From fedbce32b09adcedf2b2543a6389bf52132a45bb Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Wed, 7 Apr 2021 18:05:51 +0300 Subject: [PATCH 01/25] Fix RPC server memory leaks Resolves: rhbz#1946950 Signed-off-by: Alexander Bokovoy --- samba-bz14675-fix.patch | 157 ++++++++++++++++++++++++++++++++++++++++ samba.spec | 7 +- 2 files changed, 163 insertions(+), 1 deletion(-) create mode 100644 samba-bz14675-fix.patch diff --git a/samba-bz14675-fix.patch b/samba-bz14675-fix.patch new file mode 100644 index 0000000..f625a95 --- /dev/null +++ b/samba-bz14675-fix.patch @@ -0,0 +1,157 @@ +From 75a66ce1da41c5b081771b2db55c2994d378d882 Mon Sep 17 00:00:00 2001 +From: Ralph Boehme +Date: Tue, 23 Mar 2021 11:40:21 +0100 +Subject: [PATCH 1/3] pidl: set the per-request memory context in the pidl + generator + +The talloc memory context referenced by the pipe_struct mem_ctx member is used +as talloc parent for RPC response data by the RPC service implementations. + +In Samba versions up to 4.10 all talloc children of p->mem_ctx were freed after +a RPC response was delivered by calling talloc_free_children(p->mem_ctx). Commit +60fa8e255254d38e9443bf96f2c0f31430be6ab8 removed this call which resulted in all +memory allocations on this context not getting released, which can consume +significant memory in long running RPC connections. + +Instead of putting the talloc_free_children(p->mem_ctx) back, just use the +mem_ctx argument of the ${pipename}_op_dispatch_internal() function which is a +dcesrv_call_state object created by dcesrv_process_ncacn_packet() and released +by the RPC server when the RPC request processing is finished. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14675 +CI: https://gitlab.com/samba-team/samba/-/merge_requests/1861 + +Signed-off-by: Ralph Boehme +Reviewed-by: Volker Lendecke +(cherry picked from commit 4c3fb2a5912966a61e7ebdb05eb3231a0e1d6033) +--- + pidl/lib/Parse/Pidl/Samba4/NDR/ServerCompat.pm | 2 ++ + source3/rpc_server/rpc_handles.c | 6 ------ + 2 files changed, 2 insertions(+), 6 deletions(-) + +diff --git a/pidl/lib/Parse/Pidl/Samba4/NDR/ServerCompat.pm b/pidl/lib/Parse/Pidl/Samba4/NDR/ServerCompat.pm +index 54feea0a9ef..d1368c3dbca 100644 +--- a/pidl/lib/Parse/Pidl/Samba4/NDR/ServerCompat.pm ++++ b/pidl/lib/Parse/Pidl/Samba4/NDR/ServerCompat.pm +@@ -299,6 +299,7 @@ sub boilerplate_iface($) + $self->pidl("/* Update pipes struct opnum */"); + $self->pidl("p->opnum = opnum;"); + $self->pidl("p->dce_call = dce_call;"); ++ $self->pidl("p->mem_ctx = mem_ctx;"); + $self->pidl("/* Update pipes struct session info */"); + $self->pidl("pipe_session_info = p->session_info;"); + $self->pidl("p->session_info = dce_call->auth_state->session_info;"); +@@ -344,6 +345,7 @@ sub boilerplate_iface($) + $self->pidl(""); + + $self->pidl("p->dce_call = NULL;"); ++ $self->pidl("p->mem_ctx = NULL;"); + $self->pidl("/* Restore session info */"); + $self->pidl("p->session_info = pipe_session_info;"); + $self->pidl("p->auth.auth_type = 0;"); +diff --git a/source3/rpc_server/rpc_handles.c b/source3/rpc_server/rpc_handles.c +index 45968746440..9ef93231466 100644 +--- a/source3/rpc_server/rpc_handles.c ++++ b/source3/rpc_server/rpc_handles.c +@@ -60,12 +60,6 @@ int make_base_pipes_struct(TALLOC_CTX *mem_ctx, + return ENOMEM; + } + +- p->mem_ctx = talloc_named(p, 0, "pipe %s %p", pipe_name, p); +- if (!p->mem_ctx) { +- talloc_free(p); +- return ENOMEM; +- } +- + p->msg_ctx = msg_ctx; + p->transport = transport; + +-- +2.30.2 + + +From 33a7749f7fc5c58752815789d086d696a20878e7 Mon Sep 17 00:00:00 2001 +From: Ralph Boehme +Date: Mon, 22 Mar 2021 12:06:39 +0100 +Subject: [PATCH 2/3] spools: avoid leaking memory into the callers mem_ctx + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14675 +CI: https://gitlab.com/samba-team/samba/-/merge_requests/1861 + +Signed-off-by: Ralph Boehme +Reviewed-by: Volker Lendecke +(cherry picked from commit 481176ec745c14b78fca68e01a61c83405a4b97b) +--- + source3/rpc_server/spoolss/srv_spoolss_nt.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/source3/rpc_server/spoolss/srv_spoolss_nt.c b/source3/rpc_server/spoolss/srv_spoolss_nt.c +index d20c19d5271..24ea7367ec8 100644 +--- a/source3/rpc_server/spoolss/srv_spoolss_nt.c ++++ b/source3/rpc_server/spoolss/srv_spoolss_nt.c +@@ -5731,7 +5731,8 @@ static WERROR construct_printer_driver_info_level(TALLOC_CTX *mem_ctx, + } + + if (pinfo2->drivername == NULL || pinfo2->drivername[0] == '\0') { +- return WERR_UNKNOWN_PRINTER_DRIVER; ++ result = WERR_UNKNOWN_PRINTER_DRIVER; ++ goto done; + } + + DBG_INFO("Construct printer driver [%s] for [%s]\n", +@@ -7023,7 +7024,8 @@ static WERROR update_printer(struct pipes_struct *p, + raddr = tsocket_address_inet_addr_string(p->remote_address, + p->mem_ctx); + if (raddr == NULL) { +- return WERR_NOT_ENOUGH_MEMORY; ++ result = WERR_NOT_ENOUGH_MEMORY; ++ goto done; + } + + /* add_printer_hook() will call reload_services() */ +-- +2.30.2 + + +From 602290d48d3bc49acca64a089822f26da293ee1e Mon Sep 17 00:00:00 2001 +From: Volker Lendecke +Date: Tue, 23 Mar 2021 17:06:15 +0100 +Subject: [PATCH 3/3] rpc_server3: Fix a memleak for internal pipes +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +state->call should not be talloc'ed off a long-lived context + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14675 +CI: https://gitlab.com/samba-team/samba/-/merge_requests/1861 +RN: Memory leak in the RPC server + +Signed-off-by: Volker Lendecke +Reviewed-by: Samuel Cabrero +Reviewed-by: Ralph Boehme + +Autobuild-User(master): Ralph Böhme +Autobuild-Date(master): Wed Mar 31 12:14:01 UTC 2021 on sn-devel-184 + +(cherry picked from commit 12f516e4680753460e7fe8811e6c6ff70057580c) +--- + source3/rpc_server/rpc_ncacn_np.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/source3/rpc_server/rpc_ncacn_np.c b/source3/rpc_server/rpc_ncacn_np.c +index 9ba271c2479..494b002e714 100644 +--- a/source3/rpc_server/rpc_ncacn_np.c ++++ b/source3/rpc_server/rpc_ncacn_np.c +@@ -476,7 +476,7 @@ static struct tevent_req *rpcint_bh_raw_call_send(TALLOC_CTX *mem_ctx, + return tevent_req_post(req, ev); + } + +- state->call = talloc_zero(hs->conn, struct dcesrv_call_state); ++ state->call = talloc_zero(state, struct dcesrv_call_state); + if (tevent_req_nomem(state->call, req)) { + return tevent_req_post(req, ev); + } +-- +2.30.2 + diff --git a/samba.spec b/samba.spec index 1cd7a05..acc4c01 100644 --- a/samba.spec +++ b/samba.spec @@ -108,7 +108,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global main_release 0 +%global main_release 1 %global samba_version 4.14.2 %global talloc_version 2.3.2 @@ -177,6 +177,7 @@ Source14: samba.pamd Source201: README.downgrade Patch1: samba-s4u.patch +Patch2: samba-bz14675-fix.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -3839,6 +3840,10 @@ fi %endif %changelog +* Wed Apr 07 2021 Alexander Bokovoy - 4.14.2-1 +- Fix memory leaks in RPC server +- resolves: #1946950 + * Thu Mar 25 2021 Guenther Deschner - 4.14.2-0 - Update to Samba 4.14.2 - related: #1941400, #1942496 - Security fixes for CVE-2020-27840 From f94230da8358dc1ac2ba3a0cd4b22d819f9f2fd0 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 19 Apr 2021 09:25:41 +0200 Subject: [PATCH 02/25] Remove findsmb script resolves: #1949295 --- samba.spec | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index acc4c01..827c75e 100644 --- a/samba.spec +++ b/samba.spec @@ -108,7 +108,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global main_release 1 +%global main_release 2 %global samba_version 4.14.2 %global talloc_version 2.3.2 @@ -1514,7 +1514,7 @@ fi %{_bindir}/cifsdd %{_bindir}/dbwrap_tool %{_bindir}/dumpmscat -%{_bindir}/findsmb +%exclude %{_bindir}/findsmb %{_bindir}/mvxattr %{_bindir}/mdfind %{_bindir}/nmblookup @@ -1543,7 +1543,7 @@ fi %{_mandir}/man1/regpatch.1* %{_mandir}/man1/regshell.1* %{_mandir}/man1/regtree.1* -%{_mandir}/man1/findsmb.1* +%exclude %{_mandir}/man1/findsmb.1* %{_mandir}/man1/log2pcap.1* %{_mandir}/man1/mdfind.1* %{_mandir}/man1/mvxattr.1* @@ -3840,6 +3840,9 @@ fi %endif %changelog +* Mon Apr 19 2021 Andreas Schneider - 4.12.2-2 +- resolves: #1949295 - Remove findsmb script + * Wed Apr 07 2021 Alexander Bokovoy - 4.14.2-1 - Fix memory leaks in RPC server - resolves: #1946950 From 931e8f38e60adfcece255ebe2895a6c87ab37da1 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 19 Apr 2021 11:06:07 +0200 Subject: [PATCH 03/25] Added python3-ldb to BR --- samba.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 827c75e..c1019f8 100644 --- a/samba.spec +++ b/samba.spec @@ -108,7 +108,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global main_release 2 +%global main_release 3 %global samba_version 4.14.2 %global talloc_version 2.3.2 @@ -311,6 +311,7 @@ BuildRequires: libtdb-devel >= %{tdb_version} BuildRequires: python3-tdb >= %{tdb_version} BuildRequires: libldb-devel >= %{ldb_version} +BuildRequires: python3-ldb >= %{ldb_version} BuildRequires: python3-ldb-devel >= %{ldb_version} %else BuildRequires: lmdb-devel @@ -3840,6 +3841,9 @@ fi %endif %changelog +* Mon Apr 19 2021 Michal Ambroz - 4.14.2-3 +- Added python3-ldb to BR + * Mon Apr 19 2021 Andreas Schneider - 4.12.2-2 - resolves: #1949295 - Remove findsmb script From 5c587781c7124fa22fff99b7a763f6e015406a40 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 20 Apr 2021 12:39:17 +0200 Subject: [PATCH 04/25] Update to Samba 4.14.3 resolves: #1951531 Guenther --- .gitignore | 2 + samba-bz14675-fix.patch | 157 ---------------------------------------- samba.spec | 9 ++- sources | 4 +- 4 files changed, 10 insertions(+), 162 deletions(-) delete mode 100644 samba-bz14675-fix.patch diff --git a/.gitignore b/.gitignore index 01c732c..36ab993 100644 --- a/.gitignore +++ b/.gitignore @@ -245,3 +245,5 @@ samba-3.6.0pre1.tar.gz /samba-4.14.1.tar.asc /samba-4.14.2.tar.xz /samba-4.14.2.tar.asc +/samba-4.14.3.tar.xz +/samba-4.14.3.tar.asc diff --git a/samba-bz14675-fix.patch b/samba-bz14675-fix.patch deleted file mode 100644 index f625a95..0000000 --- a/samba-bz14675-fix.patch +++ /dev/null @@ -1,157 +0,0 @@ -From 75a66ce1da41c5b081771b2db55c2994d378d882 Mon Sep 17 00:00:00 2001 -From: Ralph Boehme -Date: Tue, 23 Mar 2021 11:40:21 +0100 -Subject: [PATCH 1/3] pidl: set the per-request memory context in the pidl - generator - -The talloc memory context referenced by the pipe_struct mem_ctx member is used -as talloc parent for RPC response data by the RPC service implementations. - -In Samba versions up to 4.10 all talloc children of p->mem_ctx were freed after -a RPC response was delivered by calling talloc_free_children(p->mem_ctx). Commit -60fa8e255254d38e9443bf96f2c0f31430be6ab8 removed this call which resulted in all -memory allocations on this context not getting released, which can consume -significant memory in long running RPC connections. - -Instead of putting the talloc_free_children(p->mem_ctx) back, just use the -mem_ctx argument of the ${pipename}_op_dispatch_internal() function which is a -dcesrv_call_state object created by dcesrv_process_ncacn_packet() and released -by the RPC server when the RPC request processing is finished. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14675 -CI: https://gitlab.com/samba-team/samba/-/merge_requests/1861 - -Signed-off-by: Ralph Boehme -Reviewed-by: Volker Lendecke -(cherry picked from commit 4c3fb2a5912966a61e7ebdb05eb3231a0e1d6033) ---- - pidl/lib/Parse/Pidl/Samba4/NDR/ServerCompat.pm | 2 ++ - source3/rpc_server/rpc_handles.c | 6 ------ - 2 files changed, 2 insertions(+), 6 deletions(-) - -diff --git a/pidl/lib/Parse/Pidl/Samba4/NDR/ServerCompat.pm b/pidl/lib/Parse/Pidl/Samba4/NDR/ServerCompat.pm -index 54feea0a9ef..d1368c3dbca 100644 ---- a/pidl/lib/Parse/Pidl/Samba4/NDR/ServerCompat.pm -+++ b/pidl/lib/Parse/Pidl/Samba4/NDR/ServerCompat.pm -@@ -299,6 +299,7 @@ sub boilerplate_iface($) - $self->pidl("/* Update pipes struct opnum */"); - $self->pidl("p->opnum = opnum;"); - $self->pidl("p->dce_call = dce_call;"); -+ $self->pidl("p->mem_ctx = mem_ctx;"); - $self->pidl("/* Update pipes struct session info */"); - $self->pidl("pipe_session_info = p->session_info;"); - $self->pidl("p->session_info = dce_call->auth_state->session_info;"); -@@ -344,6 +345,7 @@ sub boilerplate_iface($) - $self->pidl(""); - - $self->pidl("p->dce_call = NULL;"); -+ $self->pidl("p->mem_ctx = NULL;"); - $self->pidl("/* Restore session info */"); - $self->pidl("p->session_info = pipe_session_info;"); - $self->pidl("p->auth.auth_type = 0;"); -diff --git a/source3/rpc_server/rpc_handles.c b/source3/rpc_server/rpc_handles.c -index 45968746440..9ef93231466 100644 ---- a/source3/rpc_server/rpc_handles.c -+++ b/source3/rpc_server/rpc_handles.c -@@ -60,12 +60,6 @@ int make_base_pipes_struct(TALLOC_CTX *mem_ctx, - return ENOMEM; - } - -- p->mem_ctx = talloc_named(p, 0, "pipe %s %p", pipe_name, p); -- if (!p->mem_ctx) { -- talloc_free(p); -- return ENOMEM; -- } -- - p->msg_ctx = msg_ctx; - p->transport = transport; - --- -2.30.2 - - -From 33a7749f7fc5c58752815789d086d696a20878e7 Mon Sep 17 00:00:00 2001 -From: Ralph Boehme -Date: Mon, 22 Mar 2021 12:06:39 +0100 -Subject: [PATCH 2/3] spools: avoid leaking memory into the callers mem_ctx - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14675 -CI: https://gitlab.com/samba-team/samba/-/merge_requests/1861 - -Signed-off-by: Ralph Boehme -Reviewed-by: Volker Lendecke -(cherry picked from commit 481176ec745c14b78fca68e01a61c83405a4b97b) ---- - source3/rpc_server/spoolss/srv_spoolss_nt.c | 6 ++++-- - 1 file changed, 4 insertions(+), 2 deletions(-) - -diff --git a/source3/rpc_server/spoolss/srv_spoolss_nt.c b/source3/rpc_server/spoolss/srv_spoolss_nt.c -index d20c19d5271..24ea7367ec8 100644 ---- a/source3/rpc_server/spoolss/srv_spoolss_nt.c -+++ b/source3/rpc_server/spoolss/srv_spoolss_nt.c -@@ -5731,7 +5731,8 @@ static WERROR construct_printer_driver_info_level(TALLOC_CTX *mem_ctx, - } - - if (pinfo2->drivername == NULL || pinfo2->drivername[0] == '\0') { -- return WERR_UNKNOWN_PRINTER_DRIVER; -+ result = WERR_UNKNOWN_PRINTER_DRIVER; -+ goto done; - } - - DBG_INFO("Construct printer driver [%s] for [%s]\n", -@@ -7023,7 +7024,8 @@ static WERROR update_printer(struct pipes_struct *p, - raddr = tsocket_address_inet_addr_string(p->remote_address, - p->mem_ctx); - if (raddr == NULL) { -- return WERR_NOT_ENOUGH_MEMORY; -+ result = WERR_NOT_ENOUGH_MEMORY; -+ goto done; - } - - /* add_printer_hook() will call reload_services() */ --- -2.30.2 - - -From 602290d48d3bc49acca64a089822f26da293ee1e Mon Sep 17 00:00:00 2001 -From: Volker Lendecke -Date: Tue, 23 Mar 2021 17:06:15 +0100 -Subject: [PATCH 3/3] rpc_server3: Fix a memleak for internal pipes -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -state->call should not be talloc'ed off a long-lived context - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14675 -CI: https://gitlab.com/samba-team/samba/-/merge_requests/1861 -RN: Memory leak in the RPC server - -Signed-off-by: Volker Lendecke -Reviewed-by: Samuel Cabrero -Reviewed-by: Ralph Boehme - -Autobuild-User(master): Ralph Böhme -Autobuild-Date(master): Wed Mar 31 12:14:01 UTC 2021 on sn-devel-184 - -(cherry picked from commit 12f516e4680753460e7fe8811e6c6ff70057580c) ---- - source3/rpc_server/rpc_ncacn_np.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/source3/rpc_server/rpc_ncacn_np.c b/source3/rpc_server/rpc_ncacn_np.c -index 9ba271c2479..494b002e714 100644 ---- a/source3/rpc_server/rpc_ncacn_np.c -+++ b/source3/rpc_server/rpc_ncacn_np.c -@@ -476,7 +476,7 @@ static struct tevent_req *rpcint_bh_raw_call_send(TALLOC_CTX *mem_ctx, - return tevent_req_post(req, ev); - } - -- state->call = talloc_zero(hs->conn, struct dcesrv_call_state); -+ state->call = talloc_zero(state, struct dcesrv_call_state); - if (tevent_req_nomem(state->call, req)) { - return tevent_req_post(req, ev); - } --- -2.30.2 - diff --git a/samba.spec b/samba.spec index c1019f8..39900a6 100644 --- a/samba.spec +++ b/samba.spec @@ -108,9 +108,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global main_release 3 +%global main_release 0 -%global samba_version 4.14.2 +%global samba_version 4.14.3 %global talloc_version 2.3.2 %global tdb_version 1.4.3 %global tevent_version 0.10.2 @@ -177,7 +177,6 @@ Source14: samba.pamd Source201: README.downgrade Patch1: samba-s4u.patch -Patch2: samba-bz14675-fix.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -3841,6 +3840,10 @@ fi %endif %changelog +* Tue Apr 20 2021 Guenther Deschner - 4.14.3-0 +- Update to Samba 4.14.3 +- resolves: #1951531 + * Mon Apr 19 2021 Michal Ambroz - 4.14.2-3 - Added python3-ldb to BR diff --git a/sources b/sources index 03983cb..028c64a 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.14.2.tar.xz) = 5353cf67eac165afc0443639266354402f8d20437f8cd9389ff33201ab8261aacd21cfb9140b5816a9c39e2471fe6bce405d5b99103b1410768f56619010429d -SHA512 (samba-4.14.2.tar.asc) = 586d8a38be861195f87f4d23149c5483494a7fdbb530f4707b8ce0cfb39723ca0b6c5d9c1064c6235d1bb652558c5c113482d46163982e67c78bff2238605e25 +SHA512 (samba-4.14.3.tar.xz) = fef8c9f166e3add2248f25a5ee1131e20bfb882ae1d2bae61c8593419a3d7edd6e3ef3cdea34d24afa6f2b4bb8d3653a5788ff166dbaee689730078616657cb6 +SHA512 (samba-4.14.3.tar.asc) = 494e572344728466fafb6a982c96b1c54fedff9d2bb642b60a3b9e2a9d6beda4fcbe3f6f648cb33f2546bd2a60b98c514b9ddb125f9814b0576ddf34966f54ed From 2abbead6283ee732b85f6404739fbb5ab1b17780 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 26 Apr 2021 14:36:31 +0200 Subject: [PATCH 05/25] Add Provides: bundled(libreplace) This might be useful if it will ever have security issues. --- samba.spec | 40 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 40 insertions(+) diff --git a/samba.spec b/samba.spec index 39900a6..392091f 100644 --- a/samba.spec +++ b/samba.spec @@ -214,6 +214,8 @@ Obsoletes: samba-swat < %{samba_depver} Provides: samba4-swat = %{samba_depver} Obsoletes: samba4-swat < %{samba_depver} +Provides: bundled(libreplace) + BuildRequires: make BuildRequires: gcc BuildRequires: avahi-devel @@ -356,6 +358,8 @@ Obsoletes: samba4-client < %{samba_depver} Requires(post): %{_sbindir}/update-alternatives Requires(postun): %{_sbindir}/update-alternatives +Provides: bundled(libreplace) + %description client The %{name}-client package provides some SMB/CIFS clients to complement the built-in SMB/CIFS filesystem in Linux. These clients allow access @@ -393,6 +397,8 @@ Obsoletes: samba-dc-libs < %{samba_depver} Obsoletes: samba-dc-bind-dlz < %{samba_depver} %endif +Provides: bundled(libreplace) + %description common samba-common provides files necessary for both the server and client packages of Samba. @@ -407,6 +413,8 @@ Requires: %{name}-client-libs = %{samba_depver} Requires: libwbclient = %{samba_depver} %endif +Provides: bundled(libreplace) + %description common-libs The samba-common-libs package contains internal libraries needed by the SMB/CIFS clients. @@ -421,6 +429,8 @@ Requires: samba-libs = %{samba_depver} Requires: libwbclient = %{samba_depver} %endif +Provides: bundled(libreplace) + %description common-tools The samba-common-tools package contains tools for Samba servers and SMB/CIFS clients. @@ -458,6 +468,8 @@ Requires: krb5-server >= %{required_mit_krb5} Provides: samba4-dc = %{samba_depver} Obsoletes: samba4-dc < %{samba_depver} +Provides: bundled(libreplace) + %description dc The samba-dc package provides AD Domain Controller functionality @@ -478,6 +490,8 @@ Requires: %{name}-libs = %{samba_depver} Provides: samba4-dc-libs = %{samba_depver} Obsoletes: samba4-dc-libs < %{samba_depver} +Provides: bundled(libreplace) + %description dc-libs The %{name}-dc-libs package contains the libraries needed by the DC to link against the SMB, RPC and other protocols. @@ -490,6 +504,8 @@ Requires: %{name}-dc-libs = %{samba_depver} Requires: %{name}-dc = %{samba_depver} Requires: bind +Provides: bundled(libreplace) + %description dc-bind-dlz The %{name}-dc-bind-dlz package contains the libraries for bind to manage all name server related details of Samba AD. @@ -517,6 +533,8 @@ Summary: Samba VFS module for Ceph distributed storage system Requires: %{name} = %{samba_depver} Requires: %{name}-libs = %{samba_depver} +Provides: bundled(libreplace) + %description vfs-cephfs Samba VFS module for Ceph distributed storage system integration. #endif with vfs_cephfs @@ -539,6 +557,8 @@ Requires: libwbclient = %{samba_depver} Obsoletes: samba-glusterfs < %{samba_depver} Provides: samba-glusterfs = %{samba_depver} +Provides: bundled(libreplace) + %description vfs-glusterfs Samba VFS module for GlusterFS integration. %endif @@ -570,6 +590,8 @@ Requires: libwbclient = %{samba_depver} Provides: samba4-libs = %{samba_depver} Obsoletes: samba4-libs < %{samba_depver} +Provides: bundled(libreplace) + %description libs The %{name}-libs package contains the libraries needed by programs that link against the SMB, RPC and other protocols provided by the Samba suite. @@ -642,6 +664,8 @@ Requires: libsmbclient = %{samba_depver} Requires: libwbclient = %{samba_depver} %endif +Provides: bundled(libreplace) + %description -n python3-%{name} The python3-%{name} package contains the Python 3 libraries needed by programs that use SMB, RPC and other Samba provided protocols in Python 3 programs. @@ -716,6 +740,8 @@ Requires: perl(Archive::Tar) Provides: samba4-test = %{samba_depver} Obsoletes: samba4-test < %{samba_depver} +Provides: bundled(libreplace) + %description test %{name}-test provides testing tools for both the server and client packages of Samba. @@ -733,6 +759,8 @@ Requires: libwbclient = %{samba_depver} Provides: %{name}-test-devel = %{samba_depver} Obsoletes: %{name}-test-devel < %{samba_depver} +Provides: bundled(libreplace) + %description test-libs %{name}-test-libs provides libraries required by the testing tools. @@ -758,6 +786,8 @@ Obsoletes: samba4-winbind < %{samba_depver} # Old NetworkManager expects the dispatcher scripts in a different place Conflicts: NetworkManager < 1.20 +Provides: bundled(libreplace) + %description winbind The samba-winbind package provides the winbind NSS library, and some client tools. Winbind enables Linux to be a full member in Windows domains and to use @@ -778,6 +808,8 @@ Requires: libwbclient = %{samba_depver} Provides: samba4-winbind-clients = %{samba_depver} Obsoletes: samba4-winbind-clients < %{samba_depver} +Provides: bundled(libreplace) + %description winbind-clients The samba-winbind-clients package provides the wbinfo and ntlm_auth tool. @@ -805,6 +837,8 @@ Requires(post): %{_sbindir}/update-alternatives Requires(postun): %{_sbindir}/update-alternatives Requires(preun): %{_sbindir}/update-alternatives +Provides: bundled(libreplace) + %description winbind-krb5-locator The winbind krb5 locator is a plugin for the system kerberos library to allow the local kerberos library to use the same KDC as samba and winbind use @@ -819,6 +853,8 @@ Requires: libwbclient = %{samba_depver} %endif Requires: pam +Provides: bundled(libreplace) + %description winbind-modules The samba-winbind-modules package provides the NSS library and a PAM module necessary to communicate to the Winbind Daemon @@ -830,6 +866,8 @@ Summary: Samba Winexe Windows Binary License: GPLv3 Requires: %{name}-client-libs = %{samba_depver} +Provides: bundled(libreplace) + %description winexe Winexe is a Remote Windows®-command executor %endif @@ -863,6 +901,8 @@ Requires(post): systemd-units Requires(preun): systemd-units Requires(postun): systemd-units +Provides: bundled(libreplace) + %description -n ctdb CTDB is a cluster implementation of the TDB database used by Samba and other projects to store temporary data. If an application is already using TDB for From 6241c6978e46076bde001f9cd7f8dc37a6e30905 Mon Sep 17 00:00:00 2001 From: Anoop C S Date: Wed, 28 Apr 2021 10:30:49 +0530 Subject: [PATCH 06/25] Fix wrong conditional build check for AD DC resolves: #1954263 --- samba.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index 392091f..336b10d 100644 --- a/samba.spec +++ b/samba.spec @@ -108,7 +108,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global main_release 0 +%global main_release 1 %global samba_version 4.14.3 %global talloc_version 2.3.2 @@ -391,7 +391,7 @@ Recommends: logrotate Provides: samba4-common = %{samba_depver} Obsoletes: samba4-common < %{samba_depver} -%if %{with dc} || %{with testsuite} +%if %{without dc} && %{without testsuite} Obsoletes: samba-dc < %{samba_depver} Obsoletes: samba-dc-libs < %{samba_depver} Obsoletes: samba-dc-bind-dlz < %{samba_depver} @@ -3880,6 +3880,9 @@ fi %endif %changelog +* Wed Apr 28 2021 Anoop C S - 4.14.3-1 +- resolves: #1954263 - wrong conditional build check of AD DC + * Tue Apr 20 2021 Guenther Deschner - 4.14.3-0 - Update to Samba 4.14.3 - resolves: #1951531 From 5e7d7de84e5e2434cf7ebeebfd2ae54e66719174 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 29 Apr 2021 11:25:29 +0200 Subject: [PATCH 07/25] Update to Samba 4.14.4 resolves: #1949442, #1955027 - Security fixes for CVE-2021-20254 resolves: #1955011 Guenther --- .gitignore | 2 ++ samba.spec | 9 +++++++-- sources | 4 ++-- 3 files changed, 11 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 36ab993..8c4ef1d 100644 --- a/.gitignore +++ b/.gitignore @@ -247,3 +247,5 @@ samba-3.6.0pre1.tar.gz /samba-4.14.2.tar.asc /samba-4.14.3.tar.xz /samba-4.14.3.tar.asc +/samba-4.14.4.tar.xz +/samba-4.14.4.tar.asc diff --git a/samba.spec b/samba.spec index 336b10d..47dc135 100644 --- a/samba.spec +++ b/samba.spec @@ -108,9 +108,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global main_release 1 +%global main_release 0 -%global samba_version 4.14.3 +%global samba_version 4.14.4 %global talloc_version 2.3.2 %global tdb_version 1.4.3 %global tevent_version 0.10.2 @@ -3880,6 +3880,11 @@ fi %endif %changelog +* Thu Apr 29 2021 Guenther Deschner - 4.14.4-0 +- Update to Samba 4.14.4 +- resolves: #1949442, #1955027 - Security fixes for CVE-2021-20254 +- resolves: #1955011 + * Wed Apr 28 2021 Anoop C S - 4.14.3-1 - resolves: #1954263 - wrong conditional build check of AD DC diff --git a/sources b/sources index 028c64a..2a2b6e2 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.14.3.tar.xz) = fef8c9f166e3add2248f25a5ee1131e20bfb882ae1d2bae61c8593419a3d7edd6e3ef3cdea34d24afa6f2b4bb8d3653a5788ff166dbaee689730078616657cb6 -SHA512 (samba-4.14.3.tar.asc) = 494e572344728466fafb6a982c96b1c54fedff9d2bb642b60a3b9e2a9d6beda4fcbe3f6f648cb33f2546bd2a60b98c514b9ddb125f9814b0576ddf34966f54ed +SHA512 (samba-4.14.4.tar.xz) = 649bd946dfc95f02a960b710c3fdcd7ad44a33a849892c5ffabc8d0f8dfa88524bf9761b4e4131cb417d3c62c34dde8ce06708bd5173bbf8248b62e08755c9af +SHA512 (samba-4.14.4.tar.asc) = 82e698310c7a1c9783d4e1c7ec2d5032cee518c73fd4065343cd2f0bdf84764e58d7e48c97ebe0106c17eb63e1922192ef0ca6c0747eee6ddd388c3a62ebd683 From d99e824ec2eb7c4b99e2aae4aa486dc173b92a29 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 30 Apr 2021 15:58:06 +0200 Subject: [PATCH 08/25] Remove obsolete world writeable /var/spool/samba The default smb.conf we install already uses /var/tmp --- samba.spec | 2 -- smb.conf.example | 2 +- 2 files changed, 1 insertion(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 47dc135..e5d2601 100644 --- a/samba.spec +++ b/samba.spec @@ -1053,7 +1053,6 @@ install -d -m 0755 %{buildroot}/var/lib/samba/scripts install -d -m 0755 %{buildroot}/var/lib/samba/sysvol install -d -m 0755 %{buildroot}/var/lib/samba/winbindd_privileged install -d -m 0755 %{buildroot}/var/log/samba/old -install -d -m 0755 %{buildroot}/var/spool/samba install -d -m 0755 %{buildroot}/run/samba install -d -m 0755 %{buildroot}/run/winbindd install -d -m 0755 %{buildroot}/%{_libdir}/samba @@ -1495,7 +1494,6 @@ fi %{_unitdir}/nmb.service %{_unitdir}/smb.service -%attr(1777,root,root) %dir /var/spool/samba %dir %{_sysconfdir}/openldap/schema %config %{_sysconfdir}/openldap/schema/samba.schema %config(noreplace) %{_sysconfdir}/pam.d/samba diff --git a/smb.conf.example b/smb.conf.example index e672ce9..4e6b5d4 100644 --- a/smb.conf.example +++ b/smb.conf.example @@ -281,7 +281,7 @@ [printers] comment = All Printers - path = /var/spool/samba + path = /var/tmp browseable = no guest ok = no writable = no From 9604fc59981afd9c26df1ab165ce97c9b79825a3 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 30 Apr 2021 16:02:59 +0200 Subject: [PATCH 09/25] Move %{?dist} to Release tag This is expected by rpminspect and it doesn't resolve variables in spec files. --- samba.spec | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index e5d2601..f80ec1a 100644 --- a/samba.spec +++ b/samba.spec @@ -118,9 +118,9 @@ # This should be rc1 or nil %global pre_release %nil -%global samba_release %{main_release}%{?dist} +%global samba_release %{main_release} %if "x%{?pre_release}" != "x" -%global samba_release 0.%{main_release}.%{pre_release}%{?dist} +%global samba_release 0.%{main_release}.%{pre_release} %endif # This is a network daemon, do a hardened build @@ -145,7 +145,7 @@ Name: samba Version: %{samba_version} -Release: %{samba_release} +Release: %{samba_release}%{?dist} %if 0%{?rhel} Epoch: 0 From 262fc695060f2a4c8fe01c679331a54fa616b9dc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 1 Jun 2021 11:29:05 +0200 Subject: [PATCH 10/25] Update to Samba 4.14.5 resolves: #1966456 Guenther --- .gitignore | 2 ++ samba.spec | 9 +++++++-- sources | 4 ++-- 3 files changed, 11 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 8c4ef1d..1ff7739 100644 --- a/.gitignore +++ b/.gitignore @@ -249,3 +249,5 @@ samba-3.6.0pre1.tar.gz /samba-4.14.3.tar.asc /samba-4.14.4.tar.xz /samba-4.14.4.tar.asc +/samba-4.14.5.tar.xz +/samba-4.14.5.tar.asc diff --git a/samba.spec b/samba.spec index f80ec1a..7bb600a 100644 --- a/samba.spec +++ b/samba.spec @@ -110,7 +110,7 @@ %global main_release 0 -%global samba_version 4.14.4 +%global samba_version 4.14.5 %global talloc_version 2.3.2 %global tdb_version 1.4.3 %global tevent_version 0.10.2 @@ -176,7 +176,8 @@ Source13: pam_winbind.conf Source14: samba.pamd Source201: README.downgrade -Patch1: samba-s4u.patch + +Patch0: samba-s4u.