Update to Samba 4.11.15

resolves: #1892631, #1892634 - Security fixes for CVE-2020-14318 resolves: #1891685, #1892628 - Security fixes for CVE-2020-14323 resolves: #1892636, #1892640 - Security fixes for CVE-2020-14383 Guenther
Update to Samba 4.11.14
2020-10-29 12:25:34 +01:00 · 2020-10-06 11:33:42 +02:00 · 2020-09-19 08:28:59 +02:00 · 2020-08-25 10:42:34 +02:00 · 2020-07-02 18:59:30 +02:00 · 2020-06-30 14:15:28 +02:00
8 changed files with 1076 additions and 3405 deletions
--- a/.gitignore
+++ b/.gitignore
@ -169,3 +169,43 @@ samba-3.6.0pre1.tar.gz
 /samba-4.10.5.tar.asc
 /samba-4.10.6.tar.xz
 /samba-4.10.6.tar.asc
+/samba-4.11.0rc1.tar.xz
+/samba-4.11.0rc1.tar.asc
+/samba-4.11.0rc2.tar.xz
+/samba-4.11.0rc2.tar.asc
+/samba-4.11.0rc3.tar.xz
+/samba-4.11.0rc3.tar.asc
+/samba-4.11.0rc4.tar.xz
+/samba-4.11.0rc4.tar.asc
+/samba-4.11.0.tar.xz
+/samba-4.11.0.tar.asc
+/samba-4.11.1.tar.xz
+/samba-4.11.1.tar.asc
+/samba-4.11.2.tar.xz
+/samba-4.11.2.tar.asc
+/samba-4.11.3.tar.xz
+/samba-4.11.3.tar.asc
+/samba-4.11.4.tar.xz
+/samba-4.11.4.tar.asc
+/samba-4.11.5.tar.xz
+/samba-4.11.5.tar.asc
+/samba-4.11.6.tar.xz
+/samba-4.11.6.tar.asc
+/samba-4.11.7.tar.xz
+/samba-4.11.7.tar.asc
+/samba-4.11.8.tar.xz
+/samba-4.11.8.tar.asc
+/samba-4.11.9.tar.xz
+/samba-4.11.9.tar.asc
+/samba-4.11.10.tar.xz
+/samba-4.11.10.tar.asc
+/samba-4.11.11.tar.xz
+/samba-4.11.11.tar.asc
+/samba-4.11.12.tar.xz
+/samba-4.11.12.tar.asc
+/samba-4.11.13.tar.xz
+/samba-4.11.13.tar.asc
+/samba-4.11.14.tar.xz
+/samba-4.11.14.tar.asc
+/samba-4.11.15.tar.xz
+/samba-4.11.15.tar.asc
--- a/0000-use-gnutls-for-des-cbc.patch
+++ b/0000-use-gnutls-for-des-cbc.patch
@ -0,0 +1,371 @@
+From 21073bff847fbc41d3dab0a649fa400d8188fa16 Mon Sep 17 00:00:00 2001
+From: Isaac Boukris <iboukris@gmail.com>
+Date: Sat, 19 Oct 2019 23:48:19 +0300
+Subject: [PATCH 1/2] smbdes: add des_crypt56_gnutls() using use DES-CBC with
+ zeroed IV
+
+Signed-off-by: Isaac Boukris <iboukris@gmail.com>
+---
+ libcli/auth/smbdes.c | 47 ++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 47 insertions(+)
+
+diff --git a/libcli/auth/smbdes.c b/libcli/auth/smbdes.c
+index 6d9a6dc2ce8..37ede91ad22 100644
+--- a/libcli/auth/smbdes.c
+++ b/libcli/auth/smbdes.c
+@@ -23,6 +23,9 @@
+ #include "includes.h"
+ #include "libcli/auth/libcli_auth.h"
+ 
+#include <gnutls/gnutls.h>
+#include <gnutls/crypto.h>
+
+ /* NOTES: 
+ 
+    This code makes no attempt to be fast! In fact, it is a very
+@@ -273,6 +276,50 @@ static void str_to_key(const uint8_t *str,uint8_t *key)
+ 	}
+ }
+ 
+static int des_crypt56_gnutls(uint8_t out[8], const uint8_t in[8],
+			      const uint8_t key_in[7], bool enc)
+{
+	static uint8_t iv8[8];
+	gnutls_datum_t iv = { iv8, 8 };
+	gnutls_datum_t key;
+	gnutls_cipher_hd_t ctx;
+	uint8_t key2[8];
+	uint8_t outb[8];
+	int ret;
+
+	memset(out, 0, 8);
+
+	str_to_key(key_in, key2);
+
+	key.data = key2;
+	key.size = 8;
+
+	ret = gnutls_global_init();
+	if (ret != 0) {
+		return ret;
+	}
+
+	ret = gnutls_cipher_init(&ctx, GNUTLS_CIPHER_DES_CBC, &key, &iv);
+	if (ret != 0) {
+		return ret;
+	}
+
+	memcpy(outb, in, 8);
+	if (enc) {
+		ret = gnutls_cipher_encrypt(ctx, outb, 8);
+	} else {
+		ret = gnutls_cipher_decrypt(ctx, outb, 8);
+	}
+
+	if (ret == 0) {
+		memcpy(out, outb, 8);
+	}
+
+	gnutls_cipher_deinit(ctx);
+
+	return ret;
+}
+
+ /*
+   basic des crypt using a 56 bit (7 byte) key
+ */
+-- 
+2.22.0
+
+
+From 6d6651213f391840e3004ec3b055f8f25be9b360 Mon Sep 17 00:00:00 2001
+From: Isaac Boukris <iboukris@gmail.com>
+Date: Mon, 21 Oct 2019 20:03:04 +0300
+Subject: [PATCH 2/2] smbdes: use the new des_crypt56_gnutls()
+
+and remove builtin DES crypto.
+
+Signed-off-by: Isaac Boukris <iboukris@gmail.com>
+---
+ libcli/auth/smbdes.c | 258 +------------------------------------------
+ 1 file changed, 1 insertion(+), 257 deletions(-)
+
+diff --git a/libcli/auth/smbdes.c b/libcli/auth/smbdes.c
+index 37ede91ad22..7de05b75303 100644
+--- a/libcli/auth/smbdes.c
+++ b/libcli/auth/smbdes.c
+@@ -26,239 +26,6 @@
+ #include <gnutls/gnutls.h>
+ #include <gnutls/crypto.h>
+ 
+-/* NOTES: 
+-
+-   This code makes no attempt to be fast! In fact, it is a very
+-   slow implementation 
+-
+-   This code is NOT a complete DES implementation. It implements only
+-   the minimum necessary for SMB authentication, as used by all SMB
+-   products (including every copy of Microsoft Windows95 ever sold)
+-
+-   In particular, it can only do a unchained forward DES pass. This
+-   means it is not possible to use this code for encryption/decryption
+-   of data, instead it is only useful as a "hash" algorithm.
+-
+-   There is no entry point into this code that allows normal DES operation.
+-
+-   I believe this means that this code does not come under ITAR
+-   regulations but this is NOT a legal opinion. If you are concerned
+-   about the applicability of ITAR regulations to this code then you
+-   should confirm it for yourself (and maybe let me know if you come
+-   up with a different answer to the one above)
+-*/
+-
+-
+-static const uint8_t perm1[56] = {57, 49, 41, 33, 25, 17,  9,
+-			 1, 58, 50, 42, 34, 26, 18,
+-			10,  2, 59, 51, 43, 35, 27,
+-			19, 11,  3, 60, 52, 44, 36,
+-			63, 55, 47, 39, 31, 23, 15,
+-			 7, 62, 54, 46, 38, 30, 22,
+-			14,  6, 61, 53, 45, 37, 29,
+-			21, 13,  5, 28, 20, 12,  4};
+-
+-static const uint8_t perm2[48] = {14, 17, 11, 24,  1,  5,
+-                         3, 28, 15,  6, 21, 10,
+-                        23, 19, 12,  4, 26,  8,
+-                        16,  7, 27, 20, 13,  2,
+-                        41, 52, 31, 37, 47, 55,
+-                        30, 40, 51, 45, 33, 48,
+-                        44, 49, 39, 56, 34, 53,
+-                        46, 42, 50, 36, 29, 32};
+-
+-static const uint8_t perm3[64] = {58, 50, 42, 34, 26, 18, 10,  2,
+-			60, 52, 44, 36, 28, 20, 12,  4,
+-			62, 54, 46, 38, 30, 22, 14,  6,
+-			64, 56, 48, 40, 32, 24, 16,  8,
+-			57, 49, 41, 33, 25, 17,  9,  1,
+-			59, 51, 43, 35, 27, 19, 11,  3,
+-			61, 53, 45, 37, 29, 21, 13,  5,
+-			63, 55, 47, 39, 31, 23, 15,  7};
+-
+-static const uint8_t perm4[48] = {   32,  1,  2,  3,  4,  5,
+-                            4,  5,  6,  7,  8,  9,
+-                            8,  9, 10, 11, 12, 13,
+-                           12, 13, 14, 15, 16, 17,
+-                           16, 17, 18, 19, 20, 21,
+-                           20, 21, 22, 23, 24, 25,
+-                           24, 25, 26, 27, 28, 29,
+-                           28, 29, 30, 31, 32,  1};
+-
+-static const uint8_t perm5[32] = {      16,  7, 20, 21,
+-                              29, 12, 28, 17,
+-                               1, 15, 23, 26,
+-                               5, 18, 31, 10,
+-                               2,  8, 24, 14,
+-                              32, 27,  3,  9,
+-                              19, 13, 30,  6,
+-                              22, 11,  4, 25};
+-
+-
+-static const uint8_t perm6[64] ={ 40,  8, 48, 16, 56, 24, 64, 32,
+-                        39,  7, 47, 15, 55, 23, 63, 31,
+-                        38,  6, 46, 14, 54, 22, 62, 30,
+-                        37,  5, 45, 13, 53, 21, 61, 29,
+-                        36,  4, 44, 12, 52, 20, 60, 28,
+-                        35,  3, 43, 11, 51, 19, 59, 27,
+-                        34,  2, 42, 10, 50, 18, 58, 26,
+-                        33,  1, 41,  9, 49, 17, 57, 25};
+-
+-
+-static const uint8_t sc[16] = {1, 1, 2, 2, 2, 2, 2, 2, 1, 2, 2, 2, 2, 2, 2, 1};
+-
+-static const uint8_t sbox[8][4][16] = {
+-	{{14,  4, 13,  1,  2, 15, 11,  8,  3, 10,  6, 12,  5,  9,  0,  7},
+-	 {0, 15,  7,  4, 14,  2, 13,  1, 10,  6, 12, 11,  9,  5,  3,  8},
+-	 {4,  1, 14,  8, 13,  6,  2, 11, 15, 12,  9,  7,  3, 10,  5,  0},
+-	 {15, 12,  8,  2,  4,  9,  1,  7,  5, 11,  3, 14, 10,  0,  6, 13}},
+-
+-	{{15,  1,  8, 14,  6, 11,  3,  4,  9,  7,  2, 13, 12,  0,  5, 10},
+-	 {3, 13,  4,  7, 15,  2,  8, 14, 12,  0,  1, 10,  6,  9, 11,  5},
+-	 {0, 14,  7, 11, 10,  4, 13,  1,  5,  8, 12,  6,  9,  3,  2, 15},
+-	 {13,  8, 10,  1,  3, 15,  4,  2, 11,  6,  7, 12,  0,  5, 14,  9}},
+-
+-	{{10,  0,  9, 14,  6,  3, 15,  5,  1, 13, 12,  7, 11,  4,  2,  8},
+-	 {13,  7,  0,  9,  3,  4,  6, 10,  2,  8,  5, 14, 12, 11, 15,  1},
+-	 {13,  6,  4,  9,  8, 15,  3,  0, 11,  1,  2, 12,  5, 10, 14,  7},
+-	 {1, 10, 13,  0,  6,  9,  8,  7,  4, 15, 14,  3, 11,  5,  2, 12}},
+-
+-	{{7, 13, 14,  3,  0,  6,  9, 10,  1,  2,  8,  5, 11, 12,  4, 15},
+-	 {13,  8, 11,  5,  6, 15,  0,  3,  4,  7,  2, 12,  1, 10, 14,  9},
+-	 {10,  6,  9,  0, 12, 11,  7, 13, 15,  1,  3, 14,  5,  2,  8,  4},
+-	 {3, 15,  0,  6, 10,  1, 13,  8,  9,  4,  5, 11, 12,  7,  2, 14}},
+-
+-	{{2, 12,  4,  1,  7, 10, 11,  6,  8,  5,  3, 15, 13,  0, 14,  9},
+-	 {14, 11,  2, 12,  4,  7, 13,  1,  5,  0, 15, 10,  3,  9,  8,  6},
+-	 {4,  2,  1, 11, 10, 13,  7,  8, 15,  9, 12,  5,  6,  3,  0, 14},
+-	 {11,  8, 12,  7,  1, 14,  2, 13,  6, 15,  0,  9, 10,  4,  5,  3}},
+-
+-	{{12,  1, 10, 15,  9,  2,  6,  8,  0, 13,  3,  4, 14,  7,  5, 11},
+-	 {10, 15,  4,  2,  7, 12,  9,  5,  6,  1, 13, 14,  0, 11,  3,  8},
+-	 {9, 14, 15,  5,  2,  8, 12,  3,  7,  0,  4, 10,  1, 13, 11,  6},
+-	 {4,  3,  2, 12,  9,  5, 15, 10, 11, 14,  1,  7,  6,  0,  8, 13}},
+-
+-	{{4, 11,  2, 14, 15,  0,  8, 13,  3, 12,  9,  7,  5, 10,  6,  1},
+-	 {13,  0, 11,  7,  4,  9,  1, 10, 14,  3,  5, 12,  2, 15,  8,  6},
+-	 {1,  4, 11, 13, 12,  3,  7, 14, 10, 15,  6,  8,  0,  5,  9,  2},
+-	 {6, 11, 13,  8,  1,  4, 10,  7,  9,  5,  0, 15, 14,  2,  3, 12}},
+-
+-	{{13,  2,  8,  4,  6, 15, 11,  1, 10,  9,  3, 14,  5,  0, 12,  7},
+-	 {1, 15, 13,  8, 10,  3,  7,  4, 12,  5,  6, 11,  0, 14,  9,  2},
+-	 {7, 11,  4,  1,  9, 12, 14,  2,  0,  6, 10, 13, 15,  3,  5,  8},
+-	 {2,  1, 14,  7,  4, 10,  8, 13, 15, 12,  9,  0,  3,  5,  6, 11}}};
+-
+-static void permute(char *out, const char *in, const uint8_t *p, int n)
+-{
+-	int i;
+-	for (i=0;i<n;i++)
+-		out[i] = in[p[i]-1];
+-}
+-
+-static void lshift(char *d, int count, int n)
