1
0
mirror of https://github.com/samba-team/samba.git synced 2025-02-05 21:57:51 +03:00

58522 Commits

Author SHA1 Message Date
Volker Lendecke
d1341d666a smbd: No base fsps to close_file_free() from file_close_conn()
close_file_free() needs to handle base fsps specially. This can be
simplified a lot if we pass the the open files a second time in case
we encountered base_fsps that we could not immediately delete.

file_close_conn() is not our hot code path, and also we don't expect
many thousand open files that we need to walk a second time.

A subsequent patch will simplify close_file_free(), the complicated
logic is now in files.c, where it IMHO belongs because
file_set_base_fsp() are here as well.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2022-02-10 18:16:36 +00:00
Volker Lendecke
f5bc73a2ad smbd: NULL out "fsp" in close_file()
Quite a few places already had this in the caller, but not all. Rename
close_file() to close_file_free() appropriately. We'll factor out
close_file_smb() doing only parts of close_file_free() later.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2022-02-10 18:16:36 +00:00
Volker Lendecke
363ac75338 smbd: Call file_free() just once in close_file()
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2022-02-10 18:16:36 +00:00
Volker Lendecke
244c5a7d31 smbd: Move the call to file_free() out of close_fake_file()
Centralize calling file_free(), but leave close_fake_file() in for API
symmetry reasons.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2022-02-10 18:16:36 +00:00
Volker Lendecke
2293ca5b57 smbd: Move the call to file_free() out of close_normal_file()
Call file_free() just once

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2022-02-10 18:16:36 +00:00
Volker Lendecke
9966b5e233 smbd: Move the call to file_free() out of close_directory()
Call file_free() just once

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2022-02-10 18:16:36 +00:00
Volker Lendecke
1c1734974f smbd: Slightly simplify create_file_unixpath()
Avoid the "needs_fsp_unlink" variable, describe the talloc hierarchy a
bit differently in the comments.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2022-02-10 18:16:36 +00:00
Samuel Cabrero
cd06574b52 s3:winbind: Reduce the level and improve a couple of debug messages
The commit 1d5c546 changed the debug message printed when setting
winbind to offline state and offline logons are disabled from
level 10 to level 0. This message isn't really an error and might
scare some users, e.g. https://bugzilla.suse.com/show_bug.cgi?id=1195573

Signed-off-by: Samuel Cabrero <scabrero@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Wed Feb  9 20:20:36 UTC 2022 on sn-devel-184
2022-02-09 20:20:36 +00:00
Ralph Boehme
3ee690455e s3/libads: ensure a sockaddr variable is correctly zero initialized
is_zero_addr() doesn't work with addresses that have been zero-initialized.

This fixes the logic added in c863cc2ba34025731a18ac735f714b5b888504da.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14674
MR: https://gitlab.com/samba-team/samba/-/merge_requests/2354

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Feb  8 20:24:12 UTC 2022 on sn-devel-184
2022-02-08 20:24:12 +00:00
Ralph Boehme
c266ed40ae s3/libads: simplify storing existing ads->ldap.ss
We just need temporal storage for ads->ldap.ss, no need to store it as a struct
samba_sockaddr.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14674
MR: https://gitlab.com/samba-team/samba/-/merge_requests/2354

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2022-02-08 19:27:29 +00:00
Volker Lendecke
abd1525d9e vfs: Fix a typo
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2022-02-07 19:00:34 +00:00
Volker Lendecke
c2ac6a9cd7 smbd: Pass "dirfsp" and "smb_fname" to fd_open_atomic()
Dereference fsp once instead of four times

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2022-02-07 19:00:34 +00:00
Volker Lendecke
1850170708 smbd: Avoid an "else" in file_set_dosmode()
Review with git show -b

