[SCM] Samba Shared Repository - branch v4-8-test updated

Karolin Seeger kseeger at samba.org
Thu Mar 1 20:17:01 UTC 2018


The branch, v4-8-test has been updated
       via  efaf354 VERSION: Bump version up to 4.8.0rc5...
       via  562b385 VERSION: Disable GIT_SNAPSHOT for the 4.8.0rc4 release.
       via  9d4ae41 WHATSNEW: Add changes since rc4.
       via  0486f44 WHATSNEW: document changed wbinfo -m --verbose output
       via  c76d2e0 WHATSNEW: add 'Improved support for trusted domains (as AD DC)' section
       via  608d1b81f WHATSNEW: reference 'smbclient reparse point symlink parameters reversed' to 'UPGRADING'
       via  44685eb WHATSNEW: move descriptions of removed features to "REMOVED FEATURES"
      from  4cfa1f5 s4:kdc: disable support for CROSS_ORGANIZATION domains

https://git.samba.org/?p=samba.git;a=shortlog;h=v4-8-test


- Log -----------------------------------------------------------------
commit efaf354f9e4e793cee72a9ca773189d4957d9a41
Author: Karolin Seeger <kseeger at samba.org>
Date:   Thu Mar 1 21:03:53 2018 +0100

    VERSION: Bump version up to 4.8.0rc5...
    
    and re-enable GIT_SNAPSHOT.
    
    Signed-off-by: Karolin Seeger <kseeger at samba.org>

commit 562b385756409568c224098aa20b4bf808c3bafb
Author: Karolin Seeger <kseeger at samba.org>
Date:   Thu Mar 1 21:02:59 2018 +0100

    VERSION: Disable GIT_SNAPSHOT for the 4.8.0rc4 release.
    
    Signed-off-by: Karolin Seeger <kseeger at samba.org>

commit 9d4ae41fc5052e8074b1f59139813e58ded137bc
Author: Karolin Seeger <kseeger at samba.org>
Date:   Thu Mar 1 21:02:15 2018 +0100

    WHATSNEW: Add changes since rc4.
    
    Signed-off-by: Karolin Seeger <kseeger at samba.org>

commit 0486f44b76cbcaf3f843cb4d6e0d0003e87d6781
Author: Ralph Boehme <slow at samba.org>
Date:   Thu Mar 1 12:10:56 2018 +0100

    WHATSNEW: document changed wbinfo -m --verbose output
    
    Signed-off-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Stefan Metzmacher <metze at samba.org>

commit c76d2e06fd1e9d71cedcc297a6db0cffb71ee64c
Author: Stefan Metzmacher <metze at samba.org>
Date:   Thu Mar 1 09:52:51 2018 +0100

    WHATSNEW: add 'Improved support for trusted domains (as AD DC)' section
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>
    Reviewed-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Andreas Schneider <asn at samba.org>

commit 608d1b81fa2b013c6e62807536190f4d14eb0911
Author: Stefan Metzmacher <metze at samba.org>
Date:   Thu Mar 1 09:32:23 2018 +0100

    WHATSNEW: reference 'smbclient reparse point symlink parameters reversed' to 'UPGRADING'
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>
    Reviewed-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Andreas Schneider <asn at samba.org>

commit 44685eb99a1d700911d9ed5b23737d8f4e2edae9
Author: Stefan Metzmacher <metze at samba.org>
Date:   Thu Mar 1 09:31:17 2018 +0100

    WHATSNEW: move descriptions of removed features to "REMOVED FEATURES"
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>
    Reviewed-by: Ralph Boehme <slow at samba.org>
    Reviewed-by: Andreas Schneider <asn at samba.org>

-----------------------------------------------------------------------

Summary of changes:
 VERSION      |   2 +-
 WHATSNEW.txt | 195 +++++++++++++++++++++++++++++++++++++++++++++++++----------
 2 files changed, 164 insertions(+), 33 deletions(-)


Changeset truncated at 500 lines:

diff --git a/VERSION b/VERSION
index 30de02c..8720a82 100644
--- a/VERSION
+++ b/VERSION
@@ -87,7 +87,7 @@ SAMBA_VERSION_PRE_RELEASE=
 # e.g. SAMBA_VERSION_RC_RELEASE=1                      #
 #  ->  "3.0.0rc1"                                      #
 ########################################################
-SAMBA_VERSION_RC_RELEASE=4
+SAMBA_VERSION_RC_RELEASE=5
 
 ########################################################
 # To mark SVN snapshots this should be set to 'yes'    #
diff --git a/WHATSNEW.txt b/WHATSNEW.txt
index 357a8f6..5151564 100644
--- a/WHATSNEW.txt
+++ b/WHATSNEW.txt
@@ -1,7 +1,7 @@
 Release Announcements
 =====================
 
-This is the third release candidate of Samba 4.8.  This is *not*
+This is the fourth release candidate of Samba 4.8.  This is *not*
 intended for production environments and is designed for testing
 purposes only.  Please report any defects via the Samba bug reporting
 system at https://bugzilla.samba.org/.
@@ -22,6 +22,16 @@ Unlike in previous releases a transparent downgrade is not possible.
 If you wish to downgrade such a DB to a Samba 4.7 or earlier version,
 please run the source4/scripting/bin/sambaundoguididx script first.
 
