1
0
mirror of https://github.com/samba-team/samba.git synced 2025-01-07 17:18:11 +03:00
Commit Graph

102746 Commits

Author SHA1 Message Date
Karolin Seeger
4a63ccda03 samba: tag release samba-4.4.13
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iD8DBQBY3fUrbzORW2Vot+oRAiBMAKCps2eH4Uq8bVlHYvx4vT3oZ+khagCffBtx
 jR3RIdqs+LrckT4z6f3DJQE=
 =AZ0w
 -----END PGP SIGNATURE-----

Merge tag 'samba-4.4.13' into v4-4-test

samba: tag release samba-4.4.13
2017-03-31 10:12:52 +02:00
Karolin Seeger
f4f7952b70 VERSION: Disable GIT_SNAPSHOTS for the 4.4.13 release.
Signed-off-by: Karolin Seeger <kseeger@samba.org>
2017-03-31 08:18:52 +02:00
Karolin Seeger
cc9aec72f5 WHATSNEW: Add release notes for Samba 4.4.13.
Signed-off-by: Karolin Seeger <kseeger@samba.org>
2017-03-31 08:18:30 +02:00
Jeremy Allison
818fb1a39c s3: Test for CVE-2017-2619 regression with "follow symlinks = no" - part 2
Add tests for regular access.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12721

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Tue Mar 28 17:05:27 CEST 2017 on sn-devel-144

(cherry picked from commit 4e734fcd1b)
2017-03-31 08:18:30 +02:00
Jeremy Allison
80b8fa0220 s3: smbd: Fix "follow symlink = no" regression part 2.
Use the cwd_name parameter to reconstruct the original
client name for symlink testing.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12721

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit e182a4d39e)
2017-03-31 08:18:30 +02:00
Jeremy Allison
de57712c46 s3: smbd: Fix "follow symlink = no" regression part 2.
Add an extra paramter to cwd_name to check_reduced_name().

If cwd_name == NULL then fname is a client given path relative
to the root path of the share.

If cwd_name != NULL then fname is a client given path relative
to cwd_name. cwd_name is relative to the root path of the share.

Not yet used, logic added in the next commit.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12721

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit 83e30cb488)
2017-03-31 08:18:29 +02:00
Jeremy Allison
ed50b9f43a s3: Fixup test for CVE-2017-2619 regression with "follow symlinks = no"
Use correct bash operators (not string operators).
Add missing "return".

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12721

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit 037297a1c5)
2017-03-31 08:18:29 +02:00
Jeremy Allison
75df72a0b6 s3: Test for CVE-2017-2619 regression with "follow symlinks = no".
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12721

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>

Back-ported from commit 782172a9be
2017-03-31 08:18:29 +02:00
Jeremy Allison
aff09ec04e s3: smbd: Fix incorrect logic exposed by fix for the security bug 12496 (CVE-2017-2619).
In a UNIX filesystem, the names "." and ".." by definition can *never*
be symlinks - they are already reserved names.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12721

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
(cherry picked from commit ae17bebd25)
2017-03-31 08:18:29 +02:00
Karolin Seeger
452d0dd843 VERSION: Re-enable GIT_SNAPSHOTS.
Signed-off-by: Karolin Seeger <kseeger@samba.org>
2017-03-31 08:18:29 +02:00
Jeremy Allison
0839f6c6f4 s3: Test for CVE-2017-2619 regression with "follow symlinks = no" - part 2
Add tests for regular access.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12721

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Tue Mar 28 17:05:27 CEST 2017 on sn-devel-144

(cherry picked from commit 4e734fcd1b)

Autobuild-User(v4-4-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-4-test): Wed Mar 29 13:57:56 CEST 2017 on sn-devel-144
2017-03-29 13:57:56 +02:00
Karolin Seeger
e2df6aa8ba VERSION: Bump version up to 4.4.13.
Signed-off-by: Karolin Seeger <kseeger@samba.org>
(cherry picked from commit 7086fb6a4d)
2017-03-29 11:01:56 +02:00
Jeremy Allison
ed694d0680 s3: smbd: Fix "follow symlink = no" regression part 2.
Use the cwd_name parameter to reconstruct the original
client name for symlink testing.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12721

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit e182a4d39e)
2017-03-29 10:24:14 +02:00
Jeremy Allison
8e3e969eed s3: smbd: Fix "follow symlink = no" regression part 2.
Add an extra paramter to cwd_name to check_reduced_name().

