[Pkg-samba-maint] [Git][samba-team/samba][master] 53 commits: VERSION: Bump version up to Samba 4.24.7...
Michael Tokarev (@mjt)
gitlab at salsa.debian.org
Wed Sep 9 22:26:18 BST 2026
Michael Tokarev pushed to branch master at Debian Samba Team / samba
Commits:
64443976 by Björn Jacke at 2026-08-13T16:23:26+02:00
VERSION: Bump version up to Samba 4.24.7...
and re-enable GIT_SNAPSHOT.
Signed-off-by: Bjoern Jacke <bjacke at samba.org>
- - - - -
35744d77 by Volker Lendecke at 2026-08-27T17:07:13+00:00
libcli/dns: Simplify dns over tcp requests, save 39 lines :-)
tstream_readv_pdu_send() is overkill here, tstream_read_packet_send()
is sufficient. The only downside is that dns_tcp_request_recv() does
not return a talloc context on its own in reply anymore, but as the
reply is immediately ndr-parsed, so we keep that around only a tiny
bit longer.
Signed-off-by: Volker Lendecke <vl at samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky at samba.org>
(cherry picked from commit a265d18de746a0cc564c4ce64717660d611167fe)
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16225
- - - - -
6ee7f0dc by Volker Lendecke at 2026-08-27T17:07:13+00:00
libcli/dns: Avoid a local variable referenced only once
Signed-off-by: Volker Lendecke <vl at samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky at samba.org>
(cherry picked from commit 06623bfd7aab829fcd085340c21afcfd984bd699)
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16225
- - - - -
71b72ccc by Volker Lendecke at 2026-08-27T17:07:13+00:00
libcli/dns: dns_udp_request_get_reply -> dns_udp_request_sent
More in line with typical async code right now
Signed-off-by: Volker Lendecke <vl at samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky at samba.org>
(cherry picked from commit b9f9d5a0dc278499a69740348edc995606397b1b)
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16225
- - - - -
2e0fa9df by Volker Lendecke at 2026-08-27T17:07:13+00:00
libcli/dns: Make SMB_ASSERT available
SMB_ASSERT requires "lib/util/debug.h" first and then
"lib/util/samba_util.h":
1. #include "lib/util/debug.h"
* _SAMBA_DEBUG_H is now defined
2. #include "lib/util/samba_util.h"
* samba_util.h includes fault.h
* fault.h checks: #ifdef _SAMBA_DEBUG_H (only if yes, SMB_ASSERT
gets defined)
Signed-off-by: Volker Lendecke <vl at samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky at samba.org>
(cherry picked from commit 8d04671f5ad90f09c46bfbe5a1c88e09ab0e45b7)
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16225
- - - - -
d72c26c4 by Volker Lendecke at 2026-08-27T17:07:13+00:00
libcli/dns: Add TCP parallel fallback after 1 second UDP timeout
Comes with refactoring: Add EDNS0 only to the UDP request, try TCP on
any UDP failure. This patch should probably be split up into several
micro-commits, but the code is very simply structured, so I'd propose
to put this in as is. For review, just look at the final code :-)
Signed-off-by: Volker Lendecke <vl at samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky at samba.org>
Autobuild-User(master): Volker Lendecke <vl at samba.org>
Autobuild-Date(master): Wed Apr 29 17:40:38 UTC 2026 on atb-devel-224
(cherry picked from commit a55c1c97ac4d015dfe30f58b79e724f28185b14a)
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16225
- - - - -
fac98d61 by Shachar Sharon at 2026-08-27T17:07:13+00:00
libcli/dns: fix use-after-free oom case
A failure to tevent_wakeup_recv(subreq) should trigger oom call on 'req'
(instead on 'subreq', which has already been free).
Signed-off-by: Shachar Sharon <ssharon at redhat.com>
Reviewed-by: Noel Power <npower at samba.org>
Reviewed-by: Anoop C S <anoopcs at samba.org>
Autobuild-User(master): Anoop C S <anoopcs at samba.org>
Autobuild-Date(master): Sat May 2 14:51:58 UTC 2026 on atb-devel-224
(cherry picked from commit 1b762a4ea48635c534fe937d60b5e358ff6cab6c)
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16225
- - - - -
f8bce568 by Volker Lendecke at 2026-08-27T17:07:13+00:00
libcli/dns: Make dns_cli_request_send() take a dns_name_packet()
Factor out dns_cli_create_query(), allow dns_cli_request_send() to be
used for other transactions than just DNS_OPCODE_QUERY.
