sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2024-12-25 23:21:54 +03:00
Code
13d199bea0
samba-mirror/source3/script/tests/test_symlink_traversal_smb2.sh

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

383 lines
20 KiB
Bash
Raw Normal View History

CVE-2021-44141: s3: torture: Add samba3.blackbox.test_symlink_traversal.SMB2. Add to knownfail.d/symlink_traversal BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
2021-12-07 23:28:54 +03:00
#!/bin/sh
if [ $# -lt 7 ]; then
s3:tests: Reformat test_symlink_traversal_smb2.sh shfmt -f source3/script/| xargs shfmt -w -p -i 0 -fn Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-04-22 16:34:11 +03:00
cat <<EOF
CVE-2021-44141: s3: torture: Add samba3.blackbox.test_symlink_traversal.SMB2. Add to knownfail.d/symlink_traversal BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
2021-12-07 23:28:54 +03:00
Usage: test_symlink_traversal_smb2.sh SERVER SERVER_IP USERNAME PASSWORD LOCAL_PATH PREFIX SMBCLIENT
EOF
s3:tests: Reformat test_symlink_traversal_smb2.sh shfmt -f source3/script/| xargs shfmt -w -p -i 0 -fn Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-04-22 16:34:11 +03:00
exit 1
CVE-2021-44141: s3: torture: Add samba3.blackbox.test_symlink_traversal.SMB2. Add to knownfail.d/symlink_traversal BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
2021-12-07 23:28:54 +03:00
fi
SERVER="${1}"
SERVER_IP="${2}"
USERNAME="${3}"
PASSWORD="${4}"
LOCAL_PATH="${5}"
PREFIX="${6}"
SMBCLIENT="${7}"
SMBCLIENT="$VALGRIND ${SMBCLIENT}"
shift 6
incdir=$(dirname "$0")/../../../testprogs/blackbox
. "$incdir"/subunit.sh
failed=0
# Do not let deprecated option warnings muck this up
SAMBA_DEPRECATED_SUPPRESS=1
export SAMBA_DEPRECATED_SUPPRESS
# Define the test environment/filenames.
#
share_test_dir="$LOCAL_PATH"
#
# These files/directories will be created.
#
file_outside_share="/tmp/symlink_traverse_test_file.$$"
dir_outside_share="/tmp/symlink_traverse_test_dir.$$"
file_outside_share_noperms="/tmp/symlink_traverse_test_file_noperm.$$"
dir_outside_share_noperms="/tmp/symlink_traverse_test_dir_noperm.$$"
#
# These two objects do not exist.
#
file_outside_share_noexist="/tmp/symlink_traverse_test_noexist.$$"
dir_outside_share_noexist="/tmp/symlink_traverse_test_dir_noexist.$$"
#
# Cleanup function.
#
do_cleanup()
{
s3:tests: Reformat test_symlink_traversal_smb2.sh shfmt -f source3/script/| xargs shfmt -w -p -i 0 -fn Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-04-22 16:34:11 +03:00
(
#subshell.
cd "$share_test_dir" || return
s3:tests: add a lot more tests to test_symlink_traversal_smb2.sh We now also test more path components checking the difference between OBJECT_NAME_NOT_FOUND and OBJECT_PATH_NOT_FOUND. We also test with symlinks within the path instead of only checking symlinks as final path components (at least for the dirfsp part). This ensures the following commits won't introduce regressions when adding the openat2(RESOLVE_NO_SYMLINK) optimization. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
2022-08-12 20:07:39 +03:00
rm -f "symlink_to_dot"
s3:tests: Reformat test_symlink_traversal_smb2.sh shfmt -f source3/script/| xargs shfmt -w -p -i 0 -fn Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-04-22 16:34:11 +03:00
rm -f "file_exists"
s3:tests: add a lot more tests to test_symlink_traversal_smb2.sh We now also test more path components checking the difference between OBJECT_NAME_NOT_FOUND and OBJECT_PATH_NOT_FOUND. We also test with symlinks within the path instead of only checking symlinks as final path components (at least for the dirfsp part). This ensures the following commits won't introduce regressions when adding the openat2(RESOLVE_NO_SYMLINK) optimization. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
2022-08-12 20:07:39 +03:00
rm -f "symlink_to_file_exists"
rm -rf "dir_exists"
rm -f "symlink_to_dir_exists"
s3:tests: Reformat test_symlink_traversal_smb2.sh shfmt -f source3/script/| xargs shfmt -w -p -i 0 -fn Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-04-22 16:34:11 +03:00
rm -f "symlink_noexist"
rm -f "symlink_file_outside_share"
rm -f "symlink_file_outside_share_noexist"
rm -f "symlink_dir_outside_share"
rm -f "symlink_dir_outside_share_noexist"
rm -f "symlink_file_outside_share_noperms"
rm -f "symlink_dir_outside_share_noperms"
rm -rf "emptydir"
# Links inside share.
rm -f "symlink_file_inside_share_noperms"
rm -f "file_inside_share_noperms"
rm -f "symlink_dir_inside_share_noperms"
chmod 755 "dir_inside_share_noperms"
rm -rf "dir_inside_share_noperms"
)
rm -f "$file_outside_share"
rm -rf "$dir_outside_share"
rm -f "$file_outside_share_noperms"
rm -rf "$dir_outside_share_noperms"
CVE-2021-44141: s3: torture: Add samba3.blackbox.test_symlink_traversal.SMB2. Add to knownfail.d/symlink_traversal BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
2021-12-07 23:28:54 +03:00
}
#
# Ensure we start from a clean slate.
#
do_cleanup
#
# Create the test files/directories/symlinks.
#
# File/directory explicitly outside share.
touch "$file_outside_share"
mkdir "$dir_outside_share"
# File/directory explicitly outside share with permission denied.
touch "$file_outside_share_noperms"
chmod 0 "$file_outside_share_noperms"
mkdir "$dir_outside_share_noperms"
chmod 0 "$dir_outside_share_noperms"
#
# Create links to these objects inside the share definition.
(
s3:tests: Reformat test_symlink_traversal_smb2.sh shfmt -f source3/script/| xargs shfmt -w -p -i 0 -fn Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-04-22 16:34:11 +03:00
#subshell.
