Bug 15435 - regression DFS not working with widelinks = true
Summary: regression DFS not working with widelinks = true
Status: RESOLVED FIXED
Alias: None
Product: Samba 4.1 and newer
Classification: Unclassified
Component: File services (show other bugs)
Version: 4.17.10
Hardware: All All
: P5 normal (vote)
Target Milestone: ---
Assignee: Jule Anger
QA Contact: Samba QA Contact
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-07-26 18:50 UTC by Noel Power
Modified: 2024-07-03 10:09 UTC (History)
2 users (show)

See Also:


Attachments
backport for 4.18 & 4.17 (7.73 KB, patch)
2023-07-29 19:42 UTC, Noel Power
jra: review+
Details
backport for 4.19 (7.70 KB, patch)
2023-08-03 10:24 UTC, Noel Power
no flags Details
start of extra patch for 4.19 (1.06 KB, patch)
2024-06-07 20:05 UTC, Noel Power
no flags Details
start of extra patch for master (1.14 KB, patch)
2024-06-07 22:25 UTC, Noel Power
no flags Details
patch for 4.20 (8.07 KB, patch)
2024-06-12 10:03 UTC, Noel Power
jra: review+
Details
backported patch for 4.19 (8.35 KB, patch)
2024-06-12 10:06 UTC, Noel Power
jra: review+
Details
backport for 4.18 (7.54 KB, patch)
2024-06-12 10:12 UTC, Noel Power
jra: review+
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Noel Power 2023-07-26 18:50:11 UTC
when widelinks = yes is set DFS (at least in the case of local DFS pointing at local shares fail)

e.g.

with following setup


[global]
map to guest = Bad User
server role = standalone server
wide links = yes
unix extensions = no

[guest]
path = /srv/samba/guest/
read only = no
guest ok = yes
guest only = yes
msdfs root = yes


[1] create local share dir

mkdir -p /srv/samba/guest

[2] create msdfs link

ln -snf msdfs:$(hostname -f)\\guest /srv/samba/guest/linka

[3] start smbd

[4] try to access dfs link

 smbclient --no-pass //localhost/guest -c "cd linka"

will result in NT_STATUS_OBJECT_NAME_NOT_FOUND
Comment 1 Noel Power 2023-07-26 18:56:34 UTC
seems this was introduced in 4.17 by d20b60c3200b5e1881cdf4b59da154d1af7e3994 but the code around this has changed since again I think

basically it seems with the current code with widelinks enabled the vfs stack goes as follows

openat_pathref_fsp_case_insensitive

-> openat_pathref_fullname
  -> fd_openat
    -> non_widelink_open
     -> SMB_VFS_OPENAT
       -> widelinks_openat

which ends up failing with NT_STATUS_OBJECT_NAME_NOT_FOUND *but* with the associated stat buf invalide (because widelinks follow the symlink which in the case of a dfs link is invalid so it resolves to a bad / non existent object

in the normal case it is the link that is attempted to open (which fails for the normal reasons) *but* the associated stat buf is valid so the subsequent tests can determine it is a link, a dfs link etc. and process appropriatly
Comment 2 Jeremy Allison 2023-07-26 19:02:13 UTC
Is there a place in that call-stack where we have a valid stat for the dfs link path ?

If so we might be able to do something different in the 'widelinks = yes' case.
Comment 3 Jeremy Allison 2023-07-26 19:04:31 UTC
widelinks_openat() is ugly, dirty and specific enough we might be able to do something in there to restore the old behavior :-).
Comment 4 Noel Power 2023-07-26 19:08:22 UTC
(In reply to Jeremy Allison from comment #2)

>Is there a place in that call-stack where we have a valid stat for the dfs link >path ?
>
>If so we might be able to do something different in the 'widelinks = yes' case.

I didn't see one, but I could easily have missed, I opened this draft with a (as it says in the commit message) 'dodgy (tm)' attempt at fixing

https://gitlab.com/samba-team/samba/-/merge_requests/3195
Comment 5 Jeremy Allison 2023-07-26 19:12:17 UTC
I.e. if the SMB_VFS_NEXT_OPENAT() call in widelinks_openat() fails with -1, errno =ENOENT, then do an SMB_VFS_NEXT_LSTAT() on the name and see if it matches a DFS name, fill in the stat field if so.

