1 ===============================
2 Release Notes for Samba 4.12.12
4 ===============================
7 This is the latest stable release of the Samba 4.12 release series.
8 Please note that this will be the last bugfix release of the Samba 4.12 release
9 series. There will be Security Releases only beyond this point.
15 o Trever L. Adams <trever.adams@gmail.com>
16 * BUG 14634: s3:modules:vfs_virusfilter: Recent talloc changes cause infinite
19 o Jeremy Allison <jra@samba.org>
20 * BUG 13992: SAMBA RPC share error.
21 * BUG 14612: s3: smbd: Add call to conn_setup_case_options() to
22 create_conn_struct_as_root().
24 o Ralph Boehme <slow@samba.org>
25 * BUG 14602: s3/auth: Implement "winbind:ignore domains".
26 * BUG 14612: build: Remove smbd_conn private library.
28 o Peter Eriksson <pen@lysator.liu.se>
29 * BUG 14648: s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error
32 o Björn Jacke <bj@sernet.de>
33 * BUG 14624: classicupgrade: Treat old never expires value right.
35 o Volker Lendecke <vl@samba.org>
36 * BUG 14636: g_lock: Fix uninitalized variable reads.
38 o Stefan Metzmacher <metze@samba.org>
39 * BUG 13898: s3:pysmbd: Fix fd leak in py_smbd_create_file().
40 * BUG 14607: Work around special SMB2 IOCTL response behavior of NetApp
43 o Andreas Schneider <asn@samba.org>
44 * BUG 14625: Fix smbd share mode double free crash.
46 o Paul Wise <pabs3@bonedaddy.net>
47 * BUG 12505: HEIMDAL: krb5_storage_free(NULL) should work.
50 #######################################
51 Reporting bugs & Development Discussion
52 #######################################
54 Please discuss this release on the samba-technical mailing list or by
55 joining the #samba-technical IRC channel on irc.freenode.net.
57 If you do report problems then please try to send high quality
58 feedback. If you don't provide vital information to help us track down
59 the problem then you will probably be ignored. All bug reports should
60 be filed under the Samba 4.1 and newer product in the project's Bugzilla
61 database (https://bugzilla.samba.org/).
64 ======================================================================
65 == Our Code, Our Bugs, Our Responsibility.
67 ======================================================================
70 Release notes for older releases follow:
71 ----------------------------------------
74 ===============================
75 Release Notes for Samba 4.12.11
77 ===============================
80 This is the latest stable release of the Samba 4.12 release series.
86 o Jeremy Allison <jra@samba.org>
87 * BUG 14210: libcli: smb2: Never print length if smb2_signing_key_valid()
88 fails for crypto blob.
89 * BUG 14486: s3: modules: gluster. Fix the error I made in preventing talloc
90 leaks from a function.
91 * BUG 14515: s3: smbd: Don't overwrite contents of fsp->aio_requests[0] with
92 NULL via TALLOC_FREE().
93 * BUG 14568: s3: spoolss: Make parameters in call to user_ok_token() match
95 * BUG 14590: s3: smbd: Quiet log messages from usershares for an unknown
98 o Dimitry Andric <dimitry@andric.com>
99 * BUG 14605: lib: Avoid declaring zero-length VLAs in various messaging
102 o Andrew Bartlett <abartlet@samba.org>
103 * BUG 14579: Do not create an empty DB when accessing a sam.ldb.
105 o Ralph Boehme <slow@samba.org>
106 * BUG 14248: samba process does not honor "max log size".
107 * BUG 14587: vfs_zfsacl: add missing inherited flag on hidden "magic"
109 * BUG 14596: vfs_fruit may close wrong backend fd.
111 o Günther Deschner <gd@samba.org>
112 * BUG 14486: s3-vfs_glusterfs: always disable write-behind translator.
114 o Arne Kreddig <arne@kreddig.net>
115 * BUG 14606: vfs_virusfilter: Allocate separate memory for config char*.
117 o Stefan Metzmacher <metze@samba.org>
118 * BUG 14596: vfs_fruit may close wrong backend fd.
120 o Anoop C S <anoopcs@samba.org>
121 * BUG 14486: manpages/vfs_glusterfs: Mention silent skipping of write-behind
123 * BUG 14573: vfs_shadow_copy2: Preserve all open flags assuming ROFS.
125 o Andreas Schneider <asn@samba.org>
126 * BUG 14601: s3:lib: Create the cache path of user gencache recursively.
128 o Martin Schwenke <martin@meltin.net>
129 * BUG 14594: Be more flexible with repository names in CentOS 8 test
132 o Jones Syue <jonessyue@qnap.com>
133 * BUG 14514: interface: Fix if_index is not parsed correctly.
136 #######################################
137 Reporting bugs & Development Discussion
138 #######################################
140 Please discuss this release on the samba-technical mailing list or by
141 joining the #samba-technical IRC channel on irc.freenode.net.
143 If you do report problems then please try to send high quality
144 feedback. If you don't provide vital information to help us track down
145 the problem then you will probably be ignored. All bug reports should
146 be filed under the Samba 4.1 and newer product in the project's Bugzilla
147 database (https://bugzilla.samba.org/).
150 ======================================================================
151 == Our Code, Our Bugs, Our Responsibility.
153 ======================================================================
156 ----------------------------------------------------------------------
159 ===============================
160 Release Notes for Samba 4.12.10
162 ===============================
165 This is the latest stable release of the Samba 4.12 release series.
167 Major enhancements include:
169 o BUG 14537: ctdb-common: Avoid aliasing errors during code optimization.