cd "$share_test_dir" || return
s3:tests: add a lot more tests to test_symlink_traversal_smb2.sh We now also test more path components checking the difference between OBJECT_NAME_NOT_FOUND and OBJECT_PATH_NOT_FOUND. We also test with symlinks within the path instead of only checking symlinks as final path components (at least for the dirfsp part). This ensures the following commits won't introduce regressions when adding the openat2(RESOLVE_NO_SYMLINK) optimization. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
2022-08-12 20:07:39 +03:00
ln -s "." "symlink_to_dot"
s3:tests: Reformat test_symlink_traversal_smb2.sh shfmt -f source3/script/| xargs shfmt -w -p -i 0 -fn Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-04-22 16:34:11 +03:00
touch "file_exists"
s3:tests: add a lot more tests to test_symlink_traversal_smb2.sh We now also test more path components checking the difference between OBJECT_NAME_NOT_FOUND and OBJECT_PATH_NOT_FOUND. We also test with symlinks within the path instead of only checking symlinks as final path components (at least for the dirfsp part). This ensures the following commits won't introduce regressions when adding the openat2(RESOLVE_NO_SYMLINK) optimization. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
2022-08-12 20:07:39 +03:00
ln -s "file_exists" "symlink_to_file_exists"
mkdir "dir_exists"
ln -s "dir_exists" "symlink_to_dir_exists"
touch "dir_exists/subfile_exists"
mkdir "dir_exists/subdir_exists"
s3:tests: Reformat test_symlink_traversal_smb2.sh shfmt -f source3/script/| xargs shfmt -w -p -i 0 -fn Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-04-22 16:34:11 +03:00
ln -s "noexist" "symlink_noexist"
ln -s "$file_outside_share" "symlink_file_outside_share"
ln -s "$file_outside_share_noexist" "symlink_file_outside_share_noexist"
ln -s "$dir_outside_share" "symlink_dir_outside_share"
ln -s "$dir_outside_share_noexist" "symlink_dir_outside_share_noexist"
ln -s "$file_outside_share_noperms" "symlink_file_outside_share_noperms"
ln -s "$dir_outside_share_noperms" "symlink_dir_outside_share_noperms"
#
# Create the identical symlink set underneath "emptydir"
mkdir "emptydir"
(
#subshell
cd "emptydir" || return
s3:tests: add a lot more tests to test_symlink_traversal_smb2.sh We now also test more path components checking the difference between OBJECT_NAME_NOT_FOUND and OBJECT_PATH_NOT_FOUND. We also test with symlinks within the path instead of only checking symlinks as final path components (at least for the dirfsp part). This ensures the following commits won't introduce regressions when adding the openat2(RESOLVE_NO_SYMLINK) optimization. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
2022-08-12 20:07:39 +03:00
ln -s "." "symlink_to_dot"
s3:tests: Reformat test_symlink_traversal_smb2.sh shfmt -f source3/script/| xargs shfmt -w -p -i 0 -fn Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-04-22 16:34:11 +03:00
touch "file_exists"
s3:tests: add a lot more tests to test_symlink_traversal_smb2.sh We now also test more path components checking the difference between OBJECT_NAME_NOT_FOUND and OBJECT_PATH_NOT_FOUND. We also test with symlinks within the path instead of only checking symlinks as final path components (at least for the dirfsp part). This ensures the following commits won't introduce regressions when adding the openat2(RESOLVE_NO_SYMLINK) optimization. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
2022-08-12 20:07:39 +03:00
ln -s "file_exists" "symlink_to_file_exists"
mkdir "dir_exists"
ln -s "dir_exists" "symlink_to_dir_exists"
touch "dir_exists/subfile_exists"
mkdir "dir_exists/subdir_exists"
s3:tests: Reformat test_symlink_traversal_smb2.sh shfmt -f source3/script/| xargs shfmt -w -p -i 0 -fn Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-04-22 16:34:11 +03:00
ln -s "noexist" "symlink_noexist"
ln -s "$file_outside_share" "symlink_file_outside_share"
ln -s "$file_outside_share_noexist" "symlink_file_outside_share_noexist"
ln -s "$dir_outside_share" "symlink_dir_outside_share"
ln -s "$dir_outside_share_noexist" "symlink_dir_outside_share_noexist"
ln -s "$file_outside_share_noperms" "symlink_file_outside_share_noperms"
ln -s "$dir_outside_share_noperms" "symlink_dir_outside_share_noperms"
)
#
# Create symlinks to access denied file and directory
# objects within the share
touch "file_inside_share_noperms"
chmod 0 "file_inside_share_noperms"
ln -s "file_inside_share_noperms" "symlink_file_inside_share_noperms"
mkdir "dir_inside_share_noperms"
touch "dir_inside_share_noperms/noperm_file_exists"
ln -s "dir_inside_share_noperms" "symlink_dir_inside_share_noperms"
s3:tests: add a lot more tests to test_symlink_traversal_smb2.sh We now also test more path components checking the difference between OBJECT_NAME_NOT_FOUND and OBJECT_PATH_NOT_FOUND. We also test with symlinks within the path instead of only checking symlinks as final path components (at least for the dirfsp part). This ensures the following commits won't introduce regressions when adding the openat2(RESOLVE_NO_SYMLINK) optimization. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
2022-08-12 20:07:39 +03:00
mkdir "dir_inside_share_noperms/noperm_subdir_exists"
touch "dir_inside_share_noperms/noperm_subdir_exists/noperm_subdir_file_exists"
s3:tests: Create test directory and file prior to revoking permissions If 'chmod 0' is performed first, then we won't have the required permissions for the subsequent 'mkdir' and 'touch', and they will fail. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org>
2022-08-25 04:56:47 +03:00
chmod 0 "dir_inside_share_noperms"
CVE-2022-3592 torture3: Show that our symlink traversal checks are insecure This test shows that we don't properly check whether symlink targets are inside the exported share. Linking to <share-root>a/etc makes us loop back into filename_convert_dirfsp_nosymlink() with /etc as a directory name. On Linux systems with openat2(RESOLVE_NO_SYMLINKS) we pass "/etc" directly into that call after some checks for "."/".." as invalid file name components. "/etc" is okay for openat2(), but this test must also succeed on systems without RESOLVE_NO_SYMLINKS (sn-devel-184 for example). On systems without RESOLVE_NO_SYMLINKS split up the path "/etc" into path components, in this case "" and "etc". So we pass "" down to openat(), which correctly fails with ENOENT. Summary: Only with RESOLVE_NO_SYMLINKS we're hit by bug 15207, and this test shows by expecting CONNECTION_DISCONNECTED that we violate the internal assumption of empty path components with an unexpected symlink target, making it testable on systems with and without RESOLVE_NO_SYMLINKS. Bug: https://bugzilla.samba.org/show_bug.cgi?id=15207 Signed-off-by: Volker Lendecke <vl@samba.org>
2022-10-15 15:09:55 +03:00
# Symlink pointing out of the share
ln -s "$share_test_dir"a"/etc" x
CVE-2021-44141: s3: torture: Add samba3.blackbox.test_symlink_traversal.SMB2. Add to knownfail.d/symlink_traversal BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
2021-12-07 23:28:54 +03:00
)
