[SCM] Samba Shared Repository - branch v4-11-test updated
Karolin Seeger
kseeger at samba.org
Thu Aug 6 13:33:02 UTC 2020
The branch, v4-11-test has been updated
via bb08c9b1f08 dbcheck: Allow a dangling forward link outside our known NCs
via b3d08729d1b s3:smbd: check for stale pid in delay_for_oplock_fn() when leases_db_get() fails
via 7a431cb5b5c s3:leases: log errors with level 0 in leases_db_do_locked_fn()
via eb14d8850f8 smbd: check for stale pid in get_lease_type()
via 37e41647813 smbd: let get_lease_type() take a non-const share_mode_entry
via fc4f7104690 smbd: inverse if/else logic in get_lease_type()
via 4d5312be999 s3/leases: log NDR decoding failure with level 0 in leases_db_get_fn()
via 58bc493c779 smbd: increase loglevel when leases_db_del() with anything then NT_STATUS_NOT_FOUND
via c8507d0af5c docs: Fix documentation for require_membership_of of pam_winbind.conf
via 76d466f579f docs: Fix documentation for require_membership_of of pam_winbind
from 482246b997b lib/debug: set the correct default backend loglevel to MAX_DEBUG_LEVEL
https://git.samba.org/?p=samba.git;a=shortlog;h=v4-11-test
- Log -----------------------------------------------------------------
commit bb08c9b1f0897bd76e2df78aef4a5ad4576578ab
Author: Andrew Bartlett <abartlet at samba.org>
Date: Mon Jul 27 11:37:29 2020 +1200
dbcheck: Allow a dangling forward link outside our known NCs
If we do not have the NC of the target object we can not be really sure
that the object is redundent and so we want to keep it for now
and not (as happened until now) break the dbcheck run made during the
replication stage of a "samba-tool domain backup rename".
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14450
Signed-off-by: Andrew Bartlett <abartlet at samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall at catalyst.net.nz>
(cherry picked from commit 05228c4e07013c0e6f78f1330b3b787271282ca8)
Autobuild-User(v4-11-test): Karolin Seeger <kseeger at samba.org>
Autobuild-Date(v4-11-test): Thu Aug 6 13:32:29 UTC 2020 on sn-devel-184
commit b3d08729d1b29574d7d9ea3e5e93cb92796ad2e8
Author: Stefan Metzmacher <metze at samba.org>
Date: Mon Jul 6 08:58:22 2020 +0200
s3:smbd: check for stale pid in delay_for_oplock_fn() when leases_db_get() fails
If leases_db_get() failed the leases_db record might have been cleaned up for
stale processes. Check if the share-mode-entry owner is stale in this case and
return ignore the entry. In any other case, log a debug messages and panic.
Commit 05d4466a6d1ad048fa86aea09ec0a56a7b961369
"smbd: check for stale pid in get_lease_type()" fixed only one half of
this.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14428
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Jeremy Allison <jra at samba.org>
Autobuild-User(master): Jeremy Allison <jra at samba.org>
Autobuild-Date(master): Tue Jul 7 02:47:46 UTC 2020 on sn-devel-184
(backported from commit 58adf349edfd3001ad071cc7ed8cfc551f67f8a2)
[metze at samba.org: use share_mode_stale_pid() instead of share_entry_stale_pid()]
[metze at samba.org: use file_id_string_tos() instead of file_id_str_buf()]
commit 7a431cb5b5c741716b094b40744312e948165afe
Author: Stefan Metzmacher <metze at samba.org>
Date: Mon Jul 6 14:03:39 2020 +0200
s3:leases: log errors with level 0 in leases_db_do_locked_fn()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14428
Signed-off-by: Stefan Metzmacher <metze at samba.org>
Reviewed-by: Jeremy Allison <jra at samba.org>
(cherry picked from commit 217693682d5bbd0f2d6b5331f47b2a6348840898)
commit eb14d8850f8356b0b48d2a8708107599c359121c
Author: Ralph Boehme <slow at samba.org>
Date: Thu Jul 2 14:47:12 2020 +0200
smbd: check for stale pid in get_lease_type()
If leases_db_get() failed the leases_db record might have been cleaned up for
stale processes. Check if the share-mode-entry owner is stale in this case and
return a 0 lease state. In any other case, log a debug messages and panic.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14428
Signed-off-by: Ralph Boehme <slow at samba.org>
Autobuild-User(master): Stefan Metzmacher <metze at samba.org>
Autobuild-Date(master): Thu Jul 2 16:45:42 UTC 2020 on sn-devel-184
(backported from commit 05d4466a6d1ad048fa86aea09ec0a56a7b961369)
[slow at samba.org: use share_mode_stale_pid() instead of share_entry_stale_pid()]
[metze at samba.org: use file_id_string_tos() instead of file_id_str_buf()]
commit 37e4164781349c7a98d3bd336b9ea9411dfc2cba
Author: Ralph Boehme <slow at samba.org>
Date: Thu Jul 2 14:45:59 2020 +0200
smbd: let get_lease_type() take a non-const share_mode_entry
We're going to add a call to share_entry_stale_pid(share_mode_entry) which takes
a non-const pointer (in order to eventually set e->state = true).
