 --- a/.gitignore +++ b/.gitignore @@ -189,3 +189,5 @@ samba-3.6.0pre1.tar.gz /samba-4.11.4.tar.asc /samba-4.11.5.tar.xz /samba-4.11.5.tar.asc +/samba-4.11.6.tar.xz +/samba-4.11.6.tar.asc diff --git a/samba.spec b/samba.spec index 1560af9..7796ed2 100644 --- a/samba.spec +++ b/samba.spec @@ -8,7 +8,7 @@ %define main_release 0 -%define samba_version 4.11.5 +%define samba_version 4.11.6 %define talloc_version 2.2.0 %define tdb_version 1.4.2 %define tevent_version 0.10.0 @@ -2315,6 +2315,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/s3registry.*.pyc %{python3_sitearch}/samba/tests/__pycache__/s3windb.*.pyc %{python3_sitearch}/samba/tests/__pycache__/samba3sam.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/samba_upgradedns_lmdb.*.pyc %{python3_sitearch}/samba/tests/__pycache__/samdb.*.pyc %{python3_sitearch}/samba/tests/__pycache__/samdb_api.*.pyc %{python3_sitearch}/samba/tests/__pycache__/security.*.pyc @@ -2495,6 +2496,7 @@ fi %{python3_sitearch}/samba/tests/s3registry.py %{python3_sitearch}/samba/tests/s3windb.py %{python3_sitearch}/samba/tests/samba3sam.py +%{python3_sitearch}/samba/tests/samba_upgradedns_lmdb.py %dir %{python3_sitearch}/samba/tests/samba_tool %{python3_sitearch}/samba/tests/samba_tool/__init__.py %dir %{python3_sitearch}/samba/tests/samba_tool/__pycache__ @@ -3526,6 +3528,9 @@ fi %endif %changelog +* Tue Jan 28 2020 Guenther Deschner - 4.11.6-0 +- Update to Samba 4.11.6 + * Tue Jan 21 2020 Guenther Deschner - 4.11.5-0 - Update to Samba 4.11.5 - resolves: #1791201, #1793405 - Security fixes for CVE-2019-14902 diff --git a/sources b/sources index 9681c2e..84584d6 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.11.5.tar.xz) = 476a6f9104c4fe80ac6390c862403f0cb27be7ce4d70d510b773d9339f315fd88bcad82a087b4d5b1939eb3346b861fec3522faae92b1e13eb42fdc19425d48e -SHA512 (samba-4.11.5.tar.asc) = 0cb45e512046c3668c64a5e1e80eb0d0200281093d1c6bd3f924a332c220c23c913b1333d9a2a2623d232d2fbe269baf2b5fce3b9f2a16d785bd84282255577b +SHA512 (samba-4.11.6.tar.xz) = f91379c2d9ad3597cba398cc790f4f98a9048e3cd62082f2d18ee1364c1be01c204b90d24123f5bacbc59852f9630a917cf94c8d572dc878d26e7168896e6812 +SHA512 (samba-4.11.6.tar.asc) = f6780a83f898be3da0c9657bea6f1805520d017c596908be33410069fecb264dc7be9b617df625183ac7139765af8d16a4c6d42ba9bce09ea14613a36d1b62cf From 9aaf72af0f707324a1f84771eaf8dc0a372deb1d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 10 Mar 2020 13:26:42 +0100 Subject: [PATCH 42/51] Update to Samba 4.11.7 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index d385f00..e6049ca 100644 --- a/.gitignore +++ b/.gitignore @@ -191,3 +191,5 @@ samba-3.6.0pre1.tar.gz /samba-4.11.5.tar.asc /samba-4.11.6.tar.xz /samba-4.11.6.tar.asc +/samba-4.11.7.tar.xz +/samba-4.11.7.tar.asc diff --git a/samba.spec b/samba.spec index 7796ed2..da6b68e 100644 --- a/samba.spec +++ b/samba.spec @@ -8,11 +8,11 @@ %define main_release 0 -%define samba_version 4.11.6 +%define samba_version 4.11.7 %define talloc_version 2.2.0 %define tdb_version 1.4.2 %define tevent_version 0.10.0 -%define ldb_version 2.0.8 +%define ldb_version 2.0.9 # This should be rc1 or nil %define pre_release %nil @@ -3528,6 +3528,9 @@ fi %endif %changelog +* Tue Mar 10 2020 Guenther Deschner - 4.11.7-0 +- Update to Samba 4.11.7 + * Tue Jan 28 2020 Guenther Deschner - 4.11.6-0 - Update to Samba 4.11.6 diff --git a/sources b/sources index 84584d6..0256c6e 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.11.6.tar.xz) = f91379c2d9ad3597cba398cc790f4f98a9048e3cd62082f2d18ee1364c1be01c204b90d24123f5bacbc59852f9630a917cf94c8d572dc878d26e7168896e6812 -SHA512 (samba-4.11.6.tar.asc) = f6780a83f898be3da0c9657bea6f1805520d017c596908be33410069fecb264dc7be9b617df625183ac7139765af8d16a4c6d42ba9bce09ea14613a36d1b62cf +SHA512 (samba-4.11.7.tar.xz) = c67e33a48484817a3ab7ec32748c97ce3f0efa2c878c6d311fd02d1f9007d565666d9993614d71bf9f02a9ee81d5940cabd098e0042810f627444c9edc6c6630 +SHA512 (samba-4.11.7.tar.asc) = 4f91b3fb3a3939090097ed0ebd3cf5b2086720c5f4da6397f674673b171cddd2908dae489ba14221d49cd3ea439b4d9aaa7df8560dfc771cf03a669dd9f606fc From 5b3e9f9ab5c0957069c10d861cb31edcabf05bd5 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Sun, 12 Apr 2020 10:58:20 +0300 Subject: [PATCH 43/51] Revert POSIX stat tuning patch Fixes: rhbz#1801442 --- ...