Samba4 is an attempt to implement an Active Directory compatible Domain
Controller.
In short, you can join a WinNT, Win2000, WinXP or Win 2003 - 2016 member
server to a Samba4 domain, and it will behave much as it does in AD,
including Kerberos domain logins where applicable.
===> The following configuration options are available for samba413-4.13.17_9:
ADS=on: Active Directory client(implies LDAP)
AD_DC=on: Active Directory Domain Controller(implies PYTHON3)
CLUSTER=off: Clustering support
CUPS=off: CUPS printing system support
DOCS=on: Build and/or install documentation
FAM=on: File Alteration Monitor
GPGME=off: GpgME support
LDAP=on: LDAP client
MANDOC=off: Build manpages from DOCBOOK templates
NTVFS=off: Build *DEPRECATED* NTVFS file server
PROFILE=on: Profiling data
PYTHON3=on: Python 3.x bindings or support
QUOTAS=on: Disk quota support
SPOTLIGHT=off: Spotlight server-side search support
SYSLOG=on: Syslog logging support
UTMP=on: UTMP accounting
====> VFS modules
FRUIT=on: MacOSX and TimeMachine support
GLUSTERFS=off: GlusterFS support
====> GSSAPI Security API support: you have to select exactly one of them
GSSAPI_BUILTIN=on: GSSAPI support via bundled Heimdal
GSSAPI_MIT=off: GSSAPI support via security/krb5
====> Zero configuration networking: you have to select exactly one of them
ZEROCONF_NONE=off: Zeroconf support is absent
AVAHI=on: Zeroconf support via Avahi
MDNSRESPONDER=off: Zeroconf support via mDNSResponder
====> DNS frontend: you can only select none or one of them
NSUPDATE=off: Use samba NSUPDATE utility for AD DC
BIND916=off: Use Bind 9.16 as AD DC DNS server frontend
BIND918=off: Use Bind 9.18 as AD DC DNS server frontend
===> Use 'make config' to modify these settings
*/*: Sunset 12.4-RELEASE/12-STABLE from ports tree
- Remove all references to defunct ARCH arm
- Remove all references to defunct ARCH sparc64
- Remove x11-drivers/xf86-video-sunffb which requires defunct sparc64
ARCH
- Remove sysutils/afbinit requires defunct sparc64 ARCH
- Remove all references to bktr driver
- Remove all references to defunct FreeBSD_12
- Remove all references to OSVERSION/OSREL corresponding to 12
- Remove conditionals in Mk/Uses/cabal.mk
- Remove sparc reference from Mk/Uses/qt-dist.mk
- Remove BROKEN_sparc64/NOT_FOR_ARCH=sparc64
- Remove BROKEN_FreeBSD_12* from:
- Remove OpenSSL patches from:
- Remove conditional flags for OSVERSION >= 1300000 to fixed flags.
Also move conditional flags for non sparc64/arm ARCH to fixed flags.
Reviewed by: brooks, jbeich, rene, salvadore
Differential Revision: https://reviews.freebsd.org/D42068
net/samba413: Mark DEPRECATED and set EXPIRATION_DATE
Samba 4.13 has already reached its EoL on March 21, 2022. The main
reason this port isn't removed yet is that Samba 4.16 (net/samba416)
doesn't work with FreeBSD 12. So mark DEPRECATED and set
EXPIRATION_DATE to December 31, 2023, the EoL day of FreeBSD 12.
PR: 267142
Approved by: maintainer timeout
net/samba413: fix build with lld 17
Building net/samba413 with lld 17 results in the following link errors:
runner ['cc', '-Wl,--as-needed',
'-Wl,--version-script=/wrkdirs/share/dim/ports/net/samba413/work/samba-4.13.17/bin/default/lib/replace/replace.vscript',
'-shared', 'lib/replace/replace.c.2.o', 'lib/replace/strptime.c.2.o',
'lib/replace/cwrap.c.2.o', 'lib/replace/xattr.c.2.o',
'-o/wrkdirs/share/dim/ports/net/samba413/work/samba-4.13.17/bin/default/lib/replace/libreplace-samba4.so',
'-Wl,-Bstatic', '-Wl,-Bdynamic', '-L/usr/local/lib', '-L/usr/local/lib',
'-fstack-protector-strong', '-L/usr/local/lib', '-Wl,-z,relro,-z,now',
'-Wl,-no-undefined', '-Wl,--export-dynamic']
ld: error: version script assignment of 'local' to symbol '_end' failed:
symbol not defined
ld: error: version script assignment of 'local' to symbol '__bss_start'
failed: symbol not defined
ld: error: version script assignment of 'local' to symbol '_edata' failed:
symbol not defined
cc: error: linker command failed with exit code 1 (use -v to see invocation)
Since the linker version scripts are generated dynamically, suppress
errors with lld >= 17 due to these undefined symbols.
PR: 274313
Approved by: maintainer timeout (2 weeks)
MFH: 2023Q4
net/samba413: Work around 12.4 bug with orphaned temp files
Because src commit 96e101bec9 never made it into 12.4, temporary files
are littering the staging directory and causing plist errors. Since
12.4 will be EOL soon, just work around the issue.
PR: 255626
Approved by: portmgr (rene)
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D42030
all: remove explicit versions in USES=python for "3.x+"
The logic in USES=python will automatically convert this to 3.8+ by
itself.
