pkgsrc/net/samba4/Makefile

224 lines
7.6 KiB
Makefile
Raw Normal View History

# $NetBSD: Makefile,v 1.79 2019/09/04 08:15:32 taca Exp $
DISTNAME= samba-4.10.8
CATEGORIES= net
MASTER_SITES= https://download.samba.org/pub/samba/stable/
MAINTAINER= pkgsrc-users@NetBSD.org
HOMEPAGE= https://www.samba.org/
COMMENT= SMB/CIFS protocol server suite
LICENSE= gnu-gpl-v3
CONFLICTS+= ja-samba-[0-9]* winbind-[0-9]*
2019-03-27 07:28:05 +01:00
PYTHON_VERSIONS_INCOMPATIBLE= 27
GCC_REQD+= 4.4
BUILD_DEPENDS+= libxslt-[0-9]*:../../textproc/libxslt
BUILD_DEPENDS+= docbook-xml-[0-9]*:../../textproc/docbook-xml
BUILD_DEPENDS+= docbook-xsl-[0-9]*:../../textproc/docbook-xsl
DEPENDS+= p5-Parse-Yapp>=1.05:../../devel/p5-Parse-Yapp
DEPENDS+= ${PYPKGPREFIX}-dns-[0-9]*:../../net/py-dns
DEPENDS+= ${PYPKGPREFIX}-expat-[0-9]*:../../textproc/py-expat
DEPENDS+= ${PYPKGPREFIX}-iso8601-[0-9]*:../../time/py-iso8601
BUILD_DEFS+= VARBASE
.include "../../mk/bsd.prefs.mk"
SMB_LIB?= ${PREFIX}/lib
PKG_SYSCONFSUBDIR= samba
SMB_SHAREDSTATE?= ${PREFIX}/com
SMB_LOCALSTATE?= ${VARBASE}
SMB_INFO?= ${PREFIX}/info
SMB_MAN?= ${PREFIX}/${PKGMANDIR}
SMB_STATE?= ${VARBASE}/run
SMB_PRIVATE?= ${PKG_SYSCONFDIR}/private
SMB_PID?= ${VARBASE}/run
SMB_CACHE?= ${VARBASE}/run
SMB_LOCK?= ${VARBASE}/run
SMB_LOGFILEBASE?= ${VARBASE}/log
SMB_SOCKETS?= ${VARBASE}/run
SMB_MODULES?= ${SMB_LIB}/samba
SMB_PRIVATELIB?= ${SMB_LIB}/samba/private
SMB_PRIVSOCKETS?= ${VARBASE}/run
SMB_CONFIG?= ${PKG_SYSCONFDIR}
SMB_DATAROOT?= ${PREFIX}/share/samba
SMB_LOCALE?= ${PREFIX}/share/locale
SMB_DOC?= ${PREFIX}/share/doc/samba
SMB_PAMMODULES?= ${SMB_LIB}/samba/security
FILES_SUBST+= SMB_CONFIG=${SMB_CONFIG}
FILES_SUBST+= SMB_PID=${SMB_PID}
# mktemp is useful for the replacement adduser script, but don't require
# a full dependency since it's not actually needed by samba.
USE_TOOLS+= gmake mktemp perl:run pkg-config
USE_GNU_ICONV= yes # FIXME: something doesn't work on NetBSD
BROKEN_GETTEXT_DETECTION=yes
# Debugging
#CONFIGURE_ARGS+= -vvv
#CONFIGURE_ARGS+= --enable-developer
#CONFIGURE_ARGS+= --fatal-errors
HAS_CONFIGURE= yes
CONFIG_SHELL= ${PYTHONBIN}
CONFIGURE_SCRIPT= ${WRKSRC}/buildtools/bin/waf
CONFIGURE_ARGS+= configure
CONFIGURE_ARGS+= --prefix=${PREFIX}
CONFIGURE_ARGS+= --infodir=${SMB_INFO}
CONFIGURE_ARGS+= --mandir=${SMB_MAN}
CONFIGURE_ARGS+= --datarootdir=${SMB_DATAROOT}
CONFIGURE_ARGS+= --libdir=${SAMBA_LIB}
CONFIGURE_ARGS+= --localedir=${SMB_LOCALE}
CONFIGURE_ARGS+= --docdir=${SMB_DOC}
CONFIGURE_ARGS+= --with-statedir=${SMB_STATE}
CONFIGURE_ARGS+= --with-privatedir=${SMB_PRIVATE}
CONFIGURE_ARGS+= --with-piddir=${SMB_PID}
CONFIGURE_ARGS+= --with-cachedir=${SMB_CACHE}
CONFIGURE_ARGS+= --with-lockdir=${SMB_LOCK}
CONFIGURE_ARGS+= --with-logfilebase=${SMB_LOGFILEBASE}
CONFIGURE_ARGS+= --with-sockets-dir=${SMB_SOCKETS}
CONFIGURE_ARGS+= --with-modulesdir=${SMB_MODULES}
CONFIGURE_ARGS+= --with-privatelibdir=${SMB_PRIVATELIB}
CONFIGURE_ARGS+= --with-privileged-socket-dir=${SMB_PRIVSOCKETS}
CONFIGURE_ARGS+= --with-configdir=${SMB_CONFIG}
CONFIGURE_ARGS+= --with-libiconv=${BUILDLINK_PREFIX.iconv}
#CONFIGURE_ARGS+= --bundled-libraries=com_err
CONFIGURE_ARGS+= --abi-check-disable
CONFIGURE_ARGS+= --disable-symbol-versions
CONFIGURE_ARGS+= --enable-gnutls
.if defined(MAKE_JOBS) && !empty(MAKE_JOBS) && !(defined(MAKE_JOBS_SAFE) && !empty(MAKE_JOBS_SAFE:M[nN][oO]))
