CVS commit: [pkgsrc-2026Q2] pkgsrc/net/samba4

"Maya Rashish" <[email protected]> Wed, 5 Aug 2026 14:54:59 +0000
Newsgroups gmane.os.netbsd.devel.pkgsrc.cvs
Message-ID <[email protected]> 
Module Name:	pkgsrc
Committed By:	maya
Date:		Wed Aug  5 14:54:59 UTC 2026

Modified Files:
	pkgsrc/net/samba4 [pkgsrc-2026Q2]: Makefile distinfo
	pkgsrc/net/samba4/patches [pkgsrc-2026Q2]:
	    patch-buildtools_wafsamba_wscript patch-lib_util_util__crypt.c
Added Files:
	pkgsrc/net/samba4/patches [pkgsrc-2026Q2]:
	    patch-source4_torture_local_nss__tests.c

Log Message:
Pullup ticket #7216 - requested by taca
net/samba4: Security fix

Revisions pulled up:
- net/samba4/Makefile                                           1.219-1.220
- net/samba4/distinfo                                           1.127-1.129
- net/samba4/patches/patch-buildtools_wafsamba_wscript          1.4
- net/samba4/patches/patch-lib_util_util__crypt.c               1.4
- net/samba4/patches/patch-source4_torture_local_nss__tests.c   1.3

---
   Module Name:	pkgsrc
   Committed By:	adam
   Date:		Wed Jul  1 07:27:25 UTC 2026

   Modified Files:
   	pkgsrc/net/samba4: Makefile distinfo

   Log Message:
   samba4: updated to 4.24.4

   Changes since 4.24.3

   o  Volker Lendecke <[email protected]>
      * BUG 16095: Use-after-free in handling acls with claims and conditions

   o  Gary Lockyer <[email protected]>
      * BUG 16092: Compilers may ignore overflow checks - Fix tautological-compare
        warnings

   o  Stefan Metzmacher <[email protected]>
      * BUG 14638: restrict anonymous = 2 breaks RODC functionality
      * BUG 16006: warning: assignment discards 'const' qualifier from pointer
        target type [-Wdiscarded-qualifiers]
      * BUG 16067: Require NTLMv2 session security on Windows makes trusts to Samba
        unusable
      * BUG 16092: Compilers may ignore overflow checks - Fix tautological-compare
        warnings
      * BUG 16151: winbindd stuck in init_dc_connection_rpc() returning
        NT_STATUS_TRUSTED_DOMAIN_FAILURE

   o  Andreas Schneider <[email protected]>
      * BUG 16006: warning: assignment discards 'const' qualifier from pointer
        target type [-Wdiscarded-qualifiers]
      * BUG 16149: domain\user not split when provided as username in
        smbc_set_credentials_with_fallback()

---
   Module Name:	pkgsrc
   Committed By:	jperkin
   Date:		Wed Jul 29 17:22:49 UTC 2026

   Modified Files:
   	pkgsrc/net/samba4: distinfo
   	pkgsrc/net/samba4/patches: patch-buildtools_wafsamba_wscript
   Added Files:
   	pkgsrc/net/samba4/patches: patch-source4_torture_local_nss__tests.c

   Log Message:
   samba4: Additional SunOS build fixes.

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Thu Jul 30 15:37:00 UTC 2026

   Modified Files:
   	pkgsrc/net/samba4: Makefile distinfo
   	pkgsrc/net/samba4/patches: patch-lib_util_util__crypt.c

   Log Message:
   net/samba4: update to 4.24.5

   pkgsrc change:

   * remove pkglint warnings of patches/patch-lib_util_util__crypt.c

                      ==============================
                      Release Notes for Samba 4.24.5
                              July 28, 2026
                      ==============================

   This is a security release in order to address the following defects:

   o CVE-2026-6949:   TSIG packet with name compression can crash DNS

                      Incorrect size calculations when a TSIG record contains
                      compressed names can lead to a large out-of-bounds write
                      causing the server to crash.