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14428
Signed-off-by: Ralph Boehme <slow at samba.org>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
(backported from commit 3f4a865821da27efbed4f7c38ad3efbcaae77a02)
[slow at samba.org: get_lease_type() takes arg d in 4.11]
commit fc4f71046908be6f7694642acb71845defc79fb6
Author: Ralph Boehme <slow at samba.org>
Date: Thu Jul 2 14:08:44 2020 +0200
smbd: inverse if/else logic in get_lease_type()
No change in behaviour.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14428
Signed-off-by: Ralph Boehme <slow at samba.org>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
(backported from commit e4328db1c94837a8ea5652971cea20055d3d24ff)
[slow at samba.org: take id from d as it's not passed as arg]
commit 4d5312be9990410e782bcaa4532e1612820a5827
Author: Ralph Boehme <slow at samba.org>
Date: Thu Jul 2 14:10:05 2020 +0200
s3/leases: log NDR decoding failure with level 0 in leases_db_get_fn()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14428
Signed-off-by: Ralph Boehme <slow at samba.org>
(cherry picked from commit 383a2457bd6cbe0acd571a8d601f8bdc5365f0b4)
commit 58bc493c7794923b845647ab16bbfd3aafe07798
Author: Ralph Boehme <slow at samba.org>
Date: Thu Jul 2 14:09:15 2020 +0200
smbd: increase loglevel when leases_db_del() with anything then NT_STATUS_NOT_FOUND
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14428
Signed-off-by: Ralph Boehme <slow at samba.org>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
(backported from commit fbb8bbe1243eb2a0351dc2422929278f85a99e26)
[slow at samba.org: remove_lease_if_stale() does not exist in 4.11]
commit c8507d0af5c382b7a90294cd921a5b919869b12b
Author: Andreas Schneider <asn at samba.org>
Date: Fri Jul 17 12:14:16 2020 +0200
docs: Fix documentation for require_membership_of of pam_winbind.conf
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14358
Signed-off-by: Andreas Schneider <asn at samba.org>
Reviewed-by: Isaac Boukris <iboukris at samba.org>
(cherry picked from commit 71b7140fd0a33e7e8c5bf37c2897cea8224b3f01)
commit 76d466f579f13fa116ecd0b5c2395387415cae55
Author: Andreas Schneider <asn at samba.org>
Date: Thu Jul 9 11:48:26 2020 +0200
docs: Fix documentation for require_membership_of of pam_winbind
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14358
Signed-off-by: Andreas Schneider <asn at samba.org>
Reviewed-by: Alexander Bokovoy <ab at samba.org>
(cherry picked from commit 4c74db6978c682f8ba4e74a6ee8157cfcbb54971)
-----------------------------------------------------------------------
Summary of changes:
docs-xml/manpages/pam_winbind.8.xml | 8 +++--
docs-xml/manpages/pam_winbind.conf.5.xml | 9 +++--
python/samba/dbchecker.py | 24 ++++++++++++-
selftest/target/Samba4.pm | 39 +++++++++++++++++++++
source3/locking/leases_db.c | 12 +++----
source3/locking/locking.c | 7 ++--
source3/smbd/open.c | 34 +++++++++++++++++-
