summaryrefslogtreecommitdiffstats
path: root/package/samba4
Commit message (Collapse)AuthorAgeFilesLines
* Merge branch 'next'Thomas Petazzoni2017-12-014-6/+10
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This merges the next branch accumulated during the 2017.11 release cycle back into the master branch. A few conflicts had to be resolved: - In the DEVELOPERS file, because Fabrice Fontaine was added as a developer for libupnp in master, and for libupnp18 in next. Resolution is simple: add him for both. - linux/Config.in, because we updated the 4.13.x release used by default in master, while we moved to 4.14 in next. Resolution: use 4.14. - package/libupnp/libupnp.hash: a hash for the license file was added in master, while the package was bumped into next. Resolution: keep the hash for the license file, and keep the hash for the newest version of libupnp. - package/linux-headers/Config.in.host: default version of the kernel headers for 4.13 was bumped to the latest 4.13.x in master, but was changed to 4.14 in next. Resolution: use 4.14. - package/samba4/: samba was bumped to 4.6.11 in master for security reasons, but was bumped to 4.7.3 in next. Resolution: keep 4.7.3. Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
| * package/samba4: bump version to 4.7.3Bernd Kuhls2017-11-274-6/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Rebased 0001-libreplace-disable-libbsd-support.patch. Added iconv-related entry to samba4-cache.txt to fix configure error: Cross answers file /home/buildroot/test-samba4/armv5-ctng-linux-gnueabi/build/samba4-4.7.3/cache.txt is incomplete with this defconfig BR2_TOOLCHAIN_BUILDROOT_WCHAR=y BR2_PACKAGE_LIBICONV=y BR2_PACKAGE_SAMBA4=y BR2_PACKAGE_SAMBA4_AD_DC=y BR2_PACKAGE_SAMBA4_ADS=y BR2_PACKAGE_SAMBA4_SMBTORTURE=y Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* | samba4: ensure that copied cache.txt is writableDanomi Manchego2017-11-291-1/+1
| | | | | | | | | | | | | | | | | | | | If the Buildroot tree is read-only, then cache.txt is copied read-only into the build directory, and the configuration step fails. Fix this in the same way we do in other places, by opening permissions as we copy the file using $(INSTALL). Signed-off-by: Danomi Manchego <danomimanchego123@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* | samba4: security bump to version 4.6.11Peter Korsgaard2017-11-222-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes the following security issues: - CVE-2017-14746: All versions of Samba from 4.0.0 onwards are vulnerable to a use after free vulnerability, where a malicious SMB1 request can be used to control the contents of heap memory via a deallocated heap pointer. It is possible this may be used to compromise the SMB server. - CVE-2017-15275: All versions of Samba from 3.6.0 onwards are vulnerable to a heap memory information leak, where server allocated heap memory may be returned to the client without being cleared. There is no known vulnerability associated with this error, but uncleared heap memory may contain previously used data that may help an attacker compromise the server via other methods. Uncleared heap memory may potentially contain password hashes or other high-value data. For more details, see the release notes: https://www.samba.org/samba/history/samba-4.6.11.html Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* | package/samba4: bump version to 4.6.10Bernd Kuhls2017-11-152-2/+2
|/ | | | | | | | | | | | | | | Quoting release notes https://www.samba.org/samba/history/samba-4.6.10.html "This is an additional bugfix release to address a possible data corruption issue. Please update immediately! For details, please see https://bugzilla.samba.org/show_bug.cgi?id=13130 Samba 4.6.0 and newer is affected by this issue." Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/samba4: bump version to 4.6.9Bernd Kuhls2017-10-282-2/+3
| | | | | | | | | Release notes: https://www.samba.org/samba/history/samba-4.6.9.html Added license hash. Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/samba4: security bump to version 4.6.8Bernd Kuhls2017-09-212-2/+2
| | | | | | | | | | | | | | | Release notes: https://www.samba.org/samba/history/samba-4.6.8.html Fixes - CVE-2017-12150 (SMB1/2/3 connections may not require signing where they should) - CVE-2017-12151 (SMB3 connections don't keep encryption across DFS redirects) - CVE-2017-12163 (Server memory information leak over SMB1) Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/samba4: bump version to 4.6.7Bernd Kuhls2017-08-192-2/+2
