Ralph Boehme [Tue, 30 Sep 2025 15:12:49 +0000 (17:12 +0200)]
smbd: make grant_new_fsp_lease() public and add bump_epoch
Current caller passed true which results in unchanged behaviour. However, we
will call this from durable.c when reconnecting Persistent Handle where we need
control over the exact lease version.
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org>
Ralph Boehme [Tue, 7 Oct 2025 16:39:33 +0000 (18:39 +0200)]
s3/librpc: open_files.idl: updates for Persistent Handles
New share_mode_entry flag:
- SHARE_ENTRY_FLAG_PERSISTENT_OPEN
New share_mode_data member:
- num_persistent
New share_mode_entry members:
- create_guid
- protect
delete_token
- open_persistent_id
New vfs_default_durable_cookie members:
- initial_delete_on_close
The SHARE_ENTRY_FLAG_PERSISTENT_OPEN flag is crucially needed to modify the
behaviour of share_entry_stale_pid() and used in other places when looking at a
share_mode_entry and having to adust processing behaviour for Persistent
Handles.
num_persistent is used to track the number of Persistent Handles per
share_mode_data record, adjusting dbwrap_store() behaviour depending on its
value: if num_persistent is greater then zero, we pass DBWRAP_STORE_PERSISTENT.
Without it we would have to iterate over oll share_mode_entry's every time we
store the record.
The create_guid ties together the open state from locking.tdb and the
smbXsrv_open_global.tdb as an additional hardening to securely corolate both.
The protect boolean is an in-memory flag indicating a disconnected Persistent
Handle. We don't want to store this in the share_mode_entry on disk.
open_persistent_id in the delete_token will be used to implement scavening
delete_tokens when Persistent Handles with delete-on-close set expire. Windows
will actually delete the file, but this is not easily possible with the current
architecture of the scavenger, but we must at least correctly remove those stale
tokens.
initial_delete_on_close is used to preserve the fsp flag initial_delete_on_close
across disconnects. When reconnecting the handle, the fsp flag can be
reestablished based on the value from the cookie.
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org>
For now keep them as "internal" undocumented parametric options. If we learn
about real world usecases in the future, we can then look into turning them into
documented options.
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org>
The persistent flag is the primary means of directing all FSA and SMB layer
behaviour for Persistent Handles.
The file_id is used when scanning the smbXsrv_open_global.tdb for stale opens
and scheduling cleanup via the scavenger: scavenger uses the file-id from the
open to fetch the file record from locking.tdb.
name_hash will be used as part of implementing delete-on-close token cleanup via
the scavenger.
app_instance_vhigh and app_instance_vlow are part of the app_instance_id related
feature.
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org>
Ralph Boehme [Sat, 23 Aug 2025 09:52:11 +0000 (11:52 +0200)]
s3/locking: use smbXsrv_version_global_init() in locking_init()
This is only needed when opening in read-write mode in order to initialize
smbXsrv_version_global_current() which is used to set the record version when
storing a record.
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org>
Ralph Boehme [Sun, 23 Nov 2025 10:30:51 +0000 (11:30 +0100)]
dbwrap_ctdb: use CTDB_FETCH_WITH_HEADER_FUNC in ctdbd_parse[_send]()
Use db_ctdb_parse_record_parser_nonpersistent() to check if the header is
usable. Prepares for doing additional checks in
db_ctdb_parse_record_parser_nonpersistent().
No change in behaviour.
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Martin Schwenke <martin@meltin.net>
Will be used much later in the commit series by cleanupd to list the per-record
persistent backup records of the smbXsrv_open_gobal.tdb to trigger open record
scavenging.
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Martin Schwenke <martin@meltin.net>
Ralph Boehme [Wed, 11 Apr 2018 15:22:51 +0000 (17:22 +0200)]
dbwrap: add flags DBWRAP_STORE_PERSISTENT
Request storing a record with persistent semantics, the details of the
implementation are up to the backend.
Fwiw, the existing "flags" DBWRAP_[REPLACE|INSERT|MODIFY] are not flags in the
real sense, but rather something like an opcode/enum.
The new values DBWRAP_STORE_PERSISTENT will be real flags, so the backend
implementations have to be careful when processing the flags, eg if passing the
flags to TDB in the backend.
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Martin Schwenke <martin@meltin.net>
Ralph Boehme [Thu, 23 Oct 2025 16:41:41 +0000 (18:41 +0200)]
dbwrap: add flags to dbwrap_wipe()
Will be used later to pass flags=DBWRAP_DROP_PERSISTENT for databases with
DBWRAP_FLAG_PER_REC_PERSISTENT, requesting to wipe the persistent backup
database.