-to-find-posix-stat-info-in-SMBC_get.patch | 91 +++++++++++++++++++ samba.spec | 7 +- 2 files changed, 97 insertions(+), 1 deletion(-) create mode 100644 0001-libsmb-Don-t-try-to-find-posix-stat-info-in-SMBC_get.patch diff --git a/0001-libsmb-Don-t-try-to-find-posix-stat-info-in-SMBC_get.patch b/0001-libsmb-Don-t-try-to-find-posix-stat-info-in-SMBC_get.patch new file mode 100644 index 0000000..ba901a4 --- /dev/null +++ b/0001-libsmb-Don-t-try-to-find-posix-stat-info-in-SMBC_get.patch @@ -0,0 +1,91 @@ +From 686ea46cbc9538355815fe800e441d67fee6a9db Mon Sep 17 00:00:00 2001 +From: Volker Lendecke +Date: Thu, 19 Mar 2020 11:01:41 +0100 +Subject: [PATCH] libsmb: Don't try to find posix stat info in SMBC_getatr() + +This wrongly used "frame" instead of "fname", which can never have +worked. A first attempt to fix in 51551e0d53fa6 caused a few followup +patches in an attempt to clean up the test failures 51551e0d53fa6 +introduced. They were reverted after a few discussions. So rather than +changing behaviour, just remove the code that introduced the valgrind +error again. + +Signed-off-by: Volker Lendecke +Reviewed-by: Andreas Schneider + +Autobuild-User(master): Jeremy Allison +Autobuild-Date(master): Fri Mar 20 05:06:07 UTC 2020 on sn-devel-184 + +(cherry picked from commit 39c910fd9cba3caf7414274b678b9eee33d7e20b) +--- + source3/include/libsmb_internal.h | 1 - + source3/libsmb/libsmb_file.c | 20 -------------------- + source3/libsmb/libsmb_server.c | 9 --------- + 3 files changed, 30 deletions(-) + +diff --git a/source3/include/libsmb_internal.h b/source3/include/libsmb_internal.h +index 21a11c1a024..feedddd0877 100644 +--- a/source3/include/libsmb_internal.h ++++ b/source3/include/libsmb_internal.h +@@ -76,7 +76,6 @@ typedef struct DOS_ATTR_DESC { + struct _SMBCSRV { + struct cli_state *cli; + dev_t dev; +- bool try_posixinfo; + bool no_pathinfo; + bool no_pathinfo2; + bool no_pathinfo3; +diff --git a/source3/libsmb/libsmb_file.c b/source3/libsmb/libsmb_file.c +index 1577010e490..f0a16c61a83 100644 +--- a/source3/libsmb/libsmb_file.c ++++ b/source3/libsmb/libsmb_file.c +@@ -504,26 +504,6 @@ SMBC_getatr(SMBCCTX * context, + return False; + } + +- if (srv->try_posixinfo) { +- SMB_STRUCT_STAT sbuf; +- +- status = cli_posix_stat(targetcli, frame, &sbuf); +- if (NT_STATUS_IS_OK(status)) { +- setup_stat_from_stat_ex(&sbuf, path, sb); +- +- TALLOC_FREE(frame); +- return true; +- } +- if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_IMPLEMENTED) || +- NT_STATUS_EQUAL(status, NT_STATUS_INVALID_LEVEL)) { +- /* +- * Turn this off if the server doesn't +- * support it. +- */ +- srv->try_posixinfo = false; +- } +- } +- + if (!srv->no_pathinfo2) { + status = cli_qpathinfo2(targetcli, + targetpath, +diff --git a/source3/libsmb/libsmb_server.c b/source3/libsmb/libsmb_server.c +index d4f71d8c8b7..0067df48cac 100644 +--- a/source3/libsmb/libsmb_server.c ++++ b/source3/libsmb/libsmb_server.c +@@ -657,15 +657,6 @@ SMBC_server_internal(TALLOC_CTX *ctx, + ZERO_STRUCTP(srv); + DLIST_ADD(srv->cli, c); + srv->dev = (dev_t)(str_checksum(server) ^ str_checksum(share)); +- srv->try_posixinfo = false; +- /* +- * Until SMB2 POSIX is done, only +- * try POSIX stat on SMB1 with POSIX capabilities. +- */ +- if ((smbXcli_conn_protocol(c->conn) < PROTOCOL_SMB2_02) && +- (smb1cli_conn_capabilities(c->conn) & CAP_UNIX)) { +- srv->try_posixinfo = true; +- } + srv->no_pathinfo = False; + srv->no_pathinfo2 = False; + srv->no_pathinfo3 = False; +-- +2.26.0 + diff --git a/samba.spec b/samba.spec index da6b68e..bdd6899 100644 --- a/samba.spec +++ b/samba.spec @@ -6,7 +6,7 @@ # ctdb is enabled by default, you can disable it with: --without clustering %bcond_without clustering -%define main_release 0 +%define main_release 1 %define samba_version 4.11.7 %define talloc_version 2.2.0 @@ -125,6 +125,7 @@ Source201: README.downgrade Patch100: 0000-use-gnutls-for-des-cbc.patch Patch101: 0001-handle-removal-des-enctypes-from-krb5.patch Patch102: 0002-samba-tool-create-working-private-krb5.conf.patch +Patch999: 0001-libsmb-Don-t-try-to-find-posix-stat-info-in-SMBC_get.