Signed-off-by: Volker Lendecke <vl at samba.org>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
(cherry picked from commit ce1e9ed9b7f9a2258bdd0d97195e7826f28f9a21)
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16225
- - - - -
e62c39b8 by Volker Lendecke at 2026-08-27T17:07:13+00:00
libcli/dns: Add dns_cli_request() sync wrapper
Signed-off-by: Volker Lendecke <vl at samba.org>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
(cherry picked from commit 562a203fba5de9b3d0fb45b9450fa1bc5d546597)
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16225
- - - - -
52c25206 by Jennifer Sutton at 2026-08-27T17:07:13+00:00
libcli/dns: Do not pass NULL pointer to memcpy()
To do so is to invoke undefined behaviour.
Signed-off-by: Jennifer Sutton <jennifersutton at catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
(cherry picked from commit 4e0d3953e9c6974c4c4fe3fe0ee76d86042d9c37)
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16225
- - - - -
fc701b43 by Andreas Schneider at 2026-08-27T17:07:13+00:00
s4:torture: Close handles opened by torture_smb2_testdir() in smb2.streams test
Signed-off-by: Andreas Schneider <asn at samba.org>
Reviewed-by: Ralph Boehme <slow at samba.org>
(cherry picked from commit 5fd7521b0a16afbfd346651d27eaa043dff7d9cb)
- - - - -
2e8b88d7 by Andreas Schneider at 2026-08-27T17:07:13+00:00
s4:torture: Always close handle in check_stream() in smb2.streams
Signed-off-by: Andreas Schneider <asn at samba.org>
Reviewed-by: Ralph Boehme <slow at samba.org>
(cherry picked from commit 5763d741d50feaba75026cbbc09dd0bfc1e13cd8)
- - - - -
ee186472 by Andreas Schneider at 2026-08-27T17:07:13+00:00
s4:torture: Make sure we close handles correctly in test_stream_names()
Signed-off-by: Andreas Schneider <asn at samba.org>
Reviewed-by: Ralph Boehme <slow at samba.org>
(cherry picked from commit 7ef7e2ac6d7936f52966ab97a21c27854eede03e)
- - - - -
c48a2326 by Andreas Schneider at 2026-08-27T17:07:13+00:00
s4:torture: Cleanup to to use the right name
Not a bug, but just use the right union.
Signed-off-by: Andreas Schneider <asn at samba.org>
Reviewed-by: Ralph Boehme <slow at samba.org>
(cherry picked from commit 5bda5bbfbb31aa23548e5d08425e0cddc83d4fc6)
- - - - -
0653e197 by Andreas Schneider at 2026-08-27T17:07:13+00:00
s4:torture: Add missing CHECK_STATUS() in test_stream_io()
Reviewed-by: Ralph Boehme <slow at samba.org>
Signed-off-by: Andreas Schneider <asn at samba.org>
(cherry picked from commit 3fa633de9327c7d06f67d5aaf126e95ef75dd8af)
- - - - -
86452367 by Andreas Schneider at 2026-08-27T17:07:13+00:00
s4:torture: Move smb2_util_close() do done in create_file_with_stream()
Signed-off-by: Andreas Schneider <asn at samba.org>
Reviewed-by: Ralph Boehme <slow at samba.org>
(cherry picked from commit e5cdb5afff15a8e0516ef0665095638dc1d196ba)
- - - - -
4a0af83a by Andreas Schneider at 2026-08-27T17:07:13+00:00
s4:torture: Use torture_result() in check_stream_list() in smb2.streams
This change reveals a bug in the server: currently we do fail a getinfo request
SMB_FILE_STREAM_INFORMATION with NT_STATUS_INVALID_PARAMETER when issued on a
stream handle, but according to MS-FSA this is wrong, as "2.1.5.12.29
FileStreamInformation" just tells us to return the streams associated with the
underlying File object:
* For each Stream ThisStream of Open.File ...
The existing streams tests "io" and "create-disposition" make use of this
indirectly via the helper function check_stream_list(). As these tests didn't
check the return value from check_stream_list() and check_stream_list() doesn't
update the torture result state with a failure code, the tests were passing.
Mark these tests as knownfail until we've fixed the server code.
Signed-off-by: Andreas Schneider <asn at samba.org>
Reviewed-by: Ralph Boehme <slow at samba.org>
(cherry picked from commit 9bd0fee89a32ad098396cdd3cb7ab2add7f565b9)
- - - - -
db0ad6a5 by Andreas Schneider at 2026-08-27T17:07:13+00:00
s4:torture: Close all handles in test_stream_io() in smb2.streams
Also check the return value from check_stream_list(). No change in behaviour.
Signed-off-by: Andreas Schneider <asn at samba.org>
Reviewed-by: Ralph Boehme <slow at samba.org>
(cherry picked from commit b569d7c11b8d36923319b4ed2092b3252a0cdb09)
- - - - -
98692e28 by Andreas Schneider at 2026-08-27T17:07:13+00:00
s3:smbd: Allow STREAM_INFORMATION query on alternate stream handles
according to MS-FSA querying for SMB_FILE_STREAM_INFORMATION on a stream is
valid and MS-FSA 2.1.5.12.29 FileStreamInformation tells us to return the streams
associated with the underlying File object:
* For each Stream ThisStream of Open.File ...
