1
0
mirror of https://github.com/samba-team/samba.git synced 2025-03-11 16:58:40 +03:00

137189 Commits

Author SHA1 Message Date
Jule Anger
3984b04d70 VERSION: Disable GIT_SNAPSHOT for the 4.20.7 release.
Signed-off-by: Jule Anger <janger@samba.org>
samba-4.20.7
2025-01-21 14:43:27 +01:00
Jule Anger
1031da06c1 WHATSNEW: Add release notes for Samba 4.20.7.
Signed-off-by: Jule Anger <janger@samba.org>
2025-01-21 14:42:57 +01:00
Vinit Agnihotri
7123833ab4 sharesec: Check if share exists in configuration
Load config from registry without share info and check if sharename
exists from configuration. This results into lesser delay for the same.

In case of view we load config with all shares to ensure we get all
shares for diplay purpose.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15780

Signed-off-by: Vinit Agnihotri <vagnihot@redhat.com>
Reviewed-by: John Mulligan <jmulligan@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Fri Jan 10 10:45:30 UTC 2025 on atb-devel-224

(cherry picked from commit 1410803713440caf29a40aec30516489d1944665)

Autobuild-User(v4-20-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-20-test): Tue Jan 21 08:42:09 UTC 2025 on atb-devel-224
2025-01-21 08:42:09 +00:00
Vinit Agnihotri
017f90a03d sharesec: Add function to check existence of share from config
Add function to detect if a share name exists in the registry or config file.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15780

Signed-off-by: Vinit Agnihotri <vagnihot@redhat.com>
Reviewed-by: John Mulligan <jmulligan@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
(cherry picked from commit 78eb293e1cdd3635de0bcf46ffb9d842f27bcc9f)
2025-01-21 07:38:18 +00:00
Vinit Agnihotri
9141077349 param: Add API to load registry without share info
As number of shares increases loading entire registry configuration along with
share information becomes very costly operation.
Since we may not require share information all time, we can optimise
this by using API just loading configuration without any share info.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15780

Signed-off-by: Vinit Agnihotri <vagnihot@redhat.com>
Reviewed-by: John Mulligan <jmulligan@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
(cherry picked from commit 2927dba0434b960e4c381329bdc9fe474fb930ce)
2025-01-21 07:38:18 +00:00
Vinit Agnihotri
839b32b1d1 sharesec: Fix warning frame not freed in order
This change should fix following warning:
Freed frame ../../source3/utils/sharesec.c:515, expected ../../source3/utils/sharesec.c:637

Frame was not getting freed in case of servicename is NULL.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15780

Signed-off-by: Vinit Agnihotri <vagnihot@redhat.com>
Reviewed-by: John Mulligan <jmulligan@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
(cherry picked from commit 04531e1b1d25d114c470922547bee769b07e5e60)
2025-01-21 07:38:17 +00:00
Guenther Deschner
6fb64f7020 s3-sharesec: Add Test to verify command option "--view-all"
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15780

Signed-off-by: Guenther Deschner <gd@samba.org>
Signed-off-by: Vinit Agnihotri <vagnihot@redhat.com>
Reviewed-by: John Mulligan <jmulligan@samba.org>
(cherry picked from commit 0a12254ea8b3414deebc3e6329025052c650356e)
2025-01-21 07:38:17 +00:00
Stefan Metzmacher
36f514f907 s4:dsdb: fix logic of dsdb_trust_routing_by_name()
We need to use the longest dnsname match as possible.

If we are the domain samba.example.com and have a trust
to example.com, a routing request for dc.samba.example.com
should return the tdo for samba.example.com instead
of example.com.

I reproduced the problem with the following diff:

> diff --git a/selftest/target/Samba.pm b/selftest/target/Samba.pm
> index 15d7692b5d64..6e9595b784c4 100644
> --- a/selftest/target/Samba.pm
> +++ b/selftest/target/Samba.pm
> @@ -564,7 +564,7 @@ sub realm_to_ip_mappings
>  		'samba2000.example.com'           => 'dc5',
>  		'samba2003.example.com'           => 'dc6',
>  		'samba2008r2.example.com'         => 'dc7',
> -		'addom.samba.example.com'         => 'addc',
> +		'addom.samba2008r2.example.com'         => 'addc',
>  		'addom2.samba.example.com'        => 'addcsmb1',
>  		'sub.samba.example.com'           => 'localsubdc',
>  		'chgdcpassword.samba.example.com' => 'chgdcpass',
> diff --git a/selftest/target/Samba4.pm b/selftest/target/Samba4.pm
> index 0e4cf50235c3..6bca0cfd0c89 100755
> --- a/selftest/target/Samba4.pm
> +++ b/selftest/target/Samba4.pm
> @@ -2631,7 +2631,7 @@ sub setup_fl2008r2dc
>  	    return undef;
>  	}
>
> -	$env = $self->setup_trust($env, $ad_dc_vars, "forest", "");
> +	$env = $self->setup_trust($env, $ad_dc_vars, "forest", "--skip-validation");
>  	if (!defined $env) {
>  	    return undef;
>  	}
> @@ -2843,7 +2843,7 @@ sub _setup_ad_dc
>  		$server = "addc";
>  	}
>  	if (!defined($dom)) {
> -		$dom = "addom.samba.example.com";
> +		$dom = "addom.samba2008r2.example.com";
>  	}
>  	my $env = $self->provision_ad_dc($path, $server, "ADDOMAIN",
>  					 $dom,

and running:
 make -j testenv SELFTEST_TESTENV="fl2008r2dc:local"

Inside the testenv:
bin/smbclient //addc.addom.samba2008r2.example.com/netlogon \
  -U$TRUST_USERNAME@$TRUST_REALM%$TRUST_PASSWORD \
  --use-kerberos=required \
  -c 'ls'

