Jule Anger [Mon, 31 Jan 2022 09:39:24 +0000 (10:39 +0100)]
VERSION: Disable GIT_SNAPSHOT for the 4.15.5 release.
Signed-off-by: Jule Anger <janger@samba.org>
Jule Anger [Mon, 31 Jan 2022 09:34:04 +0000 (10:34 +0100)]
WHATSNEW: Add release notes for Samba 4.15.5.
Signed-off-by: Jule Anger <janger@samba.org>
Jeremy Allison [Wed, 8 Dec 2021 06:19:29 +0000 (22:19 -0800)]
CVE-2021-44141: s3: smbd: Inside rename_internals_fsp(), we must use vfs_stat() for existence, not SMB_VFS_STAT().
We need to take SMB1+POSIX into account here and do an LSTAT if it's
a POSIX name.
Remove knownfail.d/posix_sylink_rename
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Wed, 8 Dec 2021 06:15:46 +0000 (22:15 -0800)]
CVE-2021-44141: s3: torture: Add a test samba3.blackbox.test_symlink_rename.SMB1.posix that shows we still leak target info across a SMB1+POSIX rename.
Add a knownfail.d/posix_sylink_rename
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Tue, 7 Dec 2021 22:39:42 +0000 (14:39 -0800)]
CVE-2021-44141: s3: smbd: Fix a subtle bug in the error returns from filename_convert().
If filename_convert() fails to convert the path, we never call
check_name(). This means we can return an incorrect error code
(NT_STATUS_ACCESS_DENIED) if we ran into a symlink that points
outside the share to a non-readable directory. We need to make
sure in this case we always call check_name().
Remove knownfail.d/symlink_traversal.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Tue, 7 Dec 2021 22:33:17 +0000 (14:33 -0800)]
CVE-2021-44141: s3: smbd: Inside check_reduced_name() ensure we return the correct error codes when failing symlinks.
NT_STATUS_OBJECT_PATH_NOT_FOUND for a path component failure.
NT_STATUS_OBJECT_NAME_NOT_FOUND for a terminal component failure.
Remove:
samba3.blackbox.test_symlink_traversal.SMB1.posix
samba3.blackbox.smbclient_s3.*.Ensure\ widelinks\ are\ restricted\(.*\)
samba3.blackbox.smbclient_s3.*.follow\ symlinks\ \=\ no\(.*\)
in knownfail.d/symlink_traversal as we now pass these. Only one more fix
remaining to get rid of knownfail.d/symlink_traversal completely.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Tue, 7 Dec 2021 19:44:09 +0000 (11:44 -0800)]
CVE-2021-44141: s3: smbd: For SMB1+POSIX clients trying to open a symlink, always return NT_STATUS_OBJECT_NAME_NOT_FOUND.
Matches the error return from openat_pathref_fsp().
NT_STATUS_OBJECT_PATH_NOT_FOUND is for a bad component in a path, not
a bad terminal symlink.
Remove knownfail.d/simple_posix_open, we now pass.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Wed, 8 Dec 2021 01:56:35 +0000 (17:56 -0800)]
CVE-2021-44141: s3: torture: Change expected error return for samba3.smbtorture_s3.plain.POSIX.smbtorture.
Trying to open a symlink as a terminal component should return
NT_STATUS_OBJECT_NAME_NOT_FOUND, not NT_STATUS_OBJECT_PATH_NOT_FOUND.
Mark as knownfail.d/simple_posix_open until we fix the server.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Tue, 7 Dec 2021 20:56:51 +0000 (12:56 -0800)]
CVE-2021-44141: s3: torture: In test_smbclient_s3, change the error codes expected for test_widelinks() and test_nosymlinks() from ACCESS_DENIED to NT_STATUS_OBJECT_NAME_NOT_FOUND.
For SMB1/2/3 (minus posix) we need to treat bad symlinks
as though they don't exist.
