                   ===============================
                   Release Notes for Samba 4.22.11
                           July 28, 2026
                   ===============================


This is a security release in order to address the following defects:

o CVE-2026-6949:   TSIG packet with name compression can crash DNS

                   Incorrect size calculations when a TSIG record contains
                   compressed names can lead to a large out-of-bounds write
                   causing the server to crash.

                   https://www.samba.org/samba/security/CVE-2026-6949.html


o CVE-2026-58216:  An authenticated user could possibly crash a KDC process

                   A kpasswd packet that contains malformed ASN.1 might cause
                   the server to access 6 bytes of unallocated memory. This
                   memory is not exposed to the user, but in some
                   circumstances the server could crash.

                   https://www.samba.org/samba/security/CVE-2026-58216.html


o CVE-2026-58218:  DNS signing DoS via TKEY name cache exhaustion

                   An unauthenticated user can repeatedly register names TKEY
                   names, which floods a cache causing legitimate TKEYs to be
                   expunged. This can practically block the use DNS TSIG
                   signing.

                   https://www.samba.org/samba/security/CVE-2026-58218.html


o CVE-2026-58221:  Samba AD authenticated LDAP access domain takeover

                   Samba AD low-privilege authenticated LDAP access allows
                   modifications to internal LDB special DNs, which permits a
                   domain takeover.

                   https://www.samba.org/samba/security/CVE-2026-58221.html


o CVE-2026-58222:  Samba AD LDAP Compare filter injection and trusted-request
                   confusion disclose protected attributes

                   An ordinary authenticated domain user can bypass access
                   checks and query confidential Active Directory attributes
                   (such as KDS root keys) via LDAP Compare requests. Due to a
                   filter injection flaw and trusted execution context, the
                   LDAP Compare operation can be turned into a
                   protected-attribute disclosure oracle.

                   https://www.samba.org/samba/security/CVE-2026-58222.html


o CVE-2026-58224   The CTDB protocol has bounds checking issues

                   CTDB fails to do integrity checking of received packets.
                   This includes failure to check field lengths against packet
                   lengths when unmarshalling packets.

                   https://www.samba.org/samba/security/CVE-2026-58224.html


Changes since 4.22.10
---------------------

o  Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
   * BUG 16087: CVE-2026-58216

o  Volker Lendecke <vl@samba.org>
   * BUG 16115: CVE-2026-58218

o  Stefan Metzmacher <metze@samba.org>
   * BUG 16083: CVE-2026-6949
   * BUG 16147: CVE-2026-58221
   * BUG 16148: CVE-2026-58222

o  Martin Schwenke <mschwenke@ddn.com>
   * BUG 16085: CVE-2026-58224

#######################################
Reporting bugs & Development Discussion
#######################################

Please discuss this release on the samba-technical mailing list or by
joining the #samba-technical:matrix.org matrix room, or
#samba-technical IRC channel on irc.libera.chat.

If you do report problems then please try to send high quality
feedback. If you don't provide vital information to help us track down
the problem then you will probably be ignored.  All bug reports should
be filed under the Samba 4.1 and newer product in the project's Bugzilla
database (https://bugzilla.samba.org/).


======================================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
======================================================================


Release notes for older releases follow:
----------------------------------------
                   ===============================
                   Release Notes for Samba 4.22.10
                            May 26, 2026
                   ===============================


This is a security release in order to address the following defects:

o CVE-2026-1933:   Missing access checks on reparse point operations

                   On a share marked "read only = yes" and
                   on file handles opened R/O users can set
                   or delete the reparse point xattrs on files
                   that the user has write-access in the file
                   system for.

                   https://www.samba.org/samba/security/CVE-2026-1933.html


o CVE-2026-2340:   WORM vfs module does not block overwrites

                   The WORM (Write-Once, Read Many) vfs module
                   is supposed to lock write access to shared
                   files, so they cannot be altered after initial
                   writes. It was allowing files to be overwritten
                   by renaming a newly created file over a protected
                   file.