Adjust two ports that only had Python 3.7 mentioned but build fine
on Python 3.8 too.
finance/quickfix: mark BROKEN with PYTHON
libtool: compile: c++ -DHAVE_CONFIG_H -I. -I../.. -I -I. -I.. -I../.. -I../C++
-DLIBICONV_PLUG -DPYTHON_MAJOR_VERSION=3 -Wno-unused-variable
-Wno-maybe-uninitialized -O2 -pipe -DLIBICONV_PLUG -fstack-protector-strong
-fno-strict-aliasing -DLIBICONV_PLUG -Wall -ansi
-Wno-unused-command-line-argument -Wpointer-arith -Wwrite-strings
-Wno-overloaded-virtual -Wno-deprecated-declarations -Wno-deprecated -std=c++0x
-MT _quickfix_la-QuickfixPython.lo -MD -MP -MF
.deps/_quickfix_la-QuickfixPython.Tpo -c QuickfixPython.cpp -fPIC -DPIC -o
.libs/_quickfix_la-QuickfixPython.o
warning: unknown warning option '-Wno-maybe-uninitialized'; did you mean
'-Wno-uninitialized'? [-Wunknown-warning-option]
QuickfixPython.cpp:175:11: fatal error: 'Python.h' file not found
^~~~~~~~~~
1 warning and 1 error generated.
Reviewed by: portmgr, vishwin, yuri
Differential Revision: <https://reviews.freebsd.org/D40568>
Mk/**ldap.mk: Convert USE_LDAP to USES=ldap
Convert the USE_LDAP=yes to USES=ldap and adds the following features:
- Adds the argument USES=ldap:server to add openldap2{4|5|6}-server as
RUN_DEPENDS
- Adds the argument USES=ldap<version> and replaces WANT_OPENLDAP_VER
- Adds OPENLDAP versions in bsd.default-versions.mk
- Adds USE_OPENLDAP/WANT_OPENLDAP_VER in Mk/bsd.sanity.mk
- Changes consumers to use the features
Reviewed by: delphij
Approved by: portmgr
Differential Revision: https://reviews.freebsd.org/D38233
net/samba413: Backport security fix from 4.14.14
* Add upstream patch to fix configure error with Python 3.11.
* Fix plist error when AD_DC option is off and PYTHON3 option is on.
* Replace BIND911 option with BIND918 as dns/bind911 is removed from
ports tree and dns/bind918 is added instead.
PR: 266641
Approved by: maintainer timeout
MFH: 2022Q4
Security: f9140ad4-4920-11ed-a07e-080027f5fec9
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
(Only the first 15 lines of the commit message are shown above )
net/samba41[23]: set PYTHONHASHSEED during build
The build with CCACHE can be significantly sped up by passing
PYTHONHASHSEED=1 in the environment to make the build reproducible
with regard to the compiler commands issued.
PR: 262092
Reported by: chris at chrullrich.net (Christian Ullrich)
net/samba413: Update to the 4.13.16 release to address CVE-2021-43566
In addition an CVE-2021-20316 is issued, but can't be address in this
Samba release.
====================================================
Workaround and mitigating factors for CVE-2021-20316
====================================================
Do not enable SMB1 (please note SMB1 is disabled by default in Samba
from version 4.11.0 and onwards). This prevents the creation of
symbolic links via SMB1. If SMB1 must be enabled for backwards
compatibility then add the parameter:
unix extensions = no
(Only the first 15 lines of the commit message are shown above )
Fix CONFLICTS entries of multiple ports
There have been lots of missing CONFLICTS_INSTALL entries, either
because conflicting ports were added without updating existing ports,
due to name changes of generated packages, due to mis-understanding
the format and semantics of the conflicts entries, or just due to
typoes in package names.
This patch is the result of a comparison of all files contained in
the official packages with each other. This comparison was based on
packages built with default options and may therefore have missed
further conflicts with optionally installed files.
Where possible, version numbers in conflicts entries have been
generalized, some times taking advantage of the fact that a port
(Only the first 15 lines of the commit message are shown above )
net/openldap24-client: bump all dependent port
In the earlier net/openldap24-server commit, only those which depend on
net/openldap24-sasl-client were bumped. Bumping all dependent port that
didn't get a bump to force a rebuild of these packages.
Suggested by: kib
PR: 255415254033252385
Security: CVE-2021-20254
Updated net/samba412 and net/samba413 to fix CVE-2021-20254.
Also fixed:
* Incorrect include line for the bind backend(255415)
* Broken pkg-plist with NO_PYTHON(254033)
* Broken URL parsing in LDAP client(252385)
net/samba411 net/samba412 net/samba413: Fix zero-sized VLAs
With recent versions of clang, samba could dump core shortly after
startup, terminating with either SIGILL or SIGSEGV.
Investigation showed that samba is using C99 variable length arrays
(VLAs), and in some cases the length of these arrays would become zero.
Since this is undefined behavior, various interesting things would
happen, often ending in segfaults.
Fix this by avoiding to use zero as the length for these VLA
declarations.
A similar patch was also sent upstream, and was accepted and included in
subsequent samba releases.
See also: https://bugzilla.samba.org/show_bug.cgi?id=14605
Reported by: Dries Michiels <driesm.michiels@gmail.com>
PR: 252157
MFH: 2021Q1
Security update for samba411, samba412 and samba413:
CVE-2020-14318 (Missing handle permissions check in SMB1/2/3 ChangeNotify)
CVE-2020-14323 (Unprivileged user can crash winbind)
CVE-2020-14383 (An authenticated user can crash the DCE/RPC DNS with easily
crafted records)
Security: CVE-2020-14318
CVE-2020-14323
CVE-2020-14383