source3/smbd/oplock.c | 59 +++++++++++++++++++++++---------
source3/smbd/proto.h | 4 +--
9 files changed, 161 insertions(+), 35 deletions(-)
Changeset truncated at 500 lines:
diff --git a/docs-xml/manpages/pam_winbind.8.xml b/docs-xml/manpages/pam_winbind.8.xml
index a9a227f1647..a61fb2d58e5 100644
--- a/docs-xml/manpages/pam_winbind.8.xml
+++ b/docs-xml/manpages/pam_winbind.8.xml
@@ -84,9 +84,11 @@
If this option is set, pam_winbind will only succeed if the user is a member of the given SID or NAME. A SID
can be either a group-SID, an alias-SID or even an user-SID. It is also possible to give a NAME instead of the
SID. That name must have the form: <parameter>MYDOMAIN\mygroup</parameter> or
- <parameter>MYDOMAIN\myuser</parameter>. pam_winbind will, in that case, lookup the SID internally. Note that
- NAME may not contain any spaces. It is thus recommended to only use SIDs. You can verify the list of SIDs a
- user is a member of with <command>wbinfo --user-sids=SID</command>.
+ <parameter>MYDOMAIN\myuser</parameter> (where '\' character corresponds to the value of
+ <parameter>winbind separator</parameter> parameter). It is also possible to use a UPN in the form
+ <parameter>user at REALM</parameter> or <parameter>group at REALM</parameter>. pam_winbind will, in that case, lookup
+ the SID internally. Note that NAME may not contain any spaces. It is thus recommended to only use SIDs. You can
+ verify the list of SIDs a user is a member of with <command>wbinfo --user-sids=SID</command>.
</para>
<para>
diff --git a/docs-xml/manpages/pam_winbind.conf.5.xml b/docs-xml/manpages/pam_winbind.conf.5.xml
index 193a0dc971c..ea35d3f6245 100644
--- a/docs-xml/manpages/pam_winbind.conf.5.xml
+++ b/docs-xml/manpages/pam_winbind.conf.5.xml
@@ -69,9 +69,12 @@
If this option is set, pam_winbind will only succeed if the user is a member of the given SID or NAME. A SID
can be either a group-SID, an alias-SID or even an user-SID. It is also possible to give a NAME instead of the
SID. That name must have the form: <parameter>MYDOMAIN\mygroup</parameter> or
- <parameter>MYDOMAIN\myuser</parameter>. pam_winbind will, in that case, lookup the SID internally. Note that
- NAME may not contain any spaces. It is thus recommended to only use SIDs. You can verify the list of SIDs a
- user is a member of with <command>wbinfo --user-sids=SID</command>. This setting is empty by default.
+ <parameter>MYDOMAIN\myuser</parameter> (where '\' character corresponds to the value of
+ <parameter>winbind separator</parameter> parameter). It is also possible to use a UPN in the form
+ <parameter>user at REALM</parameter> or <parameter>group at REALM</parameter>. pam_winbind will, in that case, lookup
+ the SID internally. Note that NAME may not contain any spaces. It is thus recommended to only use SIDs. You can
+ verify the list of SIDs a user is a member of with <command>wbinfo --user-sids=SID</command>.
+ This setting is empty by default.