| | | | | | | Release notes: https://www.samba.org/samba/history/samba-4.6.7.html Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/samba4: bump version to 4.6.6Bernd Kuhls2017-08-022-2/+2
| | | | | Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/samba4: add optional dependency to dbusBernd Kuhls2017-08-021-0/+4
| | | | | | | | | | | | | | samba4 picks up dbus as dependency if it was built before: Checking for dbus : yes Checking for header dbus/dbus.h : yes Checking for library dbus-1 : yes There is no configure option to control dbus support so we just make sure dbus is built before samba4 to have reproducible builds. Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/samba4: allow to use libtirpc instead of internal C implementationBernd Kuhls2017-08-022-3/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch allows building samba4 with uClibc again after rpc support was removed from uClibc. Building with musl is still broken: The first error ../nsswitch/wins.c: In function ‘_nss_wins_gethostbyname_r’: ../nsswitch/wins.c:272:15: error: ‘NETDB_INTERNAL’ undeclared (first use in this function) *h_errnop = NETDB_INTERNAL; ^~~~~~~~~~~~~~ ../nsswitch/wins.c:272:15: note: each undeclared identifier is reported only once for each function it appears in ../nsswitch/wins.c:349:14: error: ‘NETDB_SUCCESS’ undeclared (first use in this function) *h_errnop = NETDB_SUCCESS; ^~~~~~~~~~~~~ could be solved by applying https://git.alpinelinux.org/cgit/aports/tree/main/samba/netdb-defines.patch but then the build fails at ../ctdb/tests/src/test_mutex_raw.c: In function ‘main’: ../ctdb/tests/src/test_mutex_raw.c:170:28: error: ‘pthread_mutex_t {aka struct <anonymous>}’ has no member named ‘__data’ printf("pid=%u\n", mutex->__data.__owner); ^~ Therefore we disable musl support until a fix can be found. Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> [Thomas: - instead of setting SAMBA4_CONF_ENV within the libtirpc condition, introduce SAMBA4_CFLAGS and SAMBA4_LDFLAGS variables and use them - add missing dependency on host-pkgconf, needed because we call pkg-config to get the flags from libtirpc] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/samba4: security bump to version 4.5.12Bernd Kuhls2017-07-132-2/+2
| | | | | | | | | | | | | | | | | Fixes CVE-2017-11103: All versions of Samba from 4.0.0 onwards using embedded Heimdal Kerberos are vulnerable to a man-in-the-middle attack impersonating a trusted server, who may gain elevated access to the domain by returning malicious replication or authorization data. Samba binaries built against MIT Kerberos are not vulnerable. https://www.samba.org/samba/history/samba-4.5.12.html [Peter: add CVE info] Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* samba4: use the new gettext logicThomas Petazzoni2017-07-051-7/+2
| | | | | | | | This commit switches to use the new gettext logic, which involves using TARGET_NLS_DEPENDENCIES instead of hand-encoded dependencies on gettext/host-gettext. Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/samba4: security bump to version 4.5.10Bernd Kuhls2017-05-292-2/+2
| | | | | | | | Fixes CVE-2017-7494: https://www.samba.org/samba/history/samba-4.5.10.html Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/gnutls: disable for static buildBernd Kuhls2017-05-291-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The gnutils code uses __attribute__((constructor)) and __attribute__((destructor)) to call constructor/desctructor when a shared library is loaded. Constructor/desctructor are not used when a static library is used (except when if -Wl,--whole-archive -lgnutls -Wno-whole-archive is used, not tested). Even if gnutls initialization (_gnutls_global_init()) may be called manually, the gnutls maintainer said it's not supported [1]. "Note that static linking applications with gnutls is not something supported. gnutls relies on library constructors and destructors which are not loaded when linking statically." Now the gnutls script warns about static linking [2]. So disable gnutls statically by adding "depends on !BR2_STATIC_LIBS" at Kconfig level and --disable-static in GNUTLS_CONF_OPTS. Fixes: [taskd] http://autobuild.buildroot.net/results/c2d/c2dd5c1c9dc87d2943c15e58ee56e67d7375368c [ffmpeg] http://autobuild.buildroot.net/results/892/8926d319d6d1cd1ee72239ad7d9ca869d2355628 [sngrep] http://autobuild.buildroot.net/results/f7f/f7fb42d3742f6f01000a0d181e0c785640284405 [1] https://gitlab.com/gnutls/gnutls/issues/203 [2] https://gitlab.com/gnutls/gnutls/commit/6b748886799f88ddee9721dba4fc4d52854832ae Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> [Romain: merge our two patches together add some option comment disable static libgnutls.a add sngrep autobuilder reference] Signed-off-by: Romain Naour <romain.naour@gmail.com> Tested-by: Bernd Kuhls <bernd.kuhls@t-online.de> [Thomas: do not disable libgnutls.a] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/samba4: bump version to 4.5.8Bernd Kuhls2017-04-292-2/+2
