Samba4 is an attempt to implement an Active Directory compatible Domain
Controller.
In short, you can join a WinNT, Win2000, WinXP or Win 2003 - 2016 member
server to a Samba4 domain, and it will behave much as it does in AD,
including Kerberos domain logins where applicable.
===> The following configuration options are available for samba424-4.24.8:
ADS=on: Active Directory client
AD_DC=on: Active Directory Domain Controller(implies PYTHON3)
CLUSTER=off: Clustering support
CUPS=off: CUPS printing system support
DOCS=on: Build and/or install documentation
FAM=on: File Alteration Monitor
GPGME=off: GpgME support
LDAP=on: LDAP client
MANPAGES=on: Build and/or install manual pages
PROFILE=on: Profiling data
PYTHON3=on: Python 3.x bindings or support
QUOTAS=on: Disk quota support
SYSLOG=on: Syslog logging support
UTMP=on: UTMP accounting
====> Bundled dependencies
BUNDLED_CMOCKA=off: Bundle cmocka instead of depending on a standalone port
BUNDLED_TALLOC=off: Bundle talloc instead of depending on a standalone port
BUNDLED_TDB=off: Bundle TDB instead of depending on a standalone port
BUNDLED_TEVENT=off: Bundle Tevent instead of depending on a standalone port
====> Testing, debugging, and development
DEVELOPER=off: With developer framework
MEMORY_DEBUG=off: Debug memory allocator
TEST=off: Build and/or run tests
====> VFS modules
FRUIT=on: MacOSX and TimeMachine support
GLUSTERFS=off: GlusterFS support
====> GSSAPI Security API support: you have to select exactly one of them
GSSAPI_BUILTIN=on: GSSAPI support via bundled Heimdal
GSSAPI_MIT=off: GSSAPI support via security/krb5
====> Zero configuration networking: you have to select exactly one of them
AVAHI=on: Zeroconf support via Avahi
MDNSRESPONDER=off: Zeroconf support via mDNSResponder
ZEROCONF_NONE=off: Zeroconf support is absent
====> LMDB version to use: you can only select none or one of them
LMDB0=on: Use LMDB 0.9 library
LMDB1=off: Use LMDB 1.0 library
===> Use 'make config' to modify these settings
net/samba424: update to 4.24.8
Changelog:
* BUG 16200: generate_unique_u64() may not protect against veto_value
* BUG 16261: Rename with ReplaceIfExists to a target differing only in case
creates a duplicate instead of replacing (regression in
bb130f32)
* BUG 15962: SMB3 SESSION SETUP responses must always be signed
* BUG 16081: winbindd_child_msg_filter: talloc_get_type_abort crashes when
winbind max domain connections > 1
* BUG 16200: generate_unique_u64() may not protect against veto_value
* BUG 16239: Fix parsing of uppercase "0X" hex values in the "kdc default
domain supported enctypes" smb.conf parameter.
* BUG 16240: smbd temporary mkdir name can exceed NAME_MAX for otherwise
valid client names
* BUG 16258: Python smbconf transaction_start() lacks a talloc stack frame
with CTDB
* BUG 16254: CTDB database operations can be run against incorrect nodes
* BUG 16273: A node can be banned because it tries to run recovery after
losing the cluster lock
* BUG 15857: All backend log should honor global log level "log level = "
PR: 299373
Reported by: anttijuhani.nikkila@gmail.com
Sponsored by: Klara, Inc.
databases/lmdb: allow to install both 0.x and 1.x together
LMDB 1.0 and the legacy 0.9 ABI cannot be mixed, the datanase format are
incompatibles as well.
Rename or relocate everything databases/lmdb0 installs so that it no
longer overlaps with databases/lmdb:
- the utilities are now mdb_copy0, mdb_dump0, mdb_load0 and mdb_stat0
- the header is include/lmdb0/lmdb.h
- the linker name is liblmdb0.so, the shared object keeps its ABI name
liblmdb.so.0 so already linked programs are unaffected
- the pkg-config file is lmdb0.pc
A compatibility prefix holding the previous layout is also installed
under ${PREFIX}/lmdb0/ (include/, lib/ and libdata/pkgconfig/) so that
build systems which expect to find lmdb.h and -llmdb relative to a
single directory only need a path change.