                   https://www.samba.org/samba/security/CVE-2026-2340.html


o CVE-2026-3012:   auto-enrolment GPO installing CA certificate over http
                   without verification

                   To bootstrap a certificate chain a domain member must
                   fetch a certificate without TLS. It was trusting HTTP
                   for this when a more secure encrypted LDAP channel
                   was also available.

                   https://www.samba.org/samba/security/CVE-2026-3012.html


o CVE-2026-3238:   Denial of service against AD DC WINS server

                   The WINS server component of the Active
                   Directory Domain controller code in Samba
                   is vulnerable to a NULL pointer dereference
                   and crash caused by a unauthenticated UDP
                   packet.

                   https://www.samba.org/samba/security/CVE-2026-3238.html


o CVE-2026-4408:   Unauthenticated Remote Code Execution in Samba DCE/RPC SAMR
                   server

                   Samba file servers and classic (non-AD) domain controllers
                   with samba-dcerpcd started as a system service and with a
                   "check password script" that has the %u substitution
                   character are vulnerable to a remote code execution.

                   https://www.samba.org/samba/security/CVE-2026-4408.html


o CVE-2026-4480:   Unauthenticated Remote Code Execution in Samba printing
                   subsystem

                   Samba print servers with a "print command"
                   that has the %J substitution character
                   are vulnerable to a Remote Code Execution.

                   https://www.samba.org/samba/security/CVE-2026-4480.html


Changes since 4.22.9
--------------------

o  Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
   * BUG 15997: CVE-2026-2340
   * BUG 16003: CVE-2026-3012
   * BUG 16033: CVE-2026-4480
   * BUG 16034: CVE-2026-4408

o  Björn Jacke <bjacke@samba.org>
   * BUG 16057: autobuild fails if /proc/version contains trailing space

o  Pavel Kohout <pavel@aisle.com>
   * BUG 15997: CVE-2026-2340

o  Volker Lendecke <vl@samba.org>
   * BUG 15992: CVE-2026-1933
   * BUG 16012: CVE-2026-3238

o  Stefan Metzmacher <metze@samba.org>
   * BUG 15992: CVE-2026-1933
   * BUG 16033: CVE-2026-4480
   * BUG 16035: CVE-2026-4408
   * BUG 16073: Winbind can change Ownership Of / To A User Who has Homedir / In
     passwd


#######################################
Reporting bugs & Development Discussion
#######################################

Please discuss this release on the samba-technical mailing list or by
joining the #samba-technical:matrix.org matrix room, or
#samba-technical IRC channel on irc.libera.chat.

If you do report problems then please try to send high quality
feedback. If you don't provide vital information to help us track down
the problem then you will probably be ignored.  All bug reports should
be filed under the Samba 4.1 and newer product in the project's Bugzilla
database (https://bugzilla.samba.org/).


======================================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
======================================================================


----------------------------------------------------------------------
                   ==============================
                   Release Notes for Samba 4.22.9
                           April 09, 2026
                   ==============================


This is the latest stable release of the Samba 4.22 release series.


Changes since 4.22.8
--------------------

o  Ralph Boehme <slow@samba.org>
   * BUG 15978: leases torture test flappy

o  Volker Lendecke <vl@samba.org>
   * BUG 16019: incorrect behavior on rpcclient enumport with rpcd_spoolss

o  Noel Power <noel.power@suse.com>
   * BUG 15789: "use-kerberos=desired" broken
   * BUG 16042: rpc workers with long living clients grow server  memory keytab

o  Peter Schwenke <pschwenke@ddn.com>
   * BUG 15938: CTDB's statd_callout fails on sm-notify
   * BUG 15939: CTDB statd_callout_notify notifies unnecessary clients and loses
     their state

o  Martin Schwenke <mschwenke@ddn.com>
   * BUG 15939: CTDB statd_callout_notify notifies unnecessary clients and loses
     their state


#######################################
Reporting bugs & Development Discussion
#######################################

Please discuss this release on the samba-technical mailing list or by
joining the #samba-technical:matrix.org matrix room, or
#samba-technical IRC channel on irc.libera.chat.

