[PATCH] samba: Update to version 4.25.0

[Adolf Belka <adolf.belka@ipfire.org>]

- Update from version 4.24.7 to 4.25.0
- Update of all three rootfiles
- 1 CVE fix
- Changelog
4.25.0
SMB3 Persistent Handles (Experimental)
	Samba now includes experimental support for SMB3 Persistent Handles,
	a fundamental building block for Transparent Failover.
	Persistent Handles allow SMB clients to reconnect after a server
	restart or outage while retaining valid file handles. Samba persists
	all necessary handle state to durable on-disk storage so that open
	files can be reconstructed when clients reconnect. This enables
	applications that depend on uninterrupted file access, such as virtual
	machine storage and clustered database workloads, to tolerate
	temporary server failures without having to reopen files.
	Persistent Handles are advertised through the SMB3 protocol capability
	SMB2_CAP_PERSISTENT_HANDLES. To make use of them on a share, both the
	global "persistent handles" option and the per-share
	"continuous availability" option must be enabled.
	Because Persistent Handles require Samba to maintain SMB state, they
	are only available on shares configured for SMB-exclusive
	access. Specifically, they require:
	kernel oplocks = no
	kernel share modes = no
	posix locking = no
	These settings disable interoperability with local POSIX file access
	and NFS clients on the affected share.
	Administrators should be aware that Persistent Handles incur a
	significant performance cost. File handle metadata is synchronously
	persisted to durable storage for every open, update, lease, and close
	operation, increasing latency compared to traditional SMB file
	serving. For this reason, the feature is intended only for workloads
	that require Continuous Availability semantics and is not recommended
	for general-purpose file servers.
	On a cluster the handle state is kept in a volatile ctdb database that
	is replicated to every node, and additionally in a backup copy in a
	persistent ctdb database. Only that backup copy makes handles survive
	an outage of every node at the same time, for example a maintenance
	window in which the whole cluster is shut down and restarted, because
	that loses the volatile databases. Maintaining the backup is expensive:
	every change to the state of a persistent handle costs an additional
	cluster wide transaction, and that transaction is written to stable
	storage on every node.
	The new global option "persistent handles durability" to choose to
	which side of the tradeof, performance or durability, they want to
	lean on:
	persistent handles durability = full_outage
	  The default. The backup copy is maintained and handles survive an
	  outage of the whole cluster.
	persistent handles durability = partial_outage
	  The backup copy is not maintained. Handles survive any outage that
	  leaves at least one node running, which covers a node crash, a
	  rolling restart and the loss of all but one node, because the handle
	  state is still kept on every node of the cluster. Handles are lost if
	  every node is down at the same time. In exchange, every open, update,
	  lease and close operation becomes noticeably cheaper.
	This feature is currently considered experimental.
Cluster-wide rate limiting in vfs_aio_ratelimit
	The vfs_aio_ratelimit VFS module has been extended with cluster-wide
	coordination. When Samba clustering is enabled, the configured per-share rate
	limits are now enforced as a global ceiling across the entire cluster rather than
	per-node. Each share's limits are tracked and enforced independently.
	Coordination is handled by a new per-node daemon, ratelimitd, which aggregates
	activity from all smbd processes on the node and broadcasts node-level summaries
	to the rest of the cluster via Samba's messaging layer.
	To enable this feature, Samba must be built with --with-ratelimitd.
New Ceph RGW VFS module
	Introduced a new VFS module, vfs_ceph_rgw, which uses the librgw APIs to
	export Ceph Object Gateway buckets as SMB shares. It provides a hierarchical
	view of the objects stored in a bucket, allowing them to be accessed as files
	and folders. The module supports standard POSIX uids and gids, as well as most
	basic file operations.
JSON Audit logging
	The two leading spaces before the opening '{' on JSON audit log lines have been
	removed. And any embedded new line characters '\n' are converted to spaces.
