sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-08 21:18:16 +03:00
Code

CVE-2021-44141: s3: smbd: For SMB1+POSIX clients trying to open a symlink, always return NT_STATUS_OBJECT_NAME_NOT_FOUND.

Browse Source 
Matches the error return from openat_pathref_fsp().

NT_STATUS_OBJECT_PATH_NOT_FOUND is for a bad component in a path, not
a bad terminal symlink.

Remove knownfail.d/simple_posix_open, we now pass.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911

Signed-off-by: Jeremy Allison <jra@samba.org>
This commit is contained in:
Jeremy Allison 2021-12-07 11:44:09 -08:00 committed by Stefan Metzmacher
parent b8da8b7220
commit 4106af6d62
2 changed files with 6 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
selftest/knownfail.d/simple_posix_open
View File

@ -1 +0,0 @@
^samba3.smbtorture_s3.plain.POSIX.smbtorture\(.*\)

13
source3/smbd/open.c
View File

@ -1443,12 +1443,10 @@ static NTSTATUS open_file(files_struct *fsp,
* POSIX client that hit a symlink. We don't want to
* return NT_STATUS_STOPPED_ON_SYMLINK to avoid handling
* this special error code in all callers, so we map
* this to NT_STATUS_OBJECT_PATH_NOT_FOUND. Historically
* the lower level functions returned status code mapped
* from errno by map_nt_error_from_unix() where ELOOP is
* mapped to NT_STATUS_OBJECT_PATH_NOT_FOUND.
* this to NT_STATUS_OBJECT_NAME_NOT_FOUND to match
* openat_pathref_fsp().
*/
status = NT_STATUS_OBJECT_PATH_NOT_FOUND;
status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
}
if (!NT_STATUS_IS_OK(status)) {
DEBUG(3,("Error opening file %s (%s) (local_flags=%d) "
@ -1531,9 +1529,10 @@ static NTSTATUS open_file(files_struct *fsp,
{
/*
* Don't allow stat opens on symlinks directly unless
* it's a POSIX open.
* it's a POSIX open. Match the return code from
* openat_pathref_fsp().
*/
return NT_STATUS_OBJECT_PATH_NOT_FOUND;
return NT_STATUS_OBJECT_NAME_NOT_FOUND;
}
if (!fsp->fsp_flags.is_pathref) {