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2022-02-07 19:00:34 +00:00
Volker Lendecke
0b55d73908 smbd: Fix open_pathref_base_fsp()'s implicit conn_cwd assumption
Opening a stream base file only worked if "dirfsp == conn->cwd_fsp":
We have replaced fsp->fsp_name with the full dirfsp->relative pathname
at the point where open_pathref_base_fsp() is called. In case dirfsp
is already a subdirectory in a share, this breaks because the
open_pathref_base_fsp() uses fsp->fsp_name, not the original
dirfsp-relative one.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2022-02-07 19:00:34 +00:00
Volker Lendecke
d4f8fdd69a libsmb: Convert SMBC_getatr() to NTSTATUS
This avoids a few calls to SMBC_errno()

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2022-02-07 19:00:34 +00:00
Volker Lendecke
0b351cda24 libsmb: Avoid a call to SMBC_errno()
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2022-02-07 19:00:34 +00:00
Volker Lendecke
c9030fb5a8 libsmb: Avoid a call to SMBC_errno()
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2022-02-07 19:00:34 +00:00
Volker Lendecke
3844fe8730 libsmb: Avoid a call to SMBC_errno()
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2022-02-07 19:00:34 +00:00
Volker Lendecke
c78f0a96a3 libsmb: Avoid two calls to SMBC_errno()
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2022-02-07 19:00:34 +00:00
Volker Lendecke
098fc00f9f libsmb: Avoid a call to SMBC_errno()
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2022-02-07 19:00:34 +00:00
Volker Lendecke
ec58a8eaf8 libsmb: Avoid a call to SMBC_errno()
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2022-02-07 19:00:34 +00:00
Volker Lendecke
ede2328c96 smbd: Fix CID 1497981: Null pointer dereferences (REVERSE_INULL)
brown paper bag quality, sorry...

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2022-02-07 19:00:34 +00:00
Volker Lendecke
b2c301ad3b sharesec: Add SEC_DIR_DELETE_CHILD to CHANGE permissions
Otherwise you can't rename or delete files using CHANGE permissions using
the sharesec or shareacls utility

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Feb  4 19:36:53 UTC 2022 on sn-devel-184
2022-02-04 19:36:53 +00:00
Jeremy Allison
b9b82f3611 s3: libsmb: Call cli_dfs_target_check() from cli_smb2_rename_send().
Strips off any DFS prefix from the target if passed in.

Remove knownfail selftest/knownfail.d/msdfs-rename.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14169

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Noel Power <npower@samba.org>

Autobuild-User(master): Noel Power <npower@samba.org>
Autobuild-Date(master): Fri Feb  4 12:02:36 UTC 2022 on sn-devel-184
2022-02-04 12:02:36 +00:00
Jeremy Allison
4473aea926 s3: libsmb: Call cli_dfs_target_check() from cli_cifs_rename_send().
Strips off any DFS prefix from the target if passed in.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14169

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Noel Power <npower@samba.org>
2022-02-04 11:10:33 +00:00
Jeremy Allison
dd0317f6ec s3: libsmb: Call cli_dfs_target_check() from cli_smb1_rename_send().
Strips off any DFS prefix from the target if passed in.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14169

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Noel Power <npower@samba.org>
2022-02-04 11:10:33 +00:00
Jeremy Allison
cf3e572442 s3: libsmb: Call cli_dfs_target_check() from cli_ntrename_internal_send().
Currently we don't pass MSDFS names as targets here, but a caller
may erroneously do this later, and for non-DFS names this is a no-op.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14169

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Noel Power <npower@samba.org>
2022-02-04 11:10:33 +00:00
Jeremy Allison
4bdbe3c2fc s3: libsmb: Call cli_dfs_target_check() from cli_smb2_hardlink_send().
Currently we don't pass MSDFS names as targets here, but a caller
may erroneously do this later, and for non-DFS names this is a no-op.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14169

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Noel Power <npower@samba.org>
2022-02-04 11:10:33 +00:00
Jeremy Allison
2abba0ea10 s3: libsmb: Add cli_dfs_target_check() function.
Strips any DFS prefix from a target name that will be passed
to an SMB1/2/3 rename or hardlink call. Returns a pointer
into the original target name after the prefix. Not yet used.