It lets the KDC of ADDOM.SAMBA2008R2.EXAMPLE.COM to
generate a (referral) ticket for
krbtgt/SAMBA2008R2.EXAMPLE.COM@ADDOM.SAMBA2008R2.EXAMPLE.COM
instead of
cifs/addc.addom.samba2008r2.example.com@ADDOM.SAMBA2008R2.EXAMPLE.COM

As ADDOM.SAMBA2008R2.EXAMPLE.COM has a forest trust (without msDS-TrustForestTrustInfo)
to SAMBA2008R2.EXAMPLE.COM dsdb_trust_update_best_tln() overwrote the
best match of addom.samba2008r2.example.com with samba2008r2.example.com.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15778

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>

Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org>
Autobuild-Date(master): Wed Jan  8 04:14:47 UTC 2025 on atb-devel-224

(cherry picked from commit 56947612452c32bd26f30ad6c9767830fe608d67)

Autobuild-User(v4-20-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-20-test): Thu Jan  9 09:56:59 UTC 2025 on atb-devel-224
2025-01-09 09:56:59 +00:00
Stefan Metzmacher
a015ffb3de s4:scripting: fix gen_hresult.py
Commit 6877e4849e81ed8f7f355fa4069f13a134e999ce reversed the
return values of hresult_errstr() and hresult_errstr_const().

hresult_errstr() should return "HRES_SEC_E_WRONG_PRINCIPAL",
while hresult_errstr_const() should return
"The target principal name is incorrect.".

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15769

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
(cherry picked from commit 6e0e9c4efc86f5ec4566aa0220ed4a74ad5436c1)
2025-01-09 08:42:16 +00:00
Volker Lendecke
4d043ea5e5 pam_winbind: Fix Bug 15771
Bug: https://bugzilla.samba.org/show_bug.cgi?id=15771

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 7e8bfe738a3d91b0724d57ed54acf40ebe026c14)

Autobuild-User(v4-20-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-20-test): Thu Dec 19 10:40:28 UTC 2024 on atb-devel-224
2024-12-19 10:40:28 +00:00
Pavel Filipenský
af0bcf35f4 selftest: Add test for vfs crossrename module
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15724

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit 02d4f58a2f7ac2db60dd2e4d16a3cbf71b3f08a9)
2024-12-19 09:36:12 +00:00
Pavel Filipenský
c121f03f59 docs:manpage: vfs_crossrename is not fully stackable VFS module
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15724

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit 94c9a99c56db438c391a966c927ec2f862c373e7)
2024-12-19 09:36:12 +00:00
Jones Syue
f1e28919ae s3:vfs_crossrename: add back checking for errno ENOENT
strace gives a clue: samba try to remove 'file.txt' in the dst folder but
actually it is not existed yet, and got an errno = ENOENT,

renameat(32, "file.txt", 31, "file.txt") = -1 EXDEV (Invalid cross-device link)
unlinkat(31, "file.txt", 0)             = -1 ENOENT (No such file or directory)

Commit 5c18f074be92 ("s3: VFS: crossrename. Use real dirfsp for
SMB_VFS_RENAMEAT()") seems unintentionally removed errno ENOENT checking,
so add it back could address 1st issue.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15724

Signed-off-by: Jones Syue <jonessyue@qnap.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit 1a089a16c40e0b3bc5d4fcde559157cf137056c2)
2024-12-19 09:36:12 +00:00
Pavel Filipenský
fac7288aff s3:vfs_crossrename: crossrename_renameat() needs to return 0 if copy_reg() is successful
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15724

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit 0a9adc85e77bc557bb8be12237fa31c4142dd3d5)
2024-12-19 09:36:12 +00:00
Pavel Filipenský
197578b4d6 s3:vfs_crossrename: avoid locking panic in copy_reg()
Use low level backend functions that don't go through the FSA layer.
Done via calling transfer_file() as it was in version before 5c18f07

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15724

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit 0a5da82f75a43838be3419cab10a50750fa500d7)
2024-12-19 09:36:12 +00:00
Stefan Metzmacher
ec098fbe84 s4:rpc_server: make use of dcesrv_assoc_group_common_destructor()
Currently this should not be needed, but it's better to
call dcesrv_assoc_group_common_destructor() in all assoc_group
destructors.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15765

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit 19657be71d7cec5ac58a5d6969dc1d6ae7c5b517)

Autobuild-User(v4-20-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-20-test): Wed Dec 18 09:51:41 UTC 2024 on atb-devel-224
2024-12-18 09:51:41 +00:00
Stefan Metzmacher
5920780965 s3:rpc_server: make use of dcesrv_assoc_group_common_destructor()
We need to detach dcesrv_iface_state from dcesrv_assoc_group,
if dcesrv_assoc_group is free'ed first.

Typically this doesn't happen, but it does when
rpc_worker_connection_terminated explicitly calls
talloc_unlink(conn, conn->assoc_group)
and dcesrv_iface_state_store_conn() is used.

But we better do it in all assoc_group destructors.