Domain encryption types changed to AES by default
	The default value of the smb.conf option ‘kdc default domain supported
	enctypes’ now corresponds to ‘aes128-cts-hmac-sha1-96
	aes256-cts-hmac-sha1-96’ (both AES encryption types) if the domain
	functional level is 2008 or higher. This addresses CVE-2026-20833.
CTDB changes
	* CTDB's locations for locks, PID files and sockets now use ctdb/
	  subdirectories of the Samba locations configured at build time.
	  This means that the relevant top-level Samba configure options
	  (--with-lockdir, --with-piddir, --with-sockets-dir) are now also
	  used by CTDB.
	  The standalone CTDB build does not support these options.  However,
	  it is generally only used for developer/standalone testing.
	* The CTDB initscript (ctdb.init) has been moved to ctdb/doc/examples.
	  This recognises that it isn't installed by default so it is
	  basically unmaintained and untested.
	* Monitoring of (infrastructure) hosts is now supported.  A good use
	  of this is to monitor DNS servers.  See the NETWORK MONITORING
	  section in ctdb-script.options(5) for more details.
	* The detect_init_style() script function and associated
	  CTDB_INIT_STYLE variable are deprecated, so will be removed in a
	  future release.  Use the new, more general CTDB_PLATFORM_STYLE
	  variable instead.  This may affect site-local CTDB (event) scripts.
	  See ctdb.sysconfig(5) for more details.
Cluster functional level
	Samba now maintains a cluster functional level, a cluster wide value
	 that is kept as persistent global state and shared by all nodes. It
	 is similar in spirit to the domain and forest functional levels known
	 from Active Directory.
	The purpose of the functional level is to allow controlled upgrades
	 of a cluster. New database formats, new internal messages and other
	 changes that affect the communication between nodes are gated behind
	 an explicit raise of the cluster functional level. As long as the
	 level has not been raised, all nodes keep writing and sending the old
	 formats, so that nodes running different Samba versions can
	 interoperate during a rolling upgrade.
	A level consists of a major and a minor number, e.g. "1.0". Samba
	 4.25 implements the initial level 1.0, which is currently also the
	 only defined level.
	On a non-clustered server the highest supported level is always
	 activated automatically, there is nothing to configure or maintain.
	On a cluster the currently active level is stored persistently in
	 cluster_level.tdb. On a fresh cluster it is initialized with the
	 highest level supported by the second node that starts up. From then
	 on the level never changes on its own, it is only raised when an
	 administrator explicitly asks for it. A node that does not support
	 the currently active level refuses to start, which keeps a node
	 running an incompatible Samba version from joining the cluster.
	Once all nodes of a cluster have been upgraded to a new Samba
	 version, the administrator can raise the cluster functional level.
	The new 'net clusterlevel' subcommands are available for this:
	  net clusterlevel features
	        List the cluster functional levels supported by the
	        installed binaries.
	  net clusterlevel show
	        Show the currently active cluster functional level.
	  net clusterlevel showall
	        Show the levels supported by each node of the cluster,
	        together with the currently active level and the highest
	        level that could be activated.
	  net clusterlevel upgrade [--test] [--apply]
	        Raise the active cluster functional level to the highest
	        level supported by all nodes. With --test (the default) only
	        checks and reports whether the upgrade would be possible,
	        --apply performs the actual upgrade.
	Note that raising the cluster functional level is a one way
	 operation, there is no way to lower it again. It should only be done
	 once all nodes have been upgraded and the new version has proven to
	 work.
	The current implementation is deliberately strict: an upgrade is only
	 possible if all nodes announce the exact same set of supported
	 levels, which in practice means that all nodes run the same Samba
	 version.
