packages/samba
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
samba/backport-s3-VFS-change-connection_struct-cwd_fname-to-cwd_fsp.patch
eaglegai 8ffc8d6a32 backport patches to fix CVE-2021-43566
2022-01-20 09:57:32 +08:00

436 lines
16 KiB
Diff
Raw Blame History

From 75f98a19537c4d0791108ebfea82f3f9d4606cb3 Mon Sep 17 00:00:00 2001
From: Ralph Boehme <slow@samba.org>
Date: Thu, 15 Aug 2019 15:53:32 +0200
Subject: [PATCH] s3: VFS: change connection_struct cwd_fname to cwd_fsp
Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
---
source3/include/vfs.h | 2 +-
source3/modules/vfs_ceph.c | 6 +++---
source3/modules/vfs_full_audit.c | 4 ++--
source3/modules/vfs_netatalk.c | 14 ++++++------
source3/modules/vfs_preopen.c | 2 +-
source3/modules/vfs_virusfilter.c | 18 ++++++++--------
source3/modules/vfs_virusfilter_clamav.c | 2 +-
source3/modules/vfs_virusfilter_fsav.c | 2 +-
source3/modules/vfs_virusfilter_sophos.c | 2 +-
source3/modules/vfs_virusfilter_utils.c | 2 +-
source3/smbd/conn.c | 15 +++++++++++++
source3/smbd/service.c | 8 +++----
source3/smbd/uid.c | 2 +-
source3/smbd/vfs.c | 27 +++++++++++++++---------
14 files changed, 64 insertions(+), 42 deletions(-)
diff --git a/source3/include/vfs.h b/source3/include/vfs.h
index aec9546681be..d3e6ec258c32 100644
--- a/source3/include/vfs.h
+++ b/source3/include/vfs.h
@@ -475,7 +475,7 @@ typedef struct connection_struct {
enum timestamp_set_resolution ts_res;
char *connectpath;
char *origpath;
- struct smb_filename *cwd_fname; /* Working directory. */
+ struct files_struct *cwd_fsp; /* Working directory. */
bool tcon_done;
struct vfs_handle_struct *vfs_handles; /* for the new plugins */
diff --git a/source3/modules/vfs_ceph.c b/source3/modules/vfs_ceph.c
index 28363f003c22..bdf1f5128cf5 100644
--- a/source3/modules/vfs_ceph.c
+++ b/source3/modules/vfs_ceph.c
@@ -1200,14 +1200,14 @@ static struct smb_filename *cephwrap_realpath(struct vfs_handle_struct *handle,
} else if ((len >= 2) && (path[0] == '.') && (path[1] == '/')) {
if (len == 2) {
r = asprintf(&result, "%s",
- handle->conn->cwd_fname->base_name);
+ handle->conn->cwd_fsp->fsp_name->base_name);
} else {
r = asprintf(&result, "%s/%s",
- handle->conn->cwd_fname->base_name, &path[2]);
+ handle->conn->cwd_fsp->fsp_name->base_name, &path[2]);
}
} else {
r = asprintf(&result, "%s/%s",
- handle->conn->cwd_fname->base_name, path);
+ handle->conn->cwd_fsp->fsp_name->base_name, path);
}
if (r < 0) {
diff --git a/source3/modules/vfs_full_audit.c b/source3/modules/vfs_full_audit.c
index 80d15f25ac6b..7a2e15d59601 100644
--- a/source3/modules/vfs_full_audit.c
+++ b/source3/modules/vfs_full_audit.c
@@ -680,11 +680,11 @@ static const char *smb_fname_str_do_log(struct connection_struct *conn,
if (!ISDOT(smb_fname->base_name)) {
abs_name = talloc_asprintf(do_log_ctx(),
"%s/%s",
- conn->cwd_fname->base_name,
+ conn->cwd_fsp->fsp_name->base_name,
smb_fname->base_name);
} else {
abs_name = talloc_strdup(do_log_ctx(),
- conn->cwd_fname->base_name);
+ conn->cwd_fsp->fsp_name->base_name);
}
if (abs_name == NULL) {
return "";
diff --git a/source3/modules/vfs_netatalk.c b/source3/modules/vfs_netatalk.c
index 3085cf4c7c9a..ebdf8d249b62 100644
--- a/source3/modules/vfs_netatalk.c
+++ b/source3/modules/vfs_netatalk.c
@@ -234,7 +234,7 @@ static int atalk_rmdir(struct vfs_handle_struct *handle,
const char *path = smb_fname->base_name;
char *dpath;
- if (!handle->conn->cwd_fname->base_name || !path) goto exit_rmdir;
+ if (!handle->conn->cwd_fsp->fsp_name->base_name || !path) goto exit_rmdir;
/* due to there is no way to change bDeleteVetoFiles variable
* from this module, gotta use talloc stuff..