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16144
Pair-Programmed-With: Ralph Boehme <slow at samba.org>
Signed-off-by: Andreas Schneider <asn at samba.org>
Signed-off-by: Ralph Boehme <slow at samba.org>
(cherry picked from commit 95d27f5e7a293262607feeeec6782f11d47f5579)
- - - - -
9fb2d75d by Andreas Schneider at 2026-08-27T17:07:13+00:00
s3:vfs_streams_xattr: Use dirfsp in streams_xattr_unlinkat()
Since commit 09f49fb56a4 ("smbd: Simplify delete_all_streams()"),
delete_all_streams() uses synthetic_smb_fname() instead of
synthetic_pathref(), passing a relative base_name to SMB_VFS_UNLINKAT()
that is relative to dirfsp, not the share root.
streams_xattr_unlinkat() creates a synthetic_pathref() for the base file
when fsp is NULL, but was using handle->conn->cwd_fsp (the share root)
instead of the passed dirfsp. This caused path resolution to fail for
files in subdirectories, leaving xattr streams intact after an OVERWRITE
or OVERWRITE_IF disposition.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16144
Signed-off-by: Andreas Schneider <asn at samba.org>
Reviewed-by: Ralph Boehme <slow at samba.org>
Autobuild-User(master): Andreas Schneider <asn at cryptomilk.org>
Autobuild-Date(master): Tue Jun 16 12:41:25 UTC 2026 on atb-devel-224
(cherry picked from commit 2fc21d87fc88f094b79701e362372f02da98ce02)
- - - - -
59126270 by Martin Schwenke at 2026-08-27T17:07:13+00:00
ctdb-recoverd: Factor out fetching node map and local flags
This will be used in more places.
Indexing by PNN is technically incorrect, so iterate to find the
correct slot in the nodemap.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16082
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Amitay Isaacs <amitay at gmail.com>
(cherry picked from commit b80acebe3d9a7d0e699f45286bf4496184067c76)
- - - - -
7cfa98c3 by Martin Schwenke at 2026-08-27T17:07:13+00:00
ctdb-recoverd: Ensure an outgoing leader aborts recovery
Near the beginning of main_loop(), the node map is fetched and the
flags of the current node are saved. Later in main_loop(), on the
leader node, decisions are made about whether a recovery is needed.
Between these times, the state of the leader node may have changed and
it may no longer be a viable leader, perhaps because it is inactive.
A state change affecting the viability of the leader may also be the
reason why recovery is needed.
Recovery sets the dmaster of records in volatile databases to the
leader. If an outgoing, inactive leader runs recovery this results in
inconsistent databases.
So, fetch the flags for a node that is about to run recovery to ensure
that it is still a viable leader. If it isn't a viable leader then
bail out and wait for an election to complete.
Here is an example showing a stopped node running recovery:
2026-05-21T14:48:00.201838+10:00 node.0 ctdbd[5494]: Stopping node
2026-05-21T14:48:00.202802+10:00 node.0 ctdbd[5494]: Making node INACTIVE
2026-05-21T14:48:00.203891+10:00 node.0 ctdbd[5494]: Recovery mode set to ACTIVE
2026-05-21T14:48:00.204981+10:00 node.0 ctdbd[5494]: Dropping all public IP addresses
...
