mirror of
https://github.com/samba-team/samba.git
synced 2025-01-06 13:18:07 +03:00
f348b84fbc
If a client opens multiple connection with the same
client guid in parallel, our connection passing is likely
to hit a race.
Assume we have 3 processes:
smbdA: This process already handles all connections for
a given client guid
smbdB: This just received a new connection with an
SMB2 neprot for the same client guid
smbdC: This also received a new connection with an
SMB2 neprot for the same client guid
Now both smbdB and smbdC send a MSG_SMBXSRV_CONNECTION_PASS
message to smbdA. These messages contain the socket fd
for each connection.
While waiting for a MSG_SMBXSRV_CONNECTION_PASSED message
from smbdA, both smbdB and smbdC watch the smbXcli_client.tdb
record for changes (that also verifies smbdA stays alive).
Once one of them say smbdB received the MSG_SMBXSRV_CONNECTION_PASSED
message, the dbwrap_watch logic will wakeup smbdC in order to
let it recheck the smbXcli_client.tdb record in order to
handle the case where smbdA died or deleted its record.
Now smbdC rechecks the smbXcli_client.tdb record, but it
was not woken because of a problem with smbdA. It meant
that smbdC sends a MSG_SMBXSRV_CONNECTION_PASS message
including the socket fd again.
As a result smbdA got the socket fd from smbdC twice (or even more),
and creates two (or more) smbXsrv_connection structures for the
same low level tcp connection. And it also sends more than one
SMB2 negprot response. Depending on the tevent logic, it will
use different smbXsrv_connection structures to process incoming
requests. And this will almost immediately result in errors.
The typicall error is:
smb2_validate_sequence_number: smb2_validate_sequence_number: bad message_id 2 (sequence id 2) (granted = 1, low = 1, range = 1)
But other errors would also be possible.
The detail that leads to the long delays on the client side is
that our smbd_server_connection_terminate_ex() code will close
only the fd of a single smbXsrv_connection, but the refcount
on the socket fd in the kernel is still not 0, so the tcp
connection is still alive...
Now we remember the server_id of the process that we send
the MSG_SMBXSRV_CONNECTION_PASS message to. And just keep
watching the smbXcli_client.tdb record if the server_id
don't change. As we just need more patience to wait for
the MSG_SMBXSRV_CONNECTION_PASSED message.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15346
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Tue Aug 8 13:59:58 UTC 2023 on atb-devel-224
|
||
|---|---|---|
| .. | ||
| bug-14236 | ||
| bug-14810 | ||
| claims-client-tool | ||
| complex_expressions | ||
| dfs_paths | ||
| dns | ||
| dns_packet | ||
| dns-aging | ||
| durable-v2-delay | ||
| empty-domain-name | ||
| encrypted_secrets | ||
| getncchanges | ||
| initshutdown | ||
| kdc-salt | ||
| keytab | ||
| kinit_trust | ||
| krb5-no-preauth | ||
| labdc | ||
| ldap | ||
| ldap_spn | ||
| lm-hash-support-gone | ||
| lzxpress | ||
| modify-order | ||
| multichannel | ||
| netlogon | ||
| nt-hash-support-gone | ||
| ntlmv1-restrictions | ||
| ntlmv2-restrictions | ||
| oneway | ||
| priv_attr | ||
| protected_users | ||
| python-segfaults | ||
| quota1 | ||
| README | ||
| replica_sync | ||
| rpc-dfs | ||
| rpc-netlogon-zerologon | ||
| rw-invalid | ||
| s3-logging | ||
| s3-lsa-server | ||
| samba3.rpc.samr | ||
| samba3.vfs.fruit | ||
| samba4.rpc.netlogon-s3 | ||
| samba4.rpc.samr | ||
| samba-4.5-emulation | ||
| sddl | ||
| sid-strings | ||
| silo-client-tool | ||
| smb1-tests | ||
| smb2.replay | ||
| smb2.session | ||
| smbcacls | ||
| smbclient_machine_auth.plain | ||
| smbclient-smb3 | ||
| source3-epmapper | ||
| srvsvc | ||
| uac_objectclass_restrict | ||
| upn_handling | ||
| usage | ||
| vlv | ||
| wkssvc | ||
# Files in this directory contain lists of regular expressions # matching the names of tests that are temporarily expected to fail. # # "make test" will not report failures for tests listed here and will consider # a successful run for any of these tests an error. # # Empty lines and lines beginning with '#' are ignored. # Please don't add tests to this README!