170 o BUG 14486: vfs_glusterfs: Avoid data corruption with the write-behind
178 The GlusterFS write-behind performance translator, when used with Samba, could
179 be a source of data corruption. The translator, while processing a write call,
180 immediately returns success but continues writing the data to the server in the
181 background. This can cause data corruption when two clients relying on Samba to
182 provide data consistency are operating on the same file.
184 The write-behind translator is enabled by default on GlusterFS.
185 The vfs_glusterfs plugin will check for the presence of the translator and
186 refuse to connect if detected. Please disable the write-behind translator for
187 the GlusterFS volume to allow the plugin to connect to the volume.
193 o Jeremy Allison <jra@samba.org>
194 * BUG 14486: s3: modules: vfs_glusterfs: Fix leak of char
195 **lines onto mem_ctx on return.
197 o Ralph Boehme <slow@samba.org>
198 * BUG 14471: RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special.
200 o Alexander Bokovoy <ab@samba.org>
201 * BUG 14538: smb.conf.5: Add clarification how configuration changes
204 o Günther Deschner <gd@samba.org>
205 * BUG 14486: s3-vfs_glusterfs: Refuse connection when write-behind xlator is
207 * winexe:: Add configure option to control whether to build it
210 o Amitay Isaacs <amitay@gmail.com>
211 * BUG 14487: Latest version of Bind9 is now 9.20.
212 * BUG 14537: ctdb-common: Avoid aliasing errors during code optimization.
214 o Stefan Metzmacher <metze@samba.org>
215 * BUG 14531: s4:dsdb:acl_read: Implement "List Object" mode feature.
217 o Sachin Prabhu <sprabhu@redhat.com>
218 * BUG 14486: docs-xml/manpages: Add warning about write-behind translator for
221 o Khem Raj <raj.khem@gmail.com>
222 * nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h.
224 o Martin Schwenke <martin@meltin.net>
225 * BUG 14513: ctdb disable/enable can still fail due to race condition.
227 o Andrew Walker <awalker@ixsystems.com>
228 * BUG 14471: RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special.
231 #######################################
232 Reporting bugs & Development Discussion
233 #######################################
235 Please discuss this release on the samba-technical mailing list or by
236 joining the #samba-technical IRC channel on irc.freenode.net.
238 If you do report problems then please try to send high quality
239 feedback. If you don't provide vital information to help us track down
240 the problem then you will probably be ignored. All bug reports should
241 be filed under the Samba 4.1 and newer product in the project's Bugzilla
242 database (https://bugzilla.samba.org/).
245 ======================================================================
246 == Our Code, Our Bugs, Our Responsibility.
248 ======================================================================
251 ----------------------------------------------------------------------
254 ==============================
255 Release Notes for Samba 4.12.9
257 ==============================
260 This is a security release in order to address the following defects:
262 o CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify.
263 o CVE-2020-14323: Unprivileged user can crash winbind.
264 o CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily
273 The SMB1/2/3 protocols have a concept of "ChangeNotify", where a client can
274 request file name notification on a directory handle when a condition such as
275 "new file creation" or "file size change" or "file timestamp update" occurs.
277 A missing permissions check on a directory handle requesting ChangeNotify
278 meant that a client with a directory handle open only for
279 FILE_READ_ATTRIBUTES (minimal access rights) could be used to obtain change
280 notify replies from the server. These replies contain information that should
281 not be available to directory handles open for FILE_READ_ATTRIBUTE only.
284 winbind in version 3.6 and later implements a request to translate multiple
285 Windows SIDs into names in one request. This was done for performance
286 reasons: The Microsoft RPC call domain controllers offer to do this
287 translation, so it was an obvious extension to also offer this batch
288 operation on the winbind unix domain stream socket that is available to local
289 processes on the Samba server.
291 Due to improper input validation a hand-crafted packet can make winbind
292 perform a NULL pointer dereference and thus crash.
295 Some DNS records (such as MX and NS records) usually contain data in the
296 additional section. Samba's dnsserver RPC pipe (which is an administrative
297 interface not used in the DNS server itself) made an error in handling the
298 case where there are no records present: instead of noticing the lack of
299 records, it dereferenced uninitialised memory, causing the RPC server to
300 crash. This RPC server, which also serves protocols other than dnsserver,
301 will be restarted after a short delay, but it is easy for an authenticated
302 non-admin attacker to crash it again as soon as it returns. The Samba DNS
303 server itself will continue to operate, but many RPC services will not.
305 For more details, please refer to the security advisories.
311 o Jeremy Allison <jra@samba.org>
312 * BUG 14434: CVE-2020-14318: s3: smbd: Ensure change notifies can't get set
313 unless the directory handle is open for SEC_DIR_LIST.
315 o Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
316 * BUG 12795: CVE-2020-14383: Remote crash after adding NS or MX records using
318 * BUG 14472: CVE-2020-14383: Remote crash after adding MX records.
320 o Volker Lendecke <vl@samba.org>
321 * BUG 14436: CVE-2020-14323: winbind: Fix invalid lookupsids DoS.
324 #######################################
325 Reporting bugs & Development Discussion
326 #######################################
328 Please discuss this release on the samba-technical mailing list or by
329 joining the #samba-technical IRC channel on irc.freenode.net.
