From 1f9d145336ed0353801476521b4a5e510e40b24f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 23 Aug 2022 21:10:48 +0200 Subject: [PATCH 01/51] Update to version 4.17.0rc3 resolves: #2118818 --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index aa5ec6b..de42e3e 100644 --- a/.gitignore +++ b/.gitignore @@ -301,3 +301,5 @@ samba-3.6.0pre1.tar.gz /samba-4.17.0rc1.tar.asc /samba-4.17.0rc2.tar.xz /samba-4.17.0rc2.tar.asc +/samba-4.17.0rc3.tar.asc +/samba-4.17.0rc3.tar.xz diff --git a/samba.spec b/samba.spec index 8d092a3..9f40891 100644 --- a/samba.spec +++ b/samba.spec @@ -135,9 +135,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.0 -%global baserelease 3 +%global baserelease 4 # This should be rc1 or %%nil -%global pre_release rc2 +%global pre_release rc3 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4205,6 +4205,9 @@ fi %endif %changelog +* Tue Aug 23 2022 Pavel Filipenský - 4.17.0-0.6.rc3 +- resolves: #2118818 - Update to version 4.17.0rc3 + * Thu Aug 18 2022 Kalev Lember - 2:4.17.0-0.3.rc2 - Avoid requiring systemd as per updated packaging guidelines diff --git a/sources b/sources index c7679e2..1f83a1a 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.17.0rc2.tar.xz) = cacdfff9f04eb584769045262e3bfc51c32f11f1fde8c25d30fb65ab19af98d7e4742b9eb519241954d252d2f921d784b70411e1bcaa04c31482e4f6bcee4a8c -SHA512 (samba-4.17.0rc2.tar.asc) = 3ad03e22726b3e7313be273ed1523c679237824f97788ab307cdf1b2219d5fabb021530c42cdbb10ed92cdfa7753d83a00ab9533047eeaec674b7043c70279d4 +SHA512 (samba-4.17.0rc3.tar.asc) = af105c471e7404044b1cb5658dfb0479db09d49967e20f35e121fc2f9b71a2bbd7d61ee0a048502b36319f59e3e79cef838082393cf816dfc079b9dcb6cd18bd +SHA512 (samba-4.17.0rc3.tar.xz) = 545a31318fc9ebcf2b327fd98a96f2ce131c6f3e0e66e3b5d4d8cd939f21b66f0ba354867507411d462407af4aa2a1c2bf7f366604e14752e5d1206ecf5c6731 From a762660a51eedd86d283615737afb16e3784b21d Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 18 Aug 2022 14:57:13 +0200 Subject: [PATCH 02/51] Split out a samba-ldb-ldap-modules subpackage --- samba.spec | 25 +++++++++++++++++++++---- 1 file changed, 21 insertions(+), 4 deletions(-) diff --git a/samba.spec b/samba.spec index 9f40891..fabf68a 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.0 -%global baserelease 4 +%global baserelease 5 # This should be rc1 or %%nil %global pre_release rc3 @@ -509,6 +509,7 @@ Summary: Tools for Samba servers and clients Requires: samba-common-libs = %{samba_depver} Requires: samba-client-libs = %{samba_depver} Requires: samba-libs = %{samba_depver} +Requires: samba-ldb-ldap-modules = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} %endif @@ -537,6 +538,7 @@ Summary: Samba AD Domain Controller Requires: %{name} = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-common-tools = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-dc-provision = %{samba_depver} Requires: %{name}-dc-libs = %{samba_depver} @@ -693,6 +695,15 @@ If you need Kerberos for print jobs to a printer connection to cups via the SMB backend, then you need to install that package. It will allow cups to access the Kerberos credentials cache of the user issuing the print job. +### LDB-LDAP-MODULES +%package ldb-ldap-modules +Summary: Samba ldap modules for ldb +Requires: %{name}-client-libs = %{samba_depver} + +%description ldb-ldap-modules +This package contains the ldb ldap modules required by samba-tool and +samba-gpupdate. + ### LIBS %package libs Summary: Samba libraries @@ -2026,10 +2037,8 @@ fi %{_libdir}/samba/ldb/extended_dn_out.so %{_libdir}/samba/ldb/extended_dn_store.so %{_libdir}/samba/ldb/group_audit_log.so -%{_libdir}/samba/ldb/ildap.so %{_libdir}/samba/ldb/instancetype.so %{_libdir}/samba/ldb/lazy_commit.so -%{_libdir}/samba/ldb/ldbsamba_extensions.so %{_libdir}/samba/ldb/linked_attributes.so %{_libdir}/samba/ldb/new_partition.so %{_libdir}/samba/ldb/objectclass.so @@ -2281,6 +2290,11 @@ fi %attr(0700,root,root) %{_libexecdir}/samba/smbspool_krb5_wrapper %{_mandir}/man8/smbspool_krb5_wrapper.8* +### LDB-LDAP-MODULES +%files ldb-ldap-modules +%{_libdir}/samba/ldb/ldbsamba_extensions.so +%{_libdir}/samba/ldb/ildap.so + ### LIBS %files libs %{_libdir}/libdcerpc-samr.so.* @@ -4205,7 +4219,10 @@ fi %endif %changelog -* Tue Aug 23 2022 Pavel Filipenský - 4.17.0-0.6.rc3 +* Thu Aug 25 2022 Andreas Schneider - 4.17.0-0.5.rc2 +- Split out a samba-ldb-ldap-modules subpackage + +* Tue Aug 23 2022 Pavel Filipenský - 4.17.0-0.4.rc3 - resolves: #2118818 - Update to version 4.17.0rc3 * Thu Aug 18 2022 Kalev Lember - 2:4.17.0-0.3.rc2 From 7bc49ae772ea92dcbd3d3a3de1ae00d81fafa80d Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 19 Aug 2022 12:47:14 +0200 Subject: [PATCH 03/51] Create a samba-gpupdate sub-package for GPO client support --- samba.spec | 30 +++++++++++++++++++++++++++--- 1 file changed, 27 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index fabf68a..189f9d9 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.0 -%global baserelease 5 +%global baserelease 6 # This should be rc1 or %%nil %global pre_release rc3 @@ -680,6 +680,22 @@ Provides: bundled(libreplace) Samba VFS module for GlusterFS integration. %endif +### GPUPDATE +%if %{with dc} +%package gpupdate +Summary: Samba GPO support for clients +Requires: cepces +Requires: certmonger +Requires: %{name}-ldb-ldap-modules = %{samba_depver} +Requires: python3-%{name} = %{samba_depver} + +%description gpupdate +This package provides the samba-gpupdate tool to apply Group Policy Objects +(GPO) on Samba clients. + +# /with dc +%endif + ### KRB5-PRINTING %package krb5-printing Summary: Samba CUPS backend for printing with Kerberos @@ -2012,7 +2028,6 @@ fi %{_sbindir}/samba %{_sbindir}/samba_dnsupdate %{_sbindir}/samba_downgrade_db -%{_sbindir}/samba-gpupdate %{_sbindir}/samba_kcc %{_sbindir}/samba_spnupdate %{_sbindir}/samba_upgradedns @@ -2073,7 +2088,6 @@ fi %dir /var/lib/samba/sysvol %{_mandir}/man8/samba.8* %{_mandir}/man8/samba_downgrade_db.8* -%{_mandir}/man8/samba-gpupdate.8* %dir %{_datadir}/samba/admx %{_datadir}/samba/admx/samba.admx %dir %{_datadir}/samba/admx/en-US @@ -2285,6 +2299,13 @@ fi %{_mandir}/man8/vfs_glusterfs.8* %endif +### GPUPDATE +%if %{with dc} +%files gpupdate +%{_mandir}/man8/samba-gpupdate.8* +%{_sbindir}/samba-gpupdate +%endif + ### KRB5-PRINTING %files krb5-printing %attr(0700,root,root) %{_libexecdir}/samba/smbspool_krb5_wrapper @@ -4219,6 +4240,9 @@ fi %endif %changelog +* Thu Aug 25 2022 Andreas Schneider - 4.17.0-0.6.rc2 +- Create a samba-gpupdate sub-package for GPO client support + * Thu Aug 25 2022 Andreas Schneider - 4.17.0-0.5.rc2 - Split out a samba-ldb-ldap-modules subpackage From e289fdb0c95f0a56abad2a41b767a99f60d52397 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 25 Aug 2022 08:17:04 +0200 Subject: [PATCH 04/51] python3-samba package should not require the samba package --- samba.spec | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 189f9d9..d3e7950 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.0 -%global baserelease 6 +%global baserelease 7 # This should be rc1 or %%nil %global pre_release rc3 @@ -790,7 +790,6 @@ library. ### PYTHON3 %package -n python3-%{name} Summary: Samba Python3 libraries -Requires: %{name} = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} @@ -1993,7 +1992,7 @@ fi %{_mandir}/man5/smbpasswd.5* %{_mandir}/man7/samba.7* -### COMMON-libs +### COMMON-LIBS %files common-libs # common libraries %{_libdir}/samba/libcmdline-samba4.so @@ -4240,6 +4239,9 @@ fi %endif %changelog +* Thu Aug 25 2022 Andreas Schneider - 4.17.0-0.7.rc3 +- python3-samba package should not require the samba package + * Thu Aug 25 2022 Andreas Schneider - 4.17.0-0.6.rc2 - Create a samba-gpupdate sub-package for GPO client support From b7e914c6cef9dd1551f94a4717343047b445f849 Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Thu, 25 Aug 2022 09:58:00 -0700 Subject: [PATCH 05/51] Rebuild with no changes to fix F37 update grouping --- samba.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index d3e7950..0b02429 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.0 -%global baserelease 7 +%global baserelease 8 # This should be rc1 or %%nil %global pre_release rc3 @@ -4239,6 +4239,9 @@ fi %endif %changelog +* Thu Aug 25 2022 Adam Williamson - 4.17.0-0.8.rc3 +- Rebuild with no changes to fix F37 update grouping + * Thu Aug 25 2022 Andreas Schneider - 4.17.0-0.7.rc3 - python3-samba package should not require the samba package From 3ef6786900ce6e002d280cb9ca042b143b0e53b2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 31 Aug 2022 10:51:49 +0200 Subject: [PATCH 06/51] Update to version 4.17.0rc4 resolves: #2118818 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index de42e3e..ea31b28 100644 --- a/.gitignore +++ b/.gitignore @@ -303,3 +303,5 @@ samba-3.6.0pre1.tar.gz /samba-4.17.0rc2.tar.asc /samba-4.17.0rc3.tar.asc /samba-4.17.0rc3.tar.xz +/samba-4.17.0rc4.tar.xz +/samba-4.17.0rc4.tar.asc diff --git a/samba.spec b/samba.spec index 0b02429..e06ea7e 100644 --- a/samba.spec +++ b/samba.spec @@ -135,9 +135,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.0 -%global baserelease 8 +%global baserelease 9 # This should be rc1 or %%nil -%global pre_release rc3 +%global pre_release rc4 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4239,6 +4239,9 @@ fi %endif %changelog +* Wed Aug 31 2022 Guenther Deschner - 4.17.0-0.9.rc4 +- resolves: #2118818 - Update to version 4.17.0rc4 + * Thu Aug 25 2022 Adam Williamson - 4.17.0-0.8.rc3 - Rebuild with no changes to fix F37 update grouping diff --git a/sources b/sources index 1f83a1a..f1969c9 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.17.0rc3.tar.asc) = af105c471e7404044b1cb5658dfb0479db09d49967e20f35e121fc2f9b71a2bbd7d61ee0a048502b36319f59e3e79cef838082393cf816dfc079b9dcb6cd18bd -SHA512 (samba-4.17.0rc3.tar.xz) = 545a31318fc9ebcf2b327fd98a96f2ce131c6f3e0e66e3b5d4d8cd939f21b66f0ba354867507411d462407af4aa2a1c2bf7f366604e14752e5d1206ecf5c6731 +SHA512 (samba-4.17.0rc4.tar.xz) = 0181f6250e8f542904d91f38eb69285e432b7da12cf970bff0f6a548ad76b2ec533d454b487023c5918359f5278789edc440e1cff9a7fb78b5cc2b93bb7f7f9d +SHA512 (samba-4.17.0rc4.tar.asc) = 60b4f06cf82d3d71dddcad216bc3329356e424d32db17d881d734069c0743266c764b931dc60b630afb0698629a0b5ab83b364ef85275e265d5240101be540ea From a65fc8509e1f60965a5edcbba3a78d42f529a260 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 6 Sep 2022 18:49:00 +0200 Subject: [PATCH 07/51] Update to version 4.17.0rc5 resolves: #2118818 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index ea31b28..349a42d 100644 --- a/.gitignore +++ b/.gitignore @@ -305,3 +305,5 @@ samba-3.6.0pre1.tar.gz /samba-4.17.0rc3.tar.xz /samba-4.17.0rc4.tar.xz /samba-4.17.0rc4.tar.asc +/samba-4.17.0rc5.tar.xz +/samba-4.17.0rc5.tar.asc diff --git a/samba.spec b/samba.spec index e06ea7e..96e6ce5 100644 --- a/samba.spec +++ b/samba.spec @@ -135,9 +135,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.0 -%global baserelease 9 +%global baserelease 10 # This should be rc1 or %%nil -%global pre_release rc4 +%global pre_release rc5 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4239,6 +4239,9 @@ fi %endif %changelog +* Tue Sep 06 2022 Guenther Deschner - 4.17.0-0.10.rc5 +- resolves: #2118818 - Update to version 4.17.0rc5 + * Wed Aug 31 2022 Guenther Deschner - 4.17.0-0.9.rc4 - resolves: #2118818 - Update to version 4.17.0rc4 diff --git a/sources b/sources index f1969c9..8211f68 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.17.0rc4.tar.xz) = 0181f6250e8f542904d91f38eb69285e432b7da12cf970bff0f6a548ad76b2ec533d454b487023c5918359f5278789edc440e1cff9a7fb78b5cc2b93bb7f7f9d -SHA512 (samba-4.17.0rc4.tar.asc) = 60b4f06cf82d3d71dddcad216bc3329356e424d32db17d881d734069c0743266c764b931dc60b630afb0698629a0b5ab83b364ef85275e265d5240101be540ea +SHA512 (samba-4.17.0rc5.tar.xz) = b3f0467ac03aa1ec20b430eb6a2a52f1608bc476f226f11dc174957e0d9d8532aec7b26a4330f48d6277efb09b5f9ebb879945513f346861b0e08c2b9d05517f +SHA512 (samba-4.17.0rc5.tar.asc) = c1cd83b0dd912a112aad88a7599141bd41450755a628fee372f841ef949ac14002d47242a65e1602b6f2b53bd97a7a02043c91b340858caddc2b6561e5e14ede From 6efa166ea21facb59378d52d3596d2a08abcf801 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 13 Sep 2022 10:14:02 +0200 Subject: [PATCH 08/51] Split out libnetapi(-devel) sub-packages resolves: rhbz#2093656 --- samba.spec | 42 +++++++++++++++++++++++++++++++++++++----- 1 file changed, 37 insertions(+), 5 deletions(-) diff --git a/samba.spec b/samba.spec index 96e6ce5..4d0db04 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.0 -%global baserelease 10 +%global baserelease 11 # This should be rc1 or %%nil %global pre_release rc5 @@ -236,6 +236,7 @@ Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-common-tools = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} +Requires: libnetapi = %{samba_depver} %if %{with libwbclient} Requires(post): libwbclient = %{samba_depver} Requires: libwbclient = %{samba_depver} @@ -510,6 +511,7 @@ Requires: samba-common-libs = %{samba_depver} Requires: samba-client-libs = %{samba_depver} Requires: samba-libs = %{samba_depver} Requires: samba-ldb-ldap-modules = %{samba_depver} +Requires: libnetapi = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} %endif @@ -618,6 +620,7 @@ Requires: %{name}-client-libs = %{samba_depver} %if %{with dc} Requires: %{name}-dc-libs = %{samba_depver} %endif +Requires: libnetapi = %{samba_depver} Provides: samba4-devel = %{samba_depver} Obsoletes: samba4-devel < %{samba_depver} @@ -738,6 +741,25 @@ Provides: bundled(libreplace) The %{name}-libs package contains the libraries needed by programs that link against the SMB, RPC and other protocols provided by the Samba suite. +### LIBNETAPI +%package -n libnetapi +Summary: The NETAPI library +Requires(pre): %{name}-common = %{samba_depver} +Requires: %{name}-common = %{samba_depver} +Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-client-libs = %{samba_depver} + +%description -n libnetapi +This contains the NETAPI library from the Samba suite. + +%package -n libnetapi-devel +Summary: Developer tools for the NETAPI library +Requires: libnetapi = %{samba_depver} + +%description -n libnetapi-devel +The libnetapi-devel package contains the header files and libraries needed to +develop programs that link against the NETAPI library in the Samba suite. + ### LIBSMBCLIENT %if %{with libsmbclient} %package -n libsmbclient @@ -874,6 +896,7 @@ Requires: %{name}-test-libs = %{samba_depver} Requires: %{name}-dc-libs = %{samba_depver} %endif Requires: %{name}-libs = %{samba_depver} +Requires: libnetapi = %{samba_depver} %if %{with libsmbclient} Requires: libsmbclient = %{samba_depver} %endif @@ -1845,7 +1868,6 @@ fi %{_libdir}/libndr-nbt.so.%{libndr_nbt_so_version}* %{_libdir}/libndr-standard.so.%{libndr_standard_so_version}* %{_libdir}/libndr.so.%{libndr_so_version}* -%{_libdir}/libnetapi.so.%{libnetapi_so_version}* %{_libdir}/libsamba-credentials.so.%{libsamba_credentials_so_version}* %{_libdir}/libsamba-errors.so.%{libsamba_errors_so_version}* %{_libdir}/libsamba-hostconfig.so.%{libsamba_hostconfig_so_version}* @@ -2196,7 +2218,6 @@ fi %{_includedir}/samba-4.0/ndr/ndr_krb5pac.h %{_includedir}/samba-4.0/ndr/ndr_svcctl.h %{_includedir}/samba-4.0/ndr/ndr_nbt.h -%{_includedir}/samba-4.0/netapi.h %{_includedir}/samba-4.0/param.h %{_includedir}/samba-4.0/passdb.h %{_includedir}/samba-4.0/policy.h @@ -2237,7 +2258,6 @@ fi %{_libdir}/libndr-nbt.so %{_libdir}/libndr-standard.so %{_libdir}/libndr.so -%{_libdir}/libnetapi.so %{_libdir}/libsamba-credentials.so %{_libdir}/libsamba-errors.so %{_libdir}/libsamba-hostconfig.so @@ -2251,7 +2271,6 @@ fi %{_libdir}/pkgconfig/ndr_krb5pac.pc %{_libdir}/pkgconfig/ndr_nbt.pc %{_libdir}/pkgconfig/ndr_standard.pc -%{_libdir}/pkgconfig/netapi.pc %{_libdir}/pkgconfig/samba-credentials.pc %{_libdir}/pkgconfig/samba-hostconfig.pc %{_libdir}/pkgconfig/samba-util.pc @@ -2331,6 +2350,16 @@ fi %{_libdir}/samba/libRPC-SERVER-LOOP-samba4.so %{_libdir}/samba/libRPC-WORKER-samba4.so +### LIBNETAPI +%files -n libnetapi +%{_libdir}/libnetapi.so.