s4:torture/smb2: split out smb2.persistent-open-reconnect-contended
This means the rule in selftest/skip actually works.
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Wed Jul 29 08:33:12 UTC 2026 on atb-devel-224
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Autobuild-User(master): Björn Jacke <bjacke@samba.org>
Autobuild-Date(master): Tue Jul 28 17:02:13 UTC 2026 on atb-devel-224
Volker Lendecke [Wed, 17 Jun 2026 06:24:47 +0000 (08:24 +0200)]
CVE-2026-58218: dns_server: Fix an error path memleak
We talloc the new key off "dns->tkeys", which is long-lived. On any
error we never free'd that again. Probably not remotely triggerable,
this is only setting up the gensec context.
Douglas Bagnall [Sun, 31 May 2026 00:48:11 +0000 (12:48 +1200)]
CVE-2026-58216: kdc:kpasswd: calculate correct size for password blob
We were making the enc_data_blob 6 bytes too big.
Its payload is an ASN.1 structure that knows its own size, so the
extra bytes are not usually read by Heimdal, but a crafted packet
could force them to be read.
Martin Schwenke [Tue, 30 Jun 2026 03:58:22 +0000 (13:58 +1000)]
CVE-2026-58224: ctdb-common: Add comments to ward off vulnerability reports
We can't deal with this in the current CTDB protocol without
disproportionate effort. So, document reality clearly in the code to
try to stop these from being reported.
Martin Schwenke [Wed, 10 Jun 2026 02:37:02 +0000 (12:37 +1000)]
CVE-2026-58224: ctdb-protocol: Avoid DoS memory allocations
The pull loop already avoids out of bounds accesses beyond the end of
the buffer. However, it does not avoid a DoS memory allocation due to
an unreasonably large array size.
Check that the number of specified array elements can be pulled from
buffer, which puts a reasonable upper bound on the subsequent memory
allocation.
Use an initialised dummy variable to avoid static analysers
complaining about uninitialised variables being passed.
Martin Schwenke [Wed, 10 Jun 2026 02:15:17 +0000 (12:15 +1000)]
CVE-2026-58224: ctdb-protocol: Avoid DoS memory allocations
The pull loop already avoids out of bounds accesses beyond the end of
the buffer. However, it does not avoid a DoS memory allocation due to
an unreasonably large array size.
Check that the number of specified array elements can be pulled from
buffer, which puts a reasonable upper bound on the subsequent memory
allocation.
Use an initialised dummy variable to avoid static analysers
complaining about uninitialised variables being passed.
Martin Schwenke [Tue, 9 Jun 2026 11:54:20 +0000 (21:54 +1000)]
CVE-2026-58224: ctdb-protocol: Always pull the specified number of bytes
The string should not contain a premature NUL terminator, which would
cause less than the specified number of bytes to be pulled. If it
does, consume the specified number of bytes anyway. The alternative
doesn't make sense.
Note that this is unlikely to be a security issue, where trailing data
in the string field causes the buffer to be overrun. That would
require an additional protocol bug. However, include this fix here
for posterity.
Martin Schwenke [Tue, 9 Jun 2026 11:48:02 +0000 (21:48 +1000)]
CVE-2026-58224: ctdb-protocol: Avoid off-by-one error for bytes pulled
As per the comment, if there is no NUL byte in the buffer then don't
count one in the number of bytes pulled.
Note that this is unlikely to be a security issue because it would
take a protocol bug elsewhere to overrun the buffer. However, include
this fix here for posterity.
Martin Schwenke [Tue, 9 Jun 2026 00:41:25 +0000 (10:41 +1000)]
CVE-2026-58224: ctdb-daemon: Avoid out of bounds data access
Instead of checking only that there is enough data for the length
field, check there is enough data for the entire header part of the
struct. After cross-checking overall lengths, ensure there is enough
data for the key/data in the data element.
