1
0
mirror of https://github.com/samba-team/samba.git synced 2025-02-04 17:47:26 +03:00

9716 Commits

Author SHA1 Message Date
Stefan Metzmacher
509113fcff CVE-2019-10197: smbd: make sure we reset current_user.{need,done}_chdir in become_root()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14035

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2019-09-03 08:07:38 +00:00
Stefan Metzmacher
6fae81312f CVE-2019-10197: smbd: make sure that change_to_user_internal() always resets current_user.done_chdir
We should not leave current_user.done_chdir as true if we didn't call
chdir_current_service() with success.

This caused problems in when calling vfs_ChDir() in pop_conn_ctx() when
chdir_current_service() worked once on one share but later failed on another
share.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14035

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2019-09-03 08:07:37 +00:00
Jeremy Allison
e48c118969 CVE-2019-10197: smbd: separate out impersonation debug info into a new function.
Will be called on elsewhere on successful impersonation.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14035

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2019-09-03 08:07:37 +00:00
Mathieu Parent
549a4a82e0 Spelling fixes s/preceeding/preceding/
Signed-off-by: Mathieu Parent <math.parent@gmail.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2019-09-01 22:21:28 +00:00
Mathieu Parent
105bb06318 Spelling fixes s/withing/within/
Signed-off-by: Mathieu Parent <math.parent@gmail.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2019-09-01 22:21:28 +00:00
Andreas Schneider
2ee1764ca8 s3:smbd: Prefer AES-GCM over AES-CCM with GnuTLS
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Adapted to remove Samba AES support

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2019-08-27 04:44:41 +00:00
Andreas Schneider
eb65fe5505 libcli:smb: Use smb2_signing_key in smb2_signing_encrypt_pdu()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Adaped to remove Samba AES support

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2019-08-27 04:44:41 +00:00
Andreas Schneider
7f56e91dbe libcli:smb: Use smb2_signing_key in smb2_signing_decrypt_pdu()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Adaped to remove Samba AES support

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2019-08-27 04:44:41 +00:00
Jeremy Allison
9b4685242f s3: VFS: Complete the replacement of SMB_VFS_READLINK() -> SMB_VFS_READLINKAT().
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Aug 23 20:06:22 UTC 2019 on sn-devel-184
2019-08-23 20:06:22 +00:00
Jeremy Allison
406bde2654 s3: smbd: Change process_symlink_open() to call SMB_VFS_READLINKAT().
Use conn->cwd_fsp as current fsp.

No logic change for now.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>
2019-08-23 18:49:36 +00:00
Jeremy Allison
288fbe3599 s3: smbd: Change smbd_do_qfilepathinfo(): case SMB_QUERY_FILE_UNIX_LINK: to call SMB_VFS_READLINKAT().
Use conn->cwd_fsp as current fsp.

No logic change for now.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>
2019-08-23 18:49:36 +00:00
Jeremy Allison
654469740c s3: smbd: Change is_msdfs_link_internal() to call SMB_VFS_READLINKAT().
Use conn->cwd_fsp as current fsp.

No logic change for now.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>
2019-08-23 18:49:36 +00:00
Jeremy Allison
515c062b9e s3: VFS: Add SMB_VFS_READLINKAT().
Currently identical to SMB_VFS_READLINK().

Next, add to all VFS modules that implement
readlink and eventually remove readlink.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>
2019-08-23 18:49:35 +00:00
Jeremy Allison
6a8bc6b549 s3: VFS: Complete the replacement of SMB_VFS_MKNOD() -> SMB_VFS_MKNODAT().
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Aug 22 19:17:07 UTC 2019 on sn-devel-184
2019-08-22 19:17:07 +00:00
Jeremy Allison
7237517c8b s3: smbd: Make smb_unix_mknod() call SMB_VFS_MKNODAT() instead of SMB_VFS_MKNOD()
Use conn->cwd_fsp as current fsp.

No logic change for now.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>
2019-08-22 18:00:34 +00:00
Jeremy Allison
e2246876d1 s3: VFS: Add SMB_VFS_MKNODAT().
Currently identical to SMB_VFS_MKNOD().