This may not be the right place of course, so look in the "normal" DFS path case (when widelinks=no) and see where the returned struct stat gets filled in.
Comment 6 Samba QA Contact 2023-07-29 00:44:03 UTC
This bug was referenced in samba master:

b57cdfd7efb161cf96b3a39dc7a1652db817e602
3d2e9db8b95f9f45d486f8272e53584975f177fa
2668dcd0968133cca4f8410bf8c41ed0483f5d87
0bf8b25aacdf2f5c746922320b32e3f0886c81f5
Comment 7 Noel Power 2023-07-29 19:42:00 UTC
Created attachment 18013 [details]
backport for 4.18 & 4.17

backport should apply to 4.17 & 4.18
Comment 8 Jeremy Allison 2023-08-02 19:46:48 UTC
Re-assigning to Jule for inclusion in 4.18.next, 4.17.next.
Comment 9 Jule Anger 2023-08-03 07:01:55 UTC
Pushed to autobuild-v4-{18,17}-test.

Could you please also create a patch for 4.19?
The 4.18/4.17 patch did not apply to 4.19.
Comment 10 Samba QA Contact 2023-08-03 08:45:05 UTC
This bug was referenced in samba v4-18-test:

e50f377b4ab853b11ea17778a3e5ea712548bc22
5db858c1afde2fd0a20c81360f03f165eee2d53b
e949750d4f533d0c2a04ada4a02236f1b012107a
c40f1619d96c0332d3ad9d9b8e63a4fbc10f332f
Comment 11 Noel Power 2023-08-03 09:59:13 UTC
(In reply to Jule Anger from comment #9)
>Could you please also create a patch for 4.19?
>The 4.18/4.17 patch did not apply to 4.19.

so sorry, I didn't realise we had branched :-( (will backport now)
Comment 12 Noel Power 2023-08-03 10:24:22 UTC
Created attachment 18022 [details]
backport for 4.19

I don't think a a re(review) is needed for this patch version (only context diffs here) but please let me know if it is needed
Comment 13 Jule Anger 2023-08-03 11:36:57 UTC
Thanks :-)
Pushed to autobuild-v4-19-test.
Comment 14 Samba QA Contact 2023-08-03 12:47:04 UTC
This bug was referenced in samba v4-17-test:

9ace53099ed5cc9cb3cabe2f104882b0f260ea43
98a53e95a0f36e60355e3e2d2719018cd485f436
b63c917cf742682f909597349d2f1f513c422ec7
10f3fafc6f4fedbc182894c3d03fd2939cfcee18
Comment 15 Samba QA Contact 2023-08-03 14:31:03 UTC
This bug was referenced in samba v4-19-test:

d59392056e796c2c491e5f53dac2f9161b329bf4
ece48278912e14432f34f6d0edcd26768e299406
368b3e6102b5a7d9df0f243ced7d75fe8605eb79
1231268c219a2f00ad62c7d109db96129b0d2388
Comment 16 Jule Anger 2023-08-04 07:00:36 UTC
Closing out bug report.

Thanks!
Comment 17 Samba QA Contact 2023-08-08 07:22:33 UTC
This bug was referenced in samba v4-19-stable (Release samba-4.19.0rc2):

d59392056e796c2c491e5f53dac2f9161b329bf4
ece48278912e14432f34f6d0edcd26768e299406
368b3e6102b5a7d9df0f243ced7d75fe8605eb79
1231268c219a2f00ad62c7d109db96129b0d2388
Comment 18 Samba QA Contact 2023-08-16 16:57:57 UTC
This bug was referenced in samba v4-18-stable (Release samba-4.18.6):

e50f377b4ab853b11ea17778a3e5ea712548bc22
5db858c1afde2fd0a20c81360f03f165eee2d53b
e949750d4f533d0c2a04ada4a02236f1b012107a
c40f1619d96c0332d3ad9d9b8e63a4fbc10f332f
Comment 19 Samba QA Contact 2023-09-07 09:02:47 UTC
This bug was referenced in samba v4-17-stable (Release samba-4.17.11):

