auth: Avoid a DEBUGADD in kerberos_decode_pac()

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

auth: Refactor check_pac_checksum to improve readability

Use ARRAY_SIZE over terminating array element. Easier to read for me.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

lib: Remove unused str_list_show

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

smbd: Modernize a DEBUG

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

smbd: Simplify smbd_do_qfsinfo()

We can rely on fsp now, avoid passing and using fname

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

smbd: smbd_do_qfsinfo() can rely on an fsp now, use fsp's stat info

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

lib: Streamline finding a file's block device for quota code

Use /proc/self/mountinfo to find the block device a file is mounted on for
quotactl purposes.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

lib: Convert sys_path_to_bdev to talloc

Next we'll have sys_dev_to_bdev based on string_list_make, which is
talloc-based.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

vfs: Add "fsp" to SMB_VFS_SET_QUOTA

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

vfs: Change SMB_VFS_GET_QUOTA to take a fsp instead of a name

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

smbd: Make disk_quotas() take a fsp

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

vfs: Remove SMB_VFS_STATVFS

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

smbd: Call FSTATVFS instead of STATVFS

To get the fs capabilities we do an openat_pathref_fsp_dot(), which
also avoids a call to SMB_VFS_STAT there.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

vfs: Add SMB_VFS_FSTATVFS

To replace SMB_VFS_STATVFS next

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

vfs_gpfs: Use fstatvfs() instead of the path-based statvfs()

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

vfs_default: Use fstatvfs() instead of the path-based statvfs()

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

lib: Remove sys_fsusage()

"man statfs" on Linux says "Unless you need the f_type field, you
should use the standard statvfs(3) interface instead.". We don't need
f_type to get disk usage :-)

We lose some of the older compatibility layers. Should these ever be
needed again, we should add them to lib/util/statvfs.c an the single
interface to retrieve file system usage info.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

smbserver: Convert callers of sys_fsusage to sys_statvfs

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

lib: Add statvfs2fsusage

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

lib: Move statvfs.[ch] to lib/util

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

smbd: Give statvfs.c its own header file

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

smbd: Add sys_fstatvfs()

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

smbd: Factor out initializing vfs_statvfs_struct from system info

Patch is a bit confusing due to all the #ifdefs, but it's just some
code shuffling to prepare for the next patch.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

vfs: Change SMB_VFS_DISK_FREE to take a fsp

The modules that change the pathname need a synthetic_pathref now for
the SMB_VFS_NEXT_DISK_FREE() call. I think this is the right thing to
do anyway, as this goes through all the path scrutiny and does not
depend on direct multi-component paths anymore.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

torture: Avoid a few casts in vfstest

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

smbd: Make sys_disk_free() take a fsp

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

smbd: Make get_dfree_info() take a fsp

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

smbd: Use fsp->fsp_name in smbd_do_qfsinfo()

Both callers pass an fsp now, use that for get_dfree_info()

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

smbd/smb1: Open a pathref's fsp_name to get_dfree_info()

Preparation for converting get_dfree_info() to directly take a fsp.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

smbd/smb1: send pathref fsp of share root to smbd_do_qfsinfo

The other caller of this already passes one.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

smbd: Slightly simplify smbd_smb2_lock_send()

"<bool> == false" just looks wrong :-)

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

adouble: Use strequal_m instead of strcasecmp_m

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

smbd: Simply return status instead of special-casing errors

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

profiling: Fix a comment

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

lib: Simplify conv_str_size

conv_str_size_error() from lib/util has almost the same code

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

lib: Move conv_str_bool() to its only user

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

lib: Avoid an "else", we return in the if-branch

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

lib: Remove very little used wrapper conv_str_u64()

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

lib: Clean up includes in util_strlist_v3.c

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

smbd: Save a few lines with direct smb_file_time initialization

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

vfs_full_audit: Print NTSTATUS errors

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

python: Align py_ntstatus.c with py_hresult.c

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

python: Simplify py_hresult.c

CFLAGS=-Og did not finish this file. Also, this makes the file a few
hundred kilobytes smaller

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

torture: Align an integer type

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

third_party: init vars for -Og on debian testing

When building on debian testing with -Og, gcc complains about these
two uninitialized variables. Not sure how to deal with those, I'm
happy to re-fix if a new upstream patch overwrites them.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

clang-format: Cut at 79 chars

As discussed at FOSDEM with Andreas: This makes emacs a bit nicer when
running on a 161x40 terminal in two columns :-)

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

lib/pthreadpool: Add some pthreadpool_pipe unit tests

Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Signed-off-by: Noel Power <noel.power@suse.com>
Autobuild-User(master): Noel Power <npower@samba.org>
Autobuild-Date(master): Fri Feb 13 11:22:34 UTC 2026 on atb-devel-224

lib/pthreadpool: Incorrect error state detected for dup2 call

Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Signed-off-by: Noel Power <noel.power@suse.com>

bootstrap: fix bootstrap in opensuse container

bootstrap.sh was failing in an opensuse container due to a conflict
of which with the pre-installed busybox-which package.

forcing resolution with zypper fixes the bootstrapping.