Add to knwownfail.d/symlink_traversal
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Tue, 7 Dec 2021 20:34:38 +0000 (12:34 -0800)]
CVE-2021-44141: s3: torture: Add samba3.blackbox.test_symlink_traversal.SMB1.posix
Add to knownfail.d/symlink_traversal.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Tue, 7 Dec 2021 20:32:19 +0000 (12:32 -0800)]
CVE-2021-44141: s3: torture: Add samba3.blackbox.test_symlink_traversal.SMB1.
Add to knownfail.d/symlink_traversal.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Tue, 7 Dec 2021 20:28:54 +0000 (12:28 -0800)]
CVE-2021-44141: s3: torture: Add samba3.blackbox.test_symlink_traversal.SMB2.
Add to knownfail.d/symlink_traversal
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Thu, 18 Nov 2021 20:16:44 +0000 (12:16 -0800)]
CVE-2021-44141: s3: smbtorture3: Fix POSIX-BLOCKING-LOCK to actually negotiate SMB1+POSIX before using POSIX calls.
This must be done before doing POSIX calls on a connection.
Remove the final entry in knownfail.d/posix_infolevel_fails
samba3.smbtorture_s3.plain.POSIX-BLOCKING-LOCK.smbtorture\(nt4_dc_smb1\)
And remove the file knownfail.d/posix_infolevel_fails itself.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Fri, 19 Nov 2021 08:05:35 +0000 (00:05 -0800)]
CVE-2021-44141: s3: tests: Fix the samba3.blackbox.acl_xattr test to actually negotiate SMB1+POSIX before using POSIX calls.
Remove the following entries in knownfail.d/posix_infolevel_fails.
samba3.blackbox.acl_xattr.NT1.nt_affects_posix.*
samba3.blackbox.acl_xattr.NT1.nt_affects_chown.*
samba3.blackbox.acl_xattr.NT1.nt_affects_chgrp.*
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Fri, 19 Nov 2021 20:12:36 +0000 (12:12 -0800)]
CVE-2021-44141: s3: tests: Fix the samba3.blackbox.inherit_owner test to actually negotiate SMB1+POSIX before using POSIX calls.
Remove the following entry in knownfail.d/posix_infolevel_fails.
samba3.blackbox.inherit_owner.*.NT1.*verify.*unix\ owner.*
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Fri, 19 Nov 2021 20:15:06 +0000 (12:15 -0800)]
CVE-2021-44141: s4: torture: Fix unix.info2 test to actually negotiate SMB1+POSIX before using POSIX calls.
Cope with the minor difference in wildcard search return when
we're actually using SMB1+POSIX on the server (SMB1+POSIX treats
all directory search paths as wildcards).
Remove the following entries in knownfail.d/posix_infolevel_fails.
samba3.unix.info2.info2\(nt4_dc_smb1\)
samba3.unix.info2.info2\(ad_dc_smb1\)
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Fri, 19 Nov 2021 22:51:39 +0000 (14:51 -0800)]
CVE-2021-44141: s4: torture: Fix raw.search:test_one_file() by using the SMB1+POSIX connection for POSIX info levels.
Remove the following entry in knownfail.d/posix_infolevel_fails.
^samba3.raw.search.one\ file\ search.*
from knownfail.d/posix_infolevel_fails
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Fri, 19 Nov 2021 22:48:20 +0000 (14:48 -0800)]
CVE-2021-44141: s4: torture: raw.search: Add setup_smb1_posix(). Call it on the second connection in test_one_file().
Not yet used.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Fri, 19 Nov 2021 22:44:05 +0000 (14:44 -0800)]
CVE-2021-44141: s4: torture: In raw.search:test_one_file() add a second connection.
Change from torture_suite_add_1smb_test() to torture_suite_add_2smb_test().
Not yet used. We will need this to do SMB1+POSIX search calls on
a connection on which we have negotiated SMB1+POSIX.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Sun, 21 Nov 2021 04:17:11 +0000 (20:17 -0800)]
CVE-2021-44141: s3: smbclient: Give a message if we try and use any POSIX command without negotiating POSIX first.
