1
0
mirror of https://github.com/samba-team/samba.git synced 2025-03-12 20:58:37 +03:00

1490 Commits

Author SHA1 Message Date
Ralph Boehme
f0a52d4337 smbd: use metadata_fsp() with SMB_VFS_FSET_NT_ACL()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15126
MR: https://gitlab.com/samba-team/samba/-/merge_requests/2643

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
(cherry picked from commit 4ab29e2a345b48ebba652d5154e96adf954a6757)
2022-09-06 06:32:13 +00:00
Ralph Boehme
fc6121cade smbd: use metadata_fsp() with SMB_VFS_FGET_NT_ACL()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15126
MR: https://gitlab.com/samba-team/samba/-/merge_requests/2643

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
(backported from commit c949e4b2a42423ac3851e86e489fd0c5d46d7f1f)
[slow@samba.org: context mismatch due to smbd_check_access_rights_fname() call in master]
2022-09-06 06:32:13 +00:00
Jeremy Allison
0671b340fb s3: cmd_vfs: cmd_set_nt_acl(). All calls to SMB_VFS_FSTAT(fsp, &fsp->fsp_name->st) clobber fsp->fsp_name->st.st_ex_iflags.
If doing an SMB_VFS_FSTAT() returning onto the stat struct stored in the fsp,
we must call vfs_stat_fsp() as this preserves the iflags.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15022

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(back-ported picked from commit 23d5c909286d438534f1a7defb2faacd1877fea1)
2022-04-11 08:32:10 +00:00
Jeremy Allison
687e9cc845 s3: cmd_vfs: cmd_open(). All calls to SMB_VFS_FSTAT(fsp, &fsp->fsp_name->st) clobber fsp->fsp_name->st.st_ex_iflags.
If doing an SMB_VFS_FSTAT() returning onto the stat struct stored in the fsp,
we must call vfs_stat_fsp() as this preserves the iflags.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15022

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit fbc6cdfbeda4086851dfb0f91fd23b4fd541e174)
2022-04-11 08:32:10 +00:00
Jeremy Allison
bbd8bdc14c s3: torture: Add 2 new tests SMB2-DEL-ON-CLOSE-NONWRITE-DELETE-NO, SMB2-DEL-ON-CLOSE-NONWRITE-DELETE-YES.
We currently allow setting the delete on close bit for
a directory containing only explicitly hidden/vetoed files
in the case where "delete veto files = yes" *and*
"delete veto files = no". For the "delete veto files = no"
case we should be denying setting the delete on close bit
when the client tries to set it (that's the only time Windows
looks at the bit and returns an error to the user). We
already do the in the dangling symlink case, we just
missed it in the !is_visible_fsp() case.

Mark SMB2-DEL-ON-CLOSE-NONWRITE-DELETE-NO as knownfail
for now.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15023

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Noel Power <npower@samba.org>
(cherry picked from commit 5fe341d2d67afb7088edcb772b058c747ab341b1)
2022-03-24 12:42:10 +00:00
Jeremy Allison
dbeef6bc73 CVE-2021-44141: s3: torture: Change expected error return for samba3.smbtorture_s3.plain.POSIX.smbtorture.
Trying to open a symlink as a terminal component should return
NT_STATUS_OBJECT_NAME_NOT_FOUND, not NT_STATUS_OBJECT_PATH_NOT_FOUND.

Mark as knownfail.d/simple_posix_open until we fix the server.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911

Signed-off-by: Jeremy Allison <jra@samba.org>
2022-01-31 12:23:53 +01:00
Jeremy Allison
3e0d40f548 CVE-2021-44141: s3: smbtorture3: Fix POSIX-BLOCKING-LOCK to actually negotiate SMB1+POSIX before using POSIX calls.
This must be done before doing POSIX calls on a connection.

