Update to Samba 4.11.15

resolves: #1892631, #1892634 - Security fixes for CVE-2020-14318
resolves: #1891685, #1892628 - Security fixes for CVE-2020-14323
resolves: #1892636, #1892640 - Security fixes for CVE-2020-14383

Guenther

.fmf/version

@@ -1 +0,0 @@
-1

.gitignore

@@ -1,4 +1,211 @@
-/samba-*.tar.xz
-/samba-*.tar.asc
-/*.rpm
-/results_samba
+samba-3.5.4.tar.gz
+samba-3.6.0pre1.tar.gz
+/samba-3.6.0pre2.tar.gz
+/samba-3.6.0pre3.tar.gz
+/samba-3.6.0rc1.tar.gz
+/samba-3.6.0rc2.tar.gz
+/samba-3.6.0rc3.tar.gz
+/samba-3.6.0.tar.gz
+/samba-3.6.1.tar.gz
+/samba-3.6.3.tar.gz
+/samba-3.6.4.tar.gz
+/samba-3.6.5.tar.gz
+/samba-3.6.6.tar.gz
+/samba-3.6.7.tar.gz
+/samba-4.0.0rc1.tar.bz2
+/samba-4.0.0rc2.tar.bz2
+/samba-4.0.0rc3.tar.bz2
+/samba-4.0.0rc4.tar.bz2
+/samba-4.0.0rc5.tar.bz2
+/samba-4.0.0rc6.tar.bz2
+/samba-4.0.0.tar.bz2
+/samba-4.0.1.tar.bz2
+/samba-4.0.2.tar.bz2
+/samba-4.0.3.tar.bz2
+/samba-4.0.4.tar.bz2
+/samba-4.0.5.tar.bz2
+/samba-4.0.6.tar.bz2
+/samba-4.0.7.tar.xz
+/samba-4.1.0rc1.tar.xz
+/samba-4.1.0rc2.tar.xz
+/samba-4.1.0rc3.tar.xz
+/samba-4.1.0rc4.tar.xz
+/samba-4.1.0.tar.xz
+/samba-4.1.1.tar.xz
+/samba-4.1.2.tar.xz
+/samba-4.1.3.tar.xz
+/samba-4.1.4.tar.xz
+/samba-4.1.5.tar.xz
+/samba-4.1.6.tar.xz
+/samba-4.1.8.tar.xz
+/samba-4.1.9.tar.xz
+/samba-4.1.11.tar.gz
+/samba-4.1.11.tar.xz
+/samba-4.1.12.tar.xz
+/samba-4.2.0rc2.tar.xz
+/samba-4.2.0rc3.tar.xz
+/samba-4.2.0rc4.tar.xz
+/samba-4.2.0rc5.tar.xz
+/samba-4.2.0.tar.xz
+/samba-4.2.1.tar.xz
+/samba-4.2.2.tar.xz
+/samba-4.2.3.tar.xz
+/samba-4.3.0rc3.tar.xz
+/samba-4.3.0rc4.tar.xz
+/samba-4.3.0.tar.xz
+/samba-4.3.1.tar.xz
+/samba-4.3.2.tar.xz
+/samba-4.3.3.tar.xz
+/samba-4.3.4.tar.xz
+/samba-4.4.0rc1.tar.xz
+/samba-4.4.0rc2.tar.xz
+/samba-4.4.0rc3.tar.xz
+/samba-4.4.0rc4.tar.xz
+/samba-4.4.0rc5.tar.xz
+/samba-4.4.0.tar.xz
+/samba-4.4.2.tar.xz
+/samba-4.4.3.tar.xz
+/samba-4.4.4.tar.xz
+/samba-4.4.5.tar.xz
+/samba-4.5.0rc1.tar.xz
+/samba-4.5.0rc2.tar.xz
+/samba-4.5.0rc3.tar.xz
+/samba-4.5.0.tar.xz
+/samba-4.5.1.tar.xz
+/samba-4.5.2.tar.xz
+/samba-4.5.3.tar.xz
+/samba-4.6.0rc1.tar.xz
+/samba-4.6.0rc2.tar.xz
+/samba-4.6.0rc2.tar.asc
+/samba-4.6.0rc3.tar.asc
+/samba-4.6.0rc3.tar.xz
+/samba-4.6.0rc4.tar.xz
+/samba-4.6.0rc4.tar.asc
+/samba-4.6.0.tar.asc
+/samba-4.6.0.tar.xz
+/samba-4.6.1.tar.xz
+/samba-4.6.1.tar.asc
+/samba-4.6.2.tar.xz
+/samba-4.6.2.tar.asc
+/samba-4.6.3.tar.xz
+/samba-4.6.3.tar.asc
+/samba-4.6.4.tar.xz
+/samba-4.6.4.tar.asc
+/samba-4.6.5.tar.xz
+/samba-4.6.5.tar.asc
+/samba-4.7.0rc1.tar.xz
+/samba-4.7.0rc1.tar.asc
+/samba-4.7.0rc3.tar.xz
+/samba-4.7.0rc3.tar.asc
+/samba-4.7.0rc5.tar.xz
+/samba-4.7.0rc5.tar.asc
+/samba-4.7.0rc6.tar.xz
+/samba-4.7.0rc6.tar.asc
+/samba-4.7.0.tar.xz
+/samba-4.7.0.tar.asc
+/samba-4.7.1.tar.xz
+/samba-4.7.1.tar.asc
+/samba-4.7.2.tar.xz
+/samba-4.7.2.tar.asc
+/samba-4.7.3.tar.xz
+/samba-4.7.3.tar.asc
+/samba-4.7.4.tar.xz
+/samba-4.7.4.tar.asc
+/samba-4.8.0rc1.tar.xz
+/samba-4.8.0rc1.tar.asc
+/samba-4.8.0rc2.tar.xz
+/samba-4.8.0rc2.tar.asc
+/samba-4.8.0rc3.tar.xz
+/samba-4.8.0rc3.tar.asc
+/samba-4.8.0rc4.tar.xz
+/samba-4.8.0rc4.tar.asc
+/samba-4.8.0.tar.xz
+/samba-4.8.0.tar.asc
+/samba-4.8.1.tar.xz
+/samba-4.8.1.tar.asc
+/samba-4.8.2.tar.xz
+/samba-4.8.2.tar.asc
+/samba-4.8.3.tar.asc
+/samba-4.8.3.tar.xz
+/samba-4.9.0rc1.tar.xz
+/samba-4.9.0rc1.tar.asc
+/samba-4.9.0rc2.tar.xz
+/samba-4.9.0rc2.tar.asc
+/samba-4.9.0rc3.tar.xz
+/samba-4.9.0rc3.tar.asc
+/samba-4.9.0rc4.tar.xz
+/samba-4.9.0rc4.tar.asc
+/samba-4.9.0rc5.tar.asc
+/samba-4.9.0rc5.tar.xz
+/samba-4.9.0.tar.xz
+/samba-4.9.0.tar.asc
+/samba-4.9.1.tar.asc
+/samba-4.9.1.tar.xz
+/samba-4.9.2.tar.xz
+/samba-4.9.2.tar.asc
+/samba-4.9.3.tar.xz
+/samba-4.9.3.tar.asc
+/samba-4.9.4.tar.xz
+/samba-4.9.4.tar.asc
+/samba-4.10.0rc1.tar.xz
+/samba-4.10.0rc1.tar.asc
+/samba-4.10.0rc2.tar.xz
+/samba-4.10.0rc2.tar.asc
+/samba-4.10.0rc3.tar.xz
+/samba-4.10.0rc3.tar.asc
+/samba-4.10.0rc4.tar.xz
+/samba-4.10.0rc4.tar.asc
+/samba-4.10.0.tar.xz
+/samba-4.10.0.tar.asc
+/samba-4.10.1.tar.xz
+/samba-4.10.1.tar.asc
+/samba-4.10.2.tar.xz
+/samba-4.10.2.tar.asc
+/samba-4.10.3.tar.xz
+/samba-4.10.3.tar.asc
+/samba-4.10.4.tar.xz
+/samba-4.10.4.tar.asc
+/samba-4.10.5.tar.xz
+/samba-4.10.5.tar.asc
+/samba-4.10.6.tar.xz
+/samba-4.10.6.tar.asc
+/samba-4.11.0rc1.tar.xz
+/samba-4.11.0rc1.tar.asc
+/samba-4.11.0rc2.tar.xz
+/samba-4.11.0rc2.tar.asc
+/samba-4.11.0rc3.tar.xz
+/samba-4.11.0rc3.tar.asc
+/samba-4.11.0rc4.tar.xz
+/samba-4.11.0rc4.tar.asc
+/samba-4.11.0.tar.xz
+/samba-4.11.0.tar.asc
+/samba-4.11.1.tar.xz
+/samba-4.11.1.tar.asc
+/samba-4.11.2.tar.xz
+/samba-4.11.2.tar.asc
+/samba-4.11.3.tar.xz
+/samba-4.11.3.tar.asc
+/samba-4.11.4.tar.xz
+/samba-4.11.4.tar.asc
+/samba-4.11.5.tar.xz
+/samba-4.11.5.tar.asc
+/samba-4.11.6.tar.xz
+/samba-4.11.6.tar.asc
+/samba-4.11.7.tar.xz
+/samba-4.11.7.tar.asc
+/samba-4.11.8.tar.xz
+/samba-4.11.8.tar.asc
+/samba-4.11.9.tar.xz
+/samba-4.11.9.tar.asc
+/samba-4.11.10.tar.xz
+/samba-4.11.10.tar.asc
+/samba-4.11.11.tar.xz
+/samba-4.11.11.tar.asc
+/samba-4.11.12.tar.xz
+/samba-4.11.12.tar.asc
+/samba-4.11.13.tar.xz
+/samba-4.11.13.tar.asc
+/samba-4.11.14.tar.xz
+/samba-4.11.14.tar.asc
+/samba-4.11.15.tar.xz
+/samba-4.11.15.tar.asc