| | | | | | | | Version bump includes a regression fix: https://www.samba.org/samba/history/samba-4.5.8.html Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* boot, package: use SPDX short identifier for GPLv3/GPLv3+Rahul Bedarkar2017-04-011-1/+1
| | | | | | | | | | | | We want to use SPDX identifier for license string as much as possible. SPDX short identifier for GPLv3/GPLv3+ is GPL-3.0/GPL-3.0+. This change is done using following command. find . -name "*.mk" | xargs sed -ri '/LICENSE( )?[\+:]?=/s/\<GPLv3\>/GPL-3.0/g' Signed-off-by: Rahul Bedarkar <rahulbedarkar89@gmail.com> Acked-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* samba4: security bump to version 4.5.7Peter Korsgaard2017-03-282-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes CVE-2017-2619: All versions of Samba prior to 4.6.1, 4.5.7, 4.4.11 are vulnerable to a malicious client using a symlink race to allow access to areas of the server file system not exported under the share definition. Samba uses the realpath() system call to ensure when a client requests access to a pathname that it is under the exported share path on the server file system. Clients that have write access to the exported part of the file system via SMB1 unix extensions or NFS to create symlinks can race the server by renaming a realpath() checked path and then creating a symlink. If the client wins the race it can cause the server to access the new symlink target after the exported share path check has been done. This new symlink target can point to anywhere on the server file system. This is a difficult race to win, but theoretically possible. Note that the proof of concept code supplied wins the race reliably only when the server is slowed down using the strace utility running on the server. Exploitation of this bug has not been seen in the wild. Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* ncurses: remove BR2_PACKAGE_NCURSES_TARGET_{FORM, MENU, PANEL} optionsThomas Petazzoni2017-02-261-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The ncurses sub-options BR2_PACKAGE_NCURSES_TARGET_{FORM,MENU,PANEL} are currently very badly broken: they only control whether the libform, libmenu and libpanel libraries are installed in $(TARGET_DIR), but do absolutely nothing about their installation in $(STAGING_DIR). This means that when one of those options is disabled, the corresponding library is indeed not installed in the target, but is available in staging. It can therefore be detected by the configure script of another package and used... even though the library will not be in the target, causing a runtime failure. Internally, ncurses.mk uses the "make install" logic of ncurses for the staging installation, but uses a completely hand-written logic for the target installation, which is the reason for this desynchronization between what's installed in staging and target. When BR2_PACKAGE_NCURSES_WCHAR=y, this also causes some build failures. Indeed, when BR2_PACKAGE_NCURSES_WCHAR=y, Buildroot creates some symbolic links lib<foo>.so -> lib<foo>w.so in staging and target, but only for the lib<foo> that have been enabled by BR2_PACKAGE_NCURSES_TARGET_{FORM,MENU,PANEL}. Due to this, a package that for example needed the libmenu library but forgot to select BR2_PACKAGE_NCURSES_TARGET_MENU was: - Building fine with BR2_PACKAGE_NCURSES_WCHAR disabled (because libmenu.so exists in staging), but would fail to run at runtime because libmenu.so is not in the target. - Fail to build with BR2_PACKAGE_NCURSES_WCHAR=y because only libmenuw.so exists, and not the libmenu.so symbolic link. Since those libraries are small (43K for libform, 21K for libmenu and 8.2K for libpanel), this commit takes the very simple approach of removing those options, and installing the libraries unconditionally. It therefore uses the "make install" logic for both the staging *and* target installation. In detail, this commit: - Removes the NCURSES_PROGS variable, not needed since --without-progs