%{libnetapi_so_version}* + +### LIBNETAPI-DEVEL +%files -n libnetapi-devel +%{_includedir}/samba-4.0/netapi.h +%{_libdir}/libnetapi.so +%{_libdir}/pkgconfig/netapi.pc + ### LIBSMBCLIENT %if %{with libsmbclient} %files -n libsmbclient @@ -4239,6 +4268,9 @@ fi %endif %changelog +* Tue Sep 13 2022 Andreas Schneider - 4.17.0-0.11.rc5 +- resolves: rhbz#2093656 - Split out libnetapi(-devel) sub-packages + * Tue Sep 06 2022 Guenther Deschner - 4.17.0-0.10.rc5 - resolves: #2118818 - Update to version 4.17.0rc5 From 9f5b114c776ee74f6edc048a3276850d79c36ef6 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 13 Sep 2022 10:25:22 +0200 Subject: [PATCH 09/51] Add samba-usershare package resolves: rhbz#2096405 --- samba.spec | 25 ++++++++++++++++++++++++- smb.conf.vendor | 3 +++ usershares.conf.vendor | 3 +++ 3 files changed, 30 insertions(+), 1 deletion(-) create mode 100644 usershares.conf.vendor diff --git a/samba.spec b/samba.spec index 4d0db04..99bdad5 100644 --- a/samba.spec +++ b/samba.spec @@ -224,9 +224,10 @@ Source11: smb.conf.vendor Source12: smb.conf.example Source13: pam_winbind.conf Source14: samba.pamd -Source15: samba.abignore +Source15: usershares.conf.vendor Source201: README.downgrade +Source202: samba.abignore Requires(pre): /usr/sbin/groupadd @@ -933,6 +934,17 @@ Provides: bundled(libreplace) %description test-libs %{name}-test-libs provides libraries required by the testing tools. +### USERSHARES +%package usershares +Summary: Provides support for non-root user shares +Requires: %{name} = %{samba_depver} +Requires: %{name}-common-tools = %{samba_depver} + +%description usershares +Installing this package will provide a configuration file, group and +directories to support non-root user shares. You can configure them +as a user using the `net usershare` command. + ### WINBIND %package winbind Summary: Samba winbind @@ -1284,6 +1296,7 @@ install -d -m 0755 %{buildroot}/var/lib/samba/lock install -d -m 0755 %{buildroot}/var/lib/samba/private install -d -m 0755 %{buildroot}/var/lib/samba/scripts install -d -m 0755 %{buildroot}/var/lib/samba/sysvol +install -d -m 0755 %{buildroot}/var/lib/samba/usershares install -d -m 0755 %{buildroot}/var/lib/samba/winbindd_privileged install -d -m 0755 %{buildroot}/var/log/samba/old install -d -m 0755 %{buildroot}/run/samba @@ -1311,6 +1324,7 @@ install -m 0644 %{SOURCE10} %{buildroot}%{_sysconfdir}/logrotate.d/samba install -m 0644 %{SOURCE11} %{buildroot}%{_sysconfdir}/samba/smb.conf install -m 0644 %{SOURCE12} %{buildroot}%{_sysconfdir}/samba/smb.conf.example +install -m 0644 %{SOURCE15} %{buildroot}%{_sysconfdir}/samba/usershares.conf install -d -m 0755 %{buildroot}%{_sysconfdir}/security install -m 0644 %{SOURCE13} %{buildroot}%{_sysconfdir}/security/pam_winbind.conf @@ -1603,6 +1617,9 @@ fi %ldconfig_scriptlets test +%pre usershares +getent group usershares >/dev/null || groupadd -r usershares || : + %pre winbind /usr/sbin/groupadd -g 88 wbpriv >/dev/null 2>&1 || : @@ -3303,6 +3320,11 @@ fi %{_libdir}/samba/libdsdb-module-samba4.so %endif +### USERSHARES +%files usershares +%config(noreplace) %{_sysconfdir}/samba/usershares.conf +%attr(1770,root,usershares) %dir /var/lib/samba/usershares + ### WINBIND %files winbind %{_libdir}/samba/idmap @@ -4270,6 +4292,7 @@ fi %changelog * Tue Sep 13 2022 Andreas Schneider - 4.17.0-0.11.rc5 - resolves: rhbz#2093656 - Split out libnetapi(-devel) sub-packages +- resolves: rhbz#2096405 - Add samba-usershare package * Tue Sep 06 2022 Guenther Deschner - 4.17.0-0.10.rc5 - resolves: #2118818 - Update to version 4.17.0rc5 diff --git a/smb.conf.vendor b/smb.conf.vendor index 32441aa..e45384d 100644 --- a/smb.conf.vendor +++ b/smb.conf.vendor @@ -18,6 +18,9 @@ load printers = yes cups options = raw + # Install samba-usershares package for support + include = /etc/samba/usershares.conf + [homes] comment = Home Directories valid users = %S, %D%w%S diff --git a/usershares.conf.vendor b/usershares.conf.vendor new file mode 100644 index 0000000..38a7885 --- /dev/null +++ b/usershares.conf.vendor @@ -0,0 +1,3 @@ +[global] + usershare max shares = 100 + usershare allow guests = yes From 2085a17eb1c72b6c9e730973ef386b28570cab33 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 30 Aug 2022 13:49:37 +0200 Subject: [PATCH 10/51] Update to version 4.17.0 resolves: rhbz#2118818 - Update to version 4.17.0 resolves: rhbz#2121138 - Fix CVE-2022-32743 resolves: rhbz#2122650 - Fix CVE-2022-1615 --- .gitignore | 2 ++ samba.spec | 9 +++++++-- sources | 4 ++-- 3 files changed, 11 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 349a42d..b6891e1 100644 --- a/.gitignore +++ b/.gitignore @@ -307,3 +307,5 @@ samba-3.6.0pre1.tar.gz /samba-4.17.0rc4.tar.asc /samba-4.17.0rc5.tar.xz /samba-4.17.0rc5.tar.asc +/samba-4.17.0.tar.xz +/samba-4.17.0.tar.asc diff --git a/samba.spec b/samba.spec index 99bdad5..95ef24d 100644 --- a/samba.spec +++ b/samba.spec @@ -135,9 +135,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.0 -%global baserelease 11 +%global baserelease 1 # This should be rc1 or %%nil -%global pre_release rc5 +%global pre_release %nil %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4290,6 +4290,11 @@ fi %endif %changelog +* Tue Sep 13 2022 Andreas Schneider - 4.17.0-1 +- resolves: rhbz#2118818 - Update to version 4.17.0 +- resolves: rhbz#2121138 - Fix CVE-2022-32743 +- resolves: rhbz#2122650 - Fix CVE-2022-1615 + * Tue Sep 13 2022 Andreas Schneider - 4.17.0-0.11.rc5 - resolves: rhbz#2093656 - Split out libnetapi(-devel) sub-packages - resolves: rhbz#2096405 - Add samba-usershare package diff --git a/sources b/sources index 8211f68..85be74a 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.17.0rc5.tar.xz) = b3f0467ac03aa1ec20b430eb6a2a52f1608bc476f226f11dc174957e0d9d8532aec7b26a4330f48d6277efb09b5f9ebb879945513f346861b0e08c2b9d05517f -SHA512 (samba-4.17.0rc5.tar.asc) = c1cd83b0dd912a112aad88a7599141bd41450755a628fee372f841ef949ac14002d47242a65e1602b6f2b53bd97a7a02043c91b340858caddc2b6561e5e14ede +SHA512 (samba-4.17.0.tar.xz) = 3d2f2ea37cb1acadd1abef6a321b9bcc552daa8d734ae1e48cb9dd07ae95d7fc22ea34f026bb6dddf09fad8cb0a38cd43ccf16e5d966e21f2499d0da5d77973f +SHA512 (samba-4.17.0.tar.asc) = f07912eb373cb93e95ed7ea08cdd456fc977c7383eab093d2e3476bde59b871b1fce2dc075e5a940861d07646e4f459384e37a9b20f9e9d11b4c3785c8dec2c7 From 6972b697e059267bad2ee0a678f664a5312b1b08 Mon Sep 17 00:00:00 2001 From: Anoop C S Date: Wed, 14 Sep 2022 16:10:01 +0530 Subject: [PATCH 11/51] Do not remove ldb-ldap-modules files from buildroot New sub-package samba-ldb-ldap-modules requires corresponding files to be present in buildroot irrespective of whether DC components are enabled or not in the build process. Therefore refrain from removing those from the buildroot. --- samba.spec | 2 -- 1 file changed, 2 deletions(-) diff --git a/samba.spec b/samba.spec index 95ef24d..03ea707 100644 --- a/samba.spec +++ b/samba.spec @@ -1377,8 +1377,6 @@ for i in \ %{_mandir}/man8/samba.8 \ %{_mandir}/man8/samba_downgrade_db.8 \ %{_mandir}/man8/samba-gpupdate.8 \ - %{_libdir}/samba/ldb/ildap.so \ - %{_libdir}/samba/ldb/ldbsamba_extensions.so \ %{_unitdir}/samba.service \ %{python3_sitearch}/samba/dcerpc/dnsserver.*.so \ %{python3_sitearch}/samba/dnsserver.py \ From cc6579cd6a6a1df2dd9e401fb05e75267624625b Mon Sep 17 00:00:00 2001 From: Troy Dawson Date: Tue, 27 Sep 2022 18:18:24 +0000 Subject: [PATCH 12/51] add BuildRequires: systemd-rpm-macros Although the spec requires systemd-rpm-macros for macros such as %{_unitdir} it was only getting pulled in as a dependency of other packages. Dependencies have changed, and systemd-rpm-macros is no longer getting pulled in. Add the BuildRequires so we always get it. Signed-off-by: Troy Dawson tdawson@redhat.com --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index 03ea707..117f337 100644 --- a/samba.spec +++ b/samba.spec @@ -311,6 +311,7 @@ BuildRequires: readline-devel BuildRequires: rpcgen BuildRequires: rpcsvc-proto-devel BuildRequires: sed +BuildRequires: systemd-rpm-macros BuildRequires: libtasn1-devel # We need asn1Parser BuildRequires: libtasn1-tools From 17b8b1136f93240b5f31aef873a0d96284e571e4 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 5 Oct 2022 11:37:23 +0200 Subject: [PATCH 13/51] Move group creation logic to sysusers.d fragment --- samba-systemd-sysusers.conf | 2 ++ samba-usershares-systemd-sysusers.conf | 2 ++ samba.spec | 21 ++++++++++++++++++++- 3 files changed, 24 insertions(+), 1 deletion(-) create mode 100644 samba-systemd-sysusers.conf create mode 100644 samba-usershares-systemd-sysusers.conf diff --git a/samba-systemd-sysusers.conf b/samba-systemd-sysusers.conf new file mode 100644 index 0000000..60ad7a5 --- /dev/null +++ b/samba-systemd-sysusers.conf @@ -0,0 +1,2 @@ +#Type Name ID +g printadmin - diff --git a/samba-usershares-systemd-sysusers.conf b/samba-usershares-systemd-sysusers.conf new file mode 100644 index 0000000..33f8fcb --- /dev/null +++ b/samba-usershares-systemd-sysusers.conf @@ -0,0 +1,2 @@ +#Type Name ID +g usershares - diff --git a/samba.spec b/samba.spec index 117f337..c186154 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.0 -%global baserelease 1 +%global baserelease 2 # This should be rc1 or %%nil %global pre_release %nil @@ -225,6 +225,8 @@ Source12: smb.conf.example Source13: pam_winbind.conf Source14: samba.pamd Source15: usershares.conf.vendor +Source16: samba-systemd-sysusers.conf +Source17: samba-usershares-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore @@ -1348,6 +1350,10 @@ echo "d /run/samba 755 root root" > %{buildroot}%{_tmpfilesdir}/samba.conf echo "d /run/ctdb 755 root root" > %{buildroot}%{_tmpfilesdir}/ctdb.conf %endif +install -d -m 0755 %{buildroot}%{_sysusersdir} +install -m 0644 %{SOURCE16} %{buildroot}%{_sysusersdir}/samba.conf +install -m 0644 %{SOURCE17} %{buildroot}%{_sysusersdir}/samba-usershares.conf + install -d -m 0755 %{buildroot}%{_sysconfdir}/sysconfig install -m 0644 packaging/systemd/samba.sysconfig %{buildroot}%{_sysconfdir}/sysconfig/samba %if %{with clustering} @@ -1508,7 +1514,11 @@ export WINBINDD_DONT_LOG_STDOUT=1 %systemd_postun_with_restart nmb.service %pre common +%if 0%{?fedora} || 0%{?rhel} > 8 +%sysusers_create_compat %{SOURCE16} +%else getent group printadmin >/dev/null || groupadd -r printadmin || : +%endif %post common %{?ldconfig} @@ -1617,7 +1627,11 @@ fi %ldconfig_scriptlets test %pre usershares +%if 0%{?fedora} || 0%{?rhel} > 8 +%sysusers_create_compat %{SOURCE17} +%else getent group usershares >/dev/null || groupadd -r usershares || : +%endif %pre winbind /usr/sbin/groupadd -g 88 wbpriv >/dev/null 2>&1 || : @@ -2011,6 +2025,7 @@ fi ### COMMON %files common %{_tmpfilesdir}/samba.conf +%{_sysusersdir}/samba.conf %dir %{_sysconfdir}/logrotate.d/ %config(noreplace) %{_sysconfdir}/logrotate.d/samba %attr(0700,root,root) %dir /var/log/samba @@ -3323,6 +3338,7 @@ fi %files usershares %config(noreplace) %{_sysconfdir}/samba/usershares.conf %attr(1770,root,usershares) %dir /var/lib/samba/usershares +%{_sysusersdir}/samba-usershares.conf ### WINBIND %files winbind @@ -4289,6 +4305,9 @@ fi %endif %changelog +* Wed Oct 05 2022 Andreas Schneider - 4.17.0-2 +- Move group creation logic to sysusers.d fragment + * Tue Sep 13 2022 Andreas Schneider - 4.17.0-1 - resolves: rhbz#2118818 - Update to version 4.17.0 - resolves: rhbz#2121138 - Fix CVE-2022-32743 From f969f3cc48fb8e03c4e07e7a25f3b0c6aa2a5c74 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Wed, 19 Oct 2022 15:55:11 +0200 Subject: [PATCH 14/51] Update to version 4.17.1 resolves: rhbz#2127301 - Permission denied calling SMBC_getatr when file not exists resolves: rhbz#2133818 - rpcclient 4.17.0 unable to resolve server hostname --- .gitignore | 2 ++ samba.spec | 11 +++++++++-- sources | 4 ++-- 3 files changed, 13 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index b6891e1..af251a8 100644 --- a/.gitignore +++ b/.gitignore @@ -309,3 +309,5 @@ samba-3.6.0pre1.tar.gz /samba-4.17.0rc5.tar.asc /samba-4.17.0.tar.xz /samba-4.17.0.tar.asc +/samba-4.17.1.tar.xz +/samba-4.17.1.tar.asc diff --git a/samba.spec b/samba.spec index c186154..8a1c51b 100644 --- a/samba.spec +++ b/samba.spec @@ -134,8 +134,8 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.17.0 -%global baserelease 2 +%global samba_version 4.17.1 +%global baserelease 1 # This should be rc1 or %%nil %global pre_release %nil @@ -3108,6 +3108,7 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tgs_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kpasswd_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/lockout_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/ms_kile_client_principal_lookup_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/nt_hash_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/pac_align_tests.*.pyc @@ -3137,6 +3138,7 @@ fi %{python3_sitearch}/samba/tests/krb5/kdc_tests.py %{python3_sitearch}/samba/tests/krb5/kdc_tgs_tests.py %{python3_sitearch}/samba/tests/krb5/kpasswd_tests.py +%{python3_sitearch}/samba/tests/krb5/lockout_tests.py %{python3_sitearch}/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py %{python3_sitearch}/samba/tests/krb5/nt_hash_tests.py %{python3_sitearch}/samba/tests/krb5/pac_align_tests.py @@ -4305,6 +4307,11 @@ fi %endif %changelog +* Wed Oct 19 2022 Pavel Filipenský - 4.17.1-1 +- Update to version 4.17.1 +- resolves: rhbz#2127301 - Permission denied calling SMBC_getatr when file not exists +- resolves: rhbz#2133818 - rpcclient 4.17.0 unable to resolve server hostname + * Wed Oct 05 2022 Andreas Schneider - 4.17.0-2 - Move group creation logic to sysusers.d fragment diff --git a/sources b/sources index 85be74a..f1afe23 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.17.0.tar.xz) = 3d2f2ea37cb1acadd1abef6a321b9bcc552daa8d734ae1e48cb9dd07ae95d7fc22ea34f026bb6dddf09fad8cb0a38cd43ccf16e5d966e21f2499d0da5d77973f -SHA512 (samba-4.17.0.tar.asc) = f07912eb373cb93e95ed7ea08cdd456fc977c7383eab093d2e3476bde59b871b1fce2dc075e5a940861d07646e4f459384e37a9b20f9e9d11b4c3785c8dec2c7 +SHA512 (samba-4.17.1.tar.xz) = fd1dd3059c484b550cfc694b14b32bb509c4e0b0e209e15b4ddc98ceba4bee8b4d94c5a488a98f75cafaf1d36dde912d738b6f79cba8bf14037c314ad9bfe4b9 +SHA512 (samba-4.17.1.tar.asc) = 921eec6894195d68922ef86c0c9d741cee17f98e7381f4e8ee99a8fe8168f569cb094b73a4e4094070f9b3ea677cf2db670dba55191fe8b417aa85b804f1fe03 From 11a3749088572edca2d06c6a7a62d3683b67235a Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 24 Oct 2022 16:58:29 +0200 Subject: [PATCH 15/51] Add missing dependency for wbinfo used by ctdb scripts --- samba.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 8a1c51b..29fbabd 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.1 -%global baserelease 1 +%global baserelease 2 # This should be rc1 or %%nil %global pre_release %nil @@ -1067,6 +1067,7 @@ Summary: A Clustered Database based on Samba's Trivial Database (TDB) Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} +Requires: %{name}-winbind-clients = %{samba_depver} Requires: coreutils # for ps and killall @@ -4307,6 +4308,9 @@ fi %endif %changelog +* Mon Oct 24 2022 Andreas Schneider - 4.17.1-2 +- Add missing dependency for wbinfo used by ctdb scripts + * Wed Oct 19 2022 Pavel Filipenský - 4.17.1-1 - Update to version 4.17.1 - resolves: rhbz#2127301 - Permission denied calling SMBC_getatr when file not exists From 50546ea326ddfc9bc8bfb2a58f28b55a53c73026 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 25 Oct 2022 13:15:13 +0200 Subject: [PATCH 16/51] Update to version 4.17.2 --- .gitignore | 2 + samba-4.17-fix-changeuserpassword4.patch | 540 +++++++++++++++++++++++ samba.spec | 11 +- sources | 4 +- 4 files changed, 554 insertions(+), 3 deletions(-) create mode 100644 samba-4.17-fix-changeuserpassword4.patch diff --git a/.gitignore b/.gitignore index af251a8..3dd6a6b 100644 --- a/.gitignore +++ b/.gitignore @@ -311,3 +311,5 @@ samba-3.6.0pre1.tar.gz /samba-4.17.0.tar.asc /samba-4.17.1.tar.xz /samba-4.17.1.tar.asc +/samba-4.17.2.tar.xz +/samba-4.17.2.tar.asc diff --git a/samba-4.17-fix-changeuserpassword4.patch b/samba-4.17-fix-changeuserpassword4.patch new file mode 100644 index 0000000..7f1b482 --- /dev/null +++ b/samba-4.17-fix-changeuserpassword4.patch @@ -0,0 +1,540 @@ +From a3e3d05f35d6082ea48450060b39084e3d0e4056 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Mon, 10 Oct 2022 15:15:20 +0200 +Subject: [PATCH 1/5] s3:librpc: Improve GSE error message + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15206 + +Signed-off-by: Andreas Schneider +Reviewed-by: Noel Power +--- + source3/librpc/crypto/gse.c | 21 +++++++++++++++++++-- + 1 file changed, 19 insertions(+), 2 deletions(-) + +diff --git a/source3/librpc/crypto/gse.c b/source3/librpc/crypto/gse.c +index c50a8a036df..c2cac7abf82 100644 +--- a/source3/librpc/crypto/gse.c ++++ b/source3/librpc/crypto/gse.c +@@ -546,11 +546,28 @@ init_sec_context_done: + goto done; + case GSS_S_FAILURE: + switch (gss_min) { +- case (OM_uint32)KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN: +- DBG_NOTICE("Server principal not found\n"); ++ case (OM_uint32)KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN: { ++ gss_buffer_desc name_token = { ++ .length = 0, ++ }; ++ ++ gss_maj = gss_display_name(&gss_min, ++ gse_ctx->server_name, ++ &name_token, ++ NULL); ++ if (gss_maj == GSS_S_COMPLETE) { ++ DBG_NOTICE("Server principal %.