                      https://www.samba.org/samba/security/CVE-2026-6949.html

   o CVE-2026-58216:  An authenticated user could possibly crash a KDC process

                      A kpasswd packet that contains malformed ASN.1 might cause
                      the server to access 6 bytes of unallocated memory. This
                      memory is not exposed to the user, but in some
                      circumstances the server could crash.

                      https://www.samba.org/samba/security/CVE-2026-58216.html

   o CVE-2026-58218:  DNS signing DoS via TKEY name cache exhaustion

                      An unauthenticated user can repeatedly register names TKEY
                      names, which floods a cache causing legitimate TKEYs to be
                      expunged. This can practically block the use DNS TSIG
                      signing.

                      https://www.samba.org/samba/security/CVE-2026-58218.html

   o CVE-2026-58221:  Samba AD authenticated LDAP access domain takeover

                      Samba AD low-privilege authenticated LDAP access allows
                      modifications to internal LDB special DNs, which permits a
                      domain takeover.

                      https://www.samba.org/samba/security/CVE-2026-58221.html

   o CVE-2026-58222:  Samba AD LDAP Compare filter injection and trusted-request
                      confusion disclose protected attributes

                      An ordinary authenticated domain user can bypass access
                      checks and query confidential Active Directory attributes
                      (such as KDS root keys) via LDAP Compare requests. Due to a
                      filter injection flaw and trusted execution context, the
                      LDAP Compare operation can be turned into a
                      protected-attribute disclosure oracle.

                      https://www.samba.org/samba/security/CVE-2026-58222.html

   o CVE-2026-58224   The CTDB protocol has bounds checking issues

                      CTDB fails to do integrity checking of received packets.
                      This includes failure to check field lengths against packet
                      lengths when unmarshalling packets.

                      https://www.samba.org/samba/security/CVE-2026-58224.html

   Changes since 4.24.4
   --------------------

   o  Douglas Bagnall <[email protected]>
      * BUG 16087: CVE-2026-58216

   o  Volker Lendecke <[email protected]>
      * BUG 16115: CVE-2026-58218

   o  Stefan Metzmacher <[email protected]>
      * BUG 16083: CVE-2026-6949
      * BUG 16147: CVE-2026-58221
      * BUG 16148: CVE-2026-58222

   o  Martin Schwenke <[email protected]>
      * BUG 16085: CVE-2026-58224


To generate a diff of this commit:
cvs rdiff -u -r1.218 -r1.218.2.1 pkgsrc/net/samba4/Makefile
cvs rdiff -u -r1.126 -r1.126.2.1 pkgsrc/net/samba4/distinfo
cvs rdiff -u -r1.3 -r1.3.54.1 \
    pkgsrc/net/samba4/patches/patch-buildtools_wafsamba_wscript
cvs rdiff -u -r1.3 -r1.3.2.1 \
    pkgsrc/net/samba4/patches/patch-lib_util_util__crypt.c
cvs rdiff -u -r0 -r1.3.2.2 \
    pkgsrc/net/samba4/patches/patch-source4_torture_local_nss__tests.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
(unnamed) (text/x-diff, 7.7 KB) 
Modified files:

Index: pkgsrc/net/samba4/Makefile
diff -u pkgsrc/net/samba4/Makefile:1.218 pkgsrc/net/samba4/Makefile:1.218.2.1
--- pkgsrc/net/samba4/Makefile:1.218	Thu Jun 11 07:21:25 2026
+++ pkgsrc/net/samba4/Makefile	Wed Aug  5 14:54:59 2026
@@ -1,8 +1,7 @@
-# $NetBSD: Makefile,v 1.218 2026/06/11 07:21:25 wiz Exp $
+# $NetBSD: Makefile,v 1.218.2.1 2026/08/05 14:54:59 maya Exp $
 
