Martin Schwenke [Thu, 18 Jun 2026 08:02:47 +0000 (18:02 +1000)]
ctdb-common: Don't build IPv6 NA link-level header
The link-level destination address is now setup outside
ip6_na_build(), since it is no longer used in that function. Group
the parts of it together instead of leaving them scattered.
Martin Schwenke [Tue, 9 Dec 2025 05:24:22 +0000 (16:24 +1100)]
ctdb-common: Use a datagram socket to send packets
The plan is to stop building the link-level (currently Ethernet)
header and let the network stack construct it. 2 reasons:
1. It should work
2. The InfiniBand link-level header is a mystery and I don't know how
to construct it
To keep this commit small, the link-level header is still built, but
it is ignored. This adds a small amount of churn to the sendto()
calls but allows smaller, more comprehensible steps.
Martin Schwenke [Tue, 6 Jan 2026 03:12:31 +0000 (14:12 +1100)]
ctdb-common: Simplify filling ARP packet
Only one field is different between request and reply. Factor out the
common code so it is above and below a simplified if-statement that
handles just the different field.
Martin Schwenke [Tue, 6 Jan 2026 03:05:31 +0000 (14:05 +1100)]
ctdb-common: Pass the ARP operation to arp_build()
This way the argument directly represents the intent so is
self-documenting. The operation is now assigned into the structure
element so the 2 arms of the if-statement have only a single statement
that is different. Keep this commit simple and let a subsequent
commit factor the common items.
Note that this is an static function so there is no widespread API
churn.
Anoop C S [Fri, 24 Jul 2026 11:57:56 +0000 (17:27 +0530)]
vfs_ceph_new: Include proxy setting in mount cache cookie
The mount cache cookie is derived from (conf_file/user_id/fsname) but
does not include the proxy mode. When two shares differ only in their
proxy setting, they produce the same cookie and share a single cached
ceph_mount_info. Since libcephfs.so and libcephfs_proxy.so define
struct ceph_mount_info with entirely different layouts, calling a
function resolved from one library on a mount allocated by the other
causes a segfault.
Add config->proxy to the cookie so that mounts created by different
libraries are never shared.
Signed-off-by: Anoop C S <anoopcs@samba.org> Reviewed-by: John Mulligan <jmulligan@redhat.com> Reviewed-by: Guenther Deschner <gd@samba.org>
Autobuild-User(master): Anoop C S <anoopcs@samba.org>
Autobuild-Date(master): Fri Jul 24 15:56:49 UTC 2026 on atb-devel-224
s3:rpc_server: add --np-only option to samba-dcerpcd
Sometimes admins prefer to start samba-dcerpcd
as daemon instead of on demand in order to
avoid startup latency. But at the same time
they may not want to provide ncacn_ip_tcp.
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
s3:rpc_client: add probe_only argument to local_np_connect[_send]()
This will cause SAMBA_NPA_FLAGS_PROBE_ONLY to be passed to
the named pipe server and let local_np_connect_recv()
return EEXIST instead of tstream_context.
This will be used to implement FSCTL_PIPE_WAIT.
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
ctdb-scripts: Secure the persistent TDB backup directory
Persistent database backups may contain sensitive data such as
Samba credentials in secrets.tdb. Currently these backup files
are created with default permissions, allowing any local user to
read sensitive credentials.
Add an optional -m <mode> argument to ctdb-backup-persistent-tdbs.sh
to set permissions for the backup directory.
A new CTDB_PERSISTENT_DB_BACKUP_MODE configuration variable is added
to script.options, allowing administrators to customize the
permissions mode. The default is 0700 to ensure secure-by-default
behavior, protecting sensitive data from unauthorized access.
The backup script sets directory permissions on the backup destination
every time it runs, providing self-healing protection.
Permissions are enforced in ctdb-backup-persistent-tdbs.sh rather than
the event script to avoid running chmod every 15 seconds during monitor
events. The backup script can also be called manually, ensuring
permissions are always enforced when backups are created.
Signed-off-by: Agam S <agam@ddn.com> Reviewed-by: Martin Schwenke <martin@meltin.net> Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Thu Jul 23 11:40:03 UTC 2026 on atb-devel-224
Avan Thakkar [Fri, 13 Feb 2026 10:51:37 +0000 (16:21 +0530)]
vfs_aio_ratelimit: add cluster-wide rate limiting via daemon aggregation
Add cluster coordination using a daemon-based architecture. Each node runs
a ratelimitd daemon that aggregates local smbd activity and broadcasts node
summaries via CTDB. VFS processes receive summaries and dynamically distribute
the global rate limit fairly among all active processes.
Network message complexity: O(M²) where M is the number of nodes.