==381007==ERROR: AddressSanitizer: heap-use-after-free on address 0x50d000004f80 at pc 0x7f15fc12e0ac bp 0x7ffe43267780 sp 0x7ffe43267778
READ of size 8 at 0x50d000004f80 thread T0
    #0 0x7f15fc12e0ab in dcesrv_iface_state_destructor ../../librpc/rpc/dcesrv_handles.c:166
    #1 0x7f15fc0f7d76 in _tc_free_internal ../../lib/talloc/talloc.c:1158
    #2 0x7f15fc0f7acd in _tc_free_children_internal ../../lib/talloc/talloc.c:1669
    #3 0x7f15fc0f7acd in _tc_free_internal ../../lib/talloc/talloc.c:1184
    #4 0x7f15fc0f7acd in _tc_free_children_internal ../../lib/talloc/talloc.c:1669
    #5 0x7f15fc0f7acd in _tc_free_internal ../../lib/talloc/talloc.c:1184
    #6 0x7f15fc0f7acd in _tc_free_children_internal ../../lib/talloc/talloc.c:1669
    #7 0x7f15fc0f7acd in _tc_free_internal ../../lib/talloc/talloc.c:1184
    #8 0x7f15fc0f924c in _talloc_free_internal ../../lib/talloc/talloc.c:1248
    #9 0x7f15fc0f924c in _talloc_free ../../lib/talloc/talloc.c:1792
    #10 0x7f15fadac024 in ncacn_terminate_connection ../../source3/rpc_server/rpc_server.c:263
    #11 0x7f15fadac024 in dcesrv_transport_terminate_connection ../../source3/rpc_server/rpc_server.c:251
    #12 0x7f15fc11e5ef in dcesrv_terminate_connection ../../librpc/rpc/dcesrv_core.c:2968
    #13 0x7f15fc125446 in dcesrv_read_fragment_done ../../librpc/rpc/dcesrv_core.c:3196
    #14 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #15 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #16 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #17 0x7f15fb4f69a1 in _tevent_req_nterror ../../lib/util/tevent_ntstatus.c:46
    #18 0x7f15fabda2f4 in dcerpc_read_ncacn_packet_done ../../librpc/rpc/dcerpc_util.c:612
    #19 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #20 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #21 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #22 0x7f15fbff4228 in tstream_readv_pdu_readv_done ../../lib/tsocket/tsocket_helpers.c:313
    #23 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #24 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #25 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #26 0x7f15fbff1800 in tstream_readv_done ../../lib/tsocket/tsocket.c:593
    #27 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #28 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #29 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #30 0x7f15fadbc1a3 in tstream_npa_readv_msg_mode_handler ../../libcli/named_pipe_auth/npa_tstream.c:697
    #31 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #32 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #33 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #34 0x7f15fbff4228 in tstream_readv_pdu_readv_done ../../lib/tsocket/tsocket_helpers.c:313
    #35 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #36 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #37 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #38 0x7f15fbff1800 in tstream_readv_done ../../lib/tsocket/tsocket.c:593
    #39 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #40 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #41 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #42 0x7f15fbff9691 in tstream_bsd_readv_handler ../../lib/tsocket/tsocket_bsd.c:2080
    #43 0x7f15fbff6f85 in tstream_bsd_fde_handler ../../lib/tsocket/tsocket_bsd.c:1764
    #44 0x7f15fb7d9ac1 in tevent_common_invoke_fd_handler ../../lib/tevent/tevent_fd.c:174
    #45 0x7f15fb7ef185 in epoll_event_loop ../../lib/tevent/tevent_epoll.c:696
    #46 0x7f15fb7ef185 in epoll_event_loop_once ../../lib/tevent/tevent_epoll.c:926
    #47 0x7f15fb7e77b8 in std_event_loop_once ../../lib/tevent/tevent_standard.c:110
    #48 0x7f15fb7d7549 in _tevent_loop_once ../../lib/tevent/tevent.c:820
    #49 0x7f15fc936b7c in rpc_worker_main ../../source3/rpc_server/rpc_worker.c:1249
    #50 0x5632ae1e1ec3 in main ../../source3/rpc_server/rpcd_lsad.c:132
    #51 0x7f15f7c2a2ad in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #52 0x7f15f7c2a378 in __libc_start_main_impl ../csu/libc-start.c:360
    #53 0x5632ae162e64 in _start ../sysdeps/x86_64/start.S:115

0x50d000004f80 is located 112 bytes inside of 136-byte region [0x50d000004f10,0x50d000004f98)
freed by thread T0 here:
    #0 0x7f15fcefb418 in free ../../../../libsanitizer/asan/asan_malloc_linux.cpp:52
    #1 0x7f15fc0f857d in _tc_free_internal ../../lib/talloc/talloc.c:1222
    #2 0x7f15fc0f8d0f in _talloc_free_internal ../../lib/talloc/talloc.c:1248
    #3 0x7f15fc0f8d0f in talloc_unlink ../../lib/talloc/talloc.c:1473
    #4 0x7f15fc934580 in rpc_worker_connection_terminated ../../source3/rpc_server/rpc_worker.c:143
    #5 0x7f15fc9310bd in dcesrv_connection_destructor ../../source3/rpc_server/rpc_worker.c:175
    #6 0x7f15fc0f7d76 in _tc_free_internal ../../lib/talloc/talloc.c:1158
    #7 0x7f15fc0f7acd in _tc_free_children_internal ../../lib/talloc/talloc.c:1669
    #8 0x7f15fc0f7acd in _tc_free_internal ../../lib/talloc/talloc.c:1184
    #9 0x7f15fc0f924c in _talloc_free_internal ../../lib/talloc/talloc.c:1248
    #10 0x7f15fc0f924c in _talloc_free ../../lib/talloc/talloc.c:1792
    #11 0x7f15fadac024 in ncacn_terminate_connection ../../source3/rpc_server/rpc_server.c:263
    #12 0x7f15fadac024 in dcesrv_transport_terminate_connection ../../source3/rpc_server/rpc_server.c:251
    #13 0x7f15fc11e5ef in dcesrv_terminate_connection ../../librpc/rpc/dcesrv_core.c:2968
    #14 0x7f15fc125446 in dcesrv_read_fragment_done ../../librpc/rpc/dcesrv_core.c:3196
    #15 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #16 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #17 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #18 0x7f15fb4f69a1 in _tevent_req_nterror ../../lib/util/tevent_ntstatus.c:46
    #19 0x7f15fabda2f4 in dcerpc_read_ncacn_packet_done ../../librpc/rpc/dcerpc_util.c:612
    #20 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #21 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #22 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #23 0x7f15fbff4228 in tstream_readv_pdu_readv_done ../../lib/tsocket/tsocket_helpers.c:313
    #24 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #25 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #26 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #27 0x7f15fbff1800 in tstream_readv_done ../../lib/tsocket/tsocket.c:593
    #28 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #29 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #30 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #31 0x7f15fadbc1a3 in tstream_npa_readv_msg_mode_handler ../../libcli/named_pipe_auth/npa_tstream.c:697
    #32 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #33 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234

