samba.git/source4/dns_server, branch master

s4/dns_server: truncate large dns packets over udp and set truncated flag

2026-04-01T05:08:14+00:00

Large DNS response must be truncated over UDP, letting client retry over TCP. Current threshold is set to 1232 as it is regarded as a safe size.
Truncated packets have no answers nor record, only the packet header and initial question(s).

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15988

Signed-off-by: Andréas Leroux 
Reviewed-by: Douglas Bagnall 
Reviewed-by: Gary Lockyer 

Autobuild-User(master): Jennifer Sutton 
Autobuild-Date(master): Wed Apr  1 05:08:14 UTC 2026 on atb-devel-224

Fix crash in DLZ plugin for incorrect setup

2025-09-20T06:49:37+00:00

When bind is not yet setup properly, logging errors should be done
through the temporary handle.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15920

Signed-off-by: Alexander Bokovoy 
Reviewed-by: Douglas Bagnall 

Autobuild-User(master): Douglas Bagnall 
Autobuild-Date(master): Sat Sep 20 06:49:37 UTC 2025 on atb-devel-224

s4/dns/dlz: log when falling back to obsolete dns ldb path

2025-03-29T18:05:29+00:00

Prior to 4.8 or so, the dlz dns files were kept in samba/private, but
sharing those files is a bit less than private so a new bind-dns
directory was added. As part of that patch set efforts were made to
fallback gracefully to the old locations. But now that silent grace is
causing confusion; the time has come to fallback resentfully.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15288

Signed-off-by: Douglas Bagnall 
Reviewed-by: Ralph Boehme

s4:dns_server: no-op dns updates with ACCESS_DENIED should be ignored

2024-06-06T03:18:16+00:00

If the client does not have permissions to update the record,
but the record already has the data the update tries to apply,
it's a no-op that should result in success instead of failing.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13019

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett 

Autobuild-User(master): Andrew Bartlett 
Autobuild-Date(master): Thu Jun  6 03:18:16 UTC 2024 on atb-devel-224

s4:dns_server: correctly sign dns update responses with gss-tsig like Windows

2024-06-06T02:13:33+00:00

This means we no longer generate strange errors/warnings
in the Windows event log nor in the nsupdate -g output.

Note: this is a only difference between gss-tsig and
the legacy gss.microsoft.com algorithms.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13019

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett

s4:dns_server: dns_verify_tsig should return REFUSED on error

2024-06-06T02:13:33+00:00

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13019

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett

s4:dns_server: also search DNS_QTYPE_TKEY in the answers section if it's the last section

2024-06-06T02:13:33+00:00

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13019

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett

s4:dns_server: use tkey->algorithm if available in dns_sign_tsig()

2024-06-06T02:13:33+00:00

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13019

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett

s4:dns_server: use the client provided algorithm for the fake TSIG structure

2024-06-06T02:13:33+00:00

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13019

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett

s4:dns_server: only allow gss-tsig and gss.microsoft.com for TSIG

2024-06-06T02:13:33+00:00

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13019

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett