summaryrefslogtreecommitdiff
path: root/source3
AgeCommit message (Collapse)AuthorFilesLines
2025-08-05net: handle replay records in `net serverid wipedbs`Ralph Boehme1-23/+219
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2025-08-05smbd: return replay-cache records in smbXsrv_open_global_traverse()Ralph Boehme3-1/+14
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2025-08-05smbd: reformat smbXsrv_open_global_traverse() function pointer argsRalph Boehme2-3/+9
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2025-08-05smbd: also delete replay cache record in smbXsrv_open_cleanup()Ralph Boehme2-1/+42
Add and use smbXsrv_replay_cleanup() to delete replay cache records. Another external caller comes later, hence adding this as a public function. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2025-08-05smbd: make create-replay cache disk backedRalph Boehme3-22/+39
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2025-08-05smbd: implement session check from MS-SMB2 3.3.5.9 Receiving an SMB2 CREATE ↵Ralph Boehme3-1/+9
Request If the server implements the SMB 3.x dialect family and all of the following conditions are TRUE, the server MUST look up an Open in GlobalOpenTable where Open.IsReplayEligible is TRUE and Open.CreateGuid matches the CreateGuid in the SMB2_CREATE_DURABLE_HANDLE_REQUEST_V2 create context and Open.ClientGuid matches the ClientGuid of the connection that received this request: ... If an Open is found, the server MUST perform the following: ... If Open.Session.SessionId is not equal to the current Session.SessionId, the server MUST fail the request with STATUS_DUPLICATE_OBJECTID. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2025-08-05smbd: Add session_global_id and tcon_global_id to smbXsrv_open_global0Ralph Boehme2-0/+12
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2025-08-05smbd: add smbXsrv_tcon to smbXsrv_openRalph Boehme5-0/+9
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2025-08-05smbd: add smbXsrv_session to smbXsrv_openRalph Boehme5-6/+14
From "MS-SMB2 3.3.1.10 Per Open": Open.Session: A reference to the authenticated session, as specified in section 3.3.1.8, over which this open was performed. If the open is not attached to a session at this time, this value MUST be NULL. Needed to implement: 3.3.5.9 Receiving an SMB2 CREATE Request If the server implements the SMB 3.x dialect family and all of the following conditions are TRUE, the server MUST look up an Open in GlobalOpenTable where Open.IsReplayEligible is TRUE and Open.CreateGuid matches the CreateGuid in the SMB2_CREATE_DURABLE_HANDLE_REQUEST_V2 create context and Open.ClientGuid matches the ClientGuid of the connection that received this request: ... If an Open is found, the server MUST perform the following: .. If Open.Session.SessionId is not equal to the current Session.SessionId, the server MUST fail the request with STATUS_DUPLICATE_OBJECTID. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2025-08-05smbd: add and use smbXsrv_open_replay_cache_key_bufRalph Boehme2-12/+70
No change in behaviour. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2025-08-05smbd: make the replay cache record an index on the global open tableRalph Boehme2-71/+99
Store only the open_global record key as is in the replay-cache record, making it an index into the global open table. Then in the replay code, use the new function smbXsrv_open_global_lookup() to get at the open records. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2025-08-05smbd: invert logic when handling pending create in ↵Ralph Boehme1-31/+28
smb2srv_open_lookup_replay_cache() No change in behaviour. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2025-08-05smbd: move create_action to smbXsrv_open_global0Ralph Boehme2-3/+3
In preperation for making create replay disk backed. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2025-08-05smbd: simplify create-replayRalph Boehme4-52/+33
Just check state->open_was_deferred and skip calling smb2srv_open_lookup_replay_cache() if it is set. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2025-08-05smbd: move DH2Q context processing to its own functionRalph Boehme1-99/+110
The DH2Q processing code is getting a bit bloated, move it to it's own function. This also simplifies a coming change where I'll add an early out. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2025-08-05smbd: add some debugging to smbXsrv_open_[lookup|set]_replay_cache()Ralph Boehme1-0/+25
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2025-08-05smbd: move create_action handling to smbd_smb2_create_after_exec()Ralph Boehme1-3/+3