If you do report problems then please try to send high quality
feedback. If you don't provide vital information to help us track down
the problem then you will probably be ignored.  All bug reports should
be filed under the Samba 4.1 and newer product in the project's Bugzilla
database (https://bugzilla.samba.org/).


======================================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
======================================================================


----------------------------------------------------------------------
                   ==============================
                   Release Notes for Samba 4.22.8
                         February 19, 2026
                   ==============================


This is the latest stable release of the Samba 4.22 release series.


Changes since 4.22.7
--------------------

o  Ralph Boehme <slow@samba.org>
   * BUG 15959: New Spotlight default search field incorrectly initialized
   * BUG 15984: smbd: in contend_dirleases() don't bother checking when not
     enabled

o  Samuel Cabrero <scabrero@samba.org>
   * BUG 15979: possible memory leak  on rpc_spoolss

o  Günther Deschner <gd@samba.org>
   * BUG 15964: "net offlinejoin requestodj" manpage entry incorrectly mentiones
     provided credentials

o  Pavel Filipenský <pfilipensky@samba.org>
   * BUG 15972: Winbind group resolution failure

o  Noel Power <noel.power@suse.com>
   * BUG 15979: possible memory leak  on rpc_spoolss

o  Martin Schwenke <mschwenke@ddn.com>
   * BUG 15977: ctdbd socket documentation is wrong

o  Michael Tokarev <mjt@tls.msk.ru>
   * BUG 15790: Bind dlz 9.20


#######################################
Reporting bugs & Development Discussion
#######################################

Please discuss this release on the samba-technical mailing list or by
joining the #samba-technical:matrix.org matrix room, or
#samba-technical IRC channel on irc.libera.chat.

If you do report problems then please try to send high quality
feedback. If you don't provide vital information to help us track down
the problem then you will probably be ignored.  All bug reports should
be filed under the Samba 4.1 and newer product in the project's Bugzilla
database (https://bugzilla.samba.org/).


======================================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
======================================================================


----------------------------------------------------------------------
                   ==============================
                   Release Notes for Samba 4.22.7
                         December 18, 2025
                   ==============================


This is the latest stable release of the Samba 4.22 release series.


Changes since 4.22.6
--------------------

o  Ralph Boehme <slow@samba.org>
   * BUG 15926: Samba 4.22 breaks Time Machine
   * BUG 15930: Searching for numbers doesn't work with Spotlight
   * BUG 15947: mdssvc doesn't support $time.iso dates before 1970

o  Günther Deschner <gd@samba.org>
   * BUG 15963: Fix winbind cache consistency

o  Pavel Filipenský <pfilipensky@samba.org>
   * BUG 15940: vfs_recycle does not update mtime

o  Volker Lendecke <vl@samba.org>
   * BUG 15897: Assert failed: (dirfd != -1) || (smb_fname->base_name[0] == '/')
     in vfswrap_openat
   * BUG 15950: ctdb can crash with inconsistent cluster lock configuration

o  Anoop C S <anoopcs@samba.org>
   * BUG 15897: Assert failed: (dirfd != -1) || (smb_fname->base_name[0] == '/')
     in vfswrap_openat

o  Andreas Schneider <asn@samba.org>
   * BUG 15809: samba-bgqd: rework man page
   * BUG 15936: samba-bgqd can't find [printers] share
   * BUG 15955: Winbind can hang forever in gssapi if there are network issues.
   * BUG 15961: libldb requires linking libreplace on Linux

o  Martin Schwenke <mschwenke@ddn.com>
   * BUG 15935: Crash in ctdbd on failed updateip


#######################################
Reporting bugs & Development Discussion
#######################################

Please discuss this release on the samba-technical mailing list or by
joining the #samba-technical:matrix.org matrix room, or
#samba-technical IRC channel on irc.libera.chat.

