libsmb: Use netlogon_pings() in dsgetdcname

Use parallel requests and req_flags filtering provided by
netlogon_pings()

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

kerberos: Use netlogon_pings()

This also makes sure we've got a KDC via DS_KDC_REQUIRED

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

ldap: Use netlogon_pings

This already requests the flags that ads_fill_cldap_reply() will later
check for, so netlogon_pings will only feed sufficient DCs into
ads_fill_cldap_reply.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

cldap: Use netlogon_pings()

Allow LDAPS for ads_cldap_netlogon()

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

libads: Add netlogon_pings()

This encapsulates our logic that we send CLDAP requests on UDP/389,
sending them with 100msec timeouts until someone replies. It also
contains the code to do this over LDAP/389 or LDAPS/636.

It also contains code to filter for domain controller flags like
DS_ONLY_LDAP_NEEDED, this logic exists in several places right now.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

tldap: Add tldap_context_create_from_plain_stream()

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

param: Add "client netlogon ping protocol"

Allow "net ads join" in environments where UDP/389 is blocked. Code
will follow.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

lib: Add a few required includes

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

build: Remove the big samba3util dependency from TLDAP

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

build: Make util_tsock its own subsystem

One step to strip TLDAP deps

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

param: Remove parameter "cldap port"

This was not used consistently across all of our code base, and I
don't see a reason why this should ever not be port 389.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

cldap: Make finddcs.out.netlogon a pointer

struct netlogon_samlogon_response has subpointers, this patch enables
a proper talloc hierarchy.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

cldap: Make cldap_netlogon.out.netlogon a pointer

struct netlogon_samlogon_response has subpointers, this patch enables
a proper talloc hierarchy.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

lib: Fix trailing whitespace

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

cldap: Remove cldap_netlogon->in.map_response

We should not pass booleans down where the caller can do the same
thing with equal effort

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

libnet4: Call map_netlogon_samlogon_response directly

Avoid using a boolean flag passed down

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

libnet4: Call map_netlogon_samlogon_response directly

Avoid using a boolean flag passed down

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

libnet4: Call map_netlogon_samlogon_response directly

Avoid using a boolean flag passed down

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

libcli4: Call map_netlogon_samlogon_response directly

Avoid using a boolean flag passed down

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

torture4: Simplifiy [tcp|udp]_ldap_netlogon()

Both callers set "map_response=true", so we don't need that flag here.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

tldap_tls: Remove tldap_[gs]et_starttls_needed()

The caller setting up a tldap connection is aware of whether to use
starttls, which is one single ldap extended operation before the tls
crypto starts. There is no complex logic behind this that is
worthwhile to be hidden behind a flag and an API. If there was more to
it than just a simple call to tldap_extended(), I would all be for
passing down that flag, but for this case I would argue the logic
after this patch is simpler.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

tldap_tls: Move creation of tls_params out of tldap_tls_connect()

Soon we will have a tldap user which does not want to verify the
certs. Instead of passing another boolean down, hand in pre-created
tstream_tls_params.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

tstream_tls: Add tstream_tls_params_peer_name()

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

smbtorture: use torture_assert_ntstatus_equal_goto() in CHECK_STATUS() in unlink.c

fixup

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>
Autobuild-User(master): Anoop C S <anoopcs@samba.org>
Autobuild-Date(master): Mon Nov 11 14:01:18 UTC 2024 on atb-devel-224

smbtorture: move hardlink test in test_ntrename() to its own test

Some filesystems may not support hardlinks.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

smbtorture: remove more allocation size checks

If the requested allocation size was 0, the resulting allocation size may be
larger due to xattrs and other filesystem dependent factors.

Cf commits fba4b290856faaf17305103efc65f6383ea4f61c and
55b2f247f9ba56516efba52481418966a777343e.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

lib/util: Include grp.h for setgroups during autoconf

Otherwise setresuid and friends don't get detected on GNU/Hurd because the
inclusion of <grp.h> is missing for the declaration of setgroups.

Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Mon Nov 11 12:51:17 UTC 2024 on atb-devel-224

ctdb: Include replace.h for PATH_MAX

Fixes build on GNU/Hurd.

Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Mon Nov 11 10:28:24 UTC 2024 on atb-devel-224

Describe implication of upstream ICU-22610

Add commentary to link commit 86c7688 (MR !3447) to the upstream
fix for ICU-22610 in case there is subsequent breakage.

Signed-off-by: Earl Chew <earl_chew@yahoo.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri Nov  8 00:20:38 UTC 2024 on atb-devel-224

smbd: initialize delete_on_close in smbd_smb2_setinfo_lease_break_fsp_check()

CID 1634488:  Uninitialized variables  (UNINIT)

/source3/smbd/smb2_setinfo.c: 475 in smbd_smb2_setinfo_lease_break_fsp_check()
469      &delete_on_close);
470      if (tevent_req_nterror(req, status)) {
471      return;
472      }
473      }
474
>>>     CID 1634488:  Uninitialized variables  (UNINIT)
>>>     Using uninitialized value "delete_on_close".
475      if (!rename && !delete_on_close) {
476      return;
477      }
478
479      state->lck = get_existing_share_mode_lock(state, fsp->file_id);
480      if (state->lck == NULL) {

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Thu Nov  7 17:21:53 UTC 2024 on atb-devel-224

libcli/auth: make use of netlogon_creds_cli_check_transport() in more places

This was somehow missing in commit
7a5ad9f64a905f5744430c6e0796c646baf9432e

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15425

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Thu Nov  7 09:14:33 UTC 2024 on atb-devel-224

ctdb-scripts: Add configuration variable CTDB_KILLTCP_USE_SS_KILL

This allows CTDB to be configured to use "ss -K" to reset TCP
connections on "releaseip".  This is only supported when the kernel is
configured with CONFIG_INET_DIAG_DESTROY enabled.

From the documentation:

   ss -K has been supported in ss since iproute 4.5 in March 2016 and
   in the Linux kernel since 4.4 in December 2015.  However, the
   required kernel configuration item CONFIG_INET_DIAG_DESTROY is
   disabled by default.  Although enabled in Debian kernels since
   ~2017 and in Ubuntu since at least 18.04,, this has only recently
   been enabled in distributions such as RHEL.  There seems to be no
   way, including running ss -K, to determine if this is supported, so
   use of this feature needs to be configurable.  When available, it
   should be the fastest, most reliable way of killing connections.

For RHEL and derivatives, this was enabled as follows:

* RHEL 8 via https://bugzilla.redhat.com/show_bug.cgi?id=2230213,
  arriving in version kernel-4.18.0-513.5.1.el8_9

* RHEL 9 via https://issues.redhat.com/browse/RHEL-212, arriving in
  kernel-5.14.0-360.el9

Enabling this option results in a small behaviour change because ss -K
always does a 2-way kill (i.e. it also sends a RST to the client).
Only a 1-way kill is done for SMB connections when ctdb_killtcp is
used - the reasons for this are shrouded in history and the 2-way kill
seems to work fine.

For the summary that is logged, when CTDB_KILLTCP_USE_SS_KILL is "yes"
or "try", always log the method used, even the fallback to
ctdb_killtcp.  However, when set to "no", maintain the existing
output.

The decision to use -K rather than --kill is because short options are
trivial to implement in test stubs.

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jerry Heyman <jheyman@ddn.com>
Autobuild-User(master): Martin Schwenke <martins@samba.org>
Autobuild-Date(master): Thu Nov  7 00:12:34 UTC 2024 on atb-devel-224

ctdb-scripts: Factor out function kill_tcp_summarise()

This will be used in a slightly different context in a subsequent
commit.  In that case, the number of killed connections will be passed
instead of the total number of connections, so support this here via
different modes instead of churning later.

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jerry Heyman <jheyman@ddn.com>

ctdb-scripts: Track connections for all ports for public IPs

Currently TCP ports like NFS lock manager are not tracked.  It is
easier to track all connections than to add a configuration system to
try to track specified ports, so do that.