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -3528,6 +3529,10 @@ fi %endif %changelog +* Sun Apr 12 2020 Alexander Bokovoy - 4.11.7-1 +- Revert SMBv1 POSIX stat use in libsmb by default +- Resolves: rhbz#1801442 + * Tue Mar 10 2020 Guenther Deschner - 4.11.7-0 - Update to Samba 4.11.7 From b2cc3a08917a1cc07c8f4ccd83768bb2d2a75143 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 28 Apr 2020 11:14:37 +0200 Subject: [PATCH 44/51] Update to Samba 4.11.8 resolves: #1825731, #1828870 - Security fixes for CVE-2020-10700 resolves: #1825734, #1828872 - Security fixes for CVE-2020-10704 Guenther --- .gitignore | 2 ++ samba.spec | 13 ++++++++++--- sources | 4 ++-- 3 files changed, 14 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index e6049ca..7c4a937 100644 --- a/.gitignore +++ b/.gitignore @@ -193,3 +193,5 @@ samba-3.6.0pre1.tar.gz /samba-4.11.6.tar.asc /samba-4.11.7.tar.xz /samba-4.11.7.tar.asc +/samba-4.11.8.tar.xz +/samba-4.11.8.tar.asc diff --git a/samba.spec b/samba.spec index bdd6899..5503b98 100644 --- a/samba.spec +++ b/samba.spec @@ -6,13 +6,13 @@ # ctdb is enabled by default, you can disable it with: --without clustering %bcond_without clustering -%define main_release 1 +%define main_release 0 -%define samba_version 4.11.7 +%define samba_version 4.11.8 %define talloc_version 2.2.0 %define tdb_version 1.4.2 %define tevent_version 0.10.0 -%define ldb_version 2.0.9 +%define ldb_version 2.0.10 # This should be rc1 or nil %define pre_release %nil @@ -2275,6 +2275,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/hostconfig.*.pyc %{python3_sitearch}/samba/tests/__pycache__/join.*.pyc %{python3_sitearch}/samba/tests/__pycache__/krb5_credentials.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/ldap_raw.*.pyc %{python3_sitearch}/samba/tests/__pycache__/ldap_referrals.*.pyc %{python3_sitearch}/samba/tests/__pycache__/loadparm.*.pyc %{python3_sitearch}/samba/tests/__pycache__/libsmb.*.pyc @@ -2456,6 +2457,7 @@ fi %{python3_sitearch}/samba/tests/kcc/kcc_utils.py %{python3_sitearch}/samba/tests/kcc/ldif_import_export.py %{python3_sitearch}/samba/tests/krb5_credentials.py +%{python3_sitearch}/samba/tests/ldap_raw.py %{python3_sitearch}/samba/tests/ldap_referrals.py %{python3_sitearch}/samba/tests/libsmb.py %{python3_sitearch}/samba/tests/loadparm.py @@ -3529,6 +3531,11 @@ fi %endif %changelog +* Tue Apr 28 2020 Guenther Deschner - 4.11.8-0 +- Update to Samba 4.11.8 +- resolves: #1825731, #1828870 - Security fixes for CVE-2020-10700 +- resolves: #1825734, #1828872 - Security fixes for CVE-2020-10704 + * Sun Apr 12 2020 Alexander Bokovoy - 4.11.7-1 - Revert SMBv1 POSIX stat use in libsmb by default - Resolves: rhbz#1801442 diff --git a/sources b/sources index 0256c6e..a667ae0 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.11.7.tar.xz) = c67e33a48484817a3ab7ec32748c97ce3f0efa2c878c6d311fd02d1f9007d565666d9993614d71bf9f02a9ee81d5940cabd098e0042810f627444c9edc6c6630 -SHA512 (samba-4.11.7.tar.asc) = 4f91b3fb3a3939090097ed0ebd3cf5b2086720c5f4da6397f674673b171cddd2908dae489ba14221d49cd3ea439b4d9aaa7df8560dfc771cf03a669dd9f606fc +SHA512 (samba-4.11.8.tar.xz) = 50de5458cf1e7635d0aec84e1f2379af361754215e0afc57b91e3b68dc5680ed7640ca2bc33ed8a058aac4897d8712abd1f5efe2a3db149456fec410b4a14f78 +SHA512 (samba-4.11.8.tar.asc) = caf7e02566a9afefd191f456b94b0ac27953b6b0a2d0509a5cb06211505daaa4b8e77c675e9a5c0a3cd12cc24be6cf31aecbf954e7fb476d1668a56f51c5046d From e31caf239ef0f94874ac6fde169692db708d7c8d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 6 May 2020 10:49:29 +0200 Subject: [PATCH 45/51] Update to Samba 4.11.9 Guenther --- .gitignore | 2 + ...-to-find-posix-stat-info-in-SMBC_get.patch | 91 ------------------- samba.spec | 6 +- sources | 4 +- 4 files changed, 8 insertions(+), 95 deletions(-) delete mode 100644 0001-libsmb-Don-t-try-to-find-posix-stat-info-in-SMBC_get.patch diff --git a/.gitignore b/.gitignore index 7c4a937..2e47f2d 100644 --- a/.gitignore +++ b/.gitignore @@ -195,3 +195,5 @@ samba-3.6.0pre1.tar.gz /samba-4.11.7.tar.asc /samba-4.11.8.tar.xz /samba-4.11.8.tar.asc +/samba-4.11.9.tar.xz +/samba-4.11.9.tar.asc diff --git a/0001-libsmb-Don-t-try-to-find-posix-stat-info-in-SMBC_get.patch b/0001-libsmb-Don-t-try-to-find-posix-stat-info-in-SMBC_get.patch deleted file mode 100644 index ba901a4..0000000 --- a/0001-libsmb-Don-t-try-to-find-posix-stat-info-in-SMBC_get.patch +++ /dev/null @@ -1,91 +0,0 @@ -From 686ea46cbc9538355815fe800e441d67fee6a9db Mon Sep 17 00:00:00 2001 -From: Volker Lendecke -Date: Thu, 19 Mar 2020 11:01:41 +0100 -Subject: [PATCH] libsmb: Don't try to find posix stat info in SMBC_getatr() - -This wrongly used "frame" instead of "fname", which can never have -worked. A first attempt to fix in 51551e0d53fa6 caused a few followup -patches in an attempt to clean up the test failures 51551e0d53fa6 -introduced. They were reverted after a few discussions. So rather than -changing behaviour, just remove the code that introduced the valgrind -error again. - -Signed-off-by: Volker Lendecke -Reviewed-by: Andreas Schneider - -Autobuild-User(master): Jeremy Allison -Autobuild-Date(master): Fri Mar 20 05:06:07 UTC 2020 on sn-devel-184 - -(cherry