If you do report problems then please try to send high quality
feedback. If you don't provide vital information to help us track down
the problem then you will probably be ignored.  All bug reports should
be filed under the Samba 4.1 and newer product in the project's Bugzilla
database (https://bugzilla.samba.org/).


======================================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
======================================================================


----------------------------------------------------------------------
                   ==============================
                   Release Notes for Samba 4.22.6
                          October 16, 2025
                   ==============================


This is the latest stable release of the Samba 4.22 release series.


Changes since 4.22.5
--------------------

o  Ralph Boehme <slow@samba.org>
   * BUG 15843: macOS Finder client DFS broken on 4.22.0.
   * BUG 15926: Samba 4.22 breaks Time Machine
   * BUG 15927: Spotlight search restriction for shares incomplete and default
     search searches in too many attributes
   * BUG 15931: rpcd_mdssvc may crash because name mangling is not initialized
   * BUG 15933: Only increment lease epoch if a lease was granted

o Pavel Filipenský <pfilipensky@samba.org>
   * BUG 15905: samba-4.21 fails to join AD when multiple DCs are returned

o MikeLiu <mikeliu@qnap.com>
   * BUG 15900: 'net ads group' failed to list domain groups.

o Anoop C S <anoopcs@samba.org>
   * BUG 15919: vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev for
     fsync_send.

o Shachar Sharon <ssharon@redhat.com>
   * BUG 15919: vfs_ceph_new should not use ceph_ll_nonblocking_readv_writev for
     fsync_send.

o Andreas Schneider <asn@samba.org>
   * BUG 15905: samba-4.21 fails to join AD when multiple DCs are returned

o Martin Schwenke <mschwenke@ddn.com>
   * BUG 15921: CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set.

#######################################
Reporting bugs & Development Discussion
#######################################

Please discuss this release on the samba-technical mailing list or by
joining the #samba-technical:matrix.org matrix room, or
#samba-technical IRC channel on irc.libera.chat.

If you do report problems then please try to send high quality
feedback. If you don't provide vital information to help us track down
the problem then you will probably be ignored.  All bug reports should
be filed under the Samba 4.1 and newer product in the project's Bugzilla
database (https://bugzilla.samba.org/).


======================================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
======================================================================


----------------------------------------------------------------------
                   ==============================
                   Release Notes for Samba 4.22.5
                          October 15, 2025
                   ==============================


This is a security release in order to address the following defects:

o CVE-2025-9640:  Uninitialized memory disclosure via vfs_streams_xattr.
                  https://www.samba.org/samba/security/CVE-2025-9640.html

o CVE-2025-10230: Command injection via WINS server hook script.
                  https://www.samba.org/samba/security/CVE-2025-10230.html


Changes since 4.22.4
--------------------

o  Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
   * BUG 15903: CVE-2025-10230.

o  Andrew Walker <andrew.walker@truenas.com>
   * BUG 15885: CVE-2025-9640.


#######################################
Reporting bugs & Development Discussion
#######################################

Please discuss this release on the samba-technical mailing list or by
joining the #samba-technical:matrix.org matrix room, or
#samba-technical IRC channel on irc.libera.chat.

If you do report problems then please try to send high quality
feedback. If you don't provide vital information to help us track down
the problem then you will probably be ignored.  All bug reports should
be filed under the Samba 4.1 and newer product in the project's Bugzilla
database (https://bugzilla.samba.org/).


======================================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
======================================================================


----------------------------------------------------------------------
                   ==============================
                   Release Notes for Samba 4.22.4
                          August 21, 2025
                   ==============================


This is the latest stable release of the Samba 4.22 release series.


