- =================================
- Release Notes for Samba 3.6.0pre2
- April 12, 2011
- =================================
+ =============================
+ Release Notes for Samba 3.6.0
+ August 9, 2011
+ =============================
-This is the second preview release of Samba 3.6.0. This is *not*
-intended for production environments and is designed for testing
-purposes only. Please report any defects via the Samba bug reporting
-system at https://bugzilla.samba.org/.
-
+This is the first release of Samba 3.6.0.
Major enhancements in Samba 3.6.0 include:
set '--option=clientusentlmv2auth=no' on your smbclient command line, or
set 'client ntlmv2 auth = no' in your smb.conf
-The impact of 'client use spnego principal = no' is that we may be able
-to use Kerberos to communicate with a server less often in smbclient,
-winbind and other Samba client tools. We may fall back to NTLMSSP in
-more situations where we would previously rely on the insecure
-indication from the 'NegProt' CIFS packet. This mostly occursed when
-connecting to a name alias not recorded as a servicePrincipalName for
-the server. This indication is not available from Windows 2008 or later
-in any case, and is not used by modern Windows clients, so this makes
-Samba's behaviour consistent with other clients and against all servers.
+The impact of 'client use spnego principal = no' is that Samba will
+use CIFS/hostname to obtain a kerberos ticket, acting more like
+Windows when using Kerberos against a CIFS server in smbclient,
+winbind and other Samba client tools. This will change which servers
+we will successfully negotiate kerberos connections to. This is due
+to Samba no longer trusting a server-provided hint which is not
+available from Windows 2008 or later. For correct operation with all
+clients, all aliases for a server should be recorded as a as a
+servicePrincipalName on the server's record in AD. (For this reason,
+this behavior change and parameter was also made in Samba 3.5.9)
The impact of 'send spnego principal = no' is to match Windows 2008 and
not to send this principal, making existing clients give more consistent
certain RPC service over TCP/IP, you just ask the endpoint mapper on which
port it is running. Then you can connect to the service and make sure that it
is running.
+
The code is deactivated by default, because it needs more testing and it
-doesn't scale yet. We will work on these limitations and hopefully release it
-with pre3. If you want to enable and test the endpoint mapper you can set
-"rpc_server:epmapper = daemon" in the smb.conf file.
+doesn't scale yet. If you want to enable and test the endpoint mapper
+you can set "rpc_server:epmapper = daemon" in the smb.conf file.
Internal restructuring
smb2 max read New 1048576
smb2 max trans New 1048576
smb2 max write New 1048576
- strict allocate Changed Default Yes
username map cache time New 0
winbind max clients New 200
+ The variable substitutions for %i and %I no longer
+ use IPv4 addresses mapped to IPv6, e.g. '::ffff:192.168.0.1',
+ if the host has IPv6 enabled. Now %i and %I contain just
+ '192.168.0.1'.
Commit Highlights
-----------------
* Add an Endpoint Mapper daemon.
+Changes since 3.6.0rc3
+----------------------
+
+o Michael Adam <obnox@samba.org>
+ * BUG 8327: Fix the reload of the configuration, also reload activated
+ registry shares.
+ * BUG 8328: Cleanup of idmap_tdb2 code.
+
+
+o Jeremy Allison <jra@samba.org>
+ * BUG 7462: Make SA_RESETHAND conditional on its existance.
+ * BUG 8324: smbclient cannot list directories from a big-endian machine.
+ * BUG 8335: File copy aborts with smb2_validate_message_id: bad message_id.
+
+
+o Andrew Bartlett <abartlet@samba.org>
+ * BUG 8326: WinXP cannot join a Samba3 domain with a 'even' hostname.
+
+
+o Björn Baumbach <bb@sernet.de>
+ * BUG 8303: db_ctdb_send_schedule_for_deletion() is not defined.
+
+
+o Alban Browaeys <prahal@yahoo.com>
+ * BUG 8341: Fix segfault in libsmbclient.
