Volker Lendecke [Sat, 13 Jun 2026 09:57:27 +0000 (11:57 +0200)]
net: Convert net_dns.c to NTSTATUS
In the gss code at many places we lost the underlying NTSTATUS code
and just replace it with DNS_GSS_ERROR. Don't loose that information.
This brings a slight change in behaviour for the interactive join
command: Instead of retrying with "the next" nameserver on very
specific errors we retry on all errors. I'm not sure the previous
behaviour did anything good, and as this is an interactive command all
that might happen is that the user has to wait a bit longer on
failure.
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
Volker Lendecke [Sat, 13 Jun 2026 08:59:08 +0000 (10:59 +0200)]
net: Move dns_negotiate_sec_ctx() into its only caller
Now that it's converted to NDR-generated structures and uses
dns_cli_request() from toplevel libcli/dns, dns_negotiate_sec_ctx()
does not have to live in lib/addns anymore. If we were to make this
more generally available, it would move together with
DoDNSUpdateNegotiateGensec() or even DoDNSUpdate().
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
Volker Lendecke [Sat, 13 Jun 2026 08:35:14 +0000 (10:35 +0200)]
net dns: Move the functionality of dns_generate_keyname()
This is just a random GUID string, so I don't think we need to hide it
behind a function. python/samba/tests/dns_base.py also does it with a
plain "uuid.uuid4()".
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
Volker Lendecke [Thu, 14 May 2026 08:14:58 +0000 (10:14 +0200)]
lib/addns: Use NDR marshalling for signed DNS updates
This together with the previous patch removes a lot of code depending
on the hand-marshalling in lib/addns. Overall it's about 50 lines code
less, but it will make it possible to remove more code.
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
Volker Lendecke [Sun, 3 May 2026 18:06:15 +0000 (20:06 +0200)]
libcli/dns: Add infrastructure for DNS updates
This creates struct dns_name_packets equivalent of
dns_create_update_request() in lib/addns to allow the use of dns.idl
structures instead of hand-marshalling DNS packets in lib/addns.
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
Volker Lendecke [Sun, 3 May 2026 11:42:03 +0000 (13:42 +0200)]
lib/addns: Make sure ads_dns_lookup_ns() returns addresses
Windows tends to return A/AAAA records when looking up nameserver
records, Samba seems not to do that. We want to avoid unnecessary
lookups.
Do it differently from ads_dns_lookup_srv: For SRV records we have an
additional layer on top of ads_dns_lookup_srv_send/recv in
dnsquery_srv.c. I don't think that additional layer is necessary, so
converting the SRV lookup to this scheme is a TODO now.
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
Volker Lendecke [Sat, 13 Jun 2026 07:49:40 +0000 (09:49 +0200)]
addns: Add a "timeout" parameter to ads_dns_lookup_ns()
Will be used as a timeout for subrequests to be triggered for A/AAAA
records like ads_dns_query_srv_send() already does it. Use uint32_t,
tevent_timeout_current_ofs wants that.
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
Volker Lendecke [Sun, 3 May 2026 10:42:46 +0000 (12:42 +0200)]
lib/addns: Add ServerAddress parameter to DoDNSUpdate()
pszServerName was used for two things: Input for getaddrinfo() to find
the name server to talk to, and also for gensec_set_target_hostname()
for finding the Kerberos target principal. Split this up to enable
using the A records from the DNS NS query directly, i.e. giving
DoDNSUpdate() an IP address to talk to.
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
Volker Lendecke [Sun, 3 May 2026 07:56:11 +0000 (09:56 +0200)]
lib/addns: Prepare for multiple IPs per NS record
struct dns_rr_srv for SRV records already supports multiple
IPs. Prepare for the same with NS records. No changes in the callers
required, nobody looks at that yet.
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
A few lines above we already have zeroed out the first 16 bytes of
blob_out.data.
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org>
Autobuild-User(master): Anoop C S <anoopcs@samba.org>
Autobuild-Date(master): Fri Jul 3 05:51:26 UTC 2026 on atb-devel-224
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Thu Jul 2 13:07:31 UTC 2026 on atb-devel-224
s3:libsmb: let dsgetdcname_rediscover() try process_dc_dns() before process_dc_netbios()
It's 2026 we typically have AD domains, and most of the time no nmbd
running.