Changes since 4.22.3
--------------------

o  Ralph Boehme <slow@samba.org>
   * BUG 14981: netr_LogonSamLogonEx returns NR_STATUS_ACCESS_DENIED with
     SysvolReady=0.
   * BUG 15844: getpwuid does not shift to new DC when current DC is down.
   * BUG 15876: Windows security hardening locks out schannel'ed netlogon dc
     calls like netr_DsRGetDCName-
   * BUG 15881: Unresponsive second DC can cause idmapping failure when using
     idmap_ad-

o  Günther Deschner <gd@samba.org>
   * BUG 15840: kinit command is failing with Missing cache Error.

o  Pavel Filipenský <pfilipensky@samba.org>
   * BUG 15891: Figuring out the DC name from IP address fails and breaks
     fork_domain_child().

o  Volker Lendecke <vl@samba.org>
   * BUG 15816: vfs_streams_depot fstatat broken.
   * BUG 15892: Delayed leader broadcast can block ctdb forever.

o  Stefan Metzmacher <metze@samba.org>
   * BUG 14981: netr_LogonSamLogonEx returns NR_STATUS_ACCESS_DENIED with
     SysvolReady=0.

o  Rabinarayan Panigrahi <rapanigr@redhat.com>
   * BUG 15663: Apparently there is a conflict between shadow_copy2 module and
     virusfilter (action quarantine).

o  Aleksandr Sharov <asharov@redhat.com>
   * BUG 15877: Fix handling of empty GPO link.

o  Srinivas Rao V <Srinivas.Rao.V@ibm.com>
   * BUG 15880: SMB ACL inheritance doesn't work for files created.


#######################################
Reporting bugs & Development Discussion
#######################################

Please discuss this release on the samba-technical mailing list or by
joining the #samba-technical:matrix.org matrix room, or
#samba-technical IRC channel on irc.libera.chat.

If you do report problems then please try to send high quality
feedback. If you don't provide vital information to help us track down
the problem then you will probably be ignored.  All bug reports should
be filed under the Samba 4.1 and newer product in the project's Bugzilla
database (https://bugzilla.samba.org/).


======================================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
======================================================================


----------------------------------------------------------------------
                   ==============================
                   Release Notes for Samba 4.22.3
                           July 07, 2025
                   ==============================


This is the latest stable release of the Samba 4.22 release series.


Important Change in Upcoming Microsoft Update
---------------------------------------------

On 8th of July, Microsoft will release an important security update for
Active Directory Domain Controllers for Windows Server versions prior to
2025.

This update includes a change to the Microsoft RPC Netlogon protocol,
which improves security by tightening access checks for a set of RPC
requests. Samba running as domain members in these environments will be
impacted by this change if a specific configuration is used, see below
for which configuration is affected.

Windows Server version 2025 is already equipped with these specific
security hardenings, and Microsoft is now planning to deploy them to all
supported Windows Server versions down to Windows Server 2008.


Who is affected?

Samba installations acting as member servers in Windows AD domains will
be affected if they are configured to use the 'ad' idmapping backend.
Samba servers not using this configuration will not be affected by the
change – at least to our current knowledge and understanding of the
change – and no further action is required.

Current versions of Samba with the affected configuration will no longer
function correctly once the Microsoft update has been applied. Users
will not be able to connect to the SMB service provided by Samba for any
domain configured to use the 'ad' idmapping backend.

See https://bugzilla.samba.org/show_bug.cgi?id=15876.


Changes since 4.22.2
--------------------

o  Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
   * BUG 15854: samba-tool cannot add user to group whose name is exactly 16
     characters long.

o  Günther Deschner <gd@samba.org>
   * BUG 15876: Windows security hardening locks out schannel'ed netlogon dc
     calls like netr_DsRGetDCName.

o  Stefan Metzmacher <metze@samba.org>
   * BUG 15876: Windows security hardening locks out schannel'ed netlogon dc
     calls like netr_DsRGetDCName.

o  Andreas Schneider <asn@samba.org>
   * BUG 15869: Startup messages of rpc daemons fills /var/log/messages.


#######################################
Reporting bugs & Development Discussion
#######################################

Please discuss this release on the samba-technical mailing list or by
joining the #samba-technical:matrix.org matrix room, or
#samba-technical IRC channel on irc.libera.chat.