</para>
<para>This option only operates during password authentication, and will not restrict access if a password is not required for any reason (such as SSH key-based login).</para>
</listitem>
diff --git a/python/samba/dbchecker.py b/python/samba/dbchecker.py
index 04304b0b0dc..13ba1f59640 100644
--- a/python/samba/dbchecker.py
+++ b/python/samba/dbchecker.py
@@ -621,7 +621,29 @@ newSuperior: %s""" % (str(from_dn), str(to_rdn), str(to_base)))
return 0
nc_root = self.samdb.get_nc_root(dn)
- target_nc_root = self.samdb.get_nc_root(dsdb_dn.dn)
+ try:
+ target_nc_root = self.samdb.get_nc_root(dsdb_dn.dn)
+ except ldb.LdbError as e:
+ (enum, estr) = e.args
+ if enum != ldb.ERR_NO_SUCH_OBJECT:
+ raise
+ target_nc_root = None
+
+ if target_nc_root is None:
+ # We don't bump the error count as Samba produces
+ # these in normal operation creating a lab domain (due
+ # to the way the rename is handled, links to
+ # now-expunged objects will never be fixed to stay
+ # inside the NC
+ self.report("WARNING: no target object found for GUID "
+ "component for link "
+ "%s in object to %s outside our NCs"
+ "%s - %s" % (attrname, dsdb_dn.dn, dn, val))
+ self.report("Not removing dangling one-way "
+ "left-over link outside our NCs "
+ "(we might be building a renamed/lab domain)")
+ return 0
+
if nc_root != target_nc_root:
# We don't bump the error count as Samba produces these
# in normal operation
diff --git a/selftest/target/Samba4.pm b/selftest/target/Samba4.pm
index 195e9b88044..a599099c59d 100755
--- a/selftest/target/Samba4.pm
+++ b/selftest/target/Samba4.pm
@@ -2813,6 +2813,45 @@ sub setup_backupfromdc
$self->setup_namespaces($env, $upn_array, $spn_array);
+ # Set up a dangling forward link to an expunged object
+ #
+ # We need this to ensure that the "samba-tool domain backup rename"
+ # that is part of the creation of the labdc environment can
+ # cope with this situation on the source DC.
+
+ if (not $self->write_ldb_file("$env->{PRIVATEDIR}/sam.ldb", "
+dn: ou=linktest,dc=backupdom,dc=samba,dc=example,dc=com
+objectclass: organizationalUnit
+-
+
+dn: cn=linkto,ou=linktest,dc=backupdom,dc=samba,dc=example,dc=com
+objectclass: msExchConfigurationContainer
+-
+
+dn: cn=linkfrom,ou=linktest,dc=backupdom,dc=samba,dc=example,dc=com
+objectclass: msExchConfigurationContainer
+addressBookRoots: cn=linkto,ou=linktest,dc=backupdom,dc=samba,dc=example,dc=com
+-
+
+")) {
+ return undef;
+ }
+ my $ldbdel = Samba::bindir_path($self, "ldbdel");
+ my $cmd = "$ldbdel -H $env->{PRIVATEDIR}/sam.ldb cn=linkto,ou=linktest,dc=backupdom,dc=samba,dc=example,dc=com";
+
+ unless(system($cmd) == 0) {
+ warn("Failed to delete link target: \n$cmd");
+ return undef;
+ }
+
+ # Expunge will ensure that linkto is totally wiped from the DB
+ my $samba_tool = Samba::bindir_path($self, "samba-tool");
+ $cmd = "$samba_tool domain tombstones expunge --tombstone-lifetime=0 $env->{CONFIGURATION}";
+
+ unless(system($cmd) == 0) {
+ warn("Failed to expunge link target: \n$cmd");
+ return undef;
+ }
return $env;
}
diff --git a/source3/locking/leases_db.c b/source3/locking/leases_db.c
