ctdb-common: Support IPoIB ARPs and IPv6 Neighbor Advertisements

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Vinit Agnihotri <vagnihot@redhat.com>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>
Autobuild-User(master): Martin Schwenke <martins@samba.org>
Autobuild-Date(master): Mon Jul 27 04:48:13 UTC 2026 on atb-devel-224

ctdb-tests: Handle arbitrary length hardware addresses

While the code can generally handle arbitrary length addresses, known
lengths are used to set the hardware type.  Therefore, tests are
artificially limited to 6 octet addresses (Ethernet) and 20 octet
addresses (IPoIB).

Add some test cases for IPoIB.

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Vinit Agnihotri <vagnihot@redhat.com>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-common: Pass hardware address to ip6_na_build()

Use address, length and type in ip6_na_build().

Logically, this generalises the code to handle any hardware address
type/length.

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Vinit Agnihotri <vagnihot@redhat.com>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-common: Pass hardware address to arp_build()

Use the address, length and hardware type.  arp_build() now works for
any supported hardware address length.

Update the test code to construct the required sockaddr_ll structure.

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Vinit Agnihotri <vagnihot@redhat.com>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-common: Construct IPv6oIB link-level multicast address

As per the comment in the code: reading RFC4391, section 4 and looking
at example GIDs on a system, suggests a simple method of mapping the
IPv4 broadcast address to an IPv6oIB multicast address.

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Vinit Agnihotri <vagnihot@redhat.com>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-common: Encapsulate whole IPv6 sendto() address setup

Variable sall is no longer used by IPv4.  It is now only used to
construct the sendto() destination address for IPv6 NA.

Replace this variable with a sockaddr_storage so it can fit larger
link-level addresses.  Change the type of ip6_ll_multicast_build() and
use it to set the sockaddr_storage (as a sockaddr_ll), based on the
link-level broadcast address and RFCs.

IPoIB is currently not supported.

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Vinit Agnihotri <vagnihot@redhat.com>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-common: Use broadcast address for ARP sendto()

Use the retrieved broadcast address, since it may vary for
non-Ethernet link-level protocols.

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Vinit Agnihotri <vagnihot@redhat.com>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-common: Bind using hardware address

Pass the found hardware address directly to bind(), instead of
effectively using sall as a temporary variable.  Calculate the real
length.

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Vinit Agnihotri <vagnihot@redhat.com>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-common: Open the socket after finding the interface

The socket is no longer used to find the interface so avoid having to
close it if a suitable interface is not found.

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Vinit Agnihotri <vagnihot@redhat.com>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-common: Find interface using getifaddrs(3)

This is the first step towards IPoIB ARP/NA support, which uses 20
octet hardware addresses.  See the comment in the code for more
details.

This is a (relatively) minimal change.  find_interface() returns a lot
of duplicate information that isn't yet used.  Also, this is (still)
explicitly restricted to Ethernet.  Improvements and clean up to come
in subsequent commits.

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Signed-off-by: Vinit Agnihotri <vagnihotri@ddn.com>
Reviewed-by: Vinit Agnihotri <vagnihot@redhat.com>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-common: Add macro CTDB_CAN_SEND_ARPS

Later, this will depend on more things.  Make this change now to
minimise the size of a later commit.

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Vinit Agnihotri <vagnihot@redhat.com>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-common: Make ip6_na_build() more flexible

Instead of filling in a fixed ether_addr structure, allow for
flexibility in link-level hardware address length.

Including the calculation for the option length and padding is not yet
necessary.  However, it makes a future commit much simpler.

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Vinit Agnihotri <vagnihot@redhat.com>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-common: Make arp_build() more flexible

Instead of filling in a fixed ether_arp structure, allow for
flexibility in link-level hardware address length.

Similarly, make the buffer size able to accommodate the largest
possible hardware addresses.

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Signed-off-by: Vinit Agnihotri <vagnihotri@ddn.com>
Reviewed-by: Vinit Agnihotri <vagnihot@redhat.com>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-common: Don't build IPv6 NA link-level header

The link-level destination address is now setup outside
ip6_na_build(), since it is no longer used in that function.  Group
the parts of it together instead of leaving them scattered.

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Vinit Agnihotri <vagnihot@redhat.com>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-common: Don't build ARP link-level header

This means the destination broadcast address no longer needs to be an
output parameter of arp_build().