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jerry Heyman <jheyman@ddn.com>

ctdb-scripts: Get connections after tickle list

Running ss to get current connections before running ctdb gettickles
means the ss output might be out of date when the 2 lists are
compared.  Some tickles might have been added after ss was run by some
other means (e.g. SMB tickles, added internally) and they would be
deleted according to the stale ss output.

This isn't currently a problem because update_tickles() is currently
only called with port 2049, so all tickles are managed by this code.
That will change in a subsequent commit.

Changing the order means the reverse problem can occur, where
update_tickles() attempts to delete an already deleted tickle.  That
may happen occasionally but is harmless because it doesn't result in
missing information.  It (currently) just causes a message to be
logged at DEBUG level.

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jerry Heyman <jheyman@ddn.com>

ctdb-scripts: Move connection tracking to 10.interface

This should really be done for all connections to public IP addresses.
Leave the port number there for now - this is just the first step.

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jerry Heyman <jheyman@ddn.com>

ctdb-server: Use ctdb_connection_same() to simplify

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jerry Heyman <jheyman@ddn.com>

ctdb: Don't leak a pointer on talloc_realloc failure

We should not directly overwrite the pointer we are realloc'ing

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Martin Schwenke <martin@meltin.net>

ctdb: Save a few lines with talloc_zero()

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Martin Schwenke <martin@meltin.net>

ctdb-server: Remove duplicate logic

Initialise the pointer to NULL and fall through to let
talloc_realloc() do the allocation.  talloc_realloc() does the right
thing with a NULL pointer...

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jerry Heyman <jheyman@ddn.com>

ctdb-server: Handle pre-existing connection first

This is cheap when tcparray is NULL and let's the code that now
follows be simplified.

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jerry Heyman <jheyman@ddn.com>

ctdb-server: Drop an unnecessary variable

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jerry Heyman <jheyman@ddn.com>

ctdb-server: Drop a log message to DEBUG level

This is harmless, so it doesn't generally need to be logged.

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jerry Heyman <jheyman@ddn.com>

ctdb-server: Clean up connection tracking functions

Apply README.Coding, modernise logging, pre-render connection as a
string for logging, switch terminology from "tickle" to "connection",
tidy up comments.

No changes in functionality.

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jerry Heyman <jheyman@ddn.com>

ctdb-scripts: Use ss -H option to simplify

This option has been available since ~2018 and has been implemented in
the stub since then.  I guess we didn't use it because CentOS 7?

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jerry Heyman <jheyman@ddn.com>

ctdb-scripts: Remove superseded compatibility code

Since commit 224e99804efef960ef4ce2ff2f4f6dced1e74146, square brackets
have been parsed by daemon and tool code, so drop the compatibility
code from here.

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jerry Heyman <jheyman@ddn.com>

ctdb-scripts: update_tickles() should use the public IPs cache

This avoids duplicating logic.

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jerry Heyman <jheyman@ddn.com>

ctdb-scripts: Don't list connections when not hosting IPs

With an empty IP filter, all incoming connections to port 2049 will be
listed, not just those to public IP addresses.  This causes error
messages like the following to be logged:

  ctdb-eventd[...]: 60.nfs: Failed to add 1 tickles

since the connection being added seems to be for a random NFS mount
that doesn't use a public IP addresses.

This has been a problem for a long time (probably since commit
04fe9e20749985c71fef1bce7f6e4c439fe11c81 in 2015).  It isn't currently
a huge deal because it only affects NFS connections.  However, this
code will soon be used to track connections to public IP addresses on
all ports.  This would result in a constant stream of log messages,
since there will always be some active connections.

The theory behind the fix is that if a node hosts no public IPs then
it should have no relevant connections and has no business changing
the list of registered tickles.

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jerry Heyman <jheyman@ddn.com>

ctdb-scripts: Reformat with "shfmt -w -p -i 0 -fn"

Massage a couple of lines manually so they're formatted sanely given
the new indentation.   Re-run shfmt to ensure no further changes.