@@ -246,7 +246,7 @@ static int atalk_rmdir(struct vfs_handle_struct *handle,
goto exit_rmdir;
if (!(dpath = talloc_asprintf(ctx, "%s/%s%s",
- handle->conn->cwd_fname->base_name, path, add ? "/"APPLEDOUBLE : "")))
+ handle->conn->cwd_fsp->fsp_name->base_name, path, add ? "/"APPLEDOUBLE : "")))
goto exit_rmdir;
atalk_rrmdir(ctx, dpath);
@@ -277,7 +277,7 @@ static int atalk_rename(struct vfs_handle_struct *handle,
return ret;
}
- if (atalk_build_paths(talloc_tos(), handle->conn->cwd_fname->base_name, oldname,
+ if (atalk_build_paths(talloc_tos(), handle->conn->cwd_fsp->fsp_name->base_name, oldname,
&adbl_path, &orig_path, &adbl_info,
&orig_info) != 0)
goto exit_rename;
@@ -339,7 +339,7 @@ static int atalk_unlink(struct vfs_handle_struct *handle,
}
if (atalk_build_paths(talloc_tos(),
- handle->conn->cwd_fname->base_name, path,
+ handle->conn->cwd_fsp->fsp_name->base_name, path,
&adbl_path, &orig_path,
&adbl_info, &orig_info) != 0)
goto exit_unlink;
@@ -376,7 +376,7 @@ static int atalk_chmod(struct vfs_handle_struct *handle,
return ret;
ret1 = atalk_build_paths(ctx,
- handle->conn->cwd_fname->base_name,
+ handle->conn->cwd_fsp->fsp_name->base_name,
smb_fname->base_name,
&adbl_path,
&orig_path,
@@ -415,7 +415,7 @@ static int atalk_chown(struct vfs_handle_struct *handle,
if (!(ctx = talloc_init("chown_file")))
return ret;
- if (atalk_build_paths(ctx, handle->conn->cwd_fname->base_name,
+ if (atalk_build_paths(ctx, handle->conn->cwd_fsp->fsp_name->base_name,
smb_fname->base_name,
&adbl_path, &orig_path,
&adbl_info, &orig_info) != 0)
@@ -452,7 +452,7 @@ static int atalk_lchown(struct vfs_handle_struct *handle,
if (!(ctx = talloc_init("lchown_file")))
return ret;
- if (atalk_build_paths(ctx, handle->conn->cwd_fname->base_name,
+ if (atalk_build_paths(ctx, handle->conn->cwd_fsp->fsp_name->base_name,
smb_fname->base_name,
&adbl_path, &orig_path,
&adbl_info, &orig_info) != 0)
diff --git a/source3/modules/vfs_preopen.c b/source3/modules/vfs_preopen.c
index 4a6816129eda..e7cdf9e47768 100644
--- a/source3/modules/vfs_preopen.c
+++ b/source3/modules/vfs_preopen.c
@@ -415,7 +415,7 @@ static int preopen_open(vfs_handle_struct *handle,
TALLOC_FREE(state->template_fname);
state->template_fname = talloc_asprintf(
state, "%s/%s",
- fsp->conn->cwd_fname->base_name, smb_fname->base_name);
+ fsp->conn->cwd_fsp->fsp_name->base_name, smb_fname->base_name);
if (state->template_fname == NULL) {
return res;
diff --git a/source3/modules/vfs_virusfilter.c b/source3/modules/vfs_virusfilter.c
index 0b4bc724f3a3..fcf0c2debc97 100644
--- a/source3/modules/vfs_virusfilter.c
+++ b/source3/modules/vfs_virusfilter.c
@@ -579,7 +579,7 @@ static virusfilter_action infected_file_action_quarantine(
{
TALLOC_CTX *frame = talloc_stackframe();
connection_struct *conn = handle->conn;
- char *cwd_fname = fsp->conn->cwd_fname->base_name;