	Also note that this change only prepares for the future. It
	 is not designed help with upgrades from older versions before
	 4.25 to 4.25 as a target. However vendors are free to use their
	 own backports and use custom levels >= 0.1 and < 1.0.
smb.conf changes
  Parameter Name                          Description     Default
  --------------                          -----------     -------
  allow dcerpc auth level connect         deprecated
  kdc default domain supported enctypes   New default     AES encryption types (if supported by domain)
  getwd cache                             Removed
  persistent handles                      New             no
  persistent handles durability           New             full_outage
  continuous availability                 New             no
bug fixes
   * BUG 16234: persistent handles options in WHATSNEW need fixups
   * BUG 16237: Bugs in Persistent Handles database layer code
   * BUG 16253: smbstatus byte-range locks broken by Persistent Handle changes
   * BUG 16233: "getwd cache" removal needs more work
   * BUG 15962: SMB3 SESSION SETUP responses must always be signed
   * BUG 16081: winbindd_child_msg_filter: talloc_get_type_abort crashes when
     winbind max domain connections > 1
   * BUG 16239: Fix parsing of uppercase "0X" hex values in the "kdc default
     domain      supported enctypes" smb.conf parameter.
   * BUG 16240: smbd temporary mkdir name can exceed NAME_MAX for otherwise
     valid client names
   * BUG 15988: Samba internal DNS service doesn't handle switch from UDP to TCP
     when packet is larger than 4k
   * BUG 16194: autobuild failures need to be reported in a more verbose way
   * BUG 16219: samba-cluster-support should depend on ndr-samba
   * BUG 16223: DNS scavenging happens even if fAging is FALSE
   * BUG 16226: samba-tool dns zoneoptions $DC_SERVER_IP
     _msdcs.addom.samba.example.com -P --aging=1 gives
     WERR_INTERNAL_DB_ERROR
   * BUG 16225: dns client problems related to EDNS usage

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 config/rootfiles/packages/aarch64/samba | 4 ++++
 config/rootfiles/packages/riscv64/samba | 4 ++++
 config/rootfiles/packages/x86_64/samba  | 4 ++++
 lfs/samba                               | 6 +++---
 4 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/config/rootfiles/packages/aarch64/samba b/config/rootfiles/packages/aarch64/samba
index 53f1263b1..007224d0a 100644
--- a/config/rootfiles/packages/aarch64/samba
+++ b/config/rootfiles/packages/aarch64/samba
@@ -215,10 +215,12 @@ usr/lib/python3.10/site-packages/samba/dcerpc/drsblobs.cpython-310-aarch64-linux
 usr/lib/python3.10/site-packages/samba/dcerpc/drsuapi.cpython-310-aarch64-linux-gnu.so
 usr/lib/python3.10/site-packages/samba/dcerpc/echo.cpython-310-aarch64-linux-gnu.so
 usr/lib/python3.10/site-packages/samba/dcerpc/epmapper.cpython-310-aarch64-linux-gnu.so
+usr/lib/python3.10/site-packages/samba/dcerpc/file_id.cpython-310-aarch64-linux-gnu.so
 usr/lib/python3.10/site-packages/samba/dcerpc/gkdi.cpython-310-aarch64-linux-gnu.so
 usr/lib/python3.10/site-packages/samba/dcerpc/gmsa.cpython-310-aarch64-linux-gnu.so