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Vinit Agnihotri <vagnihot@redhat.com>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-common: Use a datagram socket to send packets

The plan is to stop building the link-level (currently Ethernet)
header and let the network stack construct it.  2 reasons:

1. It should work

2. The InfiniBand link-level header is a mystery and I don't know how
   to construct it

To keep this commit small, the link-level header is still built, but
it is ignored.  This adds a small amount of churn to the sendto()
calls but allows smaller, more comprehensible steps.

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Signed-off-by: Vinit Agnihotri <vagnihotri@ddn.com>
Reviewed-by: Vinit Agnihotri <vagnihot@redhat.com>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-common: Simplify filling ARP packet

Only one field is different between request and reply.  Factor out the
common code so it is above and below a simplified if-statement that
handles just the different field.

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Vinit Agnihotri <vagnihot@redhat.com>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-common: Pass the ARP operation to arp_build()

This way the argument directly represents the intent so is
self-documenting.  The operation is now assigned into the structure
element so the 2 arms of the if-statement have only a single statement
that is different.  Keep this commit simple and let a subsequent
commit factor the common items.

Note that this is an static function so there is no widespread API
churn.

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Vinit Agnihotri <vagnihot@redhat.com>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-common: Clarify IPv6 multicast addresses

At the moment these are a little too magic, especially the completely
undocumented one.

Ensure there are clear comments with references to save time when
touching this code in future.

Build the link-level multicast address in its own function to reduce
churn later.

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Vinit Agnihotri <vagnihot@redhat.com>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-common: Clean up error handling when sending ARPs

Consistently close the socket after it has been opened.  Check for -1
to handle (future) code ordering changes.

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Vinit Agnihotri <vagnihot@redhat.com>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

ctdb-tests: Add sendarp command for manual testing

"system_socket_test sendarp ..." can simply be run as root from the
source tree.

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Vinit Agnihotri <vagnihot@redhat.com>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

vfs_ceph_new: Include proxy setting in mount cache cookie

The mount cache cookie is derived from (conf_file/user_id/fsname) but
does not include the proxy mode. When two shares differ only in their
proxy setting, they produce the same cookie and share a single cached
ceph_mount_info. Since libcephfs.so and libcephfs_proxy.so define
struct ceph_mount_info with entirely different layouts, calling a
function resolved from one library on a mount allocated by the other
causes a segfault.

Add config->proxy to the cookie so that mounts created by different
libraries are never shared.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=16186

Signed-off-by: Anoop C S <anoopcs@samba.org>
Reviewed-by: John Mulligan <jmulligan@redhat.com>
Reviewed-by: Guenther Deschner <gd@samba.org>
Autobuild-User(master): Anoop C S <anoopcs@samba.org>
Autobuild-Date(master): Fri Jul 24 15:56:49 UTC 2026 on atb-devel-224

s4:selftest: run samba.tests.nps_echo_test

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Fri Jul 24 14:36:47 UTC 2026 on atb-devel-224

s3:rpc_server: add a simple npsd_echo_server.c

This uses the new nps_worker_main() infrastructure
in order to implement a trivial named pipe echo
service.

For now it provides two named pipes both with
message mode, but different allocation sizes
limiting the max size of an echo request.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

python/tests: add FSCTL_PIPE_WAIT tests to nps_echo_test.py

This tests that FSCTL_PIPE_WAIT starts samba-dcerpcd on
demand if needed.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

python/tests: let nps_echo_test.py test more combinations

This verifies that upper case pipenames also work.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

python/tests: add simple smb named pipe echo test

This will be a regression test for the npsd_echo_server
coming in the next commits.

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Noel Power <noel.power@suse.com>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

s3:libsmb: allow map_fnum_to_smb2_handle() to handle UINT16_MAX

This will be needed for some fsctl tests using no file handle.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

s3:libsmb: only provide struct smb2_hnd as const

The callers should never change the content and
don't assume it's a valid talloc pointer.

This will allow us to use a fake handle for
UINT16_MAX => UINT64_MAX/UINT64_MAX in the next
commit.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

s3:rpc_server: introduce nps_worker_main()

This is the base to implement non-dcerpc named pipe servers,
which can be used for the WSP service on \pipe\MsFteWds.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

s3:rpc_server: add support for npsd_* services to rpc_host.c

This will allow named pipe servies without dcerpc.
It will be the base to implement the WSP service
on \pipe\MsFteWds.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

s3:rpc_server: maintain file_type, device_state, allocation_size per endpoint

Use the defaults for dcerpc, but in future we will have non-dcerpc
services in future...