If you do report problems then please try to send high quality
feedback. If you don't provide vital information to help us track down
the problem then you will probably be ignored.  All bug reports should
be filed under the Samba 4.1 and newer product in the project's Bugzilla
database (https://bugzilla.samba.org/).


======================================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
======================================================================


----------------------------------------------------------------------
                   ==============================
                   Release Notes for Samba 4.22.2
                           June 05, 2025
                   ==============================


This is the latest stable release of the Samba 4.22 release series.
It contains the security-relevant bugfix CVE-2025-0620:

    smbd doesn't pick up group membership changes
    when re-authenticating an expired SMB session
    https://www.samba.org/samba/security/CVE-2025-0620.html


Description of CVE-2025-0620
-----------------------------

    With Kerberos authentication SMB sessions typically have an
    associated lifetime, requiring re-authentication by the
    client when the session expires. As part of the
    re-authentication, Samba receives the current group
    membership information and is expected to reflect this
    change in further SMB request processing.

    For historic reasons, Samba maintains a cache of
    associations between a user's impersonation information and
    connected shares. A recent change in this cache caused Samba
    to not reflect group membership changes from session
    re-authentication when processing further SMB requests.

    As a result, when an administrator removes a user from a
    particular group in Active Directory, this change will not
    become effective unless the user disconnects from the server
    and establishes a new connection.


Changes since 4.22.1
--------------------

o  Ralph Boehme <slow@samba.org>
   * BUG 15707: (CVE-2025-0620) [SECURITY] CVE-2025-0620: smbd doesn't pick up
     group membership changes when re-authenticating an expired SMB
     session.
   * BUG 15861: Profile sync fails due to Directory Leases.

o  Pavel Filipenský <pfilipensky@samba.org>
   * BUG 15727: net ad join fails with "Failed to join domain: failed to create
     kerberos keytab".

o  Stefan Metzmacher <metze@samba.org>
   * BUG 15851: dcerpcd not able to bind to listening port.

o  Anoop C S <anoopcs@samba.org>
   * BUG 15819: vfs_ceph_snapshots fails to list snapshots for entries at any
     level beyond share root.

o  Martin Schwenke <mschwenke@ddn.com>
   * BUG 15858: CTDB does not put nodes running NFS into grace on graceful
     shutdown.


#######################################
Reporting bugs & Development Discussion
#######################################

Please discuss this release on the samba-technical mailing list or by
joining the #samba-technical:matrix.org matrix room, or
#samba-technical IRC channel on irc.libera.chat.

If you do report problems then please try to send high quality
feedback. If you don't provide vital information to help us track down
the problem then you will probably be ignored.  All bug reports should
be filed under the Samba 4.1 and newer product in the project's Bugzilla
database (https://bugzilla.samba.org/).


======================================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
======================================================================


----------------------------------------------------------------------
                   ==============================
                   Release Notes for Samba 4.22.1
                           April 17, 2025
                   ==============================


This is the latest stable release of the Samba 4.22 release series.


Changes since 4.22.0
--------------------

o  Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
   * BUG 15774: Running "gpo manage motd set" twice fails with backtrace.
   * BUG 15829: samba-tool gpo backup creates entity backups it can't read.
   * BUG 15839: gp_cert_auto_enroll_ext.py has problem unpacking GUIDs with
     prepended 0's.

o  Ralph Boehme <slow@samba.org>
   * BUG 15767: Deadlock between two smbd processes.
   * BUG 15823: Subnet based interfaces definition not listening on all covered
     IP addresses.
   * BUG 15836: PANIC: assert failed at source3/smbd/smb2_oplock.c(156):
     sconn->oplocks.exclusive_open>=0.

o  Pavel Filipenský <pfilipensky@samba.org>
   * BUG 15727: net ad join fails with "Failed to join domain: failed to create
     kerberos keytab".

o  Andreas Hasenack <andreas.hasenack@canonical.com>
   * BUG 15774: Running "gpo manage motd set" twice fails with backtrace.

