1
0
mirror of https://github.com/samba-team/samba.git synced 2025-02-10 13:57:47 +03:00

9757 Commits

Author SHA1 Message Date
Jeremy Allison
ca3bc78099 s3: VFS: Add SMB_VFS_MKDIRAT().
Currently identical to SMB_VFS_MKDIR().

Next, add to all VFS modules that implement
mkdir and eventually remove mkdir.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2019-09-11 18:24:28 +00:00
Jeremy Allison
5e7828faf3 s3: pysmbd: Ensure conn->cwd_fsp member of created connections is initialized.
This is needed to correctly call the XXXAT() vfs calls.

We should probably just use create_conn_struct_tos_cwd() here
and pass $cwd instead of using create_conn_struct_tos() and
passing "/" as the share root. We wouldn't change the current
working directory and the created share root would be set to $cwd
but I'm not sure what effects this may have on users of pysmbd
in case any of them pass paths above the $cwd to these functions.

Less changes to just call vfs_ChDir(conn, &cwd) which doesn't
change the current directory and leaves the share root as "/".

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2019-09-11 18:24:28 +00:00
Ralph Boehme
bdda10875e s3:smbd: skip write-time fetching for directories.
The whole logic only applies to files.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Wed Sep 11 00:33:26 UTC 2019 on sn-devel-184
2019-09-11 00:33:25 +00:00
Volker Lendecke
436be09cfc smbd: Do boolean short-circuiting
&= does bitwise AND, and does not do boolean short-circuiting if the
variable is already 0. As has_other_nonposix_opens() might have its
cost, this speeds up closing a handle.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-09-10 23:14:32 +00:00
Volker Lendecke
2448060072 smbd: Use file_id_str_buf() in close_remove_share_mode()
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-09-10 23:14:31 +00:00
Volker Lendecke
c88cb0a13b smbd: Use file_id_str_buf() in setup_poll_open()
While there, remove a pointless empty line

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-09-10 23:14:31 +00:00
Volker Lendecke
fd691fbc94 smbd: Use file_id_str_buf() in defer_open()
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-09-10 23:14:31 +00:00
Ralph Boehme
95655fe683 vfs: restore stat fields in vfs_stat_fsp()
This ensures we preserve btime, itime and File-ID.

As the Durable Handles code calls vfs_stat_fsp() in the DH disconnect function,
previously the btime was lost and NOT stored in the cookie. With this change the
cookie will store the correct btime (and iflags), which requires us to call
dos_mode() in the reconnect function to ensure we pass
vfs_default_durable_reconnect_check_stat().

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14121

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Tue Sep 10 20:22:21 UTC 2019 on sn-devel-184
2019-09-10 20:22:21 +00:00
Ralph Boehme
e00e78cfed s3:vfs: streamline vfs_stat_fsp()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14121

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2019-09-10 19:05:30 +00:00
Ralph Boehme
ab03394969 s3: replace fsp_stat() with vfs_stat_fsp()
Both functions do the same, they differ just in the type of the returned result.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14121

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2019-09-10 19:05:29 +00:00
Ralph Boehme
3483b75fed s3:smbd: ensure to update the File-ID in struct smb_filename
Initialize the File-ID in fsp->fsp_name->st, any subsequent metadata fetch on
this file-handle needs this, eg QFID SMB2 Create-Context or GETINFO SMB
requests.

It would be nice if SMB_VFS_SET_DOS_ATTRIBUTE() would do this, unfortunately it
gets a const struct smb_filename.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14121

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2019-09-10 19:05:29 +00:00
Stefan Metzmacher
66d92f37c3 s3:locking: add brl_req_guid() and brl_req_mem_ctx() helper functions
This allows the vfs backend to detect a retry and keep state between
the retries.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14113

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2019-09-09 14:23:41 +00:00
Stefan Metzmacher
7471b0f632 s3:smb2_lock: handle NT_STATUS_RETRY from the VFS backend
This allows the VFS backends to implement async byte
range locking.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14113

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2019-09-09 14:23:41 +00:00
Stefan Metzmacher
7d1cd6f22e s3:blocking: handle NT_STATUS_RETRY from the VFS backend
This allows the VFS backends to implement async byte
range locking.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14113

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2019-09-09 14:23:41 +00:00
Stefan Metzmacher
8975673e3c s3:blocking: make use of smbd_smb1_do_locks_try() in smbd_smb1_do_locks_send()
We only need the logic to call smbd_smb1_do_locks_check() and a possible
retry once in smbd_smb1_do_locks_try().

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14113

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2019-09-09 14:23:41 +00:00
Stefan Metzmacher
6e30a89b3f s3:blocking: call smbd_smb1_do_locks_setup_timeout() also in smbd_smb1_do_locks_try()
This is a noop if smbd_smb1_do_locks_setup_timeout() was called before.