Signed-off-by: Avan Thakkar <athakkar@redhat.com> Reviewed-by: Anoop C S <anoopcs@samba.org> Reviewed-by: Guenther Deschner <gd@samba.org>
Anoop C S [Wed, 1 Jul 2026 15:20:12 +0000 (20:50 +0530)]
vfs_ceph_rgw: Implement SMB_VFS_OPEN_SHARE_ROOT
Signed-off-by: Anoop C S <anoopcs@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Anoop C S <anoopcs@samba.org>
Autobuild-Date(master): Wed Jul 22 15:49:49 UTC 2026 on atb-devel-224
Volker Lendecke [Sun, 19 Oct 2025 10:07:07 +0000 (12:07 +0200)]
vfs: Add SMB_VFS_OPEN_SHARE_ROOT()
While converting more and more users from stat() to fstatat() I found
that there is one special stat-call that is different from all others:
When connecting to a share, we call SMB_VFS_STAT() without a properly
set up conn->cwd_fsp. This one special call causes quite some
special-case handling in the implementations.
Reflect this special case with a new VFS call OPEN_SHARE_ROOT. Its
final purpose will be to get us a proper fd on the share root, but
until we stop doing chdir calls into the share we can live with
AT_FDCWD being returned.
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
vfs_ceph_snapshots: Fix panic on snapshot access with a "/"-rooted share
ceph_snap_gmt_convert_dir() builds an absolute snapshot path by joining
the share's connectpath, the request-relative name and the snapshot
subdir with '/' separators, then hands it to OpenDir(). OpenDir() ->
fd_openat() -> filename_convert_dirfsp_rel() splits the path on '/' and
openat_pathref_fsp_nosymlink() asserts that no component is empty:
connectpath is a bare "/" when the share is mounted at the file system
root, so the join yields a leading "//" (e.g. "//.snap" or
"//dir/.snap"). That empty first component trips the assert and panics
smbd as soon as a snapshot is accessed.
Whether the malformed path actually reaches the assert also depends on
the Ceph client accepting a non-canonical "//" path in the preceding
stat(), so the panic is libcephfs-version dependent.
Canonicalize the .snap directory path with canonicalize_absolute_path()
after building it, so the path handed to OpenDir() is always canonical
and the empty leading component can no longer occur.
Signed-off-by: Matthias Grandl <matthias.grandl@croit.io> Reviewed-by: Anoop C S <anoopcs@samba.org> Reviewed-by: David Disseldorp ddiss@samba.org
Autobuild-User(master): Anoop C S <anoopcs@samba.org>
Autobuild-Date(master): Tue Jul 21 16:12:18 UTC 2026 on atb-devel-224
selftest:Samba4: use samba_dnsupdate --sync-file for SAMBA_DNS_FAKING
Even with SAMBA_DNS_FAKING, which means resolv_wrapper can't to real dns
over the network, we want dns updates to happen on the server,
so that our own dns client sees them.
Otherwise some tests fallback to netbios name resolution,
which gives strange and unexpected results.
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Tue Jul 21 10:39:14 UTC 2026 on atb-devel-224
This can be used similar to the --use-file option,
but the --sync-file option only mirrors the real dns
updates into the file.
It means the dns records on the server are still created,
this is needed for more useful testing.
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
s4:samba_dnsupdate: let update_file check for modified first
We only replace the file if it's modified.
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
s4:samba_dnsupdate: split out a update_file() helper function
This will help with the following changes.
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
Drop it, as it causes a compilation failure on AIX
[1852/3392] Compiling source4/libcli/resolve/dns_ex.c
"../../source4/libcli/resolve/dns_ex.c", line 111.25: 1506-022 (S) "class" is not a member of "struct dns_res_rec".
This happens because on AIX the header has:
/* ISC defines class member as rr_class. */
#ifdef __cplusplus
#define rr_class nsrr_class
#else
#define rr_class class
#endif
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Martin Schwenke <martin@meltin.net> Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Mon Jul 20 07:46:42 UTC 2026 on atb-devel-224
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Fri Jul 17 18:26:27 UTC 2026 on atb-devel-224
Ralph Boehme [Fri, 17 Jul 2026 09:24:08 +0000 (11:24 +0200)]
WHATSNEW: SMB3 Persistent Handles
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Fri Jul 17 11:21:41 UTC 2026 on atb-devel-224
It's likely a real bug that needs to be investigated, but we're
running out of time for the 4.25 merge windows, so let's pave over it
and fix it later.
Marking as flapping is not sufficient as the test leaves ctdb
non-functional when failing.
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org>
Ralph Boehme [Tue, 2 Dec 2025 15:09:32 +0000 (16:09 +0100)]
smbtorture: add test "smb2.persistent-open.deleteonclose-twice"
Verifies cleanup of stale delete-on-close token. This only works against Samba
where we have to implement DoC token expiration instead of fully deleting the
file (and the token).