Next, add to all VFS modules that implement
mknod and eventually remove mknod.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>
2019-08-22 18:00:33 +00:00
Andreas Schneider
33bca1fb80 s3:smbd: Use GnuTLS for AES constants
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Adapted to remove Samba AES

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2019-08-21 09:57:32 +00:00
Andreas Schneider
b51c4293f7 s3:smbd: Use smb2_signing_key structure for the decryption key
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-08-21 09:57:32 +00:00
Andreas Schneider
95e1c85a47 s3:smbd: Use smb2_signing_key structure for the encryption key
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-08-21 09:57:32 +00:00
Jeremy Allison
f42642e54e s3: VFS: Complete the replacement of SMB_VFS_LINK() -> SMB_VFS_LINKAT().
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Aug 20 22:26:17 UTC 2019 on sn-devel-184
2019-08-20 22:26:17 +00:00
Jeremy Allison
ea637f002d s3: smbd: Make hardlink_internals() call SMB_VFS_LINKAT() instead of SMB_VFS_LINK()
Use conn->cwd_fsp as current src and dst fsp's.

No logic change for now.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>
2019-08-20 21:09:29 +00:00
Jeremy Allison
6c3928e4e5 s3: VFS: Add SMB_VFS_LINKAT().
Currently identical to SMB_VFS_LINK().

Next, move add to all VFS modules that implement
link and eventually remove link.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>
2019-08-20 21:09:27 +00:00
Volker Lendecke
8a05d2b074 smbd: Move lease type detection in delay_for_oplock()
Walk the share_modes array only once.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Aug 20 00:33:12 UTC 2019 on sn-devel-184
2019-08-20 00:33:12 +00:00
Volker Lendecke
9a11f361cc smbd: Merge grant_fsp_oplock_type() into delay_for_oplock()
This is a preparation for the next commit: Only walk the share_modes[]
array once when handling oplocks and leases.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-08-19 23:14:39 +00:00
Volker Lendecke
7a6fa34130 smbd: Move delay_for_oplock() down
We'll merge grant_fsp_oplock_type() into this function. This makes the next
commit smaller, and the newly extended delay_for_oplocks will for example
reference static file_has_brlocks() above. Make forward declarations
unnecessary.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-08-19 23:14:39 +00:00
Volker Lendecke
a4192bc70d smbd: Make delay_for_oplock() return NTSTATUS
A further commit will merge grant_fsp_oplock_type (returning NTSTATUS)
into delay_for_oplock(). Make that commit smaller.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-08-19 23:14:39 +00:00
Volker Lendecke
10679b67d1 smbd: Slightly simplify grant_fsp_oplock_type()
This is never called with INTERNAL_OPENs anymore

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-08-19 23:14:39 +00:00
Volker Lendecke
d1cb71fa50 smbd: Slightly simplify delay_for_oplock()
This is never called for INTERNAL_OPENs anymore, see
handle_share_mode_lease()

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-08-19 23:14:39 +00:00
Volker Lendecke
385a7fb196 smbd: Introduce handle_share_mode_lease()
This consolidates the core share_mode_lock access of open_file_ntcreate
into one routine.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-08-19 23:14:39 +00:00
Volker Lendecke
d4e98b8ae5 smbd: Move set_share_mode() out of grant_fsp_oplock_type()
This shows that "req", "share_access" and "access_mask" are not needed
for the core logic of grant_fsp_oplock_type() and it separates
concerns a bit: open_directory() also does the set_share_mode() in the
main open routine, not in a helper like grant_fsp_oplock_type()

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-08-19 23:14:39 +00:00
Volker Lendecke
5c6163d3e6 smbd: Move grant_fsp_oplock_type() close to delay_for_oplock()
Note that this is not a cut&paste: Instead of fsp->access_mask we use
the access_mask the client requested. At the new code location
fsp->access_mask (a.k.a. open_access_mask) might have FILE_WRITE_DATA
from O_TRUNC (a.k.a. FILE_OVERWRITE).