CONFIGURE_ARGS+= --jobs=${MAKE_JOBS}
.else
CONFIGURE_ARGS+= --jobs=1
.endif
CONFIGURE_ARGS+= --without-gpgme
# Depends on ncurses, explicitly disable for now.
CONFIGURE_ARGS+= --without-regedit
samba4: updated to 4.10.0 Release Notes for Samba 4.10.0 This is the first stable release of the Samba 4.10 release series. Please read the release notes carefully before upgrading. NEW FEATURES/CHANGES ==================== GPO Improvements ---------------- A new 'samba-tool gpo backup' command has been added that can export a set of Group Policy Objects from a domain in a generalised XML format. A corresponding 'samba-tool gpo restore' command has been added to rebuild the Group Policy Objects from the XML after generalization. (The administrator needs to correct the values of XML entities between the backup and restore to account for the change in domain). KDC prefork ----------- The KDC now supports the pre-fork process model and worker processes will be forked for the KDC when the pre-fork process model is selected for samba. Prefork 'prefork children' -------------------------- The default value for this smdb.conf parameter has been increased from 1 to 4. Netlogon prefork ---------------- DCERPC now supports pre-forked NETLOGON processes. The netlogon processes are pre-forked when the prefork process model is selected for samba. Offline domain backups ---------------------- The 'samba-tool domain backup' command has been extended with a new 'offline' option. This safely creates a backup of the local DC's database directly from disk. The main benefits of an offline backup are it's quicker, it stores more database details (for forensic purposes), and the samba process does not have to be running when the backup is made. Refer to the samba-tool help for more details on using this command. Group membership statistics --------------------------- A new 'samba-tool group stats' command has been added. This provides summary information about how the users are spread across groups in your domain. The 'samba-tool group list --verbose' command has also been updated to include the number of users in each group. Paged results LDAP control -------------------------- The behaviour of the paged results control (1.2.840.113556.1.4.319, RFC2696) has been changed to more closely match Windows servers, to improve memory usage. Paged results may be used internally (or is requested by the user) by LDAP libraries or tools that deal with large result sizes, for example, when listing all the objects in the database. Previously, results were returned as a snapshot of the database but now, some changes made to the set of results while paging may be reflected in the responses. If strict inter-record consistency is required in answers (which is not possible on Windows with large result sets), consider avoiding the paged results control or alternatively, it might be possible to enforce restrictions using the LDAP filter expression. For further details see https://wiki.samba.org/index.php/Paged_Results Prefork process restart ----------------------- The pre-fork process model now restarts failed processes. The delay between restart attempts is controlled by the "prefork backoff increment" (default = 10) and "prefork maximum backoff" (default = 120) smbd.conf parameters. A linear back off strategy is used with "prefork backoff increment" added to the delay between restart attempts up until it reaches "prefork maximum backoff". Using the default sequence the restart delays (in seconds) are: 0, 10, 20, ..., 120, 120, ... Standard process model ---------------------- When using the standard process model samba forks a new process to handle ldap and netlogon connections. Samba now honours the 'max smbd processes' smb.conf parameter. The default value of 0, indicates there is no limit. The limit is applied individually to netlogon and ldap. When the process limit is exceeded Samba drops new connections immediately. python3 support --------------- This is the first release of Samba which has full support for Python 3. Samba 4.10 still has support for Python 2, however, Python 3 will be used by default, i.e. 'configure' & 'make' will execute using python3. To build Samba with python2 you *must* set the 'PYTHON' environment variable for both the 'configure' and 'make' steps, i.e. 'PYTHON=python2 ./configure' 'PYTHON=python2 make' This will override the python3 default. Alternatively, it is possible to produce Samba Python bindings for both Python 2 and Python 3. To do so, specify '--extra-python=/usr/bin/python2' as part of the 'configure' command. Note that python3 will still be used as the default in this case. Note that Samba 4.10 supports Python 3.4 onwards. Future Python support --------------------- Samba 4.10 will be the last release that comes with full support for Python 2. Unfortunately, the Samba Team doesn't have the resources to support both Python 2 and Python 3 long-term. Samba 4.11 will not have any runtime support for Python 2. This means if you use Python 2 bindings it is time to migrate to Python 3 now. If you are building Samba using the '--disable-python' option (i.e. you're excluding all the run-time Python support), then this will continue to work on a system that supports either python2 or python3. Also note that Samba 4.11 will most likely only support Python 3.6 onwards. JSON logging ------------ Authentication messages now contain the Windows Event Id "eventId" and logon type "logonType". The supported event codes and logon types are: Event codes: 4624 Successful logon 4625 Unsuccessful logon Logon Types: 2 Interactive 3 Network 8 NetworkCleartext The version number for Authentication messages is now 1.1, changed from 1.0 Password change messages now contain the Windows Event Id "eventId", the supported event Id's are: 4723 Password changed 4724 Password reset The version number for PasswordChange messages is now 1.1, changed from 1.0 Group membership change messages now contain the Windows Event Id "eventId", the supported event Id's are: 4728 A member was added to a security enabled global group 4729 A member was removed from a security enabled global group 4732 A member was added to a security enabled local group 4733 A member was removed from a security enabled local group 4746 A member was added to a security disabled local group 4747 A member was removed from a security disabled local group 4751 A member was added to a security disabled global group 4752 A member was removed from a security disabled global group 4756 A member was added to a security enabled universal group 4757 A member was removed from a security enabled universal group 4761 A member was added to a security disabled universal group 4762 A member was removed from a security disabled universal group The version number for GroupChange messages is now 1.1, changed from 1.0. Also A GroupChange message is generated when a new user is created to log that the user has been added to their primary group. The leading "JSON <message type>:" and source file prefix of the JSON formatted log entries has been removed to make the parsing of the JSON log messages easier. JSON log entries now start with 2 spaces followed by an opening brace i.e. " {" SMBv2 samba-tool support ------------------------ On previous releases, some samba-tool commands would not work against a remote DC that had SMBv1 disabled. SMBv2 support has now been added for samba-tool. The affected commands are 'samba-tool domain backup|rename' and the 'samba-tool gpo' set of commands. New glusterfs_fuse VFS module ----------------------------- The new vfs_glusterfs_fuse module improves performance when Samba accesses a glusterfs volume mounted via FUSE (Filesystem in Userspace as part of the Linux kernel). It achieves that by leveraging a mechanism to retrieve the appropriate case of filenames by querying a specific extended attribute in the filesystem. No extra configuration is required to use this module, only glusterfs_fuse needs to be set in the "vfs objects" parameter. Further details can be found in the vfs_glusterfs_fuse(8) manpage. This new vfs_glusterfs_fuse module does not replace the existing vfs_glusterfs module, it just provides an additional, alternative mechanism to access a Gluster volume. REMOVED FEATURES ================ MIT Kerberos build of the AD DC ------------------------------- While not removed, the MIT Kerberos build of the Samba AD DC is still considered experimental. Because Samba will not issue security patches for this configuration, such builds now require the explicit configure option: --with-experimental-mit-ad-dc For further details see https://wiki.samba.org/index.php/Running_a_Samba_AD_DC_with_MIT_Kerberos_KDC samba_backup ------------ The samba_backup script has been removed. This has now been replaced by the 'samba-tool domain backup offline' command. SMB client Python bindings -------------------------- The SMB client python bindings are now deprecated and will be removed in future Samba releases. This will only affects users that may have used the Samba Python bindings to write their own utilities, i.e. users with a custom Python script that includes the line 'from samba import smb'.