#
# smbclient function given command, path, expected error, and posix.
#
smbclient_expect_error()
{
s3:tests: Reformat test_symlink_traversal_smb2.sh shfmt -f source3/script/| xargs shfmt -w -p -i 0 -fn Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-04-22 16:34:11 +03:00
filecmd="$1"
filename1="$2"
filename2="$3"
expected_error="$4"
tmpfile=$PREFIX/smbclient_interactive_prompt_commands
cat >"$tmpfile" <<EOF
CVE-2021-44141: s3: torture: Add samba3.blackbox.test_symlink_traversal.SMB2. Add to knownfail.d/symlink_traversal BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
2021-12-07 23:28:54 +03:00
$filecmd $filename1 $filename2
quit
EOF
s3:tests: Reformat test_symlink_traversal_smb2.sh shfmt -f source3/script/| xargs shfmt -w -p -i 0 -fn Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-04-22 16:34:11 +03:00
cmd='CLI_FORCE_INTERACTIVE=yes $SMBCLIENT -U$USERNAME%$PASSWORD //$SERVER/local_symlinks -I$SERVER_IP < $tmpfile 2>&1'
eval echo "$cmd"
out=$(eval "$cmd")
ret=$?
rm -f "$tmpfile"
CVE-2021-44141: s3: torture: Add samba3.blackbox.test_symlink_traversal.SMB2. Add to knownfail.d/symlink_traversal BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
2021-12-07 23:28:54 +03:00
s3:tests: Reformat test_symlink_traversal_smb2.sh shfmt -f source3/script/| xargs shfmt -w -p -i 0 -fn Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-04-22 16:34:11 +03:00
if [ $ret != 0 ]; then
printf "%s\n" "$out"
printf "failed accessing local_symlinks with error %s\n" "$ret"
return 1
fi
CVE-2021-44141: s3: torture: Add samba3.blackbox.test_symlink_traversal.SMB2. Add to knownfail.d/symlink_traversal BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
2021-12-07 23:28:54 +03:00
s3:tests: Reformat test_symlink_traversal_smb2.sh shfmt -f source3/script/| xargs shfmt -w -p -i 0 -fn Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-04-22 16:34:11 +03:00
if [ "$expected_error" = "NT_STATUS_OK" ]; then
printf "%s" "$out" | grep -v "NT_STATUS_"
else
printf "%s" "$out" | grep "$expected_error"
fi
ret=$?
if [ $ret != 0 ]; then
printf "%s\n" "$out"
printf "failed - should get %s doing \"%s %s %s\"\n" "$expected_error" "$filecmd" "$filename1" "$filename2"
return 1
fi
CVE-2021-44141: s3: torture: Add samba3.blackbox.test_symlink_traversal.SMB2. Add to knownfail.d/symlink_traversal BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
2021-12-07 23:28:54 +03:00
}
#
# SMB2 tests.
#
test_symlink_traversal_SMB2_onename()
{
s3:tests: Reformat test_symlink_traversal_smb2.sh shfmt -f source3/script/| xargs shfmt -w -p -i 0 -fn Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-04-22 16:34:11 +03:00
name="$1"
do_rename="$2"
#
# get commands.
#
smbclient_expect_error "get" "$name" "" "NT_STATUS_OBJECT_NAME_NOT_FOUND" || return 1
smbclient_expect_error "get" "$name/noexist" "" "NT_STATUS_OBJECT_PATH_NOT_FOUND" || return 1
s3:tests: add a lot more tests to test_symlink_traversal_smb2.sh We now also test more path components checking the difference between OBJECT_NAME_NOT_FOUND and OBJECT_PATH_NOT_FOUND. We also test with symlinks within the path instead of only checking symlinks as final path components (at least for the dirfsp part). This ensures the following commits won't introduce regressions when adding the openat2(RESOLVE_NO_SYMLINK) optimization. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
2022-08-12 20:07:39 +03:00
smbclient_expect_error "get" "$name/noexistsdir/noexist" "" "NT_STATUS_OBJECT_PATH_NOT_FOUND" || return 1
s3:tests: Reformat test_symlink_traversal_smb2.sh shfmt -f source3/script/| xargs shfmt -w -p -i 0 -fn Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-04-22 16:34:11 +03:00
smbclient_expect_error "get" "$name/*" "" "NT_STATUS_OBJECT_NAME_INVALID" || return 1
smbclient_expect_error "get" "$name/*/noexist" "" "NT_STATUS_OBJECT_NAME_INVALID" || return 1
s3:tests: add a lot more tests to test_symlink_traversal_smb2.sh We now also test more path components checking the difference between OBJECT_NAME_NOT_FOUND and OBJECT_PATH_NOT_FOUND. We also test with symlinks within the path instead of only checking symlinks as final path components (at least for the dirfsp part). This ensures the following commits won't introduce regressions when adding the openat2(RESOLVE_NO_SYMLINK) optimization. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
2022-08-12 20:07:39 +03:00
smbclient_expect_error "get" "$name/*/noexistsdir/noexist" "" "NT_STATUS_OBJECT_NAME_INVALID" || return 1
s3:tests: Reformat test_symlink_traversal_smb2.sh shfmt -f source3/script/| xargs shfmt -w -p -i 0 -fn Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-04-22 16:34:11 +03:00
# Now in subdirectory emptydir
smbclient_expect_error "get" "emptydir/$name" "" "NT_STATUS_OBJECT_NAME_NOT_FOUND" || return 1
smbclient_expect_error "get" "emptydir/$name/noexist" "" "NT_STATUS_OBJECT_PATH_NOT_FOUND" || return 1
s3:tests: add a lot more tests to test_symlink_traversal_smb2.sh We now also test more path components checking the difference between OBJECT_NAME_NOT_FOUND and OBJECT_PATH_NOT_FOUND. We also test with symlinks within the path instead of only checking symlinks as final path components (at least for the dirfsp part). This ensures the following commits won't introduce regressions when adding the openat2(RESOLVE_NO_SYMLINK) optimization. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
2022-08-12 20:07:39 +03:00
smbclient_expect_error "get" "emptydir/$name/noexistsdir/noexist" "" "NT_STATUS_OBJECT_PATH_NOT_FOUND" || return 1
s3:tests: Reformat test_symlink_traversal_smb2.sh shfmt -f source3/script/| xargs shfmt -w -p -i 0 -fn Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-04-22 16:34:11 +03:00
smbclient_expect_error "get" "emptydir/$name/*" "" "NT_STATUS_OBJECT_NAME_INVALID" || return 1
smbclient_expect_error "get" "emptydir/$name/*/noexist" "" "NT_STATUS_OBJECT_NAME_INVALID" || return 1
s3:tests: add a lot more tests to test_symlink_traversal_smb2.sh We now also test more path components checking the difference between OBJECT_NAME_NOT_FOUND and OBJECT_PATH_NOT_FOUND. We also test with symlinks within the path instead of only checking symlinks as final path components (at least for the dirfsp part). This ensures the following commits won't introduce regressions when adding the openat2(RESOLVE_NO_SYMLINK) optimization. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
2022-08-12 20:07:39 +03:00
smbclient_expect_error "get" "emptydir/$name/*/noexistsdir/noexist" "" "NT_STATUS_OBJECT_NAME_INVALID" || return 1
s3:tests: Reformat test_symlink_traversal_smb2.sh shfmt -f source3/script/| xargs shfmt -w -p -i 0 -fn Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-04-22 16:34:11 +03:00
