summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* VERSION: Disable GIT_SNAPSHOT for the 4.15.5 release.samba-4.15.5Jule Anger2022-01-311-1/+1
| | | | Signed-off-by: Jule Anger <janger@samba.org>
* WHATSNEW: Add release notes for Samba 4.15.5.Jule Anger2022-01-311-2/+56
| | | | Signed-off-by: Jule Anger <janger@samba.org>
* CVE-2021-44141: s3: smbd: Inside rename_internals_fsp(), we must use ↵Jeremy Allison2022-01-312-2/+1
| | | | | | | | | | | | | vfs_stat() for existence, not SMB_VFS_STAT(). We need to take SMB1+POSIX into account here and do an LSTAT if it's a POSIX name. Remove knownfail.d/posix_sylink_rename BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: torture: Add a test ↵Jeremy Allison2022-01-313-0/+192
| | | | | | | | | | samba3.blackbox.test_symlink_rename.SMB1.posix that shows we still leak target info across a SMB1+POSIX rename. Add a knownfail.d/posix_sylink_rename BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: Fix a subtle bug in the error returns from ↵Jeremy Allison2022-01-312-2/+36
| | | | | | | | | | | | | | | | filename_convert(). If filename_convert() fails to convert the path, we never call check_name(). This means we can return an incorrect error code (NT_STATUS_ACCESS_DENIED) if we ran into a symlink that points outside the share to a non-readable directory. We need to make sure in this case we always call check_name(). Remove knownfail.d/symlink_traversal. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: Inside check_reduced_name() ensure we return the ↵Jeremy Allison2022-01-312-5/+16
| | | | | | | | | | | | | | | | | | | | correct error codes when failing symlinks. NT_STATUS_OBJECT_PATH_NOT_FOUND for a path component failure. NT_STATUS_OBJECT_NAME_NOT_FOUND for a terminal component failure. Remove: samba3.blackbox.test_symlink_traversal.SMB1.posix samba3.blackbox.smbclient_s3.*.Ensure\ widelinks\ are\ restricted\(.*\) samba3.blackbox.smbclient_s3.*.follow\ symlinks\ \=\ no\(.*\) in knownfail.d/symlink_traversal as we now pass these. Only one more fix remaining to get rid of knownfail.d/symlink_traversal completely. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: For SMB1+POSIX clients trying to open a symlink, ↵Jeremy Allison2022-01-312-8/+6
| | | | | | | | | | | | | | | always return NT_STATUS_OBJECT_NAME_NOT_FOUND. Matches the error return from openat_pathref_fsp(). NT_STATUS_OBJECT_PATH_NOT_FOUND is for a bad component in a path, not a bad terminal symlink. Remove knownfail.d/simple_posix_open, we now pass. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: torture: Change expected error return for ↵Jeremy Allison2022-01-312-2/+3
| | | | | | | | | | | | | samba3.smbtorture_s3.plain.POSIX.smbtorture. Trying to open a symlink as a terminal component should return NT_STATUS_OBJECT_NAME_NOT_FOUND, not NT_STATUS_OBJECT_PATH_NOT_FOUND. Mark as knownfail.d/simple_posix_open until we fix the server. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: torture: In test_smbclient_s3, change the error codes ↵Jeremy Allison2022-01-313-6/+8
| | | | | | | | | | | | | expected for test_widelinks() and test_nosymlinks() from ACCESS_DENIED to NT_STATUS_OBJECT_NAME_NOT_FOUND. For SMB1/2/3 (minus posix) we need to treat bad symlinks as though they don't exist. Add to knwownfail.d/symlink_traversal BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: torture: Add ↵Jeremy Allison2022-01-313-0/+276
| | | | | | | | | | samba3.blackbox.test_symlink_traversal.SMB1.posix Add to knownfail.d/symlink_traversal. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: torture: Add samba3.blackbox.test_symlink_traversal.SMB1.Jeremy Allison2022-01-313-0/+268
| | | | | | | | Add to knownfail.d/symlink_traversal. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: torture: Add samba3.blackbox.test_symlink_traversal.SMB2.Jeremy Allison2022-01-313-0/+270
| | | | | | | | Add to knownfail.d/symlink_traversal BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbtorture3: Fix POSIX-BLOCKING-LOCK to actually ↵Jeremy Allison2022-01-312-1/+5
| | | | | | | | | | | | | | | | negotiate SMB1+POSIX before using POSIX calls. This must be done before doing POSIX calls on a connection. Remove the final entry in knownfail.d/posix_infolevel_fails samba3.smbtorture_s3.plain.POSIX-BLOCKING-LOCK.smbtorture\(nt4_dc_smb1\) And remove the file knownfail.d/posix_infolevel_fails itself. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: tests: Fix the samba3.blackbox.acl_xattr test to ↵Jeremy Allison2022-01-312-9/+6
| | | | | | | | | | | | | | actually negotiate SMB1+POSIX before using POSIX calls. Remove the following entries in knownfail.d/posix_infolevel_fails. samba3.blackbox.acl_xattr.NT1.nt_affects_posix.* samba3.blackbox.acl_xattr.NT1.nt_affects_chown.* samba3.blackbox.acl_xattr.NT1.nt_affects_chgrp.* BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: tests: Fix the samba3.blackbox.inherit_owner test to ↵Jeremy Allison2022-01-312-2/+1
| | | | | | | | | | | | actually negotiate SMB1+POSIX before using POSIX calls. Remove the following entry in knownfail.d/posix_infolevel_fails. samba3.blackbox.inherit_owner.*.NT1.*verify.*unix\ owner.* BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s4: torture: Fix unix.info2 test to actually negotiate ↵Jeremy Allison2022-01-312-4/+40
