rpms
/
samba
2
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Update to Samba 4.15.0rc6 

resolves: #2002546

Guenther
This commit is contained in:
Günther Deschner 2021-09-09 09:58:04 +02:00
parent 29bd82541a
commit c6ac21963a
4 changed files with 48 additions and 39 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.gitignore vendored
View File

@ -263,3 +263,5 @@ samba-3.6.0pre1.tar.gz
/samba-4.15.0rc4.tar.asc
/samba-4.15.0rc5.tar.xz
/samba-4.15.0rc5.tar.asc
/samba-4.15.0rc6.tar.xz
/samba-4.15.0rc6.tar.asc

69
samba-s4u.patch
View File

@ -1,22 +1,21 @@
From fe300549844509624d944b93fc64dc6d382e71c1 Mon Sep 17 00:00:00 2001
From 7c4125deb1e03917f0a2353740f2c0e9e6cf87c5 Mon Sep 17 00:00:00 2001
From: Isaac Boukris <iboukris@gmail.com>
Date: Fri, 27 Sep 2019 18:25:03 +0300
Subject: [PATCH 3/7] mit-kdc: add basic loacl realm S4U support
Subject: [PATCH 1/3] mit-kdc: add basic loacl realm S4U support
Signed-off-by: Isaac Boukris <iboukris@gmail.com>
Pair-Programmed-With: Andreas Schneider <asn@samba.org>
---
source4/kdc/mit-kdb/kdb_samba_policies.c | 148 +++++++++---------
source4/kdc/mit_samba.c | 47 ++----
source4/kdc/mit_samba.h | 6 +-
wscript_configure_system_mitkrb5 | 3 +
6 files changed, 91 insertions(+), 115 deletions(-)
source4/kdc/mit-kdb/kdb_samba_policies.c | 148 +++++++++++------------
source4/kdc/mit_samba.c | 47 ++-----
source4/kdc/mit_samba.h | 6 +-
3 files changed, 86 insertions(+), 115 deletions(-)
diff --git a/source4/kdc/mit-kdb/kdb_samba_policies.c b/source4/kdc/mit-kdb/kdb_samba_policies.c
index 9197551ed61..944324d9a2f 100644
index ac9865aac60..17d4c4028b9 100644
--- a/source4/kdc/mit-kdb/kdb_samba_policies.c
+++ b/source4/kdc/mit-kdb/kdb_samba_policies.c
@@ -192,13 +192,17 @@ static krb5_error_code ks_verify_pac(krb5_context context,
@@ -195,13 +195,17 @@ static krb5_error_code ks_verify_pac(krb5_context context,
krb5_keyblock *krbtgt_key,
krb5_timestamp authtime,
krb5_authdata **tgt_auth_data,
@ -37,7 +36,7 @@ index 9197551ed61..944324d9a2f 100644
mit_ctx = ks_get_context(context);
if (mit_ctx == NULL) {
@@ -230,41 +234,43 @@ static krb5_error_code ks_verify_pac(krb5_context context,
@@ -233,41 +237,43 @@ static krb5_error_code ks_verify_pac(krb5_context context,
code = krb5_pac_parse(context,
authdata[0]->contents,
authdata[0]->length,
@ -107,7 +106,7 @@ index 9197551ed61..944324d9a2f 100644
if (code != 0) {
goto done;
}
@@ -272,17 +278,22 @@ static krb5_error_code ks_verify_pac(krb5_context context,
@@ -275,17 +281,22 @@ static krb5_error_code ks_verify_pac(krb5_context context,
code = mit_samba_reget_pac(mit_ctx,
context,
flags,
@ -134,18 +133,18 @@ index 9197551ed61..944324d9a2f 100644
return code;
}
@@ -324,7 +335,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
@@ -310,7 +321,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
krb5_authdata ***signed_auth_data)