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

s3:rpc_server: rename rpc_host_bind_read* to rpc_host_new_client*

In future this will not only be about reading the dcerpc bind pdu,
but also about accepting the npa state for NCACN_NP.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

s3:rpc_server: add --np-only option to samba-dcerpcd

Sometimes admins prefer to start samba-dcerpcd
as daemon instead of on demand in order to
avoid startup latency. But at the same time
they may not want to provide ncacn_ip_tcp.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

s3:rpc_server: split rpc_worker.[ch] into rpc_worker_{internal,dcerpc}.[ch]

This will make it possible to implement more generic
services behind named pipes soon.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

s3:rpc_server: move most of dcerpc_ncacn_conn into private rpc_worker_connection

This prepares more abstraction in rpc_worker.c coming in the next
commits.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

s3:smb2_ioctl: implement FSCTL_PIPE_WAIT

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

s3:rpc_server: implement np_wait_exists_send/recv()

This will be used to implement FSCTL_PIPE_WAIT in the SMB server.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

s3:rpc_client: add probe_only argument to local_np_connect[_send]()

This will cause SAMBA_NPA_FLAGS_PROBE_ONLY to be passed to
the named pipe server and let local_np_connect_recv()
return EEXIST instead of tstream_context.

This will be used to implement FSCTL_PIPE_WAIT.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

s3:rpc_server: add SAMBA_NPA_FLAGS_PROBE_ONLY handling

This will be used in order to check if a specific
named pipe is available without creating a new connection.

This will be used in order to implement FSCTL_PIPE_WAIT
in the following commits.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

s3:rpc_server: fix SAMBA_NPA_FLAGS_NEED_IDLE logic

This may not change the real logic, but it's much easier
to read...

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

s3:smbd: remove unused dcesrv_context from smbd_server_connection

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

s3:rpc_server: np_open() doesn't need a struct dcesrv_context

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

s3:rpc_server: remove unused dcerpc_ncacn_conn->sock

This is never used...

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

s3:rpc_server: fix use after free in rpc_worker_new_client() error path

dcesrv_conn is a client of ncacn_conn, so we can't call
TALLOC_FREE(dcesrv_conn); after TALLOC_FREE(ncacn_conn);

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

librpc: add python_ioctl

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

pidl:Samba4/Python: use a C array size variable to cache PyList_GET_SIZE($py_var)

This allows the C compiler to notice that we correctly checked the size
of fixed sized arrays.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=16006

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

ctdb-scripts: Secure the persistent TDB backup directory

Persistent database backups may contain sensitive data such as
Samba credentials in secrets.tdb. Currently these backup files
are created with default permissions, allowing any local user to
read sensitive credentials.

Add an optional -m <mode> argument to ctdb-backup-persistent-tdbs.sh
to set permissions for the backup directory.

A new CTDB_PERSISTENT_DB_BACKUP_MODE configuration variable is added
to script.options, allowing administrators to customize the
permissions mode. The default is 0700 to ensure secure-by-default
behavior, protecting sensitive data from unauthorized access.

The backup script sets directory permissions on the backup destination
every time it runs, providing self-healing protection.

Permissions are enforced in ctdb-backup-persistent-tdbs.sh rather than
the event script to avoid running chmod every 15 seconds during monitor
events. The backup script can also be called manually, ensuring
permissions are always enforced when backups are created.

Signed-off-by: Agam S <agam@ddn.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Thu Jul 23 11:40:03 UTC 2026 on atb-devel-224