+ char *cwd_fname = fsp->conn->cwd_fsp->fsp_name->base_name;
char *fname = fsp->fsp_name->base_name;
const struct smb_filename *smb_fname = fsp->fsp_name;
struct smb_filename *q_smb_fname = NULL;
@@ -696,7 +696,7 @@ static virusfilter_action infected_file_action_rename(
{
TALLOC_CTX *frame = talloc_stackframe();
connection_struct *conn = handle->conn;
- char *cwd_fname = fsp->conn->cwd_fname->base_name;
+ char *cwd_fname = fsp->conn->cwd_fsp->fsp_name->base_name;
char *fname = fsp->fsp_name->base_name;
const struct smb_filename *smb_fname = fsp->fsp_name;
struct smb_filename *q_smb_fname = NULL;
@@ -784,7 +784,7 @@ static virusfilter_action infected_file_action_delete(
unbecome_root();
if (ret == -1) {
DBG_ERR("Delete [%s/%s] failed: %s\n",
- fsp->conn->cwd_fname->base_name,
+ fsp->conn->cwd_fsp->fsp_name->base_name,
fsp->fsp_name->base_name,
strerror(saved_errno));
errno = saved_errno;
@@ -837,7 +837,7 @@ static virusfilter_action virusfilter_treat_infected_file(
bool is_cache)
{
connection_struct *conn = handle->conn;
- char *cwd_fname = fsp->conn->cwd_fname->base_name;
+ char *cwd_fname = fsp->conn->cwd_fsp->fsp_name->base_name;
char *fname = fsp->fsp_name->base_name;
TALLOC_CTX *mem_ctx = talloc_tos();
int i;
@@ -937,7 +937,7 @@ static void virusfilter_treat_scan_error(
bool is_cache)
{
connection_struct *conn = handle->conn;
- const char *cwd_fname = fsp->conn->cwd_fname->base_name;
+ const char *cwd_fname = fsp->conn->cwd_fsp->fsp_name->base_name;
const char *fname = fsp->fsp_name->base_name;
TALLOC_CTX *mem_ctx = talloc_tos();
char *env_list = NULL;
@@ -1003,7 +1003,7 @@ static virusfilter_result virusfilter_scan(
virusfilter_result scan_result;
char *scan_report = NULL;
const char *fname = fsp->fsp_name->base_name;
- const char *cwd_fname = fsp->conn->cwd_fname->base_name;
+ const char *cwd_fname = fsp->conn->cwd_fsp->fsp_name->base_name;
struct virusfilter_cache_entry *scan_cache_e = NULL;
bool is_cache = false;
virusfilter_action file_action = VIRUSFILTER_ACTION_DO_NOTHING;
@@ -1138,7 +1138,7 @@ static int virusfilter_vfs_open(
{
TALLOC_CTX *mem_ctx = talloc_tos();
struct virusfilter_config *config;
- const char *cwd_fname = fsp->conn->cwd_fname->base_name;
+ const char *cwd_fname = fsp->conn->cwd_fsp->fsp_name->base_name;
virusfilter_result scan_result;
const char *fname = fsp->fsp_name->base_name;
char *dir_name = NULL;
@@ -1435,7 +1435,7 @@ static int virusfilter_vfs_unlink(
int ret = SMB_VFS_NEXT_UNLINK(handle, smb_fname);
struct virusfilter_config *config = NULL;
char *fname = NULL;
- char *cwd_fname = handle->conn->cwd_fname->base_name;
+ char *cwd_fname = handle->conn->cwd_fsp->fsp_name->base_name;
if (ret != 0 && errno != ENOENT) {
return ret;
@@ -1465,7 +1465,7 @@ static int virusfilter_vfs_rename(
struct virusfilter_config *config = NULL;