If the incoming filename is *NOT* a DFS prefix, the
original filename is returned unchanged.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14169

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Noel Power <npower@samba.org>
2022-02-04 11:10:33 +00:00
Jeremy Allison
44cc9fb0e0 s3: tests: Add a new test test_msdfs_rename() that does simple renames on MSDFS root shares.
We fail this on SMB2 for a subtle reason.

Our client code called from smbclient only sets the SMB2_HDR_FLAG_DFS flag
in the outgoing packet on the SMB2_CREATE call, and SMB2 rename does the
following operations:

SMB2_CREATE(src_path) // We set SMB2_HDR_FLAG_DFS here for a MSDFS share.
SMB2_SETINFO: SMB2_FILE_RENAME_INFO(dst_path). // We don't set SMB2_HDR_FLAG_DFS

However, from smbclient, dst_path is a MSDFS path but we don't set the flag,
so even though the rename code inside smbd will cope with a MSDFS path
(as used in the SMB1 SMBmv call) it fails as the correct flag isn't set.

Add knownfail selftest/knownfail.d/msdfs-rename.

Note we need to add the new test to "selftest/knownfail.d/smb1-tests"
as test_smbclient_s3.sh is run against the (ad_member|nt4_member)
environments first using NT1 (SMB1) protocol and then using SMB3,
but the (ad_member|nt4_member) environments don't support SMB1.
Seems a bit strange to me, but all the other SMB1 tests inside
test_smbclient_s3.sh have already been added to "selftest/knownfail.d/smb1-tests"
so just go with the test environment.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14169

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Noel Power <npower@samba.org>
2022-02-04 11:10:33 +00:00
Jeremy Allison
d7deb87605 s3: tests: Add a new test test_msdfs_hardlink() that does simple hardlinks on MSDFS root shares.
We pass this already as the cmd_hardlink in smbclient doesn't
do the DFS path conversion on the hardlink target. But it's
good to have the test.

Note we need to add the new test to "selftest/knownfail.d/smb1-tests"
as test_smbclient_s3.sh is run against the (ad_member|nt4_member)
environments first using NT1 (SMB1) protocol and then using SMB3,
but the (ad_member|nt4_member) environments don't support SMB1.
Seems a bit strange to me, but all the other SMB1 tests inside
test_smbclient_s3.sh have already been added to "selftest/knownfail.d/smb1-tests"
so just go with the test environment.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14169

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Noel Power <npower@samba.org>
2022-02-04 11:10:33 +00:00
Jeremy Allison
ca60f6350d lib: libsmbclient: Ensure cli_rename() always sets cli->raw_status.
Identical change as used in cli_unlink(), cli_mkdir(), cli_rmdir()
cli_chkpath() to ensure SMB2 calls correctly set raw_status for
libsmbclient uses.

Remove knownfail.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14938

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Wed Feb  2 21:50:31 UTC 2022 on sn-devel-184
2022-02-02 21:50:31 +00:00
Volker Lendecke
95c7d23462 vfs: Simplify fake_acls_stat() with an early return
Review with "git di -b"

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Feb  1 20:04:44 UTC 2022 on sn-devel-184
2022-02-01 20:04:44 +00:00
Volker Lendecke
e93f46357f smbd: Simplify reopen_from_fsp() with an early return
Review with git show -b

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2022-02-01 19:09:34 +00:00
Volker Lendecke
1d6762d86b smbd: copy_access_posix_acl() just needs fsps these days
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2022-02-01 19:09:34 +00:00
Volker Lendecke
a1d5ae30ed smbd: chmod_acl_internals() does not need connection_struct anymore
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2022-02-01 19:09:34 +00:00
Volker Lendecke
ea8a653754 smbd: Make directory_has_default_posix_acl() just take "dirfsp"
conn is not referenced anymore, and we only need the files_struct

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2022-02-01 19:09:34 +00:00
Volker Lendecke
191c15f5ef smbd: Modernize a debug statement
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2022-02-01 19:09:34 +00:00
Volker Lendecke
69f2352c49 mdssvc: Align an integer type
In libjansson 2.13.1 json_array_size() returns a size_t