Ensure we only use a POSIX command if POSIX is set up.
Issue the message: Command "posix" must be issued before the "XXXX" command can be used.
After the parameter parsing has been done.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Thu, 18 Nov 2021 19:48:42 +0000 (11:48 -0800)]
CVE-2021-44141: s3: smbd: Tighten up info level checks for SMB1+POSIX to make sure POSIX was negotiated first.
Add knownfail file
knownfail.d/posix_infolevel_fails
for tests that don't currently negotiate
SMB1+POSIX before using SMB1+POSIX calls.
These are:
samba3.smbtorture_s3.plain.POSIX-BLOCKING-LOCK.smbtorture\(nt4_dc_smb1\)
samba3.blackbox.acl_xattr.NT1.nt_affects_posix.*
samba3.blackbox.acl_xattr.NT1.nt_affects_chown.*
samba3.blackbox.acl_xattr.NT1.nt_affects_chgrp.*
samba3.blackbox.inherit_owner.*.NT1.*verify.*unix\ owner.*
samba3.unix.info2.info2\(nt4_dc_smb1\)
samba3.unix.info2.info2\(ad_dc_smb1\)
samba3.raw.search.one\ file\ search.*
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Fri, 19 Nov 2021 22:18:47 +0000 (14:18 -0800)]
CVE-2021-44141: s4: torture: In raw.search:test_one_file() remove the leading '\\' in the test filenames.
We'll soon be using this under SMB1+POSIX and neither Windows or POSIX
need a leading '\\' (and SMB1+POSIX sees the '\\' as part of the name).
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Fri, 19 Nov 2021 20:54:47 +0000 (12:54 -0800)]
CVE-2021-44141: s4: torture: Fix raw.search:test_one_file() to use torture_result() instead of printf.
I think this test pre-dates torture_result.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Fri, 3 Dec 2021 21:06:27 +0000 (13:06 -0800)]
CVE-2021-44141: s3: smbd: Remove 'struct uc_state' name_has_wildcard element.
It is never set or looked at.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Fri, 3 Dec 2021 21:05:55 +0000 (13:05 -0800)]
CVE-2021-44141: s3: smbd: In unix_convert_step_stat() remove use of state->name_was_wildcard.
It can never be true.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Fri, 3 Dec 2021 21:03:47 +0000 (13:03 -0800)]
CVE-2021-44141: s3: smbd: In unix_convert_step() remove all use of 'state->name_was_wildcard'
We know it is never true.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Fri, 3 Dec 2021 20:59:50 +0000 (12:59 -0800)]
CVE-2021-44141: s3: smbd: In unix_convert() remove the now unneeded block indentation.
We removed the 'if (state->name_has_wildcard) {' clause, so
the block no longer needs indenting.
Best seen with git show -b.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Fri, 3 Dec 2021 20:55:41 +0000 (12:55 -0800)]
CVE-2021-44141: s3: smbd: In unix_convert(), remove all references to state->name_has_wildcard.
It is never set.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Fri, 3 Dec 2021 20:53:36 +0000 (12:53 -0800)]
CVE-2021-44141: s3: smbd: Inside unix_convert(), never set state->name_is_wildcard.
We error out immediately if it's set anyway.
Preparing to remove 'state->name_is_wildcard' structure element.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Fri, 3 Dec 2021 20:40:43 +0000 (12:40 -0800)]
CVE-2021-44141: s3: smbd: UCF_ALWAYS_ALLOW_WCARD_LCOMP 0x00000002 is no longer used.
Hurrah !
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Fri, 3 Dec 2021 20:37:15 +0000 (12:37 -0800)]
CVE-2021-44141: s3: smbd: We no longer need determine_path_error().