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Martin Schwenke <martin@meltin.net>
Ralph Boehme [Mon, 4 Nov 2024 06:54:19 +0000 (07:54 +0100)]
dbwrap: add record flags to struct db_record
This is needed to implement persistent record deletion in the case that
a record was stored as persistent, then fetched and is then stored
without persistency.
The additional tdb record header uses CTDB_REC_FLAG_PERSISTENT to denote if the
record was stored as persistent. When fetching a record we remember the
persistency property in record.flags.persistent.
When a subsequent store doesn't request persistency and record.flags.persistent
is set, we delete record from the persistent database.
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Martin Schwenke <martin@meltin.net>
CTDB_REC_FLAG_PERSISTENT is set when a record was stored once with per-record
persistency semantics and has a record in the persistent backup database. It's
used by the dbwrap_ctdb backend to determine if the backup record can be deleted
when storing a record.
CTDB_REC_FLAG_PERSISTENT_IN_PROGRESS is used by dbwrap_ctdb when opening database with per-record
persistency support (DBWRAP_FLAG_PER_REC_PERSISTENT). The flag is needed to make
stores atomic without holding a TDB chainlock, similar to a "glock" in smbd
parlance and also comes with a "glock" owner payload (struct server_id) to
detect stale "glocks".
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Martin Schwenke <martin@meltin.net>
Ralph Boehme [Tue, 3 Dec 2024 11:21:38 +0000 (12:21 +0100)]
ctdb-daemon: Implement CTDB_CONTROL_PUSH_RECORD
Pair-Programmed-With: Martin Schwenke <martin@meltin.net> Signed-off-by: Martin Schwenke <martin@meltin.net> Signed-off-by: Ralph Boehme <slow@samba.org>
Ralph Boehme [Tue, 3 Dec 2024 11:26:38 +0000 (12:26 +0100)]
ctdb-protocol: Add CTDB_CONTROL_PUSH_RECORD
Clients can use this control to push records to a volatile database on
all nodes at once.
Pair-Programmed-With: Martin Schwenke <martin@meltin.net> Signed-off-by: Martin Schwenke <martin@meltin.net> Signed-off-by: Ralph Boehme <slow@samba.org>
Priyanka Soni [Thu, 4 Jun 2026 13:48:41 +0000 (19:18 +0530)]
mdssvc: fix Spotlight queries restricted to subdirectories with NFD paths
Ensure directory scopes match by aligning Unicode normalization forms.
This fixes the case when the macOS client restricts the search to
a subdirectory. macOS clients transmit paths using NFD, which can
cause lookups to fail against NFC systems used by Samba and Elasticsearch.
This commit also includes a bug fix by Ralph Boehme <slow@samba.org> to resolve a
null-termination issue of the NFD converted path in add_filemeta().
Petr Usoltsev [Tue, 3 Mar 2026 07:31:18 +0000 (15:31 +0800)]
lib:ldb: Fix memory leaks in ldb_kv_index.c
The "rec" variable is allocated within the long-lived LDB memory
context, meaning it persists until the module is unloaded.
Previously, this resource was only freed upon the successful
execution of ldb_dn_compare().
If ldb_dn_compare fails, the allocated memory is leaked. This patch
ensures that the memory is properly released regardless of the
function's return status.
Signed-off-by: Petr Usoltsev <usoltsevpv@basealt.ru> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Anoop C S <anoopcs@samba.org>
Autobuild-User(master): Anoop C S <anoopcs@samba.org>
Autobuild-Date(master): Tue Jul 14 06:18:36 UTC 2026 on atb-devel-224
Noel Power [Thu, 2 Jul 2026 08:45:40 +0000 (09:45 +0100)]
s3:rpc_server: Fix undefined behavior from strchr
o If no backslash was found in servername, variable asprinter will
contain NULL value. It will then be passed to strchr call,
resulting in undefined behavior.
o Also rework code to remove const violation of handlename
Pair-Programmed-With: Dmitriy Mikhalchenko <tascad@altlinux.org>
Pair-Programmed-With: Noel Power <noel.power@suse.com> Signed-off-by: Shishkov Nikita <shishkovna@sgu.ru> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org>
Autobuild-User(master): Noel Power <npower@samba.org>
Autobuild-Date(master): Mon Jul 13 16:14:50 UTC 2026 on atb-devel-224
Martin Schwenke [Sun, 12 Jul 2026 01:41:35 +0000 (11:41 +1000)]
WHATSNEW: Document that CTDB now follows Samba configure options
For locks, PID files and sockets.