#
# ls commands.
#
smbclient_expect_error "ls" "$name" "" "NT_STATUS_NO_SUCH_FILE" || return 1
smbclient_expect_error "ls" "$name/noexist" "" "NT_STATUS_OBJECT_NAME_NOT_FOUND" || return 1
s3:tests: add a lot more tests to test_symlink_traversal_smb2.sh We now also test more path components checking the difference between OBJECT_NAME_NOT_FOUND and OBJECT_PATH_NOT_FOUND. We also test with symlinks within the path instead of only checking symlinks as final path components (at least for the dirfsp part). This ensures the following commits won't introduce regressions when adding the openat2(RESOLVE_NO_SYMLINK) optimization. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
2022-08-12 20:07:39 +03:00
smbclient_expect_error "ls" "$name/noexistsdir/noexist" "" "NT_STATUS_OBJECT_PATH_NOT_FOUND" || return 1
s3:tests: Reformat test_symlink_traversal_smb2.sh shfmt -f source3/script/| xargs shfmt -w -p -i 0 -fn Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-04-22 16:34:11 +03:00
smbclient_expect_error "ls" "$name/*" "" "NT_STATUS_OBJECT_NAME_NOT_FOUND" || return 1
smbclient_expect_error "ls" "$name/*/noexist" "" "NT_STATUS_OBJECT_NAME_INVALID" || return 1
s3:tests: add a lot more tests to test_symlink_traversal_smb2.sh We now also test more path components checking the difference between OBJECT_NAME_NOT_FOUND and OBJECT_PATH_NOT_FOUND. We also test with symlinks within the path instead of only checking symlinks as final path components (at least for the dirfsp part). This ensures the following commits won't introduce regressions when adding the openat2(RESOLVE_NO_SYMLINK) optimization. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
2022-08-12 20:07:39 +03:00
smbclient_expect_error "ls" "$name/*/noexistsdir/noexist" "" "NT_STATUS_OBJECT_NAME_INVALID" || return 1
s3:tests: Reformat test_symlink_traversal_smb2.sh shfmt -f source3/script/| xargs shfmt -w -p -i 0 -fn Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-04-22 16:34:11 +03:00
# Now in subdirectory emptydir
smbclient_expect_error "ls" "emptydir/$name" "" "NT_STATUS_NO_SUCH_FILE" || return 1
smbclient_expect_error "ls" "emptydir/$name/noexist" "" "NT_STATUS_OBJECT_NAME_NOT_FOUND" || return 1
s3:tests: add a lot more tests to test_symlink_traversal_smb2.sh We now also test more path components checking the difference between OBJECT_NAME_NOT_FOUND and OBJECT_PATH_NOT_FOUND. We also test with symlinks within the path instead of only checking symlinks as final path components (at least for the dirfsp part). This ensures the following commits won't introduce regressions when adding the openat2(RESOLVE_NO_SYMLINK) optimization. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
2022-08-12 20:07:39 +03:00
smbclient_expect_error "ls" "emptydir/$name/noexistsdir/noexist" "" "NT_STATUS_OBJECT_PATH_NOT_FOUND" || return 1
s3:tests: Reformat test_symlink_traversal_smb2.sh shfmt -f source3/script/| xargs shfmt -w -p -i 0 -fn Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-04-22 16:34:11 +03:00
smbclient_expect_error "ls" "emptydir/$name/*" "" "NT_STATUS_OBJECT_NAME_NOT_FOUND" || return 1
smbclient_expect_error "ls" "emptydir/$name/*/noexist" "" "NT_STATUS_OBJECT_NAME_INVALID" || return 1
s3:tests: add a lot more tests to test_symlink_traversal_smb2.sh We now also test more path components checking the difference between OBJECT_NAME_NOT_FOUND and OBJECT_PATH_NOT_FOUND. We also test with symlinks within the path instead of only checking symlinks as final path components (at least for the dirfsp part). This ensures the following commits won't introduce regressions when adding the openat2(RESOLVE_NO_SYMLINK) optimization. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
2022-08-12 20:07:39 +03:00
smbclient_expect_error "ls" "emptydir/$name/*/noexistsdir/noexist" "" "NT_STATUS_OBJECT_NAME_INVALID" || return 1
CVE-2021-44141: s3: torture: Add samba3.blackbox.test_symlink_traversal.SMB2. Add to knownfail.d/symlink_traversal BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
2021-12-07 23:28:54 +03:00
s3:tests: Reformat test_symlink_traversal_smb2.sh shfmt -f source3/script/| xargs shfmt -w -p -i 0 -fn Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-04-22 16:34:11 +03:00