picked from commit 39c910fd9cba3caf7414274b678b9eee33d7e20b) ---- - source3/include/libsmb_internal.h | 1 - - source3/libsmb/libsmb_file.c | 20 -------------------- - source3/libsmb/libsmb_server.c | 9 --------- - 3 files changed, 30 deletions(-) - -diff --git a/source3/include/libsmb_internal.h b/source3/include/libsmb_internal.h -index 21a11c1a024..feedddd0877 100644 ---- a/source3/include/libsmb_internal.h -+++ b/source3/include/libsmb_internal.h -@@ -76,7 +76,6 @@ typedef struct DOS_ATTR_DESC { - struct _SMBCSRV { - struct cli_state *cli; - dev_t dev; -- bool try_posixinfo; - bool no_pathinfo; - bool no_pathinfo2; - bool no_pathinfo3; -diff --git a/source3/libsmb/libsmb_file.c b/source3/libsmb/libsmb_file.c -index 1577010e490..f0a16c61a83 100644 ---- a/source3/libsmb/libsmb_file.c -+++ b/source3/libsmb/libsmb_file.c -@@ -504,26 +504,6 @@ SMBC_getatr(SMBCCTX * context, - return False; - } - -- if (srv->try_posixinfo) { -- SMB_STRUCT_STAT sbuf; -- -- status = cli_posix_stat(targetcli, frame, &sbuf); -- if (NT_STATUS_IS_OK(status)) { -- setup_stat_from_stat_ex(&sbuf, path, sb); -- -- TALLOC_FREE(frame); -- return true; -- } -- if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_IMPLEMENTED) || -- NT_STATUS_EQUAL(status, NT_STATUS_INVALID_LEVEL)) { -- /* -- * Turn this off if the server doesn't -- * support it. -- */ -- srv->try_posixinfo = false; -- } -- } -- - if (!srv->no_pathinfo2) { - status = cli_qpathinfo2(targetcli, - targetpath, -diff --git a/source3/libsmb/libsmb_server.c b/source3/libsmb/libsmb_server.c -index d4f71d8c8b7..0067df48cac 100644 ---- a/source3/libsmb/libsmb_server.c -+++ b/source3/libsmb/libsmb_server.c -@@ -657,15 +657,6 @@ SMBC_server_internal(TALLOC_CTX *ctx, - ZERO_STRUCTP(srv); - DLIST_ADD(srv->cli, c); - srv->dev = (dev_t)(str_checksum(server) ^ str_checksum(share)); -- srv->try_posixinfo = false; -- /* -- * Until SMB2 POSIX is done, only -- * try POSIX stat on SMB1 with POSIX capabilities. -- */ -- if ((smbXcli_conn_protocol(c->conn) < PROTOCOL_SMB2_02) && -- (smb1cli_conn_capabilities(c->conn) & CAP_UNIX)) { -- srv->try_posixinfo = true; -- } - srv->no_pathinfo = False; - srv->no_pathinfo2 = False; - srv->no_pathinfo3 = False; --- -2.26.0 - diff --git a/samba.spec b/samba.spec index 5503b98..8ddd4b2 100644 --- a/samba.spec +++ b/samba.spec @@ -8,7 +8,7 @@ %define main_release 0 -%define samba_version 4.11.8 +%define samba_version 4.11.9 %define talloc_version 2.2.0 %define tdb_version 1.4.2 %define tevent_version 0.10.0 @@ -125,7 +125,6 @@ Source201: README.downgrade Patch100: 0000-use-gnutls-for-des-cbc.patch Patch101: 0001-handle-removal-des-enctypes-from-krb5.patch Patch102: 0002-samba-tool-create-working-private-krb5.conf.patch -Patch999: 0001-libsmb-Don-t-try-to-find-posix-stat-info-in-SMBC_get.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -3531,6 +3530,9 @@ fi %endif %changelog +* Wed May 06 2020 Guenther Deschner - 4.11.9-0 +- Update to Samba 4.11.9 + * Tue Apr 28 2020 Guenther Deschner - 4.11.8-0 - Update to Samba 4.11.8 - resolves: #1825731, #1828870 - Security fixes for CVE-2020-10700 diff --git a/sources b/sources index a667ae0..c4cda82 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.11.8.tar.xz) = 50de5458cf1e7635d0aec84e1f2379af361754215e0afc57b91e3b68dc5680ed7640ca2bc33ed8a058aac4897d8712abd1f5efe2a3db149456fec410b4a14f78 -SHA512 (samba-4.11.8.tar.asc) = caf7e02566a9afefd191f456b94b0ac27953b6b0a2d0509a5cb06211505daaa4b8e77c675e9a5c0a3cd12cc24be6cf31aecbf954e7fb476d1668a56f51c5046d +SHA512 (samba-4.11.9.tar.xz) = 053f4b3407d1f877200bc58ae521a8f4caa2c7e2cbe10452069baadef717867ba06021640dd0bc76b5abb6516b9bc51a0ec36277c486b8d3fa406392e0a1241c +SHA512 (samba-4.11.9.tar.asc) = 8bab1aa80c8dad3abf8e440d61c9034b27fd571ff538509e7e8edf250a247fbd90dd66f09e224b26961e202d5cd642a3f39356db909e13691bd0241e91c15687 From 8d48513ebc1b290ae944c7f2d7147f019f3c440d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 30 Jun 2020 14:15:28 +0200 Subject: [PATCH 46/51] Update to Samba 4.11.10 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 2e47f2d..9ad89b6 100644 --- a/.gitignore +++ b/.gitignore @@ -197,3 +197,5 @@ samba-3.6.0pre1.tar.gz /samba-4.11.8.tar.asc /samba-4.11.9.tar.xz /samba-4.11.9.tar.asc +/samba-4.11.10.tar.xz +/samba-4.11.10.tar.asc diff --git a/samba.spec b/samba.spec index 8ddd4b2..9032a33 100644 --- a/samba.spec +++ b/samba.spec @@ -8,11 +8,11 @@ %define main_release 0 -%define samba_version 4.11.9 +%define samba_version 4.11.10 %define talloc_version 2.2.0 %define