WHATSNEW: Document vfs_aio_ratelimit cluster-wide rate limiting

Signed-off-by: Avan Thakkar <athakkar@redhat.com>
Reviewed-by: Anoop C S <anoopcs@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Wed Jul 22 17:03:16 UTC 2026 on atb-devel-224

autobuild: add --with-ratelimitd to samba_configure_params

Signed-off-by: Avan Thakkar <athakkar@redhat.com>
Reviewed-by: Anoop C S <anoopcs@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

build: add on/off ratelimitd option

Signed-off-by: Avan Thakkar <athakkar@redhat.com>
Reviewed-by: Anoop C S <anoopcs@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

vfs_aio_ratelimit: add cluster mode note to test script

Signed-off-by: Avan Thakkar <athakkar@redhat.com>
Reviewed-by: Anoop C S <anoopcs@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

vfs_aio_ratelimit: document cluster-wide coordination

Signed-off-by: Avan Thakkar <athakkar@redhat.com>
Reviewed-by: Anoop C S <anoopcs@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

vfs_aio_ratelimit: add cluster-wide rate limiting via daemon aggregation

Add cluster coordination using a daemon-based architecture. Each node runs
a ratelimitd daemon that aggregates local smbd activity and broadcasts node
summaries via CTDB. VFS processes receive summaries and dynamically distribute
the global rate limit fairly among all active processes.

Network message complexity: O(M²) where M is the number of nodes.

Signed-off-by: Avan Thakkar <athakkar@redhat.com>
Reviewed-by: Anoop C S <anoopcs@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

vfs_ceph_rgw: Implement SMB_VFS_OPEN_SHARE_ROOT

Signed-off-by: Anoop C S <anoopcs@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Anoop C S <anoopcs@samba.org>
Autobuild-Date(master): Wed Jul 22 15:49:49 UTC 2026 on atb-devel-224

vfs_glusterfs: Implement SMB_VFS_OPEN_SHARE_ROOT

Signed-off-by: Anoop C S <anoopcs@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

vfs_ceph_new: Implement SMB_VFS_OPEN_SHARE_ROOT

Signed-off-by: Anoop C S <anoopcs@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

vfs_ceph: Implement SMB_VFS_OPEN_SHARE_ROOT

Signed-off-by: Anoop C S <anoopcs@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

vfs_default: Use vfs_set_share_root() in vfswrap_open_share_root()

Signed-off-by: Anoop C S <anoopcs@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

vfs: Add vfs_set_share_root() helper

Signed-off-by: Anoop C S <anoopcs@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

vfs_default: Implement SMB_VFS_OPEN_SHARE_ROOT()

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

vfs: Add SMB_VFS_OPEN_SHARE_ROOT()

While converting more and more users from stat() to fstatat() I found
that there is one special stat-call that is different from all others:
When connecting to a share, we call SMB_VFS_STAT() without a properly
set up conn->cwd_fsp. This one special call causes quite some
special-case handling in the implementations.

Reflect this special case with a new VFS call OPEN_SHARE_ROOT. Its
final purpose will be to get us a proper fd on the share root, but
until we stop doing chdir calls into the share we can live with
AT_FDCWD being returned.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

s3-selftest: test netsamlogoncache entry expiry

Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Wed Jul 22 12:42:55 UTC 2026 on atb-devel-224

s3-samlogoncache: allow to expire cache entries

This can be controlled via parametric option:
"netsamlogoncache : timeout = <SECONDS>"

netsamlogoncache:timeout=0 (the default) means never expire.

Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>

vfs_ceph_snapshots: Fix panic on snapshot access with a "/"-rooted share

ceph_snap_gmt_convert_dir() builds an absolute snapshot path by joining
the share's connectpath, the request-relative name and the snapshot
subdir with '/' separators, then hands it to OpenDir(). OpenDir() ->
fd_openat() -> filename_convert_dirfsp_rel() splits the path on '/' and
openat_pathref_fsp_nosymlink() asserts that no component is empty:

    SMB_ASSERT(rel_fname.base_name[0] != '\0')   source3/smbd/files.c:1212

connectpath is a bare "/" when the share is mounted at the file system
root, so the join yields a leading "//" (e.g. "//.snap" or
"//dir/.snap"). That empty first component trips the assert and panics
smbd as soon as a snapshot is accessed.

Whether the malformed path actually reaches the assert also depends on
the Ceph client accepting a non-canonical "//" path in the preceding
stat(), so the panic is libcephfs-version dependent.

Canonicalize the .snap directory path with canonicalize_absolute_path()
after building it, so the path handed to OpenDir() is always canonical
and the empty leading component can no longer occur.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=16176

Signed-off-by: Matthias Grandl <matthias.grandl@croit.io>
Reviewed-by: Anoop C S <anoopcs@samba.org>
Reviewed-by: David Disseldorp ddiss@samba.org
Autobuild-User(master): Anoop C S <anoopcs@samba.org>
Autobuild-Date(master): Tue Jul 21 16:12:18 UTC 2026 on atb-devel-224

selftest:Samba4: use samba_dnsupdate --sync-file for SAMBA_DNS_FAKING

Even with SAMBA_DNS_FAKING, which means resolv_wrapper can't to real dns
over the network, we want dns updates to happen on the server,
so that our own dns client sees them.