This ensures op->create_action is set when we're calling smbXsrv_open_update() and fixes create_action handling for create replays. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2025-08-05smbd: simplify create_action handlingRalph Boehme1-7/+8
(state->info == FILE_WAS_OVERWRITTEN) can only happen when returning SMB_VFS_CREATE_FILE(), not for a Durable Handle reconnect or Replay, hence we can move the check and adjustment of state->info to smbd_smb2_create_send() after the call to SMB_VFS_CREATE_FILE(). This nicely simplifies the logic in smbd_smb2_create_finish() where we can now just set state->op->create_action and state->out_create_action to the value of state->info. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2025-08-05smbd: fix include order in smbXsrv_open.cRalph Boehme1-1/+1
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2025-08-05s3/dbwrap_watch: avoid leaking backend db handle in traversesRalph Boehme1-2/+4
Currently in a traverse callback dbwrap_record_get_db() returns the backend db handle. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2025-08-05s3:utils: Allow ROLE_IPA_DC to allow to use Kerberos in gensecPavel Filipenský1-1/+5
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15891 Signed-off-by: Pavel Filipenský <pfilipensky@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Tue Aug 5 14:51:51 UTC 2025 on atb-devel-224
2025-08-05s3:netlogon: IPA DC is the PDC as well - allow ROLE_IPA_DC in ↵Pavel Filipenský1-1/+4
_netr_DsRGetForestTrustInformation() BUG: https://bugzilla.samba.org/show_bug.cgi?id=15891 Signed-off-by: Pavel Filipenský <pfilipensky@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2025-08-05s3:winbindd: Resolve dc name using CLDAP also for ROLE_IPA_DCPavel Filipenský1-1/+3
server role ROLE_IPA_DC (introduced in e2d5b4d) needs special handling in dcip_check_name(). We should resolve the DC name using: - CLDAP in dcip_check_name_ads() instead of: - NETBIOS in nbt_getdc() that fails if Windows is not providing netbios. The impacted environment has: domain->alt_name = example.com domain->active_directory = 1 security = USER server role = ROLE_IPA_DC BUG: https://bugzilla.samba.org/show_bug.cgi?id=15891 Signed-off-by: Pavel Filipenský <pfilipensky@samba.org> Signed-off-by: Andreas Schneider <asn@samba.org> Pair-programmed-with: Andreas Schneider <asn@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org>
2025-08-05s3:tests: Use bash and disable history expansion for ↵Andreas Schneider1-2/+6
test_wbinfo_lookuprids_cache.sh Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org> Autobuild-User(master): Volker Lendecke <vl@samba.org> Autobuild-Date(master): Tue Aug 5 12:50:07 UTC 2025 on atb-devel-224
2025-08-05s3:tests: Fix shellcheck warning of test_wbinfo_lookuprids_cache.shAndreas Schneider1-1/+1
In source3/script/tests/test_wbinfo_lookuprids_cache.sh line 27: key=$("$TDBDUMP" "$cache" | grep ^key.*NDR.*/"$opnum"/ | cut -d\" -f2) ^-------------------^ SC2062 (warning): Quote the grep pattern so the shell won't interpret it. Lets better use awk for matching the pattern. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
2025-08-05librpc:gse: Implement storing tickets into an emtpy ccacheAndreas Schneider1-0/+65
smbclient //server/share --krb5-use-ccache=/tmp/foo Will write the ticket to the specified ccache. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org>
2025-08-05source3/printing: Fix CID 1273086 - Resource LeakShwetha K Acharya1-2/+2
Ensure print_queue_struct *q is initialized to NULL to avoid undefined behavior when freeing on error paths. Move SAFE_FREE(q) outside the ret > 0 block to ensure q is always freed. Signed-off-by: Shwetha K Acharya <Shwetha.K.Acharya@ibm.com> Reviewed-by: Guenther Deschner <gd@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org> Reviewed-by: Vinit Agnihotri <vagnihot@redhat.com> Autobuild-User(master): Anoop C S <anoopcs@samba.org> Autobuild-Date(master): Tue Aug 5 09:20:17 UTC 2025 on atb-devel-224
2025-08-02s3-selftest: fix test_wbinfo_lookuprids_cache.shGünther Deschner1-1/+2
This script is using tdbtool for deleting keys of a particular winbind NDR operation for regression testing. There are two issues here: The opnum for this winbind NDR operation has changed (as new calls have been added to the interface), it is no longer 16 but now 17. Better try to lookup the current opnum from the IDL. As tdbtool always returns with success error code regardless of the success of its command - in this case a delete key operation - the test is simply not able to fail at all (patch following to fix tdbtool itself). Guenther Signed-off-by: Guenther Deschner <gd@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-08-01s3:smbd: Fix CID 1449599 replacing memcpy to memmove to avoid overflowShweta Sodani1-1/+1