already allows to disable the build and installation of programs. - Removes the NCURSES_LIBS-y variable, and replaces it with a single unconditional assignement to NCURSES_LIBS, only used to create the lib<foo>w.so -> lib<foo>.so symbolic links when wchar support is enabled. - Removes NCURSES_INSTALL_TARGET_CMDS and the functions it was calling: NCURSES_INSTALL_TARGET_LIBS and NCURSES_INSTALL_TARGET_PROGS. - Adds a NCURSES_TARGET_SYMLINK_RESET hook to create the reset -> tset symbolic link, as was done before. - Adds a NCURSES_TARGET_CLEANUP_TERMINFO to cleanup the terminfo files in the target, so that we stay in the same situation in terms of installed terminfo files. - Removes the BR2_PACKAGE_NCURSES_TARGET_{FORM,MENU,PANEL} options from the Config.in files: both their definition and usage. - Simplifies all the symlink dance for lib<foo> -> lib<foo>w, because as Yann E. Morin suggested, this dance is only needed in staging, not in the target. Once binaries have been built, they refer to the SONAME of the library, which is the lib<foo>w variant (for shared linking). For static linking and .pc files, it's obvious that we don't care about them on the target. Therefore the NCURSES_LINK_LIBS_STATIC, NCURSES_LINK_LIBS_SHARED and NCURSES_LINK_PC functions no longer take any argument: they always apply to STAGING_DIR only. NCURSES_LINK_TARGET_LIBS is removed. It is worth mentioning that adding Config.in.legacy support is *NOT* necessary. Indeed: - If they were disabled before this patch, having them in Config.in.legacy would not trigger the legacy warning. - If they were enabled before this patch, then the behavior is unchanged: all libraries are now unconditionally installed. So there is no point in warning the user. We double-checked the installed size of a filesystem containing just ncurses before and after this patch, and the only folder that has its size changed is /usr/lib, growing from 852 KB to 932 KB in the wchar enabled case. That's a 80 KB system size increase. This commit fixes the sngrep build failure and potentially numerous runtime issues with ncurses. Fixes: http://autobuild.buildroot.net/results/7b5db21a6c568e6c6c8fe2b5d5a2f5ca24df510c/ Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* samba4: requires NPTLWaldemar Brodkorb2017-02-181-3/+3
| | | | | | | | | | | | | With OpenRISC there is a uClibc-ng based toolchain for an architecture with MMU support, but with only Linuxthreads and no NPTL. Samba4 uses pthread_mutexattr_setrobust which is not implemented in uClibc-ng Linuxthreads. Fixes: http://autobuild.buildroot.net/results/ec8f078046c92ae23dc973c88ac0fef136ad1535 Signed-off-by: Waldemar Brodkorb <wbx@openadk.org> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* samba4: bump to version 4.5.5Gustavo Zacarias2017-01-302-3/+3
| | | | | | | Switch download URL to match the website and avoid issues. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package: update comments for reverse dependencies of util-linuxRahul Bedarkar2017-01-281-1/+1
| | | | | | | | | | | | | | | | | | Commit 006a328ad6be ("util-linux: fix build with ncurses") removed dependency on BR2_USE_WCHAR, but failed to update the reverse dependencies of util-linux. This commit updates comments in Config.in for BR2_USE_WCHAR for reverse dependencies of util-linux which directly uses wchar now or when it is pulled from other dependencies. eudev doesn't use wchar directly, but needs C99 compiler. Autotools generate code with wchar_t for checking C99 compiler. Signed-off-by: Rahul Bedarkar <rahul.bedarkar@imgtec.com> Cc: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> Cc: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* samba4: update answer cacheGustavo Zacarias2017-01-271-0/+1
| | | | | | | | | Some toolchain/package combinations require an additional touch (answer) in the cache file. Fixes: http://autobuild.buildroot.net/results/426/4266a1690b85bde8da130a84845d1985128bda63/ Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* samba4: bump to version 4.5.4Gustavo Zacarias2017-01-243-11/+25
| | | | | | | | Drop libbsd support, it's problematic and doesn't bring in any greater benefit. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* samba4: bump to version 4.4.9Gustavo Zacarias2017-01-042-2/+2
| | | | | Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* samba4: security bump to version 4.4.8Gustavo Zacarias2016-12-192-2/+2