331 If you do report problems then please try to send high quality
332 feedback. If you don't provide vital information to help us track down
333 the problem then you will probably be ignored. All bug reports should
334 be filed under the Samba 4.1 and newer product in the project's Bugzilla
335 database (https://bugzilla.samba.org/).
338 ======================================================================
339 == Our Code, Our Bugs, Our Responsibility.
341 ======================================================================
344 ----------------------------------------------------------------------
347 ==============================
348 Release Notes for Samba 4.12.8
350 ==============================
353 This is the latest stable release of the Samba 4.12 release series.
359 o Günther Deschner <gd@samba.org>
360 * BUG 14318: docs: Add missing winexe manpage.
362 o Volker Lendecke <vl@samba.org>
363 * BUG 14465: idmap_ad does not deal properly with a RFC4511 section 4.4.1
366 o Laurent Menase <laurent.menase@hpe.com>
367 * BUG 14388: winbind: Fix a memleak.
369 o Stefan Metzmacher <metze@samba.org>
370 * BUG 14465: idmap_ad does not deal properly with a RFC4511 section 4.4.1
372 * BUG 14482: Compilation of heimdal tree fails if libbsd is not installed.
374 o Christof Schmitt <cs@samba.org>
375 * BUG 14166: util: Allow symlinks in directory_create_or_exist.
377 o Andreas Schneider <asn@samba.org>
378 * BUG 14399: waf: Only use gnutls_aead_cipher_encryptv2() for GnuTLS >
380 * BUG 14467: s3:smbd: Fix %U substitutions if it contains a domain name.
382 o Martin Schwenke <martin@meltin.net>
383 * BUG 14466: ctdb disable/enable can fail due to race condition.
386 #######################################
387 Reporting bugs & Development Discussion
388 #######################################
390 Please discuss this release on the samba-technical mailing list or by
391 joining the #samba-technical IRC channel on irc.freenode.net.
393 If you do report problems then please try to send high quality
394 feedback. If you don't provide vital information to help us track down
395 the problem then you will probably be ignored. All bug reports should
396 be filed under the Samba 4.1 and newer product in the project's Bugzilla
397 database (https://bugzilla.samba.org/).
400 ======================================================================
401 == Our Code, Our Bugs, Our Responsibility.
403 ======================================================================
406 ----------------------------------------------------------------------
409 ==============================
410 Release Notes for Samba 4.12.7
412 ==============================
415 This is a security release in order to address the following defect:
417 o CVE-2020-1472: Unauthenticated domain takeover via netlogon ("ZeroLogon").
419 The following applies to Samba used as domain controller only (most
420 seriously the Active Directory DC, but also the classic/NT4-style DC).
422 Installations running Samba as a file server only are not directly
423 affected by this flaw, though they may need configuration changes to
424 continue to talk to domain controllers (see "file servers and domain
427 The netlogon protocol contains a flaw that allows an authentication
428 bypass. This was reported and patched by Microsoft as CVE-2020-1472.
429 Since the bug is a protocol level flaw, and Samba implements the
430 protocol, Samba is also vulnerable.
432 However, since version 4.8 (released in March 2018), the default
433 behaviour of Samba has been to insist on a secure netlogon channel,
434 which is a sufficient fix against the known exploits. This default is
435 equivalent to having 'server schannel = yes' in the smb.conf.
437 Therefore versions 4.8 and above are not vulnerable unless they have
438 the smb.conf lines 'server schannel = no' or 'server schannel = auto'.
440 Samba versions 4.7 and below are vulnerable unless they have 'server
441 schannel = yes' in the smb.conf.
443 Note each domain controller needs the correct settings in its smb.conf.
445 Vendors supporting Samba 4.7 and below are advised to patch their
446 installations and packages to add this line to the [global] section if
449 The 'server schannel = yes' smb.conf line is equivalent to Microsoft's
450 'FullSecureChannelProtection=1' registry key, the introduction of
451 which we understand forms the core of Microsoft's fix.
453 Some domains employ third-party software that will not work with a
454 'server schannel = yes'. For these cases patches are available that
455 allow specific machines to use insecure netlogon. For example, the
458 server schannel = yes
459 server require schannel:triceratops$ = no
460 server require schannel:greywacke$ = no
462 will allow only "triceratops$" and "greywacke$" to avoid schannel.
464 More details can be found here:
465 https://www.samba.org/samba/security/CVE-2020-1472.html
471 o Jeremy Allison <jra@samba.org>
472 * BUG 14497: CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect
473 netr_ServerPasswordSet2 against unencrypted passwords.
475 o Günther Deschner <gd@samba.org>
476 * BUG 14497: CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support
477 "server require schannel:WORKSTATION$ = no" about unsecure configurations.
479 o Gary Lockyer <gary@catalyst.net.nz>
480 * BUG 14497: CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in
483 o Stefan Metzmacher <metze@samba.org>
484 * BUG 14497: CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client
485 challenges in netlogon_creds_server_init()
486 "server require schannel:WORKSTATION$ = no".
489 #######################################
490 Reporting bugs & Development Discussion
491 #######################################
493 Please discuss this release on the samba-technical mailing list or by
494 joining the #samba-technical IRC channel on irc.freenode.net.
496 If you do report problems then please try to send high quality
497 feedback. If you don't provide vital information to help us track down
498 the problem then you will probably be ignored. All bug reports should
499 be filed under the Samba 4.1 and newer product in the project's Bugzilla
500 database (https://bugzilla.samba.org/).