0000-use-gnutls-for-des-cbc.patch

@@ -0,0 +1,371 @@
+From 21073bff847fbc41d3dab0a649fa400d8188fa16 Mon Sep 17 00:00:00 2001
+From: Isaac Boukris <iboukris@gmail.com>
+Date: Sat, 19 Oct 2019 23:48:19 +0300
+Subject: [PATCH 1/2] smbdes: add des_crypt56_gnutls() using use DES-CBC with
+ zeroed IV
+
+Signed-off-by: Isaac Boukris <iboukris@gmail.com>
+---
+ libcli/auth/smbdes.c | 47 ++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 47 insertions(+)
+
+diff --git a/libcli/auth/smbdes.c b/libcli/auth/smbdes.c
+index 6d9a6dc2ce8..37ede91ad22 100644
+--- a/libcli/auth/smbdes.c
++++ b/libcli/auth/smbdes.c
+@@ -23,6 +23,9 @@
+ #include "includes.h"
+ #include "libcli/auth/libcli_auth.h"
+ 
++#include <gnutls/gnutls.h>
++#include <gnutls/crypto.h>
++
+ /* NOTES: 
+ 
+    This code makes no attempt to be fast! In fact, it is a very
+@@ -273,6 +276,50 @@ static void str_to_key(const uint8_t *str,uint8_t *key)
+ 	}
+ }
+ 
++static int des_crypt56_gnutls(uint8_t out[8], const uint8_t in[8],
++			      const uint8_t key_in[7], bool enc)
++{
++	static uint8_t iv8[8];
++	gnutls_datum_t iv = { iv8, 8 };
++	gnutls_datum_t key;
++	gnutls_cipher_hd_t ctx;
++	uint8_t key2[8];
++	uint8_t outb[8];
++	int ret;
++
++	memset(out, 0, 8);
++
++	str_to_key(key_in, key2);
++
++	key.data = key2;
++	key.size = 8;
++
++	ret = gnutls_global_init();
++	if (ret != 0) {
++		return ret;
++	}
++
++	ret = gnutls_cipher_init(&ctx, GNUTLS_CIPHER_DES_CBC, &key, &iv);
++	if (ret != 0) {
++		return ret;
++	}
++
++	memcpy(outb, in, 8);
++	if (enc) {
++		ret = gnutls_cipher_encrypt(ctx, outb, 8);
++	} else {
++		ret = gnutls_cipher_decrypt(ctx, outb, 8);
++	}
++
++	if (ret == 0) {
++		memcpy(out, outb, 8);
++	}
++
++	gnutls_cipher_deinit(ctx);
++
++	return ret;
++}
++
+ /*
+   basic des crypt using a 56 bit (7 byte) key
+ */
+-- 
+2.22.0
+
+
+From 6d6651213f391840e3004ec3b055f8f25be9b360 Mon Sep 17 00:00:00 2001
+From: Isaac Boukris <iboukris@gmail.com>
+Date: Mon, 21 Oct 2019 20:03:04 +0300
+Subject: [PATCH 2/2] smbdes: use the new des_crypt56_gnutls()
+
+and remove builtin DES crypto.
+
+Signed-off-by: Isaac Boukris <iboukris@gmail.com>
+---
+ libcli/auth/smbdes.c | 258 +------------------------------------------
+ 1 file changed, 1 insertion(+), 257 deletions(-)
+
+diff --git a/libcli/auth/smbdes.c b/libcli/auth/smbdes.c
+index 37ede91ad22..7de05b75303 100644
+--- a/libcli/auth/smbdes.c
++++ b/libcli/auth/smbdes.c
+@@ -26,239 +26,6 @@
+ #include <gnutls/gnutls.h>
+ #include <gnutls/crypto.h>
+ 
+-/* NOTES: 
+-
+-   This code makes no attempt to be fast! In fact, it is a very
+-   slow implementation 
+-
+-   This code is NOT a complete DES implementation. It implements only
+-   the minimum necessary for SMB authentication, as used by all SMB
+-   products (including every copy of Microsoft Windows95 ever sold)
+-
+-   In particular, it can only do a unchained forward DES pass. This
+-   means it is not possible to use this code for encryption/decryption
+-   of data, instead it is only useful as a "hash" algorithm.
+-
+-   There is no entry point into this code that allows normal DES operation.
+-
+-   I believe this means that this code does not come under ITAR
+-   regulations but this is NOT a legal opinion. If you are concerned
+-   about the applicability of ITAR regulations to this code then you
+-   should confirm it for yourself (and maybe let me know if you come
+-   up with a different answer to the one above)
+-*/
+-
+-
+-static const uint8_t perm1[56] = {57, 49, 41, 33, 25, 17,  9,
+-			 1, 58, 50, 42, 34, 26, 18,
+-			10,  2, 59, 51, 43, 35, 27,
+-			19, 11,  3, 60, 52, 44, 36,
+-			63, 55, 47, 39, 31, 23, 15,
+-			 7, 62, 54, 46, 38, 30, 22,
+-			14,  6, 61, 53, 45, 37, 29,
+-			21, 13,  5, 28, 20, 12,  4};
+-
+-static const uint8_t perm2[48] = {14, 17, 11, 24,  1,  5,
+-                         3, 28, 15,  6, 21, 10,
+-                        23, 19, 12,  4, 26,  8,
+-                        16,  7, 27, 20, 13,  2,
+-                        41, 52, 31, 37, 47, 55,
+-                        30, 40, 51, 45, 33, 48,
+-                        44, 49, 39, 56, 34, 53,
+-                        46, 42, 50, 36, 29, 32};
+-
+-static const uint8_t perm3[64] = {58, 50, 42, 34, 26, 18, 10,  2,
+-			60, 52, 44, 36, 28, 20, 12,  4,
+-			62, 54, 46, 38, 30, 22, 14,  6,
+-			64, 56, 48, 40, 32, 24, 16,  8,
+-			57, 49, 41, 33, 25, 17,  9,  1,
+-			59, 51, 43, 35, 27, 19, 11,  3,
+-			61, 53, 45, 37, 29, 21, 13,  5,
+-			63, 55, 47, 39, 31, 23, 15,  7};
+-
+-static const uint8_t perm4[48] = {   32,  1,  2,  3,  4,  5,
+-                            4,  5,  6,  7,  8,  9,
+-                            8,  9, 10, 11, 12, 13,
+-                           12, 13, 14, 15, 16, 17,
+-                           16, 17, 18, 19, 20, 21,
+-                           20, 21, 22, 23, 24, 25,
+-                           24, 25, 26, 27, 28, 29,
+-                           28, 29, 30, 31, 32,  1};
+-
+-static const uint8_t perm5[32] = {      16,  7, 20, 21,
+-                              29, 12, 28, 17,
+-                               1, 15, 23, 26,
+-                               5, 18, 31, 10,
+-                               2,  8, 24, 14,
+-                              32, 27,  3,  9,
+-                              19, 13, 30,  6,
+-                              22, 11,  4, 25};
+-
+-
+-static const uint8_t perm6[64] ={ 40,  8, 48, 16, 56, 24, 64, 32,
+-                        39,  7, 47, 15, 55, 23, 63, 31,
+-                        38,  6, 46, 14, 54, 22, 62, 30,