So we should try CLDAP before falling back name_status_find(),
this allows us to detect that the domain is an AD domain even if
we searched with the netbios domain name.
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Thu Jul 2 09:33:10 UTC 2026 on atb-devel-224
s4:cracknames: make consistent use of ldb_binary_encode_string()
A client provided value can be passed into a filter
without going through ldb_binary_encode_string()
But the value is only appended via a to "name=%s",
so there's no leading "(", which means
in lib/ldb/common/ldb_parse.c:356: the value-parsing loop terminates
at the first unescaped ')', so a payload like "users)(hidden=*" collapses to
"(name=users)" with the trailing bytes silently discarded. An escaped "\)" makes
ldb_parse_tree() return NULL rather than admit injection. Combined with
LDB_SCOPE_ONELEVEL, the attribute list restricted to ["name"], and the fact that
a DRSUAPI-authenticated client can already issue arbitrary LDAP searches via
dcesrv_samdb_connect_as_user(), there is no escalation surface.
So this is only hardening helping AI to avoid reporting
false positives.
This was reported by Arjun Basnet with Securin Labs.
get_config_item_int and get_conf_item_string function used strncmp
to check command line arguments, but didn't verify the trailing character.
This allowed partial prefix matches
(e.g., matching "itemXYZ=value" when looking for "item").
Refactored lookup-logic to ensure correct parsing.
Pair-Programmed-With: Dmitry Mikhalchenko <tascad@altlinux.org> Signed-off-by: Shumikhina Ksenia <shumikhinaka@sgu.ru> Reviewed-by: Anoop C S <anoopcs@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Wed Jul 1 09:30:23 UTC 2026 on atb-devel-224
s3:srvsvc: add NULL and empty string check in is_hidden_share()
The function lp_servicename() can return NULL string. Also there
is no guarantee that string is not empty. Add explicit checks for
both cases to avoid invalid access in net_name[len - 1].
Also remove use of True/False.
Pair-Programmed-With: Dmitry Mikhalchenko <tascad@altlinux.org> Signed-off-by: Daniil Sarafannikov <sarafannikovda@sgu.ru> Reviewed-by: Anoop C S <anoopcs@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Wed Jul 1 07:18:54 UTC 2026 on atb-devel-224
s3:utils: Fix dereference of NULL ctx when memory is not allocated
In case talloc_zero returns NULL, we must return NULL from
function check_ctx_create(). Otherwise, we dereference NULL
pointer when accessing fields of ctx struct.
Suggested-by: Anoop C S <anoopcs@samba.org> Signed-off-by: Daniil Sarafannikov <sarafannikovda@sgu.ru> Reviewed-by: Anoop C S <anoopcs@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Tue Jun 30 13:39:52 UTC 2026 on atb-devel-224
In case check_ctx_create in net_registry_check_db() returns NULL,
the pointer ctx is NULL and execution jumps to 'done' label,
where function check_ctx_transaction_stop is called.
In this fuction the ctx pointer is dereferenced instantly,
so the NULL pointer will be dereferenced.
In case check_ctx_create returns NULL,
we can just return -1 from net_registry_check_db.
Pair-Programmed-With: Dmitry Mikhalchenko <tascad@altlinux.org> Signed-off-by: Daniil Sarafannikov <sarafannikovda@sgu.ru> Reviewed-by: Anoop C S <anoopcs@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
s3:smbd/utmp: fix potential negative index in ut_id_encode
session_global_id is a uint32_t, but ut_id_encode() takes int.
In case session ID is larger than INT_MAX, the conversion may
lead to negative value and after modulo operation `i % nbase`
it may be negative.
Change the argument type to unsigned int and update all
callers (sys_utmp_fill, sys_utmp_claim, sys_utmp_yield) to
use uint32_t.
Pair-Programmed-With: Dina Tagantseva <dinchik@altlinux.org> Signed-off-by: Daniil Sarafannikov <sarafannikovda@sgu.ru> Reviewed-by: Anoop C S <anoopcs@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
s3:winbindd: only call init_dc_connection_rpc() for NCACN_NP connections
As init_dc_connection_rpc() will return NT_STATUS_TRUSTED_DOMAIN_FAILURE
if domain->conn.cli is NULL and this is the case when we
have domain->conn.ignore_smb_disconnected as true.