#
# del commands.
# smbclient internally does a cli_list, so we expect similar errors.
#
smbclient_expect_error "del" "$name" "" "NT_STATUS_NO_SUCH_FILE" || return 1
smbclient_expect_error "del" "$name/noexist" "" "NT_STATUS_OBJECT_NAME_NOT_FOUND" || return 1
# Now in subdirectory emptydir
smbclient_expect_error "del" "emptydir/$name" "" "NT_STATUS_NO_SUCH_FILE" || return 1
smbclient_expect_error "del" "emptydir/$name/noexist" "" "NT_STATUS_OBJECT_NAME_NOT_FOUND" || return 1
CVE-2021-44141: s3: torture: Add samba3.blackbox.test_symlink_traversal.SMB2. Add to knownfail.d/symlink_traversal BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
2021-12-07 23:28:54 +03:00
s3:tests: Reformat test_symlink_traversal_smb2.sh shfmt -f source3/script/| xargs shfmt -w -p -i 0 -fn Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-04-22 16:34:11 +03:00
if [ "$do_rename" = "do rename" ]; then
#
# rename commands.
#
CVE-2021-44141: s3: torture: Add samba3.blackbox.test_symlink_traversal.SMB2. Add to knownfail.d/symlink_traversal BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
2021-12-07 23:28:54 +03:00
smbclient_expect_error "rename" "file_exists" "$name" "NT_STATUS_OBJECT_NAME_NOT_FOUND" || return 1
smbclient_expect_error "rename" "file_exists" "$name/noexist" "NT_STATUS_OBJECT_PATH_NOT_FOUND" || return 1
s3:tests: add a lot more tests to test_symlink_traversal_smb2.sh We now also test more path components checking the difference between OBJECT_NAME_NOT_FOUND and OBJECT_PATH_NOT_FOUND. We also test with symlinks within the path instead of only checking symlinks as final path components (at least for the dirfsp part). This ensures the following commits won't introduce regressions when adding the openat2(RESOLVE_NO_SYMLINK) optimization. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
2022-08-12 20:07:39 +03:00
smbclient_expect_error "rename" "symlink_to_file_exists" "$name" "NT_STATUS_OBJECT_NAME_NOT_FOUND" || return 1
smbclient_expect_error "rename" "symlink_to_file_exists" "$name/noexist" "NT_STATUS_OBJECT_PATH_NOT_FOUND" || return 1
smbclient_expect_error "rename" "dir_exists" "$name" "NT_STATUS_OBJECT_NAME_NOT_FOUND" || return 1
smbclient_expect_error "rename" "dir_exists" "$name/noexist" "NT_STATUS_OBJECT_PATH_NOT_FOUND" || return 1
smbclient_expect_error "rename" "symlink_to_dir_exists" "$name" "NT_STATUS_OBJECT_NAME_NOT_FOUND" || return 1
smbclient_expect_error "rename" "symlink_to_dir_exists" "$name/noexist" "NT_STATUS_OBJECT_PATH_NOT_FOUND" || return 1
s3:tests: Reformat test_symlink_traversal_smb2.sh shfmt -f source3/script/| xargs shfmt -w -p -i 0 -fn Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-04-22 16:34:11 +03:00
# Now in subdirectory emptydir
CVE-2021-44141: s3: torture: Add samba3.blackbox.test_symlink_traversal.SMB2. Add to knownfail.d/symlink_traversal BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
2021-12-07 23:28:54 +03:00
smbclient_expect_error "rename" "file_exists" "emptydir/$name" "NT_STATUS_OBJECT_NAME_NOT_FOUND" || return 1
smbclient_expect_error "rename" "file_exists" "emptydir/$name/noexist" "NT_STATUS_OBJECT_PATH_NOT_FOUND" || return 1
s3:tests: add a lot more tests to test_symlink_traversal_smb2.sh We now also test more path components checking the difference between OBJECT_NAME_NOT_FOUND and OBJECT_PATH_NOT_FOUND. We also test with symlinks within the path instead of only checking symlinks as final path components (at least for the dirfsp part). This ensures the following commits won't introduce regressions when adding the openat2(RESOLVE_NO_SYMLINK) optimization. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
2022-08-12 20:07:39 +03:00
smbclient_expect_error "rename" "symlink_to_file_exists" "emptydir/$name" "NT_STATUS_OBJECT_NAME_NOT_FOUND" || return 1
smbclient_expect_error "rename" "symlink_to_file_exists" "emptydir/$name/noexist" "NT_STATUS_OBJECT_PATH_NOT_FOUND" || return 1
smbclient_expect_error "rename" "dir_exists" "emptydir/$name" "NT_STATUS_OBJECT_NAME_NOT_FOUND" || return 1
smbclient_expect_error "rename" "dir_exists" "emptydir/$name/noexist" "NT_STATUS_OBJECT_PATH_NOT_FOUND" || return 1
smbclient_expect_error "rename" "symlink_to_dir_exists" "emptydir/$name" "NT_STATUS_OBJECT_NAME_NOT_FOUND" || return 1
smbclient_expect_error "rename" "symlink_to_dir_exists" "emptydir/$name/noexist" "NT_STATUS_OBJECT_PATH_NOT_FOUND" || return 1
s3:tests: Reformat test_symlink_traversal_smb2.sh shfmt -f source3/script/| xargs shfmt -w -p -i 0 -fn Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-04-22 16:34:11 +03:00
fi
return 0
CVE-2021-44141: s3: torture: Add samba3.blackbox.test_symlink_traversal.SMB2. Add to knownfail.d/symlink_traversal BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