*s not found\n", ++ (int)name_token.length, ++ (char *)name_token.value); ++ gss_release_buffer(&gss_maj, &name_token); ++ } else { ++ DBG_NOTICE("Server principal not found\n"); ++ } ++ + /* Make SPNEGO ignore us, we can't go any further here */ + status = NT_STATUS_INVALID_PARAMETER; + goto done; ++ } + case (OM_uint32)KRB5KRB_AP_ERR_TKT_EXPIRED: + DBG_NOTICE("Ticket expired\n"); + /* Make SPNEGO ignore us, we can't go any further here */ +-- +2.37.3 + + +From d2e2e9acd717e45806f1b19378e09f39c8fe3da8 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Fri, 7 Oct 2022 14:35:15 +0200 +Subject: [PATCH 2/5] s3:rpcclient: Pass salt down to + init_samr_CryptPasswordAES() + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15206 + +Signed-off-by: Andreas Schneider +Reviewed-by: Noel Power +--- + source3/rpc_client/init_samr.c | 15 ++++----------- + source3/rpc_client/init_samr.h | 1 + + source3/rpcclient/cmd_samr.c | 8 ++++++++ + source4/libnet/libnet_passwd.c | 13 +++++++------ + source4/torture/rpc/samr.c | 27 +++++++++++++++++++++++++++ + 5 files changed, 47 insertions(+), 17 deletions(-) + +diff --git a/source3/rpc_client/init_samr.c b/source3/rpc_client/init_samr.c +index 68f42b602b3..52fa2f90d6e 100644 +--- a/source3/rpc_client/init_samr.c ++++ b/source3/rpc_client/init_samr.c +@@ -79,6 +79,7 @@ NTSTATUS init_samr_CryptPassword(const char *pwd, + + NTSTATUS init_samr_CryptPasswordAES(TALLOC_CTX *mem_ctx, + const char *password, ++ DATA_BLOB *salt, + DATA_BLOB *session_key, + struct samr_EncryptedPasswordAES *ppwd_buf) + { +@@ -87,12 +88,6 @@ NTSTATUS init_samr_CryptPasswordAES(TALLOC_CTX *mem_ctx, + .data = pw_data, + .length = sizeof(pw_data), + }; +- size_t iv_size = gnutls_cipher_get_iv_size(GNUTLS_CIPHER_AES_256_CBC); +- uint8_t iv_data[iv_size]; +- DATA_BLOB iv = { +- .data = iv_data, +- .length = iv_size, +- }; + DATA_BLOB ciphertext = data_blob_null; + NTSTATUS status = NT_STATUS_UNSUCCESSFUL; + bool ok; +@@ -101,8 +96,6 @@ NTSTATUS init_samr_CryptPasswordAES(TALLOC_CTX *mem_ctx, + return NT_STATUS_INVALID_PARAMETER; + } + +- generate_nonce_buffer(iv.data, iv.length); +- + ok = encode_pwd_buffer514_from_str(pw_data, password, STR_UNICODE); + if (!ok) { + return NT_STATUS_INTERNAL_ERROR; +@@ -114,7 +107,7 @@ NTSTATUS init_samr_CryptPasswordAES(TALLOC_CTX *mem_ctx, + session_key, + &samr_aes256_enc_key_salt, + &samr_aes256_mac_key_salt, +- &iv, ++ salt, + &ciphertext, + ppwd_buf->auth_data); + BURN_DATA(pw_data); +@@ -126,8 +119,8 @@ NTSTATUS init_samr_CryptPasswordAES(TALLOC_CTX *mem_ctx, + ppwd_buf->cipher = ciphertext.data; + ppwd_buf->PBKDF2Iterations = 0; + +- SMB_ASSERT(iv.length == sizeof(ppwd_buf->salt)); +- memcpy(ppwd_buf->salt, iv.data, iv.length); ++ SMB_ASSERT(salt->length == sizeof(ppwd_buf->salt)); ++ memcpy(ppwd_buf->salt, salt->data, salt->length); + + return NT_STATUS_OK; + } +diff --git a/source3/rpc_client/init_samr.h b/source3/rpc_client/init_samr.h +index 940534e7168..71b4c0e573d 100644 +--- a/source3/rpc_client/init_samr.h ++++ b/source3/rpc_client/init_samr.h +@@ -47,6 +47,7 @@ NTSTATUS init_samr_CryptPassword(const char *pwd, + */ + NTSTATUS init_samr_CryptPasswordAES(TALLOC_CTX *mem_ctx, + const char *password, ++ DATA_BLOB *salt, + DATA_BLOB *session_key, + struct samr_EncryptedPasswordAES *ppwd_buf); + +diff --git a/source3/rpcclient/cmd_samr.c b/source3/rpcclient/cmd_samr.c +index 9ccd2f78a8d..8106ca90cf2 100644 +--- a/source3/rpcclient/cmd_samr.c ++++ b/source3/rpcclient/cmd_samr.c +@@ -3172,6 +3172,11 @@ static NTSTATUS cmd_samr_setuserinfo_int(struct rpc_pipe_client *cli, + uint8_t nt_hash[16]; + uint8_t lm_hash[16]; + DATA_BLOB session_key; ++ uint8_t salt_data[16]; ++ DATA_BLOB salt = { ++ .data = salt_data, ++ .length = sizeof(salt_data), ++ }; + uint8_t password_expired = 0; + struct dcerpc_binding_handle *b = cli->binding_handle; + TALLOC_CTX *frame = NULL; +@@ -3198,6 +3203,8 @@ static NTSTATUS cmd_samr_setuserinfo_int(struct rpc_pipe_client *cli, + goto done; + } + ++ generate_nonce_buffer(salt.data, salt.length); ++ + switch(level) { + case 18: + case 21: +@@ -3220,6 +3227,7 @@ static NTSTATUS cmd_samr_setuserinfo_int(struct rpc_pipe_client *cli, + case 31: + status = init_samr_CryptPasswordAES(frame, + param, ++ &salt, + &session_key, + &pwd_buf_aes); + if (!NT_STATUS_IS_OK(status)) { +diff --git a/source4/libnet/libnet_passwd.c b/source4/libnet/libnet_passwd.c +index 4f662110e55..a1672104824 100644 +--- a/source4/libnet/libnet_passwd.c ++++ b/source4/libnet/libnet_passwd.c +@@ -57,13 +57,13 @@ static NTSTATUS libnet_ChangePassword_samr_aes(TALLOC_CTX *mem_ctx, + struct samr_EncryptedPasswordAES pwd_buf = { + .cipher_len = 0 + }; +- DATA_BLOB iv = { ++ DATA_BLOB salt = { + .data = pwd_buf.salt, + .length = sizeof(pwd_buf.salt), + }; +- gnutls_datum_t iv_datum = { +- .data = iv.data, +- .size = iv.length, ++ gnutls_datum_t salt_datum = { ++ .data = pwd_buf.salt, ++ .size = sizeof(pwd_buf.salt), + }; + uint64_t pbkdf2_iterations = generate_random_u64_range(5000, 1000000); + NTSTATUS status; +@@ -71,11 +71,11 @@ static NTSTATUS libnet_ChangePassword_samr_aes(TALLOC_CTX *mem_ctx, + + E_md4hash(old_password, old_nt_key_data); + +- generate_nonce_buffer(iv.data, iv.length); ++ generate_nonce_buffer(salt.data, salt.length); + + rc = gnutls_pbkdf2(GNUTLS_MAC_SHA512, + &old_nt_key, +- &iv_datum, ++ &salt_datum, + pbkdf2_iterations, + cek.data, + cek.length); +@@ -86,6 +86,7 @@ static NTSTATUS libnet_ChangePassword_samr_aes(TALLOC_CTX *mem_ctx, + + status = init_samr_CryptPasswordAES(mem_ctx, + new_password, ++ &salt, + &cek, + &pwd_buf); + data_blob_clear(&cek); +diff --git a/source4/torture/rpc/samr.c b/source4/torture/rpc/samr.c +index de354659067..0b1880efa18 100644 +--- a/source4/torture/rpc/samr.c ++++ b/source4/torture/rpc/samr.c +@@ -783,6 +783,11 @@ static bool test_SetUserPass_32(struct dcerpc_pipe *p, struct torture_context *t + struct samr_SetUserInfo s; + union samr_UserInfo u; + DATA_BLOB session_key; ++ uint8_t salt_data[16]; ++ DATA_BLOB salt = { ++ .data = salt_data, ++ .length = sizeof(salt_data), ++ }; + char *newpass = NULL; + struct dcerpc_binding_handle *b = p->binding_handle; + struct samr_GetUserPwInfo pwp; +@@ -818,8 +823,11 @@ static bool test_SetUserPass_32(struct dcerpc_pipe *p, struct torture_context *t + return false; + } + ++ generate_nonce_buffer(salt.data, salt.length); ++ + status = init_samr_CryptPasswordAES(tctx, + newpass, ++ &salt, + &session_key, + &u.info32.password); + torture_assert_ntstatus_ok(tctx, +@@ -852,6 +860,7 @@ static bool test_SetUserPass_32(struct dcerpc_pipe *p, struct torture_context *t + + status = init_samr_CryptPasswordAES(tctx, + newpass, ++ &salt, + &session_key, + &u.info32.password); + torture_assert_ntstatus_ok(tctx, +@@ -896,6 +905,11 @@ static bool test_SetUserPass_31(struct dcerpc_pipe *p, struct torture_context *t + union samr_UserInfo u; + bool ret = true; + DATA_BLOB session_key; ++ uint8_t salt_data[16]; ++ DATA_BLOB salt = { ++ .data = salt_data, ++ .length = sizeof(salt_data), ++ }; + char *newpass; + struct dcerpc_binding_handle *b = p->binding_handle; + struct samr_GetUserPwInfo pwp; +@@ -931,8 +945,11 @@ static bool test_SetUserPass_31(struct dcerpc_pipe *p, struct torture_context *t + return false; + } + ++ generate_nonce_buffer(salt.data, salt.length); ++ + status = init_samr_CryptPasswordAES(tctx, + newpass, ++ &salt, + &session_key, + &u.info31.password); + torture_assert_ntstatus_ok(tctx, +@@ -959,6 +976,7 @@ static bool test_SetUserPass_31(struct dcerpc_pipe *p, struct torture_context *t + + status = init_samr_CryptPasswordAES(tctx, + newpass, ++ &salt, + &session_key, + &u.info31.password); + torture_assert_ntstatus_ok(tctx, +@@ -1381,6 +1399,11 @@ static bool test_SetUserPass_level_ex(struct dcerpc_pipe *p, + union samr_UserInfo u; + bool ret = true; + DATA_BLOB session_key; ++ uint8_t salt_data[16]; ++ DATA_BLOB salt = { ++ .data = salt_data, ++ .length = sizeof(salt_data), ++ }; + char *newpass; + struct dcerpc_binding_handle *b = p->binding_handle; + struct samr_GetUserPwInfo pwp; +@@ -1490,6 +1513,8 @@ static bool test_SetUserPass_level_ex(struct dcerpc_pipe *p, + return false; + } + ++ generate_nonce_buffer(salt.data, salt.length); ++ + switch (level) { + case 18: + { +@@ -1561,6 +1586,7 @@ static bool test_SetUserPass_level_ex(struct dcerpc_pipe *p, + case 31: + status = init_samr_CryptPasswordAES(tctx, + newpass, ++ &salt, + &session_key, + &u.info31.password); + +@@ -1568,6 +1594,7 @@ static bool test_SetUserPass_level_ex(struct dcerpc_pipe *p, + case 32: + status = init_samr_CryptPasswordAES(tctx, + newpass, ++ &salt, + &session_key, + &u.info32.password); + +-- +2.37.3 + + +From 1d630363c9b2497266e418aad89c55d5b51a63ad Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Mon, 17 Oct 2022 09:02:28 +0200 +Subject: [PATCH 3/5] s4:libnet: If we successfully changed the password we are + done + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15206 + +Signed-off-by: Andreas Schneider +Reviewed-by: Noel Power +--- + source4/libnet/libnet_passwd.c | 32 ++++++++++++++++++-------------- + 1 file changed, 18 insertions(+), 14 deletions(-) + +diff --git a/source4/libnet/libnet_passwd.c b/source4/libnet/libnet_passwd.c +index a1672104824..b17614bcd97 100644 +--- a/source4/libnet/libnet_passwd.c ++++ b/source4/libnet/libnet_passwd.c +@@ -101,7 +101,7 @@ static NTSTATUS libnet_ChangePassword_samr_aes(TALLOC_CTX *mem_ctx, + r.in.password = &pwd_buf; + + status = dcerpc_samr_ChangePasswordUser4_r(h, mem_ctx, &r); +- if (NT_STATUS_IS_OK(status)) { ++ if (!NT_STATUS_IS_OK(status)) { + goto done; + } + if (!NT_STATUS_IS_OK(r.out.result)) { +@@ -112,6 +112,7 @@ static NTSTATUS libnet_ChangePassword_samr_aes(TALLOC_CTX *mem_ctx, + account->string, + nt_errstr(status)); + status = r.out.result; ++ goto done; + } + + done: +@@ -424,20 +425,23 @@ static NTSTATUS libnet_ChangePassword_samr(struct libnet_context *ctx, TALLOC_CT + r->samr.in.oldpassword, + r->samr.in.newpassword, + &(r->samr.out.error_string)); +- if (!NT_STATUS_IS_OK(status)) { +- if (NT_STATUS_EQUAL(status, +- NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE) || +- NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED) || +- NT_STATUS_EQUAL(status, NT_STATUS_NOT_IMPLEMENTED)) { +- /* +- * Don't fallback to RC4 based SAMR if weak crypto is not +- * allowed. +- */ +- if (lpcfg_weak_crypto(ctx->lp_ctx) == +- SAMBA_WEAK_CRYPTO_DISALLOWED) { +- goto disconnect; +- } ++ if (NT_STATUS_IS_OK(status)) { ++ goto disconnect; ++ } else if (NT_STATUS_EQUAL(status, ++ NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE) || ++ NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED) || ++ NT_STATUS_EQUAL(status, NT_STATUS_NOT_IMPLEMENTED)) { ++ /* ++ * Don't fallback to RC4 based SAMR if weak crypto is not ++ * allowed. ++ */ ++ if (lpcfg_weak_crypto(ctx->lp_ctx) == ++ SAMBA_WEAK_CRYPTO_DISALLOWED) { ++ goto disconnect; + } ++ } else { ++ /* libnet_ChangePassword_samr_aes is implemented and failed */ ++ goto disconnect; + } + + status = libnet_ChangePassword_samr_rc4( +-- +2.37.3 + + +From 9a4a169ab34641afb87e7f81708c9a72b321879e Mon Sep 17 00:00:00 2001 +From: Noel Power +Date: Fri, 21 Oct 2022 17:40:36 +0100 +Subject: [PATCH 4/5] s4/rpc_server/sambr: don't mutate the return of + samdb_set_password_aes + +prior to this commit return of samdb_set_password_aes was set to +NT_STATUS_WRONG_PASSWORD on failure. Useful status that should be +returned such as NT_STATUS_PASSWORD_RESTRICTION are swallowed here +otherwise (and in this case can be partially responsible for failures +in test samba.tests.auth_log_pass_change (with later gnutls) + +Signed-off-by: Noel Power +Reviewed-by: Andreas Schneider +--- + source4/rpc_server/samr/samr_password.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/source4/rpc_server/samr/samr_password.c b/source4/rpc_server/samr/samr_password.c +index 4691f9a47a9..b581be6361c 100644 +--- a/source4/rpc_server/samr/samr_password.c ++++ b/source4/rpc_server/samr/samr_password.c +@@ -250,7 +250,6 @@ NTSTATUS dcesrv_samr_ChangePasswordUser4(struct dcesrv_call_state *dce_call, + + if (!NT_STATUS_IS_OK(status)) { + ldb_transaction_cancel(sam_ctx); +- status = NT_STATUS_WRONG_PASSWORD; + goto done; + } + +-- +2.37.3 + + +From b8b36ecba0f22dbc203c12627ebd629c2437c635 Mon Sep 17 00:00:00 2001 +From: Noel Power +Date: Fri, 21 Oct 2022 17:14:44 +0100 +Subject: [PATCH 5/5] python/samba/tests: fix samba.tests.auth_log_pass_change + for later gnutls + +later gnutls that support GNUTLS_PBKDF2 currently fail, +we need to conditionally switch test data to reflect use of +'samr_ChangePasswordUser3' or 'samr_ChangePasswordUser4' +depending on whether GNUTLS_PBKDF2 is supported or not + +Signed-off-by: Noel Power +Reviewed-by: Andreas Schneider +--- + python/samba/tests/auth_log_pass_change.py | 20 ++++++++++++++++---- + source4/selftest/tests.py | 9 ++++++--- + 2 files changed, 22 insertions(+), 7 deletions(-) + +diff --git a/python/samba/tests/auth_log_pass_change.py b/python/samba/tests/auth_log_pass_change.py +index 972af2158dd..1ca46c586b3 100644 +--- a/python/samba/tests/auth_log_pass_change.py ++++ b/python/samba/tests/auth_log_pass_change.py +@@ -72,6 +72,18 @@ class AuthLogPassChangeTests(samba.tests.auth_log_base.AuthLogTestBase): + + # discard any auth log messages for the password setup + self.discardMessages() ++ gnutls_pbkdf2_support = samba.tests.env_get_var_value( ++ 'GNUTLS_PBKDF2_SUPPORT', ++ allow_missing=True) ++ if gnutls_pbkdf2_support is None: ++ gnutls_pbkdf2_support = '0' ++ self.gnutls_pbkdf2_support = bool(int(gnutls_pbkdf2_support)) ++ ++ def _authDescription(self): ++ if self.gnutls_pbkdf2_support: ++ return "samr_ChangePasswordUser4" ++ else: ++ return "samr_ChangePasswordUser3" + + def tearDown(self): + super(AuthLogPassChangeTests, self).tearDown() +@@ -83,7 +95,7 @@ class AuthLogPassChangeTests(samba.tests.auth_log_base.AuthLogTestBase): + (msg["Authentication"]["serviceDescription"] == + "SAMR Password Change") and + (msg["Authentication"]["authDescription"] == +- "samr_ChangePasswordUser3") and ++ self._authDescription()) and + (msg["Authentication"]["eventId"] == + EVT_ID_SUCCESSFUL_LOGON) and + (msg["Authentication"]["logonType"] == +@@ -109,7 +121,7 @@ class AuthLogPassChangeTests(samba.tests.auth_log_base.AuthLogTestBase): + (msg["Authentication"]["serviceDescription"] == + "SAMR Password Change") and + (msg["Authentication"]["authDescription"] == +- "samr_ChangePasswordUser3") and ++ self._authDescription()) and + (msg["Authentication"]["eventId"] == + EVT_ID_UNSUCCESSFUL_LOGON) and + (msg["Authentication"]["logonType"] == +@@ -141,7 +153,7 @@ class AuthLogPassChangeTests(samba.tests.auth_log_base.AuthLogTestBase): + (msg["Authentication"]["serviceDescription"] == + "SAMR Password Change") and + (msg["Authentication"]["authDescription"] == +- "samr_ChangePasswordUser3") and ++ self._authDescription()) and + (msg["Authentication"]["eventId"] == + EVT_ID_UNSUCCESSFUL_LOGON) and + (msg["Authentication"]["logonType"] == +@@ -174,7 +186,7 @@ class AuthLogPassChangeTests(samba.tests.auth_log_base.AuthLogTestBase): + (msg["Authentication"]["serviceDescription"] == + "SAMR Password Change") and + (msg["Authentication"]["authDescription"] == +- "samr_ChangePasswordUser3") and ++ self._authDescription()) and + (msg["Authentication"]["eventId"] == + EVT_ID_UNSUCCESSFUL_LOGON) and + (msg["Authentication"]["logonType"] == +diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py +index a803d4704ea..c92105586a7 100755 +--- a/source4/selftest/tests.py ++++ b/source4/selftest/tests.py +@@ -1094,9 +1094,11 @@ if have_heimdal_support: + environ={'CLIENT_IP': '10.53.57.11', + 'SOCKET_WRAPPER_DEFAULT_IFACE': 11}) + planoldpythontestsuite("ad_dc_smb1", "samba.tests.auth_log_pass_change", +- extra_args=['-U"$USERNAME%$PASSWORD"']) ++ extra_args=['-U"$USERNAME%$PASSWORD"'], ++ environ={'GNUTLS_PBKDF2_SUPPORT': gnutls_pbkdf2_support}) + planoldpythontestsuite("ad_dc_ntvfs", "samba.tests.auth_log_pass_change", +- extra_args=['-U"$USERNAME%$PASSWORD"']) ++ extra_args=['-U"$USERNAME%$PASSWORD"'], ++ environ={'GNUTLS_PBKDF2_SUPPORT': gnutls_pbkdf2_support}) + + # these tests use a NCA local RPC connection, so always run on the + # :local testenv, and so don't need to fake a client connection +@@ -1113,7 +1115,8 @@ if have_heimdal_support: + "samba.tests.auth_log_winbind", + extra_args=['-U"$DC_USERNAME%$DC_PASSWORD"']) + planoldpythontestsuite("ad_dc", "samba.tests.audit_log_pass_change", +- extra_args=['-U"$USERNAME%$PASSWORD"']) ++ extra_args=['-U"$USERNAME%$PASSWORD"'], ++ environ={'GNUTLS_PBKDF2_SUPPORT': gnutls_pbkdf2_support}) + planoldpythontestsuite("ad_dc", "samba.tests.audit_log_dsdb", + extra_args=['-U"$USERNAME%$PASSWORD"']) + planoldpythontestsuite("ad_dc", "samba.tests.group_audit", +-- +2.37.3 + diff --git a/samba.spec b/samba.spec index 29fbabd..3ca19a8 100644 --- a/samba.spec +++ b/samba.spec @@ -134,7 +134,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.17.1 +%global samba_version 4.17.2 %global baserelease 2 # This should be rc1 or %%nil %global pre_release %nil @@ -1167,7 +1167,11 @@ Support for using an existing CEPH cluster as a mutex helper for CTDB %prep +%if 0%{?fedora} || 0%{?rhel} >= 9 +xzcat %{SOURCE0} | %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data=- +%else xzcat %{SOURCE0} | gpgv2 --quiet --keyring %{SOURCE2} %{SOURCE1} - +%endif %autosetup -n samba-%{version}%{pre_release} -p1 # Ensure we rely on GnuTLS and do not build any other crypto code shipping with @@ -4308,6 +4312,11 @@ fi %endif %changelog +* Tue Oct 25 2022 Andreas Schneider - 4.17.2-1 +- Update to version 4.17.2 +- Fix CVE-2022-3592: A malicious client can use a symlink to escape the + exported + * Mon Oct 24 2022 Andreas Schneider - 4.17.1-2 - Add missing dependency for wbinfo used by ctdb scripts diff --git a/sources b/sources index f1afe23..7e71a49 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.17.1.tar.xz) = fd1dd3059c484b550cfc694b14b32bb509c4e0b0e209e15b4ddc98ceba4bee8b4d94c5a488a98f75cafaf1d36dde912d738b6f79cba8bf14037c314ad9bfe4b9 -SHA512 (samba-4.17.1.tar.asc) = 921eec6894195d68922ef86c0c9d741cee17f98e7381f4e8ee99a8fe8168f569cb094b73a4e4094070f9b3ea677cf2db670dba55191fe8b417aa85b804f1fe03 +SHA512 (samba-4.17.2.tar.xz) = 6450deb75ee0b0a6a8e814f62e71973fe4d3e04050a3af42d1c6a3fb3603f0b2b02fa2b86e9a2309f1141a7f2d4ddc32ec4f51457f3c6d735fd19c9750254e31 +SHA512 (samba-4.17.2.tar.asc) = 0cb78e234e812d853ea2e795dbd2dba13bdd45e484a206ecaa54fb353e5d55697bb4cddc5d6e46bf43fa6d5bbcc32d62324dc907d0d122f99bcb3c220ab7d1ef From 690c51a74b4bbfd5fb056361c705b5b0afe3bc01 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 26 Oct 2022 11:31:30 +0200 Subject: [PATCH 17/51] Add missing require for libcmdline from samba-common-libs --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index 3ca19a8..bea9abd 100644 --- a/samba.spec +++ b/samba.spec @@ -722,6 +722,7 @@ the Kerberos credentials cache of the user issuing the print job. %package ldb-ldap-modules Summary: Samba ldap modules for ldb Requires: %{name}-client-libs = %{samba_depver} +Requires: %{name}-common-libs = %{samba_depver} %description ldb-ldap-modules This package contains the ldb ldap modules required by samba-tool and From c86f1a337ebed9ac0315994ede123851c97e927f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 15 Nov 2022 18:39:46 +0100 Subject: [PATCH 18/51] Update to version 4.17.3 resolves: #2142959 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 3dd6a6b..de0b909 100644 --- a/.gitignore +++ b/.gitignore @@ -313,3 +313,5 @@ samba-3.6.0pre1.tar.gz /samba-4.17.1.tar.asc /samba-4.17.2.tar.xz /samba-4.17.2.tar.asc +/samba-4.17.3.tar.xz +/samba-4.17.3.tar.asc diff --git a/samba.spec b/samba.spec index bea9abd..633cbc9 100644 --- a/samba.spec +++ b/samba.spec @@ -134,8 +134,8 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.17.2 -%global baserelease 2 +%global samba_version 4.17.3 +%global baserelease 0 # This should be rc1 or %%nil %global pre_release %nil @@ -4313,6 +4313,9 @@ fi %endif %changelog +* Tue Nov 15 2022 Guenther Deschner - 4.17.3-0 +- resolves: #2142959 - Update to version 4.17.3 + * Tue Oct 25 2022 Andreas Schneider - 4.17.2-1 - Update to version 4.17.2 - Fix CVE-2022-3592: A malicious client can use a symlink to escape the diff --git a/sources b/sources index 7e71a49..663dead 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.17.2.tar.xz) = 6450deb75ee0b0a6a8e814f62e71973fe4d3e04050a3af42d1c6a3fb3603f0b2b02fa2b86e9a2309f1141a7f2d4ddc32ec4f51457f3c6d735fd19c9750254e31 -SHA512 (samba-4.17.2.tar.asc) = 0cb78e234e812d853ea2e795dbd2dba13bdd45e484a206ecaa54fb353e5d55697bb4cddc5d6e46bf43fa6d5bbcc32d62324dc907d0d122f99bcb3c220ab7d1ef +SHA512 (samba-4.17.3.tar.xz) = e346460ab53a5ed1f534992e21bb53c790fa4ba50752f0cf31d46fb96d138e4723a0171705ef8bf4ce3354960ddacc5a82b75975b06dcbe3224a09951174a5e7 +SHA512 (samba-4.17.3.tar.asc) = 814976c76a43b46fe67bd9a904fe3846104680446dfaf5759989a60ce1a088adb264c0bf67eccf9634fe84b3eb7ac1b8dbd020fcabf5e586c1773a2edad86306 From b153e7b80394e2b05d7f292bbf8d327b76d9f3f8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 16 Nov 2022 00:50:27 +0100 Subject: [PATCH 19/51] Security fixes for CVE-2022-42898 resolves: #2140960, #2143117 Guenther --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index 633cbc9..5712930 100644 --- a/samba.spec +++ b/samba.spec @@ -4315,6 +4315,7 @@ fi %changelog * Tue Nov 15 2022 Guenther Deschner - 4.17.3-0 - resolves: #2142959 - Update to version 4.17.3 +- resolves: #2140960, #2143117 - Security fixes for CVE-2022-42898 * Tue Oct 25 2022 Andreas Schneider - 4.17.2-1 - Update to version 4.17.2 From a96084a42da3f80185d5c0e93528f4b9342c481e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 16 Dec 2022 12:47:28 +0100 Subject: [PATCH 20/51] Update to version 4.17.4 resolves: #2153906 resolves: #2154362, #2154363 - Security fixes for CVE-2022-38023 resolves: #2154303, #2154304 - Security fixes for CVE-2022-37966 resolves: #2154320, #2154322 - Security fixes for CVE-2022-37967 Guenther --- .gitignore | 2 ++ samba.spec | 10 +++++++++- sources | 4 ++-- 3 files changed, 13 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index de0b909..fe25028 100644 --- a/.gitignore +++ b/.gitignore @@ -315,3 +315,5 @@ samba-3.6.0pre1.tar.gz /samba-4.17.2.tar.asc /samba-4.17.3.tar.xz /samba-4.17.3.tar.asc +/samba-4.17.4.tar.xz +/samba-4.17.4.tar.asc diff --git a/samba.spec b/samba.spec index 5712930..2f61f6f 100644 --- a/samba.spec +++ b/samba.spec @@ -134,7 +134,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.17.3 +%global samba_version 4.17.4 %global baserelease 0 # This should be rc1 or %%nil %global pre_release %nil @@ -3108,6 +3108,7 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/as_canonicalization_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/as_req_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/compatability_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/etype_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/fast_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kcrypto.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_base_test.*.pyc @@ -3138,6 +3139,7 @@ fi %{python3_sitearch}/samba/tests/krb5/as_canonicalization_tests.py %{python3_sitearch}/samba/tests/krb5/as_req_tests.py %{python3_sitearch}/samba/tests/krb5/compatability_tests.py +%{python3_sitearch}/samba/tests/krb5/etype_tests.py %{python3_sitearch}/samba/tests/krb5/fast_tests.py %{python3_sitearch}/samba/tests/krb5/kcrypto.py %{python3_sitearch}/samba/tests/krb5/kdc_base_test.py @@ -4313,6 +4315,12 @@ fi %endif %changelog +* Fri Dec 16 2022 Guenther Deschner - 4.17.4-0 +- resolves: #2153906 - Update to version 4.17.4 +- resolves: #2154362, #2154363 - Security fixes for CVE-2022-38023 +- resolves: #2154303, #2154304 - Security fixes for CVE-2022-37966 +- resolves: #2154320, #2154322 - Security fixes for CVE-2022-37967 + * Tue Nov 15 2022 Guenther Deschner - 4.17.3-0 - resolves: #2142959 - Update to version 4.17.3 - resolves: #2140960, #2143117 - Security fixes for CVE-2022-42898 diff --git a/sources b/sources index 663dead..523fbd2 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.17.3.tar.xz) = e346460ab53a5ed1f534992e21bb53c790fa4ba50752f0cf31d46fb96d138e4723a0171705ef8bf4ce3354960ddacc5a82b75975b06dcbe3224a09951174a5e7 -SHA512 (samba-4.17.3.tar.asc) = 814976c76a43b46fe67bd9a904fe3846104680446dfaf5759989a60ce1a088adb264c0bf67eccf9634fe84b3eb7ac1b8dbd020fcabf5e586c1773a2edad86306 +SHA512 (samba-4.17.4.tar.xz) = ffbde223ae324b6c0c779df75c926b09b77289f0ea4a6b6668d1bd758b621b3ed8ccdc4d101e6b153d1359c185b46d4baef5a7854dbc3864debbfa4696fa6bc8 +SHA512 (samba-4.17.4.tar.asc) = f69613c148453c57e83ba2bae45a316c19f80f9cceeab81a099d896e2dc578536175aa2278f85cf9e4899c8310a4eafeb1bfe365da16dd63195ffd099d6b6a6c From f40435c9608c988780c18a4c73157612a908bb74 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Mon, 19 Dec 2022 10:22:17 +0100 Subject: [PATCH 21/51] Move libpac and libauth4 to dc-libs This allows us to not install the samba and samba-dc packages. They are not needed for domain member which just want to have samba-winbind related packages installed. --- samba.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index 2f61f6f..b9bae84 100644 --- a/samba.spec +++ b/samba.spec @@ -2093,7 +2093,6 @@ fi %{_libdir}/krb5/plugins/kdb/samba.so %{_libdir}/samba/auth/samba4.so -%{_libdir}/samba/libpac-samba4.so %dir %{_libdir}/samba/gensec %{_libdir}/samba/gensec/krb5.so %{_libdir}/samba/ldb/acl.so @@ -2157,7 +2156,9 @@ fi ### DC-LIBS %files dc-libs +%{_libdir}/samba/libauth4-samba4.so %{_libdir}/samba/libdb-glue-samba4.so +%{_libdir}/samba/libpac-samba4.so %{_libdir}/samba/libprocess-model-samba4.so %{_libdir}/samba/libservice-samba4.so @@ -2376,7 +2377,6 @@ fi %{_libdir}/libdcerpc-samr.so.* %{_libdir}/samba/libLIBWBCLIENT-OLD-samba4.so -%{_libdir}/samba/libauth4-samba4.so %{_libdir}/samba/libauth-unix-token-samba4.so %{_libdir}/samba/libdcerpc-samba4.so %{_libdir}/samba/libdnsserver-common-samba4.so From f56b60cdb648c38c6d17ee0066d9aaec9b5eef37 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Wed, 14 Dec 2022 14:26:12 +0100 Subject: [PATCH 22/51] Create a new 'samba-dcerpc' sub-package for DCERPC services --- samba.spec | 46 +++++++++++++++++++++++++++++++++++----------- 1 file changed, 35 insertions(+), 11 deletions(-) diff --git a/samba.spec b/samba.spec index b9bae84..d7e0e8e 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.4 -%global baserelease 0 +%global baserelease 1 # This should be rc1 or %%nil %global pre_release %nil @@ -239,6 +239,7 @@ Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-common-tools = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} +Requires: %{name}-dcerpc = %{samba_depver} Requires: libnetapi = %{samba_depver} %if %{with libwbclient} Requires(post): libwbclient = %{samba_depver} @@ -537,6 +538,20 @@ Provides: bundled(libreplace) The samba-common-tools package contains tools for Samba servers and SMB/CIFS clients. +### RPC +%package dcerpc +Summary: DCE RPC binaries +Requires: samba-common-libs = %{samba_depver} +Requires: samba-client-libs = %{samba_depver} +Requires: samba-libs = %{samba_depver} +Requires: libnetapi = %{samba_depver} +%if %{with libwbclient} +Requires: libwbclient = %{samba_depver} +%endif + +%description dcerpc +The samba-dcerpc package contains binaries that serve DCERPC over named pipes. + ### DC %if %{with dc} || %{with testsuite} %package dc @@ -967,6 +982,7 @@ Requires: %{name}-winbind-modules = %{samba_depver} Requires(post): libwbclient = %{samba_depver} Requires: libwbclient = %{samba_depver} %endif +Requires: %{name}-dcerpc = %{samba_depver} Provides: samba4-winbind = %{samba_depver} Obsoletes: samba4-winbind < %{samba_depver} @@ -1750,15 +1766,6 @@ fi %dir %{_libexecdir}/samba %{_libexecdir}/samba/samba-bgqd -%{_libexecdir}/samba/samba-dcerpcd -%{_libexecdir}/samba/rpcd_classic -%{_libexecdir}/samba/rpcd_epmapper -%{_libexecdir}/samba/rpcd_fsrvp -%{_libexecdir}/samba/rpcd_lsad -%{_libexecdir}/samba/rpcd_mdssvc -%{_libexecdir}/samba/rpcd_rpcecho -%{_libexecdir}/samba/rpcd_spoolss -%{_libexecdir}/samba/rpcd_winreg %dir %{_datadir}/samba %dir %{_datadir}/samba/mdssvc @@ -1772,7 +1779,6 @@ fi %{_mandir}/man1/smbstatus.1* %{_mandir}/man8/eventlogadm.8* %{_mandir}/man8/samba-bgqd.8* -%{_mandir}/man8/samba-dcerpcd.8* %{_mandir}/man8/smbd.8* %{_mandir}/man8/nmbd.8* %{_mandir}/man8/vfs_acl_tdb.8* @@ -2079,6 +2085,20 @@ fi %{_mandir}/man8/samba-tool.8* %{_mandir}/man8/smbpasswd.8* +### RPC +%files dcerpc +%dir %{_libexecdir}/samba +%{_libexecdir}/samba/samba-dcerpcd +%{_libexecdir}/samba/rpcd_classic +%{_libexecdir}/samba/rpcd_epmapper +%{_libexecdir}/samba/rpcd_fsrvp +%{_libexecdir}/samba/rpcd_lsad +%{_libexecdir}/samba/rpcd_mdssvc +%{_libexecdir}/samba/rpcd_rpcecho +%{_libexecdir}/samba/rpcd_spoolss +%{_libexecdir}/samba/rpcd_winreg +%{_mandir}/man8/samba-dcerpcd.8* + ### DC %if %{with dc} || %{with testsuite} %files dc @@ -4315,6 +4335,10 @@ fi %endif %changelog +* Mon Dec 19 2022 Pavel Filipenský - 4.17.4-1 +- Create a samba-dcerpc sub-package +- Fix package installation without samba and samba-dc package + * Fri Dec 16 2022 Guenther Deschner - 4.17.4-0 - resolves: #2153906 - Update to version 4.17.4 - resolves: #2154362, #2154363 - Security fixes for CVE-2022-38023 From 8fdf7b3aef238948bf650b619e1b495c8e55295b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 20 Dec 2022 11:01:45 +0100 Subject: [PATCH 23/51] Fix '--without dc' build: delete libauth4-samba4.so --- samba.spec | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/samba.spec b/samba.spec index d7e0e8e..6e4f87f 100644 --- a/samba.spec +++ b/samba.spec @@ -1400,6 +1400,7 @@ touch %{buildroot}%{_libdir}/krb5/plugins/libkrb5/winbind_krb5_locator.so %if %{without dc} && %{without testsuite} for i in \ + %{_libdir}/samba/libauth4-samba4.so \ %{_libdir}/samba/libdfs-server-ad-samba4.so \ %{_libdir}/samba/libdsdb-garbage-collect-tombstones-samba4.so \ %{_libdir}/samba/libscavenge-dns-records-samba4.so \ @@ -4335,6 +4336,9 @@ fi %endif %changelog +* Tue Dec 20 2022 Pavel Filipenský - 4.17.4-1 +- Fix '--without dc' build: delete libauth4-samba4.so + * Mon Dec 19 2022 Pavel Filipenský - 4.17.4-1 - Create a samba-dcerpc sub-package - Fix package installation without samba and samba-dc package From 5abeded56463236c11817c3d80419bbc075928cc Mon Sep 17 00:00:00 2001 From: Florian Weimer Date: Mon, 21 Nov 2022 15:28:44 +0100 Subject: [PATCH 24/51] Memoize python3_sitearch for faster RPM spec file processing This greatly speeds up the creation of source RPMs, among other things. --- samba.spec | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/samba.spec b/samba.spec index 6e4f87f..25333b7 100644 --- a/samba.spec +++ b/samba.spec @@ -193,6 +193,10 @@ %global _systemd_extra "Environment=KRB5CCNAME=FILE:/run/samba/krb5cc_samba" +# Make a copy of this variable to prevent repeated evaluation of the +# embedded shell command. +%global python3_sitearch %{python3_sitearch} + Name: samba Version: %{samba_version} Release: %{samba_release}%{?dist} From bad52617473fede6d127dca5d0571b0515e014e6 Mon Sep 17 00:00:00 2001 From: Florian Weimer Date: Mon, 21 Nov 2022 15:44:40 +0100 Subject: [PATCH 25/51] Avoid recursive python3_sitearch expansion even if undefined Fixes an error during SRPM construction if not enough dependencies are installed (e.g., during the first build stage in mock): error: /builddir/build/SPECS/samba.spec: line 2478: Too many levels of recursion in macro expansion. It is likely caused by recursive macro declaration. --- samba.