Here reply_smb1_outbuf is allocating the req->outbuf buffer, hence safest way to use is memmove that has a checks for overlap instead of memcpy. This fixes coverity issue#1449599 Signed-off-by: Shweta Sodani <ssodani@redhat.com> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org> Reviewed-by: Shwetha K Acharya <Shwetha.K.Acharya@ibm.com> Autobuild-User(master): Anoop C S <anoopcs@samba.org> Autobuild-Date(master): Fri Aug 1 11:03:06 UTC 2025 on atb-devel-224
2025-07-30s3/libsmb: check the negative-conn-cache in resolve_ads()Ralph Boehme1-5/+20
This way we throw away blacklisted servers right away when learning about them from the DNS SRV query. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14981 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Guenther Deschner <gd@samba.org> Autobuild-User(master): Günther Deschner <gd@samba.org> Autobuild-Date(master): Wed Jul 30 10:10:21 UTC 2025 on atb-devel-224
2025-07-30s3/libsmb: check command in make_dc_info_from_cldap_reply()Ralph Boehme1-0/+6
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14981 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Guenther Deschner <gd@samba.org>
2025-07-30libads: check for if DCs are in paused state when processing CLDAP repliesRalph Boehme1-3/+10
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14981 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Guenther Deschner <gd@samba.org>
2025-07-30s3/libads: get rid of additional loop calling add_failed_connection_entry()Ralph Boehme1-12/+10
Just call add_failed_connection_entry() in the initial loop at all places where we have a "bad" result. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14981 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Guenther Deschner <gd@samba.org>
2025-07-30s3:libads: let get_kdc_ip_string() check for a blacklisted server nameStefan Metzmacher1-0/+22
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14981 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> Reviewed-by: Guenther Deschner <gd@samba.org>
2025-07-30s3:libads: let cldap_ping_list() check for a blacklisted server nameStefan Metzmacher1-0/+24
If we black listed a server we should not use it even if it responses to CLDAP requests. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14981 Pair-Programmed-With: Ralph Boehme <slow@samba.org> Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Guenther Deschner <gd@samba.org>
2025-07-30winbindd: blacklist servers returning ACCESS_DENIED/authoritative=0Stefan Metzmacher1-0/+93
https://bugzilla.samba.org/show_bug.cgi?id=14981 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> Reviewed-by: Guenther Deschner <gd@samba.org>
2025-07-30winbindd: always use winbind_add_failed_connection_entry() wrapperStefan Metzmacher3-3/+6
We should not use add_failed_connection_entry() directly. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14981 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> Reviewed-by: Guenther Deschner <gd@samba.org>
2025-07-30s3:conncache: improve debugging for the negative connection cacheStefan Metzmacher1-3/+5
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14981 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> Reviewed-by: Guenther Deschner <gd@samba.org>
2025-07-29s3:lib: Fix CID 1497484 use-after-free.Vinit Agnihotri1-0/+1
p was not set to NULL after being free'd, this can cause a use-after-free situation. This fixes coverity issue#1497484 Signed-off-by: Vinit Agnihotri <vagnihot@redhat.com> Reviewed-by: Guenther Deschner <gd@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org> Autobuild-User(master): Günther Deschner <gd@samba.org> Autobuild-Date(master): Tue Jul 29 15:01:42 UTC 2025 on atb-devel-224
2025-07-24s3-net: fix "net ads kerberos" krb5ccname handlingGünther Deschner3-3/+19
We can only rely on KRB5CCNAME being set, --use-krb5-ccname content is not available. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15840 Guenther Signed-off-by: Guenther Deschner <gd@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Günther Deschner <gd@samba.org> Autobuild-Date(master): Thu Jul 24 17:31:14 UTC 2025 on atb-devel-224
2025-07-24s3-selftest: add tests for "net ads kerberos" commandsGünther Deschner2-0/+170
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15840 Guenther Signed-off-by: Guenther Deschner <gd@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2025-07-22smbd: now also use smbXcli_session_dump_keys() in the serverRalph Boehme1-24/+15