 # XXX: Fails to build when mit-krb5 is installed.
-DISTNAME=	samba-4.24.3
-PKGREVISION=	1
+DISTNAME=	samba-4.24.5
 CATEGORIES=	net
 MASTER_SITES=	https://download.samba.org/pub/samba/stable/
 

Index: pkgsrc/net/samba4/distinfo
diff -u pkgsrc/net/samba4/distinfo:1.126 pkgsrc/net/samba4/distinfo:1.126.2.1
--- pkgsrc/net/samba4/distinfo:1.126	Wed May 27 06:06:20 2026
+++ pkgsrc/net/samba4/distinfo	Wed Aug  5 14:54:59 2026
@@ -1,13 +1,13 @@
-$NetBSD: distinfo,v 1.126 2026/05/27 06:06:20 adam Exp $
+$NetBSD: distinfo,v 1.126.2.1 2026/08/05 14:54:59 maya Exp $
 
-BLAKE2s (samba-4.24.3.tar.gz) = 41e24d03c7d01d9ed00d99efd6d51c5c161bc148e0bd0ce8e14e5f5e1083bb68
-SHA512 (samba-4.24.3.tar.gz) = 769445f861bfd978bc8eccc53135c03d94b5e2b402f45df8c3ae202999d6f8e35a2a78bb4bada34f09cf177cfe8be4013ffd6da8d311cf6a7ff2a4a8222c6b4f
-Size (samba-4.24.3.tar.gz) = 43446520 bytes
+BLAKE2s (samba-4.24.5.tar.gz) = 77d982003d1cbeb4ab0c7e61869fd11718d37571223d38b4812312481b076687
+SHA512 (samba-4.24.5.tar.gz) = dadaee50c61cc8076bd5f4e6e3a8be13b6aa6aeff33991277c7f5398ba9dea32e8d966c0206dec9cad240b935768b707f9c9dd6b60c3db433dcf8ddb30134088
+Size (samba-4.24.5.tar.gz) = 43445051 bytes
 SHA1 (patch-buildtools_wafsamba_samba__conftests.py) = d927db17124d2bb5b382885e70a41f84c3929926
 SHA1 (patch-buildtools_wafsamba_samba__install.py) = d801340617da325e3bb70a90350e45cc8e383c2d
 SHA1 (patch-buildtools_wafsamba_samba__pidl.py) = b9015694b80c0e6382d75c806fd6e0eb92e5f998
 SHA1 (patch-buildtools_wafsamba_samba__utils.py) = 0a587421870c1974175fadbb02dde215f35938f2
-SHA1 (patch-buildtools_wafsamba_wscript) = 0ca4c3a9d2e07f9165784e495f6f6b2b21db2758
+SHA1 (patch-buildtools_wafsamba_wscript) = e39a904e7bbb129e3ba497d61cea0b317ac907c3
 SHA1 (patch-dynconfig_wscript) = 1858e5fcca913f21aa3e7868d9760b9c40c9f5c4
 SHA1 (patch-lib_param_loadparm.h) = 0216b69d33d1e17260a446e11bee764116c52b18
 SHA1 (patch-lib_pthreadpool_pthreadpool.c) = 4b0c3d49d578b5ab12f5bad1ebeb50efb43e756c
@@ -21,7 +21,7 @@ SHA1 (patch-lib_util_charset_charset__ma
 SHA1 (patch-lib_util_smb__threads.h) = 817591a2b69f31ac29497a2006fe21f0b4b0aaea
 SHA1 (patch-lib_util_tfork.c) = a9acb5561c5bba76450c48904a22019c8b14cbec
 SHA1 (patch-lib_util_time.h) = 5048614e301cf6922ff7fa6693fa58bfe17ff10e
-SHA1 (patch-lib_util_util__crypt.c) = 1cd30f2bad4d469745a7e2ca146c591c8ecfec96
+SHA1 (patch-lib_util_util__crypt.c) = 476e5f501df0b87096a145005480980752109225
 SHA1 (patch-libcli_dns_wscript__build) = 4103a144aa1bb4662fd7a62270941f1a3d01fe89
 SHA1 (patch-nsswitch_stress-nss-libwbclient.c) = c546f00184b0d22b6c150e210962cdfc6fc12df2
 SHA1 (patch-nsswitch_winbind__nss__netbsd.c) = 1214bfbd7714b64f3ff3eb97b6f24e3d2629370f
@@ -40,6 +40,7 @@ SHA1 (patch-source3_utils_net__offlinejo
 SHA1 (patch-source4_auth_gensec_wscript__build) = 01f3cdf787833e05f2e0b49ff0af7c8bbad2c161
 SHA1 (patch-source4_dsdb_samdb_ldb__modules_wscript__build__server) = 47f55ec16b667a0a4d38de5ac89a117f2ac8f898
 SHA1 (patch-source4_scripting_wscript__build) = aac6894d49f5c17a28d26cb627be8cef1902bb1e
+SHA1 (patch-source4_torture_local_nss__tests.c) = c68325fdd4f65532de60c1a40e9cbe4173ea1711
 SHA1 (patch-third__party_heimdal__build_roken.h) = 59d5523676fe8c0315e969247f26b4ea2f900402
 SHA1 (patch-third__party_heimdal_include_heim__threads.h) = 5ad13530cf9688e46f9ad487bb0fddab668c8276
 SHA1 (patch-third__party_heimdal_lib_hcrypto_evp.c) = 8e8e23198ef4afdc24a6930bd57aa5a898f1826f