But it allows us to use smbd_smb1_do_locks_try() in
smbd_smb1_do_locks_send() in a following commit.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14113

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2019-09-09 14:23:41 +00:00
Stefan Metzmacher
3123271062 s3:blocking: fix the fsp->blocked_smb1_lock_reqs handling
A new request is first checks against all pending
requests before checking the already granted locks.

Before we retried the lock array of another request
(the first in the list), but then finished current request,
which is wrong.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14113

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2019-09-09 14:23:41 +00:00
Stefan Metzmacher
997548a5f1 s3:blocking: do the timeout calculation before calling dbwrap_watched_watch_send()
This makes the next commits easier to understand.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14113

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2019-09-09 14:23:41 +00:00
Stefan Metzmacher
8da7c10a58 s3:blocking: split out smbd_smb1_do_locks_setup_timeout()
This function can be called multiple times, but only
the first time will setup the endtime. And the
endtime is relative to the request time and not
the current time.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14113

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2019-09-09 14:23:41 +00:00
Stefan Metzmacher
5a841a43f9 s3:blocking: use timeval_expired(&state->endtime) to stop processing
This is less racy than timeval_elapsed() > 0
as the current time is already expired and timeout = 0
will always work correct.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14113

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2019-09-09 14:23:41 +00:00
Stefan Metzmacher
8decf41bbb s3:smb2_lock: add retry for POSIX locks
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14113

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2019-09-09 14:23:40 +00:00
Stefan Metzmacher
359e9992be s3:smb2_lock: make use of smbd_smb2_lock_try() in smbd_smb2_lock_send()
We only need the logic to call smbd_do_locks_try() and a possible
retry once in smbd_smb2_lock_try().

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14113

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2019-09-09 14:23:40 +00:00
Stefan Metzmacher
7f77e0b4e9 s3:smb2_lock: let smbd_smb2_lock_try() explicitly check for the retry condition
This makes it possible to reuse _try() in the _send() function in the
next commit.

We should not retry forever on a hard error.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14113

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2019-09-09 14:23:40 +00:00
Stefan Metzmacher
39d514cdc3 s3:smb2_lock: error out early in smbd_smb2_lock_send()
We no longer expect NT_STATUS_FILE_LOCK_CONFLICT from
the VFS layer and assert that in a future version.

This makes it easier to port the same logic to smbd_smb2_lock_try().

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14113

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2019-09-09 14:23:40 +00:00
Stefan Metzmacher
d096742da1 s3:smb2_lock: split smbd_smb2_lock_retry() into _try() and _retry()
This makes it possible to reuse _try() in the _send() function in the
next commits.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14113

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2019-09-09 14:23:40 +00:00
Stefan Metzmacher
f13d13ae9d s3:smb2_lock: move from 'blocking' to 'state->blocking'
This will simplify the next commits.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14113

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2019-09-09 14:23:40 +00:00
Stefan Metzmacher
aba0ee4625 s3:blocking: maintain state->deny_status
For Windows locks we start with LOCK_NOT_GRANTED and use
FILE_LOCK_CONFLICT if we retried after a timeout.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14113

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2019-09-09 14:23:40 +00:00
Stefan Metzmacher
15765644d2 s3:blocking: use dynamic posix lock wait intervals
We want to start with a short timeout (200ms) and
slow down to larger timeouts up to 2s for the default
value of "lock spin time".

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14113

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2019-09-09 14:23:39 +00:00
Stefan Metzmacher
62ec58b06c s3:blocking: Remove bug reproducer from a few commits ago
The problem is fixed, now we can revert the change that made it
easier to trigger.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14113

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2019-09-09 14:23:39 +00:00
Stefan Metzmacher
e8d719d31f s3:blocking: fix posix lock retry
We should evaluate the timeout condition after the very last
retry and not before.

Otherwise we'd fail to retry when waiting for posix locks.
The problem happens if the client provided timeout is smaller
than the 1 sec (for testing temporary 15 secs) retry.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14113

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2019-09-09 14:23:39 +00:00
Stefan Metzmacher
8fe708acb4 s3:blocking: move from 'timeout' to 'smbd_smb1_do_locks_state->timeout'
This will make it possible to just use smbd_smb1_do_locks_try()
in a later commit.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14113

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2019-09-09 14:23:39 +00:00
Stefan Metzmacher
e79fcfaaf2 s3:blocking: split smbd_smb1_do_locks_retry() into _try() and _retry()
This will make it possible to have just one caller to
smbd_do_locks_try() later and use smbd_smb1_do_locks_try()
from within smbd_smb1_do_locks_send().

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14113

Reviewed-by: Volker Lendecke <vl@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2019-09-09 14:23:39 +00:00
Stefan Metzmacher
2ec9e93a7a s3:blocking: demonstrate the posix lock retry fails
This is just a temporary commit that shows the bug and its
fix. It will be reverted once the problem is fixed.