index 17778050acc..5a27944acc8 100644
--- a/source3/locking/leases_db.c
+++ b/source3/locking/leases_db.c
@@ -116,7 +116,7 @@ static void leases_db_do_locked_fn(struct db_record *rec, void *private_data)
value,
(ndr_pull_flags_fn_t)ndr_pull_leases_db_value);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
- DBG_DEBUG("ndr_pull_struct_blob_failed: %s\n",
+ DBG_ERR("ndr_pull_struct_blob_failed: %s\n",
ndr_errstr(ndr_err));
state->status = ndr_map_error2ntstatus(ndr_err);
goto done;
@@ -132,7 +132,7 @@ static void leases_db_do_locked_fn(struct db_record *rec, void *private_data)
if (value->num_files == 0) {
state->status = dbwrap_record_delete(rec);
if (!NT_STATUS_IS_OK(state->status)) {
- DBG_DEBUG("dbwrap_record_delete returned %s\n",
+ DBG_ERR("dbwrap_record_delete returned %s\n",
nt_errstr(state->status));
}
goto done;
@@ -144,7 +144,7 @@ static void leases_db_do_locked_fn(struct db_record *rec, void *private_data)
value,
(ndr_push_flags_fn_t)ndr_push_leases_db_value);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
- DBG_DEBUG("ndr_push_struct_blob_failed: %s\n",
+ DBG_ERR("ndr_push_struct_blob_failed: %s\n",
ndr_errstr(ndr_err));
state->status = ndr_map_error2ntstatus(ndr_err);
goto done;
@@ -159,7 +159,7 @@ static void leases_db_do_locked_fn(struct db_record *rec, void *private_data)
state->status = dbwrap_record_store(rec, db_value, 0);
if (!NT_STATUS_IS_OK(state->status)) {
- DBG_DEBUG("dbwrap_record_store returned %s\n",
+ DBG_ERR("dbwrap_record_store returned %s\n",
nt_errstr(state->status));
}
@@ -544,8 +544,8 @@ static void leases_db_get_fn(TDB_DATA key, TDB_DATA data, void *private_data)
&blob, value, value,
(ndr_pull_flags_fn_t)ndr_pull_leases_db_value);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
- DBG_DEBUG("ndr_pull_struct_blob_failed: %s\n",
- ndr_errstr(ndr_err));
+ DBG_ERR("ndr_pull_struct_blob_failed: %s\n",
+ ndr_errstr(ndr_err));
TALLOC_FREE(value);
state->status = ndr_map_error2ntstatus(ndr_err);
return;
diff --git a/source3/locking/locking.c b/source3/locking/locking.c
index 8fa1237d6ad..5272a3dc829 100644
--- a/source3/locking/locking.c
+++ b/source3/locking/locking.c
@@ -704,13 +704,16 @@ static void remove_share_mode_lease(struct share_mode_data *d,
}
{
+ int level = DBGLVL_DEBUG;
NTSTATUS status;
status = leases_db_del(&e->client_guid,
&e->lease_key,
&d->id);
-
- DEBUG(10, ("%s: leases_db_del returned %s\n", __func__,
+ if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
+ level = DBGLVL_ERR;
+ }
+ DBG_PREFIX(level, ("leases_db_del failed: %s\n",
nt_errstr(status)));
}
}
diff --git a/source3/smbd/open.c b/source3/smbd/open.c
index 888e6ad3af7..ac60c75c139 100644
--- a/source3/smbd/open.c
+++ b/source3/smbd/open.c
@@ -1900,7 +1900,39 @@ static bool delay_for_oplock(files_struct *fsp,
NULL, /* breaking_to_required */
NULL, /* lease_version */
NULL); /* epoch */
- SMB_ASSERT(NT_STATUS_IS_OK(status));
+ /*
+ * leases_db_get() can return NT_STATUS_NOT_FOUND
+ * if the share_mode_entry e is stale and the
+ * lease record was already removed. In this case return
+ * false so the traverse continues.