2019-03-20 20:09:10 +01:00
PY_PATCHPLIST= yes
MAKE_FLAGS+= WAF_BINARY=${PYTHONBIN}\ ${WRKSRC}/buildtools/bin/waf
2015-05-17 14:27:07 +02:00
# for winbind option build.
.if "${OPSYS}" != "Darwin" && "${OPSYS}" != "SunOS"
LDFLAGS+= -Wl,--allow-shlib-undefined
.endif
LDFLAGS+= ${BUILDLINK_LDADD.gettext}
LDFLAGS+= ${COMPILER_RPATH_FLAG}${SMB_PRIVATELIB}
CFLAGS.SunOS+= -DHAVE_SOLARIS_GETGRENT_R
# workaround https://bugzilla.samba.org/show_bug.cgi?id=12502 for now
CFLAGS.SunOS+= -DMSG_NOSIGNAL=0
2019-06-28 19:13:50 +02:00
LDFLAGS.SunOS+= -lsocket -lnsl -lsendfile
.include "options.mk"
.if ${SHLIB_TYPE} == "dylib"
PLIST_SUBST+= SOEXT=dylib
.else
PLIST_SUBST+= SOEXT=so
.endif
.if !defined(PWD_MKDB)
PWD_MKDB!= ${TYPE} pwd_mkdb 2>&1 | \
${AWK} '/not found/ { print "pwd_mkdb"; exit } { print $$3 }'
MAKEFLAGS+= PWD_MKDB=${PWD_MKDB:Q}
.endif
FILES_SUBST+= MKTEMP=${MKTEMP:Q}
FILES_SUBST+= PWD_MKDB=${PWD_MKDB:Q}
INSTALLATION_DIRS+= ${DOCDIR} ${EGDIR}
DOCDIR= share/doc/${PKGBASE}
EGDIR= share/examples/${PKGBASE}
CONF_FILES= ${PREFIX}/${EGDIR}/smb.conf.default ${SMB_CONFIG}/smb.conf
OWN_DIRS_PERMS= ${SMB_PRIVATE} ${REAL_ROOT_USER} ${REAL_ROOT_GROUP} 0700
RCD_SCRIPTS+= samba nmbd smbd ${WINBINDD_RCD_SCRIPT}
SUBST_CLASSES+= docbook
SUBST_MESSAGE.docbook= Fixing docbook URLs.
SUBST_FILES.docbook+= buildtools/wafsamba/wafsamba.py
SUBST_FILES.docbook+= ctdb/doc/*.xml
samba4: updated to 4.10.0 Release Notes for Samba 4.10.0 This is the first stable release of the Samba 4.10 release series. Please read the release notes carefully before upgrading. NEW FEATURES/CHANGES ==================== GPO Improvements ---------------- A new 'samba-tool gpo backup' command has been added that can export a set of Group Policy Objects from a domain in a generalised XML format. A corresponding 'samba-tool gpo restore' command has been added to rebuild the Group Policy Objects from the XML after generalization. (The administrator needs to correct the values of XML entities between the backup and restore to account for the change in domain). KDC prefork ----------- The KDC now supports the pre-fork process model and worker processes will be forked for the KDC when the pre-fork process model is selected for samba. Prefork 'prefork children' -------------------------- The default value for this smdb.conf parameter has been increased from 1 to 4. Netlogon prefork ---------------- DCERPC now supports pre-forked NETLOGON processes. The netlogon processes are pre-forked when the prefork process model is selected for samba. Offline domain backups ---------------------- The 'samba-tool domain backup' command has been extended with a new 'offline' option. This safely creates a backup of the local DC's database directly from disk. The main benefits of an offline backup are it's quicker, it stores more database details (for forensic purposes), and the samba process does not have to be running when the backup is made. Refer to the samba-tool help for more details on using this command. Group membership statistics --------------------------- A new 'samba-tool group stats' command has been added. This provides summary information about how the users are spread across groups in your domain. The 'samba-tool group list --verbose' command has also been updated to include the number of users in each group. Paged results LDAP control -------------------------- The behaviour of the paged results control (1.2.840.113556.1.4.319, RFC2696) has been changed to more closely match Windows servers, to improve memory usage. Paged results may be used internally (or is requested by the user) by LDAP libraries or tools that deal with large result sizes, for example, when listing all the objects in the database. Previously, results were returned as a snapshot of the database but now, some changes made to the set of results while paging may be reflected in the responses. If strict inter-record consistency is required in answers (which is not possible on Windows with large result sets), consider avoiding the paged results control or alternatively, it might be possible to enforce restrictions using the LDAP filter expression. For further details see https://wiki.samba.org/index.php/Paged_Results Prefork process restart ----------------------- The pre-fork process model now restarts failed processes. The delay between restart attempts is controlled by the "prefork backoff increment" (default = 10) and "prefork maximum backoff" (default = 120) smbd.conf parameters. A linear back off strategy is used with "prefork backoff increment" added to the delay between restart attempts up until it reaches "prefork maximum backoff". Using the default sequence the restart delays (in seconds) are: 0, 10, 20, ..., 120, 120, ... Standard process model ---------------------- When using the standard process model samba forks a new process to handle ldap and netlogon connections. Samba now honours the 'max smbd processes' smb.conf parameter. The default value of 0, indicates there is no limit. The limit is applied individually to netlogon and ldap. When the process limit is exceeded Samba drops new connections immediately. python3 support --------------- This is the first release of Samba which has full support for Python 3. Samba 4.10 still has support for Python 2, however, Python 3 will be used by default, i.e. 'configure' & 'make' will execute using python3. To build Samba with python2 you *must* set the 'PYTHON' environment variable for both the 'configure' and 'make' steps, i.e. 'PYTHON=python2 ./configure' 'PYTHON=python2 make' This will override the python3 default. Alternatively, it is possible to produce Samba Python bindings for both Python 2 and Python 3. To do so, specify '--extra-python=/usr/bin/python2' as part of the 'configure' command. Note that python3 will still be used as the default in this case. Note that Samba 4.10 supports Python 3.4 onwards. Future Python support --------------------- Samba 4.10 will be the last release that comes with full support for Python 2. Unfortunately, the Samba Team doesn't have the resources to support both Python 2 and Python 3 long-term. Samba 4.11 will not have any runtime support for Python 2. This means if you use Python 2 bindings it is time to migrate to Python 3 now. If you are building Samba using the '--disable-python' option (i.e. you're excluding all the run-time Python support), then this will continue to work on a system that supports either python2 or python3. Also note that Samba 4.11 will most likely only support Python 3.6 onwards. JSON logging ------------ Authentication messages now contain the Windows Event Id "eventId" and logon type "logonType". The supported event codes and logon types are: Event codes: 4624 Successful logon 4625 Unsuccessful logon Logon Types: 2 Interactive 3 Network 8 NetworkCleartext The version number for Authentication messages is now 1.1, changed from 1.0 Password change messages now contain the Windows Event Id "eventId", the supported event Id's are: 4723 Password changed 4724 Password reset The version number for PasswordChange messages is now 1.1, changed from 1.0 Group membership change messages now contain the Windows Event Id "eventId", the supported event Id's are: 4728 A member was added to a security enabled global group 4729 A member was removed from a security enabled global group 4732 A member was added to a security enabled local group 4733 A member was removed from a security enabled local group 4746 A member was added to a security disabled local group 4747 A member was removed from a security disabled local group 4751 A member was added to a security disabled global group 4752 A member was removed from a security disabled global group 4756 A member was added to a security enabled universal group 4757 A member was removed from a security enabled universal group 4761 A member was added to a security disabled universal group 4762 A member was removed from a security disabled universal group The version number for GroupChange messages is now 1.1, changed from 1.0. Also A GroupChange message is generated when a new user is created to log that the user has been added to their primary group. The leading "JSON <message type>:" and source file prefix of the JSON formatted log entries has been removed to make the parsing of the JSON log messages easier. JSON log entries now start with 2 spaces followed by an opening brace i.e. " {" SMBv2 samba-tool support ------------------------ On previous releases, some samba-tool commands would not work against a remote DC that had SMBv1 disabled. SMBv2 support has now been added for samba-tool. The affected commands are 'samba-tool domain backup|rename' and the 'samba-tool gpo' set of commands. New glusterfs_fuse VFS module ----------------------------- The new vfs_glusterfs_fuse module improves performance when Samba accesses a glusterfs volume mounted via FUSE (Filesystem in Userspace as part of the Linux kernel). It achieves that by leveraging a mechanism to retrieve the appropriate case of filenames by querying a specific extended attribute in the filesystem. No extra configuration is required to use this module, only glusterfs_fuse needs to be set in the "vfs objects" parameter. Further details can be found in the vfs_glusterfs_fuse(8) manpage. This new vfs_glusterfs_fuse module does not replace the existing vfs_glusterfs module, it just provides an additional, alternative mechanism to access a Gluster volume. REMOVED FEATURES ================ MIT Kerberos build of the AD DC ------------------------------- While not removed, the MIT Kerberos build of the Samba AD DC is still considered experimental. Because Samba will not issue security patches for this configuration, such builds now require the explicit configure option: --with-experimental-mit-ad-dc For further details see https://wiki.samba.org/index.php/Running_a_Samba_AD_DC_with_MIT_Kerberos_KDC samba_backup ------------ The samba_backup script has been removed. This has now been replaced by the 'samba-tool domain backup offline' command. SMB client Python bindings -------------------------- The SMB client python bindings are now deprecated and will be removed in future Samba releases. This will only affects users that may have used the Samba Python bindings to write their own utilities, i.e. users with a custom Python script that includes the line 'from samba import smb'.