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -3878,6 +3879,10 @@ fi %endif %changelog +* Tue Jun 01 2021 Guenther Deschner - 4.14.5-0 +- Update to Samba 4.14.5 +- resolves: #1966456 + * Thu Apr 29 2021 Guenther Deschner - 4.14.4-0 - Update to Samba 4.14.4 - resolves: #1949442, #1955027 - Security fixes for CVE-2021-20254 diff --git a/sources b/sources index 2a2b6e2..dcfe75a 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.14.4.tar.xz) = 649bd946dfc95f02a960b710c3fdcd7ad44a33a849892c5ffabc8d0f8dfa88524bf9761b4e4131cb417d3c62c34dde8ce06708bd5173bbf8248b62e08755c9af -SHA512 (samba-4.14.4.tar.asc) = 82e698310c7a1c9783d4e1c7ec2d5032cee518c73fd4065343cd2f0bdf84764e58d7e48c97ebe0106c17eb63e1922192ef0ca6c0747eee6ddd388c3a62ebd683 +SHA512 (samba-4.14.5.tar.xz) = 39952770676b7f74c94ffeb84c91ee0fef29e7d043a916b88ad7547f74d3d10a328722c361f82be49906c4361d4f4d97d06dbdc9119147a617297f126ae3ac12 +SHA512 (samba-4.14.5.tar.asc) = 8c4efa05d47d647031bbca24341b1e2e793a05339c9abcdf28e05d6a8eada7dddc827d5d939bc578ecbcf38ba66374cd852414a8499f79c4ff5888bfd0363463 From eb923fbb0d55ea7cbbff7f7d5af23b5b3c447cf0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 29 Jun 2021 14:29:35 +0200 Subject: [PATCH 11/25] Fix typo Guenther --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 7bb600a..a5617bc 100644 --- a/samba.spec +++ b/samba.spec @@ -676,7 +676,7 @@ Summary: Samba python devel files Requires: python3-%{name} = %{samba_depver} %description -n python3-%{name}-devel -The python3-%{name}-devel package contains the Python 3 defel files. +The python3-%{name}-devel package contains the Python 3 devel files. %package -n python3-samba-test Summary: Samba Python libraries From 6f2b43436a332a294ca092916e243ca4e0f29eda Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 13 Jul 2021 13:28:32 +0200 Subject: [PATCH 12/25] Update to Samba 4.14.6 resolves: #1981764 Guenther --- .gitignore | 2 ++ samba.spec | 6 +++++- sources | 4 ++-- 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 1ff7739..264eae5 100644 --- a/.gitignore +++ b/.gitignore @@ -251,3 +251,5 @@ samba-3.6.0pre1.tar.gz /samba-4.14.4.tar.asc /samba-4.14.5.tar.xz /samba-4.14.5.tar.asc +/samba-4.14.6.tar.xz +/samba-4.14.6.tar.asc diff --git a/samba.spec b/samba.spec index a5617bc..c1ecc3b 100644 --- a/samba.spec +++ b/samba.spec @@ -110,7 +110,7 @@ %global main_release 0 -%global samba_version 4.14.5 +%global samba_version 4.14.6 %global talloc_version 2.3.2 %global tdb_version 1.4.3 %global tevent_version 0.10.2 @@ -3879,6 +3879,10 @@ fi %endif %changelog +* Tue Jul 13 2021 Guenther Deschner - 4.14.6-0 +- Update to Samba 4.14.6 +- resolves: #1981764 + * Tue Jun 01 2021 Guenther Deschner - 4.14.5-0 - Update to Samba 4.14.5 - resolves: #1966456 diff --git a/sources b/sources index dcfe75a..3125f87 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.14.5.tar.xz) = 39952770676b7f74c94ffeb84c91ee0fef29e7d043a916b88ad7547f74d3d10a328722c361f82be49906c4361d4f4d97d06dbdc9119147a617297f126ae3ac12 -SHA512 (samba-4.14.5.tar.asc) = 8c4efa05d47d647031bbca24341b1e2e793a05339c9abcdf28e05d6a8eada7dddc827d5d939bc578ecbcf38ba66374cd852414a8499f79c4ff5888bfd0363463 +SHA512 (samba-4.14.6.tar.xz) = 9f9807a8d4c1cc6e7b2b5cc9863702a08bb5243619f17bfb1e3616a826189ec1547a3618d4ab0fe3d00efb5c638eef28fcfd7483d67b25fc8f9dc527b196437c +SHA512 (samba-4.14.6.tar.asc) = 15437f5fd9e28a7312dd670804068596387124a8b9b00e0e4d5fc54ae2490cf4196030e9d327037fc366d3d4ad12c5360f11db750dc01069803c969df67de179 From b88cd5770ef6aed1c3eea20da023f5d3b153e90f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 14 Jul 2021 12:25:21 +0200 Subject: [PATCH 13/25] Build with pcp-pmda support by default on Fedora resolves: #1552276 Guenther --- samba.spec | 47 ++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 46 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index c1ecc3b..c8482d1 100644 --- a/samba.spec +++ b/samba.spec @@ -106,9 +106,16 @@ #endif fedora %endif +# Build the ctdb-pcp-pmda package by default on Fedora +%if 0%{?fedora} +%bcond_without pcp_pmda +%else +%bcond_with pcp_pmda +%endif + %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global main_release 0 +%global main_release 1 %global samba_version 4.14.6 %global talloc_version 2.3.2 @@ -286,6 +293,10 @@ BuildRequires: libcephfs-devel BuildRequires: liburing-devel >= 0.4 %endif +%if %{with pcp_pmda} +BuildRequires: pcp-libs-devel +%endif + %if %{with dc} || %{with testsuite} # Add python3-iso8601 to avoid that the # version in Samba is being packaged @@ -933,6 +944,20 @@ and use CTDB instead. #endif with selftest %endif + +%if %{with pcp_pmda} + +%package -n ctdb-pcp-pmda +Summary: CTDB PCP pmda support +Requires: ctdb = %{version} +Requires: pcp-libs + +%description -n ctdb-pcp-pmda +Performance Co-Pilot (PCP) support for CTDB + +#endif with pcp_pmda +%endif + #endif with clustering %endif @@ -1022,6 +1047,9 @@ export LDFLAGS="%{__global_ldflags} -fuse-ld=gold" %endif %if %{with testsuite} --enable-selftest \ +%endif +%if %{with pcp_pmda} + --enable-pmda \ %endif --with-profiling-data \ --with-systemd \ @@ -3868,6 +3896,19 @@ fi #endif with selftest %endif +%if %{with pcp_pmda} +%files -n ctdb-pcp-pmda +%dir %{_localstatedir}/lib/pcp/pmdas/ctdb +%{_localstatedir}/lib/pcp/pmdas/ctdb/Install +%{_localstatedir}/lib/pcp/pmdas/ctdb/README +%{_localstatedir}/lib/pcp/pmdas/ctdb/Remove +%{_localstatedir}/lib/pcp/pmdas/ctdb/domain.h +%{_localstatedir}/lib/pcp/pmdas/ctdb/help +%{_localstatedir}/lib/pcp/pmdas/ctdb/pmdactdb +%{_localstatedir}/lib/pcp/pmdas/ctdb/pmns +#endif with pcp_pmda +%endif + #endif with clustering %endif @@ -3879,6 +3920,10 @@ fi %endif %changelog +* Wed Jul 14 2021 Guenther Deschner - 4.14.6-1 +- Build with pcp-pmda support by default on Fedora +- resolves: #1552276 + * Tue Jul 13 2021 Guenther Deschner - 4.14.6-0 - Update to Samba 4.14.6 - resolves: #1981764 From 4bf2ad5fae27365feeaa9da3d2c2b69c9d4dc088 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 19 Jul 2021 11:57:57 +0200 Subject: [PATCH 14/25] Fix ctdb-pcp-pmda install resolves: #1983369 Guenther --- samba.spec | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index c8482d1..60e545b 100644 --- a/samba.spec +++ b/samba.spec @@ -115,7 +115,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global main_release 1 +%global main_release 2 %global samba_version 4.14.6 %global talloc_version 2.3.2 @@ -949,7 +949,7 @@ and use CTDB instead. %package -n ctdb-pcp-pmda Summary: CTDB PCP pmda support -Requires: ctdb = %{version} +Requires: ctdb = %{samba_depver} Requires: pcp-libs %description -n ctdb-pcp-pmda @@ -3920,6 +3920,10 @@ fi %endif %changelog +* Mon Jul 19 2021 Guenther Deschner - 4.14.6-2 +- Fix ctdb-pcp-pmda install +- resolves: #1983369 + * Wed Jul 14 2021 Guenther Deschner - 4.14.6-1 - Build with pcp-pmda support by default on Fedora - resolves: #1552276 From 14ea800772200b9568b953207fc05d8c7830eb44 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 24 Aug 2021 13:53:21 +0200 Subject: [PATCH 15/25] Update to Samba 4.14.7 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 264eae5..52a62ea 100644 --- a/.gitignore +++ b/.gitignore @@ -253,3 +253,5 @@ samba-3.6.0pre1.tar.gz /samba-4.14.5.tar.asc /samba-4.14.6.tar.xz /samba-4.14.6.tar.asc +/samba-4.14.7.tar.asc +/samba-4.14.7.tar.xz diff --git a/samba.spec b/samba.spec index 60e545b..2a14383 100644 --- a/samba.spec +++ b/samba.spec @@ -115,9 +115,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global main_release 2 +%global main_release 0 -%global samba_version 4.14.6 +%global samba_version 4.14.7 %global talloc_version 2.3.2 %global tdb_version 1.4.3 %global tevent_version 0.10.2 @@ -3920,6 +3920,9 @@ fi %endif %changelog +* Tue Aug 24 2021 Guenther Deschner - 4.14.7-0 +- Update to Samba 4.14.7 + * Mon Jul 19 2021 Guenther Deschner - 4.14.6-2 - Fix ctdb-pcp-pmda install - resolves: #1983369 diff --git a/sources b/sources index 3125f87..8fa4a2d 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.14.6.tar.xz) = 9f9807a8d4c1cc6e7b2b5cc9863702a08bb5243619f17bfb1e3616a826189ec1547a3618d4ab0fe3d00efb5c638eef28fcfd7483d67b25fc8f9dc527b196437c -SHA512 (samba-4.14.6.tar.asc) = 15437f5fd9e28a7312dd670804068596387124a8b9b00e0e4d5fc54ae2490cf4196030e9d327037fc366d3d4ad12c5360f11db750dc01069803c969df67de179 +SHA512 (samba-4.14.7.tar.asc) = 27ea903577ba7c6c26ded1b95dcca852db13baa781e9d7b97573226bf144c4a4b18fb8cceb7878caef86745b8a3fa3ca0e7c8d734801ef3b4dac50ec67ea6d92 +SHA512 (samba-4.14.7.tar.xz) = 38606940fd3c89474e38cd6a8c6ac429cfacc597cfbc2eff1124ac68dbf1bbb64e6853c24f21f3f96f930761800128d591e0ac2e7a42a7a487fe2fbb86e57100 From 5b0c16cf40d9ec1a84228f3f0933a5a5cbbdf5bd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 5 Oct 2021 19:38:38 +0200 Subject: [PATCH 16/25] Update to Samba 4.14.8 Guenther --- .gitignore | 2 ++ samba.spec | 22 +++++++++++++++++++++- sources | 4 ++-- 3 files changed, 25 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 52a62ea..c737b4e 100644 --- a/.gitignore +++ b/.gitignore @@ -255,3 +255,5 @@ samba-3.6.0pre1.tar.gz /samba-4.14.6.tar.asc /samba-4.14.7.tar.asc /samba-4.14.7.tar.xz +/samba-4.14.8.tar.xz +/samba-4.14.8.tar.asc diff --git a/samba.spec b/samba.spec index 2a14383..433bc40 100644 --- a/samba.spec +++ b/samba.spec @@ -117,7 +117,7 @@ %global main_release 0 -%global samba_version 4.14.7 +%global samba_version 4.14.8 %global talloc_version 2.3.2 %global tdb_version 1.4.3 %global tevent_version 0.10.2 @@ -2276,6 +2276,7 @@ fi %{python3_sitearch}/samba/dcerpc/idmap.*.so %{python3_sitearch}/samba/dcerpc/initshutdown.*.so %{python3_sitearch}/samba/dcerpc/irpc.*.so +%{python3_sitearch}/samba/dcerpc/krb5ccache.*.so %{python3_sitearch}/samba/dcerpc/krb5pac.*.so %{python3_sitearch}/samba/dcerpc/lsa.*.so %{python3_sitearch}/samba/dcerpc/messaging.*.so @@ -2700,6 +2701,7 @@ fi %{python3_sitearch}/samba/tests/dcerpc/__pycache__/binding.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/dnsserver.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/integer.*.pyc +%{python3_sitearch}/samba/tests/dcerpc/__pycache__/lsa.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/mdssvc.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/misc.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/raw_protocol.*.pyc @@ -2719,6 +2721,7 @@ fi %{python3_sitearch}/samba/tests/dcerpc/createtrustrelax.py %{python3_sitearch}/samba/tests/dcerpc/dnsserver.py %{python3_sitearch}/samba/tests/dcerpc/integer.py +%{python3_sitearch}/samba/tests/dcerpc/lsa.py %{python3_sitearch}/samba/tests/dcerpc/mdssvc.py %{python3_sitearch}/samba/tests/dcerpc/misc.py %{python3_sitearch}/samba/tests/dcerpc/raw_protocol.py @@ -2782,28 +2785,42 @@ fi %dir %{python3_sitearch}/samba/tests/krb5 %dir %{python3_sitearch}/samba/tests/krb5/__pycache__ %{python3_sitearch}/samba/tests/krb5/__pycache__/as_canonicalization_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/as_req_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/compatability_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/fast_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kcrypto.