o  Xavi Hernandez <xhernandez@redhat.com>
   * BUG 15822: Enable support for cephfs case insensitive behavior.

o  Volker Lendecke <vl@samba.org>
   * BUG 15791: Remove of file or directory not possible with vfs_acl_tdb.
   * BUG 15841: Wide link issue in samba 4.22.

o  Stefan Metzmacher <metze@samba.org>
   * BUG 15767: Deadlock between two smbd processes.
   * BUG 15845: NT_STATUS_INVALID_PARAMETER: Can't create folders on share of an
     exfat file system.
   * BUG 15849: Lease code is not endian-safe.

o  Anoop C S <anoopcs@samba.org>
   * BUG 15818: vfs_ceph_new module does not work with other modules for
     snapshot management.
   * BUG 15834: vfs_ceph_new: Add path based fallback for SMB_VFS_FCHOWN,
     SMB_VFS_FCHMOD and SMB_VFS_FNTIMES.

o  Shachar Sharon <ssharon@redhat.com>
   * BUG 15810: Add async io API from libcephfs to ceph_new VFS module.


#######################################
Reporting bugs & Development Discussion
#######################################

Please discuss this release on the samba-technical mailing list or by
joining the #samba-technical:matrix.org matrix room, or
#samba-technical IRC channel on irc.libera.chat.

If you do report problems then please try to send high quality
feedback. If you don't provide vital information to help us track down
the problem then you will probably be ignored.  All bug reports should
be filed under the Samba 4.1 and newer product in the project's Bugzilla
database (https://bugzilla.samba.org/).


======================================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
======================================================================


----------------------------------------------------------------------
                   ==============================
                   Release Notes for Samba 4.22.0
                          March 06, 2025
                   ==============================


This is the first stable release of the Samba 4.22 release series.
Please read the release notes carefully before upgrading.


NEW FEATURES/CHANGES
====================

SMB3 Directory Leases
---------------------

Starting with Samba 4.22 SMB3 Directory Leases are supported. The new global
option "smb3 directory leases" controls whether the feature is enabled or
not. By default, SMB3 Directory Leases are enabled on non-clustered Samba and
disabled on clustered Samba, based on the "clustering" option. See man smb.conf
for more details.

SMB3 Directory Leases allow clients to cache directory listings and, depending
on the workload, result in a decent reduction in SMB requests from clients.

Netlogon Ping over LDAP and LDAPS
---------------------------------

Samba must query domain controller information via simple queries on
the AD rootdse's netlogon attribute. Typically this is done via
connectionless LDAP, using UDP on port 389. The same information is
also available via classic LDAP rootdse queries over TCP. Samba can
now be configured to use TCP via the new "client netlogon ping
protocol" parameter to enable running in environments where firewalls
completely block port 389 or UDP traffic to domain controllers.

Experimental Himmelblaud Authentication in Samba
------------------------------------------------

Samba now includes experimental support for Azure Entra ID authentication via
`himmelblaud`, located in the `rust/` directory. This implementation provides
basic authentication and is configured through `smb.conf`, utilizing options
such as `realm`, `winbindd_socket_directory`, and `template_homedir`. New global
parameters include `himmelblaud_sfa_fallback`, `himmelblaud_hello_enabled`, and
`himmelblaud_hsm_pin_path`.
To enable, configure Samba with `--enable-rust --with-himmelblau`.

AD DC schema upgrade and provision performance improvements
-----------------------------------------------------------

By increasing the LDB index cache size for certain offline operations
that are likely to require large transactions, these are now several
times faster.


REMOVED FEATURES
================

The "nmbd proxy logon" feature was removed. This was used before
Samba4 acquired a NBT server.

The parameter "cldap port" has been removed. CLDAP runs over UDP port
389, we don't see a reason why this should ever be changed to a
different port. Moreover, we had several places in the code where
Samba did not respect this parameter, so the behaviour was at least
inconsistent.

fruit:posix_rename
------------------

This option of the vfs_fruit VFS module that could be used to enable POSIX
directory rename behaviour for OS X clients has been removed as it could result
in severe problems for Windows clients.