2019-03-20 20:09:10 +01:00
SUBST_FILES.docbook+= docs-xml/build/DTD/samba-doc
SUBST_FILES.docbook+= docs-xml/xslt/*.xsl
SUBST_FILES.docbook+= lib/ldb/docs/builddocs.sh
SUBST_FILES.docbook+= librpc/tools/*.xml
SUBST_FILES.docbook+= */*/man/*.xml
SUBST_FILES.docbook+= */*/*/man/*.xml
SUBST_STAGE.docbook= pre-configure
SUBST_SED.docbook= -e 's,http://www.oasis-open.org/docbook/xml,${PREFIX}/share/xml/docbook,g'
SUBST_SED.docbook+= -e 's,http://docbook.sourceforge.net/release/xsl/current,${PREFIX}/share/xsl/docbook,g'
SUBST_CLASSES+= paths
SUBST_MESSAGE.paths= Fixing paths.
net/samba4: update to 4.6.7 4.6.7 (2017/08/09): the latest stable release of the Samba 4.6 release series. Changes since 4.6.6 --------------------- o Jeremy Allison <jra@samba.org> * BUG 12836: s3: smbd: Fix a read after free if a chained SMB1 call goes async. o Andrew Bartlett <abartlet@samba.org> * BUG 11392: s4-cldap/netlogon: Match Windows 2012R2 and return NETLOGON_NT_VERSION_5 when version unspecified. o Ralph Boehme <slow@samba.org> * BUG 12885: s3/smbd: Let non_widelink_open() chdir() to directories directly. * BUG 12910: s3/notifyd: Ensure notifyd doesn't return from smbd_notifyd_init. o Günther Deschner <gd@samba.org> * BUG 12840: vfs_fruit: Add fruit:model = <modelname> parametric option. o David Disseldorp <ddiss@samba.org> * BUG 12911: vfs_ceph: Fix cephwrap_chdir(). o Dustin L. Howett * BUG 12720: idmap_ad: Retry query_user exactly once if we get TLDAP_SERVER_DOWN. o Thomas Jarosch <thomas.jarosch@intra2net.com> * BUG 12927: s3: libsmb: Fix use-after-free when accessing pointer *p. o Volker Lendecke <vl@samba.org> * BUG 12925: smbd: Fix a connection run-down race condition. o Stefan Metzmacher <metze@samba.org> * BUG 12782: winbindd changes the local password and gets NT_STATUS_WRONG_PASSWORD for the remote change. * BUG 12890: s3:smbd: consistently use talloc_tos() memory for rpc_pipe_open_interface(). o Noel Power <noel.power@suse.com> * BUG 12937: smbcacls: Don't fail against a directory on Windows using SMB2. o Arvid Requate <requate@univention.de> * BUG 11392: s4-dsdb/netlogon: Allow missing ntver in cldap ping. o Garming Sam <garming@catalyst.net.nz> * BUG 12813: dnsserver: Stop dns_name_equal doing OOB read. o Andreas Schneider <asn@samba.org> * BUG 12886: s3:client: The smbspool krb5 wrapper needs negotiate for authentication. o Martin Schwenke <martin@meltin.net> * BUG 12898: ctdb-common: Set close-on-exec when creating PID file. 4.6.6 (2017/07/12): security release in order to address the following defect: o CVE-2017-11103 (Orpheus' Lyre mutual authentication validation bypass) Changes since 4.6.5: --------------------- o Jeffrey Altman <jaltman@secure-endpoints.com> * BUG 12894: CVE-2017-11103: Orpheus' Lyre KDC-REP service name validation 4.6.5 (2017/06/06): the latest stable release of the Samba 4.6 release series. Changes since 4.6.4: --------------------- o Jeremy Allison <jra@samba.org> * BUG 12804: s3: VFS: Catia: Ensure path name is also converted. o Christian Ambach <ambi@samba.org> * BUG 12765: s3:smbcacls add prompt for password. o Ralph Boehme <slow@samba.org> * BUG 12562: vfs_acl_xattr|tdb: Ensure create mask is at least 0666 if ignore_system_acls is set. * BUG 12702: Wrong sid->uid mapping for SIDs residing in sIDHistory. * BUG 12749: vfs_fruit: lp_case_sensitive() does not return a bool. * BUG 12766: s3/smbd: Update exclusive oplock optimisation to the lease area. * BUG 12798: s3/smbd: Fix exclusive lease optimisation. o Alexander Bokovoy <ab@samba.org> * BUG 12751: Allow passing trusted domain password as plain-text to PASSDB layer. * BUG 12764: systemd: Fix detection of libsystemd. o Amitay Isaacs <amitay@gmail.com> * BUG 12697: ctdb-readonly: Avoid a tight loop waiting for revoke to complete. * BUG 12770: ctdb-logging: Initialize DEBUGLEVEL before changing the value. o Shilpa Krishnareddy <skrishnareddy@panzura.com> * BUG 12756: notify: Fix ordering of events in notifyd. o Volker Lendecke <vl@samba.org> * BUG 12757: idmap_rfc2307: Lookup of more than two SIDs fails. o Stefan Metzmacher <metze@samba.org> * BUG 12767: samba-tool: Let 'samba-tool user syncpasswords' report deletions immediately. o Doug Nazar <nazard@nazar.ca> * BUG 12760: s3: smbd: inotify_map_mask_to_filter incorrectly indexes an array. o Andreas Schneider <asn@samba.org> * BUG 12687: vfs_expand_msdfs tries to open the remote address as a file path. o Martin Schwenke <martin@meltin.net> * BUG 12802: 'ctdb nodestatus' incorrectly displays status for all nodes with wrong exit code. * BUG 12814: ctdb-common: Fix crash in logging initialisation.