503 ======================================================================
504 == Our Code, Our Bugs, Our Responsibility.
506 ======================================================================
509 ----------------------------------------------------------------------
512 ==============================
513 Release Notes for Samba 4.12.6
515 ==============================
518 This is the latest stable release of the Samba 4.12 release series.
524 o Jeremy Allison <jra@samba.org>
525 * BUG 14403: s3: libsmb: Fix SMB2 client rename bug to a Windows server.
527 o Andrew Bartlett <abartlet@samba.org>
528 * BUG 14424: dsdb: Allow "password hash userPassword schemes = CryptSHA256"
530 * BUG 14450: dbcheck: Allow a dangling forward link outside our known NCs.
532 o Ralph Boehme <slow@samba.org>
533 * BUG 14426: lib/debug: Set the correct default backend loglevel to
535 * BUG 14428: PANIC: Assert failed in get_lease_type().
537 o Bjoern Jacke <bjacke@samba.org>
538 * BUG 14422: util: Fix build on AIX by fixing the order of replace.h include.
540 o Volker Lendecke <vl@samba.org>
541 * BUG 14355: srvsvc_NetFileEnum asserts with open files.
543 o Stefan Metzmacher <metze@samba.org>
544 * BUG 14354: KDC breaks with DES keys still in the database and
545 msDS-SupportedEncryptionTypes 31 indicating support for it.
546 * BUG 14427: s3:smbd: Make sure vfs_ChDir() always sets
547 conn->cwd_fsp->fh->fd = AT_FDCWD.
548 * BUG 14428: PANIC: Assert failed in get_lease_type().
550 o Andreas Schneider <asn@samba.org>
551 * BUG 14358: docs: Fix documentation for require_membership_of of
554 o Martin Schwenke <martin@meltin.net>
555 * BUG 14444: ctdb-scripts: Use nfsconf utility for variable values in CTDB
558 o Andrew Walker <awalker@ixsystems.com>
559 * BUG 14425: s3:winbind:idmap_ad: Make failure to get attrnames for schema
563 #######################################
564 Reporting bugs & Development Discussion
565 #######################################
567 Please discuss this release on the samba-technical mailing list or by
568 joining the #samba-technical IRC channel on irc.freenode.net.
570 If you do report problems then please try to send high quality
571 feedback. If you don't provide vital information to help us track down
572 the problem then you will probably be ignored. All bug reports should
573 be filed under the Samba 4.1 and newer product in the project's Bugzilla
574 database (https://bugzilla.samba.org/).
577 ======================================================================
578 == Our Code, Our Bugs, Our Responsibility.
580 ======================================================================
583 ----------------------------------------------------------------------
586 ==============================
587 Release Notes for Samba 4.12.5
589 ==============================
592 This is the latest stable release of the Samba 4.12 release series.
598 o Jeremy Allison <jra@samba.org>
599 * BUG 14301: Fix smbd panic on force-close share during async io.
600 * BUG 14374: Fix segfault when using SMBC_opendir_ctx() routine for share
601 folder that contains incorrect symbols in any file name.
602 * BUG 14391: Fix DFS links.
604 o Andrew Bartlett <abartlet@samba.org>
605 * BUG 14310: Can't use DNS functionality after a Windows DC has been in
608 o Alexander Bokovoy <ab@samba.org>
609 * BUG 14413: ldapi search to FreeIPA crashes.
611 o Isaac Boukris <iboukris@gmail.com>
612 * BUG 14396: Add net-ads-join dnshostname=fqdn option.
613 * BUG 14406: Fix adding msDS-AdditionalDnsHostName to keytab with Windows DC.
615 o Björn Jacke <bj@sernet.de>
616 * BUG 14386: docs-xml: Update list of posible VFS operations for
619 o Volker Lendecke <vl@samba.org>
620 * BUG 14382: winbindd: Fix a use-after-free when winbind clients exit.
622 o Andreas Schneider <asn@samba.org>
623 * BUG 14370: Client tools are not able to read gencache anymore.
626 #######################################
627 Reporting bugs & Development Discussion
628 #######################################
630 Please discuss this release on the samba-technical mailing list or by
631 joining the #samba-technical IRC channel on irc.freenode.net.
633 If you do report problems then please try to send high quality
634 feedback. If you don't provide vital information to help us track down
635 the problem then you will probably be ignored. All bug reports should
636 be filed under the Samba 4.1 and newer product in the project's Bugzilla
637 database (https://bugzilla.samba.org/).
640 ======================================================================
641 == Our Code, Our Bugs, Our Responsibility.
643 ======================================================================
646 ----------------------------------------------------------------------
649 ==============================
650 Release Notes for Samba 4.12.4
652 ==============================
655 This is a security release in order to address the following defects:
657 o CVE-2020-10730: NULL pointer de-reference and use-after-free in Samba AD DC
658 LDAP Server with ASQ, VLV and paged_results.
659 o CVE-2020-10745: Parsing and packing of NBT and DNS packets can consume
661 o CVE-2020-10760: LDAP Use-after-free in Samba AD DC Global Catalog with
662 paged_results and VLV.
663 o CVE-2020-14303: Empty UDP packet DoS in Samba AD DC nbtd.
671 A client combining the 'ASQ' and 'VLV' LDAP controls can cause a NULL pointer
672 de-reference and further combinations with the LDAP paged_results feature can
673 give a use-after-free in Samba's AD DC LDAP server.