+-{
+-	char out[64];
+-	int i;
+-	for (i=0;i<n;i++)
+-		out[i] = d[(i+count)%n];
+-	for (i=0;i<n;i++)
+-		d[i] = out[i];
+-}
+-
+-static void concat(char *out, char *in1, char *in2, int l1, int l2)
+-{
+-	while (l1--)
+-		*out++ = *in1++;
+-	while (l2--)
+-		*out++ = *in2++;
+-}
+-
+-static void xor(char *out, char *in1, char *in2, int n)
+-{
+-	int i;
+-	for (i=0;i<n;i++)
+-		out[i] = in1[i] ^ in2[i];
+-}
+-
+-static void dohash(char *out, char *in, char *key, int forw)
+-{
+-	int i, j, k;
+-	char pk1[56];
+-	char c[28];
+-	char d[28];
+-	char cd[56];
+-	char ki[16][48];
+-	char pd1[64];
+-	char l[32], r[32];
+-	char rl[64];
+-
+-	permute(pk1, key, perm1, 56);
+-
+-	for (i=0;i<28;i++)
+-		c[i] = pk1[i];
+-	for (i=0;i<28;i++)
+-		d[i] = pk1[i+28];
+-
+-	for (i=0;i<16;i++) {
+-		lshift(c, sc[i], 28);
+-		lshift(d, sc[i], 28);
+-
+-		concat(cd, c, d, 28, 28); 
+-		permute(ki[i], cd, perm2, 48); 
+-	}
+-
+-	permute(pd1, in, perm3, 64);
+-
+-	for (j=0;j<32;j++) {
+-		l[j] = pd1[j];
+-		r[j] = pd1[j+32];
+-	}
+-
+-	for (i=0;i<16;i++) {
+-		char er[48];
+-		char erk[48];
+-		char b[8][6];
+-		char cb[32];
+-		char pcb[32];
+-		char r2[32];
+-
+-		permute(er, r, perm4, 48);
+-
+-		xor(erk, er, ki[forw ? i : 15 - i], 48);
+-
+-		for (j=0;j<8;j++)
+-			for (k=0;k<6;k++)
+-				b[j][k] = erk[j*6 + k];
+-
+-		for (j=0;j<8;j++) {
+-			int m, n;
+-			m = (b[j][0]<<1) | b[j][5];
+-
+-			n = (b[j][1]<<3) | (b[j][2]<<2) | (b[j][3]<<1) | b[j][4]; 
+-
+-			for (k=0;k<4;k++) 
+-				b[j][k] = (sbox[j][m][n] & (1<<(3-k)))?1:0; 
+-		}
+-
+-		for (j=0;j<8;j++)
+-			for (k=0;k<4;k++)
+-				cb[j*4+k] = b[j][k];
+-		permute(pcb, cb, perm5, 32);
+-
+-		xor(r2, l, pcb, 32);
+-
+-		for (j=0;j<32;j++)
+-			l[j] = r[j];
+-
+-		for (j=0;j<32;j++)
+-			r[j] = r2[j];
+-	}
+-
+-	concat(rl, r, l, 32, 32);
+-
+-	permute(out, rl, perm6, 64);
+-}
+-
+ static void str_to_key(const uint8_t *str,uint8_t *key)
+ {
+ 	int i;
+@@ -325,30 +92,7 @@ static int des_crypt56_gnutls(uint8_t out[8], const uint8_t in[8],
+ */
+ void des_crypt56(uint8_t out[8], const uint8_t in[8], const uint8_t key[7], int forw)
+ {
+-	int i;
+-	char outb[64];
+-	char inb[64];
+-	char keyb[64];
+-	uint8_t key2[8];
+-
+-	str_to_key(key, key2);
+-
+-	for (i=0;i<64;i++) {
+-		inb[i] = (in[i/8] & (1<<(7-(i%8)))) ? 1 : 0;
+-		keyb[i] = (key2[i/8] & (1<<(7-(i%8)))) ? 1 : 0;
+-		outb[i] = 0;
+-	}
+-
+-	dohash(outb, inb, keyb, forw);
+-
+-	for (i=0;i<8;i++) {
+-		out[i] = 0;
+-	}
+-
+-	for (i=0;i<64;i++) {
+-		if (outb[i])
+-			out[i/8] |= (1<<(7-(i%8)));
+-	}
+	(void)des_crypt56_gnutls(out, in, key, forw);
+ }
+ 
+ void E_P16(const uint8_t *p14,uint8_t *p16)
+-- 
+2.22.0
+
--- a/0001-handle-removal-des-enctypes-from-krb5.patch
+++ b/0001-handle-removal-des-enctypes-from-krb5.patch
@ -0,0 +1,314 @@
+From 3828e798da8e0b44356039dd927f0624d5d182f9 Mon Sep 17 00:00:00 2001
+From: Isaac Boukris <iboukris@gmail.com>
+Date: Wed, 6 Nov 2019 12:12:55 +0200
+Subject: [PATCH] Remove DES support if MIT Kerberos version does not support
+ it
+
+---
+ source3/libads/kerberos_keytab.c              |  2 -
+ source3/passdb/machine_account_secrets.c      | 36 ------------------
+ source4/auth/kerberos/kerberos.h              |  2 +-
+ .../dsdb/samdb/ldb_modules/password_hash.c    | 12 ++++++
+ source4/kdc/db-glue.c                         |  4 +-
+ source4/torture/rpc/remote_pac.c              | 37 -------------------
+ testprogs/blackbox/dbcheck-oldrelease.sh      |  2 +-
+ testprogs/blackbox/functionalprep.sh          |  2 +-
+ .../blackbox/test_export_keytab_heimdal.sh    | 16 ++++----
+ .../blackbox/upgradeprovision-oldrelease.sh   |  2 +-
+ 10 files changed, 26 insertions(+), 89 deletions(-)
+
+diff --git a/source3/libads/kerberos_keytab.c b/source3/libads/kerberos_keytab.c
+index 97d5535041c..7d193e1a600 100644
+--- a/source3/libads/kerberos_keytab.c
+++ b/source3/libads/kerberos_keytab.c
+@@ -240,8 +240,6 @@ int ads_keytab_add_entry(ADS_STRUCT *ads, const char *srvPrinc, bool update_ads)
+ 	krb5_data password;
+ 	krb5_kvno kvno;
+         krb5_enctype enctypes[6] = {
+-		ENCTYPE_DES_CBC_CRC,
+-		ENCTYPE_DES_CBC_MD5,
+ #ifdef HAVE_ENCTYPE_AES128_CTS_HMAC_SHA1_96
+ 		ENCTYPE_AES128_CTS_HMAC_SHA1_96,
+ #endif
+diff --git a/source3/passdb/machine_account_secrets.c b/source3/passdb/machine_account_secrets.c
+index dfc21f295a1..efba80f1474 100644
+--- a/source3/passdb/machine_account_secrets.c
+++ b/source3/passdb/machine_account_secrets.c
+@@ -1031,7 +1031,6 @@ static int secrets_domain_info_kerberos_keys(struct secrets_domain_info1_passwor
+ 	krb5_keyblock key;
+ 	DATA_BLOB aes_256_b = data_blob_null;
+ 	DATA_BLOB aes_128_b = data_blob_null;
+-	DATA_BLOB des_md5_b = data_blob_null;
+ 	bool ok;
+ #endif /* HAVE_ADS */
+ 	DATA_BLOB arc4_b = data_blob_null;
+@@ -1177,32 +1176,6 @@ static int secrets_domain_info_kerberos_keys(struct secrets_domain_info1_passwor
+ 		return ENOMEM;
+ 	}
+ 
+-	krb5_ret = smb_krb5_create_key_from_string(krb5_ctx,
+-						   NULL,
+-						   &salt,
+-						   &cleartext_utf8,
+-						   ENCTYPE_DES_CBC_MD5,
+-						   &key);
+-	if (krb5_ret != 0) {
+-		DBG_ERR("generation of a des-cbc-md5 key failed: %s\n",
+-			smb_get_krb5_error_message(krb5_ctx, krb5_ret, keys));
+-		krb5_free_context(krb5_ctx);
+-		TALLOC_FREE(keys);
+-		TALLOC_FREE(salt_data);
+-		return krb5_ret;
+-	}
+-	des_md5_b = data_blob_talloc(keys,
+-				     KRB5_KEY_DATA(&key),
+-				     KRB5_KEY_LENGTH(&key));
+-	krb5_free_keyblock_contents(krb5_ctx, &key);
+-	if (des_md5_b.data == NULL) {
+-		DBG_ERR("data_blob_talloc failed for des-cbc-md5.\n");
+-		krb5_free_context(krb5_ctx);
+-		TALLOC_FREE(keys);
+-		TALLOC_FREE(salt_data);
+-		return ENOMEM;
+-	}
+-
+ 	krb5_free_context(krb5_ctx);
+ no_kerberos:
+ 
+@@ -1227,15 +1200,6 @@ no_kerberos:
+ 	keys[idx].value			= arc4_b;
+ 	idx += 1;
+ 
+-#ifdef HAVE_ADS
+-	if (des_md5_b.length != 0) {
+-		keys[idx].keytype		= ENCTYPE_DES_CBC_MD5;
+-		keys[idx].iteration_count	= 4096;
+-		keys[idx].value			= des_md5_b;
+-		idx += 1;
+-	}
+-#endif /* HAVE_ADS */
+-
+ 	p->salt_data = salt_data;
+ 	p->default_iteration_count = 4096;
+ 	p->num_keys = idx;
+diff --git a/source4/auth/kerberos/kerberos.h b/source4/auth/kerberos/kerberos.h
+index 2ff9e3868af..1dd63acc838 100644
+--- a/source4/auth/kerberos/kerberos.h
+++ b/source4/auth/kerberos/kerberos.h
+@@ -50,7 +50,7 @@ struct keytab_container {
+ #define TOK_ID_GSS_GETMIC	((const uint8_t *)"\x01\x01")
+ #define TOK_ID_GSS_WRAP		((const uint8_t *)"\x02\x01")
+ 
+-#define ENC_ALL_TYPES (ENC_CRC32 | ENC_RSA_MD5 | ENC_RC4_HMAC_MD5 |	\
+#define ENC_ALL_TYPES (ENC_RC4_HMAC_MD5 |	\
+ 		       ENC_HMAC_SHA1_96_AES128 | ENC_HMAC_SHA1_96_AES256)
+ 
+ #ifndef HAVE_KRB5_SET_DEFAULT_TGS_KTYPES
+diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c
+index 006e35c46d5..f16937c6cab 100644
+--- a/source4/dsdb/samdb/ldb_modules/password_hash.c
+++ b/source4/dsdb/samdb/ldb_modules/password_hash.c
+@@ -786,6 +786,7 @@ static int setup_kerberos_keys(struct setup_password_fields_io *io)
+ 	 * create ENCTYPE_DES_CBC_MD5 key out of
+ 	 * the salt and the cleartext password
+ 	 */
+#ifdef SAMBA4_USES_HEIMDAL
+ 	krb5_ret = smb_krb5_create_key_from_string(io->smb_krb5_context->krb5_context,
+ 						   NULL,
+ 						   &salt,
+@@ -804,6 +805,11 @@ static int setup_kerberos_keys(struct setup_password_fields_io *io)
+ 					 KRB5_KEY_DATA(&key),
+ 					 KRB5_KEY_LENGTH(&key));
+ 	krb5_free_keyblock_contents(io->smb_krb5_context->krb5_context, &key);
+#else
+	/* MIT has dropped support for DES enctypes, store a random key instead. */
+	io->g.des_md5 = data_blob_talloc(io->ac, NULL, 8);
+	generate_secret_buffer(io->g.des_md5.data, 8);
+#endif
+ 	if (!io->g.des_md5.data) {
+ 		return ldb_oom(ldb);
+ 	}
+@@ -812,6 +818,7 @@ static int setup_kerberos_keys(struct setup_password_fields_io *io)
+ 	 * create ENCTYPE_DES_CBC_CRC key out of
+ 	 * the salt and the cleartext password
+ 	 */
+#ifdef SAMBA4_USES_HEIMDAL
+ 	krb5_ret = smb_krb5_create_key_from_string(io->smb_krb5_context->krb5_context,
+ 						   NULL,
+ 						   &salt,
+@@ -830,6 +837,11 @@ static int setup_kerberos_keys(struct setup_password_fields_io *io)
+ 					 KRB5_KEY_DATA(&key),
+ 					 KRB5_KEY_LENGTH(&key));
+ 	krb5_free_keyblock_contents(io->smb_krb5_context->krb5_context, &key);
+#else
+	/* MIT has dropped support for DES enctypes, store a random key instead. */
+	io->g.des_crc = data_blob_talloc(io->ac, NULL, 8);
+	generate_secret_buffer(io->g.des_crc.data, 8);
+#endif
+ 	if (!io->g.des_crc.data) {
+ 		return ldb_oom(ldb);
+ 	}
+diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c
+index f62a633c6c7..023ae7b580d 100644
+--- a/source4/kdc/db-glue.c
+++ b/source4/kdc/db-glue.c
+@@ -359,10 +359,10 @@ static krb5_error_code samba_kdc_message2entry_keys(krb5_context context,
+ 
+ 	/* If UF_USE_DES_KEY_ONLY has been set, then don't allow use of the newer enc types */
+ 	if (userAccountControl & UF_USE_DES_KEY_ONLY) {
+-		supported_enctypes = ENC_CRC32|ENC_RSA_MD5;
+		supported_enctypes = 0;
+ 	} else {
+ 		/* Otherwise, add in the default enc types */
+-		supported_enctypes |= ENC_CRC32 | ENC_RSA_MD5 | ENC_RC4_HMAC_MD5;
+		supported_enctypes |= ENC_RC4_HMAC_MD5;
+ 	}
+ 
+ 	/* Is this the krbtgt or a RODC krbtgt */
+diff --git a/source4/torture/rpc/remote_pac.c b/source4/torture/rpc/remote_pac.c
+index 7a5cda74b74..f12060e3c8f 100644
+--- a/source4/torture/rpc/remote_pac.c
+++ b/source4/torture/rpc/remote_pac.c
+@@ -38,7 +38,6 @@
+ 
+ #define TEST_MACHINE_NAME_BDC "torturepacbdc"
+ #define TEST_MACHINE_NAME_WKSTA "torturepacwksta"
+-#define TEST_MACHINE_NAME_WKSTA_DES "torturepacwkdes"
+ #define TEST_MACHINE_NAME_S4U2SELF_BDC "tests4u2selfbdc"
+ #define TEST_MACHINE_NAME_S4U2SELF_WKSTA "tests4u2selfwk"
+ 
+@@ -581,39 +580,6 @@ static bool test_PACVerify_workstation_aes(struct torture_context *tctx,
+ 			      NETLOGON_NEG_AUTH2_ADS_FLAGS | NETLOGON_NEG_SUPPORTS_AES);
+ }
+ 
+-static bool test_PACVerify_workstation_des(struct torture_context *tctx,