2017-09-18 08:41:46 +02:00
SUBST_FILES.paths= ${WRKDIR}/adduser.sh ${WRKDIR}/deluser.sh
SUBST_FILES.paths+= source3/script/findsmb.in source4/heimdal_build/roken.h
SUBST_STAGE.paths= pre-configure
Update to 4.6.2 * Use internal heimdal Changelog: Changes since 4.6.1: -------------------- o Jeremy Allison <jra@samba.org> * BUG 12721: Fix regression with "follow symlinks = no". Changes since 4.6.0: -------------------- o Jeremy Allison <jra@samba.org> * BUG 12496: CVE-2017-2619: Symlink race permits opening files outside share directory. o Ralph Boehme <slow@samba.org> * BUG 12496: CVE-2017-2619: Symlink race permits opening files outside share directory. CHANGES SINCE 4.6.0rc4 ====================== o Jeremy Allison <jra@samba.org> * BUG 12592: Fix several issues found by covscan. * BUG 12608: s3: smbd: Restart reading the incoming SMB2 fd when the send queue is drained. o Ralph Boehme <slow@samba.org> * BUG 12427: vfs_fruit doesn't work with fruit:metadata=stream. * BUG 12526: vfs_fruit: Only veto AppleDouble files if "fruit:resource" is set to "file". * BUG 12604: vfs_fruit: Enabling AAPL extensions must be a global switch. o Volker Lendecke <vl@samba.org> * BUG 12612: Re-enable token groups fallback. o Stefan Metzmacher <metze@samba.org> * BUG 9048: Samba4 ldap error codes. * BUG 12557: gensec:spnego: Add debug message for the failed principal. * BUG 12605: s3:winbindd: Fix endless forest trust scan. * BUG 12612: winbindd: Find the domain based on the sid within wb_lookupusergroups_send(). o Andreas Schneider <asn@samba.org> * BUG 12557: s3:librpc: Handle gss_min in gse_get_client_auth_token() correctly. * BUG 12582: idmap_hash: Add a deprecation message, improve the idmap_hash manpage. * BUG 12592: Fix several issues found by covscan. o Martin Schwenke <martin@meltin.net> * BUG 12592: ctdb-logging: CID 1396883 Dereference null return value (NULL_RETURNS). CHANGES SINCE 4.6.0rc3 ====================== o Jeremy Allison <jra@samba.org> * BUG 12545: s3: rpc_server/mdssvc: Add attribute "kMDItemContentType". * BUG 12572: s3: smbd: Don't loop infinitely on bad-symlink resolution. o Ralph Boehme <slow@samba.org> * BUG 12490: vfs_fruit: Correct Netatalk metadata xattr on FreeBSD. * BUG 12536: s3/smbd: Check for invalid access_mask smbd_calculate_access_mask(). * BUG 12591: vfs_streams_xattr: use fsp, not base_fsp. o Amitay Isaacs <amitay@gmail.com> * BUG 12580: ctdb-common: Fix use-after-free error in comm_fd_handler(). * BUG 12595: build: Fix generation of CTDB manpages while creating tarball. o Bryan Mason <bmason@redhat.com> * BUG 12575: Modify smbspool_krb5_wrapper to just fall through to smbspool if AUTH_INFO_REQUIRED is not set or is not "negotiate". o Stefan Metzmacher <metze@samba.org> * BUG 11830: s3:winbindd: Try a NETLOGON connection with noauth over NCACN_NP against trusted domains. * BUG 12262: 'net ads testjoin' and smb access fails after winbindd changed the trust password. * BUG 12585: librpc/rpc: fix regression in NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE error mapping. * BUG 12586: netlogon_creds_cli_LogonSamLogon doesn't work without netr_LogonSamLogonEx. * BUG 12587: winbindd child segfaults on connect to an NT4 domain. * BUG 12588: s3:winbindd: Make sure cm_prepare_connection() only returns OK with a valid tree connect. * BUG 12598: winbindd (as member) requires kerberos against trusted ad domain, while it shouldn't. * BUG 12601: Backport pytalloc_GenericObject_reference() related changes to 4.6. o Garming Sam <garming@catalyst.net.nz> * BUG 12600: dbchecker: Stop ignoring linked cases where both objects are alive. o Andreas Schneider <asn@samba.org> * BUG 12571: s3-vfs: Only walk the directory once in open_and_sort_dir(). o Martin Schwenke <martin@meltin.net> * BUG 12589: CTDB statd-callout does not cause grace period when CTDB_NFS_CALLOUT="". * BUG 12595: ctdb-build: Fix RPM build. CHANGES SINCE 4.6.0rc2 ====================== o Jeremy Allison <jra@samba.org> * BUG 12499: s3: vfs: dirsort doesn't handle opendir of "." correctly. * BUG 12546: s3: VFS: vfs_streams_xattr.c: Make streams_xattr_open() store the same path as streams_xattr_recheck(). * BUG 12531: Make vfs_shadow_copy2 cope with server changing directories. o Andrew Bartlett <abartlet@samba.org> * BUG 12543: samba-tool: Correct handling of default value for use_ntvfs and use_xattrs. * BUG 12573: Samba < 4.7 does not know about compatibleFeatures and requiredFeatures. * BUG 12577: 'samba-tool dbcheck' gives errors on one-way links after a rename. o Ralph Boehme <slow@samba.org> * BUG 12184: s3/rpc_server: Shared rpc modules loading. * BUG 12520: Ensure global "smb encrypt = off" is effective. * BUG 12524: s3/rpc_server: Move rpc_modules.c to its own subsystem. * BUG 12541: vfs_fruit: checks wrong AAPL config state and so always uses readdirattr. o Volker Lendecke <vl@samba.org> * BUG 12551: smbd: Fix "map acl inherit" = yes. o Stefan Metzmacher <metze@samba.org> * BUG 12398: Replication with DRSUAPI_DRS_CRITICAL_ONLY and DRSUAPI_DRS_GET_ANC results in WERR_DS_DRA_MISSING_PARENT S * BUG 12540: s3:smbd: allow "server min protocol = SMB3_00" to go via "SMB 2.???" negprot. o John Mulligan <jmulligan@nasuni.com> * BUG 12542: docs: Improve description of "unix_primary_group" parameter in idmap_ad manpage. o Andreas Schneider <asn@samba.org> * BUG 12552: waf: Do not install the unit test binary for krb5samba. o Amitay Isaacs <amitay@gmail.com> * BUG 12547: ctdb-build: Install CTDB tests correctly from toplevel. * BUG 12549: ctdb-common: ioctl(.. FIONREAD ..) returns an int value. o Garming Sam <garming@catalyst.net.nz> * BUG 12577: 'samba-tool dbcheck' gives errors on one-way links after a rename. o Uri Simchoni <uri@samba.org> * BUG 12529: waf: Backport finding of pkg-config. CHANGES SINCE 4.6.0rc1 ====================== o Amitay Isaacs <amitay@gmail.com> * BUG 12469: CTDB lock helper getting stuck trying to lock a record. * BUG 12500: ctdb-common: Fix a bug in packet reading code for generic socket I/O. * BUG 12510: sock_daemon_test 4 crashes with SEGV. * BUG 12513: ctdb-daemon: Remove stale eventd socket. o Björn Jacke <bj@sernet.de> * BUG 12535: vfs_default: Unlock the right file in copy chunk. o Volker Lendecke <vl@samba.org> * BUG 12509: messaging: Fix dead but not cleaned-up-yet destination sockets. * BUG 12538: Backport winbind fixes. o Stefan Metzmacher <metze@samba.org> * BUG 12501: s3:winbindd: talloc_steal the extra_data in winbindd_list_users_recv(). o Martin Schwenke <martin@meltin.net> * BUG 12511: ctdb-takeover: Handle case where there are no RELEASE_IPs to send. * BUG 12512: ctdb-scripts: Fix remaining uses of "ctdb gratiousarp". * BUG 12516: ctdb-scripts: /etc/iproute2/rt_tables gets populated with multiple 'default' entries.