Index: pkgsrc/net/samba4/patches/patch-buildtools_wafsamba_wscript
diff -u pkgsrc/net/samba4/patches/patch-buildtools_wafsamba_wscript:1.3 pkgsrc/net/samba4/patches/patch-buildtools_wafsamba_wscript:1.3.54.1
--- pkgsrc/net/samba4/patches/patch-buildtools_wafsamba_wscript:1.3	Sun Nov 10 17:01:58 2019
+++ pkgsrc/net/samba4/patches/patch-buildtools_wafsamba_wscript	Wed Aug  5 14:54:59 2026
@@ -1,16 +1,18 @@
-$NetBSD: patch-buildtools_wafsamba_wscript,v 1.3 2019/11/10 17:01:58 adam Exp $
+$NetBSD: patch-buildtools_wafsamba_wscript,v 1.3.54.1 2026/08/05 14:54:59 maya Exp $
 
 Define _POSIX_PTHREAD_SEMANTICS on SunOS to pick up re-entrant functions.
 
---- buildtools/wafsamba/wscript.orig	2019-07-09 10:08:41.000000000 +0000
+--- buildtools/wafsamba/wscript.orig	2026-01-20 15:42:53.850815000 +0000
 +++ buildtools/wafsamba/wscript
-@@ -458,6 +458,10 @@ def configure(conf):
+@@ -601,6 +601,12 @@ def configure(conf):
      if conf.CHECK_CFLAGS(['-D__STDC_WANT_LIB_EXT1__=1']):
          conf.ADD_CFLAGS('-D__STDC_WANT_LIB_EXT1__=1')
  
 +    # Use POSIX getpwnam_r and friends.
 +    if conf.env['SYSTEM_UNAME_SYSNAME'] == 'SunOS':
 +        conf.DEFINE('_POSIX_PTHREAD_SEMANTICS', 1, add_to_cflags=True)
++        conf.DEFINE('_XOPEN_SOURCE', 600, add_to_cflags=True)
++        conf.DEFINE('__EXTENSIONS__', 1, add_to_cflags=True)
 +
      # on Tru64 certain features are only available with _OSF_SOURCE set to 1
      # and _XOPEN_SOURCE set to 600