675 o CVE-2020-10745: Parsing and packing of NBT and DNS packets can consume
679 The use of the paged_results or VLV controls against the Global Catalog LDAP
680 server on the AD DC will cause a use-after-free.
683 The AD DC NBT server in Samba 4.0 will enter a CPU spin and not process
684 further requests once it receives an empty (zero-length) UDP packet to
687 For more details, please refer to the security advisories.
693 o Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
694 * BUG 14378: CVE-2020-10745: Invalid DNS or NBT queries containing dots use
695 several seconds of CPU each.
697 o Andrew Bartlett <abartlet@samba.org>
698 * BUG 14364: CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
700 * BUG 14402: CVE-2020-10760: Fix use-after-free in AD DC Global Catalog LDAP
701 server with paged_result or VLV.
702 * BUG 14417: CVE-2020-14303: Fix endless loop from empty UDP packet sent to
705 o Gary Lockyer <gary@catalyst.net.nz>
706 * BUG 14364: CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
707 and VLV combined, ldb: Bump version to 2.1.4.
710 #######################################
711 Reporting bugs & Development Discussion
712 #######################################
714 Please discuss this release on the samba-technical mailing list or by
715 joining the #samba-technical IRC channel on irc.freenode.net.
717 If you do report problems then please try to send high quality
718 feedback. If you don't provide vital information to help us track down
719 the problem then you will probably be ignored. All bug reports should
720 be filed under the Samba 4.1 and newer product in the project's Bugzilla
721 database (https://bugzilla.samba.org/).
724 ======================================================================
725 == Our Code, Our Bugs, Our Responsibility.
727 ======================================================================
730 ----------------------------------------------------------------------
733 ==============================
734 Release Notes for Samba 4.12.3
736 ==============================
739 This is the latest stable release of the Samba 4.12 release series.
745 o Jeremy Allison <jra@samba.org>
746 * BUG 14301: Fix smbd panic on force-close share during async io.
747 * BUG 14343: s3: vfs_full_audit: Add missing fcntl entry in vfs_op_names[]
749 * BUG 14361: vfs_io_uring: Fix data corruption with Windows clients.
750 * BUG 14372: Fix smbd crashes when MacOS Catalina connects if iconv
751 initialization fails.
753 o Ralph Boehme <slow@samba.org>
754 * BUG 14150: Exporting from macOS Adobe Illustrator creates multiple copies.
755 * BUG 14256: smbd does a chdir() twice per request.
756 * BUG 14320: smbd mistakenly updates a file's write-time on close.
757 * BUG 14350: vfs_shadow_copy2: implement case canonicalisation in
758 shadow_copy2_get_real_filename().
759 * BUG 14375: Fix Windows 7 clients problem after upgrading samba file server.
761 o Alexander Bokovoy <ab@samba.org>
762 * BUG 14359: s3: Pass DCE RPC handle type to create_policy_hnd.
764 o Isaac Boukris <iboukris@gmail.com>
765 * BUG 14155: Fix uxsuccess test with new MIT krb5 library 1.18.
766 * BUG 14342: mit-kdc: Explicitly reject S4U requests.
768 o Anoop C S <anoopcs@redhat.com>
769 * BUG 14352: dbwrap_watch: Set rec->value_valid while returning nested
770 share_mode_do_locked().
772 o Amit Kumar <amitkuma@redhat.com>
773 * BUG 14345: lib:util: Fix smbclient -l basename dir.
775 o Volker Lendecke <vl@samba.org>
776 * BUG 14336: s3:libads: Fix ads_get_upn().
777 * BUG 14348: ctdb: Fix a memleak.
778 * BUG 14366: Malicous SMB1 server can crash libsmbclient.
780 o Gary Lockyer <gary@catalyst.net.nz>
781 * BUG 14330: ldb: Bump version to 2.1.3, LMDB databases can grow without
784 o Stefan Metzmacher <metze@samba.org>
785 * BUG 14361: vfs_io_uring: Fix data corruption with Windows clients.
787 o Noel Power <noel.power@suse.com>
788 * BUG 14344: s3/librpc/crypto: Fix double free with unresolved credential
791 o Andreas Schneider <asn@samba.org>
792 * BUG 14358: docs-xml: Fix usernames in pam_winbind manpages.
795 #######################################
796 Reporting bugs & Development Discussion
797 #######################################
799 Please discuss this release on the samba-technical mailing list or by
800 joining the #samba-technical IRC channel on irc.freenode.net.
802 If you do report problems then please try to send high quality
803 feedback. If you don't provide vital information to help us track down
804 the problem then you will probably be ignored. All bug reports should
805 be filed under the Samba 4.1 and newer product in the project's Bugzilla
806 database (https://bugzilla.samba.org/).
809 ======================================================================
810 == Our Code, Our Bugs, Our Responsibility.
812 ======================================================================
815 ----------------------------------------------------------------------
818 ==============================
819 Release Notes for Samba 4.12.2
821 ==============================
824 This is a security release in order to address the following defects:
826 o CVE-2020-10700: Use-after-free in Samba AD DC LDAP Server with ASQ
827 o CVE-2020-10704: LDAP Denial of Service (stack overflow) in Samba AD DC
835 A client combining the 'ASQ' and 'Paged Results' LDAP controls can cause a
836 use-after-free in Samba's AD DC LDAP server.