+-                        37,  5, 45, 13, 53, 21, 61, 29,
+-                        36,  4, 44, 12, 52, 20, 60, 28,
+-                        35,  3, 43, 11, 51, 19, 59, 27,
+-                        34,  2, 42, 10, 50, 18, 58, 26,
+-                        33,  1, 41,  9, 49, 17, 57, 25};
+-
+-
+-static const uint8_t sc[16] = {1, 1, 2, 2, 2, 2, 2, 2, 1, 2, 2, 2, 2, 2, 2, 1};
+-
+-static const uint8_t sbox[8][4][16] = {
+-	{{14,  4, 13,  1,  2, 15, 11,  8,  3, 10,  6, 12,  5,  9,  0,  7},
+-	 {0, 15,  7,  4, 14,  2, 13,  1, 10,  6, 12, 11,  9,  5,  3,  8},
+-	 {4,  1, 14,  8, 13,  6,  2, 11, 15, 12,  9,  7,  3, 10,  5,  0},
+-	 {15, 12,  8,  2,  4,  9,  1,  7,  5, 11,  3, 14, 10,  0,  6, 13}},
+-
+-	{{15,  1,  8, 14,  6, 11,  3,  4,  9,  7,  2, 13, 12,  0,  5, 10},
+-	 {3, 13,  4,  7, 15,  2,  8, 14, 12,  0,  1, 10,  6,  9, 11,  5},
+-	 {0, 14,  7, 11, 10,  4, 13,  1,  5,  8, 12,  6,  9,  3,  2, 15},
+-	 {13,  8, 10,  1,  3, 15,  4,  2, 11,  6,  7, 12,  0,  5, 14,  9}},
+-
+-	{{10,  0,  9, 14,  6,  3, 15,  5,  1, 13, 12,  7, 11,  4,  2,  8},
+-	 {13,  7,  0,  9,  3,  4,  6, 10,  2,  8,  5, 14, 12, 11, 15,  1},
+-	 {13,  6,  4,  9,  8, 15,  3,  0, 11,  1,  2, 12,  5, 10, 14,  7},
+-	 {1, 10, 13,  0,  6,  9,  8,  7,  4, 15, 14,  3, 11,  5,  2, 12}},
+-
+-	{{7, 13, 14,  3,  0,  6,  9, 10,  1,  2,  8,  5, 11, 12,  4, 15},
+-	 {13,  8, 11,  5,  6, 15,  0,  3,  4,  7,  2, 12,  1, 10, 14,  9},
+-	 {10,  6,  9,  0, 12, 11,  7, 13, 15,  1,  3, 14,  5,  2,  8,  4},
+-	 {3, 15,  0,  6, 10,  1, 13,  8,  9,  4,  5, 11, 12,  7,  2, 14}},
+-
+-	{{2, 12,  4,  1,  7, 10, 11,  6,  8,  5,  3, 15, 13,  0, 14,  9},
+-	 {14, 11,  2, 12,  4,  7, 13,  1,  5,  0, 15, 10,  3,  9,  8,  6},
+-	 {4,  2,  1, 11, 10, 13,  7,  8, 15,  9, 12,  5,  6,  3,  0, 14},
+-	 {11,  8, 12,  7,  1, 14,  2, 13,  6, 15,  0,  9, 10,  4,  5,  3}},
+-
+-	{{12,  1, 10, 15,  9,  2,  6,  8,  0, 13,  3,  4, 14,  7,  5, 11},
+-	 {10, 15,  4,  2,  7, 12,  9,  5,  6,  1, 13, 14,  0, 11,  3,  8},
+-	 {9, 14, 15,  5,  2,  8, 12,  3,  7,  0,  4, 10,  1, 13, 11,  6},
+-	 {4,  3,  2, 12,  9,  5, 15, 10, 11, 14,  1,  7,  6,  0,  8, 13}},
+-
+-	{{4, 11,  2, 14, 15,  0,  8, 13,  3, 12,  9,  7,  5, 10,  6,  1},
+-	 {13,  0, 11,  7,  4,  9,  1, 10, 14,  3,  5, 12,  2, 15,  8,  6},
+-	 {1,  4, 11, 13, 12,  3,  7, 14, 10, 15,  6,  8,  0,  5,  9,  2},
+-	 {6, 11, 13,  8,  1,  4, 10,  7,  9,  5,  0, 15, 14,  2,  3, 12}},
+-
+-	{{13,  2,  8,  4,  6, 15, 11,  1, 10,  9,  3, 14,  5,  0, 12,  7},
+-	 {1, 15, 13,  8, 10,  3,  7,  4, 12,  5,  6, 11,  0, 14,  9,  2},
+-	 {7, 11,  4,  1,  9, 12, 14,  2,  0,  6, 10, 13, 15,  3,  5,  8},
+-	 {2,  1, 14,  7,  4, 10,  8, 13, 15, 12,  9,  0,  3,  5,  6, 11}}};
+-
+-static void permute(char *out, const char *in, const uint8_t *p, int n)
+-{
+-	int i;
+-	for (i=0;i<n;i++)
+-		out[i] = in[p[i]-1];
+-}
+-
+-static void lshift(char *d, int count, int n)
+-{
+-	char out[64];
+-	int i;
+-	for (i=0;i<n;i++)
+-		out[i] = d[(i+count)%n];
+-	for (i=0;i<n;i++)
+-		d[i] = out[i];
+-}
+-
+-static void concat(char *out, char *in1, char *in2, int l1, int l2)
+-{
+-	while (l1--)
+-		*out++ = *in1++;
+-	while (l2--)
+-		*out++ = *in2++;
+-}
+-
+-static void xor(char *out, char *in1, char *in2, int n)
+-{
+-	int i;
+-	for (i=0;i<n;i++)
+-		out[i] = in1[i] ^ in2[i];
+-}
+-
+-static void dohash(char *out, char *in, char *key, int forw)
+-{
+-	int i, j, k;
+-	char pk1[56];
+-	char c[28];
+-	char d[28];
+-	char cd[56];
+-	char ki[16][48];
+-	char pd1[64];
+-	char l[32], r[32];
+-	char rl[64];
+-
+-	permute(pk1, key, perm1, 56);
+-
+-	for (i=0;i<28;i++)
+-		c[i] = pk1[i];
+-	for (i=0;i<28;i++)
+-		d[i] = pk1[i+28];
+-
+-	for (i=0;i<16;i++) {
+-		lshift(c, sc[i], 28);
+-		lshift(d, sc[i], 28);
+-
+-		concat(cd, c, d, 28, 28); 
+-		permute(ki[i], cd, perm2, 48); 
+-	}
+-
+-	permute(pd1, in, perm3, 64);
+-
+-	for (j=0;j<32;j++) {
+-		l[j] = pd1[j];
+-		r[j] = pd1[j+32];
+-	}
+-
+-	for (i=0;i<16;i++) {
+-		char er[48];
+-		char erk[48];
+-		char b[8][6];
+-		char cb[32];
+-		char pcb[32];
+-		char r2[32];
+-
+-		permute(er, r, perm4, 48);
+-
+-		xor(erk, er, ki[forw ? i : 15 - i], 48);
+-
+-		for (j=0;j<8;j++)
+-			for (k=0;k<6;k++)
+-				b[j][k] = erk[j*6 + k];
+-
+-		for (j=0;j<8;j++) {
+-			int m, n;
+-			m = (b[j][0]<<1) | b[j][5];
+-
+-			n = (b[j][1]<<3) | (b[j][2]<<2) | (b[j][3]<<1) | b[j][4]; 
+-
+-			for (k=0;k<4;k++) 
+-				b[j][k] = (sbox[j][m][n] & (1<<(3-k)))?1:0; 
+-		}
+-
+-		for (j=0;j<8;j++)
+-			for (k=0;k<4;k++)
+-				cb[j*4+k] = b[j][k];
+-		permute(pcb, cb, perm5, 32);
+-
+-		xor(r2, l, pcb, 32);
+-
+-		for (j=0;j<32;j++)
+-			l[j] = r[j];
+-
+-		for (j=0;j<32;j++)
+-			r[j] = r2[j];
+-	}
+-
+-	concat(rl, r, l, 32, 32);
+-
+-	permute(out, rl, perm6, 64);
+-}
+-
+ static void str_to_key(const uint8_t *str,uint8_t *key)
+ {
+ 	int i;
+@@ -325,30 +92,7 @@ static int des_crypt56_gnutls(uint8_t out[8], const uint8_t in[8],
+ */
+ void des_crypt56(uint8_t out[8], const uint8_t in[8], const uint8_t key[7], int forw)
+ {
+-	int i;
+-	char outb[64];
+-	char inb[64];
+-	char keyb[64];
+-	uint8_t key2[8];
+-
+-	str_to_key(key, key2);
+-
+-	for (i=0;i<64;i++) {
+-		inb[i] = (in[i/8] & (1<<(7-(i%8)))) ? 1 : 0;
+-		keyb[i] = (key2[i/8] & (1<<(7-(i%8)))) ? 1 : 0;
+-		outb[i] = 0;
+-	}
+-
+-	dohash(outb, inb, keyb, forw);
+-
+-	for (i=0;i<8;i++) {
+-		out[i] = 0;
+-	}
+-
+-	for (i=0;i<64;i++) {
+-		if (outb[i])
+-			out[i/8] |= (1<<(7-(i%8)));
+-	}
++	(void)des_crypt56_gnutls(out, in, key, forw);
+ }
+ 
+ void E_P16(const uint8_t *p14,uint8_t *p16)
+-- 
+2.22.0
+