2026-05-21T14:48:00.240410+10:00 node.0 ctdbd[5494]: Freeze all
2026-05-21T14:48:00.241286+10:00 node.0 ctdbd[5494]: Freeze db: rec_test.tdb
2026-05-21T14:48:00.245207+10:00 node.0 ctdb-recoverd[5511]: Node:0 was in recovery mode. Start recovery process
2026-05-21T14:48:00.245488+10:00 node.0 ctdb-recoverd[5511]: do_recovery: Starting do_recovery
2026-05-21T14:48:00.245570+10:00 node.0 ctdb-recoverd[5511]: do_recovery: Recovery initiated due to problem with node 0
2026-05-21T14:48:00.248315+10:00 node.0 ctdb-recoverd[5511]: do_recovery: Recovery - updated flags
2026-05-21T14:48:00.255559+10:00 node.0 ctdbd[5494]: Connected client with pid:8656
2026-05-21T14:48:00.258061+10:00 node.0 ctdb-recovery[8656]: Set recovery mode to ACTIVE
2026-05-21T14:48:00.262878+10:00 node.0 ctdb-recovery[8656]: start_recovery event finished
2026-05-21T14:48:00.263332+10:00 node.0 ctdb-recovery[8656]: updated VNNMAP
2026-05-21T14:48:00.263363+10:00 node.0 ctdb-recovery[8656]: recover database 0x92421532
2026-05-21T14:48:00.288708+10:00 node.0 ctdbd[5494]: ../../server/ctdb_daemon.c:323 Registered message handler for srvid=17294104044079415297
2026-05-21T14:48:00.301158+10:00 node.0 ctdb-recovery[8656]: Pulled 1 records for db rec_test.tdb from node 1
2026-05-21T14:48:00.301685+10:00 node.0 ctdbd[5494]: ../../server/ctdb_daemon.c:323 Registered message handler for srvid=17294104044079415298
2026-05-21T14:48:00.314492+10:00 node.0 ctdb-recovery[8656]: Pulled 1 records for db rec_test.tdb from node 2
2026-05-21T14:48:00.378047+10:00 node.0 ctdb-recovery[8656]: Pushed 1 records for db rec_test.tdb
2026-05-21T14:48:00.383227+10:00 node.0 ctdb-recovery[8656]: 1 of 1 databases recovered
2026-05-21T14:48:00.407982+10:00 node.0 ctdb-recovery[8656]: Set recovery mode to NORMAL
2026-05-21T14:48:00.411630+10:00 node.0 ctdb-recovery[8656]: recovered event finished
2026-05-21T14:48:00.411803+10:00 node.0 ctdb-recoverd[5511]: Takeover run starting
...
2026-05-21T14:48:00.446576+10:00 node.0 ctdb-recoverd[5511]: Takeover run completed successfully
2026-05-21T14:48:00.446784+10:00 node.0 ctdb-recoverd[5511]: do_recovery: Recovery complete
...
2026-05-21T14:48:06.175857+10:00 node.0 ctdb-recoverd[5511]: Leader broadcast timeout
2026-05-21T14:48:06.176067+10:00 node.0 ctdb-recoverd[5511]: Start election
2026-05-21T14:48:06.178154+10:00 node.0 ctdbd[5494]: Recovery mode already set to ACTIVE
2026-05-21T14:48:06.178519+10:00 node.0 ctdbd[5494]: Recovery mode already set to ACTIVE
2026-05-21T14:48:06.737272+10:00 node.0 ctdb-recoverd[5511]: Received leader broadcast, leader=2
Recovery pulls records from and pushes records to the active nodes (1,
2). However, the dmaster of all records will be 0.
This doesn't seem to occur often. I can recreate it fairly easily if
I run ctdb/tests/INTEGRATION/database/recovery.003.no_resurrect.sh
under valgrind *and* apply a ctdb tool change that delays when "ctdb
stop" sends CTDB_SRVID_TAKEOVER_RUN. Both only affect timing and not
overall recovery daemon behaviour. However, there is currently
nothing stopping this behaviour.
In the example above, some time later, an election is held, another
node becomes leader and the new leader runs recovery:
2026-05-21T14:48:06.175072+10:00 node.2 ctdb-recoverd[5704]: Leader broadcast timeout
2026-05-21T14:48:06.176051+10:00 node.2 ctdb-recoverd[5704]: Start election
2026-05-21T14:48:06.176913+10:00 node.2 ctdbd[5649]: Recovery mode set to ACTIVE
2026-05-21T14:48:06.178319+10:00 node.2 ctdbd[5649]: Recovery mode already set to ACTIVE
2026-05-21T14:48:06.178919+10:00 node.2 ctdbd[5649]: Recovery mode already set to ACTIVE
2026-05-21T14:48:06.179961+10:00 node.2 ctdb-recoverd[5704]: Attempting to take cluster lock (./tests/var/INTEGRATION/database/shared/.ctdb/cluster.lock)
2026-05-21T14:48:06.182192+10:00 node.2 ctdb-recoverd[5704]: Set cluster mutex helper to "/home/martins/samba/samba/ctdb/bin/ctdb_mutex_fcntl_helper"
2026-05-21T14:48:06.202884+10:00 node.2 ctdb-recoverd[5704]: Cluster lock taken successfully
2026-05-21T14:48:06.203876+10:00 node.2 ctdb-recoverd[5704]: Took cluster lock, leader=2
2026-05-21T14:48:06.756771+10:00 node.2 ctdb-recoverd[5704]: Remote node 0 had flags 0x20, local had 0x0 - updating local
2026-05-21T14:48:06.760258+10:00 node.2 ctdb-recoverd[5704]: Pushing updated flags for node 0 (0x20)
2026-05-21T14:48:06.766434+10:00 node.2 ctdbd[5649]: Node 0 has changed flags - 0x0 -> 0x20
2026-05-21T14:48:06.777574+10:00 node.2 ctdb-recoverd[5704]: Node:2 was in recovery mode. Start recovery process
2026-05-21T14:48:06.778277+10:00 node.2 ctdb-recoverd[5704]: Node:1 was in recovery mode. Start recovery process
2026-05-21T14:48:06.779017+10:00 node.2 ctdb-recoverd[5704]: do_recovery: Starting do_recovery
This makes the affected databases consistent again... and explains why
this hasn't been noticed before.
