vfs: Fix a lock order violation in unlinkat_acl_tdb()

unlinkat is called when the share mode record is locked.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=15791
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit 93bc238aa91ec8041648d17e11bf235132974eda)

smbd: fix handling of directory leases and oplock levels

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15836

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Fri Mar 28 07:53:25 UTC 2025 on atb-devel-224

(cherry picked from commit 4b3f45e13f9c11920924c034a457ea2cb8e15e18)

Autobuild-User(v4-22-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-22-test): Fri Mar 28 14:53:26 UTC 2025 on atb-devel-224

smbtorture: add test smb2.dirlease.oplocks

Verifies server correctly ignores oplock on directories and only grants leases.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15836

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit 9ecaa4095643729bf5f9c93316d577b603190449)

vfs_ceph_new: Add path based fallback for SMB_VFS_FNTIMES

Fallback mechanism was missing in vfs_ceph_fntimes() for path
based call.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15834

Signed-off-by: Anoop C S <anoopcs@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Mon Mar 17 20:48:55 UTC 2025 on atb-devel-224

(cherry picked from commit dbc48a4cda7489363688bb38f6fa678011fedfaf)

Autobuild-User(v4-22-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-22-test): Tue Mar 18 16:50:49 UTC 2025 on atb-devel-224

vfs_ceph_new: Add path based fallback for SMB_VFS_FCHMOD

Fallback mechanism was missing in vfs_ceph_fchmod() for path based call.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15834

Signed-off-by: Anoop C S <anoopcs@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
(cherry picked from commit 9c019ecf4eae6e6bef48323a0b093e17b0708ee8)

vfs_ceph_new: Add path based fallback for SMB_VFS_FCHOWN

Fallback mechanism was missing in vfs_ceph_fchown() for path based call.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15834

Signed-off-by: Anoop C S <anoopcs@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
(cherry picked from commit abb97683902f50b2a57989f30c0fb53fd3492af9)

s3/lib: fix matching interfaces with multiple assigned IPs

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15823

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Björn Jacke <bjacke@samba.org>
Reviewed-by: Martin Schwenke <martin@meltin.net>
Autobuild-User(master): Martin Schwenke <martins@samba.org>
Autobuild-Date(master): Wed Mar 12 01:32:30 UTC 2025 on atb-devel-224

(cherry picked from commit b85f056e7312ea9839b6fda617132fcc956da3c1)

vfs_ceph_new: detect case sensitivity in CephFS

CephFS has recently added support for case insensitive access to the
file system. This modification detects whether the shared volume is case
sensitive or not and reports the FILE_CASE_SENSITIVE_SEARCH capability
accordingly.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15822

Signed-off-by: Xavi Hernandez <xhernandez@redhat.com>
Reviewed-by: Anoop C S <anoopcs@redhat.com>
Reviewed-by: Guenther Deschner <gd@samba.org>
Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Tue Mar 11 20:34:26 UTC 2025 on atb-devel-224

(cherry picked from commit a52602030e6ba0e1bcddf5f611464b58076fadd0)

vfs_ceph_new: Do not resolve by inode number

CephFS snapshots within snap directory shares the same inode number from
its parent. Until unless we resolve by name we may incorrectly point at
an inode which is not a snapshot directory. Therefore to be functionally
correct we avoid resolving by inode number but proper name.

For example:

path (ino = 3)
  |
  --- dir (ino = 4)
  |
  --- .snap (ino = 3)
        |
        --- snap1 (ino = 3)
              |
              --- dir (ino = 4)

In this case an attempt to resolve 'snap1' by inode number 3 results in
pointing at 'path' which is not the desired outcome.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15818

Signed-off-by: Anoop C S <anoopcs@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Fri Mar  7 18:20:47 UTC 2025 on atb-devel-224

(cherry picked from commit a96f0542c8317a7dd0470b32350de6893fd98723)