+
+
+o Volker Lendecke <vlendec@samba.org>
+ * BUG 8343: Fix SMB2 crash reading with aio_fork beyond the end of file.
+
+
+Changes since 3.6.0rc2
+----------------------
+
+o Michael Adam <obnox@samba.org>
+ * BUG 8213: Fixes in idmap_autorid.
+ * BUG 8217: Do not stat-check the share path in 'net conf addshare'.
+ * BUG 8281: Fix build of examples/VFS/*.
+
+
+o Jeremy Allison <jra@samba.org>
+ * BUG 8083: Fix "inherit owner = yes" with vfs_acl_xattr or vfs_acl_tdb
+ module.
+ * BUG 8211: Fix "inherit owner = yes" when "inherit permissions = yes"
+ is set.
+ * BUG 8219: Fix SMB Panic from Windows 7 client.
+ * BUG 8254: Fix "acl check permissions = no".
+ * BUG 8293: Fix log file rotating in SMB2.
+ * BUG 8304: Fix uninitialized variable in error path.
+ * BUG 8307: brl_close_fnum does not call SMB_VFS_BRL_UNLOCK_WINDOWS on all
+ locks.
+ * BUG 8310: toupper_ascii() is broken on big-endian systems.
+ * BUG 8314: Fix smbd crash with unknown user.
+
+
+o Christian Ambach <ambi@samba.org>
+ * BUG 8231: Fix crash bug in 'net cache get'.
+ * BUG 8244: Fix copying files larger than 2 GB to a Samba share.
+ * BUG 8263: Fix build with --with-fake-kaserver or --with-vfs-afsacl.
+ * BUG 8278: Fix smbd panic when CTDB is unhealthy.
+ * BUG 8286: Fix smbd crash on premature end of smb2 conn.
+
+
+o Andrew Bartlett <abartlet@samba.org>
+ * BUG 8230: Move .nmbd socket directory to non-hidden name PREFIX/var/nmbd.
+ * Mark 'time offset' parameter as deprecated.
+
+
+o Gregor Beck <gbeck@sernet.de>
+ * BUG 8193: Add new command 'enumerate_recursive'.
+ * BUG 8253: Fix Winbind panic if verify_idpool() fails.
+
+
+o Kai Blin <kai@samba.org>
+ * BUG 8289: Fix possible XSS attack (CVE-2011-2694).
+ * BUG 8290: Fix Cross-Site Request Forgery in SWAT (CVE-2011-2522).
+
+
+o Günther Deschner <gd@samba.org>
+ * BUG 7888: Deal with buggy 3.0 based PDCs.
+ * BUG 8214: Fix smbd crash on printer driver upgrade.
+ * BUG 8235: Fix smbd crash on startup caused by migrate_printer().
+
+
+o Björn Jacke <bj@sernet.de>
+ * BUG 8262: Fix build of vfs_commit.
+
+
+o Günter Kukkukk <linux@kukkukk.com>
+ * BUG 8305: Fix segfault in nmbd when using 'smbtree ...'..
+
+
+o Volker Lendecke <vl@samba.org>
+ * BUG 7841: Explicitly pass domain_sid to wbint_LookupRids().
+ * BUG 8102: Do not allow to change file ACLs from normal domusers.
+ * BUG 8247: Fix Coverity ID 2582: FORWARD_NULL.
+
+
+o Herb Lewis <hlewis@panasas.com>
+ * BUG 8216: Make Winbind returning correct results with 'sids2xids'.
+
+
+o Stefan Metzmacher <metze@samba.org>
+ * BUG 8102: Do not allow to change file ACLs from normal domusers.
+ * BUG 8195: Make rpc client code working against NT4 servers.
+ * BUG 8224: Fix the build on FreeBSD.
+ * BUG 8226: Use c99 initializers which are supported by old gcc 2.95
+ compilers.
