s3/smbd: let non_widelink_open() chdir() to directories directly

If the caller passes O_DIRECTORY we just try to chdir() to smb_fname
directly, not to the parent directory.

The security check in check_reduced_name() will continue to work, but
this fixes the case of an open() for a previous version of a
subdirectory that contains snapshopt.

Eg:

[share]
    path = /shares/test
    vfs objects = shadow_copy2
    shadow:snapdir = .snapshots
    shadow:snapdirseverywhere = yes

Directory tree with fake snapshots:

$ tree -a /shares/test/
/shares/test/
├── dir
│   ├── file
│   └── .snapshots
│       └── @GMT-2017.07.04-04.30.12
│           └── file
├── dir2
│   └── file
├── file
├── .snapshots
│   └── @GMT-2001.01.01-00.00.00
│       ├── dir2
│       │   └── file
│       └── file
└── testfsctl.dat

./bin/smbclient -U slow%x //localhost/share -c 'ls @GMT-2017.07.04-04.30.12/dir/*'
NT_STATUS_OBJECT_NAME_NOT_FOUND listing \@GMT-2017.07.04-04.30.12\dir\*

Bug: https://bugzilla.samba.org/show_bug.cgi?id=12885

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

diff --git a/source3/smbd/open.c b/source3/smbd/open.c
index 3ccee36e6f1993d20a04c19a7aa4555145eaaba4..7781a6f86a78ad1e15c7a5135ce5c39a36dc51f6 100644 (file)
--- a/source3/smbd/open.c
+++ b/source3/smbd/open.c
@@ -550,12 +550,32 @@ static int non_widelink_open(struct connection_struct *conn,
        char *parent_dir = NULL;
        struct smb_filename parent_dir_fname = {0};
        const char *final_component = NULL;
+       bool is_directory = false;
+       bool ok;
 
-       if (!parent_dirname(talloc_tos(),
-                       smb_fname->base_name,
-                       &parent_dir,
-                       &final_component)) {
-               goto out;
+#ifdef O_DIRECTORY
+       if (flags & O_DIRECTORY) {
+               is_directory = true;
+       }
+#endif
+
+       if (is_directory) {
+               parent_dir = talloc_strdup(talloc_tos(), smb_fname->base_name);
+               if (parent_dir == NULL) {
+                       saved_errno = errno;
+                       goto out;
+               }
+
+               final_component = ".";
+       } else {
+               ok = parent_dirname(talloc_tos(),
+                                   smb_fname->base_name,
+                                   &parent_dir,
+                                   &final_component);
+               if (!ok) {
+                       saved_errno = errno;
+                       goto out;
+               }
        }
 
        parent_dir_fname = (struct smb_filename) { .base_name = parent_dir };