summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* CVE-2021-44141: s4: torture: In raw.search:test_one_file() remove the ↵Jeremy Allison2022-01-311-11/+11
| | | | | | | | | | | leading '\\' in the test filenames. We'll soon be using this under SMB1+POSIX and neither Windows or POSIX need a leading '\\' (and SMB1+POSIX sees the '\\' as part of the name). BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s4: torture: Fix raw.search:test_one_file() to use ↵Jeremy Allison2022-01-311-19/+41
| | | | | | | | | | torture_result() instead of printf. I think this test pre-dates torture_result. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: Remove 'struct uc_state' name_has_wildcard element.Jeremy Allison2022-01-311-1/+0
| | | | | | | | It is never set or looked at. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: In unix_convert_step_stat() remove use of ↵Jeremy Allison2022-01-311-6/+2
| | | | | | | | | | state->name_was_wildcard. It can never be true. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: In unix_convert_step() remove all use of ↵Jeremy Allison2022-01-311-21/+2
| | | | | | | | | | 'state->name_was_wildcard' We know it is never true. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: In unix_convert() remove the now unneeded block ↵Jeremy Allison2022-01-311-98/+95
| | | | | | | | | | | | | indentation. We removed the 'if (state->name_has_wildcard) {' clause, so the block no longer needs indenting. Best seen with git show -b. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: In unix_convert(), remove all references to ↵Jeremy Allison2022-01-311-23/+2
| | | | | | | | | | state->name_has_wildcard. It is never set. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: Inside unix_convert(), never set ↵Jeremy Allison2022-01-311-2/+2
| | | | | | | | | | | state->name_is_wildcard. We error out immediately if it's set anyway. Preparing to remove 'state->name_is_wildcard' structure element. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: UCF_ALWAYS_ALLOW_WCARD_LCOMP 0x00000002 is no ↵Jeremy Allison2022-01-312-4/+1
| | | | | | | | | | longer used. Hurrah ! BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: We no longer need determine_path_error().Jeremy Allison2022-01-311-45/+2
| | | | | | | | | | Now we don't have to consider wildcards just return NT_STATUS_OBJECT_PATH_NOT_FOUND for the cases we used to call it. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: Inside 'struct uc_state', remove ↵Jeremy Allison2022-01-311-5/+3
| | | | | | | | | | allow_wcard_last_component. This is never allowed. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: filename_convert() no longer deals with wildcards.Jeremy Allison2022-01-311-9/+0
| | | | | | | | | | | These are already errored out with NT_STATUS_OBJECT_NAME_INVALID in the unix_convert() code. Remove the check. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: parse_dfs_path() can ignore wildcards.Jeremy Allison2022-01-311-6/+0
| | | | | | | | | If one is passed to filename_convert(), it will error out there with NT_STATUS_OBJECT_NAME_INVALID. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: Remove 'bool search_wcard_flag' from parse_dfs_path().Jeremy Allison2022-01-311-2/+1
| | | | | | | | Never set. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: dfs_path_lookup() no longer deals with wildcards.Jeremy Allison2022-01-311-13/+0
| | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: Fix call_trans2findfirst() to use ↵Jeremy Allison2022-01-311-91/+8
| | | | | | | | | | | filename_convert_smb1_search_path(). filename_convert() no longer has to handle wildcards. UCF_ALWAYS_ALLOW_WCARD_LCOMP is now unused. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: Convert reply_search() to use ↵Jeremy Allison2022-01-311-55/+16
| | | | | | | | | | filename_convert_smb1_search_path(). Cleans up this code path nicely ! BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: Add filename_convert_smb1_search_path() - deals ↵Jeremy Allison2022-01-312-0/+246