tdb_version 1.4.2 %define tevent_version 0.10.0 -%define ldb_version 2.0.10 +%define ldb_version 2.0.11 # This should be rc1 or nil %define pre_release %nil @@ -3530,6 +3530,9 @@ fi %endif %changelog +* Tue Jun 30 2020 Guenther Deschner - 4.11.10-0 +- Update to Samba 4.11.10 + * Wed May 06 2020 Guenther Deschner - 4.11.9-0 - Update to Samba 4.11.9 diff --git a/sources b/sources index c4cda82..90933a0 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.11.9.tar.xz) = 053f4b3407d1f877200bc58ae521a8f4caa2c7e2cbe10452069baadef717867ba06021640dd0bc76b5abb6516b9bc51a0ec36277c486b8d3fa406392e0a1241c -SHA512 (samba-4.11.9.tar.asc) = 8bab1aa80c8dad3abf8e440d61c9034b27fd571ff538509e7e8edf250a247fbd90dd66f09e224b26961e202d5cd642a3f39356db909e13691bd0241e91c15687 +SHA512 (samba-4.11.10.tar.xz) = 549434b8d44b38ee1f8b7ce8663629a904571064ce8094f32df2a98f26dd6b5592964340023fc8234a547b7bf1f30709def93c19ad63cc767172dd9fc8c45557 +SHA512 (samba-4.11.10.tar.asc) = dfda39a803d8a5cf43c91c68d533468a72bedc63dede7e7d9aac838f7e09cd1e6a6b5f3ea67814973d7a722c17873a1fd08a85157597998c417bb899f2c52665 From 9f77451f157f740158cc7fdd1bbeffd685c7b5eb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 2 Jul 2020 11:41:22 +0200 Subject: [PATCH 47/51] Update to Samba 4.11.11 resolves: #1849489, #1853255 - Security fixes for CVE-2020-10730 resolves: #1849491, #1853256 - Security fixes for CVE-2020-10745 resolves: #1849509, #1853276 - Security fixes for CVE-2020-10760 resolves: #1851298, #1853259 - Security fixes for CVE-2020-14303 Guenther --- .gitignore | 2 ++ samba-4.11.12-test_utils_install.patch | 26 ++++++++++++++++++++++++++ samba.spec | 15 +++++++++++++-- sources | 4 ++-- 4 files changed, 43 insertions(+), 4 deletions(-) create mode 100644 samba-4.11.12-test_utils_install.patch diff --git a/.gitignore b/.gitignore index 9ad89b6..a6c4d20 100644 --- a/.gitignore +++ b/.gitignore @@ -199,3 +199,5 @@ samba-3.6.0pre1.tar.gz /samba-4.11.9.tar.asc /samba-4.11.10.tar.xz /samba-4.11.10.tar.asc +/samba-4.11.11.tar.xz +/samba-4.11.11.tar.asc diff --git a/samba-4.11.12-test_utils_install.patch b/samba-4.11.12-test_utils_install.patch new file mode 100644 index 0000000..bbd5fd5 --- /dev/null +++ b/samba-4.11.12-test_utils_install.patch @@ -0,0 +1,26 @@ +From 7080e2b4b9923b54e92dbb920b2d7739444b2c31 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?G=C3=BCnther=20Deschner?= +Date: Thu, 2 Jul 2020 18:56:20 +0200 +Subject: [PATCH] lib/util: do not install "test_util_paths" + +Guenther + +Signed-off-by: Guenther Deschner +--- + lib/util/wscript_build | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/lib/util/wscript_build b/lib/util/wscript_build +index 9cf411007eb..84c19bb136f 100644 +--- a/lib/util/wscript_build ++++ b/lib/util/wscript_build +@@ -285,4 +285,5 @@ else: + bld.SAMBA_BINARY('test_util_paths', + source='tests/test_util_paths.c', + deps='cmocka replace talloc samba-util', +- local_include=False) ++ local_include=False, ++ install=False) +-- +2.26.2 + diff --git a/samba.spec b/samba.spec index 9032a33..bf22294 100644 --- a/samba.spec +++ b/samba.spec @@ -8,11 +8,12 @@ %define main_release 0 -%define samba_version 4.11.10 +%define samba_version 4.11.11 %define talloc_version 2.2.0 %define tdb_version 1.4.2 %define tevent_version 0.10.0 -%define ldb_version 2.0.11 +%define ldb_version 2.0.12 + # This should be rc1 or nil %define pre_release %nil @@ -125,6 +126,7 @@ Source201: README.downgrade Patch100: 0000-use-gnutls-for-des-cbc.patch Patch101: 0001-handle-removal-des-enctypes-from-krb5.patch Patch102: 0002-samba-tool-create-working-private-krb5.conf.patch +Patch103: samba-4.11.12-test_utils_install.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -2255,6 +2257,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/dns_base.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dns_forwarder.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dns_invalid.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/dns_packet.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dns_tkey.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dns_wildcard.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dsdb.*.pyc @@ -2417,6 +2420,7 @@ fi %{python3_sitearch}/samba/tests/dns_forwarder_helpers/__pycache__/server.