 usr/lib/python3.10/site-packages/samba/dcerpc/idmap.cpython-310-aarch64-linux-gnu.so
 usr/lib/python3.10/site-packages/samba/dcerpc/initshutdown.cpython-310-aarch64-linux-gnu.so
+usr/lib/python3.10/site-packages/samba/dcerpc/ioctl.cpython-310-aarch64-linux-gnu.so
 usr/lib/python3.10/site-packages/samba/dcerpc/irpc.cpython-310-aarch64-linux-gnu.so
 usr/lib/python3.10/site-packages/samba/dcerpc/keycredlink.cpython-310-aarch64-linux-gnu.so
 usr/lib/python3.10/site-packages/samba/dcerpc/krb5ccache.cpython-310-aarch64-linux-gnu.so
@@ -687,9 +689,11 @@ usr/lib/python3.10/site-packages/samba/tdb_util.py
 #usr/lib/python3.10/site-packages/samba/tests/netbios.py
 #usr/lib/python3.10/site-packages/samba/tests/netcmd.py
 #usr/lib/python3.10/site-packages/samba/tests/netlogonsvc.py
+#usr/lib/python3.10/site-packages/samba/tests/nps_echo_test.py
 #usr/lib/python3.10/site-packages/samba/tests/nss
 #usr/lib/python3.10/site-packages/samba/tests/nss/base.py
 #usr/lib/python3.10/site-packages/samba/tests/nss/group.py
+#usr/lib/python3.10/site-packages/samba/tests/ntacl_resource_attr_ace.py
 #usr/lib/python3.10/site-packages/samba/tests/ntacls.py
 #usr/lib/python3.10/site-packages/samba/tests/ntacls_backup.py
 #usr/lib/python3.10/site-packages/samba/tests/ntlm_auth.py
diff --git a/config/rootfiles/packages/riscv64/samba b/config/rootfiles/packages/riscv64/samba
index 8fe9cdeff..ee2d520ce 100644
--- a/config/rootfiles/packages/riscv64/samba
+++ b/config/rootfiles/packages/riscv64/samba
@@ -215,10 +215,12 @@ usr/lib/python3.10/site-packages/samba/dcerpc/drsblobs.cpython-310-riscv64-linux
 usr/lib/python3.10/site-packages/samba/dcerpc/drsuapi.cpython-310-riscv64-linux-gnu.so
 usr/lib/python3.10/site-packages/samba/dcerpc/echo.cpython-310-riscv64-linux-gnu.so
 usr/lib/python3.10/site-packages/samba/dcerpc/epmapper.cpython-310-riscv64-linux-gnu.so
+usr/lib/python3.10/site-packages/samba/dcerpc/file_id.cpython-310-riscv64-linux-gnu.so
 usr/lib/python3.10/site-packages/samba/dcerpc/gkdi.cpython-310-riscv64-linux-gnu.so
 usr/lib/python3.10/site-packages/samba/dcerpc/gmsa.cpython-310-riscv64-linux-gnu.so
 usr/lib/python3.10/site-packages/samba/dcerpc/idmap.cpython-310-riscv64-linux-gnu.so
 usr/lib/python3.10/site-packages/samba/dcerpc/initshutdown.cpython-310-riscv64-linux-gnu.so
+usr/lib/python3.10/site-packages/samba/dcerpc/ioctl.cpython-310-riscv64-linux-gnu.so
 usr/lib/python3.10/site-packages/samba/dcerpc/irpc.cpython-310-riscv64-linux-gnu.so
 usr/lib/python3.10/site-packages/samba/dcerpc/keycredlink.cpython-310-riscv64-linux-gnu.so
 usr/lib/python3.10/site-packages/samba/dcerpc/krb5ccache.cpython-310-riscv64-linux-gnu.so
@@ -687,9 +689,11 @@ usr/lib/python3.10/site-packages/samba/tdb_util.py
 #usr/lib/python3.10/site-packages/samba/tests/netbios.py
 #usr/lib/python3.10/site-packages/samba/tests/netcmd.py
 #usr/lib/python3.10/site-packages/samba/tests/netlogonsvc.py
+#usr/lib/python3.10/site-packages/samba/tests/nps_echo_test.py
 #usr/lib/python3.10/site-packages/samba/tests/nss
 #usr/lib/python3.10/site-packages/samba/tests/nss/base.py
 #usr/lib/python3.10/site-packages/samba/tests/nss/group.py