More details...
During recovery, recbuf_filter_add() sets the dmaster of records in a
volatile database to the leader. If this node is inactive then
records with it as dmaster can't be migrated to other nodes after
recovery completes. So, until another recovery occurs, the databases
are inconsistent and any attempts to fetch records will hang.
In terms of post-recovery distributed database performance, it might
make more sense for recovery to set each record's dmaster to its
lmaster. However, that would cost an additional lmaster (i.e. hash)
calculation for each key. So, setting the dmaster of records to be
the leader might be an important recovery performance optimisation.
This bug was found while testing a "leader resignation" change, which
aims to speed up operations like "ctdb stop" by having an outgoing
leader resign, so other nodes do not have to wait for a leader
broadcast timeout. This change does not require recovery to be run
after an election if there is no other change to the
cluster (e.g. leader capability removed: orderly transfer of power).
For a stopped node, the new leader would run a recovery due to the
stopped node becoming inactive... unless the outgoing leader runs
recovery (as per this bug), which handles the cluster change so that
it is no longer exposed to the new leader. So, with this bug and the
leader resignation change, the databases stay inconsistent until a
subsequent recovery.
Although it is theoretically unnecessary, it would be possible to have
leader resignation force a full election, which would always result in
recovery, but that is a question for another day. The current
behaviour is wrong because a recovery run by an inactive leader leaves
volatile databases (at least temporarily) in an inconsistent state.
So, this needs to be fixed.
In the longer term, CTDB will hopefully become more modular.
Elections and database recovery will happen in different modules.
This situation will have to be carefully handled.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16082
Signed-off-by: Martin Schwenke <mschwenke at ddn.com>
Reviewed-by: Amitay Isaacs <amitay at gmail.com>
Autobuild-User(master): Stefan Metzmacher <metze at samba.org>
Autobuild-Date(master): Thu Aug 6 15:26:59 UTC 2026 on atb-devel-224
(cherry picked from commit 70717cc9ac9eb327380cdb4b1f08cb363364a730)
- - - - -
241fb3b9 by Stefan Metzmacher at 2026-08-27T17:07:13+00:00
script/autobuild.py: also add .stderr output including backtraces
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16194
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Björn Jacke <bjacke at samba.org>
(cherry picked from commit 51cf4209d83272f550029412d0e960a16d7ffdaf)
- - - - -
a8193d86 by Andréas Leroux at 2026-08-27T17:07:13+00:00
s4/dns_server: add large dns udp truncated packets tests
Large DNS response must be truncated over UDP, though this is not yet done in samba. Test is added as knownfail until implementation
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15988
Signed-off-by: Andréas Leroux <aleroux at tranquil.it>
Reviewed-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary at catalyst.net.nz>
(cherry picked from commit d1a309b4e6e7fa24d95e7cf7067ff43dcbb3a070)
- - - - -
9bb04cdf by Andréas Leroux at 2026-08-27T17:07:13+00:00
s4/dns_server: truncate large dns packets over udp and set truncated flag
Large DNS response must be truncated over UDP, letting client retry over TCP. Current threshold is set to 1232 as it is regarded as a safe size.
Truncated packets have no answers nor record, only the packet header and initial question(s).
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15988
Signed-off-by: Andréas Leroux <aleroux at tranquil.it>
Reviewed-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary at catalyst.net.nz>
Autobuild-User(master): Jennifer Sutton <jsutton at samba.org>
Autobuild-Date(master): Wed Apr 1 05:08:14 UTC 2026 on atb-devel-224
(cherry picked from commit cc07c37fca2d6431e702a8073958742095761a2d)
- - - - -
372fcb30 by Stefan Metzmacher at 2026-08-27T17:07:13+00:00
s4:dns_server: make it more obvious that the DNS over TCP length hdr is u16
This is no functional change, it just makes it easier to understand.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15988
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
(cherry picked from commit 778ac9fdc18d56281d9aea88efd04a6dbdd0bdbd)
- - - - -
75052b76 by Stefan Metzmacher at 2026-08-27T17:07:13+00:00
s4:dns_server: avoid layer violation for truncated udp responses.
No caller should every look into the state of a subreq!