| | | | | | | | | | | | | | | | | SMB1+POSIX before using POSIX calls. Cope with the minor difference in wildcard search return when we're actually using SMB1+POSIX on the server (SMB1+POSIX treats all directory search paths as wildcards). Remove the following entries in knownfail.d/posix_infolevel_fails. samba3.unix.info2.info2\(nt4_dc_smb1\) samba3.unix.info2.info2\(ad_dc_smb1\) BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s4: torture: Fix raw.search:test_one_file() by using the ↵Jeremy Allison2022-01-312-3/+11
| | | | | | | | | | | | | | SMB1+POSIX connection for POSIX info levels. Remove the following entry in knownfail.d/posix_infolevel_fails. ^samba3.raw.search.one\ file\ search.* from knownfail.d/posix_infolevel_fails BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s4: torture: raw.search: Add setup_smb1_posix(). Call it on ↵Jeremy Allison2022-01-311-0/+59
| | | | | | | | | | the second connection in test_one_file(). Not yet used. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s4: torture: In raw.search:test_one_file() add a second ↵Jeremy Allison2022-01-311-3/+4
| | | | | | | | | | | | | connection. Change from torture_suite_add_1smb_test() to torture_suite_add_2smb_test(). Not yet used. We will need this to do SMB1+POSIX search calls on a connection on which we have negotiated SMB1+POSIX. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbclient: Give a message if we try and use any POSIX ↵Jeremy Allison2022-01-311-0/+79
| | | | | | | | | | | | command without negotiating POSIX first. Ensure we only use a POSIX command if POSIX is set up. Issue the message: Command "posix" must be issued before the "XXXX" command can be used. After the parameter parsing has been done. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: Tighten up info level checks for SMB1+POSIX to ↵Jeremy Allison2022-01-312-6/+62
| | | | | | | | | | | | | | | | | | | | | | | | | | make sure POSIX was negotiated first. Add knownfail file knownfail.d/posix_infolevel_fails for tests that don't currently negotiate SMB1+POSIX before using SMB1+POSIX calls. These are: samba3.smbtorture_s3.plain.POSIX-BLOCKING-LOCK.smbtorture\(nt4_dc_smb1\) samba3.blackbox.acl_xattr.NT1.nt_affects_posix.* samba3.blackbox.acl_xattr.NT1.nt_affects_chown.* samba3.blackbox.acl_xattr.NT1.nt_affects_chgrp.* samba3.blackbox.inherit_owner.*.NT1.*verify.*unix\ owner.* samba3.unix.info2.info2\(nt4_dc_smb1\) samba3.unix.info2.info2\(ad_dc_smb1\) samba3.raw.search.one\ file\ search.* BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s4: torture: In raw.search:test_one_file() remove the ↵Jeremy Allison2022-01-311-11/+11
| | | | | | | | | | | leading '\\' in the test filenames. We'll soon be using this under SMB1+POSIX and neither Windows or POSIX need a leading '\\' (and SMB1+POSIX sees the '\\' as part of the name). BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s4: torture: Fix raw.search:test_one_file() to use ↵Jeremy Allison2022-01-311-19/+41
| | | | | | | | | | torture_result() instead of printf. I think this test pre-dates torture_result. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: Remove 'struct uc_state' name_has_wildcard element.Jeremy Allison2022-01-311-1/+0
| | | | | | | | It is never set or looked at. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: In unix_convert_step_stat() remove use of ↵Jeremy Allison2022-01-311-6/+2
| | | | | | | | | | state->name_was_wildcard. It can never be true. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: In unix_convert_step() remove all use of ↵Jeremy Allison2022-01-311-21/+2
| | | | | | | | | | 'state->name_was_wildcard' We know it is never true. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: In unix_convert() remove the now unneeded block ↵Jeremy Allison2022-01-311-98/+95
| | | | | | | | | | | | | indentation. We removed the 'if (state->name_has_wildcard) {' clause, so the block no longer needs indenting. Best seen with git show -b. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: In unix_convert(), remove all references to ↵Jeremy Allison2022-01-311-23/+2
| | | | | | | | | | state->name_has_wildcard. It is never set. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: Inside unix_convert(), never set ↵Jeremy Allison2022-01-311-2/+2
| | | | | | | | | | | state->name_is_wildcard. We error out immediately if it's set anyway. Preparing to remove 'state->name_is_wildcard' structure element. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: UCF_ALWAYS_ALLOW_WCARD_LCOMP 0x00000002 is no ↵Jeremy Allison2022-01-312-4/+1
| | | | | | | | | | longer used. Hurrah ! BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: We no longer need determine_path_error().Jeremy Allison2022-01-311-45/+2
| | | | | | | | | | Now we don't have to consider wildcards just return NT_STATUS_OBJECT_PATH_NOT_FOUND for the cases we used to call it. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: Inside 'struct uc_state', remove ↵Jeremy Allison2022-01-311-5/+3
| | | | | | | | | | allow_wcard_last_component. This is never allowed. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: filename_convert() no longer deals with wildcards.Jeremy Allison2022-01-311-9/+0