+smbclient reparse point symlink parameters reversed
+---------------------------------------------------
+
+See the more detailed description below.
+
+Changed trusted domains listing with wbinfo -m --verbose
+--------------------------------------------------------
+
+See the more detailed description below.
+
 NEW FEATURES/CHANGES
 ====================
 
@@ -133,37 +143,6 @@ dot or xdot, this shows the network as a graph with DCs as vertices
 and connections edges. Certain types of degenerate edges are shown in
 different colours or line-styles.
 
-NT4-style replication based net commands removed
-------------------------------------------------
-
-The following commands and sub-commands have been removed from the
-"net" utility:
-
-net rpc samdump
-net rpc vampire ldif
-
-Also, replicating from a real NT4 domain with "net rpc vampire" and
-"net rpc vampire keytab" has been removed.
-
-The NT4-based commands were accidentially broken in 2013, and nobody
-noticed the breakage. So instead of fixing them including tests (which
-would have meant writing a server for the protocols, which we don't
-have) we decided to remove them.
-
-For the same reason, the "samsync", "samdeltas" and "database_redo"
-commands have been removed from rpcclient.
-
-"net rpc vampire keytab" from Active Directory domains continues to be
-supported.
-
-vfs_aio_linux module removed
-----------------------------
-
-The current Linux kernel aio does not match what Samba would
-do. Shipping code that uses it leads people to false
-assumptions. Samba implements async I/O based on threads by default,
-there is no special module required to see benefits of read and write
-request being sent do the disk in parallel.
 
 smbclient reparse point symlink parameters reversed
 ---------------------------------------------------
@@ -192,6 +171,74 @@ domains. Some pam_winbind setups may also require the global list.
 If you have a setup that doesn't require the global list, you should set
 "winbind scan trusted domains = no".
 
+Improved support for trusted domains (as AD DC)
+-----------------------------------------------
+
+The support for trusted domains/forests has improved a lot.
+
+External domain trusts, as well a transitive forest trusts,
+are supported in both directions (inbound and outbound)
+for Kerberos and NTLM authentication now.
+
+The LSA LookupNames and LookupSids implementations
+support resolving names and sids from trusts domains/forest
+now. This is important in order to allow Samba based
+domain members to make use of the trust.
+
+However there are currently still a few limitations:
+
+- It's not possible to add users/groups of a trusted domain
+  into domain groups. So group memberships are not expanded
+  on trust boundaries.
+  See https://bugzilla.samba.org/show_bug.cgi?id=13300
+- Both sides of the trust need to fully trust each other!
+- No SID filtering rules are applied at all!
+- This means DCs of domain A can grant domain admin rights
+  in domain B.
+- Selective (CROSS_ORIGANIZATION) authentication is
+  not supported. It's possible to create such a trust,
+  but the KDC and winbindd ignore them.
+
+Changed trusted domains listing with wbinfo -m --verbose
+--------------------------------------------------------
+
+The trust properties printed by wbinfo -m --verbose have been changed to
+correctly reflect the view of the system where wbinfo is executed.
+
+The trust type field in particular can show additional values that correctly
+reflect the type of the trust: "Local" for the local SAM and BUILTIN,
+"Workstation" for a workstation trust to the primary domain, "RWDC" for the SAM
+on a AD DC, "RODC" for the SAM on a read-only DC, "PDC" for the SAM on a
+NT4-style DC, "Forest" for a AD forest trust and "External" for quarantined,
+external or NT4-style trusts.
+
+Indirect trusts are shown as "Routed" including the routing domain.
+
+Example, on a AD DC (SDOM1):
+
+Domain Name DNS Domain          Trust Type  Transitive  In   Out
+BUILTIN                         Local
+SDOM1       sdom1.site          RWDC
+WDOM3       wdom3.site          Forest      Yes         No   Yes
+WDOM2       wdom2.site          Forest      Yes         Yes  Yes
+SUBDOM31    subdom31.wdom3.site Routed (via WDOM3)
+SUBDOM21    subdom21.wdom2.site Routed (via WDOM2)
+
+Same setup, on a member of WDOM2:
+
+Domain Name DNS Domain          Trust Type  Transitive  In   Out
+BUILTIN                         Local
+TITAN                           Local
+WDOM2       wdom2.site          Workstation Yes         No   Yes
+WDOM1       wdom1.site          Routed (via WDOM2)
+WDOM3       wdom3.site          Routed (via WDOM2)
+SUBDOM21    subdom21.wdom2.site Routed (via WDOM2)
+SDOM1       sdom1.site          Routed (via WDOM2)
+SUBDOM11    subdom11.wdom1.site Routed (via WDOM2)
+
+The list of trusts may be incomplete and additional domains may appear as
+"Routed" if a user of an unknown domain is successfully authenticated.
+
 VirusFilter VFS module
 ----------------------
 