+-					   struct dcerpc_pipe *p, struct cli_credentials *credentials, struct test_join *join_ctx)
+-{
+-	struct samr_SetUserInfo r;
+-	union samr_UserInfo user_info;
+-	struct dcerpc_pipe *samr_pipe = torture_join_samr_pipe(join_ctx);
+-	struct smb_krb5_context *smb_krb5_context;
+-	krb5_error_code ret;
+-
+-	ret = cli_credentials_get_krb5_context(popt_get_cmdline_credentials(),
+-			tctx->lp_ctx, &smb_krb5_context);
+-	torture_assert_int_equal(tctx, ret, 0, "cli_credentials_get_krb5_context() failed");
+-
+-	if (smb_krb5_get_allowed_weak_crypto(smb_krb5_context->krb5_context) == FALSE) {
+-		torture_skip(tctx, "Cannot test DES without [libdefaults] allow_weak_crypto = yes");
+-	}
+-
+-	/* Mark this workstation with DES-only */
+-	user_info.info16.acct_flags = ACB_USE_DES_KEY_ONLY | ACB_WSTRUST;
+-	r.in.user_handle = torture_join_samr_user_policy(join_ctx);
+-	r.in.level = 16;
+-	r.in.info = &user_info;
+-
+-	torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo_r(samr_pipe->binding_handle, tctx, &r),
+-		"failed to set DES info account flags");
+-	torture_assert_ntstatus_ok(tctx, r.out.result,
+-		"failed to set DES into account flags");
+-
+-	return test_PACVerify(tctx, p, credentials, SEC_CHAN_WKSTA,
+-			      TEST_MACHINE_NAME_WKSTA_DES,
+-			      NETLOGON_NEG_AUTH2_ADS_FLAGS);
+-}
+-
+ #ifdef SAMBA4_USES_HEIMDAL
+ static NTSTATUS check_primary_group_in_validation(TALLOC_CTX *mem_ctx,
+ 						  uint16_t validation_level,
+@@ -1000,9 +966,6 @@ struct torture_suite *torture_rpc_remote_pac(TALLOC_CTX *mem_ctx)
+ 								      &ndr_table_netlogon, TEST_MACHINE_NAME_WKSTA);
+ 	torture_rpc_tcase_add_test_creds(tcase, "verify-sig-aes", test_PACVerify_workstation_aes);
+ 
+-	tcase = torture_suite_add_machine_workstation_rpc_iface_tcase(suite, "netlogon-member-des",
+-								      &ndr_table_netlogon, TEST_MACHINE_NAME_WKSTA_DES);
+-	torture_rpc_tcase_add_test_join(tcase, "verify-sig", test_PACVerify_workstation_des);
+ #ifdef SAMBA4_USES_HEIMDAL
+ 	tcase = torture_suite_add_machine_bdc_rpc_iface_tcase(suite, "netr-bdc-arcfour",
+ 							      &ndr_table_netlogon, TEST_MACHINE_NAME_S4U2SELF_BDC);
+diff --git a/testprogs/blackbox/dbcheck-oldrelease.sh b/testprogs/blackbox/dbcheck-oldrelease.sh
+index 3d0ee2c165a..41c55178d4e 100755
+--- a/testprogs/blackbox/dbcheck-oldrelease.sh
+++ b/testprogs/blackbox/dbcheck-oldrelease.sh
+@@ -388,7 +388,7 @@ referenceprovision() {
+ 
+ ldapcmp() {
+     if [ x$RELEASE = x"release-4-0-0" ]; then
+-         $PYTHON $BINDIR/samba-tool ldapcmp tdb://$PREFIX_ABS/${RELEASE}_reference/private/sam.ldb tdb://$PREFIX_ABS/${RELEASE}/private/sam.ldb --two --skip-missing-dn --filter=dnsRecord,displayName
+         $PYTHON $BINDIR/samba-tool ldapcmp tdb://$PREFIX_ABS/${RELEASE}_reference/private/sam.ldb tdb://$PREFIX_ABS/${RELEASE}/private/sam.ldb --two --skip-missing-dn --filter=dnsRecord,displayName,msDS-SupportedEncryptionTypes
+     fi
+ }
+ 
+diff --git a/testprogs/blackbox/functionalprep.sh b/testprogs/blackbox/functionalprep.sh
+index 80e82252d45..1d37611ef7a 100755
+--- a/testprogs/blackbox/functionalprep.sh
+++ b/testprogs/blackbox/functionalprep.sh
+@@ -61,7 +61,7 @@ provision_2012r2() {
+ ldapcmp_ignore() {
+     # At some point we will need to ignore, but right now, it should be perfect
+     IGNORE_ATTRS=$1
+-    $PYTHON $BINDIR/samba-tool ldapcmp tdb://$PREFIX_ABS/$2/private/sam.ldb tdb://$PREFIX_ABS/$3/private/sam.ldb --two --skip-missing-dn
+    $PYTHON $BINDIR/samba-tool ldapcmp tdb://$PREFIX_ABS/$2/private/sam.ldb tdb://$PREFIX_ABS/$3/private/sam.ldb --two --skip-missing-dn --filter msDS-SupportedEncryptionTypes
+ }
+ 
+ ldapcmp() {
+diff --git a/testprogs/blackbox/test_export_keytab_heimdal.sh b/testprogs/blackbox/test_export_keytab_heimdal.sh
+index cfa245fd4de..6a2595cd684 100755
+--- a/testprogs/blackbox/test_export_keytab_heimdal.sh
+++ b/testprogs/blackbox/test_export_keytab_heimdal.sh
+@@ -43,7 +43,7 @@ test_keytab() {
+ 
+ 	echo "test: $testname"
+ 
+-	NKEYS=$($VALGRIND $samba4ktutil $keytab | grep -i "$principal" | egrep -c "des|aes|arcfour")
+	NKEYS=$($VALGRIND $samba4ktutil $keytab | grep -i "$principal" | egrep -c "aes|arcfour")
+ 	status=$?
+ 	if [ x$status != x0 ]; then
+ 		echo "failure: $testname"
+@@ -64,22 +64,22 @@ unc="//$SERVER/tmp"
+ testit "create user locally" $VALGRIND $PYTHON $newuser nettestuser $USERPASS $@ || failed=`expr $failed + 1`
+ 
+ testit "dump keytab from domain" $VALGRIND $PYTHON $samba_tool domain exportkeytab $PREFIX/tmpkeytab $@ || failed=`expr $failed + 1`
+-test_keytab "read keytab from domain" "$PREFIX/tmpkeytab" "$SERVER\\\$" 5
+test_keytab "read keytab from domain" "$PREFIX/tmpkeytab" "$SERVER\\\$" 3
+ testit "dump keytab from domain (2nd time)" $VALGRIND $PYTHON $samba_tool domain exportkeytab $PREFIX/tmpkeytab $@ || failed=`expr $failed + 1`
+-test_keytab "read keytab from domain (2nd time)" "$PREFIX/tmpkeytab" "$SERVER\\\$" 5
+test_keytab "read keytab from domain (2nd time)" "$PREFIX/tmpkeytab" "$SERVER\\\$" 3
+ 
+ testit "dump keytab from domain for cifs principal" $VALGRIND $PYTHON $samba_tool domain exportkeytab $PREFIX/tmpkeytab-server --principal=cifs/$SERVER_FQDN $@ || failed=`expr $failed + 1`
+-test_keytab "read keytab from domain for cifs principal" "$PREFIX/tmpkeytab-server" "cifs/$SERVER_FQDN" 5
+test_keytab "read keytab from domain for cifs principal" "$PREFIX/tmpkeytab-server" "cifs/$SERVER_FQDN" 3
+ testit "dump keytab from domain for cifs principal (2nd time)" $VALGRIND $PYTHON $samba_tool domain exportkeytab $PREFIX/tmpkeytab-server --principal=cifs/$SERVER_FQDN $@ || failed=`expr $failed + 1`
+-test_keytab "read keytab from domain for cifs principal (2nd time)" "$PREFIX/tmpkeytab-server" "cifs/$SERVER_FQDN" 5
+test_keytab "read keytab from domain for cifs principal (2nd time)" "$PREFIX/tmpkeytab-server" "cifs/$SERVER_FQDN" 3
+ 
+ testit "dump keytab from domain for user principal" $VALGRIND $PYTHON $samba_tool domain exportkeytab $PREFIX/tmpkeytab-2 --principal=nettestuser $@ || failed=`expr $failed + 1`
+-test_keytab "dump keytab from domain for user principal" "$PREFIX/tmpkeytab-2" "nettestuser@$REALM" 5
+test_keytab "dump keytab from domain for user principal" "$PREFIX/tmpkeytab-2" "nettestuser@$REALM" 3
+ testit "dump keytab from domain for user principal (2nd time)" $VALGRIND $PYTHON $samba_tool domain exportkeytab $PREFIX/tmpkeytab-2 --principal=nettestuser@$REALM $@ || failed=`expr $failed + 1`
+-test_keytab "dump keytab from domain for user principal (2nd time)" "$PREFIX/tmpkeytab-2" "nettestuser@$REALM" 5
+test_keytab "dump keytab from domain for user principal (2nd time)" "$PREFIX/tmpkeytab-2" "nettestuser@$REALM" 3
+ 
+ testit "dump keytab from domain for user principal with SPN as UPN" $VALGRIND $PYTHON $samba_tool domain exportkeytab $PREFIX/tmpkeytab-3 --principal=http/testupnspn.$DNSDOMAIN $@ || failed=`expr $failed + 1`
+-test_keytab "dump keytab from domain for user principal" "$PREFIX/tmpkeytab-3" "http/testupnspn.$DNSDOMAIN@$REALM" 5
+test_keytab "dump keytab from domain for user principal" "$PREFIX/tmpkeytab-3" "http/testupnspn.$DNSDOMAIN@$REALM" 3
+ 
+ KRB5CCNAME="$PREFIX/tmpuserccache"
+ export KRB5CCNAME
+diff --git a/testprogs/blackbox/upgradeprovision-oldrelease.sh b/testprogs/blackbox/upgradeprovision-oldrelease.sh
+index 76276168011..208baa54a02 100755
+--- a/testprogs/blackbox/upgradeprovision-oldrelease.sh
+++ b/testprogs/blackbox/upgradeprovision-oldrelease.sh
+@@ -106,7 +106,7 @@ referenceprovision() {
+ 
+ ldapcmp() {
+     if [ x$RELEASE != x"alpha13" ]; then
+-         $PYTHON $BINDIR/samba-tool ldapcmp tdb://$PREFIX_ABS/${RELEASE}_upgrade_reference/private/sam.ldb tdb://$PREFIX_ABS/${RELEASE}_upgrade/private/sam.ldb --two --skip-missing-dn --filter=dnsRecord,displayName
+         $PYTHON $BINDIR/samba-tool ldapcmp tdb://$PREFIX_ABS/${RELEASE}_upgrade_reference/private/sam.ldb tdb://$PREFIX_ABS/${RELEASE}_upgrade/private/sam.ldb --two --skip-missing-dn --filter=dnsRecord,displayName,msDS-SupportedEncryptionTypes
+     fi
+ }
+ 
+-- 
+2.23.0
+
--- a/0002-samba-tool-create-working-private-krb5.conf.patch
+++ b/0002-samba-tool-create-working-private-krb5.conf.patch
@ -0,0 +1,42 @@
+From 5a084994144704a6c146b94f8a22cf57ce08deab Mon Sep 17 00:00:00 2001
+From: Alexander Bokovoy <ab@samba.org>
+Date: Mon, 7 Oct 2019 18:24:28 +0300
+Subject: [PATCH] samba-tool: create working private krb5.conf
+
+DNS update tool uses private krb5.conf which should have enough details
+to authenticate with GSS-TSIG when running nsupdate.
+
+Unfortunately, the configuration we provide is not enough. We set
+defaults to not lookup REALM via DNS but at the same time we don't
+provide any realm definition. As result, MIT Kerberos cannot actually
+find a working realm for Samba AD deployment because it cannot query DNS
+for a realm discovery or pick it up from the configuration.
+
+Extend private krb5.conf with a realm definition that will allow MIT
+Kerberos to look up KDC over DNS.
+
+Signed-off-by: Alexander Bokovoy <ab@samba.org>
+Reviewed-by: Andreas Schneider <asn@samba.org>
+---
+ source4/setup/krb5.conf | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/source4/setup/krb5.conf b/source4/setup/krb5.conf
+index b1bf6cf907d..ad6f2818fb5 100644
+--- a/source4/setup/krb5.conf
+++ b/source4/setup/krb5.conf
+@@ -2,3 +2,11 @@
+ 	default_realm = ${REALM}
+ 	dns_lookup_realm = false
+ 	dns_lookup_kdc = true
+
+[realms]
+${REALM} = {
+	default_domain = ${DNSDOMAIN}
+}
+
+[domain_realm]
+	${HOSTNAME} = ${REALM}
+-- 
+2.21.0
+
--- a/samba-4.10.x-waf_update.patch
+++ b/samba-4.10.x-waf_update.patch
--- a/samba.logrotate
+++ b/samba.logrotate
@ -1,7 +1,10 @@
-/var/log/samba/* {
+/var/log/samba/log.* {
+    compress
+    dateext
+    maxage 365
+    rotate 99
    notifempty
    olddir /var/log/samba/old
    missingok
-    sharedscripts
    copytruncate
 }
--- a/samba.spec
+++ b/samba.spec
@ -8,11 +8,12 @@