{
#endif
krb5_authdata **authdata = NULL;
- krb5_boolean is_as_req;
+ krb5_const_principal pac_client;
krb5_error_code code;
krb5_pac pac = NULL;
krb5_data pac_data;
@@ -334,24 +345,21 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
@@ -318,24 +329,21 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
krbtgt = krbtgt == NULL ? local_krbtgt : krbtgt;
krbtgt_key = krbtgt_key == NULL ? local_krbtgt_key : krbtgt_key;
#endif
- /* FIXME: We don't support S4U yet */
- if (flags & KRB5_KDB_FLAGS_S4U) {
@ -179,7 +178,7 @@ index 9197551ed61..944324d9a2f 100644
client,
server,
krbtgt,
@@ -363,14 +371,28 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
@@ -347,14 +355,28 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
if (code != 0) {
goto done;
}
@ -209,7 +208,7 @@ index 9197551ed61..944324d9a2f 100644
}
if (pac == NULL) {
@@ -379,7 +401,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
@@ -363,7 +385,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
}
code = krb5_pac_sign(context, pac, authtime, client_princ,
@ -218,7 +217,7 @@ index 9197551ed61..944324d9a2f 100644
if (code != 0) {
DBG_ERR("krb5_pac_sign failed: %d\n", code);
goto done;
@@ -405,11 +427,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
@@ -389,11 +411,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
KRB5_AUTHDATA_IF_RELEVANT,
authdata,
signed_auth_data);
@ -230,7 +229,7 @@ index 9197551ed61..944324d9a2f 100644
done:
krb5_pac_free(context, pac);
@@ -432,32 +449,13 @@ krb5_error_code kdb_samba_db_check_allowed_to_delegate(krb5_context context,
@@ -416,32 +433,13 @@ krb5_error_code kdb_samba_db_check_allowed_to_delegate(krb5_context context,
* server; -> delegating service
* proxy; -> target principal
*/
@ -265,10 +264,10 @@ index 9197551ed61..944324d9a2f 100644
diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c
index 54dcd545ea1..f23327c9613 100644
index 0a0d3a98315..5f35c6025bf 100644
--- a/source4/kdc/mit_samba.c
+++ b/source4/kdc/mit_samba.c
@@ -467,7 +467,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx,
@@ -493,7 +493,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx,
krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx,
krb5_context context,
int flags,
@ -276,7 +275,7 @@ index 54dcd545ea1..f23327c9613 100644
krb5_db_entry *client,
krb5_db_entry *server,
krb5_db_entry *krbtgt,
@@ -615,7 +614,7 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx,
@@ -641,7 +640,7 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx,
context,
*pac,
server->princ,
@ -285,7 +284,7 @@ index 54dcd545ea1..f23327c9613 100644
deleg_blob);
if (!NT_STATUS_IS_OK(nt_status)) {
DEBUG(0, ("Update delegation info failed: %s\n",
@@ -937,41 +936,17 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx,
@@ -963,41 +962,17 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx,
}