Autobuild-User(v4-22-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-22-test): Thu Mar 13 17:06:25 UTC 2025 on atb-devel-224

vfs_ceph_new: Handle absolute path in vfs_ceph_ll_walk

It can very well be the case that the incoming path is absolute in
nature which breaks the assumption inside vfs_ceph_ll_walk that it
is within the current working directory. Instead perform a check to
see whether the path includes current working directory path in its
components and accordingly trim it to make it relative in nature.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15818

Signed-off-by: Anoop C S <anoopcs@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
(cherry picked from commit 9341d7fb466c95ea5aa0643049ce2a1f4183b9d0)

vfs_ceph_new: Remove unused code in cephmount_mount_fs()

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15818

Signed-off-by: Anoop C S <anoopcs@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
(cherry picked from commit ee1c3e1db9a2d12ba6d9dd24faccf0020b1daf0d)

vfs_ceph_new: Remove redundant re-intialization to NULL

TALLOC_FREE() by default re-initializes the pointer to NULL after
corresponding memory is freed.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15818

Signed-off-by: Anoop C S <anoopcs@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
(cherry picked from commit c5ddd94a08503a52914ce351ebf1083178e8c8bc)

vfs_ceph_new: use libcephfs nonblocking API for async-io ops

Use libcephfs non-blocking API (ceph_ll_nonblocking_readv_writev[1]) in
combination with smb VFS async hooks ({pread,pwrite,fsync}_send/_recv).
Fills libcephfs' struct ceph_ll_io_info with single iovec and
submit/complete the operation asynchronously on libcephfs side, with
corresponding tevent schedule-immediate upon completion on smbd side.

Control nonblocking/normal I/O mode via config parameter. The common
parts of async I/O (with/without HAVE_CEPH_ASYNCIO) are united.
Specifically, use same struct vfs_ceph_aio_state and common code via
helper function for all async I/O hooks. When HAVE_CEPH_ASYNCIO
is True _and_ config option 'asyncio = yes' use libcephfs asynchronous
I/O API. Otherwise, fake async operation using normal blocking APIs.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15810

[1] https://github.com/ceph/ceph/commit/b4e39f3eccd6734f1ed13c700c136e3aef1777f8

Signed-off-by: Shachar Sharon <ssharon@redhat.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Tue Mar  4 16:53:21 UTC 2025 on atb-devel-224

(cherry picked from commit 4ae9224138449fe7b8dd1e8ce8141aedd014efc4)

s3:utils: Remove call of ads_startup() from net_ads_keytab_create()

Calling ads_startup() is not needed in net_ads_keytab_create.  Keytab
creation code in sync_pw2keytabs() decides if it needs to talk to DC or
not and connects to AD accordingly.

Fixing this, makes the bug below easier to reproduce using
'net ads keytab create'.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15727

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Pavel Filipensky <pfilipensky@samba.org>
Autobuild-Date(master): Mon Mar 10 11:09:29 UTC 2025 on atb-devel-224

(cherry picked from commit 5cadaf91bc96cd2a8e0f6bcbd8a212e86b714180)

s3:libads: Make sure that REALM is always added to keytab principals

The code responsible for adding SPNs to keytab should always set the
REALM part.  Current code is not adding it for e.g. SPNs synced from AD.

If REALM is missing, krb5_parse_name() will succeed (and add the REALM)
only if the krb5.conf contains libdefaults section with
default_realm set and will fail otherwise. E.g.:

[libdefaults]
default_realm = SOMETESTDOMAIN1.MY.COM

When calling 'net ads join' we get the following error if SPN is missing
REALM and krb5.conf does not provide the default_realm:

pw2kt_process_add_info: Failed to parse principal:
RestrictedKrbHost/$MACHINE_NAME
Failed to join domain: failed to create kerberos keytab

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15727

Pair-Programmed-With: Noel Power <noel.power@suse.com>

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
Autobuild-User(master): Pavel Filipensky <pfilipensky@samba.org>
Autobuild-Date(master): Sun Mar  9 00:25:08 UTC 2025 on atb-devel-224

(cherry picked from commit c72554260c950d0ef7652955a59f0f68a026f4f2)

lib:krb5_wrap: Add smb_krb5_parse_name_flags()

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15727

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
(cherry picked from commit cf34645050df64d6b8c4fa45394c3feebe691e79)

VERSION: Bump version up to Samba 4.22.1...

and re-enable GIT_SNAPSHOT.