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Björn Jacke <bjacke@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Fri Jun 26 16:10:29 UTC 2026 on atb-devel-224
Ralph Boehme [Mon, 8 Jun 2026 12:12:14 +0000 (14:12 +0200)]
smbd: check the return value before the ACE-lists out args
If unpack_canon_ace() fails and returns false, file_ace_list and dir_ace_list
will be left at their initial NULL values, so we exit out at
if (!file_ace_list && !dir_ace_list) {
return NT_STATUS_OK;
}
instead of at the subsequent error checking code for acl_perms.
This subtle change was introduced by commit 81533e2d39cae11b7ea06f289a7c398ed3c51da9 and causes attempts to set an
non-canonical ACL by clients to return NT_STATUS_OK, instead of failing with
NT_STATUS_ACCESS_DENIED.
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Fri Jun 26 12:50:29 UTC 2026 on atb-devel-224
Ralph Boehme [Mon, 8 Jun 2026 13:49:57 +0000 (15:49 +0200)]
smbtorture: split smb2.acls into acls-with-sysacl and acls-ignore-sysacl
The smb2.acls test suite contains tests (OWNER-RIGHTS-DENY1 and DENY1) that use
non-canonical ACLs (containing out-of-order DENY ACEs). Under standard POSIX
draft/system ACL mapping, such non-canonical ACLs cannot be represented
on the underlying file system, hence the current code is supposed to fail
attempts to set such ACLs in the Samba POSIX ACL mapping backend.
However, as the current code wrongly silently swallows the error returned from
the low level mapping function unpack_canon_ace() and a subsequent commit is
going to fix this, the tests mentioned above will start failing.
As these non-canonical ACL are in fact valid ACLs and eg Windows allows setting
them and they only fail when Samba uses POSIX ACL backend, adjust the tests to
run against a share that uses acl_xattr without POSIX ACLs:
- smb2.acls-with-sysacl: Runs tests that are compatible with system POSIX
ACL mapping, executed against the standard 'tmp' share.
- smb2.acls-ignore-sysacl: Contains tests that require Windows-like ACL
handling (like non-canonical ACE ordering) which are executed against
the 'acl_xattr_ign_sysacl_windows' share (where system ACLs are ignored).
Volker Lendecke [Sun, 22 Mar 2026 16:14:49 +0000 (17:14 +0100)]
smbd: Make smb_set_file_unix_basic() slightly easier to read
Having set_owner/set_grp on the same side of the "!=" makes it easier
for the eye to parse.
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org>
Autobuild-User(master): Anoop C S <anoopcs@samba.org>
Autobuild-Date(master): Fri Jun 26 11:45:20 UTC 2026 on atb-devel-224
Volker Lendecke [Wed, 24 Jun 2026 15:43:49 +0000 (17:43 +0200)]
smbd: Simplify unlink_internals()
All callers have already done the stat on smb_fname if it
exists by using openat_pathref_fsp() via synthetic_pathref() or
filename_convert_dirfsp() etc.
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org>
Volker Lendecke [Wed, 17 Jun 2026 21:15:33 +0000 (23:15 +0200)]
smbd: Small simplification in smb1 qinfo
handle_trans2qfilepathinfo_result() only used "fixed_portion" for an
error check. Move that check to the only caller where both arguments
in the comparison are different.
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org>
pdb_ldap: add check for empty name in ldapsam_create_user()
Function ldapsam_create_user() should be called only
with non-empty name. Add an explicit check for it
in the beginning. Without it a buffer underflow can happen
in the first condition for setting is_machine.
Pair-Programmed-With: Dina Tagantseva <dinchik@altlinux.org> Signed-off-by: Daniil Sarafannikov <sarafannikovda@sgu.ru> Reviewed-by: Volker Lendecke <vl@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org> Reviewed-by: Noel Power <npower@samba.org>
Signed-off-by: Martin Schwenke <mschwenke@ddn.com> Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Martin Schwenke <martins@samba.org>
Autobuild-Date(master): Thu Jun 25 23:35:19 UTC 2026 on atb-devel-224
Martin Schwenke [Sun, 17 May 2026 09:16:11 +0000 (19:16 +1000)]
ctdb-daemon: Clean up debug messages
These are difficult to read. The location is unnecessary since each
of these are only done in one place. Remove "public address" from the
messages because it seems obvious.