Remove the final entry in knownfail.d/posix_infolevel_fails

    samba3.smbtorture_s3.plain.POSIX-BLOCKING-LOCK.smbtorture\(nt4_dc_smb1\)

And remove the file knownfail.d/posix_infolevel_fails itself.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911

Signed-off-by: Jeremy Allison <jra@samba.org>
2022-01-31 12:23:53 +01:00
Jeremy Allison
80d8a557dd CVE-2021-44141: s3: torture: Remove the wildcard unlink test code.
This is pre WindowXP SMB1 functionality, and we
need to remove this from the server in order to
move towards SMB2-only, so the test must go.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2022-01-31 12:23:51 +01:00
Jeremy Allison
6c40cda03e CVE-2021-44141: s3: torture: In run_smb1_wild_mangle_unlink_test() use a valid pathname for rename target.
The server will not be supporting wildcard rename soon.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2022-01-31 12:23:51 +01:00
Jeremy Allison
c249f1d09d CVE-2021-44141: s3: torture: In torture_mangle(), use torture_deltree() for setup and cleanup.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2022-01-31 12:23:51 +01:00
Jeremy Allison
cf109e26b7 CVE-2021-44141: s3: torture: In test_mask(), use torture_deltree() for setup.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2022-01-31 12:23:51 +01:00
Jeremy Allison
8349c57f76 CVE-2021-44141: s3: torture: In run_streamerror(), use torture_deltree() for setup.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2022-01-31 12:23:51 +01:00
Jeremy Allison
ff64b0f32d CVE-2021-44141: s3: torture: In torture_chkpath_test(), use torture_deltree() for setup and cleanup.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2022-01-31 12:23:51 +01:00
Jeremy Allison
18ac36f7ae CVE-2021-44141: s3: torture: In torture_casetable(), use torture_deltree() for setup and cleanup.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2022-01-31 12:23:51 +01:00
Jeremy Allison
04304b9f92 CVE-2021-44141: s3: torture: In torture_utable(), use torture_deltree() for setup.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2022-01-31 12:23:51 +01:00
Jeremy Allison
919b3c8d3f CVE-2021-44141: s3: torture: In run_smb1_wild_mangle_rename_test() use torture_deltree() for setup and cleanup.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2022-01-31 12:23:51 +01:00
Jeremy Allison
74fe15a05a CVE-2021-44141: s3: torture: In run_smb1_wild_mangle_unlink_test() use torture_deltree() for setup and cleanup.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2022-01-31 12:23:51 +01:00
Jeremy Allison
57fbf7564c CVE-2021-44141: s3: torture: Add torture_deltree() for setup and teardown.
Not yet used.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2022-01-31 12:23:51 +01:00
Jeremy Allison
728c9b8356 s3: smbtorture3: Add test for setting delete on close on a directory, then creating a file within to see if delete succeeds.
Exposes an existing problem where "ret" is overwritten
in the directory scan.

Add knownfail.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14892

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit adfad6390962022277cc6aacaa388af86e46b71c)
2021-11-17 15:14:55 +00:00
Ralph Boehme
c9b5ca53eb source3: move lib/substitute.c functions out of proto.h
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit 25043ebb2e6f74592e802f78d327f844e615a442)
2021-11-16 16:01:17 +00:00
Stefan Metzmacher
c55de3995c CVE-2020-25717: s3:torture: start with authoritative = 1
This is not strictly needed, but makes it easier to audit
that we don't miss important places.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-11-04 10:09:05 +13:00
Ralph Boehme
e5f6c2e25c vfstest: don't ignore unknown options
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14828

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit 96ab7909bd9eea14ba3aad535c28d53c184341a2)
2021-09-13 07:48:08 +00:00
Ralph Boehme
7bee957378 pdbtest: don't ignore unknown options
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14828

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit e3c5516dc578aee25aaaac1ab7a66ede9d313be0)
2021-09-13 07:48:08 +00:00
Jeremy Allison
8f8d0eaad6 s3: tests: Add "SMB2-LIST-DIR-ASYNC" test.
Add as knownfail.

