From a8d09c4b0b3edf5aa2d3a7161c5f4a1f0e1322ff Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Mon, 18 Feb 2013 10:18:57 +0100 Subject: [PATCH 1/5] s3:smbd: s/EVENT_FD/TEVENT_FD Signed-off-by: Stefan Metzmacher Reviewed-by: Michael Adam (cherry picked from commit 2672c37a8fbc9ff4e5b74e9a5ae55a3e08beed43) --- source3/smbd/process.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/source3/smbd/process.c b/source3/smbd/process.c index 3bf10de..6737517 100644 --- a/source3/smbd/process.c +++ b/source3/smbd/process.c @@ -2441,11 +2441,11 @@ static void smbd_server_connection_handler(struct event_context *ev, struct smbd_server_connection *conn = talloc_get_type(private_data, struct smbd_server_connection); - if (flags & EVENT_FD_WRITE) { + if (flags & TEVENT_FD_WRITE) { smbd_server_connection_write_handler(conn); return; } - if (flags & EVENT_FD_READ) { + if (flags & TEVENT_FD_READ) { smbd_server_connection_read_handler(conn, conn->sock); return; } @@ -2459,11 +2459,11 @@ static void smbd_server_echo_handler(struct event_context *ev, struct smbd_server_connection *conn = talloc_get_type(private_data, struct smbd_server_connection); - if (flags & EVENT_FD_WRITE) { + if (flags & TEVENT_FD_WRITE) { smbd_server_connection_write_handler(conn); return; } - if (flags & EVENT_FD_READ) { + if (flags & TEVENT_FD_READ) { smbd_server_connection_read_handler( conn, conn->smb1.echo_handler.trusted_fd); return; -- 1.7.9.5 From bc04306fe37bfaa74afdda1105151d28fe3843a1 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Mon, 17 Feb 2014 12:05:42 +0100 Subject: [PATCH 2/5] s3:smbd: simplify exit_server_common() Signed-off-by: Stefan Metzmacher Reviewed-by: Volker Lendecke (cherry picked from commit 58c71bee40bb91868fc69d8f7fa640db0e33efae) --- source3/smbd/server_exit.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/source3/smbd/server_exit.c b/source3/smbd/server_exit.c index fa28374..aac738c 100644 --- a/source3/smbd/server_exit.c +++ b/source3/smbd/server_exit.c @@ -99,13 +99,11 @@ static void exit_server_common(enum server_exit_reason how, change_to_root_user(); - if (sconn && sconn->smb1.negprot.auth_context) { - TALLOC_FREE(sconn->smb1.negprot.auth_context); - } - if (sconn) { NTSTATUS status; + TALLOC_FREE(sconn->smb1.negprot.auth_context); + if (lp_log_writeable_files_on_exit()) { bool found = false; files_forall(sconn, log_writeable_file_fn, &found); -- 1.7.9.5 From 48d8bdecb55fadb2fcb7fe60b38936836a3b1dab Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Mon, 17 Feb 2014 12:01:12 +0100 Subject: [PATCH 3/5] s3:smbd: maintain smbd_server_connection->status If this isn't NT_STATUS_OK, we skip any io on the socket. This avoids possible problems during shutdown. Signed-off-by: Stefan Metzmacher Reviewed-by: Volker Lendecke (cherry picked from commit 52ccb40d595fc80bfa53b0b9cd75ffb902369681) --- source3/smbd/globals.h | 1 + source3/smbd/process.c | 25 +++++++++++++++++++++++++ source3/smbd/server_exit.c | 11 +++++++++++ source3/smbd/smb2_server.c | 16 ++++++++++++++++ 4 files changed, 53 insertions(+) diff --git a/source3/smbd/globals.h b/source3/smbd/globals.h index b5b7d8d..0181f1d 100644 --- a/source3/smbd/globals.h +++ b/source3/smbd/globals.h @@ -632,6 +632,7 @@ struct user_struct { }; struct smbd_server_connection { + NTSTATUS status; int sock; const struct tsocket_address *local_address; const struct tsocket_address *remote_address; diff --git a/source3/smbd/process.c