@@ -202,6 +249,9 @@ software to provide scanning and filtering of files on a Samba share.
 REMOVED FEATURES
 ================
 
+'net serverid' commands removed
+-------------------------------
+
 The two commands 'net serverid list' and 'net serverid wipe' have been
 removed, because the file serverid.tdb is not used anymore.
 
@@ -216,6 +266,38 @@ properly cleaned up after single node crashes. Nowadays smbd and
 winbind take care of cleaning up the msg.lock and msg.sock directories
 automatically.
 
+NT4-style replication based net commands removed
+------------------------------------------------
+
+The following commands and sub-commands have been removed from the
+"net" utility:
+
+net rpc samdump
+net rpc vampire ldif
+
+Also, replicating from a real NT4 domain with "net rpc vampire" and
+"net rpc vampire keytab" has been removed.
+
+The NT4-based commands were accidentally broken in 2013, and nobody
+noticed the breakage. So instead of fixing them including tests (which
+would have meant writing a server for the protocols, which we don't
+have) we decided to remove them.
+
+For the same reason, the "samsync", "samdeltas" and "database_redo"
+commands have been removed from rpcclient.
+
+"net rpc vampire keytab" from Active Directory domains continues to be
+supported.
+
+vfs_aio_linux module removed
+----------------------------
+
+The current Linux kernel aio does not match what Samba would
+do. Shipping code that uses it leads people to false
+assumptions. Samba implements async I/O based on threads by default,
+there is no special module required to see benefits of read and write
+request being sent do the disk in parallel.
+
 
 smb.conf changes
 ================
@@ -243,6 +325,55 @@ smb.conf changes
   winbind trusted domains only       Removed
 
 
+CHANGES SINCE 4.8.0rc3
+======================
+
+o  Ralph Boehme <slow at samba.org>
+   * BUG 13287: Fix numerous trust related bugs in winbindd and s4 LSA RPC
+     server.
+   * BUG 13296: vfs_fruit: Use off_t, not size_t for TM size calculations.
+
+o  Alexander Bokovoy <ab at samba.org>
+   * BUG 13304: mit-kdb: Support MIT Kerberos 1.16 KDB API changes.
+
+o  G√ľnther Deschner <gd at samba.org>
+   * BUG 13277: build: Fix libceph-common detection.
+
+o  Poornima G <pgurusid at redhat.com>
+   * BUG 13297: vfs_glusterfs: Fix the wrong pointer being sent in
+     glfs_fsync_async.
+
+o  Volker Lendecke <vl at samba.org>
+   * BUG 13305: vfs_fileid: Fix the 32-bit build.
+
+o  Stefan Metzmacher <metze at samba.org>
+   * BUG 13206: Unable to authenticate with an empty string domain ''.
+   * BUG 13276: configure aborts without libnettle/gnutls.
+   * BUG 13278: winbindd (on an AD DC) should only use netlogon/lsa against
+     trusted domains.
+   * BUG 13287: Fix numerous trust related bugs in winbindd and s4 LSA RPC
+     server.
+   * BUG 13290: A disconnecting winbind client can cause a problem in 
+     the winbind parent child communication.
+   * BUG 13291: tevent: version 0.9.36.
+   * BUG 13292: winbind requests could get stuck in the queue of a busy child,
+     while later requests could get served fine by other children.
+   * BUG 13293: Minimize the lifetime of winbindd_cli_state->{pw,gr}ent_state.
+   * BUG 13294: Avoid using fstrcpy(domain->dcname,...) on a char *.
+   * BUG 13295: winbind parent should find the dc of a foreign domain via the
+     primary domain.
+   * BUG 13299: Disable support for CROSS_ORGANIZATION domains.
+   * BUG 13306: ldb: version 1.3.2.
+
+o  Sachin Prabhu <sprabhu at redhat.com>
+   * BUG 13303: vfs_glusterfs: Add fallocate support for vfs_glusterfs.
+
+o  Garming Sam <garming at catalyst.net.nz>
+   * BUG 13031: subnet: Avoid a segfault when renaming subnet objects.
+   * BUG 13269: RODC may skip objects during replication due to naming
+     conflicts.
+
+
 CHANGES SINCE 4.8.0rc2
 ======================
 


-- 
Samba Shared Repository



More information about the samba-cvs mailing list