int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx,
@ -362,12 +361,13 @@ index ba824557bd5..5aadf206443 100644
int mit_samba_kpasswd_change_password(struct mit_samba_context *ctx,
char *pwd,
--
2.25.4
2.31.1
From ff1b225493ede3d43cfad571770dacb73f75ec42 Mon Sep 17 00:00:00 2001
From b2ada81ed9f89f6b38fb0a9e54811408676671d0 Mon Sep 17 00:00:00 2001
From: Isaac Boukris <iboukris@gmail.com>
Date: Fri, 27 Sep 2019 18:35:30 +0300
Subject: [PATCH 5/7] krb5-mit: enable S4U client support for MIT build
Subject: [PATCH 2/3] krb5-mit: enable S4U client support for MIT build
Signed-off-by: Isaac Boukris <iboukris@gmail.com>
Pair-Programmed-With: Andreas Schneider <asn@samba.org>
@ -375,7 +375,7 @@ Pair-Programmed-With: Andreas Schneider <asn@samba.org>
lib/krb5_wrap/krb5_samba.c | 185 ++++++++++++++++++++++++++
lib/krb5_wrap/krb5_samba.h | 2 -
source4/auth/kerberos/kerberos_util.c | 11 --
4 files changed, 185 insertions(+), 14 deletions(-)
3 files changed, 185 insertions(+), 13 deletions(-)
diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c
index 20ce86c708d..e72ab3c30f7 100644
@ -574,7 +574,7 @@ index 20ce86c708d..e72ab3c30f7 100644
#if !defined(HAVE_KRB5_MAKE_PRINCIPAL) && defined(HAVE_KRB5_BUILD_PRINCIPAL_ALLOC_VA)
diff --git a/lib/krb5_wrap/krb5_samba.h b/lib/krb5_wrap/krb5_samba.h
index ca9a893e4f7..3264ce5eb3b 100644
index 9550447b2c5..ee3931c7544 100644
--- a/lib/krb5_wrap/krb5_samba.h
+++ b/lib/krb5_wrap/krb5_samba.h
@@ -252,7 +252,6 @@ krb5_error_code smb_krb5_kinit_password_ccache(krb5_context ctx,
@ -639,14 +639,13 @@ index 544d9d853cc..c14d8c72d8c 100644
ret = smb_krb5_kinit_password_ccache(smb_krb5_context->krb5_context,
ccache,
--
2.25.4
2.31.1
From cf1b9bdc09180d68e2b30258839d2f78b7af9c62 Mon Sep 17 00:00:00 2001
From bc5e97074739d29320a3e890575353fbfd452047 Mon Sep 17 00:00:00 2001
From: Isaac Boukris <iboukris@gmail.com>
Date: Sat, 19 Sep 2020 14:16:20 +0200
Subject: [PATCH 7/7] wip: for canonicalization with new MIT kdc code
Subject: [PATCH 3/3] wip: for canonicalization with new MIT kdc code
---
source4/heimdal/lib/hdb/hdb.h | 1 +
@ -696,10 +695,10 @@ index a560a1cd84b..c27b6a8ef4c 100644
ret = smb_krb5_make_principal(context, &entry_ex->entry.principal, lpcfg_realm(lp_ctx), samAccountName, NULL);
if (ret) {
diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c
index f23327c9613..4084e893cc2 100644
index 5f35c6025bf..20ee2c2b89e 100644
--- a/source4/kdc/mit_samba.c
+++ b/source4/kdc/mit_samba.c
@@ -198,6 +198,9 @@ int mit_samba_get_principal(struct mit_samba_context *ctx,
@@ -224,6 +224,9 @@ int mit_samba_get_principal(struct mit_samba_context *ctx,
if (kflags & KRB5_KDB_FLAG_CANONICALIZE) {
sflags |= SDB_F_CANON;
}
@ -722,5 +721,5 @@ index c929acccce6..a9115ec23d7 100644
void sdb_free_entry(struct sdb_entry_ex *e);
void free_sdb_entry(struct sdb_entry *s);
--
2.25.4
2.31.1