previously allocated by thread T0 here:
    #0 0x7f15fcefc777 in malloc ../../../../libsanitizer/asan/asan_malloc_linux.cpp:69
    #1 0x7f15fc0fbc57 in __talloc_with_prefix ../../lib/talloc/talloc.c:783
    #2 0x7f15fc0fd8cf in __talloc ../../lib/talloc/talloc.c:825
    #3 0x7f15fc0fd8cf in _talloc_named_const ../../lib/talloc/talloc.c:982
    #4 0x7f15fc0fd8cf in _talloc_zero ../../lib/talloc/talloc.c:2421
    #5 0x7f15fc93156e in rpc_worker_assoc_group_new ../../source3/rpc_server/rpc_worker.c:681
    #6 0x7f15fc93156e in rpc_worker_assoc_group_find ../../source3/rpc_server/rpc_worker.c:730
    #7 0x7f15fc120a18 in dcesrv_bind ../../librpc/rpc/dcesrv_core.c:1158
    #8 0x7f15fc120a18 in dcesrv_process_ncacn_packet ../../librpc/rpc/dcesrv_core.c:2324
    #9 0x7f15fc120a18 in dcesrv_loop_next_packet ../../librpc/rpc/dcesrv_core.c:3222
    #10 0x7f15fc933722 in rpc_worker_new_client ../../source3/rpc_server/rpc_worker.c:489
    #11 0x7f15fc933722 in rpc_worker_new_client_filter ../../source3/rpc_server/rpc_worker.c:558
    #12 0x7f15fbef95ca in messaging_dispatch_waiters ../../source3/lib/messages.c:1343
    #13 0x7f15fbefb589 in messaging_dispatch_rec ../../source3/lib/messages.c:1371
    #14 0x7f15fbefb589 in messaging_recv_cb ../../source3/lib/messages.c:431
    #15 0x7f15faddba9e in msg_dgm_ref_recv ../../lib/messaging/messages_dgm_ref.c:144
    #16 0x7f15fadd6cc3 in messaging_dgm_recv ../../lib/messaging/messages_dgm.c:1426
    #17 0x7f15fadd7618 in messaging_dgm_read_handler ../../lib/messaging/messages_dgm.c:1316
    #18 0x7f15fb7d9ac1 in tevent_common_invoke_fd_handler ../../lib/tevent/tevent_fd.c:174
    #19 0x7f15fb7ef185 in epoll_event_loop ../../lib/tevent/tevent_epoll.c:696
    #20 0x7f15fb7ef185 in epoll_event_loop_once ../../lib/tevent/tevent_epoll.c:926
    #21 0x7f15fb7e77b8 in std_event_loop_once ../../lib/tevent/tevent_standard.c:110
    #22 0x7f15fb7d7549 in _tevent_loop_once ../../lib/tevent/tevent.c:820
    #23 0x7f15fc936b7c in rpc_worker_main ../../source3/rpc_server/rpc_worker.c:1249
    #24 0x5632ae1e1ec3 in main ../../source3/rpc_server/rpcd_lsad.c:132
    #25 0x7f15f7c2a2ad in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15765

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit 627a7857844804a29c6612df5da4605c94edb3f9)
2024-12-18 08:46:12 +00:00
Stefan Metzmacher
34618ab0a5 dcesrv_core: add dcesrv_assoc_group_common_destructor()
We need to detach dcesrv_iface_state from dcesrv_assoc_group,
if dcesrv_assoc_group is free'ed first.