838 A deeply nested filter in an un-authenticated LDAP search can exhaust the
839 LDAP server's stack memory causing a SIGSEGV.
841 For more details, please refer to the security advisories.
847 o Andrew Bartlett <abartlet@samba.org>
848 * BUG 14331: CVE-2020-10700: Fix use-after-free in AD DC LDAP server when
849 ASQ and paged_results combined.
851 o Gary Lockyer <gary@catalyst.net.nz>
852 * BUG 20454: CVE-2020-10704: Fix LDAP Denial of Service (stack overflow) in
856 #######################################
857 Reporting bugs & Development Discussion
858 #######################################
860 Please discuss this release on the samba-technical mailing list or by
861 joining the #samba-technical IRC channel on irc.freenode.net.
863 If you do report problems then please try to send high quality
864 feedback. If you don't provide vital information to help us track down
865 the problem then you will probably be ignored. All bug reports should
866 be filed under the Samba 4.1 and newer product in the project's Bugzilla
867 database (https://bugzilla.samba.org/).
870 ======================================================================
871 == Our Code, Our Bugs, Our Responsibility.
873 ======================================================================
876 ----------------------------------------------------------------------
879 ==============================
880 Release Notes for Samba 4.12.1
882 ==============================
885 This is the latest stable release of the Samba 4.12 release series.
891 o Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
892 * BUG 14295: nmblib: Avoid undefined behaviour in handle_name_ptrs().
894 o Björn Baumbach <bb@sernet.de>
895 * BUG 14296: samba-tool group: Handle group names with special chars
898 o Ralph Boehme <slow@samba.org>
899 * BUG 14293: Add missing check for DMAPI offline status in async DOS
901 * BUG 14295: Starting ctdb node that was powered off hard before results in
903 * BUG 14307: smbd: Ignore set NTACL requests which contain S-1-5-88 NFS ACEs.
904 * BUG 14316: vfs_recycle: Prevent flooding the log if we're called on
907 o Günther Deschner <gd@samba.org>
908 * BUG 14313: librpc: Fix IDL for svcctl_ChangeServiceConfigW.
909 * BUG 14327: nsswitch: Fix use-after-free causing segfault in
912 o Art M. Gallagher <repos@artmg.net>
913 * BUG 13622: fruit:time machine max size is broken on arm.
915 o Amitay Isaacs <amitay@gmail.com>
916 * BUG 14294: CTDB recovery corner cases can cause record resurrection and
919 o Noel Power <noel.power@suse.com>
920 * BUG 14332: s3/utils: Fix double free error with smbtree.
922 o Martin Schwenke <martin@meltin.net>
923 * BUG 14294: CTDB recovery corner cases can cause record resurrection and
925 * BUG 14295: Starting ctdb node that was powered off hard before results in
927 * BUG 14324: CTDB recovery daemon can crash due to dereference of NULL
931 #######################################
932 Reporting bugs & Development Discussion
933 #######################################
935 Please discuss this release on the samba-technical mailing list or by
936 joining the #samba-technical IRC channel on irc.freenode.net.
938 If you do report problems then please try to send high quality
939 feedback. If you don't provide vital information to help us track down
940 the problem then you will probably be ignored. All bug reports should
941 be filed under the Samba 4.1 and newer product in the project's Bugzilla
942 database (https://bugzilla.samba.org/).
945 ======================================================================
946 == Our Code, Our Bugs, Our Responsibility.
948 ======================================================================
951 ----------------------------------------------------------------------
954 ==============================
955 Release Notes for Samba 4.12.0
957 ==============================
960 This is the first stable release of the Samba 4.12 release series.
961 Please read the release notes carefully before upgrading.
970 Samba's minimum runtime requirement for python was raised to Python
971 3.4 with samba 4.11. Samba 4.12 raises this minimum version to Python
972 3.5 both to access new features and because this is the oldest version
973 we test with in our CI infrastructure.
975 (Build time support for the file server with Python 2.6 has not
978 Removing in-tree cryptography: GnuTLS 3.4.7 required
979 ----------------------------------------------------
981 Samba is making efforts to remove in-tree cryptographic functionality,
982 and to instead rely on externally maintained libraries. To this end,
983 Samba has chosen GnuTLS as our standard cryptographic provider.
985 Samba now requires GnuTLS 3.4.7 to be installed (including development
986 headers at build time) for all configurations, not just the Samba AD
989 Thanks to this work Samba no longer ships an in-tree DES
990 implementation and on GnuTLS 3.6.5 or later Samba will include no
991 in-tree cryptography other than the MD4 hash and that
992 implemented in our copy of Heimdal.
994 Using GnuTLS for SMB3 encryption you will notice huge performance and copy
995 speed improvements. Tests with the CIFS Kernel client from Linux Kernel 5.3
996 show a 3x speed improvement for writing and a 2.5x speed improvement for reads!
998 NOTE WELL: The use of GnuTLS means that Samba will honour the
999 system-wide 'FIPS mode' (a reference to the US FIPS-140 cryptographic
1000 standard) and so will not operate in many still common situations if
1001 this system-wide parameter is in effect, as many of our protocols rely
1002 on outdated cryptography.
1004 A future Samba version will mitigate this to some extent where good
1005 cryptography effectively wraps bad cryptography, but for now that above
1008 zlib library is now required to build Samba
1009 -------------------------------------------
1011 Samba no longer includes a local copy of zlib in our source tarball.
1012 By removing this we do not need to ship (even where we did not
1013 build) the old, broken zip encryption code found there.