+ * BUG 8260: Fix DCERPC responses with fragments larger than 1024 bytes.
+ * BUG 8264: Fix Valgrind bugs in svcctl.
+ * BUG 8276: Close all sockets attached to a subnet in close_subnet().
+ * BUG 8292: Fix a major architectural flaw in the SMB2 server code.
+
+
+o Andreas Schneider <asn@samba.org>
+ * BUG 8215: Fix Winbind unix username lookup.
+ * BUG 8240: Fix Valgrind warnings in winreg/spoolss code.
+
+
+Changee since 3.6.0rc1
+----------------------
+
+o Michael Adam <obnox@samba.org>
+ * BUG 8200: Add support for multiple writeable ldap idmap domains.
+
+
+o Jeremy Allison <jra@samba.org>
+ * BUG 6911: Fix Kerberos authentication from Vista to Samba.
+ * BUG 7054: Fix X account flag when "pwdlastset" is "0".
+ * BUG 8133: Fix strange behavior for the file (whose filename first
+ character is period ) in SMB2 case.
+ * BUG 8144: Fix setting timestamp when touching files with CIFS clients.
+ * BUG 8150: Ban "dos charset = utf8".
+ * BUG 8153: Fix setting up getaddrinfo on IPv6-only machines.
+ * BUG 8156: Fix 'net ads join' using the user's Kerberos ticket.
+ * BUG 8157: Fix parsing a cups printcap file.
+ * BUG 8163: Fix our asn.1 parser to handle negative numbers.
+ * BUG 8175: Fix smbd deadlock.
+ * BUG 8191: Split the ACE flag mapping between nfs4 and Windows into two
+ separate functions.
+ * BUG 8197: Winbind does not properly detect when a DC connection is dead.
+ * BUG 8203: Winbind needs to reset the DC connection if an RPC times out.
+
+
+o Christian Ambach <ambi@samba.org>
+ * BUG 8152: Fix smbd crash in release_ip().
+
+
+o Andrew Bartlett <abartlet@samba.org>
+ * BUG 8151: Deprecate security parameters.
+
+
+o Gregor Beck <gbeck@sernet.de>
+ * BUG 8191: nfs4_acls: Pass ACE_FLAG_INHERITED_ACE up to the client/down
+ from the client.
+ * BUG 8192: Fix parsing of multiple flags in 'smbcacls'.
+
+
+o Sumit Bose <sbose@redhat.com>
+ * BUG 8142: Fix typos in LDAP schema files.
+
+
+o Holger Hetterich <hhetter@novell.com>
+ * BUG 8148: Default to protocol version 2 for SMB Traffic Analyzer.
+ * BUG 8154: Actually make use of SMBTA subversion numbers.
+
+
+o Björn Jacke <bj@sernet.de>
+ * BUG 7998: Remove warning if IOV_MAX is not defined.
+
+
+o Jim McDonough <jmcd@samba.org>
+ * BUG 8166: Don't lockout users when offline.
+
+
+o Stefan Metzmacher <metze@samba.org>
+ * BUG 8140: talloc: Fix Valgrind false positives and other backports.
+ * BUG 8141: Fix wrong permissions on lp_ncalrpc_dir().
+
+
+o Andreas Schneider <asn@samba.org>
+ * BUG 8155: Fix registering only named pipes on EPM for a service.
+
+
+o Volker Lendecke <vl@samba.org>
+ * BUG 8159: Fix memory corruption in fetching cli->server_domain from the
+ server.
+ * BUG 8185: "security=server" does not obey guest login field.
+ * BUG 8189: Support shadow copy display over SMB2.
+ * BUG 8199: Fix potential crash in smbd handling smb2.
+
+
+o Samuel Thibault <sthibault@debian.org>
+ * BUG 7998: Fix build on Hurd.
+
+
+Changes since 3.6.0pre3
+-----------------------
+
+o Jeremy Allison <jra@samba.org>
+ * BUG 8111: CIFS VFS: Fix unexpected error on SMB posix open.