==381007==ERROR: AddressSanitizer: heap-use-after-free on address 0x50d000004f80 at pc 0x7f15fc12e0ac bp 0x7ffe43267780 sp 0x7ffe43267778
READ of size 8 at 0x50d000004f80 thread T0
    #0 0x7f15fc12e0ab in dcesrv_iface_state_destructor ../../librpc/rpc/dcesrv_handles.c:166
    #1 0x7f15fc0f7d76 in _tc_free_internal ../../lib/talloc/talloc.c:1158
    #2 0x7f15fc0f7acd in _tc_free_children_internal ../../lib/talloc/talloc.c:1669
    #3 0x7f15fc0f7acd in _tc_free_internal ../../lib/talloc/talloc.c:1184
    #4 0x7f15fc0f7acd in _tc_free_children_internal ../../lib/talloc/talloc.c:1669
    #5 0x7f15fc0f7acd in _tc_free_internal ../../lib/talloc/talloc.c:1184
    #6 0x7f15fc0f7acd in _tc_free_children_internal ../../lib/talloc/talloc.c:1669
    #7 0x7f15fc0f7acd in _tc_free_internal ../../lib/talloc/talloc.c:1184
    #8 0x7f15fc0f924c in _talloc_free_internal ../../lib/talloc/talloc.c:1248
    #9 0x7f15fc0f924c in _talloc_free ../../lib/talloc/talloc.c:1792
    #10 0x7f15fadac024 in ncacn_terminate_connection ../../source3/rpc_server/rpc_server.c:263
    #11 0x7f15fadac024 in dcesrv_transport_terminate_connection ../../source3/rpc_server/rpc_server.c:251
    #12 0x7f15fc11e5ef in dcesrv_terminate_connection ../../librpc/rpc/dcesrv_core.c:2968
    #13 0x7f15fc125446 in dcesrv_read_fragment_done ../../librpc/rpc/dcesrv_core.c:3196
    #14 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #15 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #16 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #17 0x7f15fb4f69a1 in _tevent_req_nterror ../../lib/util/tevent_ntstatus.c:46
    #18 0x7f15fabda2f4 in dcerpc_read_ncacn_packet_done ../../librpc/rpc/dcerpc_util.c:612
    #19 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #20 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #21 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #22 0x7f15fbff4228 in tstream_readv_pdu_readv_done ../../lib/tsocket/tsocket_helpers.c:313
    #23 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #24 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #25 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #26 0x7f15fbff1800 in tstream_readv_done ../../lib/tsocket/tsocket.c:593
    #27 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #28 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #29 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #30 0x7f15fadbc1a3 in tstream_npa_readv_msg_mode_handler ../../libcli/named_pipe_auth/npa_tstream.c:697
    #31 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #32 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #33 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #34 0x7f15fbff4228 in tstream_readv_pdu_readv_done ../../lib/tsocket/tsocket_helpers.c:313
    #35 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #36 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #37 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #38 0x7f15fbff1800 in tstream_readv_done ../../lib/tsocket/tsocket.c:593
    #39 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #40 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #41 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #42 0x7f15fbff9691 in tstream_bsd_readv_handler ../../lib/tsocket/tsocket_bsd.c:2080
    #43 0x7f15fbff6f85 in tstream_bsd_fde_handler ../../lib/tsocket/tsocket_bsd.c:1764
    #44 0x7f15fb7d9ac1 in tevent_common_invoke_fd_handler ../../lib/tevent/tevent_fd.c:174
    #45 0x7f15fb7ef185 in epoll_event_loop ../../lib/tevent/tevent_epoll.c:696
    #46 0x7f15fb7ef185 in epoll_event_loop_once ../../lib/tevent/tevent_epoll.c:926
    #47 0x7f15fb7e77b8 in std_event_loop_once ../../lib/tevent/tevent_standard.c:110
    #48 0x7f15fb7d7549 in _tevent_loop_once ../../lib/tevent/tevent.c:820
    #49 0x7f15fc936b7c in rpc_worker_main ../../source3/rpc_server/rpc_worker.c:1249
    #50 0x5632ae1e1ec3 in main ../../source3/rpc_server/rpcd_lsad.c:132
    #51 0x7f15f7c2a2ad in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #52 0x7f15f7c2a378 in __libc_start_main_impl ../csu/libc-start.c:360
    #53 0x5632ae162e64 in _start ../sysdeps/x86_64/start.S:115

0x50d000004f80 is located 112 bytes inside of 136-byte region [0x50d000004f10,0x50d000004f98)
freed by thread T0 here:
    #0 0x7f15fcefb418 in free ../../../../libsanitizer/asan/asan_malloc_linux.cpp:52
    #1 0x7f15fc0f857d in _tc_free_internal ../../lib/talloc/talloc.c:1222
    #2 0x7f15fc0f8d0f in _talloc_free_internal ../../lib/talloc/talloc.c:1248
    #3 0x7f15fc0f8d0f in talloc_unlink ../../lib/talloc/talloc.c:1473
    #4 0x7f15fc934580 in rpc_worker_connection_terminated ../../source3/rpc_server/rpc_worker.c:143
    #5 0x7f15fc9310bd in dcesrv_connection_destructor ../../source3/rpc_server/rpc_worker.c:175
    #6 0x7f15fc0f7d76 in _tc_free_internal ../../lib/talloc/talloc.c:1158
    #7 0x7f15fc0f7acd in _tc_free_children_internal ../../lib/talloc/talloc.c:1669
    #8 0x7f15fc0f7acd in _tc_free_internal ../../lib/talloc/talloc.c:1184
    #9 0x7f15fc0f924c in _talloc_free_internal ../../lib/talloc/talloc.c:1248
    #10 0x7f15fc0f924c in _talloc_free ../../lib/talloc/talloc.c:1792
    #11 0x7f15fadac024 in ncacn_terminate_connection ../../source3/rpc_server/rpc_server.c:263
    #12 0x7f15fadac024 in dcesrv_transport_terminate_connection ../../source3/rpc_server/rpc_server.c:251
    #13 0x7f15fc11e5ef in dcesrv_terminate_connection ../../librpc/rpc/dcesrv_core.c:2968
    #14 0x7f15fc125446 in dcesrv_read_fragment_done ../../librpc/rpc/dcesrv_core.c:3196
    #15 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #16 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #17 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #18 0x7f15fb4f69a1 in _tevent_req_nterror ../../lib/util/tevent_ntstatus.c:46
    #19 0x7f15fabda2f4 in dcerpc_read_ncacn_packet_done ../../librpc/rpc/dcerpc_util.c:612
    #20 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #21 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #22 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #23 0x7f15fbff4228 in tstream_readv_pdu_readv_done ../../lib/tsocket/tsocket_helpers.c:313
    #24 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #25 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #26 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #27 0x7f15fbff1800 in tstream_readv_done ../../lib/tsocket/tsocket.c:593
    #28 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #29 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234
    #30 0x7f15fb7dcdb7 in _tevent_req_error ../../lib/tevent/tevent_req.c:252
    #31 0x7f15fadbc1a3 in tstream_npa_readv_msg_mode_handler ../../libcli/named_pipe_auth/npa_tstream.c:697
    #32 0x7f15fb7dcae5 in _tevent_req_notify_callback ../../lib/tevent/tevent_req.c:177
    #33 0x7f15fb7dcd1c in tevent_req_finish ../../lib/tevent/tevent_req.c:234