Signed-off-by: Martin Schwenke <mschwenke@ddn.com> Reviewed-by: Ralph Boehme <slow@samba.org>
Martin Schwenke [Sun, 17 May 2026 06:15:44 +0000 (16:15 +1000)]
ctdb-daemon: Clean up a debug message
This is annoyingly verbose when there are no arguments. Drop the
location details and the "with arguments" noise. Arguments are now in
square brackets, when present.
Signed-off-by: Martin Schwenke <mschwenke@ddn.com> Reviewed-by: Ralph Boehme <slow@samba.org>
Vinit Agnihotri [Tue, 23 Jun 2026 09:47:51 +0000 (15:17 +0530)]
vfs_ceph_rgw: Init librgw only once for every client
Currently we create new instance of librgw on every connect, even
for the same client. Since librgw lacks reference counting mechanism,
destroying instance in any dis-connect for the client results into
invalid handle for other instances.
This change thus initialises and shutdown librgw only once.
Signed-off-by: Vinit Agnihotri <vagnihot@redhat.com> Reviewed-by: Anoop C S <anoopcs@samba.org> Reviewed-by: Guenther Deschner <gd@samba.org>
Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Thu Jun 25 14:17:09 UTC 2026 on atb-devel-224
Anoop C S [Wed, 24 Jun 2026 04:26:44 +0000 (09:56 +0530)]
vfs_ceph_rgw: Read librgw init parameters from [global]
librgw can only be initialized once per process, so the parameters
that feed into librgw_create() - 'id', 'config_file', 'keyring_file'
and 'debug' - must be the same across all shares. Read them from
[global] section instead of per share so the configuration reflects
this constraint.
Other parameters like 'user_id', 'access_key', 'secret_access_key'
and 'bucket' remain per share as before.
Signed-off-by: Anoop C S <anoopcs@samba.org> Reviewed-by: Guenther Deschner <gd@samba.org>
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Noel Power <npower@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Thu Jun 25 12:19:53 UTC 2026 on atb-devel-224
Shweta Sodani [Thu, 19 Feb 2026 14:19:28 +0000 (19:49 +0530)]
winbindd: Add a per-domain failover log message with reason
Adding a new log message that describe for domain controller failover
in winbindd_domain and cause of failover. (DC Connectivity, Kerberos,
LDAP failures)
Snippet of log message:
print_failover_log:
========================================
DC FAILOVER: SUCCESSFULLY FAILED OVER
========================================
Domain Name: CORP
Domain Alt Name: CORP.LOCAL
Status: SUCCESS
Failover Reason: DC_CONNECTIVITY
Source DC (before failover): dc2.corp.local
Destination DC (after failover): dc1.corp.local
Current DC Name: dc1.corp.local
Failover Start Time: 1771930355.281380
Failover End Time: 1771930355.613872
Elapsed Time (seconds): 0.332494
========================================
Signed-off-by: Shweta Sodani <ssodani@redhat.com> Reviewed-by: Vinit Agnihotri <vagnihot@redhat.com> Reviewed-by: Rabinarayan Panigrahi <rapanigr@redhat.com> Reviewed-by: Xavi Hernandez <xhernandez@redhat.com> Reviewed-by: Guenther Deschner <gd@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org>
Autobuild-User(master): Anoop C S <anoopcs@samba.org>
Autobuild-Date(master): Wed Jun 24 19:24:13 UTC 2026 on atb-devel-224
libcli/smb: Fix buffer overflow in smb311_capabilities_parse()
This fixes a potential overflow in loop caused by incorrect
bound. Instead of using the wrong constant both signing and
encryption loops now use ARRAY_SIZE() on the target array.
As encryption const is larger, out-of-bounds write happened:
c.signing.algos[c.signing.num_algos] = algo.
Pair-Programmed-With: Denis Rastyogin <gerben@altlinux.org> Signed-off-by: Daniil Sarafannikov <sarafannikovda@sgu.ru> Reviewed-by: Volker Lendecke <vl@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org>
Autobuild-User(master): Anoop C S <anoopcs@samba.org>
Autobuild-Date(master): Tue Jun 23 11:12:08 UTC 2026 on atb-devel-224
Egor Mikhailov [Thu, 18 Jun 2026 05:35:47 +0000 (09:35 +0400)]
S4/dfs_server: fix potential underflow in get_dcs_insite
get_dcs_insite unconditionally truncates the last character of sAMAccountName
by index len - 1. If sAMAccountName is empty, this leads to an underflow (index -1)
and memory corruption.