12
samba.spec
View File

@ -129,7 +129,7 @@
%define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not")
%global baserelease 10
%global baserelease 11
%global samba_version 4.15.0
%global talloc_version 2.3.3
@ -137,7 +137,7 @@
%global tevent_version 0.11.0
%global ldb_version 2.4.0
# This should be rc1 or nil
%global pre_release rc5
%global pre_release rc6
%global samba_release %{baserelease}
%if "x%{?pre_release}" != "x"
@ -2813,6 +2813,7 @@ fi
%{python3_sitearch}/samba/tests/dcerpc/__pycache__/binding.*.pyc
%{python3_sitearch}/samba/tests/dcerpc/__pycache__/dnsserver.*.pyc
%{python3_sitearch}/samba/tests/dcerpc/__pycache__/integer.*.pyc
%{python3_sitearch}/samba/tests/dcerpc/__pycache__/lsa.*.pyc
%{python3_sitearch}/samba/tests/dcerpc/__pycache__/mdssvc.*.pyc
%{python3_sitearch}/samba/tests/dcerpc/__pycache__/misc.*.pyc
%{python3_sitearch}/samba/tests/dcerpc/__pycache__/raw_protocol.*.pyc
@ -2832,6 +2833,7 @@ fi
%{python3_sitearch}/samba/tests/dcerpc/createtrustrelax.py
%{python3_sitearch}/samba/tests/dcerpc/dnsserver.py
%{python3_sitearch}/samba/tests/dcerpc/integer.py
%{python3_sitearch}/samba/tests/dcerpc/lsa.py
%{python3_sitearch}/samba/tests/dcerpc/mdssvc.py
%{python3_sitearch}/samba/tests/dcerpc/misc.py
%{python3_sitearch}/samba/tests/dcerpc/raw_protocol.py
@ -2901,6 +2903,7 @@ fi
%{python3_sitearch}/samba/tests/krb5/__pycache__/as_canonicalization_tests.*.pyc
%{python3_sitearch}/samba/tests/krb5/__pycache__/as_req_tests.*.pyc
%{python3_sitearch}/samba/tests/krb5/__pycache__/compatability_tests.*.pyc
%{python3_sitearch}/samba/tests/krb5/__pycache__/fast_tests.*.pyc
%{python3_sitearch}/samba/tests/krb5/__pycache__/kcrypto.*.pyc
%{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_base_test.*.pyc
%{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tests.*.pyc
@ -2919,6 +2922,7 @@ fi
%{python3_sitearch}/samba/tests/krb5/as_canonicalization_tests.py
%{python3_sitearch}/samba/tests/krb5/as_req_tests.py
%{python3_sitearch}/samba/tests/krb5/compatability_tests.py
%{python3_sitearch}/samba/tests/krb5/fast_tests.py
%{python3_sitearch}/samba/tests/krb5/kcrypto.py
%{python3_sitearch}/samba/tests/krb5/kdc_base_test.py
%{python3_sitearch}/samba/tests/krb5/kdc_tests.py
@ -4071,6 +4075,10 @@ fi
%endif
%changelog
* Thu Sep 09 2021 Guenther Deschner <gdeschner@redhat.com> - 4.15.0-0.11.rc6
- Update to Samba 4.15.0rc6
- resolves: #2002546
* Tue Sep 07 2021 Guenther Deschner <gdeschner@redhat.com> - 4.15.0-0.10.rc5
- Update to Samba 4.15.0rc5
- resolves: #2001827

4
sources
View File

@ -1,2 +1,2 @@
SHA512 (samba-4.15.0rc5.tar.xz) = 53b79354a441e4a29ed7e807e0f18d4249b8ee0f99bf034947dd4c4674f68eb2b795832130025ab214cc3ad2deaa771b202131addc0b563a2d4310b7809e698d
SHA512 (samba-4.15.0rc5.tar.asc) = 0eea9c233c98bd52ad91a2c7bcf384d3dbe5b7017bf76dd29b083256ed95e78b6538d25d93b04710c4684d077755179a813dda82470301b8f87f63b61a6f2461
SHA512 (samba-4.15.0rc6.tar.xz) = 9b3c7e2f34e672072da9fcfc5613079f884ab7120d19f09f18c74262eddc342bff00796ed1b0c30ba1a8b8dc2b22cdba9909baca82da91bd9352de334c1ef271
SHA512 (samba-4.15.0rc6.tar.asc) = 5aa243b3dc68890feef77d44d2beae2401a9827219fe84a53d564e1e6b56175e46282c7e0c6ac932fd535bc1bf4b8a5403da4281a0bb7919543e2a464b9e8c89