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2022-02-01 19:09:34 +00:00
Jeremy Allison
2b2b41c868 s3: smbd: Add two new functions in a new file, smb2_posix.c: smb2_posix_cc_info(), store_smb2_posix_info()
Not yet used.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Tue Feb  1 17:25:45 UTC 2022 on sn-devel-184
2022-02-01 17:25:45 +00:00
Jeremy Allison
85c6711104 s3: smbd: smbd_smb2_request_process_negprot() - Allow SMB2 unix extensions to be negotiated. Currently not allowed.
As lp_smb2_unix_extensions() currently always returns false,
this code path cannot be executed. This will change once the
whole client and server fixes are in place and tests are passing.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-02-01 16:30:37 +00:00
Jeremy Allison
f68fffa85d s3: smbd: Plumb in POSIX lock requests through SMB2 lock calls if done on a POSIX handle. Currently not allowed.
Note there is currently no way to create a POSIX file
handle in SMB2 so this code can't be accessed.

This will remain so until client and server code are ready to
turn on SMB2 POSIX extensions and the tests are in place.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-02-01 16:30:37 +00:00
Jeremy Allison
fadb2d60ae s3: smbd: Update widelinks_warning() to cope with SMB1 and SMB2 unix extensions.
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-02-01 16:30:37 +00:00
Jeremy Allison
7a5fea262f s3: smbd: lp_widelinks(). Turn off widelinks if either SMB1 or SMB2 unix extensions are turned on.
NB. Currently it's impossible to turn on SMB2 unix extensions.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-02-01 16:30:37 +00:00
Jeremy Allison
955f08866d s3: smbd: Add lp_smb2_unix_extensions() function. Always returns false for now.
For now *always* returns false. This allows me to
add code into smbd contingent on lp_smb2_unix_extensions()
which I know will not be executed until all the parts
are in place. Then the real parameter can be added
(default to off) and testing added.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-02-01 16:30:37 +00:00
Jeremy Allison
0711040dd5 s3: smbd: Add the definition for SMB2_FILE_POSIX_INFORMATION info level.
Will be used by smb2_getinfo. Not yet used or available.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-02-01 16:30:37 +00:00
Jeremy Allison
e9ad189694 s3: smbd: Add an SMB2 server flag posix_extensions_negotiated.
This allows the server to only enable smb2 unix open handles if
the smb.conf parameter is set and the client client correctly
negotiated smb2 unix on the connection.

Currently there is no "smb2 unix extensions" parameter so
this can never be set to true.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2022-02-01 16:30:37 +00:00
Jeremy Allison
e4e5539e40 CVE-2021-44141: s3: smbd: Inside rename_internals_fsp(), we must use vfs_stat() for existence, not SMB_VFS_STAT().
We need to take SMB1+POSIX into account here and do an LSTAT if it's
a POSIX name.

Remove knownfail.d/posix_sylink_rename

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911

Signed-off-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Mon Jan 31 16:26:26 UTC 2022 on sn-devel-184
2022-01-31 16:26:26 +00:00
Jeremy Allison
a44435c6e7 CVE-2021-44141: s3: torture: Add a test samba3.blackbox.test_symlink_rename.SMB1.posix that shows we still leak target info across a SMB1+POSIX rename.
Add a knownfail.d/posix_sylink_rename

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911

Signed-off-by: Jeremy Allison <jra@samba.org>
2022-01-31 15:27:37 +00:00
Jeremy Allison
be13892020 CVE-2021-44141: s3: smbd: Fix a subtle bug in the error returns from filename_convert().
If filename_convert() fails to convert the path, we never call
check_name(). This means we can return an incorrect error code
(NT_STATUS_ACCESS_DENIED) if we ran into a symlink that points
outside the share to a non-readable directory. We need to make
sure in this case we always call check_name().

Remove knownfail.d/symlink_traversal.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911

Signed-off-by: Jeremy Allison <jra@samba.org>
2022-01-31 15:27:37 +00:00