Thanks to Andreas Scheider for the hint!

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Wed Feb 11 10:30:26 UTC 2026 on atb-devel-224

ctdb-daemon: Hex encode key before logging

This currently causes binary data to be logged.

Instead, conditionally hex encode the key in a similar style to the
way it is done in dbwrap_ctdb.c:fetch_locked_internal().  In this
case, the key is truncated if the debug level is less than 10.`

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Mon Feb  9 12:21:08 UTC 2026 on atb-devel-224

util: Avoid signed/unsigned integer comparisons

../../../lib/util/sys_rw.c: In function ‘sys_pread_full’:
../../../lib/util/sys_rw.c:219:25: warning: comparison of integer expressions of different signedness: ‘ssize_t’ {aka ‘long int’} and ‘size_t’ {aka ‘long unsigned int’} [-Wsign-compare]
  219 |                 if (ret > curr_count) {
      |                         ^
../../../lib/util/sys_rw.c: In function ‘sys_pwrite_full’:
../../../lib/util/sys_rw.c:282:25: warning: comparison of integer expressions of different signedness: ‘ssize_t’ {aka ‘long int’} and ‘size_t’ {aka ‘long unsigned int’} [-Wsign-compare]
  282 |                 if (ret > curr_count) {
      |                         ^
../../../lib/util/sys_rw.c: In function ‘sys_write_full’:
../../../lib/util/sys_rw.c:321:25: warning: comparison of integer expressions of different signedness: ‘ssize_t’ {aka ‘long int’} and ‘size_t’ {aka ‘long unsigned int’} [-Wsign-compare]
  321 |                 if (ret > curr_count) {
      |                         ^

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Volker Lendecke <vl@samba.org>

ctdb-tests: Fix tunables test when run as root

When run as root, this test's expected output is missing:

  Loading tunables from ...

at the top.

Fix this by using the correct function to construct the expected
output.

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Volker Lendecke <vl@samba.org>

ctdb-doc: Improve private and public network documentation

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Volker Lendecke <vl@samba.org>

ctdb-common: Use if_nametoindex(3) to check if interface exists

This is much simpler than looping through the array.  It will also
find an interface by altname, which could be very useful.

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Volker Lendecke <vl@samba.org>

ctdb-common: Align integer type

[132/416] Compiling ctdb/common/run_event.c
../../common/run_event.c: In function ‘run_event_fail’:
../../common/run_event.c:806:50: warning: comparison of integer expressions of different signedness: ‘id_t’ {aka ‘unsigned int’} and ‘int’ [-Wsign-compare]
  806 |         if (script->summary == -ETIMEDOUT && pid != -1) {
      |                                                  ^~

This is actually due to a typo in commit
20e9f203627752c4c1934e4bc0776e26c0dfb00e.  It should always have been
pid_t.

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Volker Lendecke <vl@samba.org>

ctdb-scripts: Move NFS lock manager grace hack to callout

The "startipreallocate" event was added so the NFS-Ganesha callout
could use it to start grace.  Use it for Linux kernel lock manager
grace too.

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Volker Lendecke <vl@samba.org>

ctdb-scripts: Reformat with "shfmt -w -p -i 0 -fn"

Best reviewed with "git show -w" or similar.

I now have a pre-commit hook to avoid formatting breakage.  :-)

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Volker Lendecke <vl@samba.org>

manpages: Update NET ADS KERBEROS KINIT manpage

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Pavel Filipensky <pfilipensky@samba.org>
Autobuild-Date(master): Thu Feb  5 21:11:13 UTC 2026 on atb-devel-224

s3:utils: 'net ads kerberos kinit' should use also default ccache name from krb5.conf

This is re-introducing the behavior from samba-4.20 where both these
commands operated on the same ccache (default_ccache_name in
[libdefaults] section of krb5.conf)

 'net ads kerberos kinit -P'
 'klist'

 With samba-4.21 it no longer works, 'net ads kerberos kinit -P'
 fallbacks to 'MEMORY:net' (which is of a very limited use, ticket
 cannot be used by other process) and klist finds no ticket.

 The order is changed from:

    --use-krb5-ccache
    env "KRB5CCNAME"
    "MEMORY:net"

to ("MEMORY:net" is removed):

    --use-krb5-ccache
    env "KRB5CCNAME"
    default_ccache_name

'--use-krb5-ccache=MEMORY:net' can be used to validate the credentials.

