v0.6.0

This release makes NFS filehandles recoverable across restarts and gets the experimental SMB server through its real Linux CIFS acceptance path with required SMB 3.1.1 signing.

NFS filehandles across restarts

A fixed nfs4.Server.HandleKey already gives short filehandles a stable seal. This release makes that guarantee explicit and adds Server.ResolveLongHandle, an optional callback that maps the SHA-256 stored in a long filehandle back to its served path.

Long paths normally depend on a bounded in-memory lookup table, so their handles expire after a restart or table eviction. Applications with their own path index can now restore those handles without weakening validation: the server hashes the returned path and ignores a resolver result that does not match the sealed digest. Resolved paths are cached again so the callback does not remain on the hot path.

Tests cover short-handle restart stability, long-handle restart recovery, eviction recovery, caching, and rejection of mismatched resolver paths.

SMB 3.1.1 Linux interoperability

The new scripts/smb-smoke-linux.sh mounts the example server through a real Linux kernel CIFS client in Docker with signing required. It exercises listing, reads, an 8 MiB copy in both directions, rename and delete, nested directory operations, a 300-entry directory, and unmount/remount persistence.

That real-client path exposed and fixed several independent protocol issues:

• The SMB 3.1.1 SP 800-108 signing KDF now includes the null terminator required by the SMBSigningKey label. A known-answer test pins the key derived by a real client.
• Raw NTLM clients receive raw NTLM challenge and completion framing, while SPNEGO clients continue to receive SPNEGO wrappers.
• Advertising signing support no longer forces every request to be signed. Required sessions still reject unsigned requests, and any request carrying a signature is verified and receives a signed response.
• Directory entries and file-information replies now report the same stable file identity, avoiding Linux ESTALE failures before a read.
• Multi-credit requests reserve their full consecutive message-ID range, so large transfers no longer leave artificial gaps that eventually close an otherwise valid connection.

The Linux client reports Dialect 0x311 signed and the complete smoke workflow exits with SMOKE OK. SMB remains experimental until the Windows and macOS acceptance criteria are also completed.

Verification

• Linux, macOS, and Windows package tests
• Formatting, go vet, CGO-free tests and build
• Full race detector suite
• XDR and NFS connection fuzz smoke
• Signed Linux CIFS end-to-end smoke test