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_base_test.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tgs_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/ms_kile_client_principal_lookup_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/raw_testcase.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/rfc4120_constants.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/rfc4120_pyasn1.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/test_ccache.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/test_ldap.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/test_rpc.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/test_smb.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/simple_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/s4u_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/xrealm_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/as_canonicalization_tests.py +%{python3_sitearch}/samba/tests/krb5/as_req_tests.py %{python3_sitearch}/samba/tests/krb5/compatability_tests.py +%{python3_sitearch}/samba/tests/krb5/fast_tests.py %{python3_sitearch}/samba/tests/krb5/kcrypto.py %{python3_sitearch}/samba/tests/krb5/kdc_base_test.py %{python3_sitearch}/samba/tests/krb5/kdc_tests.py %{python3_sitearch}/samba/tests/krb5/kdc_tgs_tests.py +%{python3_sitearch}/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py %{python3_sitearch}/samba/tests/krb5/raw_testcase.py %{python3_sitearch}/samba/tests/krb5/rfc4120_constants.py %{python3_sitearch}/samba/tests/krb5/rfc4120_pyasn1.py %{python3_sitearch}/samba/tests/krb5/simple_tests.py %{python3_sitearch}/samba/tests/krb5/s4u_tests.py +%{python3_sitearch}/samba/tests/krb5/test_ccache.py +%{python3_sitearch}/samba/tests/krb5/test_ldap.py +%{python3_sitearch}/samba/tests/krb5/test_rpc.py +%{python3_sitearch}/samba/tests/krb5/test_smb.py %{python3_sitearch}/samba/tests/krb5/xrealm_tests.py %{python3_sitearch}/samba/tests/krb5_credentials.py %{python3_sitearch}/samba/tests/ldap_raw.py @@ -3920,6 +3937,9 @@ fi %endif %changelog +* Tue Oct 05 2021 Guenther Deschner - 4.14.8-0 +- Update to Samba 4.14.8 + * Tue Aug 24 2021 Guenther Deschner - 4.14.7-0 - Update to Samba 4.14.7 diff --git a/sources b/sources index 8fa4a2d..8a8a041 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.14.7.tar.asc) = 27ea903577ba7c6c26ded1b95dcca852db13baa781e9d7b97573226bf144c4a4b18fb8cceb7878caef86745b8a3fa3ca0e7c8d734801ef3b4dac50ec67ea6d92 -SHA512 (samba-4.14.7.tar.xz) = 38606940fd3c89474e38cd6a8c6ac429cfacc597cfbc2eff1124ac68dbf1bbb64e6853c24f21f3f96f930761800128d591e0ac2e7a42a7a487fe2fbb86e57100 +SHA512 (samba-4.14.8.tar.xz) = a0d978191adbc3d5d73205d612203244175daf6eacf22c23b135ee4cf2884a48b1b783d99e646e6f0e590e0d6dec734c98cfc3caa0af7b63970bcbda803ad603 +SHA512 (samba-4.14.8.tar.asc) = 4e70802c325570536fc108b53a2b2ec115e96e892fc1714f31b75a07bc79677f2d7001c0d15b39375ef976d04512a9aefbc48c69de78982fd662b33d9cf7dbce From c013a3efc425a48f0420e50940c26a6e48b7a8a2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 27 Oct 2021 16:20:10 +0200 Subject: [PATCH 17/25] Update to Samba 4.14.9 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index c737b4e..f7c4edf 100644 --- a/.gitignore +++ b/.gitignore @@ -257,3 +257,5 @@ samba-3.6.0pre1.tar.gz /samba-4.14.7.tar.xz /samba-4.14.8.tar.xz /samba-4.14.8.tar.asc +/samba-4.14.9.tar.xz +/samba-4.14.9.tar.asc diff --git a/samba.spec b/samba.spec index 433bc40..0e8eabd 100644 --- a/samba.spec +++ b/samba.spec @@ -117,11 +117,11 @@ %global main_release 0 -%global samba_version 4.14.8 +%global samba_version 4.14.9 %global talloc_version 2.3.2 %global tdb_version 1.4.3 %global tevent_version 0.10.2 -%global ldb_version 2.3.0 +%global ldb_version 2.3.1 # This should be rc1 or nil %global pre_release %nil @@ -3937,6 +3937,9 @@ fi %endif %changelog +* Wed Oct 27 2021 Guenther Deschner - 4.14.9-0 +- Update to Samba 4.14.9 + * Tue Oct 05 2021 Guenther Deschner - 4.14.8-0 - Update to Samba 4.14.8 diff --git a/sources b/sources index 8a8a041..447f6c9 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.14.8.tar.xz) = a0d978191adbc3d5d73205d612203244175daf6eacf22c23b135ee4cf2884a48b1b783d99e646e6f0e590e0d6dec734c98cfc3caa0af7b63970bcbda803ad603 -SHA512 (samba-4.14.8.tar.asc) = 4e70802c325570536fc108b53a2b2ec115e96e892fc1714f31b75a07bc79677f2d7001c0d15b39375ef976d04512a9aefbc48c69de78982fd662b33d9cf7dbce +SHA512 (samba-4.14.9.tar.xz) = e947526aaf505a22f0044baa20f99409d1b446e84dda275b29230f5bcf28af4fd6eda7e389f30087e13cf50a8930d2b74b76922a25d978fc98f236886f81ae34 +SHA512 (samba-4.14.9.tar.asc) = 59c37919c62f8d8ea631c895803897e7a3801d22ca130e3f8cff4ae377bd215d89a67f47304ec03338f50f40618043cc2c899c1ae48bc43491afbfd220feb9cf From 8a8ca6c5c113ba3259c9a42babb8382cd446cb36 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 28 Oct 2021 11:25:46 +0200 Subject: [PATCH 18/25] Add missing krb5 tests Guenther --- samba.spec | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/samba.spec b/samba.spec index 0e8eabd..1d1a920 100644 --- a/samba.spec +++ b/samba.spec @@ -2800,6 +2800,8 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/test_ldap.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_rpc.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_smb.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/rodc_tests*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/salt_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/simple_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/s4u_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/xrealm_tests.*.pyc @@ -2815,6 +2817,8 @@ fi %{python3_sitearch}/samba/tests/krb5/raw_testcase.py %{python3_sitearch}/samba/tests/krb5/rfc4120_constants.py %{python3_sitearch}/samba/tests/krb5/rfc4120_pyasn1.py +%{python3_sitearch}/samba/tests/krb5/rodc_tests.py +%{python3_sitearch}/samba/tests/krb5/salt_tests.py %{python3_sitearch}/samba/tests/krb5/simple_tests.py %{python3_sitearch}/samba/tests/krb5/s4u_tests.py %{python3_sitearch}/samba/tests/krb5/test_ccache.py From 38eeb011dac5596d952f89dee2a624f0cfe15c94 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 9 Nov 2021 19:26:53 +0100 Subject: [PATCH 19/25] Update to Samba 4.14.10 resolves: #2019660, #2021711 - Security fixes for CVE-2016-2124 resolves: #2019672, #2021716 - Security fixes for CVE-2020-25717 resolves: #2019726, #2021718 - Security fixes for CVE-2020-25718 resolves: #2019732, #2021719 - Security fixes for CVE-2020-25719 resolves: #2021728, #2021729 - Security fixes for CVE-2020-25721 resolves: #2019764, #2021721 - Security fixes for CVE-2020-25722 resolves: #2021726, #2021727 - Security fixes for CVE-2021-3738 resolves: #2019666, #2021715 - Security fixes for CVE-2021-23192 Guenther --- .gitignore | 2 + samba-s4u.patch | 147 +++++++++++++++++++----------------------------- samba.spec | 28 ++++++++- sources | 4 +- 4 files changed, 89 insertions(+), 92 deletions(-) diff --git a/.gitignore b/.gitignore index f7c4edf..d1901fb 100644 --- a/.gitignore +++ b/.gitignore @@ -259,3 +259,5 @@ samba-3.6.0pre1.tar.gz /samba-4.14.8.tar.asc /samba-4.14.9.tar.xz /samba-4.14.9.tar.asc +/samba-4.14.10.tar.xz +/samba-4.14.10.tar.asc diff --git a/samba-s4u.patch b/samba-s4u.patch index 83ed873..120bac3 100644 --- a/samba-s4u.patch +++ b/samba-s4u.patch @@ -1,19 +1,18 @@ -From fe300549844509624d944b93fc64dc6d382e71c1 Mon Sep 17 00:00:00 2001 +From e649f9aedfa8a0d5caa241743bb4191927430879 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Fri, 27 Sep 2019 18:25:03 +0300 -Subject: [PATCH 3/7] mit-kdc: add basic loacl realm S4U support +Subject: [PATCH 1/3] mit-kdc: add basic loacl realm S4U support Signed-off-by: Isaac Boukris Pair-Programmed-With: Andreas Schneider --- - source4/kdc/mit-kdb/kdb_samba_policies.c | 148 +++++++++--------- - source4/kdc/mit_samba.c | 47 ++---- - source4/kdc/mit_samba.h | 6 +- - wscript_configure_system_mitkrb5 | 3 + - 6 files changed, 91 insertions(+), 115 deletions(-) + source4/kdc/mit-kdb/kdb_samba_policies.c | 124 +++++++++++------------ + source4/kdc/mit_samba.c | 47 ++------- + source4/kdc/mit_samba.h | 6 +- + 3 files changed, 71 insertions(+), 106 deletions(-) diff --git a/source4/kdc/mit-kdb/kdb_samba_policies.c b/source4/kdc/mit-kdb/kdb_samba_policies.c -index 9197551ed61..944324d9a2f 100644 +index 7bc9a7b3347..fc20bfed2f4 100644 --- a/source4/kdc/mit-kdb/kdb_samba_policies.c +++ b/source4/kdc/mit-kdb/kdb_samba_policies.c @@ -192,13 +192,17 @@ static krb5_error_code ks_verify_pac(krb5_context context, @@ -134,16 +133,15 @@ index 9197551ed61..944324d9a2f 100644 return code; } -@@ -324,7 +335,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - { - #endif +@@ -328,6 +339,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, + krb5_authdata **pac_auth_data = NULL; krb5_authdata **authdata = NULL; -- krb5_boolean is_as_req; + krb5_boolean is_as_req; + krb5_const_principal pac_client; krb5_error_code code; krb5_pac pac = NULL; krb5_data pac_data; -@@ -334,24 +345,21 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, +@@ -341,11 +353,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, krbtgt_key = krbtgt_key == NULL ? local_krbtgt_key : krbtgt_key; #endif @@ -152,13 +150,13 @@ index 9197551ed61..944324d9a2f 100644 - return KRB5_KDB_DBTYPE_NOSUP; - } - -- is_as_req = ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) != 0); -- -- if (is_as_req && (flags & KRB5_KDB_FLAG_INCLUDE_PAC)) { -- code = ks_get_pac(context, client, client_key, &pac); -- if (code != 0) { -- goto done; -- } + is_as_req = ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) != 0); + + /* +@@ -406,6 +413,16 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, + ks_client_princ = client->princ; + } + + /* In protocol transition, we are currently not provided with the tgt + * client name to verify the PAC, we could probably skip the name + * verification and just verify the signatures, but since we don't @@ -166,59 +164,31 @@ index 9197551ed61..944324d9a2f 100644 + if (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION) { + pac_client = server->princ; + } else { -+ pac_client = client_princ; - } - -- if (!is_as_req) { -+ /* TGS request */ -+ if (!(flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY)) { - code = ks_verify_pac(context, - flags, -- client_princ, -+ pac_client, - client, - server, - krbtgt, -@@ -363,14 +371,28 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - if (code != 0) { - goto done; - } -+ -+ /* We require PAC as we don't support LSA_TRUST_TYPE_MIT */ -+ if (pac == NULL) { -+ code = KRB5_KDB_DBTYPE_NOSUP; -+ goto done; -+ } - } - -- if (pac == NULL && client != NULL) { -+ if (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION) { -+ krb5_pac_free(context, pac); -+ pac = NULL; ++ pac_client = ks_client_princ; + } - -+ /* AS request or local realm protocol transition */ -+ if ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) || -+ (client != NULL && (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION))) { - code = ks_get_pac(context, client, client_key, &pac); - if (code != 0) { - goto done; - } -+ /* We require a pac! */ -+ SMB_ASSERT(pac != NULL); ++ + if (client_entry == NULL) { + client_entry = client; } +@@ -470,7 +487,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - if (pac == NULL) { -@@ -379,7 +401,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - } - - code = krb5_pac_sign(context, pac, authtime, client_princ, + code = ks_verify_pac(context, + flags, +- ks_client_princ, ++ pac_client, + client_entry, + server, + krbtgt, +@@ -510,7 +527,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, + is_as_req ? "AS-REQ" : "TGS-REQ", + client_name); + code = krb5_pac_sign(context, pac, authtime, ks_client_princ, - server_key, krbtgt_key, &pac_data); + server_key, krbtgt_key, &pac_data); if (code != 0) { DBG_ERR("krb5_pac_sign failed: %d\n", code); goto done; -@@ -405,11 +427,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, +@@ -536,12 +553,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, KRB5_AUTHDATA_IF_RELEVANT, authdata, signed_auth_data); @@ -227,10 +197,11 @@ index 9197551ed61..944324d9a2f 100644 - } - - code = 0; - +- done: - krb5_pac_free(context, pac); -@@ -432,32 +449,13 @@ krb5_error_code kdb_samba_db_check_allowed_to_delegate(krb5_context context, + if (client_entry != NULL && client_entry != client) { + ks_free_principal(context, client_entry); +@@ -567,32 +578,13 @@ krb5_error_code kdb_samba_db_check_allowed_to_delegate(krb5_context context, * server; -> delegating service * proxy; -> target principal */ @@ -265,10 +236,10 @@ index 9197551ed61..944324d9a2f 100644 diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c -index 54dcd545ea1..f23327c9613 100644 +index e015c5a52db..2a48d731501 100644 --- a/source4/kdc/mit_samba.c +++ b/source4/kdc/mit_samba.c -@@ -467,7 +467,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx, +@@ -475,7 +475,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx, krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, krb5_context context, int flags, @@ -276,7 +247,7 @@ index 54dcd545ea1..f23327c9613 100644 krb5_db_entry *client, krb5_db_entry *server, krb5_db_entry *krbtgt, -@@ -615,7 +614,7 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, +@@ -639,7 +638,7 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, context, *pac, server->princ, @@ -285,7 +256,7 @@ index 54dcd545ea1..f23327c9613 100644 deleg_blob); if (!NT_STATUS_IS_OK(nt_status)) { DEBUG(0, ("Update delegation info failed: %s\n", -@@ -937,41 +936,17 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx, +@@ -961,41 +960,17 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx, } int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx, @@ -338,7 +309,7 @@ index 54dcd545ea1..f23327c9613 100644 static krb5_error_code mit_samba_change_pwd_error(krb5_context context, diff --git a/source4/kdc/mit_samba.h b/source4/kdc/mit_samba.h -index ba824557bd5..5aadf206443 100644 +index 636c77ec97c..9cb00c9610e 100644 --- a/source4/kdc/mit_samba.h +++ b/source4/kdc/mit_samba.h @@ -56,7 +56,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx, @@ -362,12 +333,13 @@ index ba824557bd5..5aadf206443 100644 int mit_samba_kpasswd_change_password(struct mit_samba_context *ctx, char *pwd, -- -2.25.4 +2.33.1 -From ff1b225493ede3d43cfad571770dacb73f75ec42 Mon Sep 17 00:00:00 2001 + +From 9eca7b08a3987d6320d6584e146005bbc01720f6 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Fri, 27 Sep 2019 18:35:30 +0300 -Subject: [PATCH 5/7] krb5-mit: enable S4U client support for MIT build +Subject: [PATCH 2/3] krb5-mit: enable S4U client support for MIT build Signed-off-by: Isaac Boukris Pair-Programmed-With: Andreas Schneider @@ -375,13 +347,13 @@ Pair-Programmed-With: Andreas Schneider lib/krb5_wrap/krb5_samba.c | 185 ++++++++++++++++++++++++++ lib/krb5_wrap/krb5_samba.h | 2 - source4/auth/kerberos/kerberos_util.c | 11 -- - 4 files changed, 185 insertions(+), 14 deletions(-) + 3 files changed, 185 insertions(+), 13 deletions(-) diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c -index 20ce86c708d..e72ab3c30f7 100644 +index fff5b4e2a22..791b417d5ba 100644 --- a/lib/krb5_wrap/krb5_samba.c +++ b/lib/krb5_wrap/krb5_samba.c -@@ -2568,6 +2568,191 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx, +@@ -2694,6 +2694,191 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx, return 0; } @@ -574,7 +546,7 @@ index 20ce86c708d..e72ab3c30f7 100644 #if !defined(HAVE_KRB5_MAKE_PRINCIPAL) && defined(HAVE_KRB5_BUILD_PRINCIPAL_ALLOC_VA) diff --git a/lib/krb5_wrap/krb5_samba.h b/lib/krb5_wrap/krb5_samba.h -index ca9a893e4f7..3264ce5eb3b 100644 +index 56a2a975278..5af9c6d73c1 100644 --- a/lib/krb5_wrap/krb5_samba.h +++ b/lib/krb5_wrap/krb5_samba.h @@ -252,7 +252,6 @@ krb5_error_code smb_krb5_kinit_password_ccache(krb5_context ctx, @@ -639,14 +611,13 @@ index 544d9d853cc..c14d8c72d8c 100644 ret = smb_krb5_kinit_password_ccache(smb_krb5_context->krb5_context, ccache, -- -2.25.4 +2.33.1 - -From cf1b9bdc09180d68e2b30258839d2f78b7af9c62 Mon Sep 17 00:00:00 2001 +From 80289eca2bb614aacd0df86bcf7ad7027c080671 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Sat, 19 Sep 2020 14:16:20 +0200 -Subject: [PATCH 7/7] wip: for canonicalization with new MIT kdc code +Subject: [PATCH 3/3] wip: for canonicalization with new MIT kdc code --- source4/heimdal/lib/hdb/hdb.h | 1 + @@ -656,7 +627,7 @@ Subject: [PATCH 7/7] wip: for canonicalization with new MIT kdc code 4 files changed, 11 insertions(+), 2 deletions(-) diff --git a/source4/heimdal/lib/hdb/hdb.h b/source4/heimdal/lib/hdb/hdb.h -index 6a09ecb6fe1..bc5211fef35 100644 +index 5ef9d9565f3..dafaffc6c2d 100644 --- a/source4/heimdal/lib/hdb/hdb.h +++ b/source4/heimdal/lib/hdb/hdb.h @@ -63,6 +63,7 @@ enum hdb_lockop{ HDB_RLOCK, HDB_WLOCK }; @@ -668,7 +639,7 @@ index 6a09ecb6fe1..bc5211fef35 100644 /* hdb_capability_flags */ #define HDB_CAP_F_HANDLE_ENTERPRISE_PRINCIPAL 1 diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c -index a560a1cd84b..c27b6a8ef4c 100644 +index aff74f2ee71..d16b4c3329a 100644 --- a/source4/kdc/db-glue.c +++ b/source4/kdc/db-glue.c @@ -916,17 +916,21 @@ static krb5_error_code samba_kdc_message2entry(krb5_context context, @@ -696,7 +667,7 @@ index a560a1cd84b..c27b6a8ef4c 100644 ret = smb_krb5_make_principal(context, &entry_ex->entry.principal, lpcfg_realm(lp_ctx), samAccountName, NULL); if (ret) { diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c -index f23327c9613..4084e893cc2 100644 +index 2a48d731501..a8d3e7ed493 100644 --- a/source4/kdc/mit_samba.c +++ b/source4/kdc/mit_samba.c @@ -198,6 +198,9 @@ int mit_samba_get_principal(struct mit_samba_context *ctx, @@ -722,5 +693,5 @@ index c929acccce6..a9115ec23d7 100644 void sdb_free_entry(struct sdb_entry_ex *e); void free_sdb_entry(struct sdb_entry *s); -- -2.25.4 +2.33.1 diff --git a/samba.spec b/samba.spec index 1d1a920..f3dbc6d 100644 --- a/samba.spec +++ b/samba.spec @@ -117,11 +117,11 @@ %global main_release 0 -%global samba_version 4.14.9 +%global samba_version 4.14.10 %global talloc_version 2.3.2 %global tdb_version 1.4.3 %global tevent_version 0.10.2 -%global ldb_version 2.3.1 +%global ldb_version 2.3.2 # This should be rc1 or nil %global pre_release %nil @@ -1697,6 +1697,7 @@ fi %{_libdir}/samba/libcommon-auth-samba4.so %{_libdir}/samba/libctdb-event-client-samba4.so %{_libdir}/samba/libdbwrap-samba4.so +%{_libdir}/samba/libdcerpc-pkt-auth-samba4.so %{_libdir}/samba/libdcerpc-samba-samba4.so %{_libdir}/samba/libevents-samba4.so %{_libdir}/samba/libflag-mapping-samba4.so @@ -2562,6 +2563,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/dns_tkey.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dns_wildcard.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dsdb.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/dsdb_api.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dsdb_lock.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dsdb_schema_attributes.*.pyc %{python3_sitearch}/samba/tests/__pycache__/docs.*.pyc @@ -2580,6 +2582,8 @@ fi %{python3_sitearch}/samba/tests/__pycache__/krb5_credentials.*.pyc %{python3_sitearch}/samba/tests/__pycache__/ldap_raw.*.pyc %{python3_sitearch}/samba/tests/__pycache__/ldap_referrals.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/ldap_spn.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/ldap_upn_sam_account.*.pyc %{python3_sitearch}/samba/tests/__pycache__/loadparm.*.pyc %{python3_sitearch}/samba/tests/__pycache__/libsmb.*.pyc %{python3_sitearch}/samba/tests/__pycache__/lsa_string.*.pyc @@ -2747,6 +2751,7 @@ fi %{python3_sitearch}/samba/tests/dns_tkey.py %{python3_sitearch}/samba/tests/dns_wildcard.py %{python3_sitearch}/samba/tests/dsdb.py +%{python3_sitearch}/samba/tests/dsdb_api.py %{python3_sitearch}/samba/tests/dsdb_lock.py %{python3_sitearch}/samba/tests/dsdb_schema_attributes.py %{python3_sitearch}/samba/tests/docs.py @@ -2784,6 +2789,7 @@ fi %{python3_sitearch}/samba/tests/kcc/ldif_import_export.py %dir %{python3_sitearch}/samba/tests/krb5 %dir %{python3_sitearch}/samba/tests/krb5/__pycache__ +%{python3_sitearch}/samba/tests/krb5/__pycache__/alias_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/as_canonicalization_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/as_req_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/compatability_tests.