s3/libsmb: check the negative-conn-cache in resolve_ads()

This way we throw away blacklisted servers right away when learning about them
from the DNS SRV query.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14981

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Wed Jul 30 10:10:21 UTC 2025 on atb-devel-224

(cherry picked from commit c1ee6fe9a489a8923d607e14d26768935a398849)

Autobuild-User(v4-22-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-22-test): Thu Aug  7 13:50:32 UTC 2025 on atb-devel-224

diff --git a/source3/libsmb/namequery.c b/source3/libsmb/namequery.c
index a54ca2f74d37fea7651c6e3a44065be67bf3aeb6..0b762af64afce25cb20026c9077c8fe46f12a0df 100644 (file)
--- a/source3/libsmb/namequery.c
+++ b/source3/libsmb/namequery.c
@@ -2617,6 +2617,14 @@ static NTSTATUS resolve_ads(TALLOC_CTX *ctx,
        for(i = 0; i < numdcs; i++) {
                /* Copy all the IP addresses from the SRV response */
                size_t j;
+
+               status = check_negative_conn_cache(name, dcs[i].hostname);
+               if (!NT_STATUS_IS_OK(status)) {
+                       DBG_DEBUG("Skipping blacklisted server [%s] "
+                                 "for domain [%s]", dcs[i].hostname, name);
+                       continue;
+               }
+
                for (j = 0; j < dcs[i].num_ips; j++) {
                        char addr[INET6_ADDRSTRLEN];
 
@@ -2625,12 +2633,19 @@ static NTSTATUS resolve_ads(TALLOC_CTX *ctx,
                                continue;
                        }
 
+                       print_sockaddr(addr,
+                                      sizeof(addr),
+                                      &srv_addrs[num_srv_addrs]);
+
                        DBG_DEBUG("SRV lookup %s got IP[%zu] %s\n",
-                               name,
-                               j,
-                               print_sockaddr(addr,
-                                       sizeof(addr),
-                                       &srv_addrs[num_srv_addrs]));
+                                 name, j, addr);
+
+                       status = check_negative_conn_cache(name, addr);
+                       if (!NT_STATUS_IS_OK(status)) {
+                               DBG_DEBUG("Skipping blacklisted server [%s] "
+                                          "for domain [%s]", addr, name);
+                               continue;
+                       }
 
                        num_srv_addrs++;
                }