1. Open file with PH an handle-timeout of 1s
2. Open file a second time with PH an handle-timeout of 10s
3. Set Doc on handle from (1)
4. Set Doc on handle from (2)
5. Disconnect
6. Sleep 2s, handle from (1) should expire, scavenger should not
cleanup DoC token as that is from (3)
7. Reconnect session and handle from (3)
8. Close file, should now get removed as Doc should still be set
9. Verify file is gone
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org>
This uses the same basic test as smb2.persistent-open.reconnect-contended, but
instead of doing a simple TCP disconnect from TALLOC_FREE()ing the smb2_tree, we
use the ctdb failover hooks.
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org>
smb2.persistent-open.deleteonclose-reconnect verifies reconnecting or expiring a
Persistent Handle with delete-on-close pending:
1a. SMB2-CREATE + PH + initial-delete-on-close, or
1b. SMB2-CREATE + PH + SMB2-SETINFO(delete-on-close), then
2. Disconnect TCP
3. Reconnect TCP and handle
4. SMB2-CLOSE -> should delete the file
5. Try to open -> should fail with NT_STATUS_OBJECT_NAME_NOT_FOUND
The test smb2.persistent-open.deleteonclose-expire fails against Samba, but
works againt Windows. The reason is current lack of support for accessing our
VFS from the scavenger. Note that the same problem applies to Durable Handles,
not just Persistent Handles.
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org>
Ralph Boehme [Mon, 25 Aug 2025 09:56:48 +0000 (11:56 +0200)]
smbtorture: add test "smb2.persistent-open.timeout_5"
Verify that a disconnected Persistent Handle with a timeout of 5 seconds is
reaped by the scavenger after the timeout expires, so another client can then
open the file.
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org>
Ralph Boehme [Thu, 25 Sep 2025 14:59:54 +0000 (16:59 +0200)]
smbtorture: add test "smb2.persistent-open.reconnect-contended-oplock"
Persistent Handles together with oplocks are broken on Windows: eg oplocks are
"silently" downgraded from B to S when reconnecting a PH, instead of sending an
oplock break with the downgraded oplock level (cf --option=torture:subtest=7).
Samba doesn't grant Persistent Handles with oplocks at all, only with
leases or without an oplock or lease.
Skip these tests altogether, they're merely kept for historical
reference and in case this subject needs furthter exploration in the
future.
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org>
Ralph Boehme [Thu, 25 Sep 2025 14:49:22 +0000 (16:49 +0200)]
smbtorture: add test "smb2.persistent-open.reconnect-contended-two"
Same as smb2.persistent-open.reconnect-contended, but with two Persistent
Handles sharing the same lease key.
Note that some tests are failing against Windows as Windows is strangely failing
to reconnect the second handle. This is being discussed with Microsoft:
Ralph Boehme [Sun, 24 Aug 2025 19:56:38 +0000 (21:56 +0200)]
smbtorture: add test "smb2.persistent-open.reconnect-contended"
This tests trying to open a file with a disconnected persistent handle
with various different lease levels, sharemodes and create disposition
combinations.
The client then disconnects and we try to open (contend) the now disconnected
Persistent Handle from the first client. This will either fail with
NT_STATUS_FILE_NOT_AVAILABLE or trigger a lease break which gets dispatched once
the first client reconnects.
The client must always be able to reconnect the disconnected open and the server
guarantees that any operations which break W or H leases are blocked.
The bottom line being:
* incompatible opens without H-lease are blocked with
NT_STATUS_FILE_NOT_AVAILABLE
* incompatible opens with a H lease trigger a lease break and are deferred until
the first client reconnects the handle
* in addition to that, if the file has byterange locks the lease must include
W, otherwise contending opens are also blocked with NT_STATUS_FILE_NOT_AVAILABLE
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org>
Ralph Boehme [Mon, 25 Aug 2025 16:48:20 +0000 (18:48 +0200)]
smbd: fail replay operation on handle that has been used
Using a handle, eg processing an SMB2_WRITE operation, removes the replay cache
record associated with open.
If the handle is a Persistent Handle, the replay must fail with
NT_STATUS_FILE_NOT_AVAILABLE in this case, whereas for a Durable Handle without
persistency, the replay would be handled as a new create.
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org>
Ralph Boehme [Wed, 26 Feb 2025 16:55:57 +0000 (17:55 +0100)]
smbd: check for Persistent Handles in smbXsrv_open_global_verify_record()
Return NT_STATUS_REMOTE_DISCONNECT for a Persistent Handle if the process
doesn't exist, same error response as for a Durable Handle where the server_id
is found to be set to the special disconnected id a few lines above.
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org>
projects / thirdparty / samba.git / log