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-08-19 23:14:39 +00:00
Volker Lendecke
3ecfa36e77 smbd: Slightly simplify open_file_ntcreate()
There is no reference to "file_existed" after this point anymore

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-08-19 23:14:39 +00:00
Volker Lendecke
3bd7b119e6 smbd: Remove a late ref to "file_existed" in open_file_ntcreate()
If you follow "existing_dos_attributes" through the routine, this can
only ever be !=0 if SMB_VFS_GET_DOS_ATTRIBUTES() was successful. This
can only have been successful if the file existed.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-08-19 23:14:39 +00:00
Volker Lendecke
f8fe0116c1 smbd: Move resetting "oplock_request" to before delay_for_oplock()
It seems to make little sense to me to do the oplock break with one
setting and then later on grant_fsp_oplock_type with another
one. Survives tests, I can't think of any scenario where this (to me)
simplification would break anything

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-08-19 23:14:39 +00:00
Volker Lendecke
002c6d0efb smbd: For kernel-oplocked files don't call delay_for_oplock()
The kernel has already sent the signal. We don't have to send another
message. Instead, just directly wait for the downgrade to happen via
the watch on the share mode lock assuming it's there. Also setup the
polling interval: I could imagine that in some race situation the file
has already been closed and re-opened by a nonsamba process while we
were waiting.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-08-19 23:14:39 +00:00
Volker Lendecke
706f0af2e4 smbd: Optionally wait for a share mode record in setup_poll_open()
This will be used when waiting for a oplock break that has been
signalled via a kernel oplock break.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-08-19 23:14:38 +00:00
Volker Lendecke
4d6f89c988 smbd: Simplify has_other_nonposix_opens()
We pick quite some information from "fsp" already, so from an API design
perspecitve it's only fair to only use its implicit server_id. This is
what all the callers did anyway.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>
2019-08-19 23:14:38 +00:00
Volker Lendecke
6be8057317 smbd: Align integer types
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>
2019-08-19 23:14:38 +00:00
Volker Lendecke
28868d2457 smbd: Simplify delay_for_oplock()
Use is_same_lease()

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>
2019-08-19 23:14:38 +00:00
Volker Lendecke
021e2d01e6 smbd: Move is_same_lease() up in the file
The next commit will need it there

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>
2019-08-19 23:14:38 +00:00
Volker Lendecke
71c9fd73d4 smbd: Simplify is_same_lease()
It does not use "struct share_mode_data"

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>
2019-08-19 23:14:38 +00:00
Volker Lendecke
9034cb39d7 smbd: Optimize delay_for_oplock()
get_lease_type() can involve a database access. Do that only if
necessary, and that is at most once in this loop.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>
2019-08-19 23:14:38 +00:00
Volker Lendecke
aeb4265ec2 smbd: Remove a misleading comment
open_mode_check() is done before the oplock breaks.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>
2019-08-19 23:14:38 +00:00
Volker Lendecke
d09bd5f8fd smbd: Merge two DEBUGs into one
This looks easier to understand to me, less lines in logfiles

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>
2019-08-19 23:14:38 +00:00
Volker Lendecke
13fb42ac40 smbd: Avoid casts in share_conflict()
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>
2019-08-19 23:14:38 +00:00
Jeremy Allison
6acf4c35b4 s3: VFS: Complete the replacement of SMB_VFS_RENAME() -> SMB_VFS_RENAMEAT().
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2019-08-16 19:52:37 +00:00
Jeremy Allison
74ecfe28a9 s3: smbd: Change rename_internals_fsp() to call SMB_VFS_RENAMEAT().
Use conn->cwd_fsp as current src and dst fsp's.

No logic change for now.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2019-08-16 19:52:34 +00:00
Jeremy Allison
606398a3a6 s3: VFS: Add SMB_VFS_RENAMEAT().
Currently identical to SMB_VFS_RENAME() - uses
AT_FDCWD for both src and dst directories.

Next, move add to all VFS modules that implement
rename and eventually remove rename.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2019-08-16 19:52:32 +00:00
Ralph Boehme
75f98a1953 s3: VFS: change connection_struct cwd_fname to cwd_fsp
Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-08-16 19:52:32 +00:00
Ralph Boehme
c9b38eb79c s3:smbd: modernize conn_new()
Split the monstrous if into individual allocations. I'm going to add more talloc
allocations in a subsequent commit, so it's time to split this up.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-08-16 19:52:32 +00:00