Signed-off-by: Martin Schwenke <mschwenke@ddn.com> Reviewed-by: Anoop C S <anoopcs@samba.org>
Autobuild-User(master): Martin Schwenke <martins@samba.org>
Autobuild-Date(master): Mon Jul 13 13:59:00 UTC 2026 on atb-devel-224
Martin Schwenke [Mon, 6 Jul 2026 08:44:34 +0000 (18:44 +1000)]
ctdb-common: Fix CTDB_SOCKET default outside test mode
smbd expects to use CTDB_SOCKET (define, not environment variable) as
a default.
If --with-socketpath was specified at build time then smbd and ctdbd
might disagree on the socket location. smbd will use whatever is
specified (i.e. CTDB_SOCKET) but CTDB always uses path_socket() to put
the socket in CTDB_RUNDIR.
CTDB should default to CTDB_SOCKET (define) too.
This only changes the result when --with-socketpath is specified. We
should get rid of that later and always use something in
CTDB_SOCKETDIR.
Signed-off-by: Martin Schwenke <mschwenke@ddn.com> Reviewed-by: Anoop C S <anoopcs@samba.org>
Martin Schwenke [Mon, 6 Jul 2026 08:18:51 +0000 (18:18 +1000)]
ctdb-build: Add support for CTDB_{LOCKDIR,PIDDIR,SOCKETDIR}
That is, introduce new defines:
* CTDB_LOCKDIR
* CTDB_PIDDIR
* CTDB_SOCKETDIR
The new defines are currently unused. However, the directories are
created at installation time.
This is the first step in addressing the problem where /var/run/ctdb/
can't be separately configured to be outside LOCALSTATEDIR.
e.g. /run/ctdb/.
This has become a problem when unpacking Samba installation tarballs.
Some versions of tar (e.g. 1.35-11.el10) don't handle unpacking across
cross-filesystem symlinks (such as /var/run -> ../run) due to
extensive use of openat(2). This could be a bug in tar, but we might
as well use this as an opportunity make CTDB's installation paths more
flexible.
The change recognises that CTDB is part of Samba, following its
build-time configuration for these items. So, the new defines point
to ctdb/ subdirectories under Samba's LOCKDIR, PIDDIR and SOCKET_DIR,
respectively.
For the standalone build, the required variables are not available, so
add some backward compatibility. This means that using CTDB with
Samba requires a combined build. This is of little consequences
because the standalone build is probably only used for developer
testing. Replacing the backward compatibility hack by plumbing
dynconfig into CTDB is an exercise for another time - I tried it and
it didn't seem straightforward.
Signed-off-by: Martin Schwenke <mschwenke@ddn.com> Reviewed-by: Anoop C S <anoopcs@samba.org>
Martin Schwenke [Sun, 12 Jul 2026 22:32:39 +0000 (08:32 +1000)]
ctdb-scripts: Admit that ctdb.init is an example
ctdb.init is basically unmaintained and untested. It is only really
referenced by ctdb.spec.in, which is in ctdb/doc/examples/. Move
ctdb.init there too.
Signed-off-by: Martin Schwenke <mschwenke@ddn.com> Reviewed-by: Anoop C S <anoopcs@samba.org>
Martin Schwenke [Wed, 8 Jul 2026 02:12:28 +0000 (12:12 +1000)]
ctdb-build: Clean up a few things
These lists of items should be in alphabetical order to make them
easier to browse.
The ADD_CFLAGS() one is currently 2 lists, which makes maintenance
error prone. It could be improved with one or more f-strings allowing
the substitutions to be done inline. However, having a dict with
items in 2 columns makes the pairing much more obvious. Build the
result using a list comprehension whose result contains a string per
define and then join the items.
For the large sed expression, numbered variables aren't particularly
flexible. So, once again, use a dict to hold the required
substitutions. Build each sed command-line option as a list item
using a list comprehension and then join the items.
In both cases, I think using a dict means less visual clutter because
each line doesn't need to be enclosed in parentheses).
Signed-off-by: Martin Schwenke <mschwenke@ddn.com> Reviewed-by: Anoop C S <anoopcs@samba.org>
Martin Schwenke [Wed, 1 Mar 2023 22:29:31 +0000 (09:29 +1100)]
ctdb-scripts: Add host monitoring
It can be difficult to diagnose certain event script timeouts. So, at
the risk of re-inventing Nagios, this provides some limited host
monitoring to ensure that nodes are able to reach configured
infrastructure.