Otherwise some tests fallback to netbios name resolution,
which gives strange and unexpected results.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Tue Jul 21 10:39:14 UTC 2026 on atb-devel-224

s4:samba_dnsupdate: add --sync-file option

This can be used similar to the --use-file option,
but the --sync-file option only mirrors the real dns
updates into the file.

It means the dns records on the server are still created,
this is needed for more useful testing.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>

s4:samba_dnsupdate: let update_file check for modified first

We only replace the file if it's modified.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>

s4:samba_dnsupdate: split out a update_file() helper function

This will help with the following changes.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>

s4/resolve: drop unused include

Since the commits around c9587205aa1e10a71db96389d76c0e8e1f80e76b we use IDL
based marshalling and don't need the include anymore.

Drop it, as it causes a compilation failure on AIX

  [1852/3392] Compiling source4/libcli/resolve/dns_ex.c
  "../../source4/libcli/resolve/dns_ex.c", line 111.25: 1506-022 (S) "class" is not a member of "struct dns_res_rec".

This happens because on AIX the header has:

  /* ISC defines class member as rr_class. */
  #ifdef __cplusplus
  #define rr_class nsrr_class
  #else
  #define rr_class class
  #endif

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Mon Jul 20 07:46:42 UTC 2026 on atb-devel-224

smbd: implement POSIX-FSA 2.1.4.8.1 FileDispositionInformation

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Fri Jul 17 18:26:27 UTC 2026 on atb-devel-224

python/tests: add Smb3UnixTests.test_delete_read_only_attr

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

python/tests: enhance LibsmbTests.clean_file to work with READ-ONLY attributes

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

pylibsmb: add "sfileinfo" method

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

pylibsmb: add MS-SMB2 SET_INFO InfoTypes

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

WHATSNEW: SMB3 Persistent Handles

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Fri Jul 17 11:21:41 UTC 2026 on atb-devel-224

CI: skip samba3.clustered.smb2.persistent-open.reconnect-contended

It's likely a real bug that needs to be investigated, but we're
running out of time for the 4.25 merge windows, so let's pave over it
and fix it later.

Marking as flapping is not sufficient as the test leaves ctdb
non-functional when failing.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

smbtorture: add test "smb2.persistent-open.deleteonclose-twice"

Verifies cleanup of stale delete-on-close token. This only works against Samba
where we have to implement DoC token expiration instead of fully deleting the
file (and the token).

 1. Open file with PH an handle-timeout of 1s
 2. Open file a second time with PH an handle-timeout of 10s
 3. Set Doc on handle from (1)
 4. Set Doc on handle from (2)
 5. Disconnect
 6. Sleep 2s, handle from (1) should expire, scavenger should not
    cleanup DoC token as that is from (3)
 7. Reconnect session and handle from (3)
 8. Close file, should now get removed as Doc should still be set
 9. Verify file is gone

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

smbtorture: add testsuite "smb2.persistent-open-failover"

This uses the same basic test as smb2.persistent-open.reconnect-contended, but
instead of doing a simple TCP disconnect from TALLOC_FREE()ing the smb2_tree, we
use the ctdb failover hooks.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

smbtorture: add tests "smb2.persistent-open.deleteonclose-[reconnect|expire]"

smb2.persistent-open.deleteonclose-reconnect verifies reconnecting or expiring a
Persistent Handle with delete-on-close pending:

1a. SMB2-CREATE + PH + initial-delete-on-close, or

1b. SMB2-CREATE + PH + SMB2-SETINFO(delete-on-close), then

2. Disconnect TCP
3. Reconnect TCP and handle
4. SMB2-CLOSE -> should delete the file
5. Try to open -> should fail with NT_STATUS_OBJECT_NAME_NOT_FOUND

The test smb2.persistent-open.deleteonclose-expire fails against Samba, but
works againt Windows. The reason is current lack of support for accessing our
VFS from the scavenger. Note that the same problem applies to Durable Handles,
not just Persistent Handles.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

smbtorture: add test "smb2.persistent-open.directory-disconnect"