 %define main_release 0

-%define samba_version 4.10.6
-%define talloc_version 2.1.16
-%define tdb_version 1.3.18
-%define tevent_version 0.9.39
-%define ldb_version 1.5.5
+%define samba_version 4.11.15
+%define talloc_version 2.2.0
+%define tdb_version 1.4.2
+%define tevent_version 0.10.0
+%define ldb_version 2.0.12
+
 # This should be rc1 or nil
 %define pre_release %nil

@ -41,7 +42,9 @@
 %if 0%{?fedora}
 %ifarch aarch64 ppc64le s390x x86_64
 %global with_vfs_cephfs 1
+#endifarch
 %endif
+#endif fedora
 %endif

 %global with_vfs_glusterfs 1
@ -50,7 +53,9 @@
 # Only enable on x86_64
 %ifarch x86_64
 %global with_vfs_glusterfs 1
+#endif arch
 %endif
+#endif rhel
 %endif

 %global with_intel_aes_accel 0
@ -86,7 +91,7 @@

 Name:           samba
 Version:        %{samba_version}
-Release:        %{samba_release}.2
+Release:        %{samba_release}

 %if 0%{?rhel}
 Epoch:          0
@ -102,15 +107,15 @@ Epoch:          2

 Summary:        Server and Client software to interoperate with Windows machines
 License:        GPLv3+ and LGPLv3+
-URL:            http://www.samba.org/
+URL:            https://www.samba.org

 # This is a xz recompressed file of https://ftp.samba.org/pub/samba/samba-%%{version}%%{pre_release}.tar.gz
-Source0:        samba-%{version}%{pre_release}.tar.xz
+Source0:        https://ftp.samba.org/pub/samba/samba-%{version}%{pre_release}.tar.gz#/samba-%{version}%{pre_release}.tar.xz
 Source1:        https://ftp.samba.org/pub/samba/samba-%{version}%{pre_release}.tar.asc
 Source2:        gpgkey-52FBC0B86D954B0843324CDC6F33915B6568B7EA.gpg

 # Red Hat specific replacement-files
-Source10:       samba.log
+Source10:       samba.logrotate
 Source11:       smb.conf.vendor
 Source12:       smb.conf.example
 Source13:       pam_winbind.conf
@ -118,7 +123,9 @@ Source14:       samba.pamd

 Source201:      README.downgrade

-Patch0:         samba-4.10.x-waf_update.patch
+Patch100:       0000-use-gnutls-for-des-cbc.patch
+Patch101:       0001-handle-removal-des-enctypes-from-krb5.patch
+Patch102:       0002-samba-tool-create-working-private-krb5.conf.patch

 Requires(pre): /usr/sbin/groupadd
 Requires(post): systemd
@ -163,6 +170,7 @@ BuildRequires: docbook-style-xsl
 BuildRequires: e2fsprogs-devel
 BuildRequires: gawk
 BuildRequires: gnupg2
+BuildRequires: gnutls-devel >= 3.4.7
 BuildRequires: gpgme-devel
 BuildRequires: jansson-devel
 BuildRequires: krb5-devel >= %{required_mit_krb5}
@ -183,17 +191,9 @@ BuildRequires: pam-devel
 BuildRequires: perl-interpreter
 BuildRequires: perl-generators
 BuildRequires: perl(Archive::Tar)
-BuildRequires: perl(ExtUtils::MakeMaker)
-BuildRequires: perl(Parse::Yapp)
 BuildRequires: perl(Test::More)
 BuildRequires: popt-devel
 BuildRequires: python3-devel
-%if %{with_dc}
-# Add python3-iso8601 to avoid that the
-# version in Samba is being packaged
-BuildRequires: python3-iso8601
-BuildRequires: python3-subunit-test
-%endif # with_dc
 BuildRequires: quota-devel
 BuildRequires: readline-devel
 BuildRequires: rpcgen
@ -218,17 +218,17 @@ BuildRequires: libcephfs-devel
 %endif

 %if %{with_dc}
-BuildRequires: bind
-BuildRequires: gnutls-devel >= 3.4.7
-BuildRequires: krb5-server >= %{required_mit_krb5}
+# Add python3-iso8601 to avoid that the
+# version in Samba is being packaged
+BuildRequires: python3-iso8601

-# Required by samba-tool to run tests
-BuildRequires: python3-crypto
-%else
-BuildRequires: gnutls-devel >= 3.2.0
+BuildRequires: bind
+BuildRequires: krb5-server >= %{required_mit_krb5}
+#endif with_dc
 %endif

 # pidl requirements
+BuildRequires: perl(ExtUtils::MakeMaker)
 BuildRequires: perl(Parse::Yapp)

 BuildRequires: libtalloc-devel >= %{talloc_version}
@ -243,7 +243,7 @@ BuildRequires: python3-tdb >= %{tdb_version}
 BuildRequires: libldb-devel >= %{ldb_version}
 BuildRequires: python3-ldb-devel >= %{ldb_version}

-%if %{with testsuite}
+%if %{with testsuite} || %{with_dc}
 BuildRequires: ldb-tools
 BuildRequires: tdb-tools
 BuildRequires: python3-gpg
@ -310,6 +310,7 @@ Summary: Files used by both Samba servers and clients
 BuildArch: noarch

 Requires(post): systemd
+Recommends:     logrotate

 Provides: samba4-common = %{samba_depver}
 Obsoletes: samba4-common < %{samba_depver}
@ -358,6 +359,7 @@ SMB/CIFS clients.
 Summary: Samba AD Domain Controller
 Requires: %{name} = %{samba_depver}
 Requires: %{name}-libs = %{samba_depver}
+Requires: %{name}-dc-provision = %{samba_depver}
 Requires: %{name}-dc-libs = %{samba_depver}
 Requires: %{name}-winbind = %{samba_depver}
 # samba-tool needs tdbbackup
@ -381,6 +383,14 @@ Obsoletes: samba4-dc < %{samba_depver}
 %description dc
 The samba-dc package provides AD Domain Controller functionality

+### DC-PROVISION
+%package dc-provision
+Summary: Samba AD files to provision a DC
+BuildArch: noarch
+
+%description dc-provision
+The samba-dc-provision package provides files to setup a domain controller
+
 ### DC-LIBS
 %package dc-libs
 Summary: Samba AD Domain Controller Libraries
@ -405,7 +415,8 @@ Requires: bind
 %description dc-bind-dlz
 The %{name}-dc-bind-dlz package contains the libraries for bind to manage all
 name server related details of Samba AD.
-%endif # with_dc
+#endif with_dc
+%endif

 ### DEVEL
 %package devel
@ -430,6 +441,7 @@ Requires: %{name}-libs = %{samba_depver}

 %description vfs-cephfs
 Samba VFS module for Ceph distributed storage system integration.
+#endif with_vfs_cephfs
 %endif

 ### GLUSTER
@ -507,7 +519,8 @@ Requires: libsmbclient = %{samba_depver}
 The libsmbclient-devel package contains the header files and libraries needed
 to develop programs that link against the SMB client library in the Samba
 suite.
-%endif # with_libsmbclient
+#endif with_libsmbclient
+%endif

 ### LIBWBCLIENT
 %if %with_libwbclient
@ -529,7 +542,8 @@ Obsoletes: samba-winbind-devel < %{samba_depver}
 %description -n libwbclient-devel
 The libwbclient-devel package provides developer tools for the wbclient
 library.
-%endif # with_libwbclient
+#endif with_libwbclient
+%endif

 ### PYTHON3
 %package -n python3-%{name}
@ -610,7 +624,7 @@ Requires: libsmbclient = %{samba_depver}
 %if %with_libwbclient
 Requires: libwbclient = %{samba_depver}
 %endif
-Requires: python3-%{name} = %{version}-%{release}
+Requires: python3-%{name} = %{samba_depver}
 Requires: perl(Archive::Tar)

 Provides: samba4-test = %{samba_depver}
@ -651,6 +665,9 @@ Requires: libwbclient = %{samba_depver}
 Provides: samba4-winbind = %{samba_depver}
 Obsoletes: samba4-winbind < %{samba_depver}

+# Old NetworkManager expects the dispatcher scripts in a different place
+Conflicts: NetworkManager < 1.20
+
 %description winbind
 The samba-winbind package provides the winbind NSS library, and some client
 tools.  Winbind enables Linux to be a full member in Windows domains and to use
@ -770,7 +787,8 @@ CTDB is a cluster implementation of the TDB database used by Samba and other
 projects to store temporary data. If an application is already using TDB for
 temporary data it is very easy to convert that application to be cluster aware
 and use CTDB instead.
-%endif # with_clustering_support
+#endif with_clustering_support
+%endif



@ -837,7 +855,7 @@ export LDFLAGS="%{__global_ldflags} -fuse-ld=gold"
        --private-libraries=%{_samba_private_libraries} \
 %endif
        --with-system-mitkrb5 \
-	--with-experimental-mit-ad-dc \
+        --with-experimental-mit-ad-dc \
 %if ! %with_dc
        --without-ad-dc \
 %endif
@ -866,6 +884,12 @@ export LDFLAGS="%{__global_ldflags} -fuse-ld=gold"

 make %{?_smp_mflags}

+pushd pidl
+%__perl Makefile.PL PREFIX=%{_prefix}
+
+make %{?_smp_mflags}
+popd
+
 %install
 rm -rf %{buildroot}