Martin Schwenke [Sun, 31 May 2026 05:11:39 +0000 (15:11 +1000)]
CVE-2026-58224: ctdb-daemon: Avoid out of bounds data access
The first check is clearly needed because m->db_id is referenced. The
second check is handled by a similar update to
ctdb_control_update_record(), but repeat it in case something else
changes.
Martin Schwenke [Sat, 30 May 2026 04:25:00 +0000 (14:25 +1000)]
CVE-2026-58224: ctdb-daemon: Avoid out-of-bounds data access
Do not allow the VNN map's size to extend past the end of the buffer.
This is checked by switching to ctdb_vnn_map_pull(), which also
simplifies the code.
Martin Schwenke [Sat, 30 May 2026 04:38:02 +0000 (14:38 +1000)]
CVE-2026-58224: ctdb-protocol: Avoid DoS memory allocation
The pull loop already avoids out of bounds accesses beyond the end of
the buffer. However, it does not avoid a DoS memory allocation due to
an unreasonably large array size.
Check that the number of specified array elements can be pulled from
buffer, which puts a reasonable upper bound on the subsequent memory
allocation.
Use an initialised dummy variable to avoid static analysers
complaining about uninitialised variables being passed. Variable i
could be reused but that might be confusing, so leave any optimisation
to the compiler.
Reported-by: Martin Schwenke <mschwenke@ddn.com> Reported-by: Also Andrew Tridgell (issue 22) Signed-off-by: Martin Schwenke <mschwenke@ddn.com> Reviewed-by: Tristan Madani <tristan@talencesecurity.com> Reviewed-by: Stefan Metzmacher <metze@samba.org>
CVE-2026-6949: s4:dns_server: correctly truncate the buffer for TSIG verification
Calculating the length of the TSIG additional dns_res_rec,
via ndr_push_dns_res_rec() is fragile and may generate
a buffer larger than the original dns_name_packet buffer.
This could underflow the resulting packet_len,
to a very large value and buffer_len to a small value.
Resulting in a memcpy() of a very large size into
a very small buffer. This most likely already
gets a segmentation fault when reading after the
in->data.
This was reported by Arjun Basnet with Securin Labs.
While the code can generally handle arbitrary length addresses, known
lengths are used to set the hardware type. Therefore, tests are
artificially limited to 6 octet addresses (Ethernet) and 20 octet
addresses (IPoIB).
As per the comment in the code: reading RFC4391, section 4 and looking
at example GIDs on a system, suggests a simple method of mapping the
IPv4 broadcast address to an IPv6oIB multicast address.
Variable sall is no longer used by IPv4. It is now only used to
construct the sendto() destination address for IPv6 NA.
Replace this variable with a sockaddr_storage so it can fit larger
link-level addresses. Change the type of ip6_ll_multicast_build() and
use it to set the sockaddr_storage (as a sockaddr_ll), based on the
link-level broadcast address and RFCs.
Martin Schwenke [Fri, 5 Dec 2025 06:39:56 +0000 (17:39 +1100)]
ctdb-common: Find interface using getifaddrs(3)
This is the first step towards IPoIB ARP/NA support, which uses 20
octet hardware addresses. See the comment in the code for more
details.
This is a (relatively) minimal change. find_interface() returns a lot
of duplicate information that isn't yet used. Also, this is (still)
explicitly restricted to Ethernet. Improvements and clean up to come
in subsequent commits.
Martin Schwenke [Thu, 18 Jun 2026 08:02:47 +0000 (18:02 +1000)]
ctdb-common: Don't build IPv6 NA link-level header
The link-level destination address is now setup outside
ip6_na_build(), since it is no longer used in that function. Group
the parts of it together instead of leaving them scattered.
Martin Schwenke [Tue, 9 Dec 2025 05:24:22 +0000 (16:24 +1100)]
ctdb-common: Use a datagram socket to send packets
The plan is to stop building the link-level (currently Ethernet)
header and let the network stack construct it. 2 reasons:
1. It should work
2. The InfiniBand link-level header is a mystery and I don't know how
to construct it
To keep this commit small, the link-level header is still built, but
it is ignored. This adds a small amount of churn to the sendto()
calls but allows smaller, more comprehensible steps.