*.pyc %{python3_sitearch}/samba/tests/dns_forwarder_helpers/server.py %{python3_sitearch}/samba/tests/dns_invalid.py +%{python3_sitearch}/samba/tests/dns_packet.py %{python3_sitearch}/samba/tests/dns_tkey.py %{python3_sitearch}/samba/tests/dns_wildcard.py %{python3_sitearch}/samba/tests/dsdb.py @@ -3530,6 +3534,13 @@ fi %endif %changelog +* Thu Jul 02 2020 Guenther Deschner - 4.11.11-0 +- Update to Samba 4.11.11 +- resolves: #1849489, #1853255 - Security fixes for CVE-2020-10730 +- resolves: #1849491, #1853256 - Security fixes for CVE-2020-10745 +- resolves: #1849509, #1853276 - Security fixes for CVE-2020-10760 +- resolves: #1851298, #1853259 - Security fixes for CVE-2020-14303 + * Tue Jun 30 2020 Guenther Deschner - 4.11.10-0 - Update to Samba 4.11.10 diff --git a/sources b/sources index 90933a0..b847e4d 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.11.10.tar.xz) = 549434b8d44b38ee1f8b7ce8663629a904571064ce8094f32df2a98f26dd6b5592964340023fc8234a547b7bf1f30709def93c19ad63cc767172dd9fc8c45557 -SHA512 (samba-4.11.10.tar.asc) = dfda39a803d8a5cf43c91c68d533468a72bedc63dede7e7d9aac838f7e09cd1e6a6b5f3ea67814973d7a722c17873a1fd08a85157597998c417bb899f2c52665 +SHA512 (samba-4.11.11.tar.xz) = ffc5055c24f0cefa73e0fc9925d3e295824b75aef3e00303a4d05828781da5f4b8989ca24886b673ea165f69ccdd0d3d9a034d1840a8ebeb71c6c439672a3473 +SHA512 (samba-4.11.11.tar.asc) = 45c1a87f3a91c1a20873136ab4fb9600669c0a209590460c487ceea11289ec87427fbf7fc072b0d1f65d35f2786935586c70ca90816e3b739f65a4edde9b6f35 From d375ddcd7deb509e91382555cc369817a2b0390b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 25 Aug 2020 10:17:19 +0200 Subject: [PATCH 48/51] Update to Samba 4.11.12 Guenther --- .gitignore | 2 ++ ...patch => samba-4.11.13-lib_util_wscript.patch | 16 +++++++++------- samba.spec | 13 +++++++++++-- sources | 4 ++-- 4 files changed, 24 insertions(+), 11 deletions(-) rename samba-4.11.12-test_utils_install.patch => samba-4.11.13-lib_util_wscript.patch (58%) diff --git a/.gitignore b/.gitignore index a6c4d20..482c7bf 100644 --- a/.gitignore +++ b/.gitignore @@ -201,3 +201,5 @@ samba-3.6.0pre1.tar.gz /samba-4.11.10.tar.asc /samba-4.11.11.tar.xz /samba-4.11.11.tar.asc +/samba-4.11.12.tar.xz +/samba-4.11.12.tar.asc diff --git a/samba-4.11.12-test_utils_install.patch b/samba-4.11.13-lib_util_wscript.patch similarity index 58% rename from samba-4.11.12-test_utils_install.patch rename to samba-4.11.13-lib_util_wscript.patch index bbd5fd5..3921f3f 100644 --- a/samba-4.11.12-test_utils_install.patch +++ b/samba-4.11.13-lib_util_wscript.patch @@ -1,7 +1,9 @@ -From 7080e2b4b9923b54e92dbb920b2d7739444b2c31 Mon Sep 17 00:00:00 2001 +From 7f2c62dcdebb387b086df37c8dd38a6027d8b631 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= -Date: Thu, 2 Jul 2020 18:56:20 +0200 -Subject: [PATCH] lib/util: do not install "test_util_paths" +Date: Tue, 25 Aug 2020 10:37:18 +0200 +Subject: [PATCH] lib/util: do not install /usr/bin/test_util + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14166 Guenther @@ -11,12 +13,12 @@ Signed-off-by: Guenther Deschner 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/lib/util/wscript_build b/lib/util/wscript_build -index 9cf411007eb..84c19bb136f 100644 +index 4ac0a9cc064..e04752cb130 100644 --- a/lib/util/wscript_build +++ b/lib/util/wscript_build -@@ -285,4 +285,5 @@ else: - bld.SAMBA_BINARY('test_util_paths', - source='tests/test_util_paths.c', +@@ -291,4 +291,5 @@ else: + bld.SAMBA_BINARY('test_util', + source='tests/test_util.c', deps='cmocka replace talloc samba-util', - local_include=False) + local_include=False, diff --git a/samba.spec b/samba.spec index bf22294..cbed781 100644 --- a/samba.spec +++ b/samba.spec @@ -8,7 +8,7 @@ %define main_release 0 -%define samba_version 4.11.11 +%define samba_version 4.11.12 %define talloc_version 2.2.0 %define tdb_version 1.4.2 %define tevent_version 0.10.0 @@ -126,7 +126,7 @@ Source201: README.downgrade Patch100: 0000-use-gnutls-for-des-cbc.patch Patch101: 0001-handle-removal-des-enctypes-from-krb5.patch Patch102: 0002-samba-tool-create-working-private-krb5.conf.patch -Patch103: samba-4.11.12-test_utils_install.patch +Patch103: samba-4.11.13-lib_util_wscript.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -2535,6 +2535,9 @@ fi %{python3_sitearch}/samba/tests/samba_tool/__pycache__/user.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_check_password_script.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_virtualCryptSHA.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_virtualCryptSHA_base.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_virtualCryptSHA_gpg.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_virtualCryptSHA_userPassword.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_wdigest.