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index 25333b7..b16e466 100644 --- a/samba.spec +++ b/samba.spec @@ -194,8 +194,8 @@ %global _systemd_extra "Environment=KRB5CCNAME=FILE:/run/samba/krb5cc_samba" # Make a copy of this variable to prevent repeated evaluation of the -# embedded shell command. -%global python3_sitearch %{python3_sitearch} +# embedded shell command. Avoid recursive macro definition if undefined. +%{?python3_sitearch: %global python3_sitearch %{python3_sitearch}} Name: samba Version: %{samba_version} From f7094aca2eea955feb3a189439b8d532fa651a61 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Wed, 2 Nov 2022 15:56:16 +0100 Subject: [PATCH 26/51] Always add epoch to samba_depver to fix osci.brew-build.rpmdeplint.functional --- samba.spec | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/samba.spec b/samba.spec index b16e466..4861914 100644 --- a/samba.spec +++ b/samba.spec @@ -201,17 +201,13 @@ Name: samba Version: %{samba_version} Release: %{samba_release}%{?dist} -%if 0%{?rhel} -Epoch: 0 -%else +%if 0%{?fedora} Epoch: 2 +%else +Epoch: 0 %endif -%if 0%{?epoch} > 0 %global samba_depver %{epoch}:%{version}-%{release} -%else -%global samba_depver %{version}-%{release} -%endif Summary: Server and Client software to interoperate with Windows machines License: GPLv3+ and LGPLv3+ @@ -4340,6 +4336,9 @@ fi %endif %changelog +* Thu Dec 22 2022 Pavel Filipenský - 4.17.4-2 +- Always add epoch to samba_depver to fix osci.brew-build.rpmdeplint.functional + * Tue Dec 20 2022 Pavel Filipenský - 4.17.4-1 - Fix '--without dc' build: delete libauth4-samba4.so From f57b4c25bd67d47bbbd918fc9a4321adb8264ee6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Thu, 22 Dec 2022 15:06:03 +0100 Subject: [PATCH 27/51] Create package dc-libs also for 'non-dc' build --- samba.spec | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/samba.spec b/samba.spec index 4861914..7bb79cf 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.4 -%global baserelease 1 +%global baserelease 2 # This should be rc1 or %%nil %global pre_release %nil @@ -597,6 +597,9 @@ BuildArch: noarch %description dc-provision The samba-dc-provision package provides files to setup a domain controller +#endif with dc || with testsuite +%endif + ### DC-LIBS %package dc-libs Summary: Samba AD Domain Controller Libraries @@ -613,6 +616,7 @@ Provides: bundled(libreplace) The %{name}-dc-libs package contains the libraries needed by the DC to link against the SMB, RPC and other protocols. +%if %{with dc} || %{with testsuite} ### DC-BIND %package dc-bind-dlz Summary: Bind DLZ module for Samba AD @@ -835,9 +839,7 @@ Summary: Samba Python3 libraries Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} -%if %{with dc} Requires: %{name}-dc-libs = %{samba_depver} -%endif Requires: python3-talloc Requires: python3-tevent Requires: python3-tdb @@ -1400,7 +1402,6 @@ touch %{buildroot}%{_libdir}/krb5/plugins/libkrb5/winbind_krb5_locator.so %if %{without dc} && %{without testsuite} for i in \ - %{_libdir}/samba/libauth4-samba4.so \ %{_libdir}/samba/libdfs-server-ad-samba4.so \ %{_libdir}/samba/libdsdb-garbage-collect-tombstones-samba4.so \ %{_libdir}/samba/libscavenge-dns-records-samba4.so \ @@ -2175,9 +2176,13 @@ fi %license source4/setup/ad-schema/licence.txt %{_datadir}/samba/setup +#endif with dc || with testsuite +%endif ### DC-LIBS %files dc-libs %{_libdir}/samba/libauth4-samba4.so + +%if %{with dc} || %{with testsuite} %{_libdir}/samba/libdb-glue-samba4.so %{_libdir}/samba/libpac-samba4.so %{_libdir}/samba/libprocess-model-samba4.so @@ -4338,6 +4343,7 @@ fi %changelog * Thu Dec 22 2022 Pavel Filipenský - 4.17.4-2 - Always add epoch to samba_depver to fix osci.brew-build.rpmdeplint.functional +- Create package dc-libs also for 'non-dc build' * Tue Dec 20 2022 Pavel Filipenský - 4.17.4-1 - Fix '--without dc' build: delete libauth4-samba4.so From 60713c3d38d2d6c2fd30c73472be174a664cce96 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 23 Jan 2023 07:24:09 +0100 Subject: [PATCH 28/51] Use mold linker on Fedora >= 37 This makes compilation of Samba a lot faster. --- samba.spec | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 7bb79cf..7ab5ada 100644 --- a/samba.spec +++ b/samba.spec @@ -324,6 +324,10 @@ BuildRequires: zlib-devel >= 1.2.3 BuildRequires: pkgconfig(libsystemd) +%if 0%{?fedora} >= 37 +BuildRequires: mold +%endif + %if %{with vfs_glusterfs} BuildRequires: glusterfs-api-devel >= 3.4.0.16 BuildRequires: glusterfs-devel >= 3.4.0.16 @@ -1243,9 +1247,13 @@ rm -f lib/crypto/{aes,rijndael}*.c # TODO: resolve underlinked python modules export python_LDFLAGS="$(echo %{__global_ldflags} | sed -e 's/-Wl,-z,defs//g')" -# Use the gold linker -# See https://bugzilla.redhat.com/show_bug.cgi?id=2043178 ; For f36 do not use ld.gold till it is fixed -#export LDFLAGS="%%{__global_ldflags} -fuse-ld=gold" +# Use the mold linker +%if 0%{?fedora} >= 37 +export LDFLAGS="%{__global_ldflags} -fuse-ld=mold" +export python_LDFLAGS="$(echo ${LDFLAGS} | sed -e 's/-Wl,-z,defs//g')" +%else +export python_LDFLAGS="$(echo %{__global_ldflags} | sed -e 's/-Wl,-z,defs//g')" +%endif %configure \ --enable-fhs \ From 2f030add8d173cf23a72c47a1c8f7e8c87c44f9d Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 23 Jan 2023 15:12:38 +0100 Subject: [PATCH 29/51] Use python3-dateutil instead of python3-iso8601 We don't have iso8601 in third_party/ anymore. --- samba.spec | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-) diff --git a/samba.spec b/samba.spec index 7ab5ada..7d4e43c 100644 --- a/samba.spec +++ b/samba.spec @@ -352,9 +352,6 @@ BuildRequires: python3-etcd %endif %if %{with dc} || %{with testsuite} -# Add python3-iso8601 to avoid that the -# version in Samba is being packaged -BuildRequires: python3-iso8601 BuildRequires: python3-pyasn1 >= 0.4.8 BuildRequires: bind @@ -392,6 +389,11 @@ BuildRequires: lmdb-devel %if %{with dc} || %{with testsuite} BuildRequires: bind BuildRequires: krb5-server >= %{required_mit_krb5} +%if 0%{?fedora} || 0%{rhel} >= 9 +BuildRequires: python3-dateutil +%else +BuildRequires: python3-iso8601 +%endif BuildRequires: python3-gpg BuildRequires: python3-markdown BuildRequires: python3-setproctitle @@ -1457,12 +1459,6 @@ for i in \ %{python3_sitearch}/samba/remove_dc.py \ %{python3_sitearch}/samba/samdb.py \ %{python3_sitearch}/samba/schema.py \ - %{python3_sitearch}/samba/third_party/iso8601/__init__.py \ - %{python3_sitearch}/samba/third_party/iso8601/__pycache__/__init__.*.pyc \ - %{python3_sitearch}/samba/third_party/iso8601/__pycache__/iso8601.*.pyc \ - %{python3_sitearch}/samba/third_party/iso8601/__pycache__/test_iso8601.*.pyc \ - %{python3_sitearch}/samba/third_party/iso8601/iso8601.py \ - %{python3_sitearch}/samba/third_party/iso8601/test_iso8601.py \ %{python3_sitearch}/samba/uptodateness.py \ %{_sbindir}/samba-gpupdate \ ; do From a7b63dff56124a06c3f5942c291658e8815c1dc8 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 23 Jan 2023 15:13:10 +0100 Subject: [PATCH 30/51] Remove duplicate code --- samba.spec | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/samba.spec b/samba.spec index 7d4e43c..d775d94 100644 --- a/samba.spec +++ b/samba.spec @@ -351,14 +351,6 @@ BuildRequires: librados-devel BuildRequires: python3-etcd %endif -%if %{with dc} || %{with testsuite} -BuildRequires: python3-pyasn1 >= 0.4.8 - -BuildRequires: bind -BuildRequires: krb5-server >= %{required_mit_krb5} -#endif with dc -%endif - # pidl requirements BuildRequires: perl(ExtUtils::MakeMaker) BuildRequires: perl(FindBin) @@ -396,6 +388,7 @@ BuildRequires: python3-iso8601 %endif BuildRequires: python3-gpg BuildRequires: python3-markdown +BuildRequires: python3-pyasn1 >= 0.4.8 BuildRequires: python3-setproctitle BuildRequires: python3-cryptography From 0bcbb3c8e57b47933612cfe5be31ebd5a53e900e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 23 Jan 2023 15:13:36 +0100 Subject: [PATCH 31/51] Add missing python requirements for python3-samba --- samba.spec | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/samba.spec b/samba.spec index d775d94..61fb69a 100644 --- a/samba.spec +++ b/samba.spec @@ -306,8 +306,10 @@ BuildRequires: perl-generators BuildRequires: perl(Archive::Tar) BuildRequires: perl(Test::More) BuildRequires: popt-devel +BuildRequires: python3-cryptography BuildRequires: python3-devel BuildRequires: python3-dns +BuildRequires: python3-requests BuildRequires: python3-setuptools BuildRequires: quota-devel BuildRequires: readline-devel @@ -390,7 +392,6 @@ BuildRequires: python3-gpg BuildRequires: python3-markdown BuildRequires: python3-pyasn1 >= 0.4.8 BuildRequires: python3-setproctitle -BuildRequires: python3-cryptography %if %{without includelibs} BuildRequires: tdb-tools @@ -839,11 +840,13 @@ Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-dc-libs = %{samba_depver} -Requires: python3-talloc -Requires: python3-tevent -Requires: python3-tdb -Requires: python3-ldb +Requires: python3-cryptography Requires: python3-dns +Requires: python3-ldb +Requires: python3-requests +Requires: python3-talloc +Requires: python3-tdb +Requires: python3-tevent %if %{with libsmbclient} Requires: libsmbclient = %{samba_depver} %endif From 54b4a4bb2b956c4c15dd816dd609ff1900f0fef9 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 24 Jan 2023 08:59:00 +0100 Subject: [PATCH 32/51] Fix typo --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 61fb69a..95919fe 100644 --- a/samba.spec +++ b/samba.spec @@ -383,7 +383,7 @@ BuildRequires: lmdb-devel %if %{with dc} || %{with testsuite} BuildRequires: bind BuildRequires: krb5-server >= %{required_mit_krb5} -%if 0%{?fedora} || 0%{rhel} >= 9 +%if 0%{?fedora} || 0%{?rhel} >= 9 BuildRequires: python3-dateutil %else BuildRequires: python3-iso8601 From 0ea99a3fc7d338dea19698a0334692603c9322ba Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 26 Jan 2023 23:38:27 +0100 Subject: [PATCH 33/51] Update to version 4.17.5 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index fe25028..76a1b43 100644 --- a/.gitignore +++ b/.gitignore @@ -317,3 +317,5 @@ samba-3.6.0pre1.tar.gz /samba-4.17.3.tar.asc /samba-4.17.4.tar.xz /samba-4.17.4.tar.asc +/samba-4.17.5.tar.xz +/samba-4.17.5.tar.asc diff --git a/samba.spec b/samba.spec index 95919fe..842dc75 100644 --- a/samba.spec +++ b/samba.spec @@ -134,8 +134,8 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.17.4 -%global baserelease 2 +%global samba_version 4.17.5 +%global baserelease 0 # This should be rc1 or %%nil %global pre_release %nil @@ -4341,6 +4341,9 @@ fi %endif %changelog +* Thu Jan 26 2023 Guenther Deschner - 4.17.5-0 +- Update to version 4.17.5 + * Thu Dec 22 2022 Pavel Filipenský - 4.17.4-2 - Always add epoch to samba_depver to fix osci.brew-build.rpmdeplint.functional - Create package dc-libs also for 'non-dc build' diff --git a/sources b/sources index 523fbd2..a03be23 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.17.4.tar.xz) = ffbde223ae324b6c0c779df75c926b09b77289f0ea4a6b6668d1bd758b621b3ed8ccdc4d101e6b153d1359c185b46d4baef5a7854dbc3864debbfa4696fa6bc8 -SHA512 (samba-4.17.4.tar.asc) = f69613c148453c57e83ba2bae45a316c19f80f9cceeab81a099d896e2dc578536175aa2278f85cf9e4899c8310a4eafeb1bfe365da16dd63195ffd099d6b6a6c +SHA512 (samba-4.17.5.tar.xz) = 74245bdbd5c575d54a6278fca7eacaf9807030024288286f560a0c03c3fbb16f72c2c2b7a58241d5880388fbf1917e8240f94ee53d781bc827b9d4271916172a +SHA512 (samba-4.17.5.tar.asc) = fbc95da49245d38db431b960cfd0c3fd84dba499e4f3648e1aec613999909243688f33d259126cb7a16f507dd490e8c7e53d5e32c3b92d83a335dc14f65e53a9 From 306ca4dd301b19861de91629e7feabe0fa411cc5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 31 Jan 2023 21:59:37 +0100 Subject: [PATCH 34/51] rpminspect: Avoid "Missing: .debug_info" libdcerpc-samr is a grouping library without .debug_info. See source4/librpc/wscript_build. There is an empty source list for bld.SAMBA_LIBRARY('dcerpc-samr' --- rpminspect.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/rpminspect.yaml b/rpminspect.yaml index 9c56e6c..4c2edfa 100644 --- a/rpminspect.yaml +++ b/rpminspect.yaml @@ -18,3 +18,7 @@ runpath: abidiff: suppression_file: samba.abignore + +debuginfo: + ignore: + - /usr/lib*/libdcerpc-samr.so.* From 63931382e3f47c8fbf345482af998cc8b7f08343 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Fri, 10 Feb 2023 20:55:16 +0100 Subject: [PATCH 35/51] Create package samba-tools, move there samba-tool binary resolves: rhbz#2166124 --- samba.spec | 86 +++++++++++++++++------------------------------------- 1 file changed, 27 insertions(+), 59 deletions(-) diff --git a/samba.spec b/samba.spec index 842dc75..d1a55e2 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.5 -%global baserelease 0 +%global baserelease 1 # This should be rc1 or %%nil %global pre_release %nil @@ -511,7 +511,7 @@ SMB/CIFS clients. ### COMMON-TOOLS %package common-tools -Summary: Tools for Samba servers and clients +Summary: Tools for Samba clients Requires: samba-common-libs = %{samba_depver} Requires: samba-client-libs = %{samba_depver} Requires: samba-libs = %{samba_depver} @@ -521,22 +521,28 @@ Requires: libnetapi = %{samba_depver} Requires: libwbclient = %{samba_depver} %endif +Provides: bundled(libreplace) + +%description common-tools +The samba-common-tools package contains tools for SMB/CIFS clients. + +### SAMBA-TOOLS +%package tools +Summary: Tools for Samba servers # samba-tool needs python3-samba Requires: python3-%{name} = %{samba_depver} # samba-tool needs tdbbackup Requires: tdb-tools -%if %{with dc} -# samba-tool needs python3-samba-dc on a full build +# samba-tool needs python3-samba-dc also on non-dc build Requires: python3-%{name}-dc = %{samba_depver} +%if %{with dc} # samba-tool needs mdb_copy for domain backup or upgrade provision Requires: lmdb %endif -Provides: bundled(libreplace) - -%description common-tools -The samba-common-tools package contains tools for Samba servers and -SMB/CIFS clients. +%description tools +The samba-tools package contains tools for Samba servers +and for GPO management on domain members. ### RPC %package dcerpc @@ -877,7 +883,6 @@ Requires: %{name}-libs = %{samba_depver} The python3-%{name}-test package contains the Python libraries used by the test suite of Samba. If you want to run full set of Samba tests, you need to install this package. -%if %{with dc} || %{with testsuite} %package -n python3-samba-dc Summary: Samba Python libraries for Samba AD Requires: %{name}-client-libs = %{samba_depver} @@ -887,7 +892,6 @@ Requires: python3-%{name} = %{samba_depver} %description -n python3-samba-dc The python3-%{name}-dc package contains the Python libraries needed by programs to manage Samba AD. -%endif ### PIDL %package pidl @@ -981,6 +985,7 @@ Requires(post): %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires(post): %{name}-libs = %{samba_depver} Requires: %{name}-winbind-modules = %{samba_depver} +Recommends: %{name}-tools = %{samba_depver} %if %{with libwbclient} Requires(post): libwbclient = %{samba_depver} @@ -1408,54 +1413,10 @@ touch %{buildroot}%{_libdir}/krb5/plugins/libkrb5/winbind_krb5_locator.so %if %{without dc} && %{without testsuite} for i in \ - %{_libdir}/samba/libdfs-server-ad-samba4.so \ - %{_libdir}/samba/libdsdb-garbage-collect-tombstones-samba4.so \ - %{_libdir}/samba/libscavenge-dns-records-samba4.so \ %{_mandir}/man8/samba.8 \ %{_mandir}/man8/samba_downgrade_db.8 \ %{_mandir}/man8/samba-gpupdate.8 \ %{_unitdir}/samba.service \ - %{python3_sitearch}/samba/dcerpc/dnsserver.*.so \ - %{python3_sitearch}/samba/dnsserver.py \ - %{python3_sitearch}/samba/domain_update.py \ - %{python3_sitearch}/samba/forest_update.py \ - %{python3_sitearch}/samba/kcc/__init__.py \ - %{python3_sitearch}/samba/kcc/debug.py \ - %{python3_sitearch}/samba/kcc/graph.py \ - %{python3_sitearch}/samba/kcc/graph_utils.py \ - %{python3_sitearch}/samba/kcc/kcc_utils.py \ - %{python3_sitearch}/samba/kcc/ldif_import_export.py \ - %{python3_sitearch}/samba/kcc/__pycache__/__init__.*.pyc \ - %{python3_sitearch}/samba/kcc/__pycache__/debug.*.pyc \ - %{python3_sitearch}/samba/kcc/__pycache__/graph.*.pyc \ - %{python3_sitearch}/samba/kcc/__pycache__/graph_utils.*.pyc \ - %{python3_sitearch}/samba/kcc/__pycache__/kcc_utils.*.pyc \ - %{python3_sitearch}/samba/kcc/__pycache__/ldif_import_export.*.pyc \ - %{python3_sitearch}/samba/ms_forest_updates_markdown.py \ - %{python3_sitearch}/samba/ms_schema_markdown.py \ - %{python3_sitearch}/samba/provision/__init__.py \ - %{python3_sitearch}/samba/provision/backend.py \ - %{python3_sitearch}/samba/provision/common.py \ - %{python3_sitearch}/samba/provision/kerberos_implementation.py \ - %{python3_sitearch}/samba/provision/kerberos.py \ - %{python3_sitearch}/samba/provision/sambadns.py \ - %{python3_sitearch}/samba/provision/__pycache__/__init__.*.pyc \ - %{python3_sitearch}/samba/provision/__pycache__/backend.*.pyc \ - %{python3_sitearch}/samba/provision/__pycache__/common.*.pyc \ - %{python3_sitearch}/samba/provision/__pycache__/kerberos_implementation.*.pyc \ - %{python3_sitearch}/samba/provision/__pycache__/kerberos.