@ -933,7 +957,7 @@ install -d -m 0755 %{buildroot}%{_sysconfdir}/sysconfig
 install -m 0644 packaging/systemd/samba.sysconfig %{buildroot}%{_sysconfdir}/sysconfig/samba
 %if %with_clustering_support
 cat > %{buildroot}%{_sysconfdir}/sysconfig/ctdb <<EOF
-# CTDB configuration is now in %{_sysconfdir}/ctdb/ctdb.conf
+# CTDB configuration is now in %%{_sysconfdir}/ctdb/ctdb.conf
 EOF

 install -d -m 0755 %{buildroot}%{_sysconfdir}/ctdb
@ -947,9 +971,9 @@ install -m 0644 ctdb/config/ctdb.service %{buildroot}%{_unitdir}
 %endif

 # NetworkManager online/offline script
-install -d -m 0755 %{buildroot}%{_sysconfdir}/NetworkManager/dispatcher.d/
+install -d -m 0755 %{buildroot}%{_prefix}/lib/NetworkManager/dispatcher.d/
 install -m 0755 packaging/NetworkManager/30-winbind-systemd \
-            %{buildroot}%{_sysconfdir}/NetworkManager/dispatcher.d/30-winbind
+            %{buildroot}%{_prefix}/lib/NetworkManager/dispatcher.d/30-winbind

 # winbind krb5 plugins
 install -d -m 0755 %{buildroot}%{_libdir}/krb5/plugins/libkrb5
@ -962,6 +986,7 @@ for i in \
    %{_libdir}/samba/libdsdb-garbage-collect-tombstones-samba4.so \
    %{_libdir}/samba/libscavenge-dns-records-samba4.so \
    %{_mandir}/man8/samba.8 \
+    %{_mandir}/man8/samba_downgrade_db.8 \
    %{_mandir}/man8/samba-tool.8 \
    %{_mandir}/man8/samba-gpupdate.8 \
    %{_libdir}/samba/ldb/ildap.so \
@ -1031,12 +1056,24 @@ for f in samba/libsamba-net-samba4.so \
         pkgconfig/samba-policy.pc ; do
    rm -f %{buildroot}%{_libdir}/$f
 done
-%endif # ! with_dc
+#endif ! with_dc
+%endif
+
+pushd pidl
+make DESTDIR=%{buildroot} install_vendor
+
+rm -f %{buildroot}%{perl_archlib}/perllocal.pod
+rm -f %{buildroot}%{perl_archlib}/vendor_perl/auto/Parse/Pidl/.packlist
+
+# Already packaged by perl Parse:Yapp
+rm -rf %{buildroot}%{perl_vendorlib}/Parse/Yapp
+popd

 %if %{with testsuite}
 %check
-TDB_NO_FSYNC=1 make %{?_smp_mflags} test
-%endif # with testsuite
+TDB_NO_FSYNC=1 make %{?_smp_mflags} test FAIL_IMMEDIATELY=1
+#endif with testsuite
+%endif

 %post
 %systemd_post smb.service
@ -1088,7 +1125,8 @@ fi

 %postun dc
 %systemd_postun_with_restart samba.service
-%endif # with_dc
+#endif with_dc
+%endif

 %post krb5-printing
 %{_sbindir}/update-alternatives --install %{_libexecdir}/samba/cups_backend_smb \
@ -1119,10 +1157,12 @@ fi
 %{?ldconfig}

 %preun -n libwbclient
-%{_sbindir}/update-alternatives \
-        --remove \
-        libwbclient.so.%{libwbc_alternatives_version}%{libwbc_alternatives_suffix} \
-        %{_libdir}/samba/wbclient/libwbclient.so.%{libwbc_alternatives_version}
+if [ $1 -eq 0 ]; then
+    %{_sbindir}/update-alternatives \
+            --remove \
+            libwbclient.so.%{libwbc_alternatives_version}%{libwbc_alternatives_suffix} \
+            %{_libdir}/samba/wbclient/libwbclient.so.%{libwbc_alternatives_version}
+fi
 /sbin/ldconfig

 %posttrans -n libwbclient-devel
@ -1138,13 +1178,21 @@ fi
 # When downgrading to a version where alternatives is not used and
 # libwbclient.so is a link and not a file it will be removed. The following
 # check removes the alternatives files manually if that is the case.
-if [ "`readlink %{_libdir}/libwbclient.so`" == "libwbclient.so.%{libwbc_alternatives_version}" ]; then
-    /bin/rm -f /etc/alternatives/libwbclient.so%{libwbc_alternatives_suffix} /var/lib/alternatives/libwbclient.so%{libwbc_alternatives_suffix} 2> /dev/null
-else
-    %{_sbindir}/update-alternatives --remove libwbclient.so%{libwbc_alternatives_suffix} %{_libdir}/samba/wbclient/libwbclient.so
+if [ $1 -eq 0 ]; then
+    if [ "`readlink %{_libdir}/libwbclient.so`" == "libwbclient.so.%{libwbc_alternatives_version}" ]; then
+        /bin/rm -f \
+            /etc/alternatives/libwbclient.so%{libwbc_alternatives_suffix} \
+            /var/lib/alternatives/libwbclient.so%{libwbc_alternatives_suffix} 2> /dev/null
+    else
+        %{_sbindir}/update-alternatives \
+            --remove \
+            libwbclient.so%{libwbc_alternatives_suffix} \
+            %{_libdir}/samba/wbclient/libwbclient.so
+    fi
 fi

-%endif # with_libwbclient
+#endif with_libwbclient
+%endif

 %ldconfig_scriptlets test

@ -1158,8 +1206,7 @@ fi
 %systemd_preun winbind.service

 %postun winbind
-%systemd_postun_with_restart smb.service
-%systemd_postun_with_restart nmb.service
+%systemd_postun_with_restart winbind.service

 %postun winbind-krb5-locator
 if [ "$1" -ge "1" ]; then
@ -1232,6 +1279,7 @@ fi
 %{_libdir}/samba/vfs/fileid.so
 %{_libdir}/samba/vfs/fruit.so
 %{_libdir}/samba/vfs/full_audit.so
+%{_libdir}/samba/vfs/gpfs.so
 %{_libdir}/samba/vfs/glusterfs_fuse.so
 %{_libdir}/samba/vfs/linux_xfs_sgid.so
 %{_libdir}/samba/vfs/media_harmony.so
@ -1281,6 +1329,7 @@ fi
 %{_mandir}/man8/vfs_fileid.8*
 %{_mandir}/man8/vfs_fruit.8*
 %{_mandir}/man8/vfs_full_audit.8*
+%{_mandir}/man8/vfs_gpfs.8*
 %{_mandir}/man8/vfs_glusterfs_fuse.8*
 %{_mandir}/man8/vfs_linux_xfs_sgid.8*
 %{_mandir}/man8/vfs_media_harmony.8*
@ -1309,12 +1358,14 @@ fi

 %if ! %{with_vfs_cephfs}
 %exclude %{_mandir}/man8/vfs_ceph.8*
+%exclude %{_mandir}/man8/vfs_ceph_snapshots.8*
 %endif

 %attr(775,root,printadmin) %dir /var/lib/samba/drivers

 ### CLIENT
 %files client
+%doc source3/client/README.smbspool
 %{_bindir}/cifsdd
 %{_bindir}/dbwrap_tool
 %{_bindir}/dumpmscat
@ -1386,6 +1437,7 @@ fi
 %dir %{_libdir}/samba
 %{_libdir}/samba/libCHARSET3-samba4.so
 %{_libdir}/samba/libMESSAGING-SEND-samba4.so
+%{_libdir}/samba/libMESSAGING-samba4.so
 %{_libdir}/samba/libaddns-samba4.so
 %{_libdir}/samba/libads-samba4.so
 %{_libdir}/samba/libasn1util-samba4.so
@ -1411,6 +1463,7 @@ fi
 %{_libdir}/samba/libgenrand-samba4.so
 %{_libdir}/samba/libgensec-samba4.so
 %{_libdir}/samba/libgpext-samba4.so
+%{_libdir}/samba/libgpo-samba4.so
 %{_libdir}/samba/libgse-samba4.so
 %{_libdir}/samba/libhttp-samba4.so
 %{_libdir}/samba/libinterfaces-samba4.so
@ -1431,6 +1484,7 @@ fi
 %{_libdir}/samba/libnetif-samba4.so
 %{_libdir}/samba/libnpa-tstream-samba4.so
 %{_libdir}/samba/libposix-eadb-samba4.so
+%{_libdir}/samba/libprinter-driver-samba4.so
 %{_libdir}/samba/libprinting-migrate-samba4.so
 %{_libdir}/samba/libreplace-samba4.so
 %{_libdir}/samba/libregistry-samba4.so
@ -1465,12 +1519,14 @@ fi
 %if ! %with_libwbclient
 %{_libdir}/samba/libwbclient.so.*
 %{_libdir}/samba/libwinbind-client-samba4.so
-%endif # ! with_libwbclient
+#endif ! with_libwbclient
+%endif

 %if ! %with_libsmbclient
 %{_libdir}/samba/libsmbclient.so.*
 %{_mandir}/man7/libsmbclient.7*
-%endif # ! with_libsmbclient
+#endif ! with_libsmbclient
+%endif

 ### COMMON
 %files common
@ -1530,9 +1586,10 @@ fi
 %{_unitdir}/samba.service
 %{_bindir}/samba-tool
 %{_sbindir}/samba
-%{_sbindir}/samba_kcc
 %{_sbindir}/samba_dnsupdate
+%{_sbindir}/samba_downgrade_db
 %{_sbindir}/samba-gpupdate
+%{_sbindir}/samba_kcc
 %{_sbindir}/samba_spnupdate
 %{_sbindir}/samba_upgradedns

@ -1546,6 +1603,7 @@ fi
 %{_libdir}/samba/ldb/aclread.so
 %{_libdir}/samba/ldb/anr.so
 %{_libdir}/samba/ldb/audit_log.so
+%{_libdir}/samba/ldb/count_attrs.so
 %{_libdir}/samba/ldb/descriptor.so
 %{_libdir}/samba/ldb/dirsync.so
 %{_libdir}/samba/ldb/dns_notify.so
@ -1593,11 +1651,15 @@ fi
 %{_libdir}/samba/ldb/wins_ldb.so
 %{_libdir}/samba/vfs/posix_eadb.so
 %dir /var/lib/samba/sysvol
-%{_datadir}/samba/setup
 %{_mandir}/man8/samba.8*
+%{_mandir}/man8/samba_downgrade_db.8*
 %{_mandir}/man8/samba-gpupdate.8*
 %{_mandir}/man8/samba-tool.8*

+%files dc-provision
+%license source4/setup/ad-schema/licence.txt
+%{_datadir}/samba/setup
+
 ### DC-LIBS
 %files dc-libs
 %{_libdir}/samba/libdb-glue-samba4.so
@ -1618,7 +1680,6 @@ fi
 %{_libdir}/samba/service/nbtd.so
 %{_libdir}/samba/service/ntp_signd.so
 %{_libdir}/samba/service/s3fs.so
-%{_libdir}/samba/service/web.so
 %{_libdir}/samba/service/winbindd.so
 %{_libdir}/samba/service/wrepl.so
 %{_libdir}/libdcerpc-server.so.*
@ -1636,7 +1697,8 @@ fi
 %{_libdir}/samba/bind9/dlz_bind9_10.so
 %{_libdir}/samba/bind9/dlz_bind9_11.so
 %{_libdir}/samba/bind9/dlz_bind9_12.so
-%endif # with_dc
+#endif with_dc
+%endif

 ### DEVEL
 %files devel
@ -1759,17 +1821,21 @@ fi

 %if ! %with_libsmbclient
 %{_includedir}/samba-4.0/libsmbclient.h
-%endif # ! with_libsmbclient
+#endif ! with_libsmbclient
+%endif

 %if ! %with_libwbclient
 %{_includedir}/samba-4.0/wbclient.h
-%endif # ! with_libwbclient
+#endif ! with_libwbclient
+%endif

 ### VFS-CEPHFS
 %if %{with_vfs_cephfs}
 %files vfs-cephfs
 %{_libdir}/samba/vfs/ceph.so
+%{_libdir}/samba/vfs/ceph_snapshots.so
 %{_mandir}/man8/vfs_ceph.8*
+%{_mandir}/man8/vfs_ceph_snapshots.8*
 %endif