previously allocated by thread T0 here:
    #0 0x7f15fcefc777 in malloc ../../../../libsanitizer/asan/asan_malloc_linux.cpp:69
    #1 0x7f15fc0fbc57 in __talloc_with_prefix ../../lib/talloc/talloc.c:783
    #2 0x7f15fc0fd8cf in __talloc ../../lib/talloc/talloc.c:825
    #3 0x7f15fc0fd8cf in _talloc_named_const ../../lib/talloc/talloc.c:982
    #4 0x7f15fc0fd8cf in _talloc_zero ../../lib/talloc/talloc.c:2421
    #5 0x7f15fc93156e in rpc_worker_assoc_group_new ../../source3/rpc_server/rpc_worker.c:681
    #6 0x7f15fc93156e in rpc_worker_assoc_group_find ../../source3/rpc_server/rpc_worker.c:730
    #7 0x7f15fc120a18 in dcesrv_bind ../../librpc/rpc/dcesrv_core.c:1158
    #8 0x7f15fc120a18 in dcesrv_process_ncacn_packet ../../librpc/rpc/dcesrv_core.c:2324
    #9 0x7f15fc120a18 in dcesrv_loop_next_packet ../../librpc/rpc/dcesrv_core.c:3222
    #10 0x7f15fc933722 in rpc_worker_new_client ../../source3/rpc_server/rpc_worker.c:489
    #11 0x7f15fc933722 in rpc_worker_new_client_filter ../../source3/rpc_server/rpc_worker.c:558
    #12 0x7f15fbef95ca in messaging_dispatch_waiters ../../source3/lib/messages.c:1343
    #13 0x7f15fbefb589 in messaging_dispatch_rec ../../source3/lib/messages.c:1371
    #14 0x7f15fbefb589 in messaging_recv_cb ../../source3/lib/messages.c:431
    #15 0x7f15faddba9e in msg_dgm_ref_recv ../../lib/messaging/messages_dgm_ref.c:144
    #16 0x7f15fadd6cc3 in messaging_dgm_recv ../../lib/messaging/messages_dgm.c:1426
    #17 0x7f15fadd7618 in messaging_dgm_read_handler ../../lib/messaging/messages_dgm.c:1316
    #18 0x7f15fb7d9ac1 in tevent_common_invoke_fd_handler ../../lib/tevent/tevent_fd.c:174
    #19 0x7f15fb7ef185 in epoll_event_loop ../../lib/tevent/tevent_epoll.c:696
    #20 0x7f15fb7ef185 in epoll_event_loop_once ../../lib/tevent/tevent_epoll.c:926
    #21 0x7f15fb7e77b8 in std_event_loop_once ../../lib/tevent/tevent_standard.c:110
    #22 0x7f15fb7d7549 in _tevent_loop_once ../../lib/tevent/tevent.c:820
    #23 0x7f15fc936b7c in rpc_worker_main ../../source3/rpc_server/rpc_worker.c:1249
    #24 0x5632ae1e1ec3 in main ../../source3/rpc_server/rpcd_lsad.c:132
    #25 0x7f15f7c2a2ad in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15765

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit 5b929860e269e2968a0ec3759a6125ae990b43c3)
2024-12-18 08:46:12 +00:00
Ralph Boehme
c9581976a4 smbd: fix breaking leases on rename
We must also break leases on other opens if the open of the rename doesn't have
a lease itself. The existing test test_lease_v2_rename() that was added
alongside the deferred rename server code didn't cover this case.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15697

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Thu Oct 31 12:47:24 UTC 2024 on atb-devel-224

(cherry picked from commit efbbe8d6f80ceb6107f20486623eee949409c0ff)

Autobuild-User(v4-20-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-20-test): Mon Dec  9 09:45:57 UTC 2024 on atb-devel-224
2024-12-09 09:45:57 +00:00
Ralph Boehme
ebf4b30d08 smbd: force sync rename with lease break
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15697

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit bc2d87981967bc65155ba09eb5b3e3f913bec50e)
2024-12-09 08:36:19 +00:00
Ralph Boehme
9cdfb755b7 smbd: return correct error for compound related requests that went async
For a compound related request chain of eg CREATE+NOTIFY+GETINFO, the NOTIFY
will typically go async. When this is noted in smbd_smb2_request_pending_queue()
the pending async tevent_req is cancelled which means we return
NT_STATUS_CANCELLED to the client while Windows returns
NT_STATUS_INTERNAL_ERROR.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15697

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit a5635791cfdb10f64bf2bf7c72c58f7591249a0d)
2024-12-09 08:36:19 +00:00
Ralph Boehme
00fb1d0fe2 smbtorture: test rename with other opens on the file
Windows allows this. Samba also already implements this correctly.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15697

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit 3890ac2fafc5e17919fa39542440a05ef72a3fa5)
2024-12-09 08:36:19 +00:00
Ralph Boehme
7e5019e845 smbtorture: add a bunch of tests for async rename and async interim responses
All tests pass against Windows 2022, we have some bugs.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15697

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit 42e739ab62cb573d72215737027cf3c7f1fcd212)
2024-12-09 08:36:19 +00:00
Ralph Boehme
6c4a0272e7 smbtorture: rename CHECK_VALUE() to CHECK_VAL() in smb2/compound.c
Prepares for using macros from lease_break_handler.h which makes use of
CHECK_VAL() while relying on a definition of CHECK_VAL() in the .c file.

While at it, add a goto done which is always a good thing to get clear failures
from tests.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15697

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit 4932b433ff2f1c4e603073624a5d22140acfb2ed)
2024-12-09 08:36:19 +00:00
Martin Schwenke
622bcc5518 ctdb-common: Map ENOENT for a missing event script to ENOEXEC
This handles the case where an event script is disabled by unlinking,
while an event is being run, after the script list has been created.
Without this change the script will fail.  With this change the script
will be marked as DISABLED.  See the comment added by this commit for
more details.