Now we don't have to consider wildcards just
return NT_STATUS_OBJECT_PATH_NOT_FOUND for
the cases we used to call it.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Fri, 3 Dec 2021 19:33:42 +0000 (11:33 -0800)]
CVE-2021-44141: s3: smbd: Inside 'struct uc_state', remove allow_wcard_last_component.
This is never allowed.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Fri, 3 Dec 2021 19:30:42 +0000 (11:30 -0800)]
CVE-2021-44141: s3: smbd: filename_convert() no longer deals with wildcards.
These are already errored out with NT_STATUS_OBJECT_NAME_INVALID
in the unix_convert() code.
Remove the check.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Fri, 3 Dec 2021 19:48:23 +0000 (11:48 -0800)]
CVE-2021-44141: s3: smbd: parse_dfs_path() can ignore wildcards.
If one is passed to filename_convert(), it will error out there
with NT_STATUS_OBJECT_NAME_INVALID.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Fri, 3 Dec 2021 19:42:23 +0000 (11:42 -0800)]
CVE-2021-44141: s3: smbd: Remove 'bool search_wcard_flag' from parse_dfs_path().
Never set.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Fri, 3 Dec 2021 19:31:40 +0000 (11:31 -0800)]
CVE-2021-44141: s3: smbd: dfs_path_lookup() no longer deals with wildcards.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Fri, 3 Dec 2021 19:28:40 +0000 (11:28 -0800)]
CVE-2021-44141: s3: smbd: Fix call_trans2findfirst() to use filename_convert_smb1_search_path().
filename_convert() no longer has to handle wildcards.
UCF_ALWAYS_ALLOW_WCARD_LCOMP is now unused.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Fri, 3 Dec 2021 19:22:03 +0000 (11:22 -0800)]
CVE-2021-44141: s3: smbd: Convert reply_search() to use filename_convert_smb1_search_path().
Cleans up this code path nicely !
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Fri, 3 Dec 2021 18:35:09 +0000 (10:35 -0800)]
CVE-2021-44141: s3: smbd: Add filename_convert_smb1_search_path() - deals with SMB1 search pathnames.
SMB1search and trans2 findfirst are unique in that
they are the only passed in pathnames that can contain
a terminal wildcard component.
Deal with these two special cases with this new function
that strips off the terminal wildcard and returns as
the mask, and pass the non-wildcard parent directory
component through the standard filename_convert().
Uses new helper function strip_gmt_from_raw_dfs().
When SMB1search and trans2 findfirst have been
converted to use this function, we can strip all
wildcard handling out of filename_convert() as
we now know it will only ever be given valid
pathnames.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Sat, 4 Dec 2021 00:14:08 +0000 (16:14 -0800)]
CVE-2021-44141: s3: smbd: Allow dfs_redirect() to return a TWRP token it got from a parsed pathname.
This one is subtle. If an SMB1 request has both a DFS path and a @GMT token,
the unix_convert() inside the DFS path processing will remove the @GMT
token, not allowing the subsequent unix_convert() inside filename_convert()
to see it. By returning it from dfs_redirect() we can ensure it's correctly
added to the smb_filename returned from filename_convert().
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Sat, 4 Dec 2021 00:00:26 +0000 (16:00 -0800)]
CVE-2021-44141: s3: smbd: In dfs_path_lookup(). If we have a DFS path including a @GMT-token, don't throw away the twrp value when parsing the path.
Not yet used.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Fri, 3 Dec 2021 18:19:38 +0000 (10:19 -0800)]
CVE-2021-44141: s3: smbd: filename_convert() is now a one-to-one wrapper around filename_convert_internal().
Remove filename_convert() and rename filename_convert_internal() -> filename_convert().
Move the old DEBUG(..) statements to DBG_XXX() so they don't print the wrong name.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Fri, 3 Dec 2021 18:14:03 +0000 (10:14 -0800)]
CVE-2021-44141: s3: smbd: Remove now unused check_reduced_name_with_privilege().
We now only have one function that does this check (check_reduced_name()),
used everywhere.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Fri, 3 Dec 2021 18:13:13 +0000 (10:13 -0800)]
CVE-2021-44141: s3: smbd: Remove unused check_name_with_privilege().