9ace53099ed5cc9cb3cabe2f104882b0f260ea43
98a53e95a0f36e60355e3e2d2719018cd485f436
b63c917cf742682f909597349d2f1f513c422ec7
10f3fafc6f4fedbc182894c3d03fd2939cfcee18
Comment 20 Michael Thalmann 2024-05-31 19:18:07 UTC
According to my testing (samba 4.19.6) the DFSROOT option still does not work if "wide links" is enabled. If wide links is disabled and nothing else changed, the DFS root works again.
Comment 21 Noel Power 2024-06-01 19:27:58 UTC
(In reply to Michael Thalmann from comment #20)

Works for me

laptop:/home/npower/samba-clone # cat INSTALL_DIR/etc/smb.conf 
[global]
map to guest = Bad User
server role = standalone server
wide links = yes
unix extensions = no

[guest]
path = /srv/samba/guest/
read only = no
guest ok = yes
guest only = yes
msdfs root = yes
laptop:/home/npower/samba-clone # ./bin/smbd --version
Version 4.19.6
laptop:/home/npower/samba-clone # ps -efl | grep smbd
5 S root      1426 29973  0  80   0 - 24493 do_epo 20:16 pts/4    00:00:00 ./bin/smbd --no-process-group
5 S root      1432  1426  0  80   0 - 23856 do_epo 20:16 pts/4    00:00:00 smbd: notifyd
5 S root      1433  1426  0  80   0 - 23858 do_epo 20:16 pts/4    00:00:00 smbd: cleanupd
0 S root      1510  4888  0  80   0 -  1411 pipe_r 20:17 pts/4    00:00:00 grep --color=auto smbd
laptop:/home/npower/samba-clone # 
laptop:/home/npower/samba-clone # ./bin/smbclient --no-pass //localhost/guest -c "cd linka;dir"
  .                                   D        0  Sat Jun  1 20:03:41 2024
  ..                                  D        0  Sat Jun  1 20:03:41 2024
  foo                                 N        0  Sat Jun  1 20:03:38 2024
  bar                                 N        0  Sat Jun  1 20:03:41 2024

		148707328 blocks of size 1024. 114921392 blocks available
laptop:/home/npower/samba-clone # ls -lrt /srv/samba/guest
total 4
lrwxrwxrwx 1 root root 23 Jun  1 20:02 linka -> msdfs:192.168.1.6\guest
-rw-r--r-- 1 root root  0 Jun  1 20:03 foo
-rw-r--r-- 1 root root  0 Jun  1 20:03 bar



can you give more details or better still simplest reproducer, it's possible you are triggering a new bug
Comment 22 John Michael Drescher 2024-06-06 19:17:00 UTC
I had working dfs yesterday (and for over a decade) however Rocky 8.10 had an update to samba-4.19.4 and dfs has stopped working. I am unsure of the previous version. I do believe I have wide links enabled.
Comment 23 John Michael Drescher 2024-06-06 19:21:37 UTC
Turning off wide links seems to have fixed the issue:

#wide links = yes
wide links=no

now I see the dfs on the windows machines.
Comment 24 John Michael Drescher 2024-06-06 19:39:44 UTC
Turning off wide links seems to have fixed the issue:

#wide links = yes
wide links=no

now I see the dfs on the windows machines.