If cwd_name == NULL then fname is a client given path relative
to the root path of the share.

If cwd_name != NULL then fname is a client given path relative
to cwd_name. cwd_name is relative to the root path of the share.

Not yet used, logic added in the next commit.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12721

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit 83e30cb488)
2017-03-29 10:24:14 +02:00
Jeremy Allison
9a5be8b68b s3: Fixup test for CVE-2017-2619 regression with "follow symlinks = no"
Use correct bash operators (not string operators).
Add missing "return".

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12721

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit 037297a1c5)
2017-03-29 10:24:14 +02:00
Jeremy Allison
161a078f55 s3: Test for CVE-2017-2619 regression with "follow symlinks = no".
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12721

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>

Back-ported from commit 782172a9be
2017-03-29 10:24:14 +02:00
Jeremy Allison
4a6d828e8f s3: smbd: Fix incorrect logic exposed by fix for the security bug 12496 (CVE-2017-2619).
In a UNIX filesystem, the names "." and ".." by definition can *never*
be symlinks - they are already reserved names.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12721

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
(cherry picked from commit ae17bebd25)
2017-03-29 10:24:14 +02:00
Jeremy Allison
2e00feb278 s3: locking: Update oplock optimization for the leases era !
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12628

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Wed Mar 15 20:04:32 CET 2017 on sn-devel-144

(cherry picked from commit 1c4b15aa5f)

Autobuild-User(v4-4-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-4-test): Fri Mar 24 12:35:06 CET 2017 on sn-devel-144
2017-03-24 12:35:06 +01:00
Jeremy Allison
419f5cca88 s3: locking: Move two leases functions into a new file.
map_oplock_to_lease_type(), fsp_lease_type().

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12628

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(back ported from commit 125c78ad0b)
2017-03-24 08:54:23 +01:00
Karolin Seeger
7086fb6a4d VERSION: Bump version up to 4.4.13.
Signed-off-by: Karolin Seeger <kseeger@samba.org>
2017-03-23 10:19:07 +01:00
Karolin Seeger
f2ae4c7984 samba: tag release samba-4.4.12
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iD8DBQBY04N8bzORW2Vot+oRAtYcAJ0fK71YTWsyyBXyM/dWJ6lQi8XQnACeOZum
 JRlcRLhXCnNXZ47zSDHwTMU=
 =ag2T
 -----END PGP SIGNATURE-----

Merge tag 'samba-4.4.12' into v4-4-test

samba: tag release samba-4.4.12
2017-03-23 10:18:52 +01:00
Karolin Seeger
3f2864eb85 VERSION: Disable GIT_SNAPSHOTS for the 4.4.12 release
CVE-2017-2619: Symlink race allows access outside share definition.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12496

Signed-off-by: Karolin Seeger <kseeger@samba.org>
2017-03-23 09:11:40 +01:00
Karolin Seeger
df1ea2b051 WHATSNEW: Add release notes for Samba 4.4.12.
CVE-2017-2619: Symlink race allows access outside share definition.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12496

Signed-off-by: Karolin Seeger <kseeger@samba.org>
2017-03-23 09:11:34 +01:00
Jeremy Allison
9746c7e15a CVE-2017-2619: s3: smbd: Use the new non_widelink_open() function.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12496

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2017-03-22 10:45:17 +01:00
Jeremy Allison
a69b3e285a CVE-2017-2619: s3: smbd: Add the core functions to prevent symlink open races.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12496

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2017-03-22 10:45:17 +01:00
Jeremy Allison
299cbc73e0 CVE-2017-2619: s3: smbd: Move special handling of symlink errno's into a utility function.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12496

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2017-03-22 10:45:17 +01:00
Jeremy Allison
17b90d640a CVE-2017-2619: s3: smbd: Remove O_NOFOLLOW guards. We insist on O_NOFOLLOW existing.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12496

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2017-03-22 10:45:17 +01:00
Jeremy Allison
6165d9a015 CVE-2017-2619: s3: smbd: Correctly fallback to open_dir_safely if FDOPENDIR not supported on system.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12496