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Fri, 3 Dec 2021 18:10:45 +0000 (10:10 -0800)]
CVE-2021-44141: s3: smbd: In filename_convert_internal(), remove call to check_name_with_privilege().
We now always pass NULL as struct smb_request *smbreq,
so this code path can never be taken.
Comment out check_name_with_privilege() as it's now
no longer used.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Fri, 3 Dec 2021 01:55:26 +0000 (17:55 -0800)]
CVE-2021-44141: s3: smbd: Remove filename_convert_with_privilege(). No longer used.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Fri, 3 Dec 2021 01:51:42 +0000 (17:51 -0800)]
CVE-2021-44141: s3: smbd: In call_trans2findfirst() we don't need filename_convert_with_privilege() anymore.
It was extra-paranoid code now not needed as the new VFS
version of filename_convert() does the same job.
There are now no remaining callers of filename_convert_with_privilege().
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Fri, 10 Dec 2021 00:51:45 +0000 (16:51 -0800)]
CVE-2021-44141: s3: smbd: Remove split_fname_dir_mask().
No longer used.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Fri, 10 Dec 2021 00:49:46 +0000 (16:49 -0800)]
CVE-2021-44141: s3: smbd: In rename_internals(), remove the name spliting and re-combining code.
filename_convert() handles mangled names just fine, so we don't
need to split the last component and check for mangle.
Now we don't take wildcard names this is not needed. This was the
last caller of split_fname_dir_mask(), so ifdef it out.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Fri, 10 Dec 2021 00:47:13 +0000 (16:47 -0800)]
CVE-2021-44141: s3: smbd: check_name() is now static to filename.c
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Fri, 10 Dec 2021 00:45:13 +0000 (16:45 -0800)]
CVE-2021-44141: s3: smbd: In rename_internals_fsp(), remove unneeded call to check_name().
All callers have gone through filename_convert(), which has
already called check_name() on the destination.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Fri, 10 Dec 2021 00:35:17 +0000 (16:35 -0800)]
CVE-2021-44141: s3: smbd: Handling SMB_FILE_RENAME_INFORMATION, the destination name is a single component.
No errors should be allowed from filename_convert().
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Fri, 10 Dec 2021 00:16:52 +0000 (16:16 -0800)]
CVE-2021-44141: s3: smbd: Remove the old unlink_internals() implementation.
No longer used. filename_convert() already handles mangled
names just fine, so we don't need this logic.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Fri, 10 Dec 2021 00:14:40 +0000 (16:14 -0800)]
CVE-2021-44141: s3: smbd: Comment out the old unlink_internals(). Rename do_unlink() -> unlink_internals().
One parameter needs changing position. The logic inside unlink_internals()
is no longer needed if it doesn't accept wildcards. filename_convert()
already handles mangled names just fine, so we don't need this logic.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Fri, 10 Dec 2021 00:11:20 +0000 (16:11 -0800)]
CVE-2021-44141: s3: smbd: Move to modern debug calls inside do_unlink().
We will be changing its name next.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Fri, 10 Dec 2021 00:08:07 +0000 (16:08 -0800)]
CVE-2021-44141: s3: smbd: Move setting of dirtype if FILE_ATTRIBUTE_NORMAL to do_unlink().
Now we don't use wildcards when calling in unlink_internals()
the logic inside it serves no purpose and can be replaced with
a direct call to do_unlink() (which we will rename to unlink_internals()).
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Jeremy Allison [Thu, 2 Dec 2021 00:40:55 +0000 (16:40 -0800)]
CVE-2021-44141: s3: smbd: Remove 'const char *src_original_lcomp' from reply_mv().
No longer used.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Jeremy Allison [Thu, 2 Dec 2021 00:39:42 +0000 (16:39 -0800)]
CVE-2021-44141: s3: smbd: Remove 'const char *src_original_lcomp' parameter from rename_internals().