Now all ports should migrate to lmdb 1.X and use the lmdb 0.9 port to ease
in the migration path, lmdb, the lmdb 0.x is supposed to get removed at
some point.
Approved by: mat (portmgr)
Reviewed by: mat
Differential Revision: https://reviews.freebsd.org/D60741
net/samba424: avoid SIGFPE in streams_xattr_get_ea_value_fsp
As reported in https://bugzilla.samba.org/show_bug.cgi?id=16278,
upstream commit 5fa43440ebd3 ("vfs: Implement larger streams in multiple
xattrs"), results in many signal 8 (SIGFPE) crashes in smbd child
processes on FreeBSD, if the streams_xattr vfs module is loaded.
This is because streams_xattr_get_ea_value_fsp() can divide by zero, if
the "max xattrs per stream" is left at its default value.
Apply the upstream fix to avoid the crashes.
PR: 299445
Obtained from: https://gitlab.com/samba-team/samba/-/commit/21f8b339
MFH: 2026Q4
Approved by: samba (kiwi)
net/samba424: restore missing FreeBSD mDNS/dns_sd support (MDNSRESPONDER)
Three FreeBSD-local patches providing dns_sd/mDNSResponder support
(present identically in net/samba419, 420, 422, and 423) were silently
dropped when net/samba424 was created, all gated behind the
non-default MDNSRESPONDER port option (default is AVAHI):
- source3/wscript/wscript_build: the --enable-dnssd waf option
(dns_sd.h/DNSServiceRegister detection, WITH_DNSSD_SUPPORT define,
dns_sd library linkage into smbd_base and smbclient) never existed
in samba424 at all.
- source3/smbd/dnsregister.c: the FreeNAS-authored mDNS
advertise-per-interface fixes. Only the companion
source3/client/dnsbrowse.c half of this combined patch survived
into samba424; the dnsregister.c half was lost.
(Only the first 15 lines of the commit message are shown above )
net/samba424: add LMDB selection options (LMDB0 / LMDB1)
This patch introduces a new radio option group (LMDBG1) to allow
selecting between LMDB 0.9 (databases/lmdb0) and LMDB
1.0 (databases/lmdb), following the pattern used in mail/postfix.
Summary of changes:
- Introduced LMDBG1 radio option group with LMDB0 and LMDB1 choices.
- Kept LMDB0 (databases/lmdb0) as the default selection for backward
compatibility.
- Updated _LMDB_DEPENDS logic for AD_DC / DEVELOPER builds to respect
the selected LMDB version.
- Guarded FORTIFY_UNSAFE with .ifnmake portclippy to silence portclippy
warnings.
PR: 299146
Co-authored-by: vvd
Approved by: samba (kiwi)
net/samba424: update to 4.25.7
Fixes:
BUG 16097: POSIX ACL backend silently discards erros when processing NT
ACLs with non-canonical ordering
BUG 16225: dns client problems related to EDNS usage
BUG 15988: Samba internal DNS service doesn't handle switch from UDP to TCP
when packet is larger than 4k
BUG 15988: Samba internal DNS service doesn't handle switch from UDP to TCP
when packet is larger than 4k
BUG 16194: autobuild failures need to be reported in a more verbose way
BUG 16223: DNS scavenging happens even if fAging is FALSE
BUG 16226: samba-tool dns zoneoptions $DC_SERVER_IP
_msdcs.addom.samba.example.com -P --aging=1 gives
WERR_INTERNAL_DB_ERROR
BUG 16144: Incorrect behavior on stream create-disposition when prior
handle is closed
BUG 16082: An inactive node can run recovery resulting in inconsistent
databases
BUG 16225: dns client problems related to EDNS usage
BUG 16225: dns client problems related to EDNS usage
PR: 298432
Approved by: samba (kiwi)
net/samba424: restore missing FreeBSD fdescfs support in lib/system.c
net/samba419, net/samba420, net/samba422 and net/samba423 all carried
a patch (originally 0028-s3-lib-system-add-FreeBSD-proc_fd_pattern.patch
by Timur I. Bakeyev, adapted for Samba 4.20 by Andrea Venturoli) that
teaches sys_have_proc_fds()/sys_proc_fd_path() in source3/lib/system.c
to recognize FreeBSD's fdescfs mount as an equivalent to Linux's
/proc/self/fd. This patch was dropped when net/samba424 was created
and was never carried forward.