Index: pkgsrc/net/samba4/patches/patch-lib_util_util__crypt.c
diff -u pkgsrc/net/samba4/patches/patch-lib_util_util__crypt.c:1.3 pkgsrc/net/samba4/patches/patch-lib_util_util__crypt.c:1.3.2.1
--- pkgsrc/net/samba4/patches/patch-lib_util_util__crypt.c:1.3	Fri Apr 17 08:35:42 2026
+++ pkgsrc/net/samba4/patches/patch-lib_util_util__crypt.c	Wed Aug  5 14:54:59 2026
@@ -1,11 +1,11 @@
-$NetBSD: patch-lib_util_util__crypt.c,v 1.3 2026/04/17 08:35:42 adam Exp $
+$NetBSD: patch-lib_util_util__crypt.c,v 1.3.2.1 2026/08/05 14:54:59 maya Exp $
 
 Account for platforms that don't define ENOTRECOVERABLE, like NetBSD
 before 10.0.
 
 --- lib/util/util_crypt.c.orig	2025-02-17 15:48:20.606155400 +0000
 +++ lib/util/util_crypt.c
-@@ -62,7 +64,11 @@ static int crypt_as_best_we_can(TALLOC_C
+@@ -64,7 +64,11 @@ static int crypt_as_best_we_can(TALLOC_C
  	if (hash == NULL || hash[0] == '*') {
  		if (ret == 0) {
  			/* this is annoying */
@@ -17,7 +17,7 @@ before 10.0.
  		}
  	}
  	if (ret != 0) {
-@@ -107,7 +113,11 @@ char *talloc_crypt_errstring(TALLOC_CTX 
+@@ -109,7 +113,11 @@ char *talloc_crypt_errstring(TALLOC_CTX 
  			mem_ctx,
  			"Password exceeds maximum length allowed for crypt() hashing");
  	}

Added files:

Index: pkgsrc/net/samba4/patches/patch-source4_torture_local_nss__tests.c
diff -u /dev/null pkgsrc/net/samba4/patches/patch-source4_torture_local_nss__tests.c:1.3.2.2
--- /dev/null	Wed Aug  5 14:54:59 2026
+++ pkgsrc/net/samba4/patches/patch-source4_torture_local_nss__tests.c	Wed Aug  5 14:54:59 2026
@@ -0,0 +1,26 @@
+$NetBSD: patch-source4_torture_local_nss__tests.c,v 1.3.2.2 2026/08/05 14:54:59 maya Exp $
+
+Fix illumos getpwent_r/getgrent_r arguments.
+
+--- source4/torture/local/nss_tests.c.orig	2026-07-29 16:57:02.512027378 +0000
++++ source4/torture/local/nss_tests.c
+@@ -351,7 +351,8 @@ static bool test_enum_r_passwd(struct to
+ 		torture_comment(tctx, "Testing getpwent_r\n");
+ 
+ #ifdef SOLARIS_GETPWENT_R
+-		ret = getpwent_r(&pwd, buffer, sizeof(buffer));
++		pwdp = getpwent_r(&pwd, buffer, sizeof(buffer));
++		ret = (pwdp != NULL) ? 0 : errno;
+ #else /* SOLARIS_GETPWENT_R */
+ 		ret = getpwent_r(&pwd, buffer, sizeof(buffer), &pwdp);
+ #endif /* SOLARIS_GETPWENT_R */
+@@ -551,7 +552,8 @@ static bool test_enum_r_group(struct tor
+ 		torture_comment(tctx, "Testing getgrent_r\n");
+ 
+ #ifdef SOLARIS_GETGRENT_R
+-		ret = getgrent_r(&grp, buffer, sizeof(buffer));
++		grpp = getgrent_r(&grp, buffer, sizeof(buffer));
++		ret = (grpp != NULL) ? 0 : errno;
+ #else /* SOLARIS_GETGRENT_R */
+ 		ret = getgrent_r(&grp, buffer, sizeof(buffer), &grpp);
+ #endif /* SOLARIS_GETGRENT_R */