Martin Schwenke [Tue, 6 Jan 2026 03:12:31 +0000 (14:12 +1100)]
ctdb-common: Simplify filling ARP packet
Only one field is different between request and reply. Factor out the
common code so it is above and below a simplified if-statement that
handles just the different field.
Martin Schwenke [Tue, 6 Jan 2026 03:05:31 +0000 (14:05 +1100)]
ctdb-common: Pass the ARP operation to arp_build()
This way the argument directly represents the intent so is
self-documenting. The operation is now assigned into the structure
element so the 2 arms of the if-statement have only a single statement
that is different. Keep this commit simple and let a subsequent
commit factor the common items.
Note that this is an static function so there is no widespread API
churn.
Anoop C S [Fri, 24 Jul 2026 11:57:56 +0000 (17:27 +0530)]
vfs_ceph_new: Include proxy setting in mount cache cookie
The mount cache cookie is derived from (conf_file/user_id/fsname) but
does not include the proxy mode. When two shares differ only in their
proxy setting, they produce the same cookie and share a single cached
ceph_mount_info. Since libcephfs.so and libcephfs_proxy.so define
struct ceph_mount_info with entirely different layouts, calling a
function resolved from one library on a mount allocated by the other
causes a segfault.
Add config->proxy to the cookie so that mounts created by different
libraries are never shared.
Signed-off-by: Anoop C S <anoopcs@samba.org> Reviewed-by: John Mulligan <jmulligan@redhat.com> Reviewed-by: Guenther Deschner <gd@samba.org>
Autobuild-User(master): Anoop C S <anoopcs@samba.org>
Autobuild-Date(master): Fri Jul 24 15:56:49 UTC 2026 on atb-devel-224
s3:rpc_server: add --np-only option to samba-dcerpcd
Sometimes admins prefer to start samba-dcerpcd
as daemon instead of on demand in order to
avoid startup latency. But at the same time
they may not want to provide ncacn_ip_tcp.
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
s3:rpc_client: add probe_only argument to local_np_connect[_send]()
This will cause SAMBA_NPA_FLAGS_PROBE_ONLY to be passed to
the named pipe server and let local_np_connect_recv()
return EEXIST instead of tstream_context.
This will be used to implement FSCTL_PIPE_WAIT.
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
ctdb-scripts: Secure the persistent TDB backup directory
Persistent database backups may contain sensitive data such as
Samba credentials in secrets.tdb. Currently these backup files
are created with default permissions, allowing any local user to
read sensitive credentials.
Add an optional -m <mode> argument to ctdb-backup-persistent-tdbs.sh
to set permissions for the backup directory.
A new CTDB_PERSISTENT_DB_BACKUP_MODE configuration variable is added
to script.options, allowing administrators to customize the
permissions mode. The default is 0700 to ensure secure-by-default
behavior, protecting sensitive data from unauthorized access.
The backup script sets directory permissions on the backup destination
every time it runs, providing self-healing protection.
Permissions are enforced in ctdb-backup-persistent-tdbs.sh rather than
the event script to avoid running chmod every 15 seconds during monitor
events. The backup script can also be called manually, ensuring
permissions are always enforced when backups are created.
Signed-off-by: Agam S <agam@ddn.com> Reviewed-by: Martin Schwenke <martin@meltin.net> Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Thu Jul 23 11:40:03 UTC 2026 on atb-devel-224
Avan Thakkar [Fri, 13 Feb 2026 10:51:37 +0000 (16:21 +0530)]
vfs_aio_ratelimit: add cluster-wide rate limiting via daemon aggregation
Add cluster coordination using a daemon-based architecture. Each node runs
a ratelimitd daemon that aggregates local smbd activity and broadcasts node
summaries via CTDB. VFS processes receive summaries and dynamically distribute
the global rate limit fairly among all active processes.
Network message complexity: O(M²) where M is the number of nodes.