Add a testcase to simulate the race, using an event script to disable
subsequent ones.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15755
RN: Avoid event failure race when disabling an event script

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

Autobuild-User(master): Amitay Isaacs <amitay@samba.org>
Autobuild-Date(master): Thu Nov 21 01:42:09 UTC 2024 on atb-devel-224

(cherry picked from commit fee31b6cb2b8f7dd111bdd9d2ff5479c31cbca37)

Autobuild-User(v4-20-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-20-test): Fri Dec  6 15:19:41 UTC 2024 on atb-devel-224
2024-12-06 15:19:41 +00:00
Martin Schwenke
1531eb5388 ctdb-scripts: Track connections for all ports for public IPs
Currently TCP ports like NFS lock manager are not tracked.  It is
easier to track all connections than to add a configuration system to
try to track specified ports, so do that.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15320
RN: Update CTDB to track all TCP connections to public IP addresses

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jerry Heyman <jheyman@ddn.com>
(cherry picked from commit 590a86dbe4adf45ac8d15497934e25ea98148034)

Autobuild-User(v4-20-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-20-test): Mon Nov 25 13:58:45 UTC 2024 on atb-devel-224
2024-11-25 13:58:44 +00:00
Martin Schwenke
664538a65f ctdb-scripts: Get connections after tickle list
Running ss to get current connections before running ctdb gettickles
means the ss output might be out of date when the 2 lists are
compared.  Some tickles might have been added after ss was run by some
other means (e.g. SMB tickles, added internally) and they would be
deleted according to the stale ss output.

This isn't currently a problem because update_tickles() is currently
only called with port 2049, so all tickles are managed by this code.
That will change in a subsequent commit.

Changing the order means the reverse problem can occur, where
update_tickles() attempts to delete an already deleted tickle.  That
may happen occasionally but is harmless because it doesn't result in
missing information.  It (currently) just causes a message to be
logged at DEBUG level.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15320
RN: Update CTDB to track all TCP connections to public IP addresses

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jerry Heyman <jheyman@ddn.com>
(cherry picked from commit c3695722b6316b624aa6c44cad4f44279303d1b1)
2024-11-25 12:39:11 +00:00
Martin Schwenke
20987bf505 ctdb-scripts: Move connection tracking to 10.interface
This should really be done for all connections to public IP addresses.
Leave the port number there for now - this is just the first step.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15320
RN: Update CTDB to track all TCP connections to public IP addresses

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jerry Heyman <jheyman@ddn.com>
(cherry picked from commit 9683bb3ac2bbdf0e83c3be3681f9d1c8ee7cc327)
2024-11-25 12:39:11 +00:00
Martin Schwenke
75701619fb ctdb-server: Drop a log message to DEBUG level
This is harmless, so it doesn't generally need to be logged.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15320
RN: Update CTDB to track all TCP connections to public IP addresses

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jerry Heyman <jheyman@ddn.com>
(cherry picked from commit f4a8f84328c5e692ce63bec05bb71fcb469a3e9c)
2024-11-25 12:39:11 +00:00
Martin Schwenke
a80b629491 ctdb-server: Clean up connection tracking functions
Apply README.Coding, modernise logging, pre-render connection as a
string for logging, switch terminology from "tickle" to "connection",
tidy up comments.

No changes in functionality.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15320
RN: Update CTDB to track all TCP connections to public IP addresses

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jerry Heyman <jheyman@ddn.com>
(cherry picked from commit 3c19c8df778070705485b3c993e695ca1636bfa7)
2024-11-25 12:39:11 +00:00
Martin Schwenke
eb1c30341a ctdb-scripts: Use ss -H option to simplify
This option has been available since ~2018 and has been implemented in
the stub since then.  I guess we didn't use it because CentOS 7?

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15320
RN: Update CTDB to track all TCP connections to public IP addresses

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jerry Heyman <jheyman@ddn.com>
(cherry picked from commit 0505d06b12a04a5c5e813fb3f4799278f9e5b7eb)
2024-11-25 12:39:11 +00:00
Martin Schwenke
76ddab97e7 ctdb-scripts: Remove superseded compatibility code
Since commit 224e99804efef960ef4ce2ff2f4f6dced1e74146, square brackets
have been parsed by daemon and tool code, so drop the compatibility
code from here.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15320
RN: Update CTDB to track all TCP connections to public IP addresses

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jerry Heyman <jheyman@ddn.com>
(cherry picked from commit 32e4f786601712e57992ce4c8f46e5d38620a5dd)
2024-11-25 12:39:11 +00:00
Martin Schwenke
aadc131405 ctdb-scripts: update_tickles() should use the public IPs cache
This avoids duplicating logic.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15320
RN: Update CTDB to track all TCP connections to public IP addresses

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jerry Heyman <jheyman@ddn.com>
(cherry picked from commit b3e2c69ad92c0d20bb10146d2dd6d0d475455298)
2024-11-25 12:39:11 +00:00
Martin Schwenke
71210ed0df ctdb-scripts: Add caching function for public IPs
This is way more complicated than I would like but, as per the
comment, this is due to complexities in the way public IPs work.  The
main consumer will be statd-callout, which will then be able to run as
a non-root user.

Also generate the cache file in test code, whenever the PNN is set.
However, this can cause "ctdb ip" to generate a fake IP layout before
public IPs are setup.  So, have the "ctdb ip" stub generate the IP
layout every time it is run to avoid it being stale.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15320
RN: Update CTDB to track all TCP connections to public IP addresses

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
(cherry picked from commit ed3f041c309e84bcb73fda9a7a68dbf69f63e3e3)
2024-11-25 12:39:11 +00:00
Martin Schwenke
7c69634973 ctdb-scripts: Don't list connections when not hosting IPs
With an empty IP filter, all incoming connections to port 2049 will be
listed, not just those to public IP addresses.  This causes error
messages like the following to be logged:

  ctdb-eventd[...]: 60.nfs: Failed to add 1 tickles

since the connection being added seems to be for a random NFS mount
that doesn't use a public IP addresses.