Use smb_force_krb5_cc_default_name() instead of krb5_cc_default_name()
because of commit:
1ca6fb5 make sure krb5_cc_default[_name]() is no longer used directly

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

s3/printing: Fix leaking parsed options

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15979
Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Autobuild-User(master): Noel Power <npower@samba.org>
Autobuild-Date(master): Fri Jan 30 11:09:44 UTC 2026 on atb-devel-224

s3/printing: Fix leaked mem ctx returned from talloc_new

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15979
Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>

WHATSNEW document JSON audit logging changes

Document the JSON audit logging changes.
  - leading spaces before opening '{' removed
  - any embedded '\n' chars replaced with spaces

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15898

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org>
Autobuild-Date(master): Thu Jan 29 00:33:43 UTC 2026 on atb-devel-224

lib:audit_logging JSON remove leading spaces

Remove the leading spaces in JSON audit lines.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15898

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Volker Lendecke <vl@samba.org>

lib:util:debug tests for JSON logging macros

Add unit tests for the new JSON debugging macros DBGJSON and DBGJSONC

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15898

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Volker Lendecke <vl@samba.org>

lib:util:debug Logging macros for JSON output

Add new debug macros for outputting JSON log lines

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15898

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Volker Lendecke <vl@samba.org>

s3:rpc_client: Fix memory leak opening local named pipe

If no local server name was passed to rpc_pipe_open_local_np() then
get_myname() was called with NULL talloc context instead of the
current stackframe.

This was causing an increase of memory usage on busy servers with long-living
rpcd_* workers.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15979

Signed-off-by: Samuel Cabrero <scabrero@samba.org>
Reviewed-by: Noel Power <noel.power@suse.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Tue Jan 27 10:13:40 UTC 2026 on atb-devel-224

smbd: in contend_dirleases() don't bother checking when not enabled

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15984

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Martin Schwenke <martins@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Mon Jan 26 12:09:13 UTC 2026 on atb-devel-224

s3:libads: Allocate cli_credentials on a stackframe

This fixes:
ERROR: talloc_free with references at ../../source3/libads/ldap_utils.c:158

What happens:

* `struct cli_credentials *creds` is allocated on `ads` talloc context
* gensec_set_credentials() creates a talloc_reference to `creds`
* TALLOC_FREE(creds) sees two parents and complains

All other code is using temporary talloc_stackframe() for `creds`.
Do it here as well.

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Fri Jan 23 11:20:28 UTC 2026 on atb-devel-224

docs-xml:smb.conf: Fix "ctdbd socket" documentation

This has been wrong for a very long time.  I only noticed it just
now...  :-(

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15977

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Autobuild-User(master): Martin Schwenke <martins@samba.org>
Autobuild-Date(master): Thu Jan 22 23:06:20 UTC 2026 on atb-devel-224

s3:libads: Separate use of ads->config.flags for NBT_* and DS_* values

Use of ads->config.flags is overloaded.

It is used to:

- pass DS_* flags down to cldap_netlogon()
- store the server_type from NETLOGON_SAM_LOGON_RESPONSE

Both cases use different values and cannot be combined.
E.g. flags mess up with value 0x00000080

NBT_SERVER_CLOSEST  0x00000080
DS_PDC_REQUIRED     0x00000080

Let's create two separate flags

nbt_server_type server_flags; /* NBT_* cldap flags identifying the services. */
uint32 required_flags; /* DS_* - Netlogon flags */

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15972

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Pavel Filipensky <pfilipensky@samba.org>
Autobuild-Date(master): Thu Jan 22 09:14:25 UTC 2026 on atb-devel-224

s3:libads: Reset ads->config.flags in ads_disconnect()

This is doing the same thing in ads_disconnect() as commit
a26f535 Clear previous CLDAP ping flags when reusing the ADS_STRUCT
did in ads_current_time()

In this case we:

1) found cached ADS_STRUCT which already has ads->config.flags set:

  lookup_groupmem()
    ads_cached_connection()
      ads_cached_connection_reuse()

2) started search which immediately timeouts (the cached conn. was dead)

  ads_do_search_retry_internal()
    ldap_search_with_timeout() - IO_TIMEOUT

3) Retry loop finds a new DC and tries to connect

  ads_do_search_retry_internal()
    ads_disconnect()
    ads_find_dc()
    ads_try_connect()
      netlogon_pings()
        check_cldap_reply_required_flags()

4) check_cldap_reply_required_flags() fails since ads->config.flags
   (stored possibly long time ago) contain:

   NBT_SERVER_CLOSEST  0x00000080
     which is misinterpreted as:
   DS_PDC_REQUIRED     0x00000080

   the newly found DC is not PDC (we asked for DS_ONLY_LDAP_NEEDED)
   and since previous DC had NBT_SERVER_CLOSEST we want DS_PDC_REQUIRED
   and fail.