 ### VFS-GLUSTERFS
@ -1788,12 +1854,10 @@ fi
 %files libs
 %{_libdir}/libdcerpc-samr.so.*

-%{_libdir}/samba/libMESSAGING-samba4.so
 %{_libdir}/samba/libLIBWBCLIENT-OLD-samba4.so
 %{_libdir}/samba/libauth4-samba4.so
 %{_libdir}/samba/libauth-unix-token-samba4.so
 %{_libdir}/samba/libdcerpc-samba4.so
-%{_libdir}/samba/libnon-posix-acls-samba4.so
 %{_libdir}/samba/libshares-samba4.so
 %{_libdir}/samba/libsmbpasswdparser-samba4.so
 %{_libdir}/samba/libxattr-tdb-samba4.so
@ -1809,7 +1873,8 @@ fi
 %{_libdir}/libsmbclient.so
 %{_libdir}/pkgconfig/smbclient.pc
 %{_mandir}/man7/libsmbclient.7*
-%endif # with_libsmbclient
+#endif with_libsmbclient
+%endif

 ### LIBWBCLIENT
 %if %with_libwbclient
@ -1822,45 +1887,52 @@ fi
 %{_includedir}/samba-4.0/wbclient.h
 %{_libdir}/samba/wbclient/libwbclient.so
 %{_libdir}/pkgconfig/wbclient.pc
-%endif # with_libwbclient
+#endif with_libwbclient
+%endif

 ### PIDL
 %files pidl
+%doc pidl/README
 %attr(755,root,root) %{_bindir}/pidl
 %dir %{perl_vendorlib}/Parse
-%{perl_vendorlib}/Parse/Pidl.pm
+%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl.pm
 %dir %{perl_vendorlib}/Parse/Pidl
-%{perl_vendorlib}/Parse/Pidl/CUtil.pm
-%{perl_vendorlib}/Parse/Pidl/Samba4.pm
-%{perl_vendorlib}/Parse/Pidl/Expr.pm
-%{perl_vendorlib}/Parse/Pidl/ODL.pm
-%{perl_vendorlib}/Parse/Pidl/Typelist.pm
-%{perl_vendorlib}/Parse/Pidl/IDL.pm
-%{perl_vendorlib}/Parse/Pidl/Compat.pm
+%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/CUtil.pm
+%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/Samba4.pm
+%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/Expr.pm
+%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/ODL.pm
+%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/Typelist.pm
+%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/IDL.pm
+%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/Compat.pm
 %dir %{perl_vendorlib}/Parse/Pidl/Wireshark
-%{perl_vendorlib}/Parse/Pidl/Wireshark/Conformance.pm
-%{perl_vendorlib}/Parse/Pidl/Wireshark/NDR.pm
-%{perl_vendorlib}/Parse/Pidl/Dump.pm
+%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/Wireshark/Conformance.pm
+%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/Wireshark/NDR.pm
+%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/Dump.pm
 %dir %{perl_vendorlib}/Parse/Pidl/Samba3
-%{perl_vendorlib}/Parse/Pidl/Samba3/ServerNDR.pm
-%{perl_vendorlib}/Parse/Pidl/Samba3/ClientNDR.pm
+%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/Samba3/ServerNDR.pm
+%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/Samba3/ClientNDR.pm
+%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/Samba3/Template.pm
 %dir %{perl_vendorlib}/Parse/Pidl/Samba4
-%{perl_vendorlib}/Parse/Pidl/Samba4/Header.pm
+%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/Samba4/Header.pm
 %dir %{perl_vendorlib}/Parse/Pidl/Samba4/COM
-%{perl_vendorlib}/Parse/Pidl/Samba4/COM/Header.pm
-%{perl_vendorlib}/Parse/Pidl/Samba4/COM/Proxy.pm
-%{perl_vendorlib}/Parse/Pidl/Samba4/COM/Stub.pm
-%{perl_vendorlib}/Parse/Pidl/Samba4/Python.pm
-%{perl_vendorlib}/Parse/Pidl/Samba4/Template.pm
+%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/Samba4/COM/Header.pm
+%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/Samba4/COM/Proxy.pm
+%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/Samba4/COM/Stub.pm
+%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/Samba4/Python.pm
+%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/Samba4/Template.pm
 %dir %{perl_vendorlib}/Parse/Pidl/Samba4/NDR
-%{perl_vendorlib}/Parse/Pidl/Samba4/NDR/Server.pm
-%{perl_vendorlib}/Parse/Pidl/Samba4/NDR/Client.pm
-%{perl_vendorlib}/Parse/Pidl/Samba4/NDR/Parser.pm
-%{perl_vendorlib}/Parse/Pidl/Samba4/TDR.pm
-%{perl_vendorlib}/Parse/Pidl/NDR.pm
-%{perl_vendorlib}/Parse/Pidl/Util.pm
-%{_mandir}/man1/pidl*
-%{_mandir}/man3/Parse::Pidl*
+%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/Samba4/NDR/Server.pm
+%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/Samba4/NDR/Client.pm
+%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/Samba4/NDR/Parser.pm
+%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/Samba4/TDR.pm
+%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/NDR.pm
+%attr(644,root,root) %{perl_vendorlib}/Parse/Pidl/Util.pm
+%attr(644,root,root) %{_mandir}/man1/pidl.1*
+%attr(644,root,root) %{_mandir}/man3/Parse::Pidl::Dump.3pm*
+%attr(644,root,root) %{_mandir}/man3/Parse::Pidl::NDR.3pm*
+%attr(644,root,root) %{_mandir}/man3/Parse::Pidl::Util.3pm*
+%attr(644,root,root) %{_mandir}/man3/Parse::Pidl::Wireshark::Conformance.3pm*
+%attr(644,root,root) %{_mandir}/man3/Parse::Pidl::Wireshark::NDR.3pm*

 ### PYTHON3
 %files -n python3-%{name}
@ -1996,6 +2068,7 @@ fi
 %{python3_sitearch}/samba/netcmd/__pycache__/__init__.*.pyc
 %{python3_sitearch}/samba/netcmd/__pycache__/common.*.pyc
 %{python3_sitearch}/samba/netcmd/__pycache__/computer.*.pyc
+%{python3_sitearch}/samba/netcmd/__pycache__/contact.*.pyc
 %{python3_sitearch}/samba/netcmd/__pycache__/dbcheck.*.pyc
 %{python3_sitearch}/samba/netcmd/__pycache__/delegation.*.pyc
 %{python3_sitearch}/samba/netcmd/__pycache__/dns.*.pyc
@ -2023,6 +2096,7 @@ fi
 %{python3_sitearch}/samba/netcmd/__pycache__/visualize.*.pyc
 %{python3_sitearch}/samba/netcmd/common.py
 %{python3_sitearch}/samba/netcmd/computer.py
+%{python3_sitearch}/samba/netcmd/contact.py
 %{python3_sitearch}/samba/netcmd/dbcheck.py
 %{python3_sitearch}/samba/netcmd/delegation.py
 %{python3_sitearch}/samba/netcmd/dns.py
@ -2063,7 +2137,6 @@ fi
 %{python3_sitearch}/samba/samba3/smbd.*.so
 %{python3_sitearch}/samba/sd_utils.py
 %{python3_sitearch}/samba/sites.py
-%{python3_sitearch}/samba/smb.*.so
 %{python3_sitearch}/samba/subnets.py
 %dir %{python3_sitearch}/samba/subunit
 %{python3_sitearch}/samba/subunit/__init__.py
@ -2078,10 +2151,6 @@ fi
 %{python3_sitearch}/samba/third_party/__pycache__/__init__.*.pyc
 %{python3_sitearch}/samba/upgrade.py
 %{python3_sitearch}/samba/upgradehelpers.py
-%dir %{python3_sitearch}/samba/web_server
-%{python3_sitearch}/samba/web_server/__init__.py
-%dir %{python3_sitearch}/samba/web_server/__pycache__
-%{python3_sitearch}/samba/web_server/__pycache__/__init__.*.pyc
 %{python3_sitearch}/samba/werror.*.so
 %{python3_sitearch}/samba/xattr.py
 %{python3_sitearch}/samba/xattr_native.*.so
@ -2177,6 +2246,7 @@ fi
 %{python3_sitearch}/samba/tests/__pycache__/auth_log_netlogon.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/auth_log_netlogon_bad_creds.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/auth_log_samlogon.*.pyc
+%{python3_sitearch}/samba/tests/__pycache__/auth_log_winbind.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/common.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/complex_expressions.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/core.*.pyc
@ -2186,6 +2256,7 @@ fi
 %{python3_sitearch}/samba/tests/__pycache__/dns_base.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/dns_forwarder.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/dns_invalid.*.pyc
+%{python3_sitearch}/samba/tests/__pycache__/dns_packet.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/dns_tkey.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/dns_wildcard.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/dsdb.*.pyc
@ -2205,6 +2276,7 @@ fi
 %{python3_sitearch}/samba/tests/__pycache__/hostconfig.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/join.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/krb5_credentials.*.pyc
+%{python3_sitearch}/samba/tests/__pycache__/ldap_raw.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/ldap_referrals.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/loadparm.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/libsmb.*.pyc
@ -2246,11 +2318,14 @@ fi
 %{python3_sitearch}/samba/tests/__pycache__/s3registry.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/s3windb.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/samba3sam.*.pyc
+%{python3_sitearch}/samba/tests/__pycache__/samba_upgradedns_lmdb.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/samdb.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/samdb_api.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/security.*.pyc
+%{python3_sitearch}/samba/tests/__pycache__/segfault.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/smb.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/smbd_base.*.pyc
+%{python3_sitearch}/samba/tests/__pycache__/smbd_fuzztest.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/source.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/strings.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/subunitrun.*.pyc
@ -2258,6 +2333,7 @@ fi
 %{python3_sitearch}/samba/tests/__pycache__/upgrade.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/upgradeprovision.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/upgradeprovisionneeddc.*.pyc
+%{python3_sitearch}/samba/tests/__pycache__/usage.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/xattr.*.pyc
 %{python3_sitearch}/samba/tests/audit_log_base.py
 %{python3_sitearch}/samba/tests/audit_log_dsdb.py
@ -2270,12 +2346,14 @@ fi
 %{python3_sitearch}/samba/tests/auth_log_netlogon.py
 %{python3_sitearch}/samba/tests/auth_log_pass_change.py
 %{python3_sitearch}/samba/tests/auth_log_samlogon.py
+%{python3_sitearch}/samba/tests/auth_log_winbind.py
 %dir %{python3_sitearch}/samba/tests/blackbox
 %{python3_sitearch}/samba/tests/blackbox/__init__.py
 %dir %{python3_sitearch}/samba/tests/blackbox/__pycache__
 %{python3_sitearch}/samba/tests/blackbox/__pycache__/__init__.*.pyc
 %{python3_sitearch}/samba/tests/blackbox/__pycache__/bug13653.*.pyc
 %{python3_sitearch}/samba/tests/blackbox/__pycache__/check_output.*.pyc
+%{python3_sitearch}/samba/tests/blackbox/__pycache__/downgradedatabase.*.pyc
 %{python3_sitearch}/samba/tests/blackbox/__pycache__/ndrdump.*.pyc
 %{python3_sitearch}/samba/tests/blackbox/__pycache__/netads_json.*.pyc
 %{python3_sitearch}/samba/tests/blackbox/__pycache__/samba_dnsupdate.*.pyc
@ -2286,6 +2364,7 @@ fi
 %{python3_sitearch}/samba/tests/blackbox/__pycache__/traffic_summary.*.pyc
 %{python3_sitearch}/samba/tests/blackbox/bug13653.py
 %{python3_sitearch}/samba/tests/blackbox/check_output.py
+%{python3_sitearch}/samba/tests/blackbox/downgradedatabase.py
 %{python3_sitearch}/samba/tests/blackbox/ndrdump.py
 %{python3_sitearch}/samba/tests/blackbox/netads_json.py
 %{python3_sitearch}/samba/tests/blackbox/samba_dnsupdate.py
@ -2337,11 +2416,10 @@ fi
 %{python3_sitearch}/samba/tests/dns_base.py
 %{python3_sitearch}/samba/tests/dns_forwarder.py
 %dir %{python3_sitearch}/samba/tests/dns_forwarder_helpers
-%{python3_sitearch}/samba/tests/dns_forwarder_helpers/__pycache__/dns_hub.*.pyc
 %{python3_sitearch}/samba/tests/dns_forwarder_helpers/__pycache__/server.*.pyc
-%{python3_sitearch}/samba/tests/dns_forwarder_helpers/dns_hub.py
 %{python3_sitearch}/samba/tests/dns_forwarder_helpers/server.py
 %{python3_sitearch}/samba/tests/dns_invalid.py
+%{python3_sitearch}/samba/tests/dns_packet.py
 %{python3_sitearch}/samba/tests/dns_tkey.py
 %{python3_sitearch}/samba/tests/dns_wildcard.py
 %{python3_sitearch}/samba/tests/dsdb.py
@ -2381,6 +2459,7 @@ fi
 %{python3_sitearch}/samba/tests/kcc/kcc_utils.py
 %{python3_sitearch}/samba/tests/kcc/ldif_import_export.py
 %{python3_sitearch}/samba/tests/krb5_credentials.py
+%{python3_sitearch}/samba/tests/ldap_raw.py
 %{python3_sitearch}/samba/tests/ldap_referrals.py
 %{python3_sitearch}/samba/tests/libsmb.py
 %{python3_sitearch}/samba/tests/loadparm.py
@ -2422,24 +2501,31 @@ fi
 %{python3_sitearch}/samba/tests/s3registry.py
 %{python3_sitearch}/samba/tests/s3windb.py
 %{python3_sitearch}/samba/tests/samba3sam.py
+%{python3_sitearch}/samba/tests/samba_upgradedns_lmdb.py
 %dir %{python3_sitearch}/samba/tests/samba_tool
 %{python3_sitearch}/samba/tests/samba_tool/__init__.py
 %dir %{python3_sitearch}/samba/tests/samba_tool/__pycache__
 %{python3_sitearch}/samba/tests/samba_tool/__pycache__/__init__.*.pyc
 %{python3_sitearch}/samba/tests/samba_tool/__pycache__/base.*.pyc
 %{python3_sitearch}/samba/tests/samba_tool/__pycache__/computer.*.pyc
+%{python3_sitearch}/samba/tests/samba_tool/__pycache__/contact.*.pyc
 %{python3_sitearch}/samba/tests/samba_tool/__pycache__/demote.*.pyc
 %{python3_sitearch}/samba/tests/samba_tool/__pycache__/dnscmd.*.pyc
+%{python3_sitearch}/samba/tests/samba_tool/__pycache__/drs_clone_dc_data_lmdb_size.*.pyc
+%{python3_sitearch}/samba/tests/samba_tool/__pycache__/dsacl.*.pyc
 %{python3_sitearch}/samba/tests/samba_tool/__pycache__/forest.*.pyc
 %{python3_sitearch}/samba/tests/samba_tool/__pycache__/fsmo.*.pyc
 %{python3_sitearch}/samba/tests/samba_tool/__pycache__/gpo.*.pyc
 %{python3_sitearch}/samba/tests/samba_tool/__pycache__/group.*.pyc
 %{python3_sitearch}/samba/tests/samba_tool/__pycache__/help.*.pyc
 %{python3_sitearch}/samba/tests/samba_tool/__pycache__/join.*.pyc
+%{python3_sitearch}/samba/tests/samba_tool/__pycache__/join_lmdb_size.*.pyc
 %{python3_sitearch}/samba/tests/samba_tool/__pycache__/ntacl.*.pyc
 %{python3_sitearch}/samba/tests/samba_tool/__pycache__/ou.*.pyc
 %{python3_sitearch}/samba/tests/samba_tool/__pycache__/passwordsettings.*.pyc
 %{python3_sitearch}/samba/tests/samba_tool/__pycache__/processes.*.pyc
+%{python3_sitearch}/samba/tests/samba_tool/__pycache__/promote_dc_lmdb_size.*.pyc
+%{python3_sitearch}/samba/tests/samba_tool/__pycache__/provision_lmdb_size.*.pyc
 %{python3_sitearch}/samba/tests/samba_tool/__pycache__/provision_password_check.*.pyc
 %{python3_sitearch}/samba/tests/samba_tool/__pycache__/rodc.*.pyc
 %{python3_sitearch}/samba/tests/samba_tool/__pycache__/schema.*.pyc
@ -2448,23 +2534,32 @@ fi
 %{python3_sitearch}/samba/tests/samba_tool/__pycache__/user.*.pyc
 %{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_check_password_script.*.pyc
 %{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_virtualCryptSHA.*.pyc
+%{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_virtualCryptSHA_base.*.pyc
+%{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_virtualCryptSHA_gpg.*.pyc
+%{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_virtualCryptSHA_userPassword.*.pyc
 %{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_wdigest.*.pyc
 %{python3_sitearch}/samba/tests/samba_tool/__pycache__/visualize.*.pyc
 %{python3_sitearch}/samba/tests/samba_tool/__pycache__/visualize_drs.*.pyc
 %{python3_sitearch}/samba/tests/samba_tool/base.py
 %{python3_sitearch}/samba/tests/samba_tool/computer.py
+%{python3_sitearch}/samba/tests/samba_tool/contact.py
 %{python3_sitearch}/samba/tests/samba_tool/demote.py
 %{python3_sitearch}/samba/tests/samba_tool/dnscmd.py
+%{python3_sitearch}/samba/tests/samba_tool/drs_clone_dc_data_lmdb_size.py
+%{python3_sitearch}/samba/tests/samba_tool/dsacl.py
 %{python3_sitearch}/samba/tests/samba_tool/forest.py
 %{python3_sitearch}/samba/tests/samba_tool/fsmo.py
 %{python3_sitearch}/samba/tests/samba_tool/gpo.py
 %{python3_sitearch}/samba/tests/samba_tool/group.py
 %{python3_sitearch}/samba/tests/samba_tool/help.py
 %{python3_sitearch}/samba/tests/samba_tool/join.py
+%{python3_sitearch}/samba/tests/samba_tool/join_lmdb_size.py
 %{python3_sitearch}/samba/tests/samba_tool/ntacl.py
 %{python3_sitearch}/samba/tests/samba_tool/ou.py
 %{python3_sitearch}/samba/tests/samba_tool/passwordsettings.py
 %{python3_sitearch}/samba/tests/samba_tool/processes.py
+%{python3_sitearch}/samba/tests/samba_tool/promote_dc_lmdb_size.py
+%{python3_sitearch}/samba/tests/samba_tool/provision_lmdb_size.py
 %{python3_sitearch}/samba/tests/samba_tool/provision_password_check.py
 %{python3_sitearch}/samba/tests/samba_tool/rodc.py
 %{python3_sitearch}/samba/tests/samba_tool/schema.py
@ -2473,14 +2568,19 @@ fi
 %{python3_sitearch}/samba/tests/samba_tool/user.py
 %{python3_sitearch}/samba/tests/samba_tool/user_check_password_script.py
 %{python3_sitearch}/samba/tests/samba_tool/user_virtualCryptSHA.py
+%{python3_sitearch}/samba/tests/samba_tool/user_virtualCryptSHA_base.py
+%{python3_sitearch}/samba/tests/samba_tool/user_virtualCryptSHA_gpg.py
+%{python3_sitearch}/samba/tests/samba_tool/user_virtualCryptSHA_userPassword.py
 %{python3_sitearch}/samba/tests/samba_tool/user_wdigest.py
 %{python3_sitearch}/samba/tests/samba_tool/visualize.py
 %{python3_sitearch}/samba/tests/samba_tool/visualize_drs.py
 %{python3_sitearch}/samba/tests/samdb.py
 %{python3_sitearch}/samba/tests/samdb_api.py
 %{python3_sitearch}/samba/tests/security.py
+%{python3_sitearch}/samba/tests/segfault.py
 %{python3_sitearch}/samba/tests/smb.py
 %{python3_sitearch}/samba/tests/smbd_base.py
+%{python3_sitearch}/samba/tests/smbd_fuzztest.py
 %{python3_sitearch}/samba/tests/source.py
 %{python3_sitearch}/samba/tests/strings.py
 %{python3_sitearch}/samba/tests/subunitrun.py
@ -2488,6 +2588,7 @@ fi
 %{python3_sitearch}/samba/tests/upgrade.py
 %{python3_sitearch}/samba/tests/upgradeprovision.py
 %{python3_sitearch}/samba/tests/upgradeprovisionneeddc.py
+%{python3_sitearch}/samba/tests/usage.py
 %{python3_sitearch}/samba/tests/xattr.py