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15988
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
(cherry picked from commit f4bf6e101f2eda31cbe7fa78eba05e0f70b1075d)
- - - - -
ab06827c by Stefan Metzmacher at 2026-08-27T17:07:13+00:00
python:tests/dns: use tcp for the CVE-2018-14629 regression tests
These go over the limit of 512 bytes for udp, so
they would break with the next commit.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15988
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
(cherry picked from commit 3085a69e6fd223fea31d8e7645b31673d84bc267)
- - - - -
688f8b3c by Stefan Metzmacher at 2026-08-27T17:07:13+00:00
s4:dns_server: change DNS_MAX_UDP_PACKET_LENGTH to 512
This is what RFC 1035 specifies, and we don't support
EDNS(0)/RFC 2671 yet.
I've seen udp responses being dropped, which were
a bit more than 800 bytes.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15988
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
(cherry picked from commit 0e0ebd1d982477255b9f4bcba3316cd2ff054678)
- - - - -
7036a847 by Stefan Metzmacher at 2026-08-27T17:07:13+00:00
s4:rpc_server/common: turn lpcfg_dcerpc_server_info() into an inline function
This makes it easier to use without linking problems.
While there fix talloc problems.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16223
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
(cherry picked from commit 8f17d9a89e22d074e6894cc1530ea626d60a080f)
- - - - -
d87e714b by Stefan Metzmacher at 2026-08-27T17:07:13+00:00
s4:dns_server: add dns_server_scavenging_interval()
We currently have two options used in different locations:
dnsserver:scavenging_interval =>
the value is in seconds and is used in kccsrv_dns_zone_scavenging()
dnsserver:ScavengingInterval =>
the value is in hours and is used in dnsserver_init_serverinfo()
In order to have this just once with a consistent default,
we have dns_server_scavenging_interval() now.
The value of dnsserver:ScavengingInterval was only
ever used to fill the response of 'samba-tool dns serverinfo',
so we prefer dnsserver:scavenging_interval is set.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16223
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
(cherry picked from commit c239af3b4d55705b96cf371cc1c34910249b2379)
- - - - -
54565c36 by Stefan Metzmacher at 2026-08-27T17:07:13+00:00
s4:kcc: let kccsrv_dns_zone_scavenging() use dns_server_scavenging_interval()
It means we have the parameter logic just once
and a value of 0 means scavenging is disabled.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16223
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
(cherry picked from commit 03caa23a6d98fb7c252590de9ffc909407b8bdc8)
- - - - -
b2c64349 by Stefan Metzmacher at 2026-08-27T17:07:13+00:00
s4:rpc_server/dnsserver: let dnsserver_init_serverinfo() use dns_server_scavenging_interval()
It means we have the parameter logic just once.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16223
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
(cherry picked from commit 312da01ed1d9c0d0b30bc4db8262e6d01b307252)
- - - - -
59fb4e0b by Stefan Metzmacher at 2026-08-27T17:07:13+00:00
s4:rpc_server/dnsserver: define DNS_SERVER_DEFAULT_[NO_]REFRESH_INTERVAL as 24 * 7
These are the defaults Windows is also using...
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16223
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
(cherry picked from commit 9919ae52ef611423205a140e32900d84242fc01d)
- - - - -
a836a147 by Stefan Metzmacher at 2026-08-27T17:07:13+00:00
s4:rpc_server/dnsserver: let dnsserver_init_zoneinfo() fallback to serverinfo->dwDefault[No]RefreshInterval
And disable fAging if the values are still 0.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16223
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
(cherry picked from commit fdcda85ac611e2e12ab895674fed76347b5ed6d0)
- - - - -
1525bf05 by Stefan Metzmacher at 2026-08-27T17:07:14+00:00
s4:dns_server: let dns_get_zone_properties() initialize zoneinfo completely.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16223
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
(cherry picked from commit 9fe99c5760a1dc22a57e7bf6338a1b2244e4da6d)
- - - - -
674fdb59 by Stefan Metzmacher at 2026-08-27T17:07:14+00:00
s4:dns_server: move rpc_server/dnsserver/dnsutils.c to dns_server/dnsserver_utils.c
This will avoid linking problems in the following commits.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16223
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
(cherry picked from commit 3f97ac62727137a2b56555a821a2f1ab5113fac2)
- - - - -
7f00cbbd by Stefan Metzmacher at 2026-08-27T17:07:14+00:00
s4:dns_server: let dns_get_zone_properties() fallback to serverinfo->dwDefault[No]RefreshInterval
And disable fAging if the values are still 0.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16223
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
(cherry picked from commit 1146df4c532834481a67cbcf5c7bc8142dfe9875)
- - - - -