Shows our "smbd async dosmode" code wasn't working.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14758

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2021-07-15 05:02:30 +00:00
Stefan Metzmacher
ea102d3b1b s3:torture: replace PROTOCOL_SMB2_22 with PROTOCOL_SMB3_00
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2021-07-15 00:06:31 +00:00
Stefan Metzmacher
bc39450d80 s3:lib: add samba_path_matching_regex_sub1_create()
This will allow the usage 'POSIX Basic Regular Expression'
instead of 'ms wildcard' strings.

We allow exactly one 'subexpression' starting with '\(' and
ending with '\)' in order to find a replacement (byte) region
in the matching string.

This will be used in the vfs_preopen module in the following
commits.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2021-07-01 13:02:31 +00:00
Stefan Metzmacher
845a59919e s3:lib: add a new samba_path_matching* infrastructure
This aims to replace the current is_in_path() code in the long run.

For now it implements samba_path_matching_mswild_create()
in order to replace is_in_path() in the long run.

But there will be other "backends" using regexec() too.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2021-07-01 13:02:31 +00:00
Stefan Metzmacher
0a459c6b2d s3:torture: add STR-MATCH-MSWILD test for is_in_path()
I want to assert at least some of the behavior as the
next commits will add a new abstraction that should
at least partly behave the same.

Note: case_[in]sensitive_idx is the index to the patterns
in the namelist, set to -1 on non-match, otherwise to
a value >= 0.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2021-07-01 13:02:31 +00:00
Jeremy Allison
ff09fc77a2 s3: torture: In cmd_getxattr(), SMB_VFS_GETXATTR() -> SMB_VFS_FGETXATTR().
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2021-06-25 15:53:31 +00:00
Jeremy Allison
ac10058d7f s3: torture: Add POSIX-SYMLINK-SETPATHINFO regression test.
This ensure we never blunder into indirecting a NULL fsp pointer
in the server. Currently this crashes the server in several info
levels.

Add knownfail.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14742

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Noel Power <npower@samba.org>
2021-06-16 11:10:36 +00:00
Jeremy Allison
582030bae2 s3: torture: Add POSIX-SYMLINK-GETPATHINFO regression test.
This ensure we never blunder into indirecting a NULL fsp pointer
in the server. We already pass this, but this test will ensure
we continue to do so as we make fileserver changes.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Noel Power<npower@samba.org>

Autobuild-User(master): Noel Power <npower@samba.org>
Autobuild-Date(master): Tue Jun 15 11:06:23 UTC 2021 on sn-devel-184
2021-06-15 11:06:23 +00:00
Jeremy Allison
82efcc2359 s3: torture: cmd_get_nt_acl(), SMB_VFS_GET_NT_ACL_AT() -> SMB_VFS_FGET_NT_ACL()
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2021-06-09 13:14:30 +00:00
Jeremy Allison
e81aa6e358 s3: torture: Change cmd_sys_acl_blob_get_file() to be handle based.
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2021-06-09 13:14:30 +00:00
Jeremy Allison
a8e49253d7 s3: torture: cmd_sys_acl_get_file(), SMB_VFS_SYS_ACL_GET_FILE() -> SMB_VFS_SYS_ACL_GET_FD().
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2021-06-09 13:14:30 +00:00
Noel Power
e59244461f VFS: SMB_VFS_SYS_ACL_GET_FD: Modify api to take additional type param
Modify all implementations (and the definitions) related to
SMB_VFS_SYS_ACL_GET_FD to accept additional SMB_ACL_TYPE_T type param.