2021-12-07 23:28:54 +03:00
}
#
# Check error code returns traversing through different
# kinds of symlinks over SMB2.
#
test_symlink_traversal_SMB2()
{
test_symlink_traversal_SMB2_onename "symlink_noexist" "no rename" || return 1
test_symlink_traversal_SMB2_onename "symlink_file_outside_share" "do rename" || return 1
test_symlink_traversal_SMB2_onename "symlink_dir_outside_share" "do rename" || return 1
test_symlink_traversal_SMB2_onename "symlink_dir_outside_share_noexist" "no rename" || return 1
test_symlink_traversal_SMB2_onename "symlink_file_outside_share_noperms" "do rename" || return 1
test_symlink_traversal_SMB2_onename "symlink_dir_outside_share_noperms" "do rename" || return 1
s3:tests: add a lot more tests to test_symlink_traversal_smb2.sh We now also test more path components checking the difference between OBJECT_NAME_NOT_FOUND and OBJECT_PATH_NOT_FOUND. We also test with symlinks within the path instead of only checking symlinks as final path components (at least for the dirfsp part). This ensures the following commits won't introduce regressions when adding the openat2(RESOLVE_NO_SYMLINK) optimization. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
2022-08-12 20:07:39 +03:00
# Note the share has 'follow symlinks = yes'
smbclient_expect_error "ls" "." "" "NT_STATUS_NO_SUCH_FILE" || return 1
smbclient_expect_error "ls" "noexist1" "" "NT_STATUS_NO_SUCH_FILE" || return 1
smbclient_expect_error "ls" "noexist1/noexist2" "" "NT_STATUS_OBJECT_NAME_NOT_FOUND" || return 1
smbclient_expect_error "ls" "noexist1/noexist2/noexist3" "" "NT_STATUS_OBJECT_PATH_NOT_FOUND" || return 1
smbclient_expect_error "ls" "symlink_to_dot" "" "NT_STATUS_OK" || return 1
smbclient_expect_error "ls" "symlink_to_dot/noexist1" "" "NT_STATUS_NO_SUCH_FILE" || return 1
smbclient_expect_error "ls" "symlink_to_dot/noexist1/noexist2" "" "NT_STATUS_OBJECT_NAME_NOT_FOUND" || return 1
smbclient_expect_error "ls" "symlink_to_dot/noexist1/noexist2/noexist3" "" "NT_STATUS_OBJECT_PATH_NOT_FOUND" || return 1
smbclient_expect_error "ls" "file_exists" "" "NT_STATUS_OK" || return 1
smbclient_expect_error "ls" "file_exists/noexist1" "" "NT_STATUS_NOT_A_DIRECTORY" || return 1
smbclient_expect_error "ls" "file_exists/noexist1/noexist2" "" "NT_STATUS_OBJECT_PATH_NOT_FOUND" || return 1
smbclient_expect_error "ls" "file_exists/noexist1/noexist2/noexist3" "" "NT_STATUS_OBJECT_PATH_NOT_FOUND" || return 1
smbclient_expect_error "ls" "symlink_to_file_exists" "" "NT_STATUS_OK" || return 1
smbclient_expect_error "ls" "symlink_to_file_exists/noexist1" "" "NT_STATUS_NOT_A_DIRECTORY" || return 1
smbclient_expect_error "ls" "symlink_to_file_exists/noexist1/noexist2" "" "NT_STATUS_OBJECT_PATH_NOT_FOUND" || return 1
smbclient_expect_error "ls" "symlink_to_file_exists/noexist1/noexist2/noexist" "" "NT_STATUS_OBJECT_PATH_NOT_FOUND" || return 1
smbclient_expect_error "ls" "dir_exists" "" "NT_STATUS_OK" || return 1
smbclient_expect_error "ls" "dir_exists/noexist1" "" "NT_STATUS_NO_SUCH_FILE" || return 1
smbclient_expect_error "ls" "dir_exists/noexist1/noexist2" "" "NT_STATUS_OBJECT_NAME_NOT_FOUND" || return 1
smbclient_expect_error "ls" "dir_exists/noexist1/noexist2/noexist3" "" "NT_STATUS_OBJECT_PATH_NOT_FOUND" || return 1
smbclient_expect_error "ls" "dir_exists/subfile_exists" "" "NT_STATUS_OK" || return 1
smbclient_expect_error "ls" "dir_exists/subfile_exists/noexist1" "" "NT_STATUS_NOT_A_DIRECTORY" || return 1
smbclient_expect_error "ls" "dir_exists/subfile_exists/noexist1/noexist2" "" "NT_STATUS_OBJECT_PATH_NOT_FOUND" || return 1
smbclient_expect_error "ls" "dir_exists/subfile_exists/noexist1/noexist2/noexist3" "" "NT_STATUS_OBJECT_PATH_NOT_FOUND" || return 1
smbclient_expect_error "ls" "dir_exists/subdir_exists" "" "NT_STATUS_OK" || return 1
smbclient_expect_error "ls" "dir_exists/subdir_exists/noexist1" "" "NT_STATUS_NO_SUCH_FILE" || return 1
smbclient_expect_error "ls" "dir_exists/subdir_exists/noexist1/noexist2" "" "NT_STATUS_OBJECT_NAME_NOT_FOUND" || return 1
smbclient_expect_error "ls" "dir_exists/subdir_exists/noexist1/noexist2/noexist3" "" "NT_STATUS_OBJECT_PATH_NOT_FOUND" || return 1
smbclient_expect_error "ls" "symlink_to_dir_exists" "" "NT_STATUS_OK" || return 1
smbclient_expect_error "ls" "symlink_to_dir_exists/noexist1" "" "NT_STATUS_NO_SUCH_FILE" || return 1
smbclient_expect_error "ls" "symlink_to_dir_exists/noexist1/noexist2" "" "NT_STATUS_OBJECT_NAME_NOT_FOUND" || return 1
smbclient_expect_error "ls" "symlink_to_dir_exists/noexist1/noexist2/noexist3" "" "NT_STATUS_OBJECT_PATH_NOT_FOUND" || return 1
smbclient_expect_error "ls" "symlink_to_dir_exists/subfile_exists" "" "NT_STATUS_OK" || return 1
smbclient_expect_error "ls" "symlink_to_dir_exists/subfile_exists/noexist1" "" "NT_STATUS_NOT_A_DIRECTORY" || return 1
smbclient_expect_error "ls" "symlink_to_dir_exists/subfile_exists/noexist1/noexist2" "" "NT_STATUS_OBJECT_PATH_NOT_FOUND" || return 1
smbclient_expect_error "ls" "symlink_to_dir_exists/subfile_exists/noexist1/noexist2/noexist3" "" "NT_STATUS_OBJECT_PATH_NOT_FOUND" || return 1
smbclient_expect_error "ls" "symlink_to_dir_exists/subdir_exists" "" "NT_STATUS_OK" || return 1
smbclient_expect_error "ls" "symlink_to_dir_exists/subdir_exists/noexist1" "" "NT_STATUS_NO_SUCH_FILE" || return 1
smbclient_expect_error "ls" "symlink_to_dir_exists/subdir_exists/noexist1/noexist2" "" "NT_STATUS_OBJECT_NAME_NOT_FOUND" || return 1
smbclient_expect_error "ls" "symlink_to_dir_exists/subdir_exists/noexist1/noexist2/noexist3" "" "NT_STATUS_OBJECT_PATH_NOT_FOUND" || return 1
smbclient_expect_error "get" "." "" "NT_STATUS_OBJECT_NAME_INVALID" || return 1
smbclient_expect_error "get" "noexist1" "" "NT_STATUS_OBJECT_NAME_NOT_FOUND" || return 1
smbclient_expect_error "get" "noexist1/noexist2" "" "NT_STATUS_OBJECT_PATH_NOT_FOUND" || return 1
smbclient_expect_error "get" "symlink_to_dot" "" "NT_STATUS_FILE_IS_A_DIRECTORY" || return 1