We should anyway avoid mixing independent namespaces  NBT_* and DS_*
in the same flag.
Next commit will do that.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15972

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

printing: Fix compilation error for native 32-bit time_t

commit#e9a7dce599eb12d broke samba compilation for 32-bit time_t.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15976
Used correct pointer type to fix the warning to fix compialtion.

Pair-Programmed-With: Vinit Agnihotri <vagnihot@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Vinit Agnihotri <vagnihot@redhat.com>
Reviewed-by: Günther Deschner <gd@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Wed Jan 21 19:23:29 UTC 2026 on atb-devel-224

s3:libads: Do not reduce the page size in case of immediate timeouts

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Wed Jan 21 11:38:40 UTC 2026 on atb-devel-224

s3:libads: Fix trailing whitespaces in ldap_utils.c

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

s3:libads: Set NT_STATUS_UNSUCCESSFUL for IP address entry

This is what we do in libads/ldap.c too.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15975

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>

selftest: Set the ‘report_canonical_client_name’ option in krb5.conf

This will do something later when MIT Kerberos supports this option. For Heimdal
it shouldn’t make a difference.

Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org>
Autobuild-Date(master): Wed Jan 21 04:46:43 UTC 2026 on atb-devel-224

selftest: Add functionality for setting extra krb5.conf options

Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>

selftest: Disable implicit dollar match without canonicalization for promoted_dc

This puts promoted_dc and ad_dc_ntvfs in sync, and avoids an issue in the former
environment where the Heimdal KDC will use the smb.conf from one of the two DCs,
and the MIT KDC will use the smb.conf from the other.

Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>

s4:kdc: Return SDB_ERR_NOENTRY if canonicalization is required

MIT Kerberos maps this error code to KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN, avoiding
problems from the KDC returning KRB5KRB_ERR_GENERIC.

Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>

s4:test: Add kdc-canon-mit tests

These are modelled after the kdc-canon-heimdal tests.

Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>

selftest: Remove unused variables

These have gone unused since commit bd60c605ca1cf3f3568646dc3c0ca3501f0bfbec.

Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>

s3:lib: Remove unused code

Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>

lib:ldb-samba:ildap: fix empty attribute list handling

An LDB request interprets an empty attribute list as a request for no
attributes, but LDAP interprets an empty list as a request for all attributes,
and ["1.1"] as a request for no attributes, as per
RFC4511:4.5.1.8(SearchRequest.attributes).  We need to convert [] to ["1.1"]
in the ildap module before the request goes out.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13852

Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz>
Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org>
Autobuild-Date(master): Wed Jan 21 03:29:23 UTC 2026 on atb-devel-224

WHATSNEW: Start release notes for Samba 4.21.0pre1.

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Signed-off-by: Jule Anger <janger@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Björn Jacke <bjacke@samba.org>
Autobuild-Date(master): Tue Jan 20 15:00:48 UTC 2026 on atb-devel-224

VERSION: Bump version up to 4.25.0pre1...

and re-enable GIT_SNAPSHOT.

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Signed-off-by: Jule Anger <janger@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>

VERSION: Disable GIT_SNAPSHOT for the Samba 4.24.0rc1 release.

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Signed-off-by: Jule Anger <janger@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>

WHATSNEW: Up to Samba 4.24.0rc1.

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Signed-off-by: Jule Anger <janger@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>

tdb: version 1.4.15

tdb: Fix parse_hex during `tdbtool storehex`

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Signed-off-by: Jule Anger <janger@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>

lib: Delay get_iconv_handle() in strchr_m()

Do it the same way as in strrchr_m()

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Tue Jan 20 12:56:27 UTC 2026 on atb-devel-224

lib: Move a variable declaration closer to its use

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

lib: Remove extern const data_blob_null

This actually saves some .text bytes in the code referencing this constant. The
compiler should be smarter to do the right thing than to copy from a shared
location.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

lib: Remove &data_blob_null refs

The next patch will remove the data_blob_null global constant. The
APIs here are a bit weird in that they don't work fine with a NULL
pointer but require a reference to a NULL blob. But that's few enough
to add the special case in the callers.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

printing: Inline oneliners used just once

This patch and the 2 previous ones could be squashed, but it's the way those
unfolded :-)

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

printing: Simplify mapping permissions

Use security_acl_map_generic()

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

printing: Make structures const static

While there, remove an unused mapping

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

printing: Simplify file_version_is_newer()

We don't need to call fstat(), driver_unix_convert() already does it
via filename_convert_dirfsp().

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

printing: Make file_version_is_newer() more precise

We have timespec_compare, we don't have to loose info.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

printing: Fix file_version_is_newer()

fstring as a function parameter does not really make sense...

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

printing: Apply some const

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

printing: Simplify driver_unix_convert()

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>