*.pyc @@ -2796,8 +2802,10 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/raw_testcase.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/rfc4120_constants.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/rfc4120_pyasn1.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/spn_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_ccache.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_ldap.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/test_min_domain_uid.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_rpc.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_smb.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/rodc_tests*.pyc @@ -2805,6 +2813,7 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/simple_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/s4u_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/xrealm_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/alias_tests.py %{python3_sitearch}/samba/tests/krb5/as_canonicalization_tests.py %{python3_sitearch}/samba/tests/krb5/as_req_tests.py %{python3_sitearch}/samba/tests/krb5/compatability_tests.py @@ -2820,15 +2829,19 @@ fi %{python3_sitearch}/samba/tests/krb5/rodc_tests.py %{python3_sitearch}/samba/tests/krb5/salt_tests.py %{python3_sitearch}/samba/tests/krb5/simple_tests.py +%{python3_sitearch}/samba/tests/krb5/spn_tests.py %{python3_sitearch}/samba/tests/krb5/s4u_tests.py %{python3_sitearch}/samba/tests/krb5/test_ccache.py %{python3_sitearch}/samba/tests/krb5/test_ldap.py +%{python3_sitearch}/samba/tests/krb5/test_min_domain_uid.py %{python3_sitearch}/samba/tests/krb5/test_rpc.py %{python3_sitearch}/samba/tests/krb5/test_smb.py %{python3_sitearch}/samba/tests/krb5/xrealm_tests.py %{python3_sitearch}/samba/tests/krb5_credentials.py %{python3_sitearch}/samba/tests/ldap_raw.py %{python3_sitearch}/samba/tests/ldap_referrals.py +%{python3_sitearch}/samba/tests/ldap_spn.py +%{python3_sitearch}/samba/tests/ldap_upn_sam_account.py %{python3_sitearch}/samba/tests/libsmb.py %{python3_sitearch}/samba/tests/loadparm.py %{python3_sitearch}/samba/tests/lsa_string.py @@ -3941,6 +3954,17 @@ fi %endif %changelog +* Tue Nov 09 2021 Guenther Deschner - 4.14.10-0 +- Update to Samba 4.14.10 +- resolves: #2019660, #2021711 - Security fixes for CVE-2016-2124 +- resolves: #2019672, #2021716 - Security fixes for CVE-2020-25717 +- resolves: #2019726, #2021718 - Security fixes for CVE-2020-25718 +- resolves: #2019732, #2021719 - Security fixes for CVE-2020-25719 +- resolves: #2021728, #2021729 - Security fixes for CVE-2020-25721 +- resolves: #2019764, #2021721 - Security fixes for CVE-2020-25722 +- resolves: #2021726, #2021727 - Security fixes for CVE-2021-3738 +- resolves: #2019666, #2021715 - Security fixes for CVE-2021-23192 + * Wed Oct 27 2021 Guenther Deschner - 4.14.9-0 - Update to Samba 4.14.9 diff --git a/sources b/sources index 447f6c9..e8ff218 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.14.9.tar.xz) = e947526aaf505a22f0044baa20f99409d1b446e84dda275b29230f5bcf28af4fd6eda7e389f30087e13cf50a8930d2b74b76922a25d978fc98f236886f81ae34 -SHA512 (samba-4.14.9.tar.asc) = 59c37919c62f8d8ea631c895803897e7a3801d22ca130e3f8cff4ae377bd215d89a67f47304ec03338f50f40618043cc2c899c1ae48bc43491afbfd220feb9cf +SHA512 (samba-4.14.10.tar.xz) = 8ba8e6ae29df10f5b936eac7563b3308adf671ec5b70d457c807a3482b594dc5c1c6a7dfb1c27ade87db7f62999ecbe95b4315db2143e4a19afd1c8b8c8fb00f +SHA512 (samba-4.14.10.tar.asc) = 0763c098b38d4ad8d5d8e22cd9142a1b392dae6bff7a7200d48208cfc47e5413e606418065e30b5042b4a6fa662d2f84df047531ecac668a512e299cab635ecb From b10ff49d652720bcf5e9ad6179bb3d4d52b9b58e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 11 Nov 2021 14:45:45 +0100 Subject: [PATCH 20/25] Fix winbind trusted domain regression related: #2021716 Guenther --- ...a-4.14-fix-winbind-no-trusted-domain.patch | 41 +++++++++++++++++++ samba.spec | 7 +++- 2 files changed, 47 insertions(+), 1 deletion(-) create mode 100644 samba-4.14-fix-winbind-no-trusted-domain.patch diff --git a/samba-4.14-fix-winbind-no-trusted-domain.patch b/samba-4.14-fix-winbind-no-trusted-domain.patch new file mode 100644 index 0000000..4924872 --- /dev/null +++ b/samba-4.14-fix-winbind-no-trusted-domain.patch @@ -0,0 +1,41 @@ +From 2edaf32b4204b9fe363c441c25b6989fe76911a4 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Tue, 9 Nov 2021 20:50:20 +0100 +Subject: [PATCH] s3:winbindd: fix "allow trusted domains = no" regression + +add_trusted_domain() should only reject domains +based on is_allowed_domain(), which now also +checks "allow trusted domains = no", if we don't +have an explicit trust to the domain (SEC_CHAN_NULL). + +We use at least SEC_CHAN_LOCAL for local domains like +BUILTIN. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14899 + +Signed-off-by: Stefan Metzmacher + +Autobuild-User(master): Stefan Metzmacher +Autobuild-Date(master): Wed Nov 10 11:21:31 UTC 2021 on sn-devel-184 + +(cherry picked from commit a7f6c60cb037b4bc9eee276236539b8282213935) +--- + source3/winbindd/winbindd_util.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/source3/winbindd/winbindd_util.c b/source3/winbindd/winbindd_util.c +index 42ddbfd2f44..9d54e462c42 100644 +--- a/source3/winbindd/winbindd_util.c ++++ b/source3/winbindd/winbindd_util.c +@@ -134,7 +134,7 @@ static NTSTATUS add_trusted_domain(const char *domain_name, + return NT_STATUS_INVALID_PARAMETER; + } + +- if (!is_allowed_domain(domain_name)) { ++ if (secure_channel_type == SEC_CHAN_NULL && !is_allowed_domain(domain_name)) { + return NT_STATUS_NO_SUCH_DOMAIN; + } + +-- +2.33.1 + diff --git a/samba.spec b/samba.spec index f3dbc6d..0494d2b 100644 --- a/samba.spec +++ b/samba.spec @@ -115,7 +115,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global main_release 0 +%global main_release 1 %global samba_version 4.14.10 %global talloc_version 2.3.2 @@ -185,6 +185,7 @@ Source14: samba.pamd Source201: README.downgrade Patch0: samba-s4u.patch +Patch1: samba-4.14-fix-winbind-no-trusted-domain.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -3954,6 +3955,10 @@ fi %endif %changelog +* Thu Nov 11 2021 Guenther Deschner - 4.14.10-1 +- Fix winbind trusted domain regression +- related: #2021716 + * Tue Nov 09 2021 Guenther Deschner - 4.14.10-0 - Update to Samba 4.14.10 - resolves: #2019660, #2021711 - Security fixes for CVE-2016-2124 From 61550bb51c43a7d4af0eb8a446473987ed376554 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Sat, 13 Nov 2021 00:15:32 +0100 Subject: [PATCH 21/25] Fix IPA DC schannel support Guenther --- samba-4.14-ipa-dc-schannel.patch | 45 ++++++++++++++++++++++++++++++++ samba.spec | 6 ++++- 2 files changed, 50 insertions(+), 1 deletion(-) create mode 100644 samba-4.14-ipa-dc-schannel.patch diff --git a/samba-4.14-ipa-dc-schannel.patch b/samba-4.14-ipa-dc-schannel.patch new file mode 100644 index 0000000..d315a5d --- /dev/null +++ b/samba-4.14-ipa-dc-schannel.patch @@ -0,0 +1,45 @@ +From 3fc4d1d3998f3956a84c855cb60a9dcb335e1f59 Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Fri, 12 Nov 2021 19:06:01 +0200 +Subject: [PATCH] IPA DC: add missing checks + +When introducing FreeIPA support, two places were forgotten: + + - schannel gensec module needs to be aware of IPA DC + - _lsa_QueryInfoPolicy should treat IPA DC as PDC + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14903 + +Signed-off-by: Alexander Bokovoy +--- + auth/gensec/schannel.c | 1 + + source3/rpc_server/lsa/srv_lsa_nt.c | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/auth/gensec/schannel.c b/auth/gensec/schannel.c +index 0cdae141ead..6ebbe8f3179 100644 +--- a/auth/gensec/schannel.c ++++ b/auth/gensec/schannel.c +@@ -1080,6 +1080,7 @@ static NTSTATUS schannel_server_start(struct gensec_security *gensec_security) + case ROLE_DOMAIN_BDC: + case ROLE_DOMAIN_PDC: + case ROLE_ACTIVE_DIRECTORY_DC: ++ case ROLE_IPA_DC: + return NT_STATUS_OK; + default: + return NT_STATUS_NOT_IMPLEMENTED; +diff --git a/source3/rpc_server/lsa/srv_lsa_nt.c b/source3/rpc_server/lsa/srv_lsa_nt.c +index 8d71b5252ab..ea92a22cbc9 100644 +--- a/source3/rpc_server/lsa/srv_lsa_nt.c ++++ b/source3/rpc_server/lsa/srv_lsa_nt.c +@@ -683,6 +683,7 @@ NTSTATUS _lsa_QueryInfoPolicy(struct pipes_struct *p, + switch (lp_server_role()) { + case ROLE_DOMAIN_PDC: + case ROLE_DOMAIN_BDC: ++ case ROLE_IPA_DC: + name = get_global_sam_name(); + sid = dom_sid_dup(p->mem_ctx, get_global_sam_sid()); + if (!sid) { +-- +2.33.1 + diff --git a/samba.spec b/samba.spec index 0494d2b..ef2a10a 100644 --- a/samba.spec +++ b/samba.spec @@ -115,7 +115,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global main_release 1 +%global main_release 2 %global samba_version 4.14.10 %global talloc_version 2.3.2 @@ -186,6 +186,7 @@ Source201: README.downgrade Patch0: samba-s4u.patch Patch1: samba-4.14-fix-winbind-no-trusted-domain.patch +Patch2: samba-4.14-ipa-dc-schannel.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -3955,6 +3956,9 @@ fi %endif %changelog +* Sat Nov 13 2021 Guenther Deschner - 4.14.10-2 +- Fix IPA DC schannel support + * Thu Nov 11 2021 Guenther Deschner - 4.14.10-1 - Fix winbind trusted domain regression - related: #2021716 From 9ee082a9f3a68ef1cc6639634622a65f3ac1f48a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 15 Dec 2021 23:31:43 +0100 Subject: [PATCH 22/25] Update to Samba 4.14.11 Guenther --- .gitignore | 2 + ...a-4.14-fix-winbind-no-trusted-domain.patch | 41 ----------------- samba-4.14-ipa-dc-schannel.patch | 45 ------------------- samba.spec | 11 +++-- sources | 4 +- 5 files changed, 11 insertions(+), 92 deletions(-) delete mode 100644 samba-4.14-fix-winbind-no-trusted-domain.patch delete mode 100644 samba-4.14-ipa-dc-schannel.patch diff --git a/.gitignore b/.gitignore index d1901fb..e94134d 100644 --- a/.gitignore +++ b/.gitignore @@ -261,3 +261,5 @@ samba-3.6.0pre1.tar.gz /samba-4.14.9.tar.asc /samba-4.14.10.tar.xz /samba-4.14.10.tar.asc +/samba-4.14.11.tar.xz +/samba-4.14.11.tar.asc diff --git a/samba-4.14-fix-winbind-no-trusted-domain.patch b/samba-4.14-fix-winbind-no-trusted-domain.patch deleted file mode 100644 index 4924872..0000000 --- a/samba-4.14-fix-winbind-no-trusted-domain.patch +++ /dev/null @@ -1,41 +0,0 @@ -From 2edaf32b4204b9fe363c441c25b6989fe76911a4 Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Tue, 9 Nov 2021 20:50:20 +0100 -Subject: [PATCH] s3:winbindd: fix "allow trusted domains = no" regression - -add_trusted_domain() should only reject domains -based on is_allowed_domain(), which now also -checks "allow trusted domains = no", if we don't -have an explicit trust to the domain (SEC_CHAN_NULL). - -We use at least SEC_CHAN_LOCAL for local domains like -BUILTIN. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14899 - -Signed-off-by: Stefan Metzmacher - -Autobuild-User(master): Stefan Metzmacher -Autobuild-Date(master): Wed Nov 10 11:21:31 UTC 2021 on sn-devel-184 - -(cherry picked from commit a7f6c60cb037b4bc9eee276236539b8282213935) ---- - source3/winbindd/winbindd_util.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/source3/winbindd/winbindd_util.c b/source3/winbindd/winbindd_util.c -index 42ddbfd2f44..9d54e462c42 100644 ---- a/source3/winbindd/winbindd_util.c -+++ b/source3/winbindd/winbindd_util.c -@@ -134,7 +134,7 @@ static NTSTATUS add_trusted_domain(const char *domain_name, - return NT_STATUS_INVALID_PARAMETER; - } - -- if (!is_allowed_domain(domain_name)) { -+ if (secure_channel_type == SEC_CHAN_NULL && !is_allowed_domain(domain_name)) { - return NT_STATUS_NO_SUCH_DOMAIN; - } - --- -2.33.1 - diff --git a/samba-4.14-ipa-dc-schannel.patch b/samba-4.14-ipa-dc-schannel.patch deleted file mode 100644 index d315a5d..0000000 --- a/samba-4.14-ipa-dc-schannel.patch +++ /dev/null @@ -1,45 +0,0 @@ -From 3fc4d1d3998f3956a84c855cb60a9dcb335e1f59 Mon Sep 17 00:00:00 2001 -From: Alexander Bokovoy -Date: Fri, 12 Nov 2021 19:06:01 +0200 -Subject: [PATCH] IPA DC: add missing checks - -When introducing FreeIPA support, two places were forgotten: - - - schannel gensec module needs to be aware of IPA DC - - _lsa_QueryInfoPolicy should treat IPA DC as PDC - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14903 - -Signed-off-by: Alexander Bokovoy ---- - auth/gensec/schannel.c | 1 + - source3/rpc_server/lsa/srv_lsa_nt.c | 1 + - 2 files changed, 2 insertions(+) - -diff --git a/auth/gensec/schannel.c b/auth/gensec/schannel.c -index 0cdae141ead..6ebbe8f3179 100644 ---- a/auth/gensec/schannel.c -+++ b/auth/gensec/schannel.c -@@ -1080,6 +1080,7 @@ static NTSTATUS schannel_server_start(struct gensec_security *gensec_security) - case ROLE_DOMAIN_BDC: - case ROLE_DOMAIN_PDC: - case ROLE_ACTIVE_DIRECTORY_DC: -+ case ROLE_IPA_DC: - return NT_STATUS_OK; - default: - return NT_STATUS_NOT_IMPLEMENTED; -diff --git a/source3/rpc_server/lsa/srv_lsa_nt.c b/source3/rpc_server/lsa/srv_lsa_nt.c -index 8d71b5252ab..ea92a22cbc9 100644 ---- a/source3/rpc_server/lsa/srv_lsa_nt.c -+++ b/source3/rpc_server/lsa/srv_lsa_nt.c -@@ -683,6 +683,7 @@ NTSTATUS _lsa_QueryInfoPolicy(struct pipes_struct *p, - switch (lp_server_role()) { - case ROLE_DOMAIN_PDC: - case ROLE_DOMAIN_BDC: -+ case ROLE_IPA_DC: - name = get_global_sam_name(); - sid = dom_sid_dup(p->mem_ctx, get_global_sam_sid()); - if (!sid) { --- -2.33.1 - diff --git a/samba.spec b/samba.spec index ef2a10a..7093f49 100644 --- a/samba.spec +++ b/samba.spec @@ -115,9 +115,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global main_release 2 +%global main_release 0 -%global samba_version 4.14.10 +%global samba_version 4.14.11 %global talloc_version 2.3.2 %global tdb_version 1.4.3 %global tevent_version 0.10.2 @@ -185,8 +185,6 @@ Source14: samba.pamd Source201: README.downgrade Patch0: samba-s4u.patch -Patch1: samba-4.14-fix-winbind-no-trusted-domain.patch -Patch2: samba-4.14-ipa-dc-schannel.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -2806,6 +2804,7 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/rfc4120_pyasn1.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/spn_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_ccache.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/test_idmap_nss.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_ldap.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_min_domain_uid.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_rpc.*.pyc @@ -2834,6 +2833,7 @@ fi %{python3_sitearch}/samba/tests/krb5/spn_tests.py %{python3_sitearch}/samba/tests/krb5/s4u_tests.py %{python3_sitearch}/samba/tests/krb5/test_ccache.py +%{python3_sitearch}/samba/tests/krb5/test_idmap_nss.py %{python3_sitearch}/samba/tests/krb5/test_ldap.py %{python3_sitearch}/samba/tests/krb5/test_min_domain_uid.py %{python3_sitearch}/samba/tests/krb5/test_rpc.py @@ -3956,6 +3956,9 @@ fi %endif %changelog +* Wed Dec 15 2021 Guenther Deschner - 4.14.11-0 +- Update to Samba 4.14.11 + * Sat Nov 13 2021 Guenther Deschner - 4.14.10-2 - Fix IPA DC schannel support diff --git a/sources b/sources index e8ff218..68bef4b 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.14.10.tar.xz) = 8ba8e6ae29df10f5b936eac7563b3308adf671ec5b70d457c807a3482b594dc5c1c6a7dfb1c27ade87db7f62999ecbe95b4315db2143e4a19afd1c8b8c8fb00f -SHA512 (samba-4.14.10.tar.asc) = 0763c098b38d4ad8d5d8e22cd9142a1b392dae6bff7a7200d48208cfc47e5413e606418065e30b5042b4a6fa662d2f84df047531ecac668a512e299cab635ecb +SHA512 (samba-4.14.11.tar.xz) = 71dbfa42da94cd46ce3da6fa9feb3465ec72cc0ef3a204cca42f06e5b5c1ac12215dd84ec6e4ac73c66c75739cafc1547008ec616c128fffe071ff254ad52157 +SHA512 (samba-4.14.11.tar.asc) = 93adca86546c6c81caca68022ce521cf5eed73e4b918a6b88bfc0206813a1135196723582355b6a04bb5d0f9b2c2e5a12423b61797a70f7be981f4c7e9fa22f0 From aff99d46fff888abf60a7e6ab46025d667aae738 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Mon, 31 Jan 2022 15:14:20 +0100 Subject: [PATCH 23/25] Update to Samba 4.14.12 --- .gitignore | 2 ++ samba.spec | 8 +++++++- sources | 4 ++-- 3 files changed, 11 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index e94134d..3f9503f 100644 --- a/.gitignore +++ b/.gitignore @@ -263,3 +263,5 @@ samba-3.6.0pre1.tar.gz /samba-4.14.10.tar.asc /samba-4.14.11.tar.xz /samba-4.14.11.tar.asc +/samba-4.14.12.tar.xz +/samba-4.14.12.tar.asc diff --git a/samba.spec b/samba.spec index 7093f49..b345bab 100644 --- a/samba.spec +++ b/samba.spec @@ -117,7 +117,7 @@ %global main_release 0 -%global samba_version 4.14.11 +%global samba_version 4.14.12 %global talloc_version 2.3.2 %global tdb_version 1.4.3 %global tevent_version 0.10.2 @@ -3956,6 +3956,12 @@ fi %endif %changelog +* Mon Jan 31 2022 Pavel Filipenský - 4.14.12-0 +- Update to Samba 4.14.12 +- resolves: #2046120, #2048566 - Security fixes for CVE-2021-44141 +- resolves: #2046146, #2048570 - Security fixes for CVE-2021-44142 +- resolves: #2046134, #2048568 - Security fixes for CVE-2022-0336 + * Wed Dec 15 2021 Guenther Deschner - 4.14.11-0 - Update to Samba 4.14.11 diff --git a/sources b/sources index 68bef4b..38435ea 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.14.11.tar.xz) = 71dbfa42da94cd46ce3da6fa9feb3465ec72cc0ef3a204cca42f06e5b5c1ac12215dd84ec6e4ac73c66c75739cafc1547008ec616c128fffe071ff254ad52157 -SHA512 (samba-4.14.11.tar.asc) = 93adca86546c6c81caca68022ce521cf5eed73e4b918a6b88bfc0206813a1135196723582355b6a04bb5d0f9b2c2e5a12423b61797a70f7be981f4c7e9fa22f0 +SHA512 (samba-4.14.12.tar.xz) = 771c31e68a0b585cca8fc33aedf90159b8503d9a76cc9f3bbfc1c66f39f8756f9c692a73dfab8452d50d99f7a84b621241462d7f37ce61829977f4e1925d6a5c +SHA512 (samba-4.14.12.tar.asc) = 7b92d6506c4277faf448275249a2b299fb2f75d707c7c0843bd52c5aa39f3486ce300506736007abd13c014fa79f970e810eb9c8df55b3a020a7e0eb51cbe39a From f0a6c7215fd231cbe693b3ed0f25f6971e9fc0da Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 4 Apr 2022 19:17:02 +0200 Subject: [PATCH 24/25] Update to Samba 4.14.13 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 3f9503f..0765195 100644 --- a/.gitignore +++ b/.gitignore @@ -265,3 +265,5 @@ samba-3.6.0pre1.tar.gz /samba-4.14.11.tar.asc /samba-4.14.12.tar.xz /samba-4.14.12.tar.asc +/samba-4.14.13.tar.xz +/samba-4.14.13.tar.asc diff --git a/samba.spec b/samba.spec index b345bab..b25e817 100644 --- a/samba.spec +++ b/samba.spec @@ -117,8 +117,8 @@ %global main_release 0 -%global samba_version 4.14.12 -%global talloc_version 2.3.2 +%global samba_version 4.14.13 +%global talloc_version 2.3.3 %global tdb_version 1.4.3 %global tevent_version 0.10.2 %global ldb_version 2.3.2 @@ -3956,6 +3956,9 @@ fi %endif %changelog +* Mon Apr 04 2022 Guenther Deschner - 4.14.13-0 +- Update to Samba 4.14.13 + * Mon Jan 31 2022 Pavel Filipenský - 4.14.12-0 - Update to Samba 4.14.12 - resolves: #2046120, #2048566 - Security fixes for CVE-2021-44141 diff --git a/sources b/sources index 38435ea..70455c7 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.14.12.tar.xz) = 771c31e68a0b585cca8fc33aedf90159b8503d9a76cc9f3bbfc1c66f39f8756f9c692a73dfab8452d50d99f7a84b621241462d7f37ce61829977f4e1925d6a5c -SHA512 (samba-4.14.12.tar.asc) = 7b92d6506c4277faf448275249a2b299fb2f75d707c7c0843bd52c5aa39f3486ce300506736007abd13c014fa79f970e810eb9c8df55b3a020a7e0eb51cbe39a +SHA512 (samba-4.14.13.tar.xz) = 0424549c3bb28ed8a6e376592f5d0916c010d76b6555b34b3c81adfaec9356b42f739a6b8653534f6f694fddc8b2383fea7c8aad4c6618b845e4fa0257c7f6d9 +SHA512 (samba-4.14.13.tar.asc) = b0e35a6281285d70d0c5ea7a788c67e4f3b143cf70472088d454e68cbdad30a383018df45865fd1b73f4ab0508f7d8129c79f791047860b202416d02aa757ee5 From d0d8ecd14cd667d26482a319447646dfce3394d7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 4 Apr 2022 20:28:21 +0200 Subject: [PATCH 25/25] Fix libtalloc/libldb version mismatch Guenther --- samba.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index b25e817..af67810 100644 --- a/samba.spec +++ b/samba.spec @@ -118,10 +118,10 @@ %global main_release 0 %global samba_version 4.14.13 -%global talloc_version 2.3.3 +%global talloc_version 2.3.2 %global tdb_version 1.4.3 %global tevent_version 0.10.2 -%global ldb_version 2.3.2 +%global ldb_version 2.3.3 # This should be rc1 or nil %global pre_release %nil