| | | | | | | | | | | | | | | | | | | | | | | | | with SMB1 search pathnames. SMB1search and trans2 findfirst are unique in that they are the only passed in pathnames that can contain a terminal wildcard component. Deal with these two special cases with this new function that strips off the terminal wildcard and returns as the mask, and pass the non-wildcard parent directory component through the standard filename_convert(). Uses new helper function strip_gmt_from_raw_dfs(). When SMB1search and trans2 findfirst have been converted to use this function, we can strip all wildcard handling out of filename_convert() as we now know it will only ever be given valid pathnames. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: Allow dfs_redirect() to return a TWRP token it got ↵Jeremy Allison2022-01-313-3/+12
| | | | | | | | | | | | | | from a parsed pathname. This one is subtle. If an SMB1 request has both a DFS path and a @GMT token, the unix_convert() inside the DFS path processing will remove the @GMT token, not allowing the subsequent unix_convert() inside filename_convert() to see it. By returning it from dfs_redirect() we can ensure it's correctly added to the smb_filename returned from filename_convert(). BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: In dfs_path_lookup(). If we have a DFS path ↵Jeremy Allison2022-01-311-0/+7
| | | | | | | | | | including a @GMT-token, don't throw away the twrp value when parsing the path. Not yet used. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: filename_convert() is now a one-to-one wrapper ↵Jeremy Allison2022-01-311-34/+12
| | | | | | | | | | | around filename_convert_internal(). Remove filename_convert() and rename filename_convert_internal() -> filename_convert(). Move the old DEBUG(..) statements to DBG_XXX() so they don't print the wrong name. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: Remove now unused check_reduced_name_with_privilege().Jeremy Allison2022-01-312-176/+0
| | | | | | | | | We now only have one function that does this check (check_reduced_name()), used everywhere. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: Remove unused check_name_with_privilege().Jeremy Allison2022-01-311-21/+0
| | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: In filename_convert_internal(), remove call to ↵Jeremy Allison2022-01-311-4/+3
| | | | | | | | | | | | | | check_name_with_privilege(). We now always pass NULL as struct smb_request *smbreq, so this code path can never be taken. Comment out check_name_with_privilege() as it's now no longer used. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: Remove filename_convert_with_privilege(). No ↵Jeremy Allison2022-01-312-27/+0
| | | | | | | | longer used. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: In call_trans2findfirst() we don't need ↵Jeremy Allison2022-01-311-9/+2
| | | | | | | | | | | | | filename_convert_with_privilege() anymore. It was extra-paranoid code now not needed as the new VFS version of filename_convert() does the same job. There are now no remaining callers of filename_convert_with_privilege(). BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: Remove split_fname_dir_mask().Jeremy Allison2022-01-311-34/+0
| | | | | | | | No longer used. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: In rename_internals(), remove the name spliting ↵Jeremy Allison2022-01-311-65/+2
| | | | | | | | | | | | | | and re-combining code. filename_convert() handles mangled names just fine, so we don't need to split the last component and check for mangle. Now we don't take wildcard names this is not needed. This was the last caller of split_fname_dir_mask(), so ifdef it out. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: check_name() is now static to filename.cJeremy Allison2022-01-312-3/+1
| | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: In rename_internals_fsp(), remove unneeded call to ↵Jeremy Allison2022-01-311-5/+0
| | | | | | | | | | | check_name(). All callers have gone through filename_convert(), which has already called check_name() on the destination. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: Handling SMB_FILE_RENAME_INFORMATION, the ↵Jeremy Allison2022-01-311-18/+1
| | | | | | | | | | destination name is a single component. No errors should be allowed from filename_convert(). BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: Remove the old unlink_internals() implementation.Jeremy Allison2022-01-311-80/+0
| | | | | | | | | No longer used. filename_convert() already handles mangled names just fine, so we don't need this logic. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: Comment out the old unlink_internals(). Rename ↵Jeremy Allison2022-01-311-3/+5