+ */
+
+ if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND) &&
+ share_mode_stale_pid(d, i))
+ {
+ struct GUID_txt_buf guid_strbuf;
+ DBG_DEBUG("leases_db_get for client_guid [%s] "
+ "lease_key [%"PRIu64"/%"PRIu64"] "
+ "file_id [%s] failed for stale "
+ "share_mode_entry\n",
+ GUID_buf_string(&e->client_guid, &guid_strbuf),
+ e->lease_key.data[0],
+ e->lease_key.data[1],
+ file_id_string_tos(&fsp->file_id));
+ continue;
+ }
+ if (!NT_STATUS_IS_OK(status)) {
+ struct GUID_txt_buf guid_strbuf;
+ DBG_ERR("leases_db_get for client_guid [%s] "
+ "lease_key [%"PRIu64"/%"PRIu64"] "
+ "file_id [%s] failed: %s\n",
+ GUID_buf_string(&e->client_guid, &guid_strbuf),
+ e->lease_key.data[0],
+ e->lease_key.data[1],
+ file_id_string_tos(&fsp->file_id),
+ nt_errstr(status));
+ smb_panic("leases_db_get() failed");
+ }
}
break_to = e_lease_type & ~delay_mask;
diff --git a/source3/smbd/oplock.c b/source3/smbd/oplock.c
index fe88adc9806..bafd6c74c38 100644
--- a/source3/smbd/oplock.c
+++ b/source3/smbd/oplock.c
@@ -172,27 +172,52 @@ static void downgrade_file_oplock(files_struct *fsp)
TALLOC_FREE(fsp->oplock_timeout);
}
-uint32_t get_lease_type(const struct share_mode_data *d,
- const struct share_mode_entry *e)
+uint32_t get_lease_type(struct share_mode_data *d,
+ struct share_mode_entry *e)
{
- if (e->op_type == LEASE_OPLOCK) {
- NTSTATUS status;
- uint32_t current_state;
+ struct GUID_txt_buf guid_strbuf;
+ NTSTATUS status;
+ uint32_t current_state;
+ int idx;
- status = leases_db_get(
- &e->client_guid,
- &e->lease_key,
- &d->id,
- ¤t_state,
- NULL, /* breaking */
- NULL, /* breaking_to_requested */
- NULL, /* breaking_to_required */
- NULL, /* lease_version */
- NULL); /* epoch */
- SMB_ASSERT(NT_STATUS_IS_OK(status));
+ if (e->op_type != LEASE_OPLOCK) {
+ return map_oplock_to_lease_type(e->op_type);
+ }
+
+ status = leases_db_get(&e->client_guid,
+ &e->lease_key,
+ &d->id,
+ ¤t_state,
+ NULL, /* breaking */
+ NULL, /* breaking_to_requested */
+ NULL, /* breaking_to_required */
+ NULL, /* lease_version */
+ NULL); /* epoch */
+ if (NT_STATUS_IS_OK(status)) {
return current_state;
}
- return map_oplock_to_lease_type(e->op_type);
+
+ for (idx = 0; idx < d->num_share_modes; idx++) {
+ struct share_mode_entry *_e = &d->share_modes[idx];
+
+ if (_e->share_file_id == e->share_file_id) {
+ break;
+ }
+ }
+ SMB_ASSERT(idx < d->num_share_modes);
+
+ if (share_mode_stale_pid(d, idx)) {
+ return 0;
+ }
+ DBG_ERR("leases_db_get for client_guid [%s] "
+ "lease_key [%"PRIu64"/%"PRIu64"] "
+ "file_id [%s] failed: %s\n",
+ GUID_buf_string(&e->client_guid, &guid_strbuf),
+ e->lease_key.data[0],
+ e->lease_key.data[1],
+ file_id_string_tos(&d->id),
+ nt_errstr(status));
+ smb_panic("leases_db_get() failed");
}
/****************************************************************************
diff --git a/source3/smbd/proto.h b/source3/smbd/proto.h
index 6e2509e7c57..82be9b4e364 100644
--- a/source3/smbd/proto.h
+++ b/source3/smbd/proto.h
@@ -720,8 +720,8 @@ NTSTATUS create_file_default(connection_struct *conn,
/* The following definitions come from smbd/oplock.c */
-uint32_t get_lease_type(const struct share_mode_data *d,
- const struct share_mode_entry *e);
+uint32_t get_lease_type(struct share_mode_data *d,
+ struct share_mode_entry *e);
void break_kernel_oplock(struct messaging_context *msg_ctx, files_struct *fsp);
NTSTATUS set_file_oplock(files_struct *fsp);
--
Samba Shared Repository
More information about the samba-cvs
mailing list