As a possible workaround it is possible to prevent creation of .DS_Store files
(a Finder thingy to store directory view settings) on network mounts by running

  $ defaults write com.apple.desktopservices DSDontWriteNetworkStores true

on the Mac.


smb.conf changes
================

  Parameter Name                          Description     Default
  --------------                          -----------     -------
  smb3 directory leases                   New             Auto
  vfs mkdir use tmp name                  New             Auto
  client netlogon ping protocol           New             cldap
  himmelblaud hello enabled               New             no
  himmelblaud hsm pin path                New             default hsm pin path
  himmelblaud sfa fallback                New             no
  client use krb5 netlogon                Experimental    no
  reject aes netlogon servers             Experimental    no
  server reject aes schannel              Experimental    no
  server support krb5 netlogon            Experimental    no
  fruit:posix_rename                      Removed
  cldap port                              Removed


CHANGES SINCE 4.22.0rc4
=======================

o  Ralph Boehme <slow@samba.org>
   * BUG 15801: `NT_STATUS_ACCESS_DENIED making remote directory` on OpenBSD.

o  Anoop C S <anoopcs@samba.org>
   * BUG 15797: Unable to connect to CephFS subvolume shares with
     vfs_shadow_copy2.

o  Stefan Metzmacher <metze@samba.org>
   * BUG 15801: `NT_STATUS_ACCESS_DENIED making remote directory` on OpenBSD.

o  Martin Schwenke <mschwenke@ddn.com>
   * BUG 15820: Incorrect FSF address in ctdb pcp scripts.

o  Andrea Venturoli <ml@netfence.it>
   * BUG 15804: "samba-tool domain backup offline" hangs.


CHANGES SINCE 4.22.0rc3
=======================

o  Stefan Metzmacher <metze@samba.org>
   * BUG 15815: client use krb5 netlogon is experimental and should not be used
     in production.


CHANGES SINCE 4.22.0rc2
=======================

o  Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
   * BUG 15738: Creation of GPOs applicable to more than one group is impossible
     with Samba 4.20.0 and later.

o  Björn Baumbach <bb@sernet.de>
   * BUG 15806: samba-tool acl commands broken for relative path names
   * BUG 15807: pysmbd seg faults when file is not found.

o  Ralph Boehme <slow@samba.org>
   * BUG 15796: Spotlight search results don't show file size and creation date.

o  Pavel Filipenský <pfilipensky@samba.org>
   * BUG 15759: net ads create/join/winbind producing unix dysfunctional
     keytabs.

o  Volker Lendecke <vl@samba.org>
   * BUG 15806: samba-tool acl commands broken for relative path names.
   * BUG 15807: pysmbd seg faults when file is not found.

o  Stefan Metzmacher <metze@samba.org>
   * BUG 15680: Trust domains are not created.

o  Andreas Schneider <asn@samba.org>
   * BUG 15680: Trust domains are not created.

o  Shweta Sodani <ssodani@redhat.com>
   * BUG 15703: General improvements for vfs_ceph_new module.


CHANGES SINCE 4.22.0rc1
=======================

o  Björn Baumbach <bb@sernet.de>
   * BUG 15798: libnet4: seg fault after dc lookup failure


KNOWN ISSUES
============

https://wiki.samba.org/index.php/Release_Planning_for_Samba_4.22#Release_blocking_bugs


#######################################
Reporting bugs & Development Discussion
#######################################

Please discuss this release on the samba-technical mailing list or by
joining the #samba-technical:matrix.org matrix room, or
#samba-technical IRC channel on irc.libera.chat

If you do report problems then please try to send high quality
feedback. If you don't provide vital information to help us track down
the problem then you will probably be ignored.  All bug reports should
be filed under the Samba 4.1 and newer product in the project's Bugzilla
database (https://bugzilla.samba.org/).


======================================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
======================================================================