| | | | | | | | | | | | do_unlink() -> unlink_internals(). One parameter needs changing position. The logic inside unlink_internals() is no longer needed if it doesn't accept wildcards. filename_convert() already handles mangled names just fine, so we don't need this logic. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: Move to modern debug calls inside do_unlink().Jeremy Allison2022-01-311-6/+6
| | | | | | | | We will be changing its name next. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: Move setting of dirtype if FILE_ATTRIBUTE_NORMAL ↵Jeremy Allison2022-01-311-3/+4
| | | | | | | | | | | | to do_unlink(). Now we don't use wildcards when calling in unlink_internals() the logic inside it serves no purpose and can be replaced with a direct call to do_unlink() (which we will rename to unlink_internals()). BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: Remove 'const char *src_original_lcomp' from ↵Jeremy Allison2022-01-311-11/+0
| | | | | | | | | | | reply_mv(). No longer used. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* CVE-2021-44141: s3: smbd: Remove 'const char *src_original_lcomp' parameter ↵Jeremy Allison2022-01-314-5/+0
| | | | | | | | | | | from rename_internals(). No longer used. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* CVE-2021-44141: s3: smbd: Inside rename_internals() remove '{ ... }' block ↵Jeremy Allison2022-01-311-68/+64
| | | | | | | | | | | | | around singleton rename code. Best viewed with 'git show -b' As we're touching the DEBUG() code, change it to modern DBG_NOTICE(). BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* CVE-2021-44141: s3: smbd: Remove the commented out resolve_wildcards().Jeremy Allison2022-01-311-129/+0
| | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* CVE-2021-44141: s3: smbd: Remove all wildcard code from rename_internals().Jeremy Allison2022-01-311-197/+4
| | | | | | | | | | | We no longer use resolve_wildcards() so comment it out for later removal. Keep the '{ ... }' block around the singleton rename for now, to keep the diff small. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* CVE-2021-44141: s3: smbd: Remove dest_has_wild and all associated code from ↵Jeremy Allison2022-01-311-19/+0
| | | | | | | | | rename_internals() BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* CVE-2021-44141: s3: smbd: Prepare to remove wildcard matching from ↵Jeremy Allison2022-01-311-14/+0
| | | | | | | | | | | rename_internals(). src_has_wild and dest_has_wild can never be true. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* CVE-2021-44141: s3: smbd: In reply_ntrename() remove 'bool dest_has_wcard' ↵Jeremy Allison2022-01-311-20/+12
| | | | | | | | | | | and all uses. It's always false now. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* CVE-2021-44141: s3: smbd: In reply_ntrename(), never set dest_has_wcard.Jeremy Allison2022-01-311-4/+0
| | | | | | | | | It can never be true. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* CVE-2021-44141: s3: smbd: In reply_ntrename() remove the ↵Jeremy Allison2022-01-311-8/+0
| | | | | | | | | | | UCF_ALWAYS_ALLOW_WCARD_LCOMP flag for destination lookups. We know the destination will never be a wildcard. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* CVE-2021-44141: s3: smbd: In SMBntrename (0xa5) prevent wildcards in ↵Jeremy Allison2022-01-311-0/+5
| | | | | | | | | destination name. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* CVE-2021-44141: s3: smbd: In smb_file_rename_information() ↵Jeremy Allison2022-01-311-2/+1
| | | | | | | | | (SMB_FILE_RENAME_INFORMATION info level) prevent destination wildcards. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* CVE-2021-44141: s3: smbd: Remove UCF_ALWAYS_ALLOW_WCARD_LCOMP flag from ↵Jeremy Allison2022-01-311-4/+2
| | | | | | | | | | | | pathname processing in reply_mv(). We are no longer supporting wildcard rename via SMBmv (0x7) as WindowsXP SMB1 and above do not use it. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* CVE-2021-44141: s3: smbd: Remove 'bool has_wild' parameter from ↵Jeremy Allison2022-01-314-8/+5
| | | | | | | | | unlink_internals(). BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* CVE-2021-44141: s3: smbd: Change unlink_internals() to ignore has_wild ↵Jeremy Allison2022-01-311-200/+26
| | | | | | | | | | | | parameter. It's always passed as false now so we can remove the (horrible) enumeration code for unlink. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
View Lorry Controller Status