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2017-03-22 10:45:16 +01:00
Jeremy Allison
af839aeb5a CVE-2017-2619: s3: smbd: Move the reference counting and destructor setup to just before retuning success.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12496

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2017-03-22 10:45:16 +01:00
Jeremy Allison
5915e2af1a CVE-2017-2619: s3: smbd: OpenDir_fsp() - Fix memory leak on error.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12496

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2017-03-22 10:45:16 +01:00
Jeremy Allison
8d8205239b CVE-2017-2619: s3: smbd: OpenDir_fsp() use early returns.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12496

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2017-03-22 10:45:16 +01:00
Jeremy Allison
ab1851ea3b CVE-2017-2619: s3: smbd: Create and use open_dir_safely(). Use from OpenDir().
Hardens OpenDir against TOC/TOU races.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12496

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2017-03-22 10:45:16 +01:00
Jeremy Allison
9178d6d311 CVE-2017-2619: s3: smbd: Opendir_internal() early return if SMB_VFS_OPENDIR failed.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12496

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2017-03-22 10:45:16 +01:00
Jeremy Allison
203f454965 CVE-2017-2619: s3: smbd: Create wrapper function for OpenDir in preparation for making robust.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12496

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2017-03-22 10:45:15 +01:00
Ralph Boehme
8b56019147 CVE-2017-2619: s4/torture: add SMB2_FIND tests with SMB2_CONTINUE_FLAG_REOPEN flag
Bug: https://bugzilla.samba.org/show_bug.cgi?id=12496

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2017-03-22 10:45:15 +01:00
Ralph Boehme
d295ad1aaf CVE-2017-2619: s3/smbd: re-open directory after dptr_CloseDir()
dptr_CloseDir() will close and invalidate the fsp's file descriptor, we
have to reopen it.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12496

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
2017-03-22 10:45:15 +01:00
Karolin Seeger
2a6683c34a VERSION: Bump version up to Samba 4.4.12...
and re-enable GIT_SNAPSHOTS.

Signed-off-by: Karolin Seeger <kseeger@samba.org>
(cherry picked from commit ca33b7c71f)
2017-03-17 09:04:59 +01:00
Karolin Seeger
ca33b7c71f VERSION: Bump version up to Samba 4.4.12...
and re-enable GIT_SNAPSHOTS.

Signed-off-by: Karolin Seeger <kseeger@samba.org>
2017-03-16 08:50:19 +01:00
Karolin Seeger
fcdc0fa280 VERSION: Disable GIT_SNAPSHOTS for the Samba 4.4.11 release.
Signed-off-by: Karolin Seeger <kseeger@samba.org>
2017-03-16 08:50:18 +01:00
Karolin Seeger
c31433a9b0 WHATSNEW: Fix date.
Signed-off-by: Karolin Seeger <kseeger@samba.org>
2017-03-16 08:50:18 +01:00
Karolin Seeger
c248e53726 WHATSNEW: Add release notes for Samba 4.4.11.
Signed-off-by: Karolin Seeger <kseeger@samba.org>

Autobuild-User(v4-4-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-4-test): Tue Mar 14 16:30:22 CET 2017 on sn-devel-144
2017-03-14 16:30:22 +01:00
Ralph Boehme
699c336454 manpages/vfs_fruit: document global options
Some options MUST be set in the global section, better document that.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12615

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 0c212c50b5)
2017-03-14 12:49:24 +01:00
Ralph Boehme
23389b7b13 s4/torture: some tests for kernel oplocks
Bug: https://bugzilla.samba.org/show_bug.cgi?id=7537

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(backported from commit fd03420c4f)
2017-03-14 12:49:24 +01:00
Ralph Boehme
5c0b98801b s3/selftest: adopt config.h check from source4
No change in behaviour.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=7537

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(backported from commit 6e54d8d2bd)
2017-03-14 12:49:24 +01:00
Ralph Boehme
7e436a37b9 s3/smbd: fix deferred open with streams and kernel oplocks
I noticed smbd can get stuck in an open() call with kernel oplocks
enabled and named streams (provided by vfs_streams_xattr):

- client opens a file and with an exclusive oplock

- client starts writing to the file

- client opens an existing stream of the file

- the smbd process gets stuck in an open()

What happens is:

we had setup a locking.tdb record watch in defer_open(), the watch was
triggered, we reattempted the open and got stuck in a blocking open
because the oplock holder (ourselves) hadn't given up the oplock yet.