Signed-off-by: Jule Anger <janger@samba.org>

VERSION: Disable GIT_SNAPSHOT for the 4.22.0 release.

Signed-off-by: Jule Anger <janger@samba.org>

WHATSNEW: Add release notes for Samba 4.22.0.

Signed-off-by: Jule Anger <janger@samba.org>

WHATSNEW: mention schema upgrade speed improvements

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15821

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Autobuild-User(v4-22-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-22-test): Thu Mar  6 12:47:56 UTC 2025 on atb-devel-224

vfs_shadow_copy2: Use VFS interface to derive mount point

shadow_copy2_find_mount_point() does direct stat() calls locally while
trying to automatically detect the mount point. This cannot be always
true as there are virtual file systems like CephFS, GlusterFS etc.
without their share path locally available on the system. Instead use
the VFS interface to make the stat calls hit the underlying file system
irrespective of their local presence in the system.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15797

Signed-off-by: Anoop C S <anoopcs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Reviewed-by: John Mulligan <jmulligan@samba.org>
Autobuild-User(master): Anoop C S <anoopcs@samba.org>
Autobuild-Date(master): Fri Feb  7 06:23:12 UTC 2025 on atb-devel-224

(cherry picked from commit c7d0adade09fa264201a125b28dd76c163451260)

s3:smbd: disable "vfs mkdir use tmp name = auto" on OpenBSD

This is the simplest way to avoid a regression.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15801

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Ralph Boehme <slow@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Wed Mar  5 12:37:40 UTC 2025 on atb-devel-224

(cherry picked from commit a3f129f66346dcec41a01caf8060fe1a9da484ac)

Autobuild-User(v4-22-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-22-test): Wed Mar  5 15:13:18 UTC 2025 on atb-devel-224

ctdb-utils: Fix incorrect FSF address

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15820

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org>
Autobuild-Date(master): Wed Mar  5 03:40:15 UTC 2025 on atb-devel-224

(cherry picked from commit 9675d8aed8e3368f0a797490f3bf85d8026e5acc)

python:tdb_util: "samba-tool domain backup offline" hangs

GNU getopt(3) is by default non-POSIX compliant and accepts options after
positional arguments (unless forced with POSIXLY_CORRECT). This is not portable,
e..g., on FreeBSD. Put options first and then positional arguments.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15804

Signed-off-by: Andrea Venturoli <ml@netfence.it>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
(cherry picked from commit 7e083a6b3a12933b79ef19ccbd4c13bfa0203498)

Autobuild-User(v4-22-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-22-test): Tue Mar  4 14:57:29 UTC 2025 on atb-devel-224

VERSION: Bump version up to Samba 4.22.0rc5...

and re-enable GIT_SNAPSHOT.

Signed-off-by: Jule Anger <janger@samba.org>

VERSION: Disable GIT_SNAPSHOT for the 4.22.0rc4 release.

Signed-off-by: Jule Anger <janger@samba.org>

WHATSNEW: Add release notes for Samba 4.22.0rc4.