0001-handle-removal-des-enctypes-from-krb5.patch

@@ -0,0 +1,314 @@
+From 3828e798da8e0b44356039dd927f0624d5d182f9 Mon Sep 17 00:00:00 2001
+From: Isaac Boukris <iboukris@gmail.com>
+Date: Wed, 6 Nov 2019 12:12:55 +0200
+Subject: [PATCH] Remove DES support if MIT Kerberos version does not support
+ it
+
+---
+ source3/libads/kerberos_keytab.c              |  2 -
+ source3/passdb/machine_account_secrets.c      | 36 ------------------
+ source4/auth/kerberos/kerberos.h              |  2 +-
+ .../dsdb/samdb/ldb_modules/password_hash.c    | 12 ++++++
+ source4/kdc/db-glue.c                         |  4 +-
+ source4/torture/rpc/remote_pac.c              | 37 -------------------
+ testprogs/blackbox/dbcheck-oldrelease.sh      |  2 +-
+ testprogs/blackbox/functionalprep.sh          |  2 +-
+ .../blackbox/test_export_keytab_heimdal.sh    | 16 ++++----
+ .../blackbox/upgradeprovision-oldrelease.sh   |  2 +-
+ 10 files changed, 26 insertions(+), 89 deletions(-)
+
+diff --git a/source3/libads/kerberos_keytab.c b/source3/libads/kerberos_keytab.c
+index 97d5535041c..7d193e1a600 100644
+--- a/source3/libads/kerberos_keytab.c
++++ b/source3/libads/kerberos_keytab.c
+@@ -240,8 +240,6 @@ int ads_keytab_add_entry(ADS_STRUCT *ads, const char *srvPrinc, bool update_ads)
+ 	krb5_data password;
+ 	krb5_kvno kvno;
+         krb5_enctype enctypes[6] = {
+-		ENCTYPE_DES_CBC_CRC,
+-		ENCTYPE_DES_CBC_MD5,
+ #ifdef HAVE_ENCTYPE_AES128_CTS_HMAC_SHA1_96
+ 		ENCTYPE_AES128_CTS_HMAC_SHA1_96,
+ #endif
+diff --git a/source3/passdb/machine_account_secrets.c b/source3/passdb/machine_account_secrets.c
+index dfc21f295a1..efba80f1474 100644
+--- a/source3/passdb/machine_account_secrets.c
++++ b/source3/passdb/machine_account_secrets.c
+@@ -1031,7 +1031,6 @@ static int secrets_domain_info_kerberos_keys(struct secrets_domain_info1_passwor
+ 	krb5_keyblock key;
+ 	DATA_BLOB aes_256_b = data_blob_null;
+ 	DATA_BLOB aes_128_b = data_blob_null;
+-	DATA_BLOB des_md5_b = data_blob_null;
+ 	bool ok;
+ #endif /* HAVE_ADS */
+ 	DATA_BLOB arc4_b = data_blob_null;
+@@ -1177,32 +1176,6 @@ static int secrets_domain_info_kerberos_keys(struct secrets_domain_info1_passwor
+ 		return ENOMEM;
+ 	}
+ 
+-	krb5_ret = smb_krb5_create_key_from_string(krb5_ctx,
+-						   NULL,
+-						   &salt,
+-						   &cleartext_utf8,
+-						   ENCTYPE_DES_CBC_MD5,
+-						   &key);
+-	if (krb5_ret != 0) {
+-		DBG_ERR("generation of a des-cbc-md5 key failed: %s\n",
+-			smb_get_krb5_error_message(krb5_ctx, krb5_ret, keys));
+-		krb5_free_context(krb5_ctx);
+-		TALLOC_FREE(keys);
+-		TALLOC_FREE(salt_data);
+-		return krb5_ret;
+-	}
+-	des_md5_b = data_blob_talloc(keys,
+-				     KRB5_KEY_DATA(&key),
+-				     KRB5_KEY_LENGTH(&key));
+-	krb5_free_keyblock_contents(krb5_ctx, &key);
+-	if (des_md5_b.data == NULL) {
+-		DBG_ERR("data_blob_talloc failed for des-cbc-md5.\n");
+-		krb5_free_context(krb5_ctx);
+-		TALLOC_FREE(keys);
+-		TALLOC_FREE(salt_data);
+-		return ENOMEM;
+-	}
+-
+ 	krb5_free_context(krb5_ctx);
+ no_kerberos:
+ 
+@@ -1227,15 +1200,6 @@ no_kerberos:
+ 	keys[idx].value			= arc4_b;
+ 	idx += 1;
+ 
+-#ifdef HAVE_ADS
+-	if (des_md5_b.length != 0) {
+-		keys[idx].keytype		= ENCTYPE_DES_CBC_MD5;
+-		keys[idx].iteration_count	= 4096;
+-		keys[idx].value			= des_md5_b;
+-		idx += 1;
+-	}
+-#endif /* HAVE_ADS */
+-
+ 	p->salt_data = salt_data;
+ 	p->default_iteration_count = 4096;
+ 	p->num_keys = idx;
+diff --git a/source4/auth/kerberos/kerberos.h b/source4/auth/kerberos/kerberos.h
+index 2ff9e3868af..1dd63acc838 100644
+--- a/source4/auth/kerberos/kerberos.h
++++ b/source4/auth/kerberos/kerberos.h
+@@ -50,7 +50,7 @@ struct keytab_container {
+ #define TOK_ID_GSS_GETMIC	((const uint8_t *)"\x01\x01")
+ #define TOK_ID_GSS_WRAP		((const uint8_t *)"\x02\x01")
+ 
+-#define ENC_ALL_TYPES (ENC_CRC32 | ENC_RSA_MD5 | ENC_RC4_HMAC_MD5 |	\
++#define ENC_ALL_TYPES (ENC_RC4_HMAC_MD5 |	\
+ 		       ENC_HMAC_SHA1_96_AES128 | ENC_HMAC_SHA1_96_AES256)
+ 
+ #ifndef HAVE_KRB5_SET_DEFAULT_TGS_KTYPES
+diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c
+index 006e35c46d5..f16937c6cab 100644
+--- a/source4/dsdb/samdb/ldb_modules/password_hash.c
++++ b/source4/dsdb/samdb/ldb_modules/password_hash.c
+@@ -786,6 +786,7 @@ static int setup_kerberos_keys(struct setup_password_fields_io *io)
+ 	 * create ENCTYPE_DES_CBC_MD5 key out of
+ 	 * the salt and the cleartext password
+ 	 */
++#ifdef SAMBA4_USES_HEIMDAL
+ 	krb5_ret = smb_krb5_create_key_from_string(io->smb_krb5_context->krb5_context,
+ 						   NULL,
+ 						   &salt,
+@@ -804,6 +805,11 @@ static int setup_kerberos_keys(struct setup_password_fields_io *io)
+ 					 KRB5_KEY_DATA(&key),
+ 					 KRB5_KEY_LENGTH(&key));
+ 	krb5_free_keyblock_contents(io->smb_krb5_context->krb5_context, &key);
++#else
++	/* MIT has dropped support for DES enctypes, store a random key instead. */
++	io->g.des_md5 = data_blob_talloc(io->ac, NULL, 8);
++	generate_secret_buffer(io->g.des_md5.data, 8);
++#endif
+ 	if (!io->g.des_md5.data) {
+ 		return ldb_oom(ldb);
+ 	}
+@@ -812,6 +818,7 @@ static int setup_kerberos_keys(struct setup_password_fields_io *io)