smbclient_expect_error "get" "symlink_to_dot/noexist1" "" "NT_STATUS_OBJECT_NAME_NOT_FOUND" || return 1
smbclient_expect_error "get" "symlink_to_dot/noexist1/noexist2" "" "NT_STATUS_OBJECT_PATH_NOT_FOUND" || return 1
s3:tests: Transfer test files into temporary directory The presence of these two files is causing 'check-clean-tree' to fail. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Thu Aug 25 17:56:31 UTC 2022 on sn-devel-184
2022-08-25 05:03:17 +03:00
smbclient_expect_error "get" "file_exists" "$dir_outside_share/file_exists" "NT_STATUS_OK" || return 1
s3:tests: add a lot more tests to test_symlink_traversal_smb2.sh We now also test more path components checking the difference between OBJECT_NAME_NOT_FOUND and OBJECT_PATH_NOT_FOUND. We also test with symlinks within the path instead of only checking symlinks as final path components (at least for the dirfsp part). This ensures the following commits won't introduce regressions when adding the openat2(RESOLVE_NO_SYMLINK) optimization. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
2022-08-12 20:07:39 +03:00
smbclient_expect_error "get" "file_exists/noexist1" "" "NT_STATUS_OBJECT_PATH_NOT_FOUND" || return 1
smbclient_expect_error "get" "file_exists/noexist1/noexist2" "" "NT_STATUS_OBJECT_PATH_NOT_FOUND" || return 1
s3:tests: Transfer test files into temporary directory The presence of these two files is causing 'check-clean-tree' to fail. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Thu Aug 25 17:56:31 UTC 2022 on sn-devel-184
2022-08-25 05:03:17 +03:00
smbclient_expect_error "get" "symlink_to_file_exists" "$dir_outside_share/symlink_to_file_exists" "NT_STATUS_OK" || return 1
s3:tests: add a lot more tests to test_symlink_traversal_smb2.sh We now also test more path components checking the difference between OBJECT_NAME_NOT_FOUND and OBJECT_PATH_NOT_FOUND. We also test with symlinks within the path instead of only checking symlinks as final path components (at least for the dirfsp part). This ensures the following commits won't introduce regressions when adding the openat2(RESOLVE_NO_SYMLINK) optimization. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
2022-08-12 20:07:39 +03:00
smbclient_expect_error "get" "symlink_to_file_exists/noexist1" "" "NT_STATUS_OBJECT_PATH_NOT_FOUND" || return 1
smbclient_expect_error "get" "symlink_to_file_exists/noexist1/noexist2" "" "NT_STATUS_OBJECT_PATH_NOT_FOUND" || return 1
smbclient_expect_error "get" "dir_exists" "" "NT_STATUS_FILE_IS_A_DIRECTORY" || return 1
smbclient_expect_error "get" "dir_exists/noexist1" "" "NT_STATUS_OBJECT_NAME_NOT_FOUND" || return 1
smbclient_expect_error "get" "dir_exists/noexist1/noexist2" "" "NT_STATUS_OBJECT_PATH_NOT_FOUND" || return 1
smbclient_expect_error "get" "dir_exists/subfile_exists" "" "NT_STATUS_OK" || return 1
smbclient_expect_error "get" "dir_exists/subfile_exists/noexist1" "" "NT_STATUS_OBJECT_PATH_NOT_FOUND" || return 1
smbclient_expect_error "get" "dir_exists/subfile_exists/noexist1/noexist2" "" "NT_STATUS_OBJECT_PATH_NOT_FOUND" || return 1
smbclient_expect_error "get" "dir_exists/subdir_exists" "" "NT_STATUS_FILE_IS_A_DIRECTORY" || return 1
smbclient_expect_error "get" "dir_exists/subdir_exists/noexist1" "" "NT_STATUS_OBJECT_NAME_NOT_FOUND" || return 1
smbclient_expect_error "get" "dir_exists/subdir_exists/noexist1/noexist2" "" "NT_STATUS_OBJECT_PATH_NOT_FOUND" || return 1
smbclient_expect_error "get" "symlink_to_dir_exists" "" "NT_STATUS_FILE_IS_A_DIRECTORY" || return 1
smbclient_expect_error "get" "symlink_to_dir_exists/noexist1" "" "NT_STATUS_OBJECT_NAME_NOT_FOUND" || return 1
smbclient_expect_error "get" "symlink_to_dir_exists/noexist1/noexist2" "" "NT_STATUS_OBJECT_PATH_NOT_FOUND" || return 1
smbclient_expect_error "get" "symlink_to_dir_exists/subfile_exists" "" "NT_STATUS_OK" || return 1
smbclient_expect_error "get" "symlink_to_dir_exists/subfile_exists/noexist1" "" "NT_STATUS_OBJECT_PATH_NOT_FOUND" || return 1
smbclient_expect_error "get" "symlink_to_dir_exists/subfile_exists/noexist1/noexist2" "" "NT_STATUS_OBJECT_PATH_NOT_FOUND" || return 1
smbclient_expect_error "get" "symlink_to_dir_exists/subdir_exists" "" "NT_STATUS_FILE_IS_A_DIRECTORY" || return 1
smbclient_expect_error "get" "symlink_to_dir_exists/subdir_exists/noexist1" "" "NT_STATUS_OBJECT_NAME_NOT_FOUND" || return 1
smbclient_expect_error "get" "symlink_to_dir_exists/subdir_exists/noexist1/noexist2" "" "NT_STATUS_OBJECT_PATH_NOT_FOUND" || return 1
CVE-2022-3592 smbd: Slightly simplify filename_convert_dirfsp() subdir_of() calculates the share-relative rest for us, don't do the strlen(connectpath) calculation twice. subdir_of() also checks that the target properly ends on a directory. With just strncmp a symlink to x->/aa/etc would qualify as in share /a, so a "get x/passwd" leads to a pretty unfortunate result. This is the proper fix for bug 15207, so we need to change the expected error code to OBJECT_PATH_NOT_FOUND Bug: https://bugzilla.samba.org/show_bug.cgi?id=15207 Signed-off-by: Volker Lendecke <vl@samba.org> Autobuild-User(master): Jule Anger <janger@samba.org> Autobuild-Date(master): Tue Oct 25 11:27:02 UTC 2022 on sn-devel-184
2022-10-15 14:37:17 +03:00
smbclient_expect_error "get" "x/passwd" "passwd" "NT_STATUS_OBJECT_PATH_NOT_FOUND" || return 1
s3:tests: add a lot more tests to test_symlink_traversal_smb2.sh We now also test more path components checking the difference between OBJECT_NAME_NOT_FOUND and OBJECT_PATH_NOT_FOUND. We also test with symlinks within the path instead of only checking symlinks as final path components (at least for the dirfsp part). This ensures the following commits won't introduce regressions when adding the openat2(RESOLVE_NO_SYMLINK) optimization. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
2022-08-12 20:07:39 +03:00
s3:tests: Reformat test_symlink_traversal_smb2.sh shfmt -f source3/script/| xargs shfmt -w -p -i 0 -fn Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-04-22 16:34:11 +03:00