| | | | | | | | | | | | | Fixes: CVE-2016-2123 - Samba NDR Parsing ndr_pull_dnsp_name Heap-based Buffer Overflow Remote Code Execution Vulnerability. CVE-2016-2125 - Unconditional privilege delegation to Kerberos servers in trusted realms. CVE-2016-2126 - Flaws in Kerberos PAC validation can trigger privilege elevation. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* samba4: bump to version 4.4.7Gustavo Zacarias2016-10-272-2/+2
| | | | | Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* samba4: bump to version 4.4.6Gustavo Zacarias2016-09-242-2/+2
| | | | | Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/samba4: security bump to 4.4.5Bernd Kuhls2016-07-082-3/+3
| | | | | | | | Fixes CVE-2016-2119 https://www.samba.org/samba/security/CVE-2016-2119.html Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/samba4: Change tmpfiles pathMaxime Hadjinlian2016-07-021-2/+2
| | | | | | | | | | | | | | | | | Per the documentation: https://www.freedesktop.org/software/systemd/man/tmpfiles.d.html The order of path by priorites is: /etc/tmpfiles.d/*.conf /run/tmpfiles.d/*.conf /usr/lib/tmpfiles.d/*.conf For the user to be able to override our tmpfiles easily, it's better to place our files in /usr/lib/tmpfiles.d/ Signed-off-by: Maxime Hadjinlian <maxime.hadjinlian@gmail.com> Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* samba4: bump to version 4.4.4Gustavo Zacarias2016-06-082-2/+2
| | | | | Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* Merge branch 'next'Peter Korsgaard2016-06-011-10/+0
|\ | | | | | | Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| * samba4: remove compilation of .pyc filesThomas Petazzoni2016-05-261-10/+0
| | | | | | | | | | | | | | | | | | Now that .py files are globally compiled into .pyc files, we can get rid of the samba4 specific logic doing this compilation. Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> Reviewed-by: Samuel Martin <s.martin49@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* | package/samba4: create tempfile with systemdYann E. MORIN2016-05-161-0/+3
|/ | | | | | | | | | | | | | | | | | With systemd, samba4 will need some special temporary files to be created on each boot, as explained in: packaging/systemd/README Install the provided template file as configuration. However, this is not enough, as even the log directory is a tmpfs in the default Buildroot configuration, so we must also create the log directory on each boot. Hence we append this to the template installed above. Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr> Cc: Gustavo Zacarias <gustavo@zacarias.com.ar> Acked-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* samba4: bump to version 4.4.3Gustavo Zacarias2016-05-022-2/+2
| | | | | | | Fixes a few regressions from the previous security bump. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* samba4: security bump to version 4.4.2Gustavo Zacarias2016-04-122-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes: CVE-2016-2118 - A man in the middle can intercept any DCERPC traffic between a client and a server in order toimpersonate the client and get the same privileges as the authenticated user account. CVE-2016-2115 - The protection of DCERPC communication over ncacn_np (which is the default for most the file server related protocols) is inherited from the underlying SMB connection. Samba doesn't enforce SMB signing for this kind of SMB connections by default, which makes man in the middle attacks possible. CVE-2016-2114 - Due to a bug Samba doesn't enforce required smb signing, even if explicitly configured. CVE-2016-2113 - Man in the middle attacks are possible for client triggered LDAP connections (with ldaps://) and ncacn_http connections (with https://). CVE-2016-2112 - A man in the middle is able to downgrade LDAP connections to no integrity protection. It's possible to attack client and server with this. CVE-2016-2111 - When Samba is configured as Domain Controller it allows remote attackers to spoof the computer name of a secure channel's endpoints, and obtain sensitive session information, by running a crafted application and leveraging the ability to sniff network traffic. CVE-2016-2110 - The feature negotiation of NTLMSSP is not downgrade protected. A man in the middle is able to clear even required flags, especially NTLMSSP_NEGOTIATE_SIGN and NTLMSSP_NEGOTIATE_SEAL. CVE-2015-5370 - Errors in Samba DCE-RPC code can lead to denial of service (crashes and high cpu consumption) and man in the middle attacks. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* samba4: drop --with-gettext configure optionGustavo Zacarias2016-03-251-1/+0