b/source3/smbd/process.c index 6737517..5b2658a 100644 --- a/source3/smbd/process.c +++ b/source3/smbd/process.c @@ -153,6 +153,13 @@ bool srv_send_smb(struct smbd_server_connection *sconn, char *buffer, ssize_t ret; char *buf_out = buffer; + if (!NT_STATUS_IS_OK(sconn->status)) { + /* + * we're not supposed to do any io + */ + return true; + } + smbd_lock_socket(sconn); if (do_signing) { @@ -2441,6 +2448,15 @@ static void smbd_server_connection_handler(struct event_context *ev, struct smbd_server_connection *conn = talloc_get_type(private_data, struct smbd_server_connection); + if (!NT_STATUS_IS_OK(conn->status)) { + /* + * we're not supposed to do any io + */ + TEVENT_FD_NOT_READABLE(conn->smb1.fde); + TEVENT_FD_NOT_WRITEABLE(conn->smb1.fde); + return; + } + if (flags & TEVENT_FD_WRITE) { smbd_server_connection_write_handler(conn); return; @@ -2459,6 +2475,15 @@ static void smbd_server_echo_handler(struct event_context *ev, struct smbd_server_connection *conn = talloc_get_type(private_data, struct smbd_server_connection); + if (!NT_STATUS_IS_OK(conn->status)) { + /* + * we're not supposed to do any io + */ + TEVENT_FD_NOT_READABLE(conn->smb1.echo_handler.trusted_fde); + TEVENT_FD_NOT_WRITEABLE(conn->smb1.echo_handler.trusted_fde); + return; + } + if (flags & TEVENT_FD_WRITE) { smbd_server_connection_write_handler(conn); return; diff --git a/source3/smbd/server_exit.c b/source3/smbd/server_exit.c index aac738c..0bd6f5c 100644 --- a/source3/smbd/server_exit.c +++ b/source3/smbd/server_exit.c @@ -102,6 +102,17 @@ static void exit_server_common(enum server_exit_reason how, if (sconn) { NTSTATUS status; + if (NT_STATUS_IS_OK(sconn->status)) { + switch (how) { + case SERVER_EXIT_ABNORMAL: + sconn->status = NT_STATUS_INTERNAL_ERROR; + break; + case SERVER_EXIT_NORMAL: + sconn->status = NT_STATUS_LOCAL_DISCONNECT; + break; + } + } + TALLOC_FREE(sconn->smb1.negprot.auth_context); if (lp_log_writeable_files_on_exit()) { diff --git a/source3/smbd/smb2_server.c b/source3/smbd/smb2_server.c index b4c291e5..b46f994 100644 --- a/source3/smbd/smb2_server.c +++ b/source3/smbd/smb2_server.c @@ -2841,6 +2841,13 @@ static NTSTATUS smbd_smb2_request_next_incoming(struct smbd_server_connection *s size_t max_send_queue_len; size_t cur_send_queue_len; + if (!NT_STATUS_IS_OK(sconn->status)) { + /* + * we're not supposed to do any io + */ + return NT_STATUS_OK; + } + if (state->req != NULL) { /* * if there is already a tstream_readv_pdu @@ -3085,6 +3092,15 @@ static NTSTATUS smbd_smb2_io_handler(struct smbd_server_connection *sconn, NTSTATUS status; NTTIME now; + if (!NT_STATUS_IS_OK(sconn->status)) { + /* + * we're not supposed to do any io + */ + TEVENT_FD_NOT_READABLE(sconn->smb2.fde); + TEVENT_FD_NOT_WRITEABLE(sconn->smb2.fde); + return NT_STATUS_OK; + } + if (fde_flags & TEVENT_FD_WRITE) { status = smbd_smb2_flush_send_queue(sconn); if (!NT_STATUS_IS_OK(status)) { -- 1.7.9.5 From db648dbf32619479c174d0007b768a14fcd79cbe Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Mon, 17 Feb 2014 11:57:52 +0100 Subject: [PATCH 4/5] s3:lib/ctdbd_conn: let release_ip_handler return bool If it returns true the passed ip address matched and we let a nested ctdb operation fail with NT_STATUS_ADDRESS_CLOSED. Signed-off-by: Stefan Metzmacher Reviewed-by: Volker Lendecke (cherry picked from commit 9677fae6aab26d2bf0884dc31516d2dcd8840c03) --- source3/include/ctdbd_conn.h | 2 +- source3/lib/ctdbd_conn.c | 36 ++++++++++++++++++++++++++++++------ source3/smbd/process.c | 6 ++++-- 3 files changed, 35 insertions(+), 9 deletions(-) diff --git a/source3/include/ctdbd_conn.h b/source3/include/ctdbd_conn.h index 5778a92..426c1ac 100644 --- a/source3/include/ctdbd_conn.h +++ b/source3/include/ctdbd_conn.h @@ -74,7 +74,7 @@ NTSTATUS ctdbd_traverse(uint32_t db_id, NTSTATUS ctdbd_register_ips(struct ctdbd_connection *conn, const struct sockaddr_storage *server, const struct sockaddr_storage *client, - void (*release_ip_handler)(const char *ip_addr, + bool (*release_ip_handler)(const char *ip_addr, void *private_data), void *private_data); diff --git a/source3/lib/ctdbd_conn.c b/source3/lib/ctdbd_conn.c index 84f26e0..e826685 100644 --- a/source3/lib/ctdbd_conn.c +++ b/source3/lib/ctdbd_conn.c @@ -59,7 +59,7 @@ struct ctdbd_connection { struct ctdb_packet_context *pkt; struct fd_event *fde; - void (*release_ip_handler)(const char *ip_addr, void *private_data); + bool (*release_ip_handler)(const char *ip_addr, void *private_data); void *release_ip_priv; }; @@ -427,10 +427,23 @@ static NTSTATUS ctdb_read_req(struct ctdbd_connection *conn, uint32_t reqid, if ((conn->release_ip_handler != NULL) && (msg->srvid == CTDB_SRVID_RELEASE_IP)) { + bool ret; + /* must be dispatched immediately */ DEBUG(10, ("received CTDB_SRVID_RELEASE_IP\n")); - conn->release_ip_handler((const char *)msg->data, - conn->release_ip_priv); + ret = conn->release_ip_handler((const char *)msg->data, + conn->release_ip_priv); + if (ret) { + /* + * We need to release the ip, + * so return an error to the upper layers. + * + * We make sure we don't trigger this again. + */ + conn->release_ip_handler = NULL; + conn->release_ip_priv = NULL; + return NT_STATUS_ADDRESS_CLOSED; + } TALLOC_FREE(hdr); goto next_pkt; } @@ -629,10 +642,21 @@ static NTSTATUS ctdb_handle_message(uint8_t *buf, size_t length, if ((conn->release_ip_handler != NULL) && (msg->srvid == CTDB_SRVID_RELEASE_IP)) { + bool ret; + /* must be dispatched immediately */ DEBUG(10, ("received CTDB_SRVID_RELEASE_IP\n")); - conn->release_ip_handler((const char *)msg->data, - conn->release_ip_priv); + ret = conn->release_ip_handler((const char *)msg->data, + conn->release_ip_priv); + if (ret) { + /* + * We need to release the ip. + * + * We make sure we don't trigger this again. + */ + conn->release_ip_handler = NULL; + conn->release_ip_priv = NULL; + } TALLOC_FREE(buf); return NT_STATUS_OK; } @@ -1693,7 +1717,7 @@ static void smbd_ctdb_canonicalize_ip(const struct sockaddr_storage *in, NTSTATUS ctdbd_register_ips(struct ctdbd_connection *conn, const struct sockaddr_storage *_server, const struct sockaddr_storage *_client, - void (*release_ip_handler)(const char *ip_addr, + bool (*release_ip_handler)(const char *ip_addr, void *private_data), void *private_data) { diff --git a/source3/smbd/process.c b/source3/smbd/process.c index 5b2658a..5d2c8ee 100644 --- a/source3/smbd/process.c +++ b/source3/smbd/process.c @@ -2505,7 +2505,7 @@ struct smbd_release_ip_state { /**************************************************************************** received when we should release a specific IP ****************************************************************************/ -static void release_ip(const char *ip, void *priv) +static bool release_ip(const char *ip, void *priv) { struct smbd_release_ip_state *state = talloc_get_type_abort(priv, @@ -2542,8 +2542,10 @@ static void release_ip(const char *ip, void *priv) */ smbd_server_connection_terminate(state->sconn, "CTDB_SRVID_RELEASE_IP"); - return; + return true; } + + return false; } static NTSTATUS smbd_register_ips(struct smbd_server_connection *sconn, -- 1.7.9.5 From 7f98d1f58937101607c44a826967cbd0eb2cedfc Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Thu, 13 Feb 2014 15:36:27 +0100 Subject: [PATCH 5/5] s3:smbd: avoid invalid lock_order panic triggered by "CTDB_SRVID_RELEASE_IP" If smbd_server_connection_terminate("CTDB_SRVID_RELEASE_IP") is triggered from within ctdbd_migrate(), we got a smb_panic complaining about invalid lock_order, as ctdbd_migrate is called from dbwrap_fetch_locked(). Bug: https://bugzilla.samba.org/show_bug.cgi?id=10444 Signed-off-by: Stefan Metzmacher Reviewed-by: Volker Lendecke Autobuild-User(master): Stefan Metzmacher Autobuild-Date(master): Fri Feb 21 14:51:51 CET 2014 on sn-devel-104 (cherry picked from commit 33f10d06baf44e31d558bc5bd926c886915322cc) --- source3/smbd/process.c | 41 +++++++++++++++++++++++++++++++++++++++-- 1 file changed, 39 insertions(+), 2 deletions(-) diff --git a/source3/smbd/process.c b/source3/smbd/process.c index 5d2c8ee..65be50f 100644 --- a/source3/smbd/process.c +++ b/source3/smbd/process.c @@ -2499,9 +2499,28 @@ static void smbd_server_echo_handler(struct event_context *ev, struct smbd_release_ip_state { struct smbd_server_connection *sconn; + struct tevent_immediate *im; char addr[INET6_ADDRSTRLEN]; }; +static void smbd_release_ip_immediate(struct tevent_context *ctx, + struct tevent_immediate *im, + void *private_data) +{ + struct smbd_release_ip_state *state = + talloc_get_type_abort(private_data, + struct smbd_release_ip_state); + + if (!NT_STATUS_EQUAL(state->sconn->status, NT_STATUS_ADDRESS_CLOSED)) { + /* + * smbd_server_connection_terminate() already triggered ? + */ + return; + } + + smbd_server_connection_terminate(state->sconn, "CTDB_SRVID_RELEASE_IP"); +} + /**************************************************************************** received when we should release a specific IP ****************************************************************************/ @@ -2513,6 +2532,11 @@ static bool release_ip(const char *ip, void *priv) const char *addr = state->addr; const char *p = addr; + if (!NT_STATUS_IS_OK(state->sconn->status)) { + /* avoid recursion */ + return false; + } + if (strncmp("::ffff:", addr, 7) == 0) { p = addr + 7; } @@ -2539,9 +2563,18 @@ static bool release_ip(const char *ip, void *priv) * triggered and has implication on our process model, * we can just use smbd_server_connection_terminate() * (also for SMB1). + * + * We don't call smbd_server_connection_terminate() directly + * as we might be called from within ctdbd_migrate(), + * we need to defer our action to the next event loop */ - smbd_server_connection_terminate(state->sconn, - "CTDB_SRVID_RELEASE_IP"); + tevent_schedule_immediate(state->im, state->sconn->ev_ctx, + smbd_release_ip_immediate, state); + + /* + * Make sure we don't get any io on the connection. + */ + state->sconn->status = NT_STATUS_ADDRESS_CLOSED; return true; } @@ -2565,6 +2598,10 @@ static NTSTATUS smbd_register_ips(struct smbd_server_connection *sconn, return NT_STATUS_NO_MEMORY; } state->sconn = sconn; + state->im = tevent_create_immediate(state); + if (state->im == NULL) { + return NT_STATUS_NO_MEMORY; + } if (print_sockaddr(state->addr, sizeof(state->addr), srv) == NULL) { return NT_STATUS_NO_MEMORY; } -- 1.7.9.5