The posix lock retry fails if the client specified timeout
is smaller than the hardcoded 1 second retry.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14113

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2019-09-09 14:23:39 +00:00
Stefan Metzmacher
3b788d97f9 s3:blocking: remove unused timeval_brl_min()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14113

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2019-09-09 14:23:39 +00:00
Stefan Metzmacher
8b565de1ac s3:smb2_lock: call change_to_user_by_fsp() when dbwrap_watched_watch* finishes
This is not strictly required as fd-based calls are used,
but it's more consistent to call SMB_VFS_BRL_LOCK_WINDOWS()
in the same environment on retry.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14113

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2019-09-09 14:23:39 +00:00
Stefan Metzmacher
28ac2cbaf9 s3:blocking: call change_to_user_by_fsp() when dbwrap_watched_watch* finishes
This is not strictly required as fd-based calls are used,
but it's more consistent to call SMB_VFS_BRL_LOCK_WINDOWS()
in the same environment on retry.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14113

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2019-09-09 14:23:39 +00:00
Jeremy Allison
c5ea3d045a s3: VFS: Complete the replacement of SMB_VFS_SYMLINK() -> SMB_VFS_SYMLINKAT().
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Sep  3 22:32:30 UTC 2019 on sn-devel-184
2019-09-03 22:32:30 +00:00
Jeremy Allison
daf78b0271 s3: smbd: Change create_msdfs_link() to call SMB_VFS_SYMLINKAT().
Use conn->cwd_fsp as current fsp.

No logic change for now.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>
2019-09-03 21:15:43 +00:00
Jeremy Allison
538f78f07b s3: smbd: Change smb_set_file_unix_link() to call SMB_VFS_SYMLINKAT().
Use conn->cwd_fsp as current fsp.

No logic change for now.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>
2019-09-03 21:15:43 +00:00
Jeremy Allison
42414b5bfc s3: VFS: Add SMB_VFS_SYMLINKAT().
Currently identical to SMB_VFS_SYMLINK().

Next, add to all VFS modules that implement
symlink and eventually remove symlink.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>
2019-09-03 21:15:42 +00:00
Stefan Metzmacher
efd4832c2c CVE-2019-10197: smbd: split change_to_user_impersonate() out of change_to_user_internal()
This makes sure we always call chdir_current_service() even
when we still impersonated the user. Which is important
in order to run the SMB* request within the correct working directory
and only if the user has permissions to enter that directory.

It makes sure we always update conn->lastused_count
in chdir_current_service() for each request.

Note that vfs_ChDir() (called from chdir_current_service())
maintains its own cache and avoids calling SMB_VFS_CHDIR()
if possible.

It means we still avoid syscalls if we get a multiple requests
for the same session/tcon tuple.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14035

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

Autobuild-User(master): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(master): Tue Sep  3 09:27:22 UTC 2019 on sn-devel-184
2019-09-03 09:27:21 +00:00
Stefan Metzmacher
509113fcff CVE-2019-10197: smbd: make sure we reset current_user.{need,done}_chdir in become_root()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14035

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2019-09-03 08:07:38 +00:00
Stefan Metzmacher
6fae81312f CVE-2019-10197: smbd: make sure that change_to_user_internal() always resets current_user.done_chdir
We should not leave current_user.done_chdir as true if we didn't call
chdir_current_service() with success.

This caused problems in when calling vfs_ChDir() in pop_conn_ctx() when
chdir_current_service() worked once on one share but later failed on another
share.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14035

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2019-09-03 08:07:37 +00:00
Jeremy Allison
e48c118969 CVE-2019-10197: smbd: separate out impersonation debug info into a new function.
Will be called on elsewhere on successful impersonation.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14035

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2019-09-03 08:07:37 +00:00
Mathieu Parent
549a4a82e0 Spelling fixes s/preceeding/preceding/
Signed-off-by: Mathieu Parent <math.parent@gmail.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2019-09-01 22:21:28 +00:00
Mathieu Parent
105bb06318 Spelling fixes s/withing/within/
Signed-off-by: Mathieu Parent <math.parent@gmail.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2019-09-01 22:21:28 +00:00
Andreas Schneider
2ee1764ca8 s3:smbd: Prefer AES-GCM over AES-CCM with GnuTLS
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Adapted to remove Samba AES support

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2019-08-27 04:44:41 +00:00
Andreas Schneider
eb65fe5505 libcli:smb: Use smb2_signing_key in smb2_signing_encrypt_pdu()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Adaped to remove Samba AES support

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2019-08-27 04:44:41 +00:00
Andreas Schneider
7f56e91dbe libcli:smb: Use smb2_signing_key in smb2_signing_decrypt_pdu()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Adaped to remove Samba AES support

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2019-08-27 04:44:41 +00:00
Jeremy Allison
9b4685242f s3: VFS: Complete the replacement of SMB_VFS_READLINK() -> SMB_VFS_READLINKAT().
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Aug 23 20:06:22 UTC 2019 on sn-devel-184
2019-08-23 20:06:22 +00:00