No longer used.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Jeremy Allison [Thu, 2 Dec 2021 00:35:54 +0000 (16:35 -0800)]
CVE-2021-44141: s3: smbd: Inside rename_internals() remove '{ ... }' block around singleton rename code.
Best viewed with 'git show -b'
As we're touching the DEBUG() code, change it to modern DBG_NOTICE().
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Jeremy Allison [Thu, 2 Dec 2021 00:31:36 +0000 (16:31 -0800)]
CVE-2021-44141: s3: smbd: Remove the commented out resolve_wildcards().
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Jeremy Allison [Thu, 2 Dec 2021 00:29:43 +0000 (16:29 -0800)]
CVE-2021-44141: s3: smbd: Remove all wildcard code from rename_internals().
We no longer use resolve_wildcards() so comment it out
for later removal. Keep the '{ ... }' block around the
singleton rename for now, to keep the diff small.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Jeremy Allison [Thu, 2 Dec 2021 00:26:28 +0000 (16:26 -0800)]
CVE-2021-44141: s3: smbd: Remove dest_has_wild and all associated code from rename_internals()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Jeremy Allison [Thu, 2 Dec 2021 00:25:03 +0000 (16:25 -0800)]
CVE-2021-44141: s3: smbd: Prepare to remove wildcard matching from rename_internals().
src_has_wild and dest_has_wild can never be true.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Jeremy Allison [Thu, 2 Dec 2021 00:17:51 +0000 (16:17 -0800)]
CVE-2021-44141: s3: smbd: In reply_ntrename() remove 'bool dest_has_wcard' and all uses.
It's always false now.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Jeremy Allison [Thu, 2 Dec 2021 00:14:57 +0000 (16:14 -0800)]
CVE-2021-44141: s3: smbd: In reply_ntrename(), never set dest_has_wcard.
It can never be true.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Jeremy Allison [Thu, 2 Dec 2021 00:12:46 +0000 (16:12 -0800)]
CVE-2021-44141: s3: smbd: In reply_ntrename() remove the UCF_ALWAYS_ALLOW_WCARD_LCOMP flag for destination lookups.
We know the destination will never be a wildcard.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Jeremy Allison [Thu, 2 Dec 2021 00:08:13 +0000 (16:08 -0800)]
CVE-2021-44141: s3: smbd: In SMBntrename (0xa5) prevent wildcards in destination name.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Jeremy Allison [Thu, 2 Dec 2021 00:07:07 +0000 (16:07 -0800)]
CVE-2021-44141: s3: smbd: In smb_file_rename_information() (SMB_FILE_RENAME_INFORMATION info level) prevent destination wildcards.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Jeremy Allison [Wed, 1 Dec 2021 21:56:31 +0000 (13:56 -0800)]
CVE-2021-44141: s3: smbd: Remove UCF_ALWAYS_ALLOW_WCARD_LCOMP flag from pathname processing in reply_mv().
We are no longer supporting wildcard rename via SMBmv (0x7)
as WindowsXP SMB1 and above do not use it.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Jeremy Allison [Wed, 1 Dec 2021 21:03:03 +0000 (13:03 -0800)]
CVE-2021-44141: s3: smbd: Remove 'bool has_wild' parameter from unlink_internals().
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Jeremy Allison [Wed, 1 Dec 2021 20:53:29 +0000 (12:53 -0800)]
CVE-2021-44141: s3: smbd: Change unlink_internals() to ignore has_wild parameter.
It's always passed as false now so we can remove the (horrible)
enumeration code for unlink.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Jeremy Allison [Wed, 1 Dec 2021 20:31:44 +0000 (12:31 -0800)]
CVE-2021-44141: s3: smbd: In reply_unlink() remove the possibility of receiving a wildcard name.
This was the only user of "has_wild=true" passed to
unlink_internals().
Next commit will remove this functionality from unlink_internals().