Adds support for dumping keys in format for Wireshark ~/.wireshark/smb2_seskey_list Example: debug encryption: dumping generated session keys Session Id [0000] 7D 00 00 E8 57 E0 31 01 }...W.1. Session Key [0000] 71 54 77 50 C1 DD 66 68 A8 51 D8 DE 23 F4 91 01 qTwP..fh .Q..#... Signing Key [0000] B1 29 AC EF 41 30 AE D2 43 00 1F 67 87 29 BF DB .)..A0.. C..g.).. App Key [0000] 6A 88 5C 51 51 22 FF 5C 25 95 A2 5C E2 2C FC 5D j.\QQ".\ %..\.,.] ServerIn Key [0000] 20 08 EB A2 14 99 17 03 9C A5 9A BB B8 48 88 3C ....... .....H.< ServerOut Key [0000] 15 AA C2 0D 19 AB 4C 26 64 E8 FC 94 B1 FE 27 5A ......L& d.....'Z Wireshark configuration line 7d0000e857e03101,71547750c1dd6668a851d8de23f49101,15aac20d19ab4c2664e8fc94b1fe275a,2008eba2149917039ca59abbb848883c When setting debug encryption = yes debug encryption:wireshark keyfile = /home/slow/.wireshark/smb2_seskey_list the keys are appended directly to Wireshark's keyfile. Wireshark has to be restarted to pick them up. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
2025-07-22libcli/smb2: dump encryption key in format for Wireshark ↵Ralph Boehme1-1/+7
~/.wireshark/smb2_seskey_list This allows dumping the keys and quickly feeding them into Wireshark by adding them to ~/.wireshark/smb2_seskey_list. Example: debug encryption: dumping generated session keys Session Id [0000] 7D 00 00 E8 57 E0 31 01 }...W.1. Session Key [0000] 71 54 77 50 C1 DD 66 68 A8 51 D8 DE 23 F4 91 01 qTwP..fh .Q..#... Signing Key [0000] B1 29 AC EF 41 30 AE D2 43 00 1F 67 87 29 BF DB .)..A0.. C..g.).. App Key [0000] 6A 88 5C 51 51 22 FF 5C 25 95 A2 5C E2 2C FC 5D j.\QQ".\ %..\.,.] ServerIn Key [0000] 20 08 EB A2 14 99 17 03 9C A5 9A BB B8 48 88 3C ....... .....H.< ServerOut Key [0000] 15 AA C2 0D 19 AB 4C 26 64 E8 FC 94 B1 FE 27 5A ......L& d.....'Z Wireshark configuration line 7d0000e857e03101,71547750c1dd6668a851d8de23f49101,15aac20d19ab4c2664e8fc94b1fe275a,2008eba2149917039ca59abbb848883c When setting debug encryption = yes debug encryption:wireshark keyfile = /home/slow/.wireshark/smb2_seskey_list the keys are appended directly to Wireshark's keyfile. Wireshark has to be restarted to pick them up. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
2025-07-22libcli/smb: also dump signing_algo in smbXcli_session_dump_keys()Ralph Boehme1-0/+1
The server side already does that and I'm aiming for consolidating server and client code for dumping the keys. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
2025-07-22libcli/smb: make smbXcli_session_dump_keys() usable for the server sideRalph Boehme1-3/+25
By passing the individual keys directly instead of passing the wrapping state objects, smbXcli_session_dump_keys() can later also be used by the server code. No change in behaviour. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
2025-07-22libcli/smb: move cli_session_dump_keys() to libsmbRalph Boehme1-53/+3
More callers to come... Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
2025-07-21vfs_virsufilter: Fix the invocation of SMB_VFS_NEXT_CONNECTRabinarayan Panigrahi1-1/+6
virusfilter is failing if path is defined for virusfilter:quarantine as next module is not initialized by mean time. So rearranged invocation of SMB_VFS_NEXT_CONNECT call BUG: https://bugzilla.samba.org/show_bug.cgi?id=15663 Signed-off-by: Rabinarayan Panigrahi <rapanigr@redhat.com> Reviewed-by: Anoop C S <anoopcs@samba.org> Reviewed-by: Guenther Deschner <gd@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> Autobuild-User(master): Anoop C S <anoopcs@samba.org> Autobuild-Date(master): Mon Jul 21 11:28:12 UTC 2025 on atb-devel-224
2025-07-18smbd: fix mode being sent to possibly_set_archiveSrinivas Rao V1-1/+1
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15880 possibly_set_archive is being passed smb_fname->st.st_ex_mode. Inside the function same variable is getting assigned to itself. Fixed this to send unx_mode to possibly_set_archive. Signed-off-by: Srinivas Rao V <Srinivas.Rao.V@ibm.com> Reviewed-by: Ralph Boehme <slow@samba.org> Reviewed-by: Guenther Deschner <gd@samba.org> Autobuild-User(master): Günther Deschner <gd@samba.org> Autobuild-Date(master): Fri Jul 18 22:25:05 UTC 2025 on atb-devel-224
2025-07-17vfs_ceph_new: cleanup to async pathShweta Sodani1-53/+48
Signed-off-by: Shweta Sodani <ssodani@redhat.com> Reviewed-by: Anoop C S <anoopcs@samba.org> Reviewed-by: Shachar Sharon <ssharon@redhat.com> Reviewed-by: Guenther Deschner <gd@samba.org> Autobuild-User(master): Günther Deschner <gd@samba.org> Autobuild-Date(master): Thu Jul 17 23:13:36 UTC 2025 on atb-devel-224
2025-07-17s3:selftest: run smb2.{bench,connect,credits,ioctl,rw} over quic-ngtcp2Stefan Metzmacher1-0/+15
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Thu Jul 17 10:00:51 UTC 2025 on atb-devel-224
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-13 21:04:28 +0000