1015 New Spotlight backend for Elasticsearch
1016 ---------------------------------------
1018 Support for the macOS specific Spotlight search protocol has been enhanced
1019 significantly. Starting with 4.12 Samba supports using Elasticsearch as search
1020 backend. Various new parameters have been added to configure this:
1022 spotlight backend = noindex | elasticsearch | tracker
1023 elasticsearch:address = ADDRESS
1024 elasticsearch:port = PORT
1025 elasticsearch:use tls = BOOLEAN
1026 elasticsearch:index = INDEXNAME
1027 elasticsearch:mappings = PATH
1028 elasticsearch:max results = NUMBER
1030 Samba also ships a Spotlight client command "mdfind" which can be used to search
1031 any SMB server that runs the Spotlight RPC service. See the manpage of mdfind
1034 Note that when upgrading existing installations that are using the previous
1035 default Spotlight backend Gnome Tracker must explicitly set "spotlight backend =
1036 tracker" as the new default is "noindex".
1038 'net ads kerberos pac save' and 'net eventlog export'
1039 -----------------------------------------------------
1041 The 'net ads kerberos pac save' and 'net eventlog export' tools will
1042 no longer silently overwrite an existing file during data export. If
1043 the filename given exits, an error will be shown.
1048 A large number of fuzz targets have been added to Samba, and Samba has
1049 been registered in Google's oss-fuzz cloud fuzzing service. In
1050 particular, we now have good fuzzing coverage of our generated NDR
1053 A large number of issues have been found and fixed thanks to this
1056 'samba-tool' improvements add contacts as member to groups
1057 ----------------------------------------------------------
1059 Previously 'samba-tool group addmemers' can just add users, groups and
1060 computers as members to groups. But also contacts can be members of
1061 groups. Samba 4.12 adds the functionality to add contacts to
1062 groups. Since contacts have no sAMAccountName, it's possible that
1063 there are more than one contact with the same name in different
1064 organizational units. Therefore it's necessary to have an option to
1065 handle group members by their DN.
1067 To get the DN of an object there is now the "--full-dn" option available
1068 for all necessary commands.
1070 The MS Windows UI allows to search for specific types of group members
1071 when searching for new members for a group. This feature is included
1072 here with the new samba-tool group addmembers "--object-type=OBJECTYPE"
1073 option. The different types are selected accordingly to the Windows
1074 UI. The default samba-toole behaviour shouldn't be changed.
1076 Allow filtering by OU or subtree in samba-tool
1077 ----------------------------------------------
1079 A new "--base-dn" and "--member-base-dn" option is added to relevant
1080 samba-tool user, group and ou management commands to allow operation
1081 on just one part of the AD tree, such as a single OU.
1089 Samba now uses a sentinel value based on utimensat(2) UTIME_OMIT to denote
1090 to-be-ignored timestamp variables passed to the SMB_VFS_NTIMES() VFS function.
1092 VFS modules can check whether any of the time values inside a struct
1093 smb_file_time is to be ignored by calling is_omit_timespec() on the value.
1095 'io_uring' vfs module
1096 ---------------------
1098 The module makes use of the new io_uring infrastructure
1099 (intruduced in Linux 5.1), see https://lwn.net/Articles/776703/
1101 Currently this implements SMB_VFS_{PREAD,PWRITE,FSYNC}_SEND/RECV
1102 and avoids the overhead of the userspace threadpool in the default
1103 vfs backend. See also vfs_io_uring(8).
1105 In order to build the module you need the liburing userspace library
1106 and its developement headers installed, see
1107 https://git.kernel.dk/cgit/liburing/
1109 At runtime you'll need a Linux kernel with version 5.1 or higher.
1110 Note that 5.4.14 and 5.4.15 have a regression that breaks the Samba
1111 module! The regression was fixed in Linux 5.4.16 again.
1113 MS-DFS changes in the VFS
1114 -------------------------
1116 This release changes set getting and setting of MS-DFS redirects
1117 on the filesystem to go through two new VFS functions:
1119 SMB_VFS_CREATE_DFS_PATHAT()
1120 SMB_VFS_READ_DFS_PATHAT()
1122 instead of smbd explicitly storing MS-DFS redirects inside
1123 symbolic links on the filesystem. The underlying default
1124 implementations of this has not changed, the redirects are
1125 still stored inside symbolic links on the filesystem, but
1126 moving the creation and reading of these links into the VFS
1127 as first-class functions now allows alternate methods of
1128 storing them (maybe in extended attributes) for OEMs who
1129 don't want to mis-use filesystem symbolic links in this
1136 * The ctdb_mutex_fcntl_helper periodically re-checks the lock file
1138 The re-check period is specified using a 2nd argument to this
1139 helper. The default re-check period is 5s.
1141 If the file no longer exists or the inode number changes then the
1142 helper exits. This triggers an election.
1148 The smb.conf parameter "write cache size" has been removed.
1150 Since the in-memory write caching code was written, our write path has
1151 changed significantly. In particular we have gained very flexible
1152 support for async I/O, with the new linux io_uring interface in
1153 development. The old write cache concept which cached data in main
1154 memory followed by a blocking pwrite no longer gives any improvement
1155 on modern systems, and may make performance worse on memory-contrained
1156 systems, so this functionality should not be enabled in core smbd
1159 In addition, it complicated the write code, which is a performance
1162 If required for specialist purposes, it can be recreated as a VFS
1165 Retiring DES encryption types in Kerberos.
1166 ------------------------------------------
1167 With this release, support for DES encryption types has been removed from
1168 Samba, and setting DES_ONLY flag for an account will cause Kerberos
1169 authentication to fail for that account (see RFC-6649).