2017-04-08 10:56:27 +02:00
SUBST_SED.paths+= -e 's,@PERL@,${PERL5},g'
SUBST_VARS.paths= AWK CAT MKTEMP RM PWD_MKDB SH PERL PKG_SYSCONFBASE
SUBST_CLASSES+= logpath
SUBST_MESSAGE.logpath= Fixing log path.
SUBST_FILES.logpath= examples/smb.conf.default
SUBST_STAGE.logpath= pre-configure
SUBST_SED.logpath+= -e 's,/usr/local/samba/var/log.%m,${SMB_LOGFILEBASE}/log.%m,g'
2018-09-29 16:37:30 +02:00
SMF_INSTANCES= smbd nmbd
CTF_FILES_SKIP+= lib/libdcerpc-samr.so.* # empty
post-extract:
${CP} ${FILESDIR}/adduser.sh ${FILESDIR}/deluser.sh ${WRKDIR}
post-install:
${RUN} cd ${WRKSRC}/docs-xml/registry; for f in *.reg; do \
${INSTALL_DATA} $${f} ${DESTDIR}${PREFIX}/${DOCDIR}/$${f}; \
done
${INSTALL_SCRIPT} ${WRKDIR}/adduser.sh \
${DESTDIR}${PREFIX}/${EGDIR}/adduser.sh
${INSTALL_SCRIPT} ${WRKDIR}/deluser.sh \
${DESTDIR}${PREFIX}/${EGDIR}/deluser.sh
${INSTALL_DATA} ${WRKSRC}/examples/LDAP/samba.schema \
${DESTDIR}${PREFIX}/${EGDIR}
${INSTALL_DATA} ${WRKSRC}/examples/smb.conf.default \
${DESTDIR}${PREFIX}/${EGDIR}
REPLACE_PERL+= librpc/tables.pl
REPLACE_PERL+= pidl/pidl
REPLACE_PERL+= pidl/tests/*.pl
REPLACE_PERL+= script/*.pl
REPLACE_PERL+= script/findsmb.in
REPLACE_PERL+= source3/script/*.pl
REPLACE_PERL+= source4/build/pasn1/pasn1.pl
REPLACE_PERL+= source4/script/*.pl
REPLACE_PERL+= third_party/nss_wrapper/nss_wrapper.pl
REPLACE_PYTHON+= buildtools/bin/waf
REPLACE_PYTHON+= source4/setup/wscript_build
REPLACE_PYTHON+= source4/scripting/bin/*
.if "${OPSYS}" == "Linux"
.include "../../devel/libuuid/buildlink3.mk"
.endif
.include "../../archivers/libarchive/buildlink3.mk"
.include "../../converters/libiconv/buildlink3.mk"
samba4: updated to 4.10.0 Release Notes for Samba 4.10.0 This is the first stable release of the Samba 4.10 release series. Please read the release notes carefully before upgrading. NEW FEATURES/CHANGES ==================== GPO Improvements ---------------- A new 'samba-tool gpo backup' command has been added that can export a set of Group Policy Objects from a domain in a generalised XML format. A corresponding 'samba-tool gpo restore' command has been added to rebuild the Group Policy Objects from the XML after generalization. (The administrator needs to correct the values of XML entities between the backup and restore to account for the change in domain). KDC prefork ----------- The KDC now supports the pre-fork process model and worker processes will be forked for the KDC when the pre-fork process model is selected for samba. Prefork 'prefork children' -------------------------- The default value for this smdb.conf parameter has been increased from 1 to 4. Netlogon prefork ---------------- DCERPC now supports pre-forked NETLOGON processes. The netlogon processes are pre-forked when the prefork process model is selected for samba. Offline domain backups ---------------------- The 'samba-tool domain backup' command has been extended with a new 'offline' option. This safely creates a backup of the local DC's database directly from disk. The main benefits of an offline backup are it's quicker, it stores more database details (for forensic purposes), and the samba process does not have to be running when the backup is made. Refer to the samba-tool help for more details on using this command. Group membership statistics --------------------------- A new 'samba-tool group stats' command has been added. This provides summary information about how the users are spread across groups in your domain. The 'samba-tool group list --verbose' command has also been updated to include the number of users in each group. Paged results LDAP control -------------------------- The behaviour of the paged results control (1.2.840.113556.1.4.319, RFC2696) has been changed to more closely match Windows servers, to improve memory usage. Paged results may be used internally (or is requested by the user) by LDAP libraries or tools that deal with large result sizes, for example, when listing all the objects in the database. Previously, results were returned as a snapshot of the database but now, some changes made to the set of results while paging may be reflected in the responses. If strict inter-record consistency is required in answers (which is not possible on Windows with large result sets), consider avoiding the paged results control or alternatively, it might be possible to enforce restrictions using the LDAP filter expression. For further details see https://wiki.samba.org/index.php/Paged_Results Prefork process restart ----------------------- The pre-fork process model now restarts failed processes. The delay between restart attempts is controlled by the "prefork backoff increment" (default = 10) and "prefork maximum backoff" (default = 120) smbd.conf parameters. A linear back off strategy is used with "prefork backoff increment" added to the delay between restart attempts up until it reaches "prefork maximum backoff". Using the default sequence the restart delays (in seconds) are: 0, 10, 20, ..., 120, 120, ... Standard process model ---------------------- When using the standard process model samba forks a new process to handle ldap and netlogon connections. Samba now honours the 'max smbd processes' smb.conf parameter. The default value of 0, indicates there is no limit. The limit is applied individually to netlogon and ldap. When the process limit is exceeded Samba drops new connections immediately. python3 support --------------- This is the first release of Samba which has full support for Python 3. Samba 4.10 still has support for Python 2, however, Python 3 will be used by default, i.e. 'configure' & 'make' will execute using python3. To build Samba with python2 you *must* set the 'PYTHON' environment variable for both the 'configure' and 'make' steps, i.e. 