| | | | | | | | | The --with-gettext=X configure option was silently dropped from the 4.4.0 release and it errors out since it's unknown. Fixes: http://autobuild.buildroot.net/results/3c0/3c0800fd6cc7a217a866cd9cf63d5f91dcbfd306/ Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* samba4: bump to version 4.4.0Gustavo Zacarias2016-03-243-65/+3
| | | | | | | | | | libaio support is now automatic so drop the enable/disable (it will fall back to pthread aio if libaio is not present). 0002-build-improve-stack-protector-check.patch is upstream so remove it. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* samba4: add host-python to dependenciesGustavo Zacarias2016-03-161-1/+3
| | | | | | | | | | | | Even though it's inherited by the python dependency it's more clear this way for graph-depends, since it's used by the waf buildsystem. And even though we have a hard dependency on python for the distro this python could ostensibly be 3.x which isn't compatible with the bundled waf series (1.5.x) in samba (as of current shipping version and upcoming 4.4.x series). Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* samba: remove deprecatedGustavo Zacarias2016-03-151-1/+0
| | | | | | | | It's been deprecated for a year now so remove it. [Peter: drop !samba dependency from samba4] Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* samba4: security bump to version 4.3.6Gustavo Zacarias2016-03-082-2/+2
| | | | | | | | | | | Fixes: CVE-2015-7560 - Authenticated client could cause Samba to overwrite ACLs with incorrect owner/group. CVE-2016-0771 - Malicious request can cause the Samba internal DNS server to crash or unintentionally return uninitialized memory. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* Merge branch 'next'Peter Korsgaard2016-03-022-2/+2
|\ | | | | | | Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| * samba4: bump to version 4.3.5Gustavo Zacarias2016-02-232-2/+2
| | | | | | | | | | Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* | samba4: add optional libbsd dependencyGustavo Zacarias2016-02-131-0/+1
|/ | | | | | | | | It's used for some small functions like md5 support, non-essential since samba has an internal fallback for those, but still add it for predictability. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* samba4: add dependency on BR2_TOOLCHAIN_HAS_SYNC_4Thomas Petazzoni2016-02-061-0/+2
| | | | | | | | | | | | samba4 uses the __sync_fetch_and_add_4() atomic built-in, so it should depend on BR2_TOOLCHAIN_HAS_SYNC_4 in order to avoid build failures on architectures not providing this atomic built-in. Fixes: http://autobuild.buildroot.org/results/0d0fd9d2a132a40a840bea5df59c35d8573ebf45/ Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* samba4: remove dependency on specific C librariesThomas Petazzoni2016-02-011-5/+2
| | | | | | | | | | | | | | | | | | | | samba4 relies on the $ORIGIN feature of the dynamic linker, which used to not be implemented in old uClibc versions. However: - this feature is supported by glibc - this feature is supported by uClibc-ng, which is the only uClibc version we are going to support - this feature is supported by musl Consequently, we can completely remove the dependency of samba4 on certain C libraries. Note that despite this commit, samba4 still cannot be chosen when the musl C library is used, because samba4 requires native RPC support, which musl doesn't provide. Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* samba4: bump to version 4.3.4Gustavo Zacarias2016-01-122-2/+2
| | | | | Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* samba4: security bump to version 4.3.3Gustavo Zacarias2015-12-172-2/+2
| | | | | | | | | | | | | | | | Fixes: CVE-2015-7540 - Remote DoS in Samba (AD) LDAP server CVE-2015-3223 - Denial of service in Samba Active Directory server CVE-2015-5252 - Insufficient symlink verification in smbd) CVE-2015-5299 - Missing access control check in shadow copy code CVE-2015-5296 - Samba client requesting encryption vulnerable to downgrade attack CVE-2015-8467 - Denial of service attack against Windows Active Directory server CVE-2015-5330 - Remote memory read in Samba LDAP server Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* samba4: bump to version 4.3.2Gustavo Zacarias2015-12-012-2/+2
| | | | | Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* samba4: bump to version 4.3.1Gustavo Zacarias2015-10-202-2/+2
| | | | | Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
OpenPOWER on IntegriCloud