+ 	 * create ENCTYPE_DES_CBC_CRC key out of
+ 	 * the salt and the cleartext password
+ 	 */
++#ifdef SAMBA4_USES_HEIMDAL
+ 	krb5_ret = smb_krb5_create_key_from_string(io->smb_krb5_context->krb5_context,
+ 						   NULL,
+ 						   &salt,
+@@ -830,6 +837,11 @@ static int setup_kerberos_keys(struct setup_password_fields_io *io)
+ 					 KRB5_KEY_DATA(&key),
+ 					 KRB5_KEY_LENGTH(&key));
+ 	krb5_free_keyblock_contents(io->smb_krb5_context->krb5_context, &key);
++#else
++	/* MIT has dropped support for DES enctypes, store a random key instead. */
++	io->g.des_crc = data_blob_talloc(io->ac, NULL, 8);
++	generate_secret_buffer(io->g.des_crc.data, 8);
++#endif
+ 	if (!io->g.des_crc.data) {
+ 		return ldb_oom(ldb);
+ 	}
+diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c
+index f62a633c6c7..023ae7b580d 100644
+--- a/source4/kdc/db-glue.c
++++ b/source4/kdc/db-glue.c
+@@ -359,10 +359,10 @@ static krb5_error_code samba_kdc_message2entry_keys(krb5_context context,
+ 
+ 	/* If UF_USE_DES_KEY_ONLY has been set, then don't allow use of the newer enc types */
+ 	if (userAccountControl & UF_USE_DES_KEY_ONLY) {
+-		supported_enctypes = ENC_CRC32|ENC_RSA_MD5;
++		supported_enctypes = 0;
+ 	} else {
+ 		/* Otherwise, add in the default enc types */
+-		supported_enctypes |= ENC_CRC32 | ENC_RSA_MD5 | ENC_RC4_HMAC_MD5;
++		supported_enctypes |= ENC_RC4_HMAC_MD5;
+ 	}
+ 
+ 	/* Is this the krbtgt or a RODC krbtgt */
+diff --git a/source4/torture/rpc/remote_pac.c b/source4/torture/rpc/remote_pac.c
+index 7a5cda74b74..f12060e3c8f 100644
+--- a/source4/torture/rpc/remote_pac.c
++++ b/source4/torture/rpc/remote_pac.c
+@@ -38,7 +38,6 @@
+ 
+ #define TEST_MACHINE_NAME_BDC "torturepacbdc"
+ #define TEST_MACHINE_NAME_WKSTA "torturepacwksta"
+-#define TEST_MACHINE_NAME_WKSTA_DES "torturepacwkdes"
+ #define TEST_MACHINE_NAME_S4U2SELF_BDC "tests4u2selfbdc"
+ #define TEST_MACHINE_NAME_S4U2SELF_WKSTA "tests4u2selfwk"
+ 
+@@ -581,39 +580,6 @@ static bool test_PACVerify_workstation_aes(struct torture_context *tctx,
+ 			      NETLOGON_NEG_AUTH2_ADS_FLAGS | NETLOGON_NEG_SUPPORTS_AES);
+ }
+ 
+-static bool test_PACVerify_workstation_des(struct torture_context *tctx,
+-					   struct dcerpc_pipe *p, struct cli_credentials *credentials, struct test_join *join_ctx)
+-{
+-	struct samr_SetUserInfo r;
+-	union samr_UserInfo user_info;
+-	struct dcerpc_pipe *samr_pipe = torture_join_samr_pipe(join_ctx);
+-	struct smb_krb5_context *smb_krb5_context;
+-	krb5_error_code ret;
+-
+-	ret = cli_credentials_get_krb5_context(popt_get_cmdline_credentials(),
+-			tctx->lp_ctx, &smb_krb5_context);
+-	torture_assert_int_equal(tctx, ret, 0, "cli_credentials_get_krb5_context() failed");
+-
+-	if (smb_krb5_get_allowed_weak_crypto(smb_krb5_context->krb5_context) == FALSE) {
+-		torture_skip(tctx, "Cannot test DES without [libdefaults] allow_weak_crypto = yes");
+-	}
+-
+-	/* Mark this workstation with DES-only */
+-	user_info.info16.acct_flags = ACB_USE_DES_KEY_ONLY | ACB_WSTRUST;
+-	r.in.user_handle = torture_join_samr_user_policy(join_ctx);
+-	r.in.level = 16;
+-	r.in.info = &user_info;
+-
+-	torture_assert_ntstatus_ok(tctx, dcerpc_samr_SetUserInfo_r(samr_pipe->binding_handle, tctx, &r),
+-		"failed to set DES info account flags");
+-	torture_assert_ntstatus_ok(tctx, r.out.result,
+-		"failed to set DES into account flags");
+-
+-	return test_PACVerify(tctx, p, credentials, SEC_CHAN_WKSTA,
+-			      TEST_MACHINE_NAME_WKSTA_DES,
+-			      NETLOGON_NEG_AUTH2_ADS_FLAGS);
+-}
+-
+ #ifdef SAMBA4_USES_HEIMDAL
+ static NTSTATUS check_primary_group_in_validation(TALLOC_CTX *mem_ctx,
+ 						  uint16_t validation_level,
+@@ -1000,9 +966,6 @@ struct torture_suite *torture_rpc_remote_pac(TALLOC_CTX *mem_ctx)
+ 								      &ndr_table_netlogon, TEST_MACHINE_NAME_WKSTA);
+ 	torture_rpc_tcase_add_test_creds(tcase, "verify-sig-aes", test_PACVerify_workstation_aes);
+ 
+-	tcase = torture_suite_add_machine_workstation_rpc_iface_tcase(suite, "netlogon-member-des",
+-								      &ndr_table_netlogon, TEST_MACHINE_NAME_WKSTA_DES);
+-	torture_rpc_tcase_add_test_join(tcase, "verify-sig", test_PACVerify_workstation_des);
+ #ifdef SAMBA4_USES_HEIMDAL
+ 	tcase = torture_suite_add_machine_bdc_rpc_iface_tcase(suite, "netr-bdc-arcfour",
+ 							      &ndr_table_netlogon, TEST_MACHINE_NAME_S4U2SELF_BDC);
+diff --git a/testprogs/blackbox/dbcheck-oldrelease.sh b/testprogs/blackbox/dbcheck-oldrelease.sh
+index 3d0ee2c165a..41c55178d4e 100755
+--- a/testprogs/blackbox/dbcheck-oldrelease.sh
++++ b/testprogs/blackbox/dbcheck-oldrelease.sh
+@@ -388,7 +388,7 @@ referenceprovision() {
+ 
+ ldapcmp() {
+     if [ x$RELEASE = x"release-4-0-0" ]; then
+-         $PYTHON $BINDIR/samba-tool ldapcmp tdb://$PREFIX_ABS/${RELEASE}_reference/private/sam.ldb tdb://$PREFIX_ABS/${RELEASE}/private/sam.ldb --two --skip-missing-dn --filter=dnsRecord,displayName
++         $PYTHON $BINDIR/samba-tool ldapcmp tdb://$PREFIX_ABS/${RELEASE}_reference/private/sam.ldb tdb://$PREFIX_ABS/${RELEASE}/private/sam.ldb --two --skip-missing-dn --filter=dnsRecord,displayName,msDS-SupportedEncryptionTypes
+     fi
+ }
+ 
