Fix bug #8541 - readlink() on Linux clients fails if the symlink target is outside...

The key is to only allow the lookup to succeed if it's a UNIX level lookup or readlink,
but disallow all other operations.
(cherry picked from commit 9685fb343de057598752d8f43d43523cab5c4356)

diff --git a/source3/include/proto.h b/source3/include/proto.h
index 2b20cc4f473ae713056f5f3745d8083772b25aac..8afc2e7161f1e732cb0423238b79e1439f95faa3 100644 (file)
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -6354,6 +6354,7 @@ NTSTATUS unix_convert(TALLOC_CTX *ctx,
                      const char *orig_path,
                      struct smb_filename **smb_fname,
                      uint32_t ucf_flags);
+NTSTATUS check_veto_path(connection_struct *conn, const char *name);
 NTSTATUS check_name(connection_struct *conn, const char *name);
 int get_real_filename(connection_struct *conn, const char *path,
                      const char *name, TALLOC_CTX *mem_ctx,

diff --git a/source3/include/smb.h b/source3/include/smb.h
index 202f9d77db6ea03a22ea994d26acc483a231ea4a..4b5c49b2e4f946420a23ff395c2982feff73e86a 100644 (file)
--- a/source3/include/smb.h
+++ b/source3/include/smb.h
@@ -1957,6 +1957,7 @@ struct smb_file_time {
 #define UCF_ALWAYS_ALLOW_WCARD_LCOMP   0x00000002
 #define UCF_COND_ALLOW_WCARD_LCOMP     0x00000004
 #define UCF_POSIX_PATHNAMES            0x00000008
+#define UCF_UNIX_NAME_LOOKUP           0x00000010
 
 /*
  * smb_filename

diff --git a/source3/smbd/filename.c b/source3/smbd/filename.c
index 84bdd408e9e52940c8a6f5bdc243a02a218d7bfa..2ea9d24f873eaf52b9887c8fa2a5545ef222dc6c 100644 (file)
--- a/source3/smbd/filename.c
+++ b/source3/smbd/filename.c
@@ -839,25 +839,39 @@ NTSTATUS unix_convert(TALLOC_CTX *ctx,
 }
 
 /****************************************************************************
- Check a filename - possibly calling check_reduced_name.
- This is called by every routine before it allows an operation on a filename.
- It does any final confirmation necessary to ensure that the filename is
- a valid one for the user to access.
+ Ensure a path is not vetod.
 ****************************************************************************/
 
-NTSTATUS check_name(connection_struct *conn, const char *name)
+NTSTATUS check_veto_path(connection_struct *conn, const char *name)
 {
        if (IS_VETO_PATH(conn, name))  {
                /* Is it not dot or dot dot. */
                if (!(ISDOT(name) || ISDOTDOT(name))) {
-                       DEBUG(5,("check_name: file path name %s vetoed\n",
+                       DEBUG(5,("check_veto_path: file path name %s vetoed\n",
                                                name));
                        return map_nt_error_from_unix(ENOENT);
                }
        }
+       return NT_STATUS_OK;
+}
+
+/****************************************************************************
+ Check a filename - possibly calling check_reduced_name.
+ This is called by every routine before it allows an operation on a filename.
+ It does any final confirmation necessary to ensure that the filename is
+ a valid one for the user to access.
+****************************************************************************/
+
+NTSTATUS check_name(connection_struct *conn, const char *name)
+{
+       NTSTATUS status = check_veto_path(conn, name);
+
+       if (!NT_STATUS_IS_OK(status)) {
+               return status;
+       }
 
        if (!lp_widelinks(SNUM(conn)) || !lp_symlinks(SNUM(conn))) {
-               NTSTATUS status = check_reduced_name(conn,name);
+               status = check_reduced_name(conn,name);
                if (!NT_STATUS_IS_OK(status)) {
                        DEBUG(5,("check_name: name %s failed with %s\n",name,
                                                nt_errstr(status)));
@@ -1175,6 +1189,12 @@ NTSTATUS filename_convert(TALLOC_CTX *ctx,
                return status;
        }
 
+       if ((ucf_flags & UCF_UNIX_NAME_LOOKUP) &&
+                       VALID_STAT((*pp_smb_fname)->st) &&
+                       S_ISLNK((*pp_smb_fname)->st.st_ex_mode)) {
+               return check_veto_path(conn, (*pp_smb_fname)->base_name);
+       }
+
        status = check_name(conn, (*pp_smb_fname)->base_name);
        if (!NT_STATUS_IS_OK(status)) {
                DEBUG(3,("filename_convert: check_name failed "

diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c
index 88ac17d81ed00179f8b005b7cceb5b6bc726bb4a..6cadc8cc4e71791b0ab56abdf17ae9c14e64848c 100644 (file)
--- a/source3/smbd/trans2.c
+++ b/source3/smbd/trans2.c
@@ -2233,6 +2233,7 @@ static void call_trans2findfirst(connection_struct *conn,
        TALLOC_CTX *ctx = talloc_tos();
        struct dptr_struct *dirptr = NULL;
        struct smbd_server_connection *sconn = smbd_server_conn;
+       uint32_t ucf_flags = (UCF_SAVE_LCOMP | UCF_ALWAYS_ALLOW_WCARD_LCOMP);
 
        if (total_params < 13) {
                reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
@@ -2276,6 +2277,7 @@ close_if_end = %d requires_resume_key = %d level = 0x%x, max_data_bytes = %d\n",
                                reply_nterror(req, NT_STATUS_INVALID_LEVEL);
                                goto out;
                        }
+                       ucf_flags |= UCF_UNIX_NAME_LOOKUP;
                        break;
                default:
                        reply_nterror(req, NT_STATUS_INVALID_LEVEL);
@@ -5089,6 +5091,7 @@ static void call_trans2qfilepathinfo(connection_struct *conn,
 
        } else {
                char *fname = NULL;
+               uint32_t ucf_flags = 0;
 
                /* qpathinfo */
                if (total_params < 7) {
@@ -5100,9 +5103,16 @@ static void call_trans2qfilepathinfo(connection_struct *conn,
 
                DEBUG(3,("call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = %d\n", info_level));
 
-               if (INFO_LEVEL_IS_UNIX(info_level) && !lp_unix_extensions()) {
-                       reply_nterror(req, NT_STATUS_INVALID_LEVEL);
-                       return;
+               if (INFO_LEVEL_IS_UNIX(info_level)) {
+                       if (!lp_unix_extensions()) {
+                               reply_nterror(req, NT_STATUS_INVALID_LEVEL);
+                               return;
+                       }
+                       if (info_level == SMB_QUERY_FILE_UNIX_BASIC ||
+                                       info_level == SMB_QUERY_FILE_UNIX_INFO2 ||
+                                       info_level == SMB_QUERY_FILE_UNIX_LINK) {
+                               ucf_flags |= UCF_UNIX_NAME_LOOKUP;
+                       }
                }
 
                srvstr_get_path(req, params, req->flags2, &fname, &params[6],
@@ -5117,7 +5127,7 @@ static void call_trans2qfilepathinfo(connection_struct *conn,
                                        conn,
                                        req->flags2 & FLAGS2_DFS_PATHNAMES,
                                        fname,
-                                       0,
+                                       ucf_flags,
                                        NULL,
                                        &smb_fname);
                if (!NT_STATUS_IS_OK(status)) {