Cf e576bf5310 for the commit that added
the kernel oplock retry logic. tldr: with kernel oplocks the first open
is non-blocking, but the second one is blocking.

Detailed analysis follows.

When opening a named stream of a file, Samba internally opens the
underlying "base" file first. This internal open of the basefile suceeds
and does *not* trigger an oplock break (because it is an internal open
that doesn't call open() at all) but it is added as an entry to the
locking.tdb record of the file.

Next, the stream open ends up in streams_xattr where a non-blocking
open() on the base file is called. This open fails with EWOULDBLOCK
because we have another fd with a kernel oplock on the file.

So we call defer_open() which sets up a watch on the locking.tdb record.

In the subsequent error unwinding code in open_file_ntcreate() and
callers we close the internal open file handle of the basefile which
also removes the entry from the locking.tdb record and so *changes the
record*.

This fires the record watch and in the callback defer_open_done() we
don't check whether the condition (oplock gone) we're interested in is
actually met. The callback blindly reschedules the open request with
schedule_deferred_open_message_smb().

schedule_deferred_open_message_smb() schedules an immediate tevent event
which has precedence over the IPC fd events in messaging, so the open is
always (!) reattempted before processing the oplock break message.

As explained above, this second open will be a blocking one so we get
stuck in a blocking open.

It doesn't help to make all opens non-blocking, that would just result
in a busy loop failing the open, as we never process the oplock break
message (remember, schedule_deferred_open_message_smb() used immediate
tevent events).

To fix this we must add some logic to the record watch callback to check
whether the record watch was done for a kernel oplock file and if yes,
check if the oplock state changed. If not, simply reschedule the
deferred open and keep waiting.

This logic is only needed for kernel oplocks, not for Samba-level
oplocks, because there's no risk of deadlocking, the worst that can
happen is a rescheduled open that fails again in the oplock checks and
gets deferred again.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=7537

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(backported from commit b35a296a27)
2017-03-14 12:49:24 +01:00
Ralph Boehme
ec6794d270 s3/smbd: all callers of defer_open() pass a lck
No change in behaviour. Update the function comment explaining how it
works and relies on lck for a record watch.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=7537

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(backported from commit 1a6c82e5d5)
2017-03-14 12:49:24 +01:00
Ralph Boehme
9bbccbb1d2 s3/smbd: remove async_open arg from defer_open()
All remaining callers pass false.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=7537

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 7fa2f11594)
2017-03-14 12:49:24 +01:00
Ralph Boehme
5e94b38e14 s3/smbd: fix schedule_async_open() timer
schedule_async_open() was calling defer_open with sharemode lock = NULL,
as a result there was never an active 20 s timeout.

This has been broken since the commits in

$ git log --reverse -p -10 8283fd0e00

Just roll our own deferred record instead of calling defer_open() and
also set up timer that, as a last resort, catches stuck opens and just
exits for now.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=7537

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit ad8c36125f)
2017-03-14 12:49:24 +01:00
Ralph Boehme
621abab71f s3/smbd: add and use retry_open() instead of defer_open() in two places
Add a new function that does an immediate open rescheduling.

The first deferred open this commit changes was never scheduled, as the
scheduling relies on a timeout of the watch on the sharemode lock.

This has been broken since the commits in

$ git log --reverse -p -10 8283fd0e00

That patchset added the dbwrap watch record logic to defer_open() and
removed the timers.

I'm doing this mainly to untangle the defer_open() logic which is
complicated by the lck arg.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=7537

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit beaba62228)
2017-03-14 12:49:24 +01:00
Ralph Boehme
ad3217c9d9 s3/smbd: simplify defer_open()
Add a helper function deferred_open_record_create() that creates a
deferred_open_record and let all callers pass all needed arguments
individually.

While we're at it, enhance the debug message in defer_open() to print
all variables.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=7537

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit b17ff9b181)
2017-03-14 12:49:24 +01:00