1171 Samba-DC: DES keys no longer saved in DB.
1172 -----------------------------------------
1173 When a new password is set for an account, Samba DC will store random keys
1174 in DB instead of DES keys derived from the password. If the account is being
1175 migrated to Windbows or to an older version of Samba in order to use DES keys,
1176 the password must be reset to make it work.
1178 Heimdal-DC: removal of weak-crypto.
1179 -----------------------------------
1180 Following removal of DES encryption types from Samba, the embedded Heimdal
1181 build has been updated to not compile weak crypto code (HEIM_WEAK_CRYPTO).
1183 vfs_netatalk: The netatalk VFS module has been removed.
1184 -------------------------------------------------------
1186 The netatalk VFS module has been removed. It was unmaintained and is not needed
1189 BIND9_FLATFILE deprecated
1190 -------------------------
1192 The BIND9_FLATFILE DNS backend is deprecated in this release and will
1193 be removed in the future. This was only practically useful on a single
1194 domain controller or under expert care and supervision.
1196 This release removes the 'rndc command' smb.conf parameter, which
1197 supported this configuration by writing out a list of DCs permitted to
1198 make changes to the DNS Zone and nudging the 'named' server if a new
1199 DC was added to the domain. Administrators using BIND9_FLATFILE will
1200 need to maintain this manually from now on.
1206 Parameter Name Description Default
1207 -------------- ----------- -------
1209 elasticsearch:address New localhost
1210 elasticsearch:port New 9200
1211 elasticsearch:use tls New No
1212 elasticsearch:index New _all
1213 elasticsearch:mappings New DATADIR/elasticsearch_mappings.json
1214 elasticsearch:max results New 100
1215 nfs4:acedup Changed default merge
1216 rndc command Removed
1217 write cache size Removed
1218 spotlight backend New noindex
1221 CHANGES SINCE 4.12.0rc4
1222 =======================
1224 o Andrew Bartlett <abartlet@samba.org>
1225 * BUG 14258: dsdb: Correctly handle memory in objectclass_attrs.
1228 CHANGES SINCE 4.12.0rc3
1229 =======================
1231 o Jeremy Allison <jra@samba.org>
1232 * BUG 14269: s3: DFS: Don't allow link deletion on a read-only share.
1234 o Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
1235 * BUG 14284: pidl/wscript: configure should insist on Parse::Yapp::Driver.
1237 o Andrew Bartlett <abartlet@samba.org>
1238 * BUG 14270: ldb: Fix search with scope ONE and small result sets.
1239 * BUG 14284: build: Do not check if system perl modules should be bundled.
1241 o Volker Lendecke <vl@samba.org>
1242 * BUG 14285: smbd fails to handle EINTR from open(2) properly.
1244 o Stefan Metzmacher <metze@samba.org>
1245 * BUG 14270: ldb: version 2.1.1.
1248 CHANGES SINCE 4.12.0rc2
1249 =======================
1251 o Jeremy Allison <jra@samba.org>
1252 * BUG 14282: Set getting and setting of MS-DFS redirects on the filesystem
1253 to go through two new VFS functions SMB_VFS_CREATE_DFS_PATHAT() and
1254 SMB_VFS_READ_DFS_PATHAT().
1256 o Andrew Bartlett <abartlet@samba.org>
1257 * BUG 14255: bootstrap: Remove un-used dependency python3-crypto.
1259 o Volker Lendecke <vl@samba.org>
1260 * BUG 14247: Fix CID 1458418 and 1458420.
1261 * BUG 14281: lib: Fix a shutdown crash with "clustering = yes".
1263 o Stefan Metzmacher <metze@samba.org>
1264 * BUG 14247: Winbind member (source3) fails local SAM auth with empty domain
1266 * BUG 14265: winbindd: Handle missing idmap in getgrgid().
1267 * BUG 14271: Don't use forward declaration for GnuTLS typedefs.
1268 * BUG 14280: Add io_uring vfs module.
1270 o Andreas Schneider <asn@samba.org>
1271 * BUG 14250: libcli:smb: Improve check for gnutls_aead_cipher_(en|de)cryptv2.
1274 CHANGES SINCE 4.12.0rc1
1275 =======================
1277 o Jeremy Allison <jra@samba.org>
1278 * BUG 14239: s3: lib: nmblib. Clean up and harden nmb packet processing.
1280 o Andreas Schneider <asn@samba.org>
1281 * BUG 14253: lib:util: Log mkdir error on correct debug levels.
1287 https://wiki.samba.org/index.php/Release_Planning_for_Samba_4.12#Release_blocking_bugs
1290 #######################################
1291 Reporting bugs & Development Discussion
1292 #######################################
1294 Please discuss this release on the samba-technical mailing list or by
1295 joining the #samba-technical IRC channel on irc.freenode.net.
1297 If you do report problems then please try to send high quality
1298 feedback. If you don't provide vital information to help us track down
1299 the problem then you will probably be ignored. All bug reports should
1300 be filed under the Samba 4.1 and newer product in the project's Bugzilla
1301 database (https://bugzilla.samba.org/).
1304 ======================================================================
1305 == Our Code, Our Bugs, Our Responsibility.
1307 ======================================================================