'PYTHON=python2 ./configure' 'PYTHON=python2 make' This will override the python3 default. Alternatively, it is possible to produce Samba Python bindings for both Python 2 and Python 3. To do so, specify '--extra-python=/usr/bin/python2' as part of the 'configure' command. Note that python3 will still be used as the default in this case. Note that Samba 4.10 supports Python 3.4 onwards. Future Python support --------------------- Samba 4.10 will be the last release that comes with full support for Python 2. Unfortunately, the Samba Team doesn't have the resources to support both Python 2 and Python 3 long-term. Samba 4.11 will not have any runtime support for Python 2. This means if you use Python 2 bindings it is time to migrate to Python 3 now. If you are building Samba using the '--disable-python' option (i.e. you're excluding all the run-time Python support), then this will continue to work on a system that supports either python2 or python3. Also note that Samba 4.11 will most likely only support Python 3.6 onwards. JSON logging ------------ Authentication messages now contain the Windows Event Id "eventId" and logon type "logonType". The supported event codes and logon types are: Event codes: 4624 Successful logon 4625 Unsuccessful logon Logon Types: 2 Interactive 3 Network 8 NetworkCleartext The version number for Authentication messages is now 1.1, changed from 1.0 Password change messages now contain the Windows Event Id "eventId", the supported event Id's are: 4723 Password changed 4724 Password reset The version number for PasswordChange messages is now 1.1, changed from 1.0 Group membership change messages now contain the Windows Event Id "eventId", the supported event Id's are: 4728 A member was added to a security enabled global group 4729 A member was removed from a security enabled global group 4732 A member was added to a security enabled local group 4733 A member was removed from a security enabled local group 4746 A member was added to a security disabled local group 4747 A member was removed from a security disabled local group 4751 A member was added to a security disabled global group 4752 A member was removed from a security disabled global group 4756 A member was added to a security enabled universal group 4757 A member was removed from a security enabled universal group 4761 A member was added to a security disabled universal group 4762 A member was removed from a security disabled universal group The version number for GroupChange messages is now 1.1, changed from 1.0. Also A GroupChange message is generated when a new user is created to log that the user has been added to their primary group. The leading "JSON <message type>:" and source file prefix of the JSON formatted log entries has been removed to make the parsing of the JSON log messages easier. JSON log entries now start with 2 spaces followed by an opening brace i.e. " {" SMBv2 samba-tool support ------------------------ On previous releases, some samba-tool commands would not work against a remote DC that had SMBv1 disabled. SMBv2 support has now been added for samba-tool. The affected commands are 'samba-tool domain backup|rename' and the 'samba-tool gpo' set of commands. New glusterfs_fuse VFS module ----------------------------- The new vfs_glusterfs_fuse module improves performance when Samba accesses a glusterfs volume mounted via FUSE (Filesystem in Userspace as part of the Linux kernel). It achieves that by leveraging a mechanism to retrieve the appropriate case of filenames by querying a specific extended attribute in the filesystem. No extra configuration is required to use this module, only glusterfs_fuse needs to be set in the "vfs objects" parameter. Further details can be found in the vfs_glusterfs_fuse(8) manpage. This new vfs_glusterfs_fuse module does not replace the existing vfs_glusterfs module, it just provides an additional, alternative mechanism to access a Gluster volume. REMOVED FEATURES ================ MIT Kerberos build of the AD DC ------------------------------- While not removed, the MIT Kerberos build of the Samba AD DC is still considered experimental. Because Samba will not issue security patches for this configuration, such builds now require the explicit configure option: --with-experimental-mit-ad-dc For further details see https://wiki.samba.org/index.php/Running_a_Samba_AD_DC_with_MIT_Kerberos_KDC samba_backup ------------ The samba_backup script has been removed. This has now been replaced by the 'samba-tool domain backup offline' command. SMB client Python bindings -------------------------- The SMB client python bindings are now deprecated and will be removed in future Samba releases. This will only affects users that may have used the Samba Python bindings to write their own utilities, i.e. users with a custom Python script that includes the line 'from samba import smb'.
2019-03-20 20:09:10 +01:00
.include "../../databases/ldb/buildlink3.mk"
samba4: updated to 4.10.6 Changes 4.10.6: * BUG 13956: s3: winbind: Fix crash when invoking winbind idmap scripts. * BUG 13964: smbd does not correctly parse arguments passed to dfree and quota scripts. * BUG 13965: samba-tool dns: use bytes for inet_ntop. * BUG 13828: samba-tool domain provision: Fix --interactive module in python3. * BUG 13893: ldb_kv: Skip @ records early in a search full scan. * BUG 13981: docs: Improve documentation of "lanman auth" and "ntlm auth" connection. * BUG 14002: python/ntacls: Use correct "state directory" smb.conf option instead of "state dir". * BUG 13840: registry: Add a missing include. * BUG 13944: Fix SMB guest authentication. * BUG 13958: AppleDouble conversion breaks Resourceforks. * BUG 13968: vfs_fruit makes direct use of syscalls like mmap() and pread(). * BUG 13987: s3:mdssvc: Fix flex compilation error. * BUG 13872: s3/vfs_glusterfs[_fuse]: Avoid using NAME_MAX directly: * BUG 13799: dsdb:samdb: schemainfo update with relax control. * BUG 13964: s3:util: Move static file_pload() function to lib/util. * BUG 13957: smbd: Fix a panic. * BUG 12478: ldap server: Generate correct referral schemes. * BUG 13941: s4 dsdb/repl_meta_data: fix use after free in dsdb_audit_add_ldb_value. * BUG 13942: s4 dsdb: Fix use after free in samldb_rename_search_base_callback. * BUG 12204: dsdb/repl: we need to replicate the whole schema before we can apply it. * BUG 12478: ldb: Release ldb 1.5.5 * BUG 13713: Schema replication fails if link crosses chunk boundary backwards. * BUG 13799: 'samba-tool domain schemaupgrade' uses relax control and skips the schemaInfo update provision. * BUG 13916: dsdb_audit: avoid printing "... remote host [Unknown] SID [(NULL SID)] ..." * BUG 13917: python/ntacls: We only need security.SEC_STD_READ_CONTROL in order to get the ACL. * BUG 13947: s3:loadparm: Ensure to truncate FS Volume Label at multibyte boundary. * BUG 13939: Using Kerberos credentials to print using spoolss doesn't work. * BUG 13998: wafsamba: Use native waf timer. * BUG 13984: ctdb-scripts: Fix tcp_tw_recycle existence check.