*.pyc \ - %{python3_sitearch}/samba/provision/__pycache__/sambadns.*.pyc \ - %{python3_sitearch}/samba/__pycache__/domain_update.*.pyc \ - %{python3_sitearch}/samba/__pycache__/forest_update.*.pyc \ - %{python3_sitearch}/samba/__pycache__/ms_forest_updates_markdown.*.pyc \ - %{python3_sitearch}/samba/__pycache__/ms_schema_markdown.*.pyc \ - %{python3_sitearch}/samba/__pycache__/remove_dc.*.pyc \ - %{python3_sitearch}/samba/__pycache__/schema.*.pyc \ - %{python3_sitearch}/samba/__pycache__/uptodateness.*.pyc \ - %{python3_sitearch}/samba/remove_dc.py \ - %{python3_sitearch}/samba/samdb.py \ - %{python3_sitearch}/samba/schema.py \ - %{python3_sitearch}/samba/uptodateness.py \ %{_sbindir}/samba-gpupdate \ ; do rm -f %{buildroot}$i @@ -2071,11 +2032,11 @@ fi %{_libdir}/samba/pdb/smbpasswd.so %{_libdir}/samba/pdb/tdbsam.so +### COMMON-TOOLS %files common-tools %{_bindir}/net %{_bindir}/pdbedit %{_bindir}/profiles -%{_bindir}/samba-tool %{_bindir}/smbcontrol %{_bindir}/smbpasswd %{_bindir}/testparm @@ -2084,9 +2045,13 @@ fi %{_mandir}/man1/testparm.1* %{_mandir}/man8/net.8* %{_mandir}/man8/pdbedit.8* -%{_mandir}/man8/samba-tool.8* %{_mandir}/man8/smbpasswd.8* +### TOOLS +%files tools +%{_bindir}/samba-tool +%{_mandir}/man8/samba-tool.8* + ### RPC %files dcerpc %dir %{_libexecdir}/samba @@ -2796,7 +2761,6 @@ fi %{_libdir}/libsamba-policy.*.so %{_libdir}/pkgconfig/samba-policy.*.pc -%if %{with dc} || %{with testsuite} %files -n python3-%{name}-dc %{python3_sitearch}/samba/samdb.py %{python3_sitearch}/samba/schema.py @@ -2812,7 +2776,9 @@ fi %{python3_sitearch}/samba/__pycache__/uptodateness.*.pyc %{python3_sitearch}/samba/dcerpc/dnsserver.*.so +%if %{with dc} || %{with testsuite} %{python3_sitearch}/samba/dckeytab.*.so +%endif %{python3_sitearch}/samba/domain_update.py %{python3_sitearch}/samba/forest_update.py %{python3_sitearch}/samba/ms_forest_updates_markdown.py @@ -2853,7 +2819,6 @@ fi %{python3_sitearch}/samba/remove_dc.py %{python3_sitearch}/samba/uptodateness.py -%endif %files -n python3-%{name}-test %dir %{python3_sitearch}/samba/tests @@ -4341,6 +4306,9 @@ fi %endif %changelog +* Tue Feb 14 2023 Pavel Filipenský - 4.17.5-1 +- resolves: rhbz#2166124 - Create package samba-tools, move there samba-tool binary + * Thu Jan 26 2023 Guenther Deschner - 4.17.5-0 - Update to version 4.17.5 From 823f4aaeb64e9e0c919d376eab562524a63c77af Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 16 Feb 2023 09:11:52 +0100 Subject: [PATCH 36/51] Fix samba-tool dependencies --- samba.spec | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index d1a55e2..6baea24 100644 --- a/samba.spec +++ b/samba.spec @@ -531,13 +531,12 @@ The samba-common-tools package contains tools for SMB/CIFS clients. Summary: Tools for Samba servers # samba-tool needs python3-samba Requires: python3-%{name} = %{samba_depver} -# samba-tool needs tdbbackup -Requires: tdb-tools # samba-tool needs python3-samba-dc also on non-dc build Requires: python3-%{name}-dc = %{samba_depver} %if %{with dc} -# samba-tool needs mdb_copy for domain backup or upgrade provision +# samba-tool needs mdb_copy and tdbackup for domain backup or upgrade provision Requires: lmdb +Requires: tdb-tools %endif %description tools From 3f44a1d65c879ad83f7fd0d59e612d542731fa80 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 16 Feb 2023 09:13:28 +0100 Subject: [PATCH 37/51] Add missing Requires for samba-tool on samba-dc --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index 6baea24..80ce0bb 100644 --- a/samba.spec +++ b/samba.spec @@ -565,6 +565,7 @@ Requires: %{name} = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-common-tools = %{samba_depver} +Requires: %{name}-tools = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-dc-provision = %{samba_depver} Requires: %{name}-dc-libs = %{samba_depver} From 09b9bd7d7248af29e840a68eb2501cf17b3e04d0 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 23 Feb 2023 15:15:37 +0100 Subject: [PATCH 38/51] Update License to SPDX expressions https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_1 --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 80ce0bb..55e5bfc 100644 --- a/samba.spec +++ b/samba.spec @@ -210,7 +210,7 @@ Epoch: 0 %global samba_depver %{epoch}:%{version}-%{release} Summary: Server and Client software to interoperate with Windows machines -License: GPLv3+ and LGPLv3+ +License: GPL-3.0-or-later AND LGPL-3.0-or-later URL: https://www.samba.org # This is a xz recompressed file of https://ftp.samba.org/pub/samba/samba-%%{version}%%{pre_release}.tar.gz From 299323d641aefa5d181e7220787b93812d5abc51 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Thu, 23 Feb 2023 15:18:11 +0100 Subject: [PATCH 39/51] SPDX migration --- samba.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index 55e5bfc..14d140a 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.5 -%global baserelease 1 +%global baserelease 2 # This should be rc1 or %%nil %global pre_release %nil @@ -1076,7 +1076,7 @@ necessary to communicate to the Winbind Daemon %if %{with winexe} %package winexe Summary: Samba Winexe Windows Binary -License: GPLv3 +License: GPL-3.0-only Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} @@ -4306,6 +4306,9 @@ fi %endif %changelog +* Thu Feb 23 2023 Pavel Filipenský - 4.17.5-2 +- SPDX migration + * Tue Feb 14 2023 Pavel Filipenský - 4.17.5-1 - resolves: rhbz#2166124 - Create package samba-tools, move there samba-tool binary From 438d84812eb9433859ac1fb076ef2c8be65b9ac2 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 28 Feb 2023 07:55:19 +0100 Subject: [PATCH 40/51] Add missing Requires for glibc-gconv-extra resolves: #2173619 --- samba.spec | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/samba.spec b/samba.spec index 14d140a..fbafb38 100644 --- a/samba.spec +++ b/samba.spec @@ -270,6 +270,7 @@ Provides: bundled(libreplace) BuildRequires: make BuildRequires: gcc +BuildRequires: glibc-gconv-extra BuildRequires: avahi-devel BuildRequires: bison BuildRequires: cups-devel @@ -448,6 +449,8 @@ Requires: %{name}-common-libs = %{samba_depver} Requires: libwbclient = %{samba_depver} %endif Requires: krb5-libs >= %{required_mit_krb5} +# This is needed for charset conversion +Requires: glibc-gconv-extra %description client-libs The samba-client-libs package contains internal libraries needed by the @@ -4307,6 +4310,7 @@ fi %changelog * Thu Feb 23 2023 Pavel Filipenský - 4.17.5-2 +- resolves: #2173619 - Add missing Requires for glibc-gconv-extra - SPDX migration * Tue Feb 14 2023 Pavel Filipenský - 4.17.5-1 From 39f565286354d4bc4e5f1e790d7c5cce82fc2afd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 9 Mar 2023 19:37:30 +0100 Subject: [PATCH 41/51] Update to version 4.17.6 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 76a1b43..584524b 100644 --- a/.gitignore +++ b/.gitignore @@ -319,3 +319,5 @@ samba-3.6.0pre1.tar.gz /samba-4.17.4.tar.asc /samba-4.17.5.tar.xz /samba-4.17.5.tar.asc +/samba-4.17.6.tar.xz +/samba-4.17.6.tar.asc diff --git a/samba.spec b/samba.spec index fbafb38..176d7fa 100644 --- a/samba.spec +++ b/samba.spec @@ -134,8 +134,8 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.17.5 -%global baserelease 2 +%global samba_version 4.17.6 +%global baserelease 0 # This should be rc1 or %%nil %global pre_release %nil @@ -4309,6 +4309,9 @@ fi %endif %changelog +* Thu Mar 09 2023 Guenther Deschner - 4.17.6-0 +- Update to version 4.17.6 + * Thu Feb 23 2023 Pavel Filipenský - 4.17.5-2 - resolves: #2173619 - Add missing Requires for glibc-gconv-extra - SPDX migration diff --git a/sources b/sources index a03be23..0c160b9 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.17.5.tar.xz) = 74245bdbd5c575d54a6278fca7eacaf9807030024288286f560a0c03c3fbb16f72c2c2b7a58241d5880388fbf1917e8240f94ee53d781bc827b9d4271916172a -SHA512 (samba-4.17.5.tar.asc) = fbc95da49245d38db431b960cfd0c3fd84dba499e4f3648e1aec613999909243688f33d259126cb7a16f507dd490e8c7e53d5e32c3b92d83a335dc14f65e53a9 +SHA512 (samba-4.17.6.tar.xz) = 5c9341fc27ed9912de8da190f6b3464a46e4ad95b1edc8e1a4556d5da5fd17005873b22a26da9890b1537bf61d70c5e2de0d8243c361c71518959d99bb0790aa +SHA512 (samba-4.17.6.tar.asc) = f666ebef32865e4d347ea78c2274742c07222f6539a2a8ec5db5c509b115490c2456243beab27c9c9054ad21a2375f15969787f01c2c269db19da3f5316ac166 From 42e489e3b570732c55294c53d6c4619fcd297159 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 10 Mar 2023 10:32:14 +0100 Subject: [PATCH 42/51] Add missing Requires for python3-gpg to samba-tools --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index 176d7fa..95cca77 100644 --- a/samba.spec +++ b/samba.spec @@ -540,6 +540,7 @@ Requires: python3-%{name}-dc = %{samba_depver} # samba-tool needs mdb_copy and tdbackup for domain backup or upgrade provision Requires: lmdb Requires: tdb-tools +Requires: python3-gpg %endif %description tools From 099eb865eee17c0f7c5ea395e3dd46ab2732089a Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 28 Mar 2023 09:01:24 +0200 Subject: [PATCH 43/51] Add missing Requires for bind-utils samba_dnsupdate uses nsupdate from bind-utils --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index 95cca77..1f4d2ff 100644 --- a/samba.spec +++ b/samba.spec @@ -590,6 +590,7 @@ Requires: python3-setproctitle Requires: python3-%{name} = %{samba_depver} Requires: python3-%{name}-dc = %{samba_depver} Requires: krb5-server >= %{required_mit_krb5} +Requires: bind-utils Provides: samba4-dc = %{samba_depver} Obsoletes: samba4-dc < %{samba_depver} From ddba08d9132e4bce0cd9e35fbdf8b745a2456984 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 29 Mar 2023 16:04:57 +0200 Subject: [PATCH 44/51] Update to version 4.17.7 resolves: #2182772, #2182773 - Security fixes for CVE-2023-0225 resolves: #2182774, #2182775 - Security fixes for CVE-2023-0922 resolves: #2182776, #2182777 - Security fixes for CVE-2023-0614 Guenther --- .gitignore | 2 ++ samba.spec | 10 ++++++++-- sources | 4 ++-- 3 files changed, 12 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 584524b..e4dec1a 100644 --- a/.gitignore +++ b/.gitignore @@ -321,3 +321,5 @@ samba-3.6.0pre1.tar.gz /samba-4.17.5.tar.asc /samba-4.17.6.tar.xz /samba-4.17.6.tar.asc +/samba-4.17.7.tar.xz +/samba-4.17.7.tar.asc diff --git a/samba.spec b/samba.spec index 1f4d2ff..dec02e3 100644 --- a/samba.spec +++ b/samba.spec @@ -134,7 +134,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.17.6 +%global samba_version 4.17.7 %global baserelease 0 # This should be rc1 or %%nil %global pre_release %nil @@ -171,7 +171,7 @@ %global talloc_version 2.3.4 %global tdb_version 1.4.7 %global tevent_version 0.13.0 -%global ldb_version 2.6.1 +%global ldb_version 2.6.2 %global required_mit_krb5 1.19 @@ -4311,6 +4311,12 @@ fi %endif %changelog +* Wed Mar 29 2023 Guenther Deschner - 4.17.7-0 +- Update to version 4.17.7 +- resolves: #2182772, #2182773 - Security fixes for CVE-2023-0225 +- resolves: #2182774, #2182775 - Security fixes for CVE-2023-0922 +- resolves: #2182776, #2182777 - Security fixes for CVE-2023-0614 + * Thu Mar 09 2023 Guenther Deschner - 4.17.6-0 - Update to version 4.17.6 diff --git a/sources b/sources index 0c160b9..1d863ac 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.17.6.tar.xz) = 5c9341fc27ed9912de8da190f6b3464a46e4ad95b1edc8e1a4556d5da5fd17005873b22a26da9890b1537bf61d70c5e2de0d8243c361c71518959d99bb0790aa -SHA512 (samba-4.17.6.tar.asc) = f666ebef32865e4d347ea78c2274742c07222f6539a2a8ec5db5c509b115490c2456243beab27c9c9054ad21a2375f15969787f01c2c269db19da3f5316ac166 +SHA512 (samba-4.17.7.tar.xz) = d4027eee9df1fc62658f08859359c9c96f438710b03e52dfaa2c3cb6a0f3890db62dec0dd872a3ec081eeaaa896d546def809f697220ef25c958828a036438e0 +SHA512 (samba-4.17.7.tar.asc) = 099710f748f1a755567711f0ad6d96fb2c5dbe050baf4c05614c19a17b1ef327abce9416adf401ee52fae2e47a85ab655f1b0c463aa4524af21c776a42063031 From 253aaa817fab0d5b08e1f8905f7b96f824fdf0df Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 11 May 2023 11:46:10 +0200 Subject: [PATCH 45/51] Update to version 4.17.8 Guenther --- .gitignore | 2 ++ samba.spec | 5 ++++- sources | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index e4dec1a..ad28eb6 100644 --- a/.gitignore +++ b/.gitignore @@ -323,3 +323,5 @@ samba-3.6.0pre1.tar.gz /samba-4.17.6.tar.asc /samba-4.17.7.tar.xz /samba-4.17.7.tar.asc +/samba-4.17.8.tar.xz +/samba-4.17.8.tar.asc diff --git a/samba.spec b/samba.spec index dec02e3..89ba627 100644 --- a/samba.spec +++ b/samba.spec @@ -134,7 +134,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.17.7 +%global samba_version 4.17.8 %global baserelease 0 # This should be rc1 or %%nil %global pre_release %nil @@ -4311,6 +4311,9 @@ fi %endif %changelog +* Thu May 11 2023 Guenther Deschner - 4.17.8-0 +- Update to version 4.17.8 + * Wed Mar 29 2023 Guenther Deschner - 4.17.7-0 - Update to version 4.17.7 - resolves: #2182772, #2182773 - Security fixes for CVE-2023-0225 diff --git a/sources b/sources index 1d863ac..4aab7bf 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.17.7.tar.xz) = d4027eee9df1fc62658f08859359c9c96f438710b03e52dfaa2c3cb6a0f3890db62dec0dd872a3ec081eeaaa896d546def809f697220ef25c958828a036438e0 -SHA512 (samba-4.17.7.tar.asc) = 099710f748f1a755567711f0ad6d96fb2c5dbe050baf4c05614c19a17b1ef327abce9416adf401ee52fae2e47a85ab655f1b0c463aa4524af21c776a42063031 +SHA512 (samba-4.17.8.tar.xz) = a8b10f304f7f7d26adc2f11ad3c90b54b834992f0980f31ba18924dd5df2b474e19c75c46e1a63095e25d76ce6c21c73513c48d96779844eab92eac46ba369be +SHA512 (samba-4.17.8.tar.asc) = dc1df496caedb448d87c4364b07a58b3dfcb7c268e41662f1fa635f773177de8860e425e71fd537f4ec0ebacb76f2f5d4c27cd15af29b8fb265e14e71d4062a6 From 7d4ce35f0f25b3590b276c37231ee5c5df7c13bb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 6 Jul 2023 12:29:38 +0200 Subject: [PATCH 46/51] Update to version 4.17.9 Guenther --- .gitignore | 2 ++ samba.spec | 5 ++++- sources | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index ad28eb6..e44052e 100644 --- a/.gitignore +++ b/.gitignore @@ -325,3 +325,5 @@ samba-3.6.0pre1.tar.gz /samba-4.17.7.tar.asc /samba-4.17.8.tar.xz /samba-4.17.8.tar.asc +/samba-4.17.9.tar.xz +/samba-4.17.9.tar.asc diff --git a/samba.spec b/samba.spec index 89ba627..b025bf3 100644 --- a/samba.spec +++ b/samba.spec @@ -134,7 +134,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.17.8 +%global samba_version 4.17.9 %global baserelease 0 # This should be rc1 or %%nil %global pre_release %nil @@ -4311,6 +4311,9 @@ fi %endif %changelog +* Thu Jul 06 2023 Guenther Deschner - 4.17.9-0 +- Update to version 4.17.9 + * Thu May 11 2023 Guenther Deschner - 4.17.8-0 - Update to version 4.17.8 diff --git a/sources b/sources index 4aab7bf..8f48ea8 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.17.8.tar.xz) = a8b10f304f7f7d26adc2f11ad3c90b54b834992f0980f31ba18924dd5df2b474e19c75c46e1a63095e25d76ce6c21c73513c48d96779844eab92eac46ba369be -SHA512 (samba-4.17.8.tar.asc) = dc1df496caedb448d87c4364b07a58b3dfcb7c268e41662f1fa635f773177de8860e425e71fd537f4ec0ebacb76f2f5d4c27cd15af29b8fb265e14e71d4062a6 +SHA512 (samba-4.17.9.tar.xz) = 3ea45409a945b5a458ccf277b6d2b683ec038be478a21234abd410ea0aa8327e83860755ae3e5923c1d3cce302e68fff1a556a4cc792b56b97109a411d1a7320 +SHA512 (samba-4.17.9.tar.asc) = b53a361ed0a2a7d7efebfad60a9cfe4cf3314898226a9ffe2d3d105bf1518856f6f0fbd5dc6b6148a10b31010a92b47bf94cb0bb03d081f3f9212d54e03bb047 From a0a98098b5c1aacb88ec4edbde1a672e9c8f0ad8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Sat, 15 Jul 2023 15:17:52 +0200 Subject: [PATCH 47/51] Fix netlogon LogonGetCapabilities level 2 error handling resolves: #2223091 Guenther --- master-netlogongetcaps.patch | 351 +++++++++++++++++++++++++++++++++++ samba.spec | 7 +- 2 files changed, 357 insertions(+), 1 deletion(-) create mode 100644 master-netlogongetcaps.patch diff --git a/master-netlogongetcaps.patch b/master-netlogongetcaps.patch new file mode 100644 index 0000000..dd0f6b1 --- /dev/null +++ b/master-netlogongetcaps.patch @@ -0,0 +1,351 @@ +From 5f87888ed53320538cf773d64868390d8641a40e Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Sat, 15 Jul 2023 17:20:32 +0200 +Subject: [PATCH 1/4] netlogon.idl: add support for netr_LogonGetCapabilities + response level 2 + +We don't have any documentation about this yet, but tests against +a Windows Server 2022 patched with KB5028166 revealed that +the response for query_level=2 is exactly the same as +for querey_level=1. + +Until we know the reason for query_level=2 we won't +use it as client nor support it in the server, but +we want ndrdump to work. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15418 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Andrew Bartlett +--- + librpc/idl/netlogon.idl | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/librpc/idl/netlogon.idl b/librpc/idl/netlogon.idl +index 48a8c8f9310..85dd73ee7e4 100644 +--- a/librpc/idl/netlogon.idl ++++ b/librpc/idl/netlogon.idl +@@ -1236,6 +1236,7 @@ interface netlogon + /* Function 0x15 */ + typedef [switch_type(uint32)] union { + [case(1)] netr_NegotiateFlags server_capabilities; ++ [case(2)] netr_NegotiateFlags server_capabilities; + } netr_Capabilities; + + NTSTATUS netr_LogonGetCapabilities( +-- +2.41.0 + + +From 404ce08e9088968311c714e756f5d58ce2cef715 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Sat, 15 Jul 2023 17:25:05 +0200 +Subject: [PATCH 2/4] s4:torture/rpc: let rpc.schannel also check + netr_LogonGetCapabilities with different levels + +The important change it that we expect DCERPC_NCA_S_FAULT_INVALID_TAG +for unsupported query_levels, we allow it to work with servers +with or without support for query_level=2. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15418 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Andrew Bartlett +--- + .../knownfail.d/netr_LogonGetCapabilities | 3 + + source4/torture/rpc/netlogon.c | 77 ++++++++++++++++++- + 2 files changed, 79 insertions(+), 1 deletion(-) + create mode 100644 selftest/knownfail.d/netr_LogonGetCapabilities + +diff --git a/selftest/knownfail.d/netr_LogonGetCapabilities b/selftest/knownfail.d/netr_LogonGetCapabilities +new file mode 100644 +index 00000000000..30aadf3bb9d +--- /dev/null ++++ b/selftest/knownfail.d/netr_LogonGetCapabilities +@@ -0,0 +1,3 @@ ++^samba3.rpc.schannel.*\.schannel\(nt4_dc ++^samba3.rpc.schannel.*\.schannel\(ad_dc ++^samba4.rpc.schannel.*\.schannel\(ad_dc +diff --git a/source4/torture/rpc/netlogon.c b/source4/torture/rpc/netlogon.c +index 1f068eb7826..a3d190f13dd 100644 +--- a/source4/torture/rpc/netlogon.c ++++ b/source4/torture/rpc/netlogon.c +@@ -2056,8 +2056,47 @@ bool test_netlogon_capabilities(struct dcerpc_pipe *p, struct torture_context *t + r.out.capabilities = &capabilities; + r.out.return_authenticator = &return_auth; + +- torture_comment(tctx, "Testing LogonGetCapabilities\n"); ++ torture_comment(tctx, "Testing LogonGetCapabilities with query_level=0\n"); + ++ r.in.query_level = 0; ++ ZERO_STRUCT(return_auth); ++ ++ /* ++ * we need to operate on a temporary copy of creds ++ * because dcerpc_netr_LogonGetCapabilities with ++ * an unknown query level returns DCERPC_NCA_S_FAULT_INVALID_TAG ++ * => NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE ++ * without looking a the authenticator. ++ */ ++ tmp_creds = *creds; ++ netlogon_creds_client_authenticator(&tmp_creds, &auth); ++ ++ status = dcerpc_netr_LogonGetCapabilities_r(b, tctx, &r); ++ torture_assert_ntstatus_equal(tctx, status, NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE, ++ "LogonGetCapabilities query_level=0 failed"); ++ ++ torture_comment(tctx, "Testing LogonGetCapabilities with query_level=3\n"); ++ ++ r.in.query_level = 3; ++ ZERO_STRUCT(return_auth); ++ ++ /* ++ * we need to operate on a temporary copy of creds ++ * because dcerpc_netr_LogonGetCapabilities with ++ * an unknown query level returns DCERPC_NCA_S_FAULT_INVALID_TAG ++ * => NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE ++ * without looking a the authenticator. ++ */ ++ tmp_creds = *creds; ++ netlogon_creds_client_authenticator(&tmp_creds, &auth); ++ ++ status = dcerpc_netr_LogonGetCapabilities_r(b, tctx, &r); ++ torture_assert_ntstatus_equal(tctx, status, NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE, ++ "LogonGetCapabilities query_level=0 failed"); ++ ++ torture_comment(tctx, "Testing LogonGetCapabilities with query_level=1\n"); ++ ++ r.in.query_level = 1; + ZERO_STRUCT(return_auth); + + /* +@@ -2077,6 +2116,42 @@ bool test_netlogon_capabilities(struct dcerpc_pipe *p, struct torture_context *t + + *creds = tmp_creds; + ++ torture_assert(tctx, netlogon_creds_client_check(creds, ++ &r.out.return_authenticator->cred), ++ "Credential chaining failed"); ++ ++ torture_assert_int_equal(tctx, creds->negotiate_flags, ++ capabilities.server_capabilities, ++ "negotiate flags"); ++ ++ torture_comment(tctx, "Testing LogonGetCapabilities with query_level=2\n"); ++ ++ r.in.query_level = 2; ++ ZERO_STRUCT(return_auth); ++ ++ /* ++ * we need to operate on a temporary copy of creds ++ * because dcerpc_netr_LogonGetCapabilities with ++ * an query level 2 may returns DCERPC_NCA_S_FAULT_INVALID_TAG ++ * => NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE ++ * without looking a the authenticator. ++ */ ++ tmp_creds = *creds; ++ netlogon_creds_client_authenticator(&tmp_creds, &auth); ++ ++ status = dcerpc_netr_LogonGetCapabilities_r(b, tctx, &r); ++ if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE)) { ++ /* ++ * an server without KB5028166 returns ++ * DCERPC_NCA_S_FAULT_INVALID_TAG => ++ * NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE ++ */ ++ return true; ++ } ++ torture_assert_ntstatus_ok(tctx, status, "LogonGetCapabilities query_level=2 failed"); ++ ++ *creds = tmp_creds; ++ + torture_assert(tctx, netlogon_creds_client_check(creds, + &r.out.return_authenticator->cred), + "Credential chaining failed"); +-- +2.41.0 + + +From d5f1097b6220676d56ed5fc6707acf667b704518 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Sat, 15 Jul 2023 16:11:48 +0200 +Subject: [PATCH 3/4] s4:rpc_server:netlogon: generate FAULT_INVALID_TAG for + invalid netr_LogonGetCapabilities levels + +This is important as Windows clients with KB5028166 seem to +call netr_LogonGetCapabilities with query_level=2 after +a call with query_level=1. + +An unpatched Windows Server returns DCERPC_NCA_S_FAULT_INVALID_TAG +for query_level values other than 1. +While Samba tries to return NT_STATUS_NOT_SUPPORTED, but +later fails to marshall the response, which results +in DCERPC_FAULT_BAD_STUB_DATA instead. + +Because we don't have any documentation for level 2 yet, +we just try to behave like an unpatched server and +generate DCERPC_NCA_S_FAULT_INVALID_TAG instead of +DCERPC_FAULT_BAD_STUB_DATA. +Which allows patched Windows clients to keep working +against a Samba DC. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15418 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Andrew Bartlett +--- + .../knownfail.d/netr_LogonGetCapabilities | 2 -- + source4/rpc_server/netlogon/dcerpc_netlogon.c | 28 ++++++++++++++++--- + 2 files changed, 24 insertions(+), 6 deletions(-) + +diff --git a/selftest/knownfail.d/netr_LogonGetCapabilities b/selftest/knownfail.d/netr_LogonGetCapabilities +index 30aadf3bb9d..99c7ac711ed 100644 +--- a/selftest/knownfail.d/netr_LogonGetCapabilities ++++ b/selftest/knownfail.d/netr_LogonGetCapabilities +@@ -1,3 +1 @@ + ^samba3.rpc.schannel.*\.schannel\(nt4_dc +-^samba3.rpc.schannel.*\.schannel\(ad_dc +-^samba4.rpc.schannel.*\.schannel\(ad_dc +diff --git a/source4/rpc_server/netlogon/dcerpc_netlogon.c b/source4/rpc_server/netlogon/dcerpc_netlogon.c +index 6ccba65d3bf..dc2167f08b2 100644 +--- a/source4/rpc_server/netlogon/dcerpc_netlogon.c ++++ b/source4/rpc_server/netlogon/dcerpc_netlogon.c +@@ -2364,6 +2364,30 @@ static NTSTATUS dcesrv_netr_LogonGetCapabilities(struct dcesrv_call_state *dce_c + struct netlogon_creds_CredentialState *creds; + NTSTATUS status; + ++ switch (r->in.query_level) { ++ case 1: ++ break; ++ case 2: ++ /* ++ * Until we know the details behind KB5028166 ++ * just return DCERPC_NCA_S_FAULT_INVALID_TAG ++ * like an unpatched Windows Server. ++ */ ++ FALL_THROUGH; ++ default: ++ /* ++ * There would not be a way to marshall the ++ * the response. Which would mean our final ++ * ndr_push would fail an we would return ++ * an RPC-level fault with DCERPC_FAULT_BAD_STUB_DATA. ++ * ++ * But it's important to match a Windows server ++ * especially before KB5028166, see also our bug #15418 ++ * Otherwise Windows client would stop talking to us. ++ */ ++ DCESRV_FAULT(DCERPC_NCA_S_FAULT_INVALID_TAG); ++ } ++ + status = dcesrv_netr_creds_server_step_check(dce_call, + mem_ctx, + r->in.computer_name, +@@ -2375,10 +2399,6 @@ static NTSTATUS dcesrv_netr_LogonGetCapabilities(struct dcesrv_call_state *dce_c + } + NT_STATUS_NOT_OK_RETURN(status); + +- if (r->in.query_level != 1) { +- return NT_STATUS_NOT_SUPPORTED; +- } +- + r->out.capabilities->server_capabilities = creds->negotiate_flags; + + return NT_STATUS_OK; +-- +2.41.0 + + +From dfeabce44fbb78083fbbb2aa634fc4172cf83db9 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Sat, 15 Jul 2023 16:11:48 +0200 +Subject: [PATCH 4/4] s3:rpc_server:netlogon: generate FAULT_INVALID_TAG for + invalid netr_LogonGetCapabilities levels + +This is important as Windows clients with KB5028166 seem to +call netr_LogonGetCapabilities with query_level=2 after +a call with query_level=1. + +An unpatched Windows Server returns DCERPC_NCA_S_FAULT_INVALID_TAG +for query_level values other than 1. +While Samba tries to return NT_STATUS_NOT_SUPPORTED, but +later fails to marshall the response, which results +in DCERPC_FAULT_BAD_STUB_DATA instead. + +Because we don't have any documentation for level 2 yet, +we just try to behave like an unpatched server and +generate DCERPC_NCA_S_FAULT_INVALID_TAG instead of +DCERPC_FAULT_BAD_STUB_DATA. +Which allows patched Windows clients to keep working +against a Samba DC. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15418 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Andrew Bartlett + +Autobuild-User(master): Stefan Metzmacher +Autobuild-Date(master): Mon Jul 17 07:35:09 UTC 2023 on atb-devel-224 +--- + .../knownfail.d/netr_LogonGetCapabilities | 1 - + source3/rpc_server/netlogon/srv_netlog_nt.c | 29 ++++++++++++++++--- + 2 files changed, 25 insertions(+), 5 deletions(-) + delete mode 100644 selftest/knownfail.d/netr_LogonGetCapabilities + +diff --git a/selftest/knownfail.d/netr_LogonGetCapabilities b/selftest/knownfail.d/netr_LogonGetCapabilities +deleted file mode 100644 +index 99c7ac711ed..00000000000 +--- a/selftest/knownfail.d/netr_LogonGetCapabilities ++++ /dev/null +@@ -1 +0,0 @@ +-^samba3.rpc.schannel.*\.schannel\(nt4_dc +diff --git a/source3/rpc_server/netlogon/srv_netlog_nt.c b/source3/rpc_server/netlogon/srv_netlog_nt.c +index 3ba58e61206..e8aa14167fc 100644 +--- a/source3/rpc_server/netlogon/srv_netlog_nt.c ++++ b/source3/rpc_server/netlogon/srv_netlog_nt.c +@@ -2284,6 +2284,31 @@ NTSTATUS _netr_LogonGetCapabilities(struct pipes_struct *p, + struct netlogon_creds_CredentialState *creds; + NTSTATUS status; + ++ switch (r->in.query_level) { ++ case 1: ++ break; ++ case 2: ++ /* ++ * Until we know the details behind KB5028166 ++ * just return DCERPC_NCA_S_FAULT_INVALID_TAG ++ * like an unpatched Windows Server. ++ */ ++ FALL_THROUGH; ++ default: ++ /* ++ * There would not be a way to marshall the ++ * the response. Which would mean our final ++ * ndr_push would fail an we would return ++ * an RPC-level fault with DCERPC_FAULT_BAD_STUB_DATA. ++ * ++ * But it's important to match a Windows server ++ * especially before KB5028166, see also our bug #15418 ++ * Otherwise Windows client would stop talking to us. ++ */ ++ p->fault_state = DCERPC_NCA_S_FAULT_INVALID_TAG; ++ return NT_STATUS_NOT_SUPPORTED; ++ } ++ + become_root(); + status = dcesrv_netr_creds_server_step_check(p->dce_call, + p->mem_ctx, +@@ -2296,10 +2321,6 @@ NTSTATUS _netr_LogonGetCapabilities(struct pipes_struct *p, + return status; + } + +- if (r->in.query_level != 1) { +- return NT_STATUS_NOT_SUPPORTED; +- } +- + r->out.capabilities->server_capabilities = creds->negotiate_flags; + + return NT_STATUS_OK; +-- +2.41.0 + diff --git a/samba.spec b/samba.spec index b025bf3..50e6c7e 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.9 -%global baserelease 0 +%global baserelease 1 # This should be rc1 or %%nil %global pre_release %nil @@ -231,6 +231,8 @@ Source17: samba-usershares-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore +Patch0: master-netlogongetcaps.patch + Requires(pre): /usr/sbin/groupadd Requires(pre): %{name}-common = %{samba_depver} @@ -4311,6 +4313,9 @@ fi %endif %changelog +* Sat Jul 15 2023 Guenther Deschner - 4.17.9-1 +- resolves: #2223091 - Fix netlogon LogonGetCapabilities level 2 error handling + * Thu Jul 06 2023 Guenther Deschner - 4.17.9-0 - Update to version 4.17.9 From 82c3006972f100656c9469a5024d6ff2d0ac0d26 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 20 Jul 2023 10:24:29 +0200 Subject: [PATCH 48/51] Update to version 4.17.10 Security fix for CVE-2022-2127 resolves: #2222791, #2224254 Security fix for CVE-2023-3347 resolves: #2222792, #2224255 Security fix for CVE-2023-34966 resolves: #2222793, #2224253 Security fix for CVE-2023-34967 resolves: #2222794, #2224252 Security fix for CVE-2023-34968 resolves: #2222795, #2224250 Guenther --- .gitignore | 2 + master-netlogongetcaps.patch | 351 ----------------------------------- samba.spec | 14 +- sources | 4 +- 4 files changed, 14 insertions(+), 357 deletions(-) delete mode 100644 master-netlogongetcaps.patch diff --git a/.gitignore b/.gitignore index e44052e..cefcd4e 100644 --- a/.gitignore +++ b/.gitignore @@ -327,3 +327,5 @@ samba-3.6.0pre1.tar.gz /samba-4.17.8.tar.asc /samba-4.17.9.tar.xz /samba-4.17.9.tar.asc +/samba-4.17.10.tar.xz +/samba-4.17.10.tar.asc diff --git a/master-netlogongetcaps.patch b/master-netlogongetcaps.patch deleted file mode 100644 index dd0f6b1..0000000 --- a/master-netlogongetcaps.patch +++ /dev/null @@ -1,351 +0,0 @@ -From 5f87888ed53320538cf773d64868390d8641a40e Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Sat, 15 Jul 2023 17:20:32 +0200 -Subject: [PATCH 1/4] netlogon.idl: add support for netr_LogonGetCapabilities - response level 2 - -We don't have any documentation about this yet, but tests against -a Windows Server 2022 patched with KB5028166 revealed that -the response for query_level=2 is exactly the same as -for querey_level=1. - -Until we know the reason for query_level=2 we won't -use it as client nor support it in the server, but -we want ndrdump to work. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15418 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Andrew Bartlett ---- - librpc/idl/netlogon.idl | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/librpc/idl/netlogon.idl b/librpc/idl/netlogon.idl -index 48a8c8f9310..85dd73ee7e4 100644 ---- a/librpc/idl/netlogon.idl -+++ b/librpc/idl/netlogon.idl -@@ -1236,6 +1236,7 @@ interface netlogon - /* Function 0x15 */ - typedef [switch_type(uint32)] union { - [case(1)] netr_NegotiateFlags server_capabilities; -+ [case(2)] netr_NegotiateFlags server_capabilities; - } netr_Capabilities; - - NTSTATUS netr_LogonGetCapabilities( --- -2.41.0 - - -From 404ce08e9088968311c714e756f5d58ce2cef715 Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Sat, 15 Jul 2023 17:25:05 +0200 -Subject: [PATCH 2/4] s4:torture/rpc: let rpc.schannel also check - netr_LogonGetCapabilities with different levels - -The important change it that we expect DCERPC_NCA_S_FAULT_INVALID_TAG -for unsupported query_levels, we allow it to work with servers -with or without support for query_level=2. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15418 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Andrew Bartlett ---- - .../knownfail.d/netr_LogonGetCapabilities | 3 + - source4/torture/rpc/netlogon.c | 77 ++++++++++++++++++- - 2 files changed, 79 insertions(+), 1 deletion(-) - create mode 100644 selftest/knownfail.d/netr_LogonGetCapabilities - -diff --git a/selftest/knownfail.d/netr_LogonGetCapabilities b/selftest/knownfail.d/netr_LogonGetCapabilities -new file mode 100644 -index 00000000000..30aadf3bb9d ---- /dev/null -+++ b/selftest/knownfail.d/netr_LogonGetCapabilities -@@ -0,0 +1,3 @@ -+^samba3.rpc.schannel.*\.schannel\(nt4_dc -+^samba3.rpc.schannel.*\.schannel\(ad_dc -+^samba4.rpc.schannel.