| | | | | | | | | | | These are already errored out with NT_STATUS_OBJECT_NAME_INVALID in the unix_convert() code. Remove the check. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: parse_dfs_path() can ignore wildcards.Jeremy Allison2022-01-311-6/+0
| | | | | | | | | If one is passed to filename_convert(), it will error out there with NT_STATUS_OBJECT_NAME_INVALID. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: Remove 'bool search_wcard_flag' from parse_dfs_path().Jeremy Allison2022-01-311-2/+1
| | | | | | | | Never set. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: dfs_path_lookup() no longer deals with wildcards.Jeremy Allison2022-01-311-13/+0
| | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: Fix call_trans2findfirst() to use ↵Jeremy Allison2022-01-311-91/+8
| | | | | | | | | | | filename_convert_smb1_search_path(). filename_convert() no longer has to handle wildcards. UCF_ALWAYS_ALLOW_WCARD_LCOMP is now unused. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: Convert reply_search() to use ↵Jeremy Allison2022-01-311-55/+16
| | | | | | | | | | filename_convert_smb1_search_path(). Cleans up this code path nicely ! BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: Add filename_convert_smb1_search_path() - deals ↵Jeremy Allison2022-01-312-0/+246
| | | | | | | | | | | | | | | | | | | | | | | | | with SMB1 search pathnames. SMB1search and trans2 findfirst are unique in that they are the only passed in pathnames that can contain a terminal wildcard component. Deal with these two special cases with this new function that strips off the terminal wildcard and returns as the mask, and pass the non-wildcard parent directory component through the standard filename_convert(). Uses new helper function strip_gmt_from_raw_dfs(). When SMB1search and trans2 findfirst have been converted to use this function, we can strip all wildcard handling out of filename_convert() as we now know it will only ever be given valid pathnames. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: Allow dfs_redirect() to return a TWRP token it got ↵Jeremy Allison2022-01-313-3/+12
| | | | | | | | | | | | | | from a parsed pathname. This one is subtle. If an SMB1 request has both a DFS path and a @GMT token, the unix_convert() inside the DFS path processing will remove the @GMT token, not allowing the subsequent unix_convert() inside filename_convert() to see it. By returning it from dfs_redirect() we can ensure it's correctly added to the smb_filename returned from filename_convert(). BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: In dfs_path_lookup(). If we have a DFS path ↵Jeremy Allison2022-01-311-0/+7
| | | | | | | | | | including a @GMT-token, don't throw away the twrp value when parsing the path. Not yet used. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: filename_convert() is now a one-to-one wrapper ↵Jeremy Allison2022-01-311-34/+12
| | | | | | | | | | | around filename_convert_internal(). Remove filename_convert() and rename filename_convert_internal() -> filename_convert(). Move the old DEBUG(..) statements to DBG_XXX() so they don't print the wrong name. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: Remove now unused check_reduced_name_with_privilege().Jeremy Allison2022-01-312-176/+0
| | | | | | | | | We now only have one function that does this check (check_reduced_name()), used everywhere. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: Remove unused check_name_with_privilege().Jeremy Allison2022-01-311-21/+0
| | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: In filename_convert_internal(), remove call to ↵Jeremy Allison2022-01-311-4/+3
| | | | | | | | | | | | | | check_name_with_privilege(). We now always pass NULL as struct smb_request *smbreq, so this code path can never be taken. Comment out check_name_with_privilege() as it's now no longer used. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: Remove filename_convert_with_privilege(). No ↵Jeremy Allison2022-01-312-27/+0
| | | | | | | | longer used. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: In call_trans2findfirst() we don't need ↵Jeremy Allison2022-01-311-9/+2
| | | | | | | | | | | | | filename_convert_with_privilege() anymore. It was extra-paranoid code now not needed as the new VFS version of filename_convert() does the same job. There are now no remaining callers of filename_convert_with_privilege(). BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: Remove split_fname_dir_mask().Jeremy Allison2022-01-311-34/+0
| | | | | | | | No longer used. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: In rename_internals(), remove the name spliting ↵Jeremy Allison2022-01-311-65/+2
| | | | | | | | | | | | | | and re-combining code. filename_convert() handles mangled names just fine, so we don't need to split the last component and check for mangle. Now we don't take wildcard names this is not needed. This was the last caller of split_fname_dir_mask(), so ifdef it out. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
* CVE-2021-44141: s3: smbd: check_name() is now static to filename.cJeremy Allison2022-01-312-3/+1
| | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911 Signed-off-by: Jeremy Allison <jra@samba.org>
View Lorry Controller Status