c5e2a6d6 by Stefan Metzmacher at 2026-08-27T18:12:43+00:00
s4:kcc: let dns_tombstone_records_zone() skip if fAging is not 1
This means we only do scavenging if the dw[No]RefreshInterval related
logic in dns_common_replace() is triggered and dwTimeStamp has
a chance to be updated before.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16223
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
Autobuild-User(master): Stefan Metzmacher <metze at samba.org>
Autobuild-Date(master): Tue Aug 25 12:14:04 UTC 2026 on atb-devel-224
(cherry picked from commit 2cf29c3c95aa4c6bdd645e34fdf521f9bcb91538)
Autobuild-User(v4-24-test): Björn Jacke <bjacke at samba.org>
Autobuild-Date(v4-24-test): Thu Aug 27 18:12:43 UTC 2026 on atb-devel-224
- - - - -
48330acb by Stefan Metzmacher at 2026-09-01T22:21:21+00:00
python/tests: add tests for samba-tool dns zoneoptions on a zone without dNSProperty values
Currently they fail with WERR_INTERNAL_DB_ERROR.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16226
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
(cherry picked from commit b179abed6757ece911d58e562a2045edf2225a91)
- - - - -
e2ea69bf by Stefan Metzmacher at 2026-09-01T22:21:21+00:00
s4:rpc_server/dnsserver: fix talloc hierarchy in dnsserver_db_do_reset_dword()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16226
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
(cherry picked from commit 3ae706be815952a20ecfef427ab98f540fa6b8ac)
- - - - -
1fc39c45 by Stefan Metzmacher at 2026-09-02T00:08:44+00:00
s4:rpc_server/dnsserver: allow dnsserver_db_do_reset_dword() to add new dNSProperty values
On a zone without "dNSProperty" values at all, or without
a value for the new property, we failed with WERR_INTERNAL_DB_ERROR.
If there's no value stored for the property, we just need to
add a new value.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16226
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
Autobuild-User(master): Stefan Metzmacher <metze at samba.org>
Autobuild-Date(master): Thu Aug 27 17:36:53 UTC 2026 on atb-devel-224
(cherry picked from commit 731e541a0ef4fda598a1480e66aff9d26641d9da)
Autobuild-User(v4-24-test): Björn Jacke <bjacke at samba.org>
Autobuild-Date(v4-24-test): Wed Sep 2 00:08:44 UTC 2026 on atb-devel-224
- - - - -
ee4f5240 by Michael Tokarev at 2026-09-03T09:46:14+03:00
cmocka: it is only used (if at all) in unit tests, not shipped - drop build-dep and ignore generated one
- - - - -
2cc2d16a by Ralph Boehme at 2026-09-08T21:44:12+00:00
smbtorture: split smb2.acls into acls-with-sysacl and acls-ignore-sysacl
The smb2.acls test suite contains tests (OWNER-RIGHTS-DENY1 and DENY1) that use
non-canonical ACLs (containing out-of-order DENY ACEs). Under standard POSIX
draft/system ACL mapping, such non-canonical ACLs cannot be represented
on the underlying file system, hence the current code is supposed to fail
attempts to set such ACLs in the Samba POSIX ACL mapping backend.
However, as the current code wrongly silently swallows the error returned from
the low level mapping function unpack_canon_ace() and a subsequent commit is
going to fix this, the tests mentioned above will start failing.
As these non-canonical ACL are in fact valid ACLs and eg Windows allows setting
them and they only fail when Samba uses POSIX ACL backend, adjust the tests to
run against a share that uses acl_xattr without POSIX ACLs:
- smb2.acls-with-sysacl: Runs tests that are compatible with system POSIX
ACL mapping, executed against the standard 'tmp' share.
- smb2.acls-ignore-sysacl: Contains tests that require Windows-like ACL
handling (like non-canonical ACE ordering) which are executed against
the 'acl_xattr_ign_sysacl_windows' share (where system ACLs are ignored).
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16097
Signed-off-by: Ralph Boehme <slow at samba.org>
Reviewed-by: Jeremy Allison <jra at samba.org>
(cherry picked from commit 8d5674bccfdfecde34ea7a1b1fd384b0cff60d82)
- - - - -
f4084b29 by Ralph Boehme at 2026-09-08T21:44:12+00:00
smbtorture: add test smb2.acls.NON-CANONICAL-ORDER
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16097
Signed-off-by: Ralph Boehme <slow at samba.org>
Reviewed-by: Jeremy Allison <jra at samba.org>
(cherry picked from commit 64a20d65df6c828dee1ca3230c82868969a60afc)
- - - - -
61fe86b4 by Ralph Boehme at 2026-09-08T21:44:12+00:00
smbd: prepare for correct error handling for callers of unpack_canon_ace()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16097
Signed-off-by: Ralph Boehme <slow at samba.org>
Reviewed-by: Jeremy Allison <jra at samba.org>
(cherry picked from commit 1d19ca727c6f6fc6fec4a070dc90b04058b316d8)
- - - - -
655614d8 by Ralph Boehme at 2026-09-08T22:46:49+00:00
smbd: check the return value before the ACE-lists out args
If unpack_canon_ace() fails and returns false, file_ace_list and dir_ace_list
will be left at their initial NULL values, so we exit out at
if (!file_ace_list && !dir_ace_list) {
return NT_STATUS_OK;
}
instead of at the subsequent error checking code for acl_perms.