Best reviewed with "git show -w".

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jerry Heyman <jheyman@ddn.com>

ctdb-doc: Improve 10.interface documentation and comments

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jerry Heyman <jheyman@ddn.com>

ctdb-tests: Fix ss -a not supported

This is currently just a series of typos.

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jerry Heyman <jheyman@ddn.com>

ctdb-tests: Drop unsupported long options from ss stub usage

These have not been supported since commit
896c77df1ce2645c6dd7898b59ea802e204dc7d9 in 2018.

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jerry Heyman <jheyman@ddn.com>

ctdb-tests: Ensure ss stub handles square brackets around addresses

It isn't unreasonable for unit test cases to use square brackets in
their input.

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jerry Heyman <jheyman@ddn.com>

libndr: specialise ndr_token_find() for key pointer comparison

Usually we are doing a pointer comparison. Because we are doing it
in a tight loop, the cost of the comparison function call can be
noticeable.

There is a fuzz case that before f43ae1ab1a8803d8c5ad4e5f3dad63ccbe91aa54
took 3.957s, after that took 6.438s, and now again takes 3.960s.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Wed Nov  6 12:06:04 UTC 2024 on atb-devel-224

ldb:test:lmdb_free_list: s/the the/to the/ in comment

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Volker Lendecke <vl@samba.org>

s4:reg: s/the there/there/ in comments

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Volker Lendecke <vl@samba.org>

s4: s/the the\b/the/ in miscellaneous comments

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Volker Lendecke <vl@samba.org>

s4:ldb_mods:group_audit: s/the the/the/ in comments

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Volker Lendecke <vl@samba.org>

s3:smbd:posix_acls: s/the the/that the/ in comment

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Volker Lendecke <vl@samba.org>

s3:printing and spoolss: s/the the\b/the/ in comments

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Volker Lendecke <vl@samba.org>

s3:headers: s/the the\b/the/ in comments

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Volker Lendecke <vl@samba.org>

s3:client:clitar: s/the the/to the/ in comment

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Volker Lendecke <vl@samba.org>

pytest: s/the the\b/the/ in comments

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Volker Lendecke <vl@samba.org>

samba-tool:: s/the the\b/the/ in docstring

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Volker Lendecke <vl@samba.org>

nsswitch:: s/the the\b/the/ in comments

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Volker Lendecke <vl@samba.org>

libcli:auth:msrpc_parse: s/the the/is the/ in comments

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Volker Lendecke <vl@samba.org>

util:charset: s/the the\b/the/ in comments

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Volker Lendecke <vl@samba.org>

tevent docs: s/the the\b/the/

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Volker Lendecke <vl@samba.org>

pyldb: s/the the\b/the/ in comments

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Volker Lendecke <vl@samba.org>

ldb:pack: s/the the/in the/ in comments

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Volker Lendecke <vl@samba.org>

lib/afs: s/the the\b/the/ in comments

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Volker Lendecke <vl@samba.org>

ctdb:tests: s/the the\b/the/ in comments

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Volker Lendecke <vl@samba.org>

WHATSNEW: SMB3 Directory Leases

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Tue Nov  5 15:51:27 UTC 2024 on atb-devel-224

smbtorture: Directory Leases vs unlink

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

smbtorture: Directory Leases vs hardlink

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

smbtorture: Directory Leases vs overwrite

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

smbtorture: Directory Leases vs renaming

Note that we must use defines for the DLEASE* values, as declaring them as const
int triggers a CI failure on one of the runners (opensuse155-samba-o3) likely
due to a bug in its gcc version:

  ../../source4/torture/smb2/lease.c:6242:22: error: initializer element is not constant
     .srcdir_leasekey = DLEASE1,
                        ^~~~~~~

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

smbtorture: Directory Leases vs setting access date

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

smbtorture: Directory Leases vs setting inode change date

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

smbtorture: Directory Leases vs setting modification date

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

smbtorture: Directory Leases vs setting creation date

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

smbtorture: Directory Leases vs setting DOS attributes

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

smbtorture: Directory Leases vs setting EOF

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

libcli/smb: only copy the parent lease key if SMB2_LEASE_FLAG_PARENT_LEASE_KEY_SET is set

MS-SMB2 3.3.5.9.11 Handling the SMB2_CREATE_REQUEST_LEASE_V2 Create Context:

  If the SMB2_LEASE_FLAG_PARENT_LEASE_KEY_SET bit is set in the Flags field of
  the request, Lease.ParentLeaseKey MUST be set to the ParentLeaseKey of the
  request.

