samba.git/source4/lib, branch master

lib: Fix Coverity ID 1509061 Use of 32-bit time_t

2025-09-02T08:08:29+00:00

"man gnutls_x509_crt_set_serial" says that the serial number should be
a big-endian positive integer of up to 20 bytes....

Signed-off-by: Volker Lendecke 
Reviewed-by: Anoop C S

tls: Reorder macro for easier readability

2025-09-02T08:08:29+00:00

Signed-off-by: Volker Lendecke 
Reviewed-by: Anoop C S

tls: Make tstream_tls_params_quic_enabled a bit easier to read

2025-09-02T08:08:29+00:00

YMMV

Signed-off-by: Volker Lendecke 
Reviewed-by: Anoop C S

tls: Fix a printf sign mismatch

2025-09-02T08:08:28+00:00

Signed-off-by: Volker Lendecke 
Reviewed-by: Anoop C S

tls: Fix whitespace

2025-09-02T08:08:28+00:00

Signed-off-by: Volker Lendecke 
Reviewed-by: Anoop C S

s4:libsocket: better diagnostics for no interfaces

2025-08-26T22:42:39+00:00

Signed-off-by: Douglas Bagnall 
Reviewed-by: Jennifer Sutton

s4:lib/tls: add additional dns hostnames as GNUTLS_SAN_DNSNAME for self-signed certificates

2025-08-26T22:00:26+00:00

It's better to include X509v3 Subject Alternative Name with
DNS names also for additional dns hostnames.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15899

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Ralph Boehme 

Autobuild-User(master): Stefan Metzmacher 
Autobuild-Date(master): Tue Aug 26 22:00:26 UTC 2025 on atb-devel-224

s4:lib/tls: set GNUTLS_SAN_DNSNAME for self-signed certificates

2025-08-26T20:58:38+00:00

It's better to include X509v3 Subject Alternative Name with
DNS names in the self-signed certificate...

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15899

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Ralph Boehme

s4:lib/tls: let tstream_tls_params_server_lpcfg() use lpcfg_dns_hostname() internally

2025-08-26T20:58:37+00:00

This is simpler and the next step will also make use of
lpcfg_additional_dns_hostnames() too...

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15899

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Ralph Boehme

lib: tstream_tls_verify_peer_trusted()

2025-08-22T13:55:34+00:00

We can only trust a tls connection if at connection setup we checked
the certificates

Signed-off-by: Volker Lendecke 
Reviewed-by: Ralph Boehme