+#usr/lib/python3.10/site-packages/samba/tests/ntacl_resource_attr_ace.py
 #usr/lib/python3.10/site-packages/samba/tests/ntacls.py
 #usr/lib/python3.10/site-packages/samba/tests/ntacls_backup.py
 #usr/lib/python3.10/site-packages/samba/tests/ntlm_auth.py
diff --git a/config/rootfiles/packages/x86_64/samba b/config/rootfiles/packages/x86_64/samba
index 31677eb84..937d1ec54 100644
--- a/config/rootfiles/packages/x86_64/samba
+++ b/config/rootfiles/packages/x86_64/samba
@@ -215,10 +215,12 @@ usr/lib/python3.10/site-packages/samba/dcerpc/drsblobs.cpython-310-x86_64-linux-
 usr/lib/python3.10/site-packages/samba/dcerpc/drsuapi.cpython-310-x86_64-linux-gnu.so
 usr/lib/python3.10/site-packages/samba/dcerpc/echo.cpython-310-x86_64-linux-gnu.so
 usr/lib/python3.10/site-packages/samba/dcerpc/epmapper.cpython-310-x86_64-linux-gnu.so
+usr/lib/python3.10/site-packages/samba/dcerpc/file_id.cpython-310-x86_64-linux-gnu.so
 usr/lib/python3.10/site-packages/samba/dcerpc/gkdi.cpython-310-x86_64-linux-gnu.so
 usr/lib/python3.10/site-packages/samba/dcerpc/gmsa.cpython-310-x86_64-linux-gnu.so
 usr/lib/python3.10/site-packages/samba/dcerpc/idmap.cpython-310-x86_64-linux-gnu.so
 usr/lib/python3.10/site-packages/samba/dcerpc/initshutdown.cpython-310-x86_64-linux-gnu.so
+usr/lib/python3.10/site-packages/samba/dcerpc/ioctl.cpython-310-x86_64-linux-gnu.so
 usr/lib/python3.10/site-packages/samba/dcerpc/irpc.cpython-310-x86_64-linux-gnu.so
 usr/lib/python3.10/site-packages/samba/dcerpc/keycredlink.cpython-310-x86_64-linux-gnu.so
 usr/lib/python3.10/site-packages/samba/dcerpc/krb5ccache.cpython-310-x86_64-linux-gnu.so
@@ -687,9 +689,11 @@ usr/lib/python3.10/site-packages/samba/tdb_util.py
 #usr/lib/python3.10/site-packages/samba/tests/netbios.py
 #usr/lib/python3.10/site-packages/samba/tests/netcmd.py
 #usr/lib/python3.10/site-packages/samba/tests/netlogonsvc.py
+#usr/lib/python3.10/site-packages/samba/tests/nps_echo_test.py
 #usr/lib/python3.10/site-packages/samba/tests/nss
 #usr/lib/python3.10/site-packages/samba/tests/nss/base.py
 #usr/lib/python3.10/site-packages/samba/tests/nss/group.py
+#usr/lib/python3.10/site-packages/samba/tests/ntacl_resource_attr_ace.py
 #usr/lib/python3.10/site-packages/samba/tests/ntacls.py
 #usr/lib/python3.10/site-packages/samba/tests/ntacls_backup.py
 #usr/lib/python3.10/site-packages/samba/tests/ntlm_auth.py
diff --git a/lfs/samba b/lfs/samba
index c5220fc11..34d665914 100644
--- a/lfs/samba
+++ b/lfs/samba
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 4.24.7
+VER        = 4.25.0
 SUMMARY    = A SMB/CIFS File, Print, and Authentication Server
 
 THISAPP    = samba-$(VER)
@@ -33,7 +33,7 @@ DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
 PROG       = samba
-PAK_VER    = 124
+PAK_VER    = 125
 
 DEPS       = avahi libtalloc perl-Parse-Yapp wsdd
 
@@ -47,7 +47,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = 79f5093db219798081eddadf1c81c0337d97563bbd3f9047f14538c557c61b6d58dd57d97bde957a7d84f61f1fbe547cd85a4f6f1e4bff6fe4b86d0772223501
+$(DL_FILE)_BLAKE2 = 556455a628732a084826f2cf180c75071ad5f89f0bf8a0e728d79a450e0c1cbab6ba5869ec48816b2a886ad5b6d4db1a18a31d80ba7dc2f7972f4f0e470f67fb
 
 install : $(TARGET)
 
-- 
2.55.0