This has been a problem for a long time (probably since commit
04fe9e20749985c71fef1bce7f6e4c439fe11c81 in 2015).  It isn't currently
a huge deal because it only affects NFS connections.  However, this
code will soon be used to track connections to public IP addresses on
all ports.  This would result in a constant stream of log messages,
since there will always be some active connections.

The theory behind the fix is that if a node hosts no public IPs then
it should have no relevant connections and has no business changing
the list of registered tickles.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15320
RN: Update CTDB to track all TCP connections to public IP addresses

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jerry Heyman <jheyman@ddn.com>
(cherry picked from commit 1a4a6c46f1cdabfea67c264d6576a597a70c3007)
2024-11-25 12:39:11 +00:00
Ralph Boehme
82db30cdbd smbd: avoid a panic in close_directory()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15754

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Mon Nov 18 12:43:28 UTC 2024 on atb-devel-224

(backported from commit f86d1a35917cdcc07b2fa741c6a369aaad24abaf)
[slow@samba.org: context changes from Directory Leases]

Autobuild-User(v4-20-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-20-test): Wed Nov 20 11:17:07 UTC 2024 on atb-devel-224
2024-11-20 11:17:07 +00:00
Jule Anger
0cfc035e9d VERSION: Bump version up to Samba 4.20.7...
and re-enable GIT_SNAPSHOT.

Signed-off-by: Jule Anger <janger@samba.org>
2024-11-19 15:39:38 +01:00
Jule Anger
3de528753a VERSION: Disable GIT_SNAPSHOT for the 4.20.6 release.
Signed-off-by: Jule Anger <janger@samba.org>
samba-4.20.6
2024-11-19 15:39:35 +01:00
Jule Anger
609ab9a783 WHATSNEW: Add release notes for Samba 4.20.6.
Signed-off-by: Jule Anger <janger@samba.org>
2024-11-19 15:37:59 +01:00
Jule Anger
42bfbb012f BUG 15590 ldb: Release LDB 2.9.2
* BUG 15590: libldb: performance issue with indexes.

Signed-off-by: Jule Anger <janger@samba.org>
ldb-2.9.2
2024-11-19 15:33:52 +01:00
Stefan Metzmacher
7b4629ef84 libcli/auth: make use of netlogon_creds_cli_check_transport() in more places
This was somehow missing in commit
7a5ad9f64a905f5744430c6e0796c646baf9432e

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15425

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Thu Nov  7 09:14:33 UTC 2024 on atb-devel-224

(cherry picked from commit f340dce6546a22d857cad440f8afaee9815dbdb1)

Autobuild-User(v4-20-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-20-test): Wed Nov 13 11:36:37 UTC 2024 on atb-devel-224
2024-11-13 11:36:37 +00:00
Stefan Metzmacher
aa4add0053 libcli/auth: split out netlogon_creds_cli_check_transport()
This will make it easier to implement netr_ServerAuthenticateKerberos()
later...

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15425

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
(cherry picked from commit 7a5ad9f64a905f5744430c6e0796c646baf9432e)
2024-11-13 10:39:12 +00:00
Stefan Metzmacher
21e9355630 libcli/auth: let netlogon_creds_copy() copy all scalar elements
This version is good for now, as we want it to be backportable.
For master we'll add a ndr_deepcopy_struct() helper in order
to avoid future problems.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15425

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
(cherry picked from commit 8edbdd65ef78e3f26357d0254b58db3120a32880)
2024-11-13 10:39:12 +00:00
Stefan Metzmacher
75e62cc19b s4:librpc/rpc: make use of netlogon_creds_client_verify()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15425

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
(cherry picked from commit 132629ee3a9b73d0888d1110e4d0a45ded778e5a)
2024-11-13 10:39:12 +00:00
Stefan Metzmacher
77a02d6e79 libcli/auth: make use of netlogon_creds_client_verify()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15425

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
(cherry picked from commit 1a5984ac6312b204b51590057b8327cf4698383b)
2024-11-13 10:39:12 +00:00
Stefan Metzmacher
1de6cffa68 libcli/auth: split out netlogon_creds_client_verify() that takes auth_{type,level}
This will make it easier to implement netr_ServerAuthenticateKerberos()
later...

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15425

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
(cherry picked from commit 45faf6c35a033ec46a546dfb9d5d6aeb2fb2b83c)
2024-11-13 10:39:12 +00:00
Stefan Metzmacher
0c61920c88 libcli/auth: pass auth_{type,level} to netlogon_creds_server_step_check()
This will make it easier to implement netr_ServerAuthenticateKerberos() later...

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15425

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
(cherry picked from commit 2956c7eb3c9fc2161fd2748e5aac1fc94478e8c7)
2024-11-13 10:39:12 +00:00
Stefan Metzmacher
200fc14fb8 libcli/auth: pass auth_{type,level} to schannel_check_creds_state()
This will make it easier to implement netr_ServerAuthenticateKerberos() later...

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15425

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
(cherry picked from commit 7b02fb50143ba5044605ec67ed41180391835dcb)
2024-11-13 10:39:12 +00:00
Stefan Metzmacher
270499b1c9 libcli/auth: return INVALID_PARAMETER for DES in netlogon_creds_{de,en}crypt_samlogon_logon
For the NetlogonGenericInformation case we want an error instead of no
encryption if only DES was negotiated...

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15425

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
(cherry picked from commit 131f5c0b251e456c466eaca744525504e1d69492)
2024-11-13 10:39:12 +00:00
Stefan Metzmacher
6b32dcf6ea s4:rpc_server/netlogon: make use of netlogon_creds_decrypt_SendToSam
This will make it easier to implement netr_ServerAuthenticateKerberos() later...

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15425

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
(cherry picked from commit 834197dafef0f3779ba69c8e350cbd7bb9333284)
2024-11-13 10:39:12 +00:00