Looks like the update was from 4.18.6 to 4.19.4:
    Upgrade       samba-4.19.4-3.el8.x86_64                                                                  @baseos
    Upgraded      samba-4.18.6-3.el8_9.x86_64                                                                @@System
    Upgrade       samba-client-libs-4.19.4-3.el8.x86_64                                                      @baseos
    Upgraded      samba-client-libs-4.18.6-3.el8_9.x86_64                                                    @@System
    Upgrade       samba-common-4.19.4-3.el8.noarch                                                           @baseos
    Upgraded      samba-common-4.18.6-3.el8_9.noarch                                                         @@System
    Upgrade       samba-common-libs-4.19.4-3.el8.x86_64                                                      @baseos
    Upgraded      samba-common-libs-4.18.6-3.el8_9.x86_64                                                    @@System
    Upgrade       samba-common-tools-4.19.4-3.el8.x86_64                                                     @baseos
    Upgraded      samba-common-tools-4.18.6-3.el8_9.x86_64                                                   @@System
    Upgrade       samba-dcerpc-4.19.4-3.el8.x86_64                                                           @baseos
    Upgraded      samba-dcerpc-4.18.6-3.el8_9.x86_64                                                         @@System
    Upgrade       samba-ldb-ldap-modules-4.19.4-3.el8.x86_64                                                 @baseos
    Upgraded      samba-ldb-ldap-modules-4.18.6-3.el8_9.x86_64                                               @@System
    Upgrade       samba-libs-4.19.4-3.el8.x86_64                                                             @baseos
    Upgraded      samba-libs-4.18.6-3.el8_9.x86_64                                                           @@System
    Upgrade       samba-winbind-4.19.4-3.el8.x86_64                                                          @baseos
    Upgraded      samba-winbind-4.18.6-3.el8_9.x86_64                                                        @@System
    Upgrade       samba-winbind-clients-4.19.4-3.el8.x86_64                                                  @baseos
    Upgraded      samba-winbind-clients-4.18.6-3.el8_9.x86_64                                                @@System
    Upgrade       samba-winbind-modules-4.19.4-3.el8.x86_64                                                  @baseos
    Upgraded      samba-winbind-modules-4.18.6-3.el8_9.x86_64                                                @@System
Comment 25 Jeremy Allison 2024-06-06 22:55:32 UTC
Is this with a source build from 4.19.x from git.samba.org ?

Or is this with a vendor package (Rocky8 was mentioned).

If you can reproduce with a source build from git.samba.org I'll investigte, otherwise it may be a problem with the vendor package.
Comment 26 Noel Power 2024-06-07 20:03:27 UTC
(In reply to Jeremy Allison from comment #25)

so looking again (it appears I am blind) in my test (against upstream 4.19.6)

# ./bin/smbclient --no-pass //localhost/guest -c "cd linka;dir"
  .                                   D        0  Sat Jun  1 20:03:41 2024
  ..                                  D        0  Sat Jun  1 20:03:41 2024
  foo                                 N        0  Sat Jun  1 20:03:38 2024
  bar                                 N        0  Sat Jun  1 20:03:41 2024


fine? erm no.. we are missing the entry for the dfs linka entry

this isn't missing when widelinks = no (default)

we would get the same result if we did

./bin/smbclient --no-pass //localhost/guest -c "dir"
  .                                   D        0  Sat Jun  1 20:03:41 2024
  ..                                  D        0  Sat Jun  1 20:03:41 2024
  foo                                 N        0  Sat Jun  1 20:03:38 2024
  bar                                 N        0  Sat Jun  1 20:03:41 2024


BUT... we can cd linka (even though it isn't enumerated) so there is a problem.

Note this doesn't happen on master but on master (and most likely on 4.19 aswell) the first 'cd' will work but the second will not

e.g.
./bin/smbclient  --no-pass //localhost/guest
smb: \> dir
  .                                   D        0  Fri Jun  7 20:48:27 2024
  ..                                  D        0  Fri Jun  7 20:48:27 2024
  linka                              Dr        0  Mon Jul 24 21:49:46 2023
  foo                                 N        0  Fri Jun  7 20:48:27 2024
  bar                                 N        0  Fri Jun  7 20:48:27 2024

		220098560 blocks of size 1024. 50010836 blocks available
smb: \> cd linka
smb: \linka\> dir
  .                                   D        0  Fri Jun  7 20:48:27 2024
  ..                                  D        0  Fri Jun  7 20:48:27 2024
  linka                              Dr        0  Mon Jul 24 21:49:46 2023
  foo                                 N        0  Fri Jun  7 20:48:27 2024
  bar                                 N        0  Fri Jun  7 20:48:27 2024

		220098560 blocks of size 1024. 50010836 blocks available
smb: \linka\> cd linka
cd \linka\linka\: NT_STATUS_OBJECT_PATH_NOT_FOUND
smb: \linka\> 


In short I think (although related) these are different but separate problems (might be worth keeping them under the same bug, I dunno what is more effective or confusing)