This subtle change was introduced by commit
81533e2d39cae11b7ea06f289a7c398ed3c51da9 and causes attempts to set an
non-canonical ACL by clients to return NT_STATUS_OK, instead of failing with
NT_STATUS_ACCESS_DENIED.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16097
Signed-off-by: Ralph Boehme <slow at samba.org>
Reviewed-by: Jeremy Allison <jra at samba.org>
Autobuild-User(master): Ralph Böhme <slow at samba.org>
Autobuild-Date(master): Fri Jun 26 12:50:29 UTC 2026 on atb-devel-224
(cherry picked from commit 4cc867cc6fe1afef85b7f88b55e4c8e0058fc7a4)
Autobuild-User(v4-24-test): Björn Jacke <bjacke at samba.org>
Autobuild-Date(v4-24-test): Tue Sep 8 22:46:49 UTC 2026 on atb-devel-224
- - - - -
3d8f77c7 by Björn Jacke at 2026-09-09T17:09:03+02:00
WHATSNEW: Add release notes for Samba 4.24.7.
Signed-off-by: Bjoern Jacke <bjacke at samba.org>
- - - - -
1aab718a by Björn Jacke at 2026-09-09T17:09:26+02:00
VERSION: Disable GIT_SNAPSHOT for the 4.24.7 release.
Signed-off-by: Bjoern Jacke <bjacke at samba.org>
- - - - -
7af4cba0 by Michael Tokarev at 2026-09-09T23:00:25+03:00
New upstream version 4.24.7+dfsg
- - - - -
9563524d by Michael Tokarev at 2026-09-09T23:01:20+03:00
Update upstream source from tag 'upstream/4.24.7+dfsg'
Update to upstream version '4.24.7+dfsg'
with Debian dir 1255da5458d88fcb001662ee553c741587a6e8a3
- - - - -
f20273ca by Michael Tokarev at 2026-09-10T00:22:41+03:00
asn1util-deps.diff: another library missing private deps
- - - - -
ff99eb5d by Michael Tokarev at 2026-09-10T00:23:24+03:00
update changelog; upload version 4.24.7+dfsg-1 to unstable
- - - - -
41 changed files:
- VERSION
- WHATSNEW.txt
- ctdb/server/ctdb_recoverd.c
- debian/changelog
- debian/control
- debian/not-installed
- + debian/patches/asn1util-deps.diff
- debian/patches/series
- lib/param/param.h
- libcli/dns/dns.c
- libcli/dns/dns_lookup.c
- libcli/dns/libdns.h
- libcli/dns/wscript_build
- python/samba/tests/dns.py
- python/samba/tests/samba_tool/dnscmd.py
- script/autobuild.py
- selftest/flapping
- selftest/knownfail
- selftest/knownfail.d/dns
- source3/modules/vfs_streams_xattr.c
- source3/selftest/tests.py
- source3/smbd/posix_acls.c
- source3/smbd/smb2_trans2.c
- source4/dns_server/dns_query.c
- source4/dns_server/dns_server.c
- source4/dns_server/dns_server.h
- source4/dns_server/dnsserver_common.c
- source4/dns_server/dnsserver_common.h
- source4/rpc_server/dnsserver/dnsutils.c → source4/dns_server/dnsserver_utils.c
- source4/dns_server/wscript_build
- source4/dsdb/kcc/kcc_periodic.c
- source4/dsdb/kcc/scavenge_dns_records.c
- source4/rpc_server/common/common.h
- − source4/rpc_server/common/loadparm.c
- source4/rpc_server/dnsserver/dnsdb.c
- source4/rpc_server/dnsserver/dnsserver.h
- source4/rpc_server/tests/rpc_dns_server_dnsutils_test.c
- source4/rpc_server/wscript_build
- source4/torture/smb2/acls.c
- source4/torture/smb2/smb2.c
- source4/torture/smb2/streams.c
The diff was not included because it is too large.
View it on GitLab: https://salsa.debian.org/samba-team/samba/-/compare/01dba9c03038ae97913e2658067540a5d52c3c2b...ff99eb5d0ade11cba91b42e5bd87fe281f76d7e2
--
View it on GitLab: https://salsa.debian.org/samba-team/samba/-/compare/01dba9c03038ae97913e2658067540a5d52c3c2b...ff99eb5d0ade11cba91b42e5bd87fe281f76d7e2
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-samba-maint/attachments/20260909/7933d264/attachment-0001.htm>
More information about the Pkg-samba-maint
mailing list