Signed-off-by: Martin Schwenke <mschwenke@ddn.com> Reviewed-by: Amitay Isaacs <amitay@gmail.com>
Autobuild-User(master): Amitay Isaacs <amitay@samba.org>
Autobuild-Date(master): Thu Jul 9 17:07:12 UTC 2026 on atb-devel-224
Martin Schwenke [Fri, 27 Feb 2026 07:20:21 +0000 (18:20 +1100)]
ctdb-scripts: Support periodic printing of warnings
In the case where a failcount only produces warnings (not
errors/unhealthy), the warnings could continue forever. A constant
stream of warnings could dominate the logs, possibly obscuring other
useful messages.
To avoid this, add interval-based printing of warnings. It can be set
to "hourly", "daily", any number of seconds (up to 4 digits) or
"none" (no periodic warning, use current behaviour). The default is
"hourly".
Generally, the same interval will apply to all failcounts in a script.
However, multiple carefully placed calls to
failcount_set_warning_interval() can cause different intervals to be
used for different counters.
Add an extra unit test for vsftp monitoring to test this.
Signed-off-by: Martin Schwenke <mschwenke@ddn.com> Reviewed-by: Amitay Isaacs <amitay@gmail.com>
Martin Schwenke [Thu, 5 Mar 2026 03:37:20 +0000 (14:37 +1100)]
ctdb-scripts: New variable CTDB_PLATFORM_STYLE
CTDB_PLATFORM_STYLE is effectively a rename of CTDB_INIT_STYLE, since
a variable is needed that will be used for more purposes than "init".
The new variable is automatically set when sourcing the functions
file.
CTDB_INIT_STYLE is now deprecated and can still be set be calling
detect_init_style(). This provides backward compatibility for
site-local scripts.
Avoid using a state file. Given that detect_platform_style() is now
only called in 1 place (i.e. immediately after its definition), the
state file is an unnecessary optimisation. Also, using a state file,
and setting the variable automatically when sourcing the file, means
that CTDB_SCRIPT_VARDIR needs to be overridden in more UNIT test
suites. For example, the tools ctdb lvs/natgw unit tests indirectly test
the ctdb_lvs/ctdb_natgw scripts, which source the functions file.
The previous sub-shell wasn't useful protection against a poisoned
/etc/os-release file. Evil commands are evil commands, so if someone
can poison that file then we're in more trouble than this script can
handle. However, limiting to a couple of variables with the eval/grep
trick seems like a a useful idea because those variables can then be
manually unset when they are no longer needed. Using eval to do the
parsing also means that full manual parsing does not need to be
implemented, which would require handling (optional) quotes around
values.
Signed-off-by: Martin Schwenke <mschwenke@ddn.com> Reviewed-by: Amitay Isaacs <amitay@gmail.com>
Martin Schwenke [Wed, 1 Mar 2023 01:14:04 +0000 (12:14 +1100)]
ctdb-scripts: Improve some comments
The word "passing" is ambiguous, since it could refer to whether a
value is passed to the function. "exceeding" is wrong, because the
counter is equal. Instead, use "reaching".
Signed-off-by: Martin Schwenke <mschwenke@ddn.com> Reviewed-by: Amitay Isaacs <amitay@gmail.com>
There is no sign that the first election ended. Starting another one
causes bad state interactions. Apart from causing confusion for
multiple pieces of state (e.g. rec->election_in_progress), a nested
call to _cluster_lock_lock() will leak rec->cluster_lock_handle
because it will overwrite it with the new in-progress handle.
Martin Schwenke [Tue, 12 May 2026 07:19:03 +0000 (17:19 +1000)]
ctdb-recoverd: Strengthen check for cluster lock held
This avoids attempting to start recovery without holding the cluster
lock.
