The branch, master has been updated
via 2acad276860 s3: smbd: Don't leak meta-data about the containing
directory of the share root.
via b004ebb1c62 s3: smbd: Allow async dosmode to cope with ".."
pathnames where we close smb_fname->fsp to prevent meta-data leakage.
from 696972c832c selftest: Remove fips env variables from client env
https://git.samba.org/?p=samba.git;a=shortlog;h=master
- Log -----------------------------------------------------------------
commit 2acad27686074029ac83c66b42bb37eea380f449
Author: Jeremy Allison <j...@samba.org>
Date: Wed Jul 14 19:11:05 2021 -0700
s3: smbd: Don't leak meta-data about the containing directory of the share
root.
This is a subtle one. In smbd_dirptr_get_entry() we now
open a pathref fsp on all entries - including "..".
If we're at the root of the share we don't want
a handle to the directory above it, so silently
close the smb_fname->fsp for ".." names to prevent
it from being used to return meta-data to the client
(more than we already have done historically by
calling pathname functions on "..").
The marshalling returned entries and async DOS
code copes with smb_fname->fsp == NULL perfectly
well.
Only in master, but will need fixing for 4.15.rc1
or 2.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14759
Signed-off-by: Jeremy Allison <j...@samba.org>
Reviewed-by: Ralph Boehme <s...@samba.org>
Autobuild-User(master): Ralph Böhme <s...@samba.org>
Autobuild-Date(master): Wed Jul 28 15:07:54 UTC 2021 on sn-devel-184
commit b004ebb1c62742346b84ecb9d52c783173528fac
Author: Jeremy Allison <j...@samba.org>
Date: Wed Jul 14 21:30:09 2021 -0700
s3: smbd: Allow async dosmode to cope with ".." pathnames where we close
smb_fname->fsp to prevent meta-data leakage.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14759
Signed-off-by: Jeremy Allison <j...@samba.org>
Reviewed-by: Ralph Boehme <s...@samba.org>
-----------------------------------------------------------------------
Summary of changes:
source3/smbd/dir.c | 25 +++++++++++++++++++++++++
source3/smbd/dosmode.c | 23 ++++++++++++++---------
2 files changed, 39 insertions(+), 9 deletions(-)
Changeset truncated at 500 lines:
diff --git a/source3/smbd/dir.c b/source3/smbd/dir.c
index 127e4b0d08d..4c807c3f85c 100644
--- a/source3/smbd/dir.c
+++ b/source3/smbd/dir.c
@@ -946,6 +946,31 @@ bool smbd_dirptr_get_entry(TALLOC_CTX *ctx,
continue;
}
+ /*
+ * Don't leak metadata about the containing
+ * directory of the share.
+ */
+ if (dirptr_path_is_dot && ISDOTDOT(dname)) {
+ /*
+ * Making a copy here, then freeing
+ * the original will close the smb_fname->fsp.
+ */
+ struct smb_filename *tmp_smb_fname =
+ cp_smb_filename(ctx, smb_fname);
+
+ if (tmp_smb_fname == NULL) {
+ TALLOC_FREE(atname);
+ TALLOC_FREE(smb_fname);
+ TALLOC_FREE(dname);
+ TALLOC_FREE(fname);
+ return false;
+ }
+ TALLOC_FREE(smb_fname);
+ smb_fname = tmp_smb_fname;
+ mode = FILE_ATTRIBUTE_DIRECTORY;
+ get_dosmode = false;
+ }
+
ok = mode_fn(ctx,
private_data,
dirptr->dir_hnd->fsp,
diff --git a/source3/smbd/dosmode.c b/source3/smbd/dosmode.c
index 43c46867122..99cb8607944 100644
--- a/source3/smbd/dosmode.c
+++ b/source3/smbd/dosmode.c
@@ -814,15 +814,20 @@ struct tevent_req *dos_mode_at_send(TALLOC_CTX *mem_ctx,
}
if (smb_fname->fsp == NULL) {
- /*
- * The pathological case where a caller does
- * dos_mode_at_send() and smb_fname points at a
- * symlink in POSIX context. smb_fname->fsp is NULL.
- *
- * FIXME ? Should we move to returning
- * FILE_ATTRIBUTE_REPARSE_POINT here ?
- */
- state->dosmode = FILE_ATTRIBUTE_NORMAL;
+ if (ISDOTDOT(smb_fname->base_name)) {
+ /*
+ * smb_fname->fsp is explicitly closed
+ * for ".." to prevent meta-data leakage.
+ */
+ state->dosmode = FILE_ATTRIBUTE_DIRECTORY;
+ } else {
+ /*
+ * This is a symlink in POSIX context.
+ * FIXME ? Should we move to returning
+ * FILE_ATTRIBUTE_REPARSE_POINT here ?
+ */
+ state->dosmode = FILE_ATTRIBUTE_NORMAL;
+ }
tevent_req_done(req);
return tevent_req_post(req, ev);
}
--
Samba Shared Repository