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Jeremy Allison [Wed, 1 Dec 2021 20:24:07 +0000 (12:24 -0800)]
CVE-2021-44141: s3: smbd: Remove support for SMBcopy SMB_COM_COPY (0x29)
It's not used in our client code or tested.
From MS-CIFS.
This command was introduced in the LAN Manager 1.0 dialect
It was rendered obsolete in the NT LAN Manager dialect.
This command was used to perform server-side file copies, but
is no longer used. Clients SHOULD
NOT send requests using this command code.
Servers receiving requests with this command code
SHOULD return STATUS_NOT_IMPLEMENTED (ERRDOS/ERRbadfunc).
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Jeremy Allison [Wed, 1 Dec 2021 20:18:35 +0000 (12:18 -0800)]
CVE-2021-44141: s3: torture: Remove the wildcard unlink test code.
This is pre WindowXP SMB1 functionality, and we
need to remove this from the server in order to
move towards SMB2-only, so the test must go.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Jeremy Allison [Wed, 1 Dec 2021 21:22:39 +0000 (13:22 -0800)]
CVE-2021-44141: s4: torture: Remove the wildcard rename test code.
This is pre WindowXP SMB1 functionality, and we
need to remove this from the server in order to
move towards SMB2-only, so the test must go.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Jeremy Allison [Wed, 1 Dec 2021 20:05:20 +0000 (12:05 -0800)]
CVE-2021-44141: s4: torture: Remove the wildcard unlink test code.
This is pre WindowXP SMB1 functionality, and we
need to remove this from the server in order to
move towards SMB2-only, so the test must go.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Jeremy Allison [Thu, 2 Dec 2021 22:10:41 +0000 (14:10 -0800)]
CVE-2021-44141: s3: torture: In run_smb1_wild_mangle_unlink_test() use a valid pathname for rename target.
The server will not be supporting wildcard rename soon.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Jeremy Allison [Thu, 2 Dec 2021 22:21:47 +0000 (14:21 -0800)]
CVE-2021-44141: s3: torture: In torture_mangle(), use torture_deltree() for setup and cleanup.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Jeremy Allison [Thu, 2 Dec 2021 22:20:07 +0000 (14:20 -0800)]
CVE-2021-44141: s3: torture: In test_mask(), use torture_deltree() for setup.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Jeremy Allison [Thu, 2 Dec 2021 22:18:56 +0000 (14:18 -0800)]
CVE-2021-44141: s3: torture: In run_streamerror(), use torture_deltree() for setup.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Jeremy Allison [Thu, 2 Dec 2021 22:16:38 +0000 (14:16 -0800)]
CVE-2021-44141: s3: torture: In torture_chkpath_test(), use torture_deltree() for setup and cleanup.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Jeremy Allison [Thu, 2 Dec 2021 22:14:53 +0000 (14:14 -0800)]
CVE-2021-44141: s3: torture: In torture_casetable(), use torture_deltree() for setup and cleanup.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Jeremy Allison [Thu, 2 Dec 2021 22:13:41 +0000 (14:13 -0800)]
CVE-2021-44141: s3: torture: In torture_utable(), use torture_deltree() for setup.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Jeremy Allison [Wed, 1 Dec 2021 21:51:12 +0000 (13:51 -0800)]
CVE-2021-44141: s3: torture: In run_smb1_wild_mangle_rename_test() use torture_deltree() for setup and cleanup.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Jeremy Allison [Wed, 1 Dec 2021 20:51:54 +0000 (12:51 -0800)]
CVE-2021-44141: s3: torture: In run_smb1_wild_mangle_unlink_test() use torture_deltree() for setup and cleanup.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Jeremy Allison [Thu, 2 Dec 2021 21:47:07 +0000 (13:47 -0800)]
CVE-2021-44141: s3: torture: Add torture_deltree() for setup and teardown.