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2021-06-09 13:14:30 +00:00
Jeremy Allison
0c2ceb0435 s3: torture: Add regression test for renaming SMB1+POSIX symlinks, dangling and real.
Mark as knownfail.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Noel Power <noel.power@suse.com>
2021-05-24 16:57:37 +00:00
Andreas Schneider
de159c40c5 s3:torture: Migrate pdbtest to new cmdline option parser
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-05-20 02:58:36 +00:00
Andreas Schneider
279c95cebf s3:torture: Migrate vfstest to new cmdline option parser
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-05-20 02:58:36 +00:00
Jeremy Allison
544289b54b s3: torture: Add test for bug 14708 - POSIX default ACL not mapped into returned Windows ACL for directory handles.
Knownfail for now.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14708

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Noel Power <npower@samba.org>
2021-05-19 08:34:30 +00:00
Jeremy Allison
b6700044de s3: torture: cmd_sys_acl_delete_def_file: Move SMB_VFS_SYS_ACL_DELETE_DEF_FILE() -> SMB_VFS_SYS_ACL_DELETE_DEF_FD().
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Noel Power <npower@samba.org>
2021-05-18 17:29:34 +00:00
Jeremy Allison
249565c65a s3: torture: Add samba3.smbtorture_s3.plain.POSIX-SYMLINK-CHMOD
Shows we must protect against a null fsp handle when doing POSIX chmod on a symlink,
whether the symlink points to a real object or is dangling.

Add to knownfail for now. Commit 9722732b1867e359304594ada72ff40cd1341be5
removed the fsp == NULL protection for POSIX, and we need to put it back.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2021-04-20 07:39:37 +00:00
Samuel Cabrero
ae9044395f s3: torture: Change cmd_utime to use SMB_VFS_FNTIMES()
Signed-off-by: Samuel Cabrero <scabrero@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2021-04-19 12:28:30 +00:00
Noel Power
5cad228f55 s3/torture: Make cmd_chmod now use SMB_VFS_FCHMOD
Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
2021-04-11 22:27:34 +00:00
Jeremy Allison
14ac9296c9 s3: torture: Change cmd_removexattr to use SMB_VFS_FREMOVEXATTR().
The last user of SMB_VFS_REMOVEXATTR() is gone, I can now
remove the internal VFS functions implementing it.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2021-04-07 16:26:28 +00:00
Jeremy Allison
eb3a578b0b s3: torture: Add an SMB1 POSIX specific test POSIX-SYMLINK-PARENT.
This creates a directory, then a symlink to a directory,
and then checks we can POSIX create and delete file, directory,
symlink and hardlink filesystem objects under the symlink
parent directory.

Mark as knownfail until next commit.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2021-04-07 14:36:37 +00:00
Jeremy Allison
c7762a2bee s3: torture: Add a test for setting and getting ACLs on stream handles (SMB2-STREAM-ACL).
It shows this isn't done correctly for streams_xattr.

A common config is:

vfs_objects = streams_xattr acl_xattr

to store both streams and Windows ACLs in xattrs.

Unfortunately getting and setting ACLs using handles
opened on stream files isn't being done correctly
in Samba.

This test passes against Windows 10.

This adds tests that prove this doesn't work. Next
patch will add the fix and remove the knownfail.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2021-03-30 19:16:34 +00:00
Stefan Metzmacher
c34b86a34e libcli/smb: pass smb3_capabilities to smbXcli_conn_create()
Passing NULL means use none.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14512

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2021-03-17 00:49:32 +00:00
Volker Lendecke
bb5bf50819 lib: Remove init_names()
is_myname() looks at lp_* directly, nmbd maintains its own list: We don't
need the baroque loadparm handler anymore.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2021-03-16 17:09:32 +00:00
Noel Power
1a8b384440 s3/torture: SMB_VFS_SETXATTR -> SMB_VFS_FSETXATTR
Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
2021-03-11 17:50:30 +00:00
Noel Power
435119c495 s3/torture: migrate SMB_VFS_FLISTXATTR calls to SMB_VFS_FLISTXATTR
Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
2021-02-26 21:28:33 +00:00