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/visualize.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/visualize_drs.*.pyc @@ -2566,6 +2569,9 @@ fi %{python3_sitearch}/samba/tests/samba_tool/user.py %{python3_sitearch}/samba/tests/samba_tool/user_check_password_script.py %{python3_sitearch}/samba/tests/samba_tool/user_virtualCryptSHA.py +%{python3_sitearch}/samba/tests/samba_tool/user_virtualCryptSHA_base.py +%{python3_sitearch}/samba/tests/samba_tool/user_virtualCryptSHA_gpg.py +%{python3_sitearch}/samba/tests/samba_tool/user_virtualCryptSHA_userPassword.py %{python3_sitearch}/samba/tests/samba_tool/user_wdigest.py %{python3_sitearch}/samba/tests/samba_tool/visualize.py %{python3_sitearch}/samba/tests/samba_tool/visualize_drs.py @@ -3534,6 +3540,9 @@ fi %endif %changelog +* Tue Aug 25 2020 Guenther Deschner - 4.11.12-0 +- Update to Samba 4.11.12 + * Thu Jul 02 2020 Guenther Deschner - 4.11.11-0 - Update to Samba 4.11.11 - resolves: #1849489, #1853255 - Security fixes for CVE-2020-10730 diff --git a/sources b/sources index b847e4d..8ebef27 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.11.11.tar.xz) = ffc5055c24f0cefa73e0fc9925d3e295824b75aef3e00303a4d05828781da5f4b8989ca24886b673ea165f69ccdd0d3d9a034d1840a8ebeb71c6c439672a3473 -SHA512 (samba-4.11.11.tar.asc) = 45c1a87f3a91c1a20873136ab4fb9600669c0a209590460c487ceea11289ec87427fbf7fc072b0d1f65d35f2786935586c70ca90816e3b739f65a4edde9b6f35 +SHA512 (samba-4.11.12.tar.xz) = 617707ad6ab274c6539bcfdb9422990638aa5f6bd89a373d6b6db4ceffb8027e03c279d937ccb13e9404ea53688fad2e73d32f2303dcc5dfaa596e5b209fadaa +SHA512 (samba-4.11.12.tar.asc) = 5e44093254f92c7fa65e01ee204e4d9546dd5749017f0fffaf2ddb3cfdb10b7935e331d3ec48806fe8278f9b35b44ac089d8479783c6166abca9edf5846b0ed8 From 50d0fd9e207f14d400fb35a40cb7e1c6cfb11caf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Sat, 19 Sep 2020 02:51:28 +0200 Subject: [PATCH 49/51] Update to Samba 4.11.13 resolves: #1879822, #1880703 - Security fixes for CVE-2020-1472 Guenther --- .gitignore | 2 ++ samba.spec | 6 +++++- sources | 4 ++-- 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 482c7bf..386bf91 100644 --- a/.gitignore +++ b/.gitignore @@ -203,3 +203,5 @@ samba-3.6.0pre1.tar.gz /samba-4.11.11.tar.asc /samba-4.11.12.tar.xz /samba-4.11.12.tar.asc +/samba-4.11.13.tar.xz +/samba-4.11.13.tar.asc diff --git a/samba.spec b/samba.spec index cbed781..85bf474 100644 --- a/samba.spec +++ b/samba.spec @@ -8,7 +8,7 @@ %define main_release 0 -%define samba_version 4.11.12 +%define samba_version 4.11.13 %define talloc_version 2.2.0 %define tdb_version 1.4.2 %define tevent_version 0.10.0 @@ -3540,6 +3540,10 @@ fi %endif %changelog +* Fri Sep 18 2020 Guenther Deschner - 4.11.13-0 +- Update to Samba 4.11.13 +- resolves: #1879822, #1880703 - Security fixes for CVE-2020-1472 + * Tue Aug 25 2020 Guenther Deschner - 4.11.12-0 - Update to Samba 4.11.12 diff --git a/sources b/sources index 8ebef27..c433252 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.11.12.tar.xz) = 617707ad6ab274c6539bcfdb9422990638aa5f6bd89a373d6b6db4ceffb8027e03c279d937ccb13e9404ea53688fad2e73d32f2303dcc5dfaa596e5b209fadaa -SHA512 (samba-4.11.12.tar.asc) = 5e44093254f92c7fa65e01ee204e4d9546dd5749017f0fffaf2ddb3cfdb10b7935e331d3ec48806fe8278f9b35b44ac089d8479783c6166abca9edf5846b0ed8 +SHA512 (samba-4.11.13.tar.xz) = 36072d67c370b01ab8d8408f076111dcc2380eea9f5d1aa971e12902f06b4dbd1ce168103e6bc53b928dda01100ae357298949285c2d1a5085fa66e65b03a4bf +SHA512 (samba-4.11.13.tar.asc) = 9a0b83531385085970cd99973a96a39f6cba9b69b0602f1cf15d90030cff3a0de0c04e6ecbbbdf9feefce12591a51a98cd6ae7ec23145fd3c3514d7cd36a8871 From f6da685b76c27d7c43429edf8fa1635c24d071cd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 6 Oct 2020 11:27:19 +0200 Subject: [PATCH 50/51] Update to Samba 4.11.14 Guenther --- .gitignore | 2 ++ samba-4.11.13-lib_util_wscript.patch | 28 ---------------------------- samba.spec | 6 ++++-- sources | 4 ++-- 4 files changed, 8 insertions(+), 32 deletions(-) delete mode 100644 samba-4.11.13-lib_util_wscript.patch diff --git a/.gitignore b/.gitignore index 386bf91..259aafb 100644 --- a/.gitignore +++ b/.gitignore @@ -205,3 +205,5 @@ samba-3.6.0pre1.tar.gz /samba-4.11.12.tar.asc /samba-4.11.13.tar.xz /samba-4.11.13.tar.asc +/samba-4.11.14.tar.xz +/samba-4.11.14.tar.asc diff --git a/samba-4.11.13-lib_util_wscript.patch b/samba-4.11.13-lib_util_wscript.patch deleted file mode 100644 index 3921f3f..0000000 --- a/samba-4.11.13-lib_util_wscript.patch +++ /dev/null @@ -1,28 +0,0 @@ -From 7f2c62dcdebb387b086df37c8dd38a6027d8b631 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?G=C3=BCnther=20Deschner?