Signed-off-by: Jule Anger <janger@samba.org>

WHATSNEW: add himmelblaud

Signed-off-by: David Mulder <dmulder@samba.org>

WHATSNEW: add krb5 netlogon smb.conf options

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15815

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(v4-22-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-22-test): Wed Feb 26 10:09:36 UTC 2025 on atb-devel-224

s3:testparm: make it clear that 'client use krb5 netlogon' is experimental

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15815

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Mon Feb 24 08:43:55 UTC 2025 on atb-devel-224

(cherry picked from commit 154875244c5a349e04605cad1f66cb26aeaf86d7)

samba-tool/testparm: make it clear that 'client use krb5 netlogon' is experimental

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15815

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
(cherry picked from commit 5fc5f90dee13ab5168c22fd53b89c582f3d582e9)

docs-xml/smbdotconf: make it clear that 'client use krb5 netlogon' is experimental

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15815

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
(cherry picked from commit 54514ad809ef2e70b772906a815b27a0950a5341)

VERSION: Bump version up to Samba 4.22.0rc4...

and re-enable GIT_SNAPSHOT.

Signed-off-by: Jule Anger <janger@samba.org>

VERSION: Disable GIT_SNAPSHOT for the 4.22.0rc3 release.

Signed-off-by: Jule Anger <janger@samba.org>

WHATSNEW: Add release notes for Samba 4.22.0rc3.

Signed-off-by: Jule Anger <janger@samba.org>

python:lsa_utils: Fix fallback to OpenPolicy2

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15680

Pair-Programmed-With: Andreas Schneider <asn@samba.org>
Signed-off-by: Andreas Schneider <asn@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Mon Feb 17 18:33:15 UTC 2025 on atb-devel-224

(cherry picked from commit a814f5d90a3fb85a94c9516dba224037e8fd76f1)

Autobuild-User(v4-22-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-22-test): Thu Feb 20 11:22:18 UTC 2025 on atb-devel-224

python:lsa_utils: Don't use optional arguments for OpenPolicyFallback()

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15680

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit f9a3fc19f1e212c54351c3f94978e66fceeb8835)

pidl: Update documentation for DCERPC interface connections

https://realpython.com/documenting-python-code/

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15680

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit 73ce15e7d5b7ea867849f1aa4fa5390830660f11)

librpc:pyrpc: Allow new authenticated rpc connection on the same transport as the basis_connection

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15680

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit 2c171fb1b8c88034a98c3aaf052e99ba5dbbafd9)

dcesrv_core: Make dcesrv_call_disconnect_after() public

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15680

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit a094a29e426cc79e23bb4d866334d7735159fb41)

s3:rpc_client: Use cli_rpc_pipe_reopen_np_noauth() for OpenPolicy fallback

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15680

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit 3bbe35d42c4d4a0ce663580dfb035b6beb329ebb)

s3:rpc_cerver: Use dcerpc_lsa_open_policy3() for internal RPC

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15680

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit 0c68d9bc0cd5873f7b59be0fe93d64d6d47b5a57)

s3:rpc_client: Add cli_rpc_pipe_reopen_np_noauth()

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15680

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit d2ac6221db48b93581d7ce48d31f8851c88b77bc)

pytests: test pysmbd with relative path names via samba-tool ntacl

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15806

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Autobuild-User(master): Björn Baumbach <bb@sernet.de>
Autobuild-Date(master): Fri Feb 14 16:18:19 UTC 2025 on atb-devel-224

(cherry picked from commit 3e1c19c2c3f8b0bdf21301431bc886757fd4b3ce)

pysmbd: Fix interactive samba-tool use after 0bb35e246141

samba-tool ntacl also calls into pysmbd, and 0bb35e246141 broke
relative path names. Thanks to Björn Baumbach <bb@sernet.de> for
testing interactively!!