Signed-off-by: Avan Thakkar <athakkar@redhat.com> Reviewed-by: Anoop C S <anoopcs@samba.org> Reviewed-by: Guenther Deschner <gd@samba.org>
Anoop C S [Wed, 1 Jul 2026 15:20:12 +0000 (20:50 +0530)]
vfs_ceph_rgw: Implement SMB_VFS_OPEN_SHARE_ROOT
Signed-off-by: Anoop C S <anoopcs@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Anoop C S <anoopcs@samba.org>
Autobuild-Date(master): Wed Jul 22 15:49:49 UTC 2026 on atb-devel-224
Volker Lendecke [Sun, 19 Oct 2025 10:07:07 +0000 (12:07 +0200)]
vfs: Add SMB_VFS_OPEN_SHARE_ROOT()
While converting more and more users from stat() to fstatat() I found
that there is one special stat-call that is different from all others:
When connecting to a share, we call SMB_VFS_STAT() without a properly
set up conn->cwd_fsp. This one special call causes quite some
special-case handling in the implementations.
Reflect this special case with a new VFS call OPEN_SHARE_ROOT. Its
final purpose will be to get us a proper fd on the share root, but
until we stop doing chdir calls into the share we can live with
AT_FDCWD being returned.
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
vfs_ceph_snapshots: Fix panic on snapshot access with a "/"-rooted share
ceph_snap_gmt_convert_dir() builds an absolute snapshot path by joining
the share's connectpath, the request-relative name and the snapshot
subdir with '/' separators, then hands it to OpenDir(). OpenDir() ->
fd_openat() -> filename_convert_dirfsp_rel() splits the path on '/' and
openat_pathref_fsp_nosymlink() asserts that no component is empty:
connectpath is a bare "/" when the share is mounted at the file system
root, so the join yields a leading "//" (e.g. "//.snap" or
"//dir/.snap"). That empty first component trips the assert and panics
smbd as soon as a snapshot is accessed.
Whether the malformed path actually reaches the assert also depends on
the Ceph client accepting a non-canonical "//" path in the preceding
stat(), so the panic is libcephfs-version dependent.
Canonicalize the .snap directory path with canonicalize_absolute_path()
after building it, so the path handed to OpenDir() is always canonical
and the empty leading component can no longer occur.
Signed-off-by: Matthias Grandl <matthias.grandl@croit.io> Reviewed-by: Anoop C S <anoopcs@samba.org> Reviewed-by: David Disseldorp ddiss@samba.org
Autobuild-User(master): Anoop C S <anoopcs@samba.org>
Autobuild-Date(master): Tue Jul 21 16:12:18 UTC 2026 on atb-devel-224
selftest:Samba4: use samba_dnsupdate --sync-file for SAMBA_DNS_FAKING
Even with SAMBA_DNS_FAKING, which means resolv_wrapper can't to real dns
over the network, we want dns updates to happen on the server,
so that our own dns client sees them.
Otherwise some tests fallback to netbios name resolution,
which gives strange and unexpected results.
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Tue Jul 21 10:39:14 UTC 2026 on atb-devel-224
This can be used similar to the --use-file option,
but the --sync-file option only mirrors the real dns
updates into the file.
It means the dns records on the server are still created,
this is needed for more useful testing.
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
s4:samba_dnsupdate: let update_file check for modified first
We only replace the file if it's modified.
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
s4:samba_dnsupdate: split out a update_file() helper function
This will help with the following changes.
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
Drop it, as it causes a compilation failure on AIX
[1852/3392] Compiling source4/libcli/resolve/dns_ex.c
"../../source4/libcli/resolve/dns_ex.c", line 111.25: 1506-022 (S) "class" is not a member of "struct dns_res_rec".
This happens because on AIX the header has:
/* ISC defines class member as rr_class. */
#ifdef __cplusplus
#define rr_class nsrr_class
#else
#define rr_class class
#endif
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Martin Schwenke <martin@meltin.net> Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Mon Jul 20 07:46:42 UTC 2026 on atb-devel-224
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Fri Jul 17 18:26:27 UTC 2026 on atb-devel-224
projects / thirdparty / samba.git / log
