From c1ee6fe9a489a8923d607e14d26768935a398849 Mon Sep 17 00:00:00 2001 From: Ralph Boehme Date: Thu, 3 Jul 2025 18:42:04 +0200 Subject: [PATCH] s3/libsmb: check the negative-conn-cache in resolve_ads() MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit This way we throw away blacklisted servers right away when learning about them from the DNS SRV query. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14981 Signed-off-by: Ralph Boehme Reviewed-by: Guenther Deschner Autobuild-User(master): Günther Deschner Autobuild-Date(master): Wed Jul 30 10:10:21 UTC 2025 on atb-devel-224 --- source3/libsmb/namequery.c | 25 ++++++++++++++++++++----- 1 file changed, 20 insertions(+), 5 deletions(-) diff --git a/source3/libsmb/namequery.c b/source3/libsmb/namequery.c index a54ca2f74d3..0b762af64af 100644 --- a/source3/libsmb/namequery.c +++ b/source3/libsmb/namequery.c @@ -2617,6 +2617,14 @@ static NTSTATUS resolve_ads(TALLOC_CTX *ctx, for(i = 0; i < numdcs; i++) { /* Copy all the IP addresses from the SRV response */ size_t j; + + status = check_negative_conn_cache(name, dcs[i].hostname); + if (!NT_STATUS_IS_OK(status)) { + DBG_DEBUG("Skipping blacklisted server [%s] " + "for domain [%s]", dcs[i].hostname, name); + continue; + } + for (j = 0; j < dcs[i].num_ips; j++) { char addr[INET6_ADDRSTRLEN]; @@ -2625,12 +2633,19 @@ static NTSTATUS resolve_ads(TALLOC_CTX *ctx, continue; } + print_sockaddr(addr, + sizeof(addr), + &srv_addrs[num_srv_addrs]); + DBG_DEBUG("SRV lookup %s got IP[%zu] %s\n", - name, - j, - print_sockaddr(addr, - sizeof(addr), - &srv_addrs[num_srv_addrs])); + name, j, addr); + + status = check_negative_conn_cache(name, addr); + if (!NT_STATUS_IS_OK(status)) { + DBG_DEBUG("Skipping blacklisted server [%s] " + "for domain [%s]", addr, name); + continue; + } num_srv_addrs++; } -- 2.47.2