 ### TEST
@ -2528,7 +2629,7 @@ fi
 %{_sbindir}/winbindd
 %attr(750,root,wbpriv) %dir /var/lib/samba/winbindd_privileged
 %{_unitdir}/winbind.service
-%{_sysconfdir}/NetworkManager/dispatcher.d/30-winbind
+%{_prefix}/lib/NetworkManager
 %{_mandir}/man8/winbindd.8*
 %{_mandir}/man8/idmap_*.8*

@ -2710,7 +2811,6 @@ fi
 %{_libexecdir}/ctdb/tests/sock_io_test
 %{_libexecdir}/ctdb/tests/srvid_test
 %{_libexecdir}/ctdb/tests/system_socket_test
-%{_libexecdir}/ctdb/tests/test_mutex_raw
 %{_libexecdir}/ctdb/tests/transaction_loop
 %{_libexecdir}/ctdb/tests/tunnel_cmd
 %{_libexecdir}/ctdb/tests/tunnel_test
@ -2872,10 +2972,8 @@ fi
 %{_datadir}/ctdb/tests/eventscripts/05.system.monitor.007.sh
 %{_datadir}/ctdb/tests/eventscripts/05.system.monitor.011.sh
 %{_datadir}/ctdb/tests/eventscripts/05.system.monitor.012.sh
-%{_datadir}/ctdb/tests/eventscripts/05.system.monitor.013.sh
 %{_datadir}/ctdb/tests/eventscripts/05.system.monitor.014.sh
 %{_datadir}/ctdb/tests/eventscripts/05.system.monitor.015.sh
-%{_datadir}/ctdb/tests/eventscripts/05.system.monitor.016.sh
 %{_datadir}/ctdb/tests/eventscripts/05.system.monitor.017.sh
 %{_datadir}/ctdb/tests/eventscripts/05.system.monitor.018.sh
 %{_datadir}/ctdb/tests/eventscripts/06.nfs.releaseip.001.sh
@ -3211,6 +3309,7 @@ fi
 %{_datadir}/ctdb/tests/simple/80_ctdb_traverse.sh
 %{_datadir}/ctdb/tests/simple/81_tunnel_ring.sh
 %{_datadir}/ctdb/tests/simple/90_debug_hung_script.sh
+%{_datadir}/ctdb/tests/simple/91_version_check.sh


 %dir %{_datadir}/ctdb/tests/simple/scripts
@ -3436,9 +3535,111 @@ fi
 %dir %{_datadir}/ctdb/tests/tool/scripts
 %{_datadir}/ctdb/tests/tool/scripts/local.sh

-%endif # with_clustering_support
+#endif with_clustering_support
+%endif

 %changelog
+* Thu Oct 29 2020 Guenther Deschner <gdeschner@redhat.com> - 4.11.15-0
+- Update to Samba 4.11.15
+- resolves: #1892631, #1892634 - Security fixes for CVE-2020-14318
+- resolves: #1891685, #1892628 - Security fixes for CVE-2020-14323
+- resolves: #1892636, #1892640 - Security fixes for CVE-2020-14383
+
+* Tue Oct 06 2020 Guenther Deschner <gdeschner@redhat.com> - 4.11.14-0
+- Update to Samba 4.11.14
+
+* Fri Sep 18 2020 Guenther Deschner <gdeschner@redhat.com> - 4.11.13-0
+- Update to Samba 4.11.13
+- resolves: #1879822, #1880703 - Security fixes for CVE-2020-1472
+
+* Tue Aug 25 2020 Guenther Deschner <gdeschner@redhat.com> - 4.11.12-0
+- Update to Samba 4.11.12
+
+* Thu Jul 02 2020 Guenther Deschner <gdeschner@redhat.com> - 4.11.11-0
+- Update to Samba 4.11.11
+- resolves: #1849489, #1853255 - Security fixes for CVE-2020-10730
+- resolves: #1849491, #1853256 - Security fixes for CVE-2020-10745
+- resolves: #1849509, #1853276 - Security fixes for CVE-2020-10760
+- resolves: #1851298, #1853259 - Security fixes for CVE-2020-14303
+
+* Tue Jun 30 2020 Guenther Deschner <gdeschner@redhat.com> - 4.11.10-0
+- Update to Samba 4.11.10
+
+* Wed May 06 2020 Guenther Deschner <gdeschner@redhat.com> - 4.11.9-0
+- Update to Samba 4.11.9
+
+* Tue Apr 28 2020 Guenther Deschner <gdeschner@redhat.com> - 4.11.8-0
+- Update to Samba 4.11.8
+- resolves: #1825731, #1828870 - Security fixes for CVE-2020-10700
+- resolves: #1825734, #1828872 - Security fixes for CVE-2020-10704
+
+* Sun Apr 12 2020 Alexander Bokovoy <abokovoy@redhat.com> - 4.11.7-1
+- Revert SMBv1 POSIX stat use in libsmb by default
+- Resolves: rhbz#1801442
+
+* Tue Mar 10 2020 Guenther Deschner <gdeschner@redhat.com> - 4.11.7-0
+- Update to Samba 4.11.7
+
+* Tue Jan 28 2020 Guenther Deschner <gdeschner@redhat.com> - 4.11.6-0
+- Update to Samba 4.11.6
+
+* Tue Jan 21 2020 Guenther Deschner <gdeschner@redhat.com> - 4.11.5-0
+- Update to Samba 4.11.5
+- resolves: #1791201, #1793405 - Security fixes for CVE-2019-14902
+- resolves: #1791207, #1793407 - Security fixes for CVE-2019-14907
+- resolves: #1791204, #1793406 - Security fixes for CVE-2019-19344
+
+* Mon Dec 16 2019 Guenther Deschner <gdeschner@redhat.com> - 4.11.4-0
+- Update to Samba 4.11.4
+
+* Tue Dec 10 2019 Guenther Deschner <gdeschner@redhat.com> - 4.11.3-0
+- Update to Samba 4.11.3
+- resolves: #1778586, #1781542 - Security fixes for CVE-2019-14861
+- resolves: #1778589, #1781545 - Security fixes for CVE-2019-14870
+
+* Thu Dec 05 2019 Andreas Schneider <asn@redhat.com> - 4.11.2-2
+- Restart winbindd on samba-winbind package upgrade
+
+* Wed Nov 06 2019 Alexander Bokovoy <abokovoy@redhat.com> - 4.11.2-1
+- Update DES removal patch
+
+* Tue Oct 29 2019 Guenther Deschner <gdeschner@redhat.com> - 4.11.2-0
+- Update to Samba 4.11.2
+- resolves: #1763137, #1766558 - Security fixes for CVE-2019-10218
+- resolves: #1764126, #1766559 - Security fixes for CVE-2019-14833
+
+* Sun Oct 27 2019 Alexander Bokovoy <abokovoy@redhat.com> - 4.11.1-1
+- resolves: #1757071 - Deploy new samba DC fails
+
+* Fri Oct 18 2019 Guenther Deschner <gdeschner@redhat.com> - 4.11.1-0
+- Update to Samba 4.11.1
+
+* Tue Sep 17 2019 Guenther Deschner <gdeschner@redhat.com> - 4.11.0-3
+- Update to Samba 4.11.0
+
+* Wed Sep 11 2019 Guenther Deschner <gdeschner@redhat.com> - 4.11.0rc4-2
+- Update to Samba 4.11.0rc4
+
+* Tue Sep 03 2019 Guenther Deschner <gdeschner@redhat.com> - 4.11.0rc3-2
+- Update to Samba 4.11.0rc3
+- resolves: #1746225, #1748308 - Security fixes for CVE-2019-10197
+
+* Tue Aug 27 2019 Guenther Deschner <gdeschner@redhat.com> - 4.11.0rc2-2
+- resolves: #1746014 - re-add pidl
+
+* Mon Aug 26 2019 Lubomir Rintel <lkundrak@v3.sk> - 2:4.11.0-0.1.rc2
+- Move the NetworkManager dispatcher script out of /etc
+
+* Wed Aug 21 2019 Guenther Deschner <gdeschner@redhat.com> - 4.11.0rc2-0
+- Update to Samba 4.11.0rc2
+
+* Tue Aug 20 2019 Guenther Deschner <gdeschner@redhat.com> - 4.11.0rc1-0
+- Update to Samba 4.11.0rc1
+
+* Fri Aug 16 2019 Alexander Bokovoy <abokovoy@redhat.com> - 2:4.10.6-1
+- Fix Samba bug https://bugzilla.samba.org/show_bug.cgi?id=14091
+- Fixes: Windows systems cannot resolve IPA users and groups over LSA RPC
+
 * Fri Jul 26 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2:4.10.6-0.2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild

--- a/4
+++ b/4
@ -1,2 +1,2 @@
-SHA512 (samba-4.10.6.tar.xz) = 1189e25271d3f708efebe99e840028dd82f82de458771bf9e8373c6b21643e3968165963b4a9efb5eac356734a4b4c7857f6fb2a077f3c8ca463ebae5a889cfc
-SHA512 (samba-4.10.6.tar.asc) = 21dc113313d98185ee97be1c59e791862d55dcd509b82f98d8fb5f2123b09c7be7265305734b0b17fb95aca729c1b7df48751cb6d6b645dbfbf092e174e07cbc
+SHA512 (samba-4.11.15.tar.xz) = 192d9ddbe5ffe6be1fbb845ba71b3b89eb3fc6bdd48eb1aa97d00cb281fdd1c0f999d03fa394ddcf24dfbae804161231badbfb3aa9d412024d049ce9122be30e
+SHA512 (samba-4.11.15.tar.asc) = c262e54669755fd7bf068a61c9f5b4984230504d956bcb9be737f2b8b312ab6b81a86f3a9c764961360fb790a999f1ef3c509b46214bdd09079d73d3b915ce46
Author	SHA1	Message	Date
Günther Deschner	f7272fe00c	Update to Samba 4.11.15 resolves: #1892631, #1892634 - Security fixes for CVE-2020-14318 resolves: #1891685, #1892628 - Security fixes for CVE-2020-14323 resolves: #1892636, #1892640 - Security fixes for CVE-2020-14383 Guenther	2020-10-29 12:25:34 +01:00
Günther Deschner	f6da685b76	Update to Samba 4.11.14 Guenther	2020-10-06 11:33:42 +02:00
Günther Deschner	50d0fd9e20	Update to Samba 4.11.13 resolves: #1879822, #1880703 - Security fixes for CVE-2020-1472 Guenther	2020-09-19 08:28:59 +02:00
Günther Deschner	d375ddcd7d	Update to Samba 4.11.12 Guenther	2020-08-25 10:42:34 +02:00
Günther Deschner	9f77451f15	Update to Samba 4.11.11 resolves: #1849489, #1853255 - Security fixes for CVE-2020-10730 resolves: #1849491, #1853256 - Security fixes for CVE-2020-10745 resolves: #1849509, #1853276 - Security fixes for CVE-2020-10760 resolves: #1851298, #1853259 - Security fixes for CVE-2020-14303 Guenther	2020-07-02 18:59:30 +02:00
Günther Deschner	8d48513ebc	Update to Samba 4.11.10 Guenther	2020-06-30 14:15:28 +02:00
Günther Deschner	e31caf239e	Update to Samba 4.11.9 Guenther	2020-05-06 10:55:12 +02:00
Günther Deschner	b2cc3a0891	Update to Samba 4.11.8 resolves: #1825731, #1828870 - Security fixes for CVE-2020-10700 resolves: #1825734, #1828872 - Security fixes for CVE-2020-10704 Guenther	2020-04-28 22:25:44 +02:00
Alexander Bokovoy	5b3e9f9ab5	Revert POSIX stat tuning patch Fixes: rhbz#1801442	2020-04-12 11:03:32 +03:00
Günther Deschner	9aaf72af0f	Update to Samba 4.11.7 Guenther	2020-03-10 13:26:42 +01:00
Günther Deschner	11d719327d	Update to Samba 4.11.6 Guenther	2020-01-28 13:59:42 +01:00
Andreas Schneider	b9cfd9a102	Remove obsolete python3 requirements	2020-01-23 12:19:05 +01:00
Andreas Schneider	35ba9ba00d	Fail 'make test' immediately	2020-01-23 12:19:03 +01:00
Günther Deschner	9e7933acd0	Fix typo in package description Guenther	2020-01-21 15:36:57 +01:00
Günther Deschner	e655147cf1	Update to Samba 4.11.5 resolves: #1791201, #1793405 - Security fixes for CVE-2019-14902 resolves: #1791207, #1793407 - Security fixes for CVE-2019-14907 resolves: #1791204, #1793406 - Security fixes for CVE-2019-19344 Guenther	2020-01-21 11:56:41 +01:00
Andreas Schneider	64f225a13b	Fix manual libwbclient alternative settings	2020-01-10 15:35:37 +01:00
Günther Deschner	4fcec48e54	Update to Samba 4.11.4 Guenther	2019-12-17 02:10:39 +01:00
Günther Deschner	5c144e4c79	Update to Samba 4.11.3 resolves: #1778586, #1781542 - Security fixes for CVE-2019-14861 resolves: #1778589, #1781545 - Security fixes for CVE-2019-14870 Guenther	2019-12-10 13:59:21 +01:00
Andreas Schneider	b25be67059	Fix URL	2019-12-06 11:28:24 +01:00
Andreas Schneider	75fbee791b	Fix spec file warnings Mark end of %endif with a comment in an extra line	2019-12-06 11:28:22 +01:00
Andreas Schneider	6f0a1892de	Always require gnutls >= 3.4.7	2019-12-06 11:28:20 +01:00
Andreas Schneider	d3255f4ba6	Fix python3-samba requirement of smaba-test	2019-12-06 11:28:18 +01:00
Andreas Schneider	9dd15774e7	Create a samba-dc-provision subpackage This includes only ldif files for provisioning => noarch	2019-12-06 11:28:16 +01:00
Andreas Schneider	19616dde1b	Fix spec file issues	2019-12-06 11:28:14 +01:00
Andreas Schneider	a6e5467a7f	Add missing README files	2019-12-06 11:28:12 +01:00
Andreas Schneider	d521ae1c65	Update logrotate script	2019-12-06 11:28:09 +01:00
Andreas Schneider	7496562e11	Bump release for new build	2019-12-05 17:25:07 +01:00
Andreas Schneider	08266200dc	libMESSAGING is needed by samba-client-libs now Found by rpmdiff	2019-12-05 17:25:07 +01:00
Andreas Schneider	f2018e5930	Use an URL for Source0. This makes our tools happy and you can use it as a link to get the tar.gz.	2019-12-05 15:20:30 +01:00
Andreas Schneider	c800abd9c3	More fixes for pidl packaging MakeMaker installs files with 0444: https://bugzilla.redhat.com/show_bug.cgi?id=1780126 Define permissions when packaging files as a workaround.	2019-12-05 15:06:05 +01:00
Andreas Schneider	024853af7b	Fix pidl packageing	2019-12-02 12:07:46 +01:00
Andreas Schneider	d32eb4651c	Remove the pidl patch and build pidl using its Makefile.PL	2019-11-29 11:20:26 +01:00
Andreas Schneider	e7b3b0387a	Restart the winbind service on upgrade	2019-11-25 12:03:13 +01:00
Alexander Bokovoy	0316af4dc4	Rebase no-DES patch for 4.11.2	2019-11-06 12:43:05 +02:00
Andreas Schneider	edd1863652	Fix building without addc	2019-10-30 14:08:07 +01:00
Günther Deschner	581d9525fe	Update to Samba 4.11.2 resolves: #1763137, #1766558 - Security fixes for CVE-2019-10218 resolves: #1764126, #1766559 - Security fixes for CVE-2019-14833 Guenther	2019-10-30 12:09:09 +01:00
Alexander Bokovoy	0efc6d4556	Fix deployment of Samba AD DC with MIT Kerberos When DES encryption is not supported in MIT Kerberos, deployment of Samba AD DC fails with "ERROR(ldb): uncaught exception - setup_kerberos_keys: generation of a des-cbc-md5 key failed: Bad encryption type" Fix it by not using DES encryption types in MIT build. Resolves #1757071 (cherry picked from commit `03a27a2599`)	2019-10-27 13:42:45 +02:00
Alexander Bokovoy	f9f065ecbc	Correct generated krb5.conf file to actually find own realm (cherry picked from commit `a744fc0117`)	2019-10-27 13:42:45 +02:00
Alexander Bokovoy	8e580cc182	Do not allow DES encryption when using Kerberos MIT Kerberos did remove support for DES. Without removing DES from the default encryption types list we cannot proceed with Samba AD DC creation. Convert internal DES implementation to use GnuTLS instead. (cherry picked from commit `e9627e790b`)	2019-10-27 13:42:45 +02:00
Alexander Bokovoy	ffa2b389dc	Both testsuite and AD DC builds require ldb/tdb-tools and python modules (cherry picked from commit `e5c09f56c5`)	2019-10-27 13:42:45 +02:00
Günther Deschner	b55713591e	Update to Samba 4.11.1 Guenther	2019-10-18 17:17:39 +02:00
Günther Deschner	4c73b568ce	Update to Samba 4.11.0 Guenther	2019-09-17 15:35:18 +02:00
Günther Deschner	203ce796bb	Update to Samba 4.11.0rc4 Guenther Signed-off-by: Guenther Deschner <gd@samba.org>	2019-09-12 00:24:23 +02:00
Günther Deschner	5e86fbcc8a	Add missing files Guenther	2019-09-04 09:13:29 +02:00
Günther Deschner	068248beda	Fix ldb version dependency Guenther	2019-09-03 14:45:06 +02:00
Günther Deschner	7e06ae540c	Update to Samba 4.11.0rc3 resolves: #1746225, #1748308 - Security fixes for CVE-2019-10197 Guenther	2019-09-03 14:32:39 +02:00
Günther Deschner	ddcbb02185	re-add pidl resolves: #1746014 Guenther	2019-08-29 13:27:13 +02:00
Lubomir Rintel	7b283dee16	Move the NetworkManager dispatcher script out of /etc It's not user configuration and shouldn't ever have been there. Except for that it used to be the only location NetworkManager looked into. With NetworkManager 1.20 that is no longer the case and the dispatcher scripts can be moved to /usr/lib.	2019-08-29 13:27:01 +02:00
Günther Deschner	f297ac882f	Update to Samba 4.11.0rc2 Thanks to Lukas Slebodnik <lslebodn@fedoraproject.org> Guenther	2019-08-26 15:52:02 +02:00
Günther Deschner	ebd06bdd1a	Update to Samba 4.11.0rc1 Guenther	2019-08-26 15:52:02 +02:00
Alexander Bokovoy	d819c93793	Allow Windows to resolve IPA users and groups over LSA RPC Fixes: https://bugzilla.samba.org/show_bug.cgi?id=14091 (cherry picked from commit `e9d6c3ff33`)	2019-08-16 12:01:11 +03:00