There seems to be only one way the following can happen:
2026-05-12T12:15:51.127992+05:30 nsds1 ctdb-recoverd[826]: Leader broadcast timeout
2026-05-12T12:15:51.128019+05:30 nsds1 ctdb-recoverd[826]: Start election
2026-05-12T12:15:51.128192+05:30 nsds1 ctdb-recoverd[826]: Attempting to take cluster lock (!/usr/libexec/ctdb/ctdb_mutex_fcntl_helper /mnt/lustre/mac167/nsds_conf/.nsds_config/cluster_lock 5 20)
2026-05-12T12:15:51.135578+05:30 nsds1 ctdbd[700]: ctdb_mutex_fcntl_helper: Unable to open /mnt/lustre/mac167/nsds_conf/.nsds_config/cluster_lock - (No such file or directory)
2026-05-12T12:15:51.135590+05:30 nsds1 ctdb-recoverd[826]: Unable to take cluster lock - unknown error
2026-05-12T12:15:56.130174+05:30 nsds1 ctdb-recoverd[826]: Leader broadcast timeout
2026-05-12T12:15:56.130206+05:30 nsds1 ctdb-recoverd[826]: Start election
2026-05-12T12:15:56.130329+05:30 nsds1 ctdb-recoverd[826]: Attempting to take cluster lock (!/usr/libexec/ctdb/ctdb_mutex_fcntl_helper /mnt/lustre/mac167/nsds_conf/.nsds_config/cluster_lock 5 20)
2026-05-12T12:16:01.131882+05:30 nsds1 ctdb-recoverd[826]: Leader broadcast timeout
2026-05-12T12:16:01.131918+05:30 nsds1 ctdb-recoverd[826]: Start election
2026-05-12T12:16:13.094308+05:30 nsds1 ctdbd[700]: ctdb_mutex_fcntl_helper: Unable to open /mnt/lustre/mac167/nsds_conf/.nsds_config/cluster_lock - (No such file or directory)
2026-05-12T12:16:13.094362+05:30 nsds1 ctdb-recoverd[826]: Unable to take cluster lock - unknown error
2026-05-12T12:16:13.094582+05:30 nsds1 ctdb-recoverd[826]: do_recovery: Starting do_recovery
2026-05-12T12:16:13.094591+05:30 nsds1 ctdb-recoverd[826]: Cluster lock not held - abort recovery, ban node
2026-05-12T12:16:13.094596+05:30 nsds1 ctdb-recoverd[826]: Banning node 0 for 300 seconds
2026-05-12T12:16:13.094612+05:30 nsds1 ctdbd[700]: Banning this node for 300 seconds
_cluster_lock_lock() sets rec->cluster_lock_handle during an attempt
to take the cluster look. This function contains a nested event loop
where other things can happen. Presumably the 3rd leader broadcast
timeout above occurs, starting a nested election (which also needs to
be avoided - this is the real root cause). cluster_lock_election()
then presumably finds that cluster_lock_held() returns true and sets
the leader to the current node.
However, the check in cluster_lock_held() is too weak and the "locked"
element must also be checked. As noted above, the nested elections
are the real issue but this is a belts-and-braces fix that should be
in place to avoid weirdness due to the nested event loop.
Close async write with proper SMBPROFILE_BYTES_ASYNC_END_X macro to
properly update both global and per-share counter. Use smbprofile
pervsc helper macros when possible.
Signed-off-by: Shachar Sharon <ssharon@redhat.com> Reviewed-by: Vinit Agnihotri <vagnihot@redhat.com> Reviewed-by: Anoop C S <anoopcs@samba.org> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
Autobuild-User(master): Anoop C S <anoopcs@samba.org>
Autobuild-Date(master): Thu Jul 9 07:01:43 UTC 2026 on atb-devel-224
Volker Lendecke [Fri, 29 May 2026 15:00:56 +0000 (17:00 +0200)]
tests: Add test making sure we can parse an ACL broken by Samba < 4.19
The nice base64 blob you find here was retrieved from the
security.NTACL xattr when running the test from the previous patch
against a 4.18 server. The test has to be modified with a breakpoint()
right after the set_acl() call, because it cleans up the file after
the test, and it has to be run with a user that has the
SeSecurityPrivilege, i.e. typically and administrator. The resulting
security.NTACL xattr is broken.
I haven't found an easy way to inject this ACL into a running xattr
tdb file such that the posix hash function would make this survive a
get_nt_acl. A simple ndrdump should show the point.
Bug: https://bugzilla.samba.org/show_bug.cgi?id=16096 Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
Noel Power [Tue, 4 Feb 2020 10:25:21 +0000 (10:25 +0000)]
s4/torture/smb2: Port raw.streams subtest raw.streams.perms to SMB2
Mostly afaics raw.streams is already ported, the only test I saw that
was missing was the perms test. So this is added here.
Addionally
o add known fail for perms for streams_xattr and ntvfs
o move the smb1 raw.streams to _smb1_done env
o remove test from todo_smb2_tests_to_port.list
o add a known fail for samba3.smb2.streams.perms(simpleserver)
simpleserver is using vfs_streams_depot in preference to
vfs_acl_xattr and the test seems to pass a check it expects
an open of the stream to fail with ACCESS_DENIED but it
passes (see https://bugzilla.samba.org/show_bug.cgi?id=16157)
Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Noel Power <npower@samba.org>
Autobuild-Date(master): Fri Jul 3 12:02:56 UTC 2026 on atb-devel-224
projects / thirdparty / samba.git / log