Bug: https://bugzilla.samba.org/show_bug.cgi?id=15806
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
(cherry picked from commit 26705d047cb885957a49939370e03047429351b6)

pytests: test pysmbd with non-existent file

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15807

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
(cherry picked from commit 334f621e4b74e9cda735982e223aefc7eefb4631)

pysmbd: Init mangle_fns

openat_pathref_fsp() eventually calls mangling functions, so we have
to initialize them.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=15807
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
(cherry picked from commit 0a9946258eb4587f5c132805d7c44062c377f375)

mdssvc: support a few more attributes

This adds support for the following Spotlight Metadata Attributes:

  _kMDItemFileName (another alias for kMDItemFSName and kMDItemDisplayName)
  kMDItemLastUsedDate
  kMDItemContentCreationDate
  kMDItemLogicalSize (another alias for kMDItemFSSize)

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15796

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit 0ba1a8d77694182058d1c01b54a8759bdf0e28a6)

Autobuild-User(v4-22-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-22-test): Mon Feb 17 17:21:35 UTC 2025 on atb-devel-224

ndr: fix coda logic around in ndr_pull_security_ace()

Sometimes an access allowed object ACE has unneeded trailing bytes,
like this:

                      aces: struct security_ace
                          type                     : SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT (5)
                          flags                    : 0x00 (0)
                                 0: SEC_ACE_FLAG_OBJECT_INHERIT
                                 0: SEC_ACE_FLAG_CONTAINER_INHERIT
                                 0: SEC_ACE_FLAG_NO_PROPAGATE_INHERIT
                                 0: SEC_ACE_FLAG_INHERIT_ONLY
                                 0: SEC_ACE_FLAG_INHERITED_ACE
                              0x00: SEC_ACE_FLAG_VALID_INHERIT (0)
                                 0: SEC_ACE_FLAG_SUCCESSFUL_ACCESS
                                 0: SEC_ACE_FLAG_FAILED_ACCESS
                          size                     : 0x0048 (72)
                          access_mask              : 0x00000100 (256)
                          object                   : union security_ace_object_ctr(case 1)
                          object: struct security_ace_object
                              flags                    : 0x00000001 (1)
                                     1: SEC_ACE_OBJECT_TYPE_PRESENT
                                     0: SEC_ACE_INHERITED_OBJECT_TYPE_PRESENT
                              type                     : union security_ace_object_type(case 1)
                              type                     : edacfd8f-ffb3-11d1-b41d-00a0c968f939
                              inherited_type           : union security_ace_object_inherited_type(case 0)
                          trustee                  : S-1-3-0
                          coda                     : union security_ace_coda(case 5)
                          ignored                  : DATA_BLOB length=32
  [0000] 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00   ........ ........
  [0010] 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00   ........ ........

which we need to pull in order to ignore.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15738

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Thu Feb 13 15:15:40 UTC 2025 on atb-devel-224

(cherry picked from commit 67b09b481b06080d3f46878d60095f188ff18fb8)
[bugzilla link added in backport]

pytest: add ndr packing tests for security descriptors

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15738

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Volker Lendecke <vl@samba.org>
(cherry picked from commit 455a0558c89312061f3b9ccaa577a4a60df7ee77)
[bugzilla link added in backport]

docs: Update documentation for 'sync machine password to keytab'

Use specifier 'spn_prefixes=host' instead of 'host'

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15759

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Pavel Filipensky <pfilipensky@samba.org>
Autobuild-Date(master): Sat Feb 15 19:21:56 UTC 2025 on atb-devel-224

(cherry picked from commit 7cae7aad1ca6dcd5e0a3a102f36af74fa49a2c2b)

s3:libads: Remove specifier for 'host' principal from 'sync machine password to keytab'

Use specifier 'spn_prefixes=host' instead of 'host'

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15759

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit ccc3b2b2fba7b5d223c79bffc0f655490aed19cf)

docs-xml:smbdotconf: Document new options for 'sync machinepassword to keytab'

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15759

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
Autobuild-User(master): Pavel Filipensky <pfilipensky@samba.org>
Autobuild-Date(master): Thu Feb 13 18:45:21 UTC 2025 on atb-devel-224

(cherry picked from commit 7a662e097be5e0d3f7779fa544486968b8f57063)

s3: Add new keytab specifiers

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15759

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
(cherry picked from commit 15e191736d3eaba83b2fb4b901e1df2214526b64)

vfs_ceph_new:minor logging improvement

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15703

Signed-off-by: Shweta Sodani <ssodani@redhat.com>
Reviewed-by: Anoop C S <anoopcs@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Fri Feb 14 10:57:50 UTC 2025 on atb-devel-224

(cherry picked from commit 6430e0a9fb7e9c368a3170f9cddd688a49aedb23)

VERSION: Bump version up to Samba 4.22.0rc3...

and re-enable GIT_SNAPSHOT.