= -Date: Tue, 25 Aug 2020 10:37:18 +0200 -Subject: [PATCH] lib/util: do not install /usr/bin/test_util - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14166 - -Guenther - -Signed-off-by: Guenther Deschner ---- - lib/util/wscript_build | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/lib/util/wscript_build b/lib/util/wscript_build -index 4ac0a9cc064..e04752cb130 100644 ---- a/lib/util/wscript_build -+++ b/lib/util/wscript_build -@@ -291,4 +291,5 @@ else: - bld.SAMBA_BINARY('test_util', - source='tests/test_util.c', - deps='cmocka replace talloc samba-util', -- local_include=False) -+ local_include=False, -+ install=False) --- -2.26.2 - diff --git a/samba.spec b/samba.spec index 85bf474..20dbd98 100644 --- a/samba.spec +++ b/samba.spec @@ -8,7 +8,7 @@ %define main_release 0 -%define samba_version 4.11.13 +%define samba_version 4.11.14 %define talloc_version 2.2.0 %define tdb_version 1.4.2 %define tevent_version 0.10.0 @@ -126,7 +126,6 @@ Source201: README.downgrade Patch100: 0000-use-gnutls-for-des-cbc.patch Patch101: 0001-handle-removal-des-enctypes-from-krb5.patch Patch102: 0002-samba-tool-create-working-private-krb5.conf.patch -Patch103: samba-4.11.13-lib_util_wscript.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -3540,6 +3539,9 @@ fi %endif %changelog +* Tue Oct 06 2020 Guenther Deschner - 4.11.14-0 +- Update to Samba 4.11.14 + * Fri Sep 18 2020 Guenther Deschner - 4.11.13-0 - Update to Samba 4.11.13 - resolves: #1879822, #1880703 - Security fixes for CVE-2020-1472 diff --git a/sources b/sources index c433252..fbc5f0e 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.11.13.tar.xz) = 36072d67c370b01ab8d8408f076111dcc2380eea9f5d1aa971e12902f06b4dbd1ce168103e6bc53b928dda01100ae357298949285c2d1a5085fa66e65b03a4bf -SHA512 (samba-4.11.13.tar.asc) = 9a0b83531385085970cd99973a96a39f6cba9b69b0602f1cf15d90030cff3a0de0c04e6ecbbbdf9feefce12591a51a98cd6ae7ec23145fd3c3514d7cd36a8871 +SHA512 (samba-4.11.14.tar.xz) = f2178ad9a3c35b9d6944684624034d71e252f83a5a347aa49cb4d271ef2bbf7f444452fc31d3cb77803c6618e888c6edec1b570d96559040e577cde0c5d25a0d +SHA512 (samba-4.11.14.tar.asc) = 403df90bed6fab6ec849dc1c74cd93528a443592dc9af72029051b589aa6647b372b6e423ffed7b21724f86cbd25bfa6385b2526f44f8b45a77ad9f9d5040e99 From f7272fe00cef425729b1a72a0321f75de7c47bbb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 29 Oct 2020 10:19:28 +0100 Subject: [PATCH 51/51] Update to Samba 4.11.15 resolves: #1892631, #1892634 - Security fixes for CVE-2020-14318 resolves: #1891685, #1892628 - Security fixes for CVE-2020-14323 resolves: #1892636, #1892640 - Security fixes for CVE-2020-14383 Guenther --- .gitignore | 2 ++ samba.spec | 8 +++++++- sources | 4 ++-- 3 files changed, 11 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 259aafb..1e53b65 100644 --- a/.gitignore +++ b/.gitignore @@ -207,3 +207,5 @@ samba-3.6.0pre1.tar.gz /samba-4.11.13.tar.asc /samba-4.11.14.tar.xz /samba-4.11.14.tar.asc +/samba-4.11.15.tar.xz +/samba-4.11.15.tar.asc diff --git a/samba.spec b/samba.spec index 20dbd98..e9a2a40 100644 --- a/samba.spec +++ b/samba.spec @@ -8,7 +8,7 @@ %define main_release 0 -%define samba_version 4.11.14 +%define samba_version 4.11.15 %define talloc_version 2.2.0 %define tdb_version 1.4.2 %define tevent_version 0.10.0 @@ -3539,6 +3539,12 @@ fi %endif %changelog +* Thu Oct 29 2020 Guenther Deschner - 4.11.15-0 +- Update to Samba 4.11.15 +- resolves: #1892631, #1892634 - Security fixes for CVE-2020-14318 +- resolves: #1891685, #1892628 - Security fixes for CVE-2020-14323 +- resolves: #1892636, #1892640 - Security fixes for CVE-2020-14383 + * Tue Oct 06 2020 Guenther Deschner - 4.11.14-0 - Update to Samba 4.11.14 diff --git a/sources b/sources index fbc5f0e..243bfeb 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.11.14.tar.xz) = f2178ad9a3c35b9d6944684624034d71e252f83a5a347aa49cb4d271ef2bbf7f444452fc31d3cb77803c6618e888c6edec1b570d96559040e577cde0c5d25a0d -SHA512 (samba-4.11.14.tar.asc) = 403df90bed6fab6ec849dc1c74cd93528a443592dc9af72029051b589aa6647b372b6e423ffed7b21724f86cbd25bfa6385b2526f44f8b45a77ad9f9d5040e99 +SHA512 (samba-4.11.15.tar.xz) = 192d9ddbe5ffe6be1fbb845ba71b3b89eb3fc6bdd48eb1aa97d00cb281fdd1c0f999d03fa394ddcf24dfbae804161231badbfb3aa9d412024d049ce9122be30e +SHA512 (samba-4.11.15.tar.asc) = c262e54669755fd7bf068a61c9f5b4984230504d956bcb9be737f2b8b312ab6b81a86f3a9c764961360fb790a999f1ef3c509b46214bdd09079d73d3b915ce46