+diff --git a/testprogs/blackbox/functionalprep.sh b/testprogs/blackbox/functionalprep.sh
+index 80e82252d45..1d37611ef7a 100755
+--- a/testprogs/blackbox/functionalprep.sh
++++ b/testprogs/blackbox/functionalprep.sh
+@@ -61,7 +61,7 @@ provision_2012r2() {
+ ldapcmp_ignore() {
+     # At some point we will need to ignore, but right now, it should be perfect
+     IGNORE_ATTRS=$1
+-    $PYTHON $BINDIR/samba-tool ldapcmp tdb://$PREFIX_ABS/$2/private/sam.ldb tdb://$PREFIX_ABS/$3/private/sam.ldb --two --skip-missing-dn
++    $PYTHON $BINDIR/samba-tool ldapcmp tdb://$PREFIX_ABS/$2/private/sam.ldb tdb://$PREFIX_ABS/$3/private/sam.ldb --two --skip-missing-dn --filter msDS-SupportedEncryptionTypes
+ }
+ 
+ ldapcmp() {
+diff --git a/testprogs/blackbox/test_export_keytab_heimdal.sh b/testprogs/blackbox/test_export_keytab_heimdal.sh
+index cfa245fd4de..6a2595cd684 100755
+--- a/testprogs/blackbox/test_export_keytab_heimdal.sh
++++ b/testprogs/blackbox/test_export_keytab_heimdal.sh
+@@ -43,7 +43,7 @@ test_keytab() {
+ 
+ 	echo "test: $testname"
+ 
+-	NKEYS=$($VALGRIND $samba4ktutil $keytab | grep -i "$principal" | egrep -c "des|aes|arcfour")
++	NKEYS=$($VALGRIND $samba4ktutil $keytab | grep -i "$principal" | egrep -c "aes|arcfour")
+ 	status=$?
+ 	if [ x$status != x0 ]; then
+ 		echo "failure: $testname"
+@@ -64,22 +64,22 @@ unc="//$SERVER/tmp"
+ testit "create user locally" $VALGRIND $PYTHON $newuser nettestuser $USERPASS $@ || failed=`expr $failed + 1`
+ 
+ testit "dump keytab from domain" $VALGRIND $PYTHON $samba_tool domain exportkeytab $PREFIX/tmpkeytab $@ || failed=`expr $failed + 1`
+-test_keytab "read keytab from domain" "$PREFIX/tmpkeytab" "$SERVER\\\$" 5
++test_keytab "read keytab from domain" "$PREFIX/tmpkeytab" "$SERVER\\\$" 3
+ testit "dump keytab from domain (2nd time)" $VALGRIND $PYTHON $samba_tool domain exportkeytab $PREFIX/tmpkeytab $@ || failed=`expr $failed + 1`
+-test_keytab "read keytab from domain (2nd time)" "$PREFIX/tmpkeytab" "$SERVER\\\$" 5
++test_keytab "read keytab from domain (2nd time)" "$PREFIX/tmpkeytab" "$SERVER\\\$" 3
+ 
+ testit "dump keytab from domain for cifs principal" $VALGRIND $PYTHON $samba_tool domain exportkeytab $PREFIX/tmpkeytab-server --principal=cifs/$SERVER_FQDN $@ || failed=`expr $failed + 1`
+-test_keytab "read keytab from domain for cifs principal" "$PREFIX/tmpkeytab-server" "cifs/$SERVER_FQDN" 5
++test_keytab "read keytab from domain for cifs principal" "$PREFIX/tmpkeytab-server" "cifs/$SERVER_FQDN" 3
+ testit "dump keytab from domain for cifs principal (2nd time)" $VALGRIND $PYTHON $samba_tool domain exportkeytab $PREFIX/tmpkeytab-server --principal=cifs/$SERVER_FQDN $@ || failed=`expr $failed + 1`
+-test_keytab "read keytab from domain for cifs principal (2nd time)" "$PREFIX/tmpkeytab-server" "cifs/$SERVER_FQDN" 5
++test_keytab "read keytab from domain for cifs principal (2nd time)" "$PREFIX/tmpkeytab-server" "cifs/$SERVER_FQDN" 3
+ 
+ testit "dump keytab from domain for user principal" $VALGRIND $PYTHON $samba_tool domain exportkeytab $PREFIX/tmpkeytab-2 --principal=nettestuser $@ || failed=`expr $failed + 1`
+-test_keytab "dump keytab from domain for user principal" "$PREFIX/tmpkeytab-2" "nettestuser@$REALM" 5
++test_keytab "dump keytab from domain for user principal" "$PREFIX/tmpkeytab-2" "nettestuser@$REALM" 3
+ testit "dump keytab from domain for user principal (2nd time)" $VALGRIND $PYTHON $samba_tool domain exportkeytab $PREFIX/tmpkeytab-2 --principal=nettestuser@$REALM $@ || failed=`expr $failed + 1`
+-test_keytab "dump keytab from domain for user principal (2nd time)" "$PREFIX/tmpkeytab-2" "nettestuser@$REALM" 5
++test_keytab "dump keytab from domain for user principal (2nd time)" "$PREFIX/tmpkeytab-2" "nettestuser@$REALM" 3
+ 
+ testit "dump keytab from domain for user principal with SPN as UPN" $VALGRIND $PYTHON $samba_tool domain exportkeytab $PREFIX/tmpkeytab-3 --principal=http/testupnspn.$DNSDOMAIN $@ || failed=`expr $failed + 1`
+-test_keytab "dump keytab from domain for user principal" "$PREFIX/tmpkeytab-3" "http/testupnspn.$DNSDOMAIN@$REALM" 5
++test_keytab "dump keytab from domain for user principal" "$PREFIX/tmpkeytab-3" "http/testupnspn.$DNSDOMAIN@$REALM" 3
+ 
+ KRB5CCNAME="$PREFIX/tmpuserccache"
+ export KRB5CCNAME
+diff --git a/testprogs/blackbox/upgradeprovision-oldrelease.sh b/testprogs/blackbox/upgradeprovision-oldrelease.sh
+index 76276168011..208baa54a02 100755
+--- a/testprogs/blackbox/upgradeprovision-oldrelease.sh
++++ b/testprogs/blackbox/upgradeprovision-oldrelease.sh
+@@ -106,7 +106,7 @@ referenceprovision() {
+ 
+ ldapcmp() {
+     if [ x$RELEASE != x"alpha13" ]; then
+-         $PYTHON $BINDIR/samba-tool ldapcmp tdb://$PREFIX_ABS/${RELEASE}_upgrade_reference/private/sam.ldb tdb://$PREFIX_ABS/${RELEASE}_upgrade/private/sam.ldb --two --skip-missing-dn --filter=dnsRecord,displayName
++         $PYTHON $BINDIR/samba-tool ldapcmp tdb://$PREFIX_ABS/${RELEASE}_upgrade_reference/private/sam.ldb tdb://$PREFIX_ABS/${RELEASE}_upgrade/private/sam.ldb --two --skip-missing-dn --filter=dnsRecord,displayName,msDS-SupportedEncryptionTypes
+     fi
+ }
+ 
+-- 
+2.23.0
+