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

smbtorture: add test "smb2.persistent-open.directory-leaselevels"

Test Persistent Handles and various lease levels on directories.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

smbtorture: add test "smb2.persistent-open.replay-multi"

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

smbtorture: add test "smb2.persistent-open.replay-reconnect"

A simple replay test on a Persistent Handle:

- get a persistent handle
- disconnect
- reconnect
- replay
- use reconnected handle by writing to it

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

smbtorture: add test "smb2.persistent-open.rename-dir-open-files"

Verifies rename a directory containing a disconnected Persistent Handle
fails.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

smbtorture: add test "smb2.persistent-open.timeout_5"

Verify that a disconnected Persistent Handle with a timeout of 5 seconds is
reaped by the scavenger after the timeout expires, so another client can then
open the file.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

smbtorture: add test "smb2.persistent-open.reconnect-contended-replay"

This tests verifies, that a

* contending open on a disconnected persisten open that triggers a lease
  break is blocked,

* a replay if the create that caused the lease break fails with
  NT_STATUS_FILE_NOT_AVAILABLE as long the the persistent open is still
  disconnected,

* after the persistent open is reconnected the second replay of the
  contending open succeeds

* the client with the persistent open receives a lease break

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

smbtorture: add test "smb2.persistent-open.reconnect-contended-oplock"

Persistent Handles together with oplocks are broken on Windows: eg oplocks are
"silently" downgraded from B to S when reconnecting a PH, instead of sending an
oplock break with the downgraded oplock level (cf --option=torture:subtest=7).

Samba doesn't grant Persistent Handles with oplocks at all, only with
leases or without an oplock or lease.

Skip these tests altogether, they're merely kept for historical
reference and in case this subject needs furthter exploration in the
future.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

smbtorture: add test "smb2.persistent-open.reconnect-contended-two"

Same as smb2.persistent-open.reconnect-contended, but with two Persistent
Handles sharing the same lease key.

Note that some tests are failing against Windows as Windows is strangely failing
to reconnect the second handle. This is being discussed with Microsoft:

PR: https://lists.samba.org/archive/cifs-protocol/2025-September/004583.html

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

smbtorture: add test "smb2.persistent-open.reconnect-contended"

This tests trying to open a file with a disconnected persistent handle
with various different lease levels, sharemodes and create disposition
combinations.

The client then disconnects and we try to open (contend) the now disconnected
Persistent Handle from the first client. This will either fail with
NT_STATUS_FILE_NOT_AVAILABLE or trigger a lease break which gets dispatched once
the first client reconnects.

The client must always be able to reconnect the disconnected open and the server
guarantees that any operations which break W or H leases are blocked.

The bottom line being:

* incompatible opens without H-lease are blocked with
  NT_STATUS_FILE_NOT_AVAILABLE

* incompatible opens with a H lease trigger a lease break and are deferred until
  the first client reconnects the handle

* in addition to that, if the file has byterange locks the lease must include
  W, otherwise contending opens are also blocked with NT_STATUS_FILE_NOT_AVAILABLE

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

smbtorture: start of a smb2.persistent-open testsuite

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

selftest: add share argument to planclusteredmembertestsuite()

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

s4/torture: add torture_smb2_connection_share_ext()

Takes an additional share paramter compared to torture_smb2_connection_ext().

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

selftest: add clusteredmember env ctdb management hooks

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

smbtorture: add utility functions to stop and restart the serving ctdb node

Add arbitrary sleep for five seconds, so far this seem to have worked well on
gitlab CI.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

smbd: add FSCTL_SMBTORTURE_[GET_CTDB_PNN|STOP_CTDB_NODE|START_CTDB_NODE]

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

smbd: bypass child cleanup when child exits with a magic exit code

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

smbstatus: print persistent handles

While at it, add all other share_mode_entry flags to the json output.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

smbd: SMB layer processing of Persistent Handle requests

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

smbd: fail replay operation on handle that has been used

Using a handle, eg processing an SMB2_WRITE operation, removes the replay cache
record associated with open.

If the handle is a Persistent Handle, the replay must fail with
NT_STATUS_FILE_NOT_AVAILABLE in this case, whereas for a Durable Handle without
persistency, the replay would be handled as a new create.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>