*\.schannel\(ad_dc -diff --git a/source4/torture/rpc/netlogon.c b/source4/torture/rpc/netlogon.c -index 1f068eb7826..a3d190f13dd 100644 ---- a/source4/torture/rpc/netlogon.c -+++ b/source4/torture/rpc/netlogon.c -@@ -2056,8 +2056,47 @@ bool test_netlogon_capabilities(struct dcerpc_pipe *p, struct torture_context *t - r.out.capabilities = &capabilities; - r.out.return_authenticator = &return_auth; - -- torture_comment(tctx, "Testing LogonGetCapabilities\n"); -+ torture_comment(tctx, "Testing LogonGetCapabilities with query_level=0\n"); - -+ r.in.query_level = 0; -+ ZERO_STRUCT(return_auth); -+ -+ /* -+ * we need to operate on a temporary copy of creds -+ * because dcerpc_netr_LogonGetCapabilities with -+ * an unknown query level returns DCERPC_NCA_S_FAULT_INVALID_TAG -+ * => NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE -+ * without looking a the authenticator. -+ */ -+ tmp_creds = *creds; -+ netlogon_creds_client_authenticator(&tmp_creds, &auth); -+ -+ status = dcerpc_netr_LogonGetCapabilities_r(b, tctx, &r); -+ torture_assert_ntstatus_equal(tctx, status, NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE, -+ "LogonGetCapabilities query_level=0 failed"); -+ -+ torture_comment(tctx, "Testing LogonGetCapabilities with query_level=3\n"); -+ -+ r.in.query_level = 3; -+ ZERO_STRUCT(return_auth); -+ -+ /* -+ * we need to operate on a temporary copy of creds -+ * because dcerpc_netr_LogonGetCapabilities with -+ * an unknown query level returns DCERPC_NCA_S_FAULT_INVALID_TAG -+ * => NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE -+ * without looking a the authenticator. -+ */ -+ tmp_creds = *creds; -+ netlogon_creds_client_authenticator(&tmp_creds, &auth); -+ -+ status = dcerpc_netr_LogonGetCapabilities_r(b, tctx, &r); -+ torture_assert_ntstatus_equal(tctx, status, NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE, -+ "LogonGetCapabilities query_level=0 failed"); -+ -+ torture_comment(tctx, "Testing LogonGetCapabilities with query_level=1\n"); -+ -+ r.in.query_level = 1; - ZERO_STRUCT(return_auth); - - /* -@@ -2077,6 +2116,42 @@ bool test_netlogon_capabilities(struct dcerpc_pipe *p, struct torture_context *t - - *creds = tmp_creds; - -+ torture_assert(tctx, netlogon_creds_client_check(creds, -+ &r.out.return_authenticator->cred), -+ "Credential chaining failed"); -+ -+ torture_assert_int_equal(tctx, creds->negotiate_flags, -+ capabilities.server_capabilities, -+ "negotiate flags"); -+ -+ torture_comment(tctx, "Testing LogonGetCapabilities with query_level=2\n"); -+ -+ r.in.query_level = 2; -+ ZERO_STRUCT(return_auth); -+ -+ /* -+ * we need to operate on a temporary copy of creds -+ * because dcerpc_netr_LogonGetCapabilities with -+ * an query level 2 may returns DCERPC_NCA_S_FAULT_INVALID_TAG -+ * => NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE -+ * without looking a the authenticator. -+ */ -+ tmp_creds = *creds; -+ netlogon_creds_client_authenticator(&tmp_creds, &auth); -+ -+ status = dcerpc_netr_LogonGetCapabilities_r(b, tctx, &r); -+ if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE)) { -+ /* -+ * an server without KB5028166 returns -+ * DCERPC_NCA_S_FAULT_INVALID_TAG => -+ * NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE -+ */ -+ return true; -+ } -+ torture_assert_ntstatus_ok(tctx, status, "LogonGetCapabilities query_level=2 failed"); -+ -+ *creds = tmp_creds; -+ - torture_assert(tctx, netlogon_creds_client_check(creds, - &r.out.return_authenticator->cred), - "Credential chaining failed"); --- -2.41.0 - - -From d5f1097b6220676d56ed5fc6707acf667b704518 Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Sat, 15 Jul 2023 16:11:48 +0200 -Subject: [PATCH 3/4] s4:rpc_server:netlogon: generate FAULT_INVALID_TAG for - invalid netr_LogonGetCapabilities levels - -This is important as Windows clients with KB5028166 seem to -call netr_LogonGetCapabilities with query_level=2 after -a call with query_level=1. - -An unpatched Windows Server returns DCERPC_NCA_S_FAULT_INVALID_TAG -for query_level values other than 1. -While Samba tries to return NT_STATUS_NOT_SUPPORTED, but -later fails to marshall the response, which results -in DCERPC_FAULT_BAD_STUB_DATA instead. - -Because we don't have any documentation for level 2 yet, -we just try to behave like an unpatched server and -generate DCERPC_NCA_S_FAULT_INVALID_TAG instead of -DCERPC_FAULT_BAD_STUB_DATA. -Which allows patched Windows clients to keep working -against a Samba DC. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15418 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Andrew Bartlett ---- - .../knownfail.d/netr_LogonGetCapabilities | 2 -- - source4/rpc_server/netlogon/dcerpc_netlogon.c | 28 ++++++++++++++++--- - 2 files changed, 24 insertions(+), 6 deletions(-) - -diff --git a/selftest/knownfail.d/netr_LogonGetCapabilities b/selftest/knownfail.d/netr_LogonGetCapabilities -index 30aadf3bb9d..99c7ac711ed 100644 ---- a/selftest/knownfail.d/netr_LogonGetCapabilities -+++ b/selftest/knownfail.d/netr_LogonGetCapabilities -@@ -1,3 +1 @@ - ^samba3.rpc.schannel.*\.schannel\(nt4_dc --^samba3.rpc.schannel.*\.schannel\(ad_dc --^samba4.rpc.schannel.*\.schannel\(ad_dc -diff --git a/source4/rpc_server/netlogon/dcerpc_netlogon.c b/source4/rpc_server/netlogon/dcerpc_netlogon.c -index 6ccba65d3bf..dc2167f08b2 100644 ---- a/source4/rpc_server/netlogon/dcerpc_netlogon.c -+++ b/source4/rpc_server/netlogon/dcerpc_netlogon.c -@@ -2364,6 +2364,30 @@ static NTSTATUS dcesrv_netr_LogonGetCapabilities(struct dcesrv_call_state *dce_c - struct netlogon_creds_CredentialState *creds; - NTSTATUS status; - -+ switch (r->in.query_level) { -+ case 1: -+ break; -+ case 2: -+ /* -+ * Until we know the details behind KB5028166 -+ * just return DCERPC_NCA_S_FAULT_INVALID_TAG -+ * like an unpatched Windows Server. -+ */ -+ FALL_THROUGH; -+ default: -+ /* -+ * There would not be a way to marshall the -+ * the response. Which would mean our final -+ * ndr_push would fail an we would return -+ * an RPC-level fault with DCERPC_FAULT_BAD_STUB_DATA. -+ * -+ * But it's important to match a Windows server -+ * especially before KB5028166, see also our bug #15418 -+ * Otherwise Windows client would stop talking to us. -+ */ -+ DCESRV_FAULT(DCERPC_NCA_S_FAULT_INVALID_TAG); -+ } -+ - status = dcesrv_netr_creds_server_step_check(dce_call, - mem_ctx, - r->in.computer_name, -@@ -2375,10 +2399,6 @@ static NTSTATUS dcesrv_netr_LogonGetCapabilities(struct dcesrv_call_state *dce_c - } - NT_STATUS_NOT_OK_RETURN(status); - -- if (r->in.query_level != 1) { -- return NT_STATUS_NOT_SUPPORTED; -- } -- - r->out.capabilities->server_capabilities = creds->negotiate_flags; - - return NT_STATUS_OK; --- -2.41.0 - - -From dfeabce44fbb78083fbbb2aa634fc4172cf83db9 Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Sat, 15 Jul 2023 16:11:48 +0200 -Subject: [PATCH 4/4] s3:rpc_server:netlogon: generate FAULT_INVALID_TAG for - invalid netr_LogonGetCapabilities levels - -This is important as Windows clients with KB5028166 seem to -call netr_LogonGetCapabilities with query_level=2 after -a call with query_level=1. - -An unpatched Windows Server returns DCERPC_NCA_S_FAULT_INVALID_TAG -for query_level values other than 1. -While Samba tries to return NT_STATUS_NOT_SUPPORTED, but -later fails to marshall the response, which results -in DCERPC_FAULT_BAD_STUB_DATA instead. - -Because we don't have any documentation for level 2 yet, -we just try to behave like an unpatched server and -generate DCERPC_NCA_S_FAULT_INVALID_TAG instead of -DCERPC_FAULT_BAD_STUB_DATA. -Which allows patched Windows clients to keep working -against a Samba DC. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15418 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Andrew Bartlett - -Autobuild-User(master): Stefan Metzmacher -Autobuild-Date(master): Mon Jul 17 07:35:09 UTC 2023 on atb-devel-224 ---- - .../knownfail.d/netr_LogonGetCapabilities | 1 - - source3/rpc_server/netlogon/srv_netlog_nt.c | 29 ++++++++++++++++--- - 2 files changed, 25 insertions(+), 5 deletions(-) - delete mode 100644 selftest/knownfail.d/netr_LogonGetCapabilities - -diff --git a/selftest/knownfail.d/netr_LogonGetCapabilities b/selftest/knownfail.d/netr_LogonGetCapabilities -deleted file mode 100644 -index 99c7ac711ed..00000000000 ---- a/selftest/knownfail.d/netr_LogonGetCapabilities -+++ /dev/null -@@ -1 +0,0 @@ --^samba3.rpc.schannel.*\.schannel\(nt4_dc -diff --git a/source3/rpc_server/netlogon/srv_netlog_nt.c b/source3/rpc_server/netlogon/srv_netlog_nt.c -index 3ba58e61206..e8aa14167fc 100644 ---- a/source3/rpc_server/netlogon/srv_netlog_nt.c -+++ b/source3/rpc_server/netlogon/srv_netlog_nt.c -@@ -2284,6 +2284,31 @@ NTSTATUS _netr_LogonGetCapabilities(struct pipes_struct *p, - struct netlogon_creds_CredentialState *creds; - NTSTATUS status; - -+ switch (r->in.query_level) { -+ case 1: -+ break; -+ case 2: -+ /* -+ * Until we know the details behind KB5028166 -+ * just return DCERPC_NCA_S_FAULT_INVALID_TAG -+ * like an unpatched Windows Server. -+ */ -+ FALL_THROUGH; -+ default: -+ /* -+ * There would not be a way to marshall the -+ * the response. Which would mean our final -+ * ndr_push would fail an we would return -+ * an RPC-level fault with DCERPC_FAULT_BAD_STUB_DATA. -+ * -+ * But it's important to match a Windows server -+ * especially before KB5028166, see also our bug #15418 -+ * Otherwise Windows client would stop talking to us. -+ */ -+ p->fault_state = DCERPC_NCA_S_FAULT_INVALID_TAG; -+ return NT_STATUS_NOT_SUPPORTED; -+ } -+ - become_root(); - status = dcesrv_netr_creds_server_step_check(p->dce_call, - p->mem_ctx, -@@ -2296,10 +2321,6 @@ NTSTATUS _netr_LogonGetCapabilities(struct pipes_struct *p, - return status; - } - -- if (r->in.query_level != 1) { -- return NT_STATUS_NOT_SUPPORTED; -- } -- - r->out.capabilities->server_capabilities = creds->negotiate_flags; - - return NT_STATUS_OK; --- -2.41.0 - diff --git a/samba.spec b/samba.spec index 50e6c7e..89fdf9c 100644 --- a/samba.spec +++ b/samba.spec @@ -134,8 +134,8 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.17.9 -%global baserelease 1 +%global samba_version 4.17.10 +%global baserelease 0 # This should be rc1 or %%nil %global pre_release %nil @@ -231,8 +231,6 @@ Source17: samba-usershares-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore -Patch0: master-netlogongetcaps.patch - Requires(pre): /usr/sbin/groupadd Requires(pre): %{name}-common = %{samba_depver} @@ -4313,6 +4311,14 @@ fi %endif %changelog +* Thu Jul 20 2023 Guenther Deschner - 4.17.10-0 +- Update to version 4.17.10 +- resolves: #2222791, #2224254 - Security fix for CVE-2022-2127 +- resolves: #2222792, #2224255 - Security fix for CVE-2023-3347 +- resolves: #2222793, #2224253 - Security fix for CVE-2023-34966 +- resolves: #2222794, #2224252 - Security fix for CVE-2023-34967 +- resolves: #2222795, #2224250 - Security fix for CVE-2023-34968 + * Sat Jul 15 2023 Guenther Deschner - 4.17.9-1 - resolves: #2223091 - Fix netlogon LogonGetCapabilities level 2 error handling diff --git a/sources b/sources index 8f48ea8..9593329 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.17.9.tar.xz) = 3ea45409a945b5a458ccf277b6d2b683ec038be478a21234abd410ea0aa8327e83860755ae3e5923c1d3cce302e68fff1a556a4cc792b56b97109a411d1a7320 -SHA512 (samba-4.17.9.tar.asc) = b53a361ed0a2a7d7efebfad60a9cfe4cf3314898226a9ffe2d3d105bf1518856f6f0fbd5dc6b6148a10b31010a92b47bf94cb0bb03d081f3f9212d54e03bb047 +SHA512 (samba-4.17.10.tar.xz) = 8d56892202279e6fdf158f7b8825d66658fdca6a236a2477791e44f055c2693bc9d2d106b510e3b10d982bd80abf4552d7a65c9def79c217b2e9403a9be09a0e +SHA512 (samba-4.17.10.tar.asc) = 41798424a724974877b783b8f9f43f0b34db75f4707a1e3315ef11876589d8f0a88de1dc0b4fa336215c6212ae61645a45265cc149e39ec8944189763f45b8d8 From f441b5bad16bc90e9c9830eda8b2798492c8a7ed Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 7 Sep 2023 20:31:08 +0200 Subject: [PATCH 49/51] Update to version 4.17.11 Guenther --- .gitignore | 2 ++ samba.spec | 5 ++++- sources | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index cefcd4e..8d9c8c7 100644 --- a/.gitignore +++ b/.gitignore @@ -329,3 +329,5 @@ samba-3.6.0pre1.tar.gz /samba-4.17.9.tar.asc /samba-4.17.10.tar.xz /samba-4.17.10.tar.asc +/samba-4.17.11.tar.xz +/samba-4.17.11.tar.asc diff --git a/samba.spec b/samba.spec index 89fdf9c..bf090a5 100644 --- a/samba.spec +++ b/samba.spec @@ -134,7 +134,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.17.10 +%global samba_version 4.17.11 %global baserelease 0 # This should be rc1 or %%nil %global pre_release %nil @@ -4311,6 +4311,9 @@ fi %endif %changelog +* Thu Sep 07 2023 Guenther Deschner - 4.17.11-0 +- Update to version 4.17.11 + * Thu Jul 20 2023 Guenther Deschner - 4.17.10-0 - Update to version 4.17.10 - resolves: #2222791, #2224254 - Security fix for CVE-2022-2127 diff --git a/sources b/sources index 9593329..3ee78ef 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.17.10.tar.xz) = 8d56892202279e6fdf158f7b8825d66658fdca6a236a2477791e44f055c2693bc9d2d106b510e3b10d982bd80abf4552d7a65c9def79c217b2e9403a9be09a0e -SHA512 (samba-4.17.10.tar.asc) = 41798424a724974877b783b8f9f43f0b34db75f4707a1e3315ef11876589d8f0a88de1dc0b4fa336215c6212ae61645a45265cc149e39ec8944189763f45b8d8 +SHA512 (samba-4.17.11.tar.xz) = e06503bfb63695c3ccca8351147c296d5e9fb0c0c8062f0cce616d9641c5c0dbf931bd1c0f363143001c82f6449ee68afaa7db941e2eb082a610d36ea3763f5a +SHA512 (samba-4.17.11.tar.asc) = c63dd06c4431da6805a3d3530d40ef0416eadbe76d5418fb16c38b701d52fdf49084f19871a77e6a9a4f3268a30df4be9429b18c0d3f29f1b0970b8a5a272f8c From 540c35cff7d41ce5b849c3a2ddeff8c999a013e9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 10 Oct 2023 17:45:30 +0200 Subject: [PATCH 50/51] Update to 4.17.12 resolves: #2241881, #2243228: Security fix for CVE-2023-3961 resolves: #2241882, #2243231: Security fix for CVE-2023-4091 resolves: #2241883, #2243230: Security fix for CVE-2023-4154 resolves: #2241884, #2243229: Security fix for CVE-2023-42669 resolves: #2241885, #2243232: Security fix for CVE-2023-42670 Guenther --- .gitignore | 2 ++ samba.spec | 13 ++++++++++--- sources | 4 ++-- 3 files changed, 14 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 8d9c8c7..09685c6 100644 --- a/.gitignore +++ b/.gitignore @@ -331,3 +331,5 @@ samba-3.6.0pre1.tar.gz /samba-4.17.10.tar.asc /samba-4.17.11.tar.xz /samba-4.17.11.tar.asc +/samba-4.17.12.tar.xz +/samba-4.17.12.tar.asc diff --git a/samba.spec b/samba.spec index bf090a5..e882bfb 100644 --- a/samba.spec +++ b/samba.spec @@ -134,8 +134,8 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.17.11 -%global baserelease 0 +%global samba_version 4.17.12 +%global baserelease 1 # This should be rc1 or %%nil %global pre_release %nil @@ -2066,7 +2066,6 @@ fi %{_libexecdir}/samba/rpcd_fsrvp %{_libexecdir}/samba/rpcd_lsad %{_libexecdir}/samba/rpcd_mdssvc -%{_libexecdir}/samba/rpcd_rpcecho %{_libexecdir}/samba/rpcd_spoolss %{_libexecdir}/samba/rpcd_winreg %{_mandir}/man8/samba-dcerpcd.8* @@ -4311,6 +4310,14 @@ fi %endif %changelog +* Tue Oct 10 2023 Guenther Deschner - 4.17.12-1 +- Update to 4.17.12 +- resolves: #2241881, #2243228: Security fix for CVE-2023-3961 +- resolves: #2241882, #2243231: Security fix for CVE-2023-4091 +- resolves: #2241883, #2243230: Security fix for CVE-2023-4154 +- resolves: #2241884, #2243229: Security fix for CVE-2023-42669 +- resolves: #2241885, #2243232: Security fix for CVE-2023-42670 + * Thu Sep 07 2023 Guenther Deschner - 4.17.11-0 - Update to version 4.17.11 diff --git a/sources b/sources index 3ee78ef..1151a3c 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.17.11.tar.xz) = e06503bfb63695c3ccca8351147c296d5e9fb0c0c8062f0cce616d9641c5c0dbf931bd1c0f363143001c82f6449ee68afaa7db941e2eb082a610d36ea3763f5a -SHA512 (samba-4.17.11.tar.asc) = c63dd06c4431da6805a3d3530d40ef0416eadbe76d5418fb16c38b701d52fdf49084f19871a77e6a9a4f3268a30df4be9429b18c0d3f29f1b0970b8a5a272f8c +SHA512 (samba-4.17.12.tar.xz) = 54e7761b1db5a3bc077cd955ec6aadb485ecddc4f5099899208c87ef70fe1f912458569186bba16c61355270c1bfa6eb4d708bc0fe73720f3487ac78b30aa5cc +SHA512 (samba-4.17.12.tar.asc) = 11a830be3ee78c6ab60782a287aebad160b3613d799580abdac4cef45af2e7743a6b7e04b609bdbb71e5af9e4b1f627176ad6477ef2b77ce9f20354243f0182d From 29fbff508c3b3122a42206a11e5c13fd6549f061 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 13 Oct 2023 11:43:02 +0200 Subject: [PATCH 51/51] When built with testsuite rpcd_echo is built as well Guenther --- samba.spec | 3 +++ 1 file changed, 3 insertions(+) diff --git a/samba.spec b/samba.spec index e882bfb..301ce1e 100644 --- a/samba.spec +++ b/samba.spec @@ -2066,6 +2066,9 @@ fi %{_libexecdir}/samba/rpcd_fsrvp %{_libexecdir}/samba/rpcd_lsad %{_libexecdir}/samba/rpcd_mdssvc +%if %{with testsuite} +%{_libexecdir}/samba/rpcd_rpcecho +%endif %{_libexecdir}/samba/rpcd_spoolss %{_libexecdir}/samba/rpcd_winreg %{_mandir}/man8/samba-dcerpcd.8*