0002-samba-tool-create-working-private-krb5.conf.patch

@@ -0,0 +1,42 @@
+From 5a084994144704a6c146b94f8a22cf57ce08deab Mon Sep 17 00:00:00 2001
+From: Alexander Bokovoy <ab@samba.org>
+Date: Mon, 7 Oct 2019 18:24:28 +0300
+Subject: [PATCH] samba-tool: create working private krb5.conf
+
+DNS update tool uses private krb5.conf which should have enough details
+to authenticate with GSS-TSIG when running nsupdate.
+
+Unfortunately, the configuration we provide is not enough. We set
+defaults to not lookup REALM via DNS but at the same time we don't
+provide any realm definition. As result, MIT Kerberos cannot actually
+find a working realm for Samba AD deployment because it cannot query DNS
+for a realm discovery or pick it up from the configuration.
+
+Extend private krb5.conf with a realm definition that will allow MIT
+Kerberos to look up KDC over DNS.
+
+Signed-off-by: Alexander Bokovoy <ab@samba.org>
+Reviewed-by: Andreas Schneider <asn@samba.org>
+---
+ source4/setup/krb5.conf | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/source4/setup/krb5.conf b/source4/setup/krb5.conf
+index b1bf6cf907d..ad6f2818fb5 100644
+--- a/source4/setup/krb5.conf
++++ b/source4/setup/krb5.conf
+@@ -2,3 +2,11 @@
+ 	default_realm = ${REALM}
+ 	dns_lookup_realm = false
+ 	dns_lookup_kdc = true
++
++[realms]
++${REALM} = {
++	default_domain = ${DNSDOMAIN}
++}
++
++[domain_realm]
++	${HOSTNAME} = ${REALM}
+-- 
+2.21.0
+

filter-requires-samba.sh

@@ -0,0 +1,3 @@
+#!/bin/sh
+
+/usr/lib/rpm/perl.req $* | grep -E -v '(Net::LDAP|Crypt::SmbHash|CGI|Unicode::MapUTF8|smbldap_tools|Carp|Convert::ASN1|Getopt::Long|Getopt::Std|IO::Socket|POSIX|Time::Local|strict)'

gating.yaml

@@ -1,6 +0,0 @@
---- !Policy
-product_versions:
-  - fedora-*
-decision_context: bodhi_update_push_stable
-rules:
-  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional}

plans.fmf

@@ -1,4 +0,0 @@
-discover:
-    how: fmf
-execute:
-    how: tmt

rpminspect.yaml

@@ -1,35 +0,0 @@
----
-inspections:
-    disttag: off
-
-badfuncs:
-    ignore:
-        - /usr/bin/nmbd
-        - /usr/bin/nmblookup
-        - /usr/bin/smbtorture
-        - /usr/lib*/libndr.so.*
-        - /usr/lib*/libsmbconf.so.*
-        - /usr/lib*/samba/libgse-private-samba.so
-        - /usr/lib*/samba/libsamba-sockets-private-samba.so
-        - /usr/lib*/samba/service/nbtd.so
-        - /usr/libexec/ctdb/smnotify
-        - /usr/sbin/nmbd
-
-runpath:
-    allowed_paths:
-        - /usr/lib/samba
-        - /usr/lib64/samba
-
-abidiff:
-    suppression_file: samba.abignore
-
-debuginfo:
-    ignore:
-        - /usr/lib*/libdcerpc-samr.so.*
-
-annocheck:
-    ignore:
-        - /usr/bin/gentest
-        - /usr/bin/locktest
-        - /usr/bin/masktest
-        - /usr/bin/smbtorture

samba-4.23-fix-cmocka.patch

@@ -1,38 +0,0 @@
-From b1ec803f420b2c6d3c5c83d70c6875a7f36b15fc Mon Sep 17 00:00:00 2001
-From: Andreas Schneider <asn@samba.org>
-Date: Fri, 21 Nov 2025 15:33:32 +0100
-Subject: [PATCH] s4:dsdb: Do not declare cm_print_error()
-
-This is part of the cmocka.h header file.
-
-Signed-off-by: Andreas Schneider <asn@samba.org>
-Reviewed-by: Martin Schwenke <martin@meltin.net>
-Reviewed-by: Volker Lendecke <vl@samba.org>
-
-Autobuild-User(master): Volker Lendecke <vl@samba.org>
-Autobuild-Date(master): Mon Nov 24 11:28:08 UTC 2025 on atb-devel-224
-
-(cherry picked from commit 5a981663e4f677042ba80191770100aecff2120a)
----
- source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c | 5 -----
- 1 file changed, 5 deletions(-)
-
-diff --git a/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c b/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c
-index f7075f3485e..12c464b49c7 100644
---- a/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c
-+++ b/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c
-@@ -103,11 +103,6 @@ void audit_message_send(
- 
- #define check_group_change_message(m, u, a, e)                                 \
- 	_check_group_change_message(m, u, a, e, __FILE__, __LINE__);
--/*
-- * declare the internal cmocka cm_print_error so that we can output messages
-- * in sub unit format
-- */
--void cm_print_error(const char * const format, ...);
- 
- /*
-  * Validate a group change JSON audit message
--- 
-2.52.0
-

samba-systemd-sysusers.conf

@@ -1,2 +0,0 @@
-#Type Name       ID
-g     printadmin -

samba-usershares-systemd-sysusers.conf

@@ -1,2 +0,0 @@
-#Type Name       ID
-g     usershares -

samba-winbind-systemd-sysusers.conf

@@ -1,2 +0,0 @@
-#Type Name       ID
-g     wbpriv     88

samba.abignore

@@ -1,5 +0,0 @@
-#################################################
-# This is a grouping library without any code
-#################################################
-[suppress_file]
-file_name_regexp=.*libdcerpc-samr\\.so.*

samba.logrotate

@@ -1,4 +1,4 @@
-/var/log/samba/*log* {
+/var/log/samba/log.* {
     compress
     dateext
     maxage 365

smb.conf.example

@@ -269,13 +269,6 @@
 ;	map system = no
 ;	store dos attributes = yes
 
-# Turn on SMB 3.1.1 Unix Extensions by default
-#
-# Note: The Linux Kernel SMB3 client will negotiate unix extensions by default,
-# find more info in man mount.smb3(8). Linux 6.13 will finally support special
-# filetypes and symlink handling.
-
-	smb3 unix extensions = yes
 
 #============================ Share Definitions ==============================
 
@@ -288,7 +281,7 @@
 
 [printers]
 	comment = All Printers
-	path = /var/tmp
+	path = /var/spool/samba
 	browseable = no
 	guest ok = no
 	writable = no

smb.conf.vendor

@@ -2,10 +2,6 @@
 # read the smb.conf manpage.
 # Run 'testparm' to verify the config is correct after
 # you modified it.
-#
-# Note:
-# SMB1 is disabled by default. This means clients without support for SMB2 or
-# SMB3 are no longer able to connect to smbd (by default).
 