Without it, upstream's sys_have_proc_fds() only ever checks
"/proc/self/fd/0", which does not exist on stock FreeBSD, so
fsp->fsp_flags.have_proc_fds is always false. That flag gates the
race-free pathref-fd-to-path resolution branches in
patch-source3_modules_vfs__zfsacl.c and patch-source3_modules_vfs__freebsd.c,
(Only the first 15 lines of the commit message are shown above )
net/samba424: fix sys_proc_fd_path() buffer type in vfs_freebsd.c
At all 5 call sites, vfs_freebsd.c declared a plain "char buf[PATH_MAX]"
and passed its address to sys_proc_fd_path(fd, &buf). Samba 4.24
changed that function's signature to
"char *sys_proc_fd_path(int fd, struct sys_proc_fd_path_buf *buf)",
so "&buf" here has type "char (*)[PATH_MAX]", not the expected
"struct sys_proc_fd_path_buf *" - a type mismatch left over from an
incomplete migration of this patch to the new API (the sibling
patch-source3_modules_vfs__zfsacl.c was already updated correctly).
Change all 5 declarations to "struct sys_proc_fd_path_buf buf;" to
match the current signature.
PR: 298884
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Approved by: samba (kiwi)
net/samba424: fix swapped paths/targetdir args in join.py provision_fill call
patch-python_samba_provision_____init____.py extends provision_fill()'s
signature to provision_fill(..., paths, targetdir, schema=None, ...),
but the DCJoinContext call site in patch-python_samba_join.py passed
the two positional arguments in the opposite order (targetdir, paths).
This silently bound paths to a plain targetdir string and targetdir to
the ProvisionPaths object, which would raise AttributeError as soon as
provision_fill() accesses paths.netlogon/paths.sysvol.
Present identically since net/samba422 (join.py was not touched at all
in net/samba419) and carried forward unnoticed through samba423 and
samba424. Only reachable via the AD DC subdomain-join code path
(DCJoinContext), not via a fresh/root-domain provision.
PR: 298883
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Aproved by: samba (kiwi)
net/samba424: fix dropped %%GDB_CMD%% and %%SAMBA4_CONFIG%% placeholders
patch-buildtools_scripts_abi__gen.sh hardcoded the abi_gen.sh gdb
invocation to "true" instead of the %%GDB_CMD%% placeholder that the
port's post-patch target substitutes via _GDB_CMD. This made the
Makefile's REINPLACE_CMD for %%GDB_CMD%% a dead no-op and silently
disabled real gdb-based ABI/symbol-version checking under the
DEVELOPER option, even though the devel/gdb dependency is still pulled
in for that option.
patch-dynconfig_wscript hardcoded the CONFIGFILE path to smb4.conf
instead of the %%SAMBA4_CONFIG%% placeholder, making the corresponding
REINPLACE_CMD for %%SAMBA4_CONFIG%% a dead no-op too. Harmless in
practice since _SAMBA_CONFIG already equals smb4.conf, but it silently
removes the ability to reconfigure the config file name through the
mechanism the Makefile provides for it.
Restore both placeholders so the existing substitution logic in the
Makefile actually takes effect again.
PR: 298882
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Approved by: samba (kiwi)
net/samba424: fix mampage plist
vfs fruit and glusterfs had bad plist entries. This fix this.
Reported by: Paul <paul604@protonmail.ch>
Approved by: samba (kiwi)
Sponsored by: Klara, Inc.
net/samba424: fix building of ctdb
When using some option, the ctdb doesn't build because of
non existant ENODATA on FreeBSD.
PR: 294595
Reported by: Vladimir Druzenko
Approved by: samba (kiwi)
Sponsored by: Klara, Inc.