Not yet used.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Jeremy Allison [Thu, 2 Dec 2021 22:23:10 +0000 (14:23 -0800)]
CVE-2021-44141: s4: libcli: smbcli_unlink() is no longer used with wildcard patterns.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Jeremy Allison [Thu, 2 Dec 2021 02:08:32 +0000 (18:08 -0800)]
CVE-2021-44141: s4: torture: Use smbcli_unlink_wcard() to setup and cleanup in masktest.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Jeremy Allison [Thu, 2 Dec 2021 02:03:57 +0000 (18:03 -0800)]
CVE-2021-44141: s4: torture: Use smbcli_unlink_wcard() in base.casetable test.
Avoid smbcli_unlink() calls with a wildcard path.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Jeremy Allison [Thu, 2 Dec 2021 01:58:58 +0000 (17:58 -0800)]
CVE-2021-44141: s4: torture: Use smbcli_unlink_wcard() to cleanup in base.mangle test.
Avoid using smbcli_unlink() calls with wildcard names.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Jeremy Allison [Thu, 2 Dec 2021 01:52:37 +0000 (17:52 -0800)]
CVE-2021-44141: s4: torture: Use smbcli_unlink_wcard() to remove wildcards in base.chkpath test.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Jeremy Allison [Thu, 2 Dec 2021 20:08:49 +0000 (12:08 -0800)]
CVE-2021-44141: s4: torture: In raw.notify test use smbcli_unlink_wcard() in place of smbcli_unlink().
We know we have a wildcard mask here.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Jeremy Allison [Thu, 2 Dec 2021 20:10:14 +0000 (12:10 -0800)]
CVE-2021-44141: s4: libcli: In smbcli_deltree() use smbcli_unlink_wcard() in place of smbcli_unlink().
We know we have a wildcard mask here.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Jeremy Allison [Thu, 2 Dec 2021 20:05:51 +0000 (12:05 -0800)]
CVE-2021-44141: s4: libcli: Add smbcli_unlink_wcard().
We will use this in place of smbcli_unlink() when we
know we are using a wildcard pattern. If can be used
to generally replace smbcli_unlink() as it calls down
to smbcli_unlink() is no wildcard is detected.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Ralph Boehme [Thu, 13 Jan 2022 16:03:02 +0000 (17:03 +0100)]
CVE-2021-44142: libadouble: harden parsing code
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14914
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Ralph Boehme [Thu, 25 Nov 2021 14:04:03 +0000 (15:04 +0100)]
CVE-2021-44142: libadouble: add basic cmocka tests
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14914
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
[slow@samba.org: conflict due to missing test in selftest/tests.py]
Ralph Boehme [Fri, 26 Nov 2021 06:19:32 +0000 (07:19 +0100)]
CVE-2021-44142: libadouble: harden ad_unpack_xattrs()
This ensures ad_unpack_xattrs() is only called for an ad_type of ADOUBLE_RSRC,
which is used for parsing ._ AppleDouble sidecar files, and the buffer
ad->ad_data is AD_XATTR_MAX_HDR_SIZE bytes large which is a prerequisite for all
buffer out-of-bounds access checks in ad_unpack_xattrs().
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14914
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Ralph Boehme [Sat, 20 Nov 2021 15:36:42 +0000 (16:36 +0100)]
CVE-2021-44142: smbd: add Netatalk xattr used by vfs_fruit to the list of private Samba xattrs
This is an internal xattr that should not be user visible.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14914
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Ralph Boehme [Thu, 13 Jan 2022 15:48:01 +0000 (16:48 +0100)]
CVE-2021-44142: libadouble: add defines for icon lengths
From https://www.ietf.org/rfc/rfc1740.txt
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14914
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Joseph Sutton [Mon, 17 Jan 2022 23:02:45 +0000 (12:02 +1300)]
CVE-2022-0336: s4/dsdb/samldb: Don't return early when an SPN is re-added to an object
If an added SPN already exists on an object, we still want to check the
rest of the element values for conflicts.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14950
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
git.samba.org / palcantara / samba-autobuild / .git / log