#
# Test paths within share with no permissions.
#
# Can't 'get' file with no perms or a symlink to it.
CVE-2021-44141: s3: torture: Add samba3.blackbox.test_symlink_traversal.SMB2. Add to knownfail.d/symlink_traversal BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
2021-12-07 23:28:54 +03:00
smbclient_expect_error "get" "file_inside_share_noperms" "" "NT_STATUS_ACCESS_DENIED" || return 1
smbclient_expect_error "get" "symlink_file_inside_share_noperms" "" "NT_STATUS_ACCESS_DENIED" || return 1
s3:tests: Reformat test_symlink_traversal_smb2.sh shfmt -f source3/script/| xargs shfmt -w -p -i 0 -fn Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-04-22 16:34:11 +03:00
# But can list it and the symlink to it.
CVE-2021-44141: s3: torture: Add samba3.blackbox.test_symlink_traversal.SMB2. Add to knownfail.d/symlink_traversal BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
2021-12-07 23:28:54 +03:00
smbclient_expect_error "ls" "file_inside_share_noperms" "" "NT_STATUS_OK" || return 1
smbclient_expect_error "ls" "symlink_file_inside_share_noperms" "" "NT_STATUS_OK" || return 1
s3:tests: Reformat test_symlink_traversal_smb2.sh shfmt -f source3/script/| xargs shfmt -w -p -i 0 -fn Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-04-22 16:34:11 +03:00
# Can't 'get' file inside a directory with no perms or a symlink to it.
CVE-2021-44141: s3: torture: Add samba3.blackbox.test_symlink_traversal.SMB2. Add to knownfail.d/symlink_traversal BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
2021-12-07 23:28:54 +03:00
smbclient_expect_error "get" "dir_inside_share_noperms/noperm_file_exists" "" "NT_STATUS_ACCESS_DENIED" || return 1
smbclient_expect_error "get" "symlink_dir_inside_share_noperms/noperm_file_exists" "" "NT_STATUS_ACCESS_DENIED" || return 1
s3:tests: Reformat test_symlink_traversal_smb2.sh shfmt -f source3/script/| xargs shfmt -w -p -i 0 -fn Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-04-22 16:34:11 +03:00
# But can list the directory with no perms and the symlink to it.
CVE-2021-44141: s3: torture: Add samba3.blackbox.test_symlink_traversal.SMB2. Add to knownfail.d/symlink_traversal BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
2021-12-07 23:28:54 +03:00
smbclient_expect_error "ls" "dir_inside_share_noperms" "" "NT_STATUS_OK" || return 1
smbclient_expect_error "ls" "symlink_dir_inside_share_noperms" "" "NT_STATUS_OK" || return 1
s3:tests: add a lot more tests to test_symlink_traversal_smb2.sh We now also test more path components checking the difference between OBJECT_NAME_NOT_FOUND and OBJECT_PATH_NOT_FOUND. We also test with symlinks within the path instead of only checking symlinks as final path components (at least for the dirfsp part). This ensures the following commits won't introduce regressions when adding the openat2(RESOLVE_NO_SYMLINK) optimization. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
2022-08-12 20:07:39 +03:00
# Check that 'get' on non existing subpaths also returns NT_STATUS_ACCESS_DENIED
smbclient_expect_error "get" "symlink_dir_inside_share_noperms/noperm_file_exists/_none_" "" "NT_STATUS_ACCESS_DENIED" || return 1
smbclient_expect_error "get" "symlink_dir_inside_share_noperms/noperm_subdir_exists/noperm_subdir_file_exists" "" "NT_STATUS_ACCESS_DENIED" || return 1
smbclient_expect_error "get" "symlink_dir_inside_share_noperms/noperm_subdir_exists/noperm_subdir_file_exists/_none_" "" "NT_STATUS_ACCESS_DENIED" || return 1
CVE-2021-44141: s3: torture: Add samba3.blackbox.test_symlink_traversal.SMB2. Add to knownfail.d/symlink_traversal BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
2021-12-07 23:28:54 +03:00
}
testit "symlink_traversal_SMB2" \
s3:tests: Reformat test_symlink_traversal_smb2.sh shfmt -f source3/script/| xargs shfmt -w -p -i 0 -fn Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-04-22 16:34:11 +03:00
test_symlink_traversal_SMB2 ||
failed=$((failed + 1))
CVE-2021-44141: s3: torture: Add samba3.blackbox.test_symlink_traversal.SMB2. Add to knownfail.d/symlink_traversal BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
2021-12-07 23:28:54 +03:00
#
# Cleanup.
do_cleanup
testok "$0" "$failed"
Copy Permalink