Found by MS-SMB2-Prototocol-Testsuite test "Compare_Zero_LeaseFlag_ParentLeaseKey".

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

smbtorture: check parent leasekey is ignored unless SMB2_LEASE_FLAG_PARENT_LEASE_KEY_SET is set

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

libcli/smb: only allow SMB2_LEASE_FLAG_PARENT_LEASE_KEY_SET in lease_flag

MS-SMB2 3.3.5.9.11 Handling the SMB2_CREATE_REQUEST_LEASE_V2 Create Context:

  The server MUST attempt to locate a Lease by performing a lookup in the
  LeaseTable.LeaseList using the LeaseKey ...

  If no lease is found, one MUST be allocated with the following values set:

  ...

  * Lease.Breaking is set to FALSE.

  ...

Ensures we ignore SMB2_LEASE_FLAG_BREAK_IN_PROGRESS. Found by
MS-SMB2-Prototocol-Testsuite "BreakReadLeaseV2TestCaseS0".

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

smbtorture: check SMB2_LEASE_FLAG_BREAK_IN_PROGRESS when client requests new lease

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

smbtorture: expand Directory Leases test "v2_request

Add three subtests:

- trigger a sharing violation, ack break, create fails with STATUS_SHARING_VIOLATION
- trigger a sharing violation, close conflicting open, create succeeds
- write with valid parent lease key.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

smbtorture: simplify test_lease_v2_request()

- Add and use test_rearm_dirlease().
- Rename variable "ls2" to "dirlease".
- Simplify lease epoch tracking by using dirlease.lease_epoch as a counter.
- Add comments.
- Zero out a handle after closing it.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

smbtorture: add test smb2.dirleases.leases

Checks server accepts "RWH", "RH" and "R" lease request and grants at most
(lease_request & "RH"), so no "W", but "R" without "H" if requested.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

s4/torture: give smb2_generic_create_share() caller some flexibility

This way callers can either create or open a directory.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

selftest: add "smb2.dirlease" test suite

Move all existing Directory Leases tests to this test suite and require
SMB2_CAP_DIRECTORY_LEASING.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

smbd: grant Directory Lease if requested

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

smbd: add option "smb3 directory leases"

By default enabled on non-clustered Samba, disabled on clustered Samba, the
reason being the expected additional load caused by forcing strict rename to be
enabled.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

docs: fix indentation of "strict rename"

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

smbd: allow directory leases in close_directory()

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

smbd: use get_deferred_open_message_state() in open_directory()

"deferred" will be used in the function by a later commit...

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

libcli/smb: ignore lease_flags and lease_duration for leasev1 in smb2_lease_pull()

MS-SMB2 2.2.13.2.8 SMB2_CREATE_REQUEST_LEASE:

  LeaseFlags (4 bytes): This field MUST NOT be used and MUST be reserved.
  The client MUST set this to 0, and the server MUST ignore it on receipt.

  LeaseDuration (8 bytes): This field MUST NOT be used and MUST be reserved.
  The client MUST set this to 0, and the server MUST ignore it on receipt.

So let's really, really ignore it.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

libcli/smb: rely on the caller zero-initializing "lease" in smb2_lease_pull()

Doing the zero initialization per struct member just feels like a way for bugs
to creep in, even when leasev1 is not going to change ever. The only caller has
already zero-initialized state->lease twice via 1) __tevent_req_create() and 2)
a struct initializer of "state".

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

smbd: trigger NOTIFY_ACTION_DIRLEASE_BREAK when creating hardlink

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>