The 'missing' dir entry in 4.19 is can be fixed by tweaking openat_pathref_fsp_nosymlink to return NT_STATUS_STOPPED_ON_SYMLINK when it encounters a dfs link (I have a hacky patch for this) which also seems to fix the entering into nested dfs link dir.

fixing the nested dfs entry on master might be a bit more problematic, the code has changed around this a bit I think and maybe posix stuff intersects too
Comment 27 Noel Power 2024-06-07 20:05:48 UTC
Created attachment 18331 [details]
start of extra patch for 4.19

This no doubt isn't correct, I spent enough time today poking around some of this code to realise I am not smart enough to understand the subtleties here. But it should at least give some ideas
Comment 28 Noel Power 2024-06-07 22:25:25 UTC
Created attachment 18332 [details]
start of extra patch for master

if the previous 4.19 patch is in the right direction then this might be a follow-up (but like I said, I really feel dumb about this stuff)
Comment 29 Jeremy Allison 2024-06-11 00:38:34 UTC
Noel, can you retest this with the patch being tested in:

https://gitlab.com/samba-team/devel/samba/-/pipelines/1326402431

please ? This is certainly in a related area.
Comment 30 Samba QA Contact 2024-06-11 19:32:04 UTC
This bug was referenced in samba master:

7f1de90f72d6e8287aec6ab1d9f7776b7df624e5
788ef8f07c75d5e6eca5b8f18d93d96f31574267
Comment 31 Noel Power 2024-06-12 10:03:27 UTC
Created attachment 18335 [details]
patch for 4.20

backport for 4.20 - minor change here due to different methods for reading symlink

NOTE: This patch should be applied *after* backport for bug #15662 (or there will be an unexpected failure in the tests)
Comment 32 Noel Power 2024-06-12 10:06:44 UTC
Created attachment 18336 [details]
backported patch for 4.19

backport for 4.19, a couple of more differences from master/4.20 backport. Differences are annotated at bottom of commits messages but in summary
a) knowfails are adjusted, test_ci_chdir doen't fail in 4.19 but test_enumerate_dfs_link does
b) In 4.19 vfs_widelink widelink_openat sets errno to ENOENT instead of ELOOP
Comment 33 Noel Power 2024-06-12 10:12:36 UTC
Created attachment 18337 [details]
backport for 4.18

backport for 4.18 (not sure if we are supporting that) but if not I think from a distro pov I will add it here

And there are some more changes again from 4.19 backport, again these are annotated at the end of the commit message

in summary

a) changes to knownfails for test, only test_nested_chdir fails in this release
b) modify existing code (that was already catering for ELOOP) to include ENOENT
Comment 34 John Michael Drescher 2024-06-13 20:50:27 UTC
I will try to test the patch / fixes in the next 2 weeks. I am busy on a project now but should have time soon.
Comment 35 Jeremy Allison 2024-06-17 17:37:38 UTC
Comment on attachment 18337 [details]
backport for 4.18

Not sure we need this one though.
Comment 36 Jeremy Allison 2024-06-17 17:39:48 UTC
Jule can you please add the 4.20.next and 4.19.next patches for the next releases please !

Thanks,

Jeremy.
Comment 37 Jule Anger 2024-06-18 07:28:30 UTC
Pushed to autobuild-v4-{20,19}-test.
Comment 38 Samba QA Contact 2024-06-18 08:34:21 UTC
This bug was referenced in samba v4-20-test:

4b4b0152fd7cce2923ffcfe04eb07de4cc8721d7
5b90acbef156174ea65014a298f926218a760c4e
Comment 39 Samba QA Contact 2024-06-19 14:36:08 UTC
This bug was referenced in samba v4-20-stable (Release samba-4.20.2):

4b4b0152fd7cce2923ffcfe04eb07de4cc8721d7
5b90acbef156174ea65014a298f926218a760c4e
Comment 40 Samba QA Contact 2024-07-03 09:57:21 UTC
This bug was referenced in samba v4-19-test:

6c86b5199366ab3b6b3e2f38937e0a79a34c2d84
dfa0b1adb872f9c34b6fb1f4f84a06f5dd6802bc
Comment 41 Jule Anger 2024-07-03 10:09:05 UTC
Closing out bug report.

Thanks!