This fix ensures sAMAccountName length is validated before truncation.
Pair-Programmed-With: Sergey Zhidkih <rx1513@altlinux.org> Signed-off-by: Egor Mikhailov <mikhailovev@sgu.ru> Reviewed-by: Anoop C S <anoopcs@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Tue Jun 23 09:15:50 UTC 2026 on atb-devel-224
Vinit Agnihotri [Fri, 19 Jun 2026 08:48:45 +0000 (14:18 +0530)]
vfs_ceph_rgw: Add new module parameter 'id'
Module parameter 'id' represents 'Client id portion of the Ceph
client name used by librgw'.
Additionally updated new parameter in man page.
Signed-off-by: Vinit Agnihotri <vagnihot@redhat.com> Reviewed-by: Anoop C S <anoopcs@samba.org> Reviewed-by: John Mulligan <jmulligan@redhat.com> Reviewed-by: Guenther Deschner <gd@samba.org
Autobuild-User(master): Anoop C S <anoopcs@samba.org>
Autobuild-Date(master): Mon Jun 22 15:36:07 UTC 2026 on atb-devel-224
shumikhinaka [Thu, 11 Jun 2026 14:49:58 +0000 (18:49 +0400)]
s3:utils: Fix buffer underflow in parse_timeout for empty strings
The parse_timeout function is called with a command-line argument. The user
may pass an empty string, which will result in undefined behavior until
the result is checked.
A check for the string length has been added immediately after the strlen()
call. If an empty string is passed, the function returns 0, preventing
incorrect access to the array.
Pair-Programmed-With: Dmitry Mikhalchenko <tascad@altlinux.org> Signed-off-by: Shumikhina Ksenia <shumikhinaka@sgu.ru> Reviewed-by: Anoop C S <anoopcs@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Autobuild-User(master): Anoop C S <anoopcs@samba.org>
Autobuild-Date(master): Fri Jun 19 13:03:44 UTC 2026 on atb-devel-224
kdc-heimdal: avoid NULL dereference when task is NULL
kdc_post_fork() may be called with NULL task pointer leading to a
call of task_server_terminate() with NULL pointer, where it will
be dereferenced.
Add an explicit NULL check and instead of attempting to terminate
a NULL task, log the error and return.
Pair-Programmed-With: Timofei Fedotov <sovtouch@altlinux.org> Signed-off-by: Daniil Sarafannikov <sarafannikovda@sgu.ru> Reviewed-by: Anoop C S <anoopcs@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Autobuild-User(master): Anoop C S <anoopcs@samba.org>
Autobuild-Date(master): Fri Jun 19 08:22:25 UTC 2026 on atb-devel-224
Vinit Agnihotri [Thu, 13 Nov 2025 05:37:59 +0000 (11:07 +0530)]
docs-xml/manpages: Add man page for vfs_ceph_rgw
Document all module parameters.
Signed-off-by: Vinit Agnihotri <vagnihot@redhat.com> Reviewed-by: Shachar Sharon <ssharon@redhat.com> Reviewed-by: Anoop C S <anoopcs@samba.org> Reviewed-by: Guenther Deschner <gd@samba.org>
Autobuild-User(master): Anoop C S <anoopcs@samba.org>
Autobuild-Date(master): Thu Jun 18 15:58:55 UTC 2026 on atb-devel-224
Vinit Agnihotri [Thu, 26 Feb 2026 06:57:37 +0000 (12:27 +0530)]
vfs_ceph_rgw: Add renameat method
rgw object store treats dirname as a prefix.
Thus if a particular prefix is part object name for number of objects,
renaming prefix does not reflect for other objects.
Therefor librgw do not recommend renaming directories, thus this
changelist fails dir renaming attempts. Renaming files are also
prohibited due to basic rgw limitation. See inline comments for details.
Signed-off-by: Vinit Agnihotri <vagnihot@redhat.com> Reviewed-by: Shachar Sharon <ssharon@redhat.com> Reviewed-by: Anoop C S <anoopcs@samba.org> Reviewed-by: Guenther Deschner <gd@samba.org>
projects / thirdparty / samba.git / log