+ * BUG 8112: POSIX extension opens of a directory are denied with EISDIR.
+ * Remove fstrings from client struct.
+ * BUGFIX when converting from safe_strcpy to strlcpy.
+ * Fix off-by-one calculations with strlcpy.
+ * Ensure we always write the correct incoming mid into the share mode table
+ entries.
+ * Fix the SMB2 oplock showstopper.
+
+
+o Christian Ambach <christian.ambach@de.ibm.com>
+ * Convert user-specified domain to uppercase in libsmb.
+
+
+o Günther Deschner <gd@samba.org>
+ * BUG 8132: Fix filling printers location field when using cups.
+ * Fix Coverity CID #2302: FORWARD_NULL.
+ * Fix cups_pull_comment_location().
+ * Fix double free of cups request.
+ * Make cups_pull_comment_location() work again.
+ * Fix potential crash bug in display_print_driver3().
+
+
+o Volker Lendecke <vl@samba.org>
+ * Properly clean up in pthreadpool_init in case of failure.
+ * Make plaintext session setup async.
+ * Reduce fd load in Winbind children.
+ * Avoid a potential 100% CPU loop in Winbind.
+ * Tune broadcast namequeries for unique names.
+ * Properly deal with exited winbind children.
+ * Fix dup_smb2_vec3.
+ * Fix return check in nss_wins.
+
+
+Changes since 3.6.0pre2
+-----------------------
+
+o Michael Adam <obnox@samba.org>
+ * Fix build of tdb2.
+
+
+o Jeremy Allison <jra@samba.org>
+ * BUG 8083: "inherit owner = yes" doesn't interact correctly with
+ vfs_acl_xattr or vfs_acl_tdb module.
+ * BUG 8088: rpccli_samr_chng_pswd_auth_crap segfaults if any input blobs
+ are null.
+ * Correctly detect and deny symlinks anywhere in a path (not just the last
+ component) if "follow symlinks = no".
+
+
+o Günther Deschner <gd@samba.org>
+ * BUG 8106: Fix the build of 'smbget' on HP NonStop.
+ * Fix timeout in rpc_pipe_open_tcp_port().
+ * Fix the build of "--with-profiling-data".
+ * Fix the AIX 5.3 build.
+
+
+o Sergey Korsak <skif@1plus1.net>
+ * BUG #8099: setpwent() actually does endpwent() and vice versa on FreeBSD.
+
+
+o Volker Lendecke <vl@samba.org>
+ * BUG 8066: Fix wrong output in 'smbget'.
+ * Fix Coverity IDs 986, 1340, 2047, 2299, 2307, 2325, 2335, 2336, 2470,
+ 2471, 2478.
+ * nsswitch: Add 'wbinfo --lookup-sids'.
+ * nsswitch: Add 'wbinfo --sids-to-unix-ids'.
+ * Fix smbd with the async echo responder.
+ * Fix the build of vfs_gpfs.c.
+ * Add a 10-second timeout for the 445 or netbios connection to a DC.
+ * Many pthreadpool fixes.
+
+
+o Stefan Metzmacher <metze@samba.org>
+ * BUG 7383: Listen on IPv6 addresses with IPV6_ONLY.
+
+
+o Rusty Russell <rusty@rustcorp.com.au>
+ * Fix transaction recovery area for converted tdbs.
+
+
Changes since 3.6.0pre1
-----------------------
* Fix 'net usersidlist' not to skip every other user.
-o Gregor Beck <gbeck@sernet.de>
- * Add "net idmap check", a check and repair tool for the
- id mapping database.
-
o Günther Deschner <gd@samba.org>
* BUG 7690: Retry DNS updates when connection to one nameserver has failed.
* BUG 7945: Let winbind try to use samlogon validation level 6.
git.samba.org / samba.git / blobdiff