Signed-off-by: Jule Anger <janger@samba.org>

VERSION: Disable GIT_SNAPSHOT for the 4.22.0rc2 release.

Signed-off-by: Jule Anger <janger@samba.org>

WHATSNEW: Add release notes for Samba 4.22.0rc2.

Signed-off-by: Jule Anger <janger@samba.org>

libnet4: free tevent request even on error

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15798

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Björn Baumbach <bb@sernet.de>
Autobuild-Date(master): Tue Feb 11 11:05:37 UTC 2025 on atb-devel-224

(cherry picked from commit 8f72b5673e6a26c5a6a69dbc56e91027d0dabe37)

Autobuild-User(v4-22-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-22-test): Wed Feb 12 11:37:37 UTC 2025 on atb-devel-224

libnet4: check return value of DC lookup

Avoids possible segmentation fault when the lookup fails.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15798

Pair-programmed-with: Volker Lendecke <vl@samba.org>
Signed-off-by: Volker Lendecke <vl@samba.org>
Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org>
Autobuild-Date(master): Sat Feb  8 03:30:27 UTC 2025 on atb-devel-224

(cherry picked from commit c5511056708fb1be3c2e1b2ad61af6643f92051c)

VERSION: Bump version up to Samba 4.22.0rc2...

and re-enable GIT_SNAPSHOT.

Signed-off-by: Jule Anger <janger@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>

VERSION: Disable GIT_SNAPSHOT for the Samba 4.22.0rc1 release.

Signed-off-by: Jule Anger <janger@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>

WHATSNEW: Up to Samba 4.22.0rc1.

Signed-off-by: Jule Anger <janger@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>

tevent: version 0.16.2

* Documentation fixes
* Add LGPLv3 LICENSE file

Signed-off-by: Jule Anger <janger@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>

talloc: version 2.4.3

* Testsuite and documenation fixes
* Add LGPLv3 LICENSE file

Signed-off-by: Jule Anger <janger@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>

tdb: version 1.4.13

* Add LGPLv3 LICENSE file

Signed-off-by: Jule Anger <janger@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>

vfs_gpfs: Remove one whitespace

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

gpfswrap: Remove unused gpfs_set_winattrs_path

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

gpfswrap: Remove unused gpfs_fstat_x

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

gpfswrap: Remove unused gpfs_stat_x wrapper

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

vfs_gpfs: Remove winattr calls from vfs_gpfs_fntimes

The call to the default function for fntimes already calls back into
fset_dos_attributes to set the create time. It is not necessary to
repeat the code in vfs_gpfs_fntimes.

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

vfs_gpfs: Set creation time from vfs_gpfs_fset_dos_attributes

This matches the default behavior of fset_dos_attributes and allows
removing the fallback case from vfs_gpfs_fntimes.

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

vfs_gpfs: Simplify vfs_gpfs_fset_dos_attributes

The gpfs_set_winattrs API call accepts O_PATH descriptors since GPFS
5.1.2, so switch to fsp_get_pathref_fd and remove the fallback logic.

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

vfs_gpfs: Use gpfs_get_winattrs instead of gpfs_fstat_x

gpfs_fstat_x had been introduced for querying additional inode
attributes for fileids. With the fileid code being removed, the simpler
gpfs_get_winattrs call can be used. gpfs_get_winattrs also accepts
O_PATH descriptors since GPFS 5.1.2.