 [global]
 	workgroup = SAMBA
@@ -18,9 +14,6 @@
 	load printers = yes
 	cups options = raw
 
-	# Install samba-usershares package for support
-	include = /etc/samba/usershares.conf
-
 [homes]
 	comment = Home Directories
 	valid users = %S, %D%w%S
@@ -38,8 +31,7 @@
 [print$]
 	comment = Printer Drivers
 	path = /var/lib/samba/drivers
-	# printadmin is a local group
-	write list = printadmin root
-	force group = printadmin
+	write list = @printadmin root
+	force group = @printadmin
 	create mask = 0664
 	directory mask = 0775

sources

@@ -1,2 +1,2 @@
-SHA512 (samba-4.23.4.tar.xz) = 58979aa8a83e8210918f4f1adbcadff329e57a9cd25d7aba98d18f54a2e790a7ef3cc6b9fb3303d492d33d67f4a135849a419c95644d14e53a39654736d486ac
-SHA512 (samba-4.23.4.tar.asc) = 0981ce6a43202953cdc7ceae77fa0e3b4ab853991430dde4df6daa163984de6c7ca3f3a3037376659d3bdaedcc108cdd7a77ce0ac24d0a1add56c7103fca7dce
+SHA512 (samba-4.11.15.tar.xz) = 192d9ddbe5ffe6be1fbb845ba71b3b89eb3fc6bdd48eb1aa97d00cb281fdd1c0f999d03fa394ddcf24dfbae804161231badbfb3aa9d412024d049ce9122be30e
+SHA512 (samba-4.11.15.tar.asc) = c262e54669755fd7bf068a61c9f5b4984230504d956bcb9be737f2b8b312ab6b81a86f3a9c764961360fb790a999f1ef3c509b46214bdd09079d73d3b915ce46

tests/deps-check.fmf

@@ -1,22 +0,0 @@
-summary: Check samba package dependency structure
-description: |
-    Verify that samba library packages maintain correct dependency hierarchy:
-    - samba-core-libs has no samba-*-libs dependencies
-    - samba-ndr-libs depends on samba-core-libs (not samba-client-libs or samba-libs)
-    - samba-client-libs depends on core-libs + ndr-libs (not samba-libs)
-    - samba-client depends on samba-client-libs (not samba-libs)
-    - samba-libs does not depend on samba-dc-libs
-    - libsmbclient depends on samba-client-libs (not samba-libs)
-    - libwbclient has no samba-*-libs dependencies
-    - libldb has no samba-*-libs dependencies
-test: ./deps-check.sh
-framework: shell
-require:
-  - samba-core-libs
-  - samba-ndr-libs
-  - samba-client-libs
-  - samba-libs
-  - samba-client
-  - libwbclient
-  - libsmbclient
-  - libldb

tests/deps-check.sh

@@ -1,167 +0,0 @@
-#!/bin/bash
-#
-# Samba package dependency structure verification
-#
-# This test ensures that the samba library package dependencies don't regress.
-# The expected hierarchy is:
-#
-#   samba-core-libs    (no samba-*-libs dependencies)
-#        ^
-#        |
-#   samba-ndr-libs     (depends on samba-core-libs only)
-#        ^
-#        |
-#   samba-client-libs  (depends on samba-core-libs + samba-ndr-libs)
-#
-#   libwbclient        (no samba-*-libs dependencies - only links to libc)
-#
-#   samba-client       (depends on samba-client-libs, NOT samba-libs)
-#   libsmbclient       (depends on samba-client-libs, NOT samba-libs)
-#
-# NOTE: This test checks RESOLVED dependencies, not just explicit Requires.
-# A library requirement like 'libfoo.so' is resolved to the package that
-# provides it, ensuring we catch indirect dependencies.
-#
-
-set -e
-
-ERRORS=0
-
-# Get all packages that a package depends on (resolved)
-# This resolves library deps like 'libfoo.so' to actual package names
-get_resolved_deps() {
-    local pkg="$1"
-
-    rpm --query --requires "$pkg" 2>/dev/null | while read -r req; do
-        # Skip rpmlib and config requirements
-        [[ "$req" =~ ^rpmlib ]] && continue
-        [[ "$req" =~ ^config ]] && continue
-        [[ "$req" =~ ^/ ]] && continue
-
-        # Get the package that provides this requirement
-        provider=$(rpm --query --whatprovides "$req" 2>/dev/null | head -1)
-        if [ -n "$provider" ] && [ "$provider" != "no package provides $req" ]; then
-            # Extract just the package name (remove version-release.arch)
-            echo "${provider%%-[0-9]*}"
-        fi
-    done | sort -u
-}
-
-# Check that a package does NOT depend on packages matching a pattern
-# This checks RESOLVED dependencies (what packages actually get pulled in)
-check_no_resolved_dep() {
-    local pkg="$1"
-    local pattern="$2"
-    local description="$3"
-
-    if ! rpm --query "$pkg" &>/dev/null; then
-        echo "SKIP: $pkg not installed"
-        return 0
-    fi
-
-    local bad_deps
-    # Exclude the package itself from the check
-    bad_deps=$(get_resolved_deps "$pkg" | grep -v "^${pkg}$" | grep -E "$pattern" || true)
-
-    if [ -n "$bad_deps" ]; then
-        echo "FAIL: $pkg depends on $description"
-        echo "  Found: $bad_deps"
-        ERRORS=$((ERRORS + 1))
-        return 1
-    fi
-    echo "PASS: $pkg does not depend on $description"
-    return 0
-}
-
-# Check that a package DOES depend on a specific package
-check_has_resolved_dep() {
-    local pkg="$1"
-    local expected="$2"
-
-    if ! rpm --query "$pkg" &>/dev/null; then
-        echo "SKIP: $pkg not installed"
-        return 0
-    fi
-
-    if get_resolved_deps "$pkg" | grep -qF "$expected"; then
-        echo "PASS: $pkg depends on $expected"
-        return 0
-    fi
-    echo "FAIL: $pkg does not depend on $expected"
-    ERRORS=$((ERRORS + 1))
-    return 1
-}
-
-echo "=== Samba Package Dependency Checks ==="
-echo ""
-echo "Checking resolved dependencies (library deps resolved to packages)"
-echo ""
-
-# 1. samba-core-libs must NOT depend on any samba-*-libs packages
-echo "--- samba-core-libs ---"
-check_no_resolved_dep samba-core-libs "^samba-.*-libs$" "any samba*-libs package"
-
-echo ""
-
-# 2. samba-ndr-libs must depend on samba-core-libs
-#    but NOT samba-client-libs or samba-libs
-echo "--- samba-ndr-libs ---"
-check_has_resolved_dep samba-ndr-libs "samba-core-libs"
-check_no_resolved_dep samba-ndr-libs "^samba-client-libs$" "samba-client-libs"
-check_no_resolved_dep samba-ndr-libs "^samba-libs$" "samba-libs"
-
-echo ""
-
-# 3. samba-client-libs must depend on samba-core-libs and samba-ndr-libs
-#    but NOT samba-libs
-echo "--- samba-client-libs ---"
-check_has_resolved_dep samba-client-libs "samba-core-libs"
-check_has_resolved_dep samba-client-libs "samba-ndr-libs"
-check_no_resolved_dep samba-client-libs "^samba-libs$" "samba-libs"
-
-echo ""
-
-# 4. libwbclient must NOT depend on any samba-*-libs packages
-echo "--- libwbclient ---"
-check_no_resolved_dep libwbclient "^samba-.*-libs$" "any samba*-libs package"
-
-echo ""
-
-# 5. samba-client must depend on samba-client-libs but NOT samba-libs
-#    (client tools should not pull in server libraries)
-echo "--- samba-client ---"
-check_has_resolved_dep samba-client "samba-client-libs"
-check_no_resolved_dep samba-client "^samba-libs$" "samba-libs"
-
-echo ""
-
-# 6. libsmbclient must depend on samba-client-libs but NOT samba-libs
-#    (SMB client library should not pull in server libraries)
-echo "--- libsmbclient ---"
-check_has_resolved_dep libsmbclient "samba-client-libs"
-check_no_resolved_dep libsmbclient "^samba-libs$" "samba-libs"
-
-echo ""
-
-# 7. libldb must NOT depend on any samba-*-libs packages
-#    (libldb is a standalone database library)
-echo "--- libldb ---"
-check_no_resolved_dep libldb "^samba-.*-libs$" "any samba*-libs package"
-
-echo ""
-
-# 8. samba-libs must NOT depend on samba-dc-libs
-#    (server libraries should not pull in DC-specific libraries)
-echo "--- samba-libs ---"
-check_no_resolved_dep samba-libs "^samba-dc-libs$" "samba-dc-libs"
-
-echo ""
-echo "=== Summary ==="
-
-if [ $ERRORS -gt 0 ]; then
-    echo "FAILED: $ERRORS dependency check(s) failed"
-    exit 1
-fi
-
-echo "All dependency checks passed"
-exit 0

usershares.conf.vendor

@@ -1,3 +0,0 @@
-[global]
-	usershare max shares = 100
-	usershare allow guests = yes