2019-08-03 08:54:39 +02:00
.include "../../databases/lmdb/buildlink3.mk"
.include "../../devel/cmocka/buildlink3.mk"
.include "../../devel/gettext-lib/buildlink3.mk"
.include "../../devel/popt/buildlink3.mk"
.include "../../devel/readline/buildlink3.mk"
BUILDLINK_API_DEPENDS.talloc+= talloc>=2.1.9
.include "../../devel/talloc/buildlink3.mk"
.include "../../devel/tevent/buildlink3.mk"
.include "../../devel/zlib/buildlink3.mk"
samba4: updated to 4.10.0 Release Notes for Samba 4.10.0 This is the first stable release of the Samba 4.10 release series. Please read the release notes carefully before upgrading. NEW FEATURES/CHANGES ==================== GPO Improvements ---------------- A new 'samba-tool gpo backup' command has been added that can export a set of Group Policy Objects from a domain in a generalised XML format. A corresponding 'samba-tool gpo restore' command has been added to rebuild the Group Policy Objects from the XML after generalization. (The administrator needs to correct the values of XML entities between the backup and restore to account for the change in domain). KDC prefork ----------- The KDC now supports the pre-fork process model and worker processes will be forked for the KDC when the pre-fork process model is selected for samba. Prefork 'prefork children' -------------------------- The default value for this smdb.conf parameter has been increased from 1 to 4. Netlogon prefork ---------------- DCERPC now supports pre-forked NETLOGON processes. The netlogon processes are pre-forked when the prefork process model is selected for samba. Offline domain backups ---------------------- The 'samba-tool domain backup' command has been extended with a new 'offline' option. This safely creates a backup of the local DC's database directly from disk. The main benefits of an offline backup are it's quicker, it stores more database details (for forensic purposes), and the samba process does not have to be running when the backup is made. Refer to the samba-tool help for more details on using this command. Group membership statistics --------------------------- A new 'samba-tool group stats' command has been added. This provides summary information about how the users are spread across groups in your domain. The 'samba-tool group list --verbose' command has also been updated to include the number of users in each group. Paged results LDAP control -------------------------- The behaviour of the paged results control (1.2.840.113556.1.4.319, RFC2696) has been changed to more closely match Windows servers, to improve memory usage. Paged results may be used internally (or is requested by the user) by LDAP libraries or tools that deal with large result sizes, for example, when listing all the objects in the database. Previously, results were returned as a snapshot of the database but now, some changes made to the set of results while paging may be reflected in the responses. If strict inter-record consistency is required in answers (which is not possible on Windows with large result sets), consider avoiding the paged results control or alternatively, it might be possible to enforce restrictions using the LDAP filter expression. For further details see https://wiki.samba.org/index.php/Paged_Results Prefork process restart ----------------------- The pre-fork process model now restarts failed processes. The delay between restart attempts is controlled by the "prefork backoff increment" (default = 10) and "prefork maximum backoff" (default = 120) smbd.conf parameters. A linear back off strategy is used with "prefork backoff increment" added to the delay between restart attempts up until it reaches "prefork maximum backoff". Using the default sequence the restart delays (in seconds) are: 0, 10, 20, ..., 120, 120, ... Standard process model ---------------------- When using the standard process model samba forks a new process to handle ldap and netlogon connections. Samba now honours the 'max smbd processes' smb.conf parameter. The default value of 0, indicates there is no limit. The limit is applied individually to netlogon and ldap. When the process limit is exceeded Samba drops new connections immediately. python3 support --------------- This is the first release of Samba which has full support for Python 3. Samba 4.10 still has support for Python 2, however, Python 3 will be used by default, i.e. 'configure' & 'make' will execute using python3. To build Samba with python2 you *must* set the 'PYTHON' environment variable for both the 'configure' and 'make' steps, i.e. 'PYTHON=python2 ./configure' 'PYTHON=python2 make' This will override the python3 default. Alternatively, it is possible to produce Samba Python bindings for both Python 2 and Python 3. To do so, specify '--extra-python=/usr/bin/python2' as part of the 'configure' command. Note that python3 will still be used as the default in this case. Note that Samba 4.10 supports Python 3.4 onwards. Future Python support --------------------- Samba 4.10 will be the last release that comes with full support for Python 2. Unfortunately, the Samba Team doesn't have the resources to support both Python 2 and Python 3 long-term. Samba 4.11 will not have any runtime support for Python 2. This means if you use Python 2 bindings it is time to migrate to Python 3 now. If you are building Samba using the '--disable-python' option (i.e. you're excluding all the run-time Python support), then this will continue to work on a system that supports either python2 or python3. Also note that Samba 4.11 will most likely only support Python 3.6 onwards. JSON logging ------------ Authentication messages now contain the Windows Event Id "eventId" and logon type "logonType". The supported event codes and logon types are: Event codes: 4624 Successful logon 4625 Unsuccessful logon Logon Types: 2 Interactive 3 Network 8 NetworkCleartext The version number for Authentication messages is now 1.1, changed from 1.0 Password change messages now contain the Windows Event Id "eventId", the supported event Id's are: 4723 Password changed 4724 Password reset The version number for PasswordChange messages is now 1.1, changed from 1.0 Group membership change messages now contain the Windows Event Id "eventId", the supported event Id's are: 4728 A member was added to a security enabled global group 4729 A member was removed from a security enabled global group 4732 A member was added to a security enabled local group 4733 A member was removed from a security enabled local group 4746 A member was added to a security disabled local group 4747 A member was removed from a security disabled local group 4751 A member was added to a security disabled global group 4752 A member was removed from a security disabled global group 4756 A member was added to a security enabled universal group 4757 A member was removed from a security enabled universal group 4761 A member was added to a security disabled universal group 4762 A member was removed from a security disabled universal group The version number for GroupChange messages is now 1.1, changed from 1.0. Also A GroupChange message is generated when a new user is created to log that the user has been added to their primary group. The leading "JSON <message type>:" and source file prefix of the JSON formatted log entries has been removed to make the parsing of the JSON log messages easier. JSON log entries now start with 2 spaces followed by an opening brace i.e. " {" SMBv2 samba-tool support ------------------------ On previous releases, some samba-tool commands would not work against a remote DC that had SMBv1 disabled. SMBv2 support has now been added for samba-tool. The affected commands are 'samba-tool domain backup|rename' and the 'samba-tool gpo' set of commands. New glusterfs_fuse VFS module ----------------------------- The new vfs_glusterfs_fuse module improves performance when Samba accesses a glusterfs volume mounted via FUSE (Filesystem in Userspace as part of the Linux kernel). It achieves that by leveraging a mechanism to retrieve the appropriate case of filenames by querying a specific extended attribute in the filesystem. No extra configuration is required to use this module, only glusterfs_fuse needs to be set in the "vfs objects" parameter. Further details can be found in the vfs_glusterfs_fuse(8) manpage. This new vfs_glusterfs_fuse module does not replace the existing vfs_glusterfs module, it just provides an additional, alternative mechanism to access a Gluster volume. REMOVED FEATURES ================ MIT Kerberos build of the AD DC ------------------------------- While not removed, the MIT Kerberos build of the Samba AD DC is still considered experimental. Because Samba will not issue security patches for this configuration, such builds now require the explicit configure option: --with-experimental-mit-ad-dc For further details see https://wiki.samba.org/index.php/Running_a_Samba_AD_DC_with_MIT_Kerberos_KDC samba_backup ------------ The samba_backup script has been removed. This has now been replaced by the 'samba-tool domain backup offline' command. SMB client Python bindings -------------------------- The SMB client python bindings are now deprecated and will be removed in future Samba releases. This will only affects users that may have used the Samba Python bindings to write their own utilities, i.e. users with a custom Python script that includes the line 'from samba import smb'.
2019-03-20 20:09:10 +01:00
.include "../../lang/python/application.mk"
.include "../../lang/python/extension.mk"
.include "../../security/gnutls/buildlink3.mk"
.include "../../security/libgcrypt/buildlink3.mk"
.include "../../textproc/jansson/buildlink3.mk"
.include "../../mk/bsd.pkg.mk"