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

vfs_gpfs: Remove pathref test

The gpfs_stat_x call O_PATH descriptors since GPFS 5.1.2.0 and will also
be replaced with a simpler API call that also accepts O_PATH
descriptors. Remove the pathref test that is no longer needed.

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

vfs_gpfs: Remove gpfs_stat_x fallback

Since GPFS 5.1.2 gpfs_stat_x accepts O_PATH descriptors so the fallback
case is no longer used and can be removed.

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

librpc/ndr: apply some const to ndr_push_union_blob()

Keep libndr at 6.0.0, this has not been released yet.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Thu Feb  6 10:45:52 UTC 2025 on atb-devel-224

vfs_gpfs: add gpfs:clamp_invalid_times

The timestamp validation added as part of the fix for bug 15151 causes hard
failures for certain clients that seem to use a temporary timestamp initially
when creating files, changing in a later step.

Clamp invalid timestamps to the allowed range 0..UINT32_MAX if
"gpfs:clamp_invalid_times = yes" is set.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15151

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Christof Schmitt <cs@samba.org>
Autobuild-User(master): Christof Schmitt <cs@samba.org>
Autobuild-Date(master): Wed Feb  5 23:42:15 UTC 2025 on atb-devel-224

ntvfs: Simplify rap_netshareenum()

I know, unused. But the whole point of strlcpy is that we don't need
this kind of calculation, and we should not leave this as a bad
example code in our tree.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Wed Feb  5 01:05:08 UTC 2025 on atb-devel-224

talloc: Add a comment explaining talloc_asprintf_addbuf()

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

smbd: Remove an unnecessary call to SMB_VFS_STAT()

smb_fname came out of filename_convert_dirfsp(), which already stat'ed
if the file exists. !VALID_STAT means new file.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

lib: Shrink .text a bit

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

vfs: Slightly simplify ad_get_meta_fsp()

Use cp_smb_filename_nostream()

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

vfs: Add some const

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

vfs: Align a few integer types

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

smbd: Remove vfs_file_exist()

Both callers followed this with SMB_VFS_CREATE_FILE which can be given
FILE_NON_DIRECTORY_FILE as an option to achieve the same.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

lib: Remove a pointer from R/W .data

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

lib: Move a pointer from .data to stack

Why was this declared static? ...

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

vfs: Remove a few calls to map_errno_from_nt_status()

That call always "feels" lossy to me, the other way around is better
defined.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

vfs: Slightly simplify catia_translate_name()

We have returned if !NT_STATUS_OK(status) a few lines above.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

lib: Convert string_replace_allocate() to return 0/errno

This is only used in the VFS, which is still in large parts
errno-based.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

vfs: Fix some whitespace

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

vfs: Fix some error path memleaks

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

libsmb: Save some bytes in .text code

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

lib: Fix typos

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

lib: Move 968 bytes from R/W data to R/O text

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

lib: Simplify ad_get_internal()

Remove an unnecessary variable

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

provision: always use a large transaction index cache

A larger cache costs more per transaction, but makes a large number
of operations within a transaction faster. We expect to be dealing
with the latter case here, regardless of the batch_mode parameter
and the database size. 200000 is chosen because it is also used in
join and schemaupgrade, and should be sufficient in most cases.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15795

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org>
Autobuild-Date(master): Tue Feb  4 22:47:35 UTC 2025 on atb-devel-224

netcmd: Increase the transaction_index_cache_size to 200k for schemaupgrade

Increasing this value greatly improve the performances of schema
upgrade for large domains (>200k entries).

The value 200000 is chosen because it is already used in join.py, and
should be sufficient for known domains.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15795

Signed-off-by: Andréas Leroux <aleroux@tranquil.it>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

s3:utils: Fix 'Usage:' for 'net ads enctypes'

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Pavel Filipensky <pfilipensky@samba.org>
Autobuild-Date(master): Tue Feb  4 09:35:58 UTC 2025 on atb-devel-224