char *fname = NULL;
char *dst_fname = NULL;
- char *cwd_fname = handle->conn->cwd_fname->base_name;
+ char *cwd_fname = handle->conn->cwd_fsp->fsp_name->base_name;
if (ret != 0) {
return ret;
diff --git a/source3/modules/vfs_virusfilter_clamav.c b/source3/modules/vfs_virusfilter_clamav.c
index d0e1fc081b7a..fb93caeded66 100644
--- a/source3/modules/vfs_virusfilter_clamav.c
+++ b/source3/modules/vfs_virusfilter_clamav.c
@@ -81,7 +81,7 @@ static virusfilter_result virusfilter_clamav_scan(
const struct files_struct *fsp,
char **reportp)
{
- char *cwd_fname = fsp->conn->cwd_fname->base_name;
+ char *cwd_fname = fsp->conn->cwd_fsp->fsp_name->base_name;
const char *fname = fsp->fsp_name->base_name;
size_t filepath_len = strlen(cwd_fname) + 1 /* slash */ + strlen(fname);
struct virusfilter_io_handle *io_h = config->io_h;
diff --git a/source3/modules/vfs_virusfilter_fsav.c b/source3/modules/vfs_virusfilter_fsav.c
index bd22ee58bc45..240940c75c89 100644
--- a/source3/modules/vfs_virusfilter_fsav.c
+++ b/source3/modules/vfs_virusfilter_fsav.c
@@ -301,7 +301,7 @@ static virusfilter_result virusfilter_fsav_scan(
const struct files_struct *fsp,
char **reportp)
{
- char *cwd_fname = fsp->conn->cwd_fname->base_name;
+ char *cwd_fname = fsp->conn->cwd_fsp->fsp_name->base_name;
const char *fname = fsp->fsp_name->base_name;
struct virusfilter_io_handle *io_h = config->io_h;
virusfilter_result result = VIRUSFILTER_RESULT_CLEAN;
diff --git a/source3/modules/vfs_virusfilter_sophos.c b/source3/modules/vfs_virusfilter_sophos.c
index 82f9cbce7494..c8cdec5fd7fc 100644
--- a/source3/modules/vfs_virusfilter_sophos.c
+++ b/source3/modules/vfs_virusfilter_sophos.c
@@ -226,7 +226,7 @@ static virusfilter_result virusfilter_sophos_scan(
const struct files_struct *fsp,
char **reportp)
{
- char *cwd_fname = fsp->conn->cwd_fname->base_name;
+ char *cwd_fname = fsp->conn->cwd_fsp->fsp_name->base_name;
const char *fname = fsp->fsp_name->base_name;
char fileurl[VIRUSFILTER_IO_URL_MAX+1];
int fileurl_len, fileurl_len2;
diff --git a/source3/modules/vfs_virusfilter_utils.c b/source3/modules/vfs_virusfilter_utils.c
index f56fc6ed5d8b..f1a7a9ba6cbe 100644
--- a/source3/modules/vfs_virusfilter_utils.c
+++ b/source3/modules/vfs_virusfilter_utils.c
@@ -977,7 +977,7 @@ int virusfilter_shell_set_conn_env(
virusfilter_env_set(mem_ctx, env_list, "VIRUSFILTER_SERVICE_NAME",
lp_const_servicename(snum));
virusfilter_env_set(mem_ctx, env_list, "VIRUSFILTER_SERVICE_PATH",
- conn->cwd_fname->base_name);
+ conn->cwd_fsp->fsp_name->base_name);
client_addr_p = tsocket_address_inet_addr_string(
conn->sconn->remote_address, talloc_tos());
diff --git a/source3/smbd/conn.c b/source3/smbd/conn.c
index ca973b0d6aa6..6d9ea419f8df 100644
--- a/source3/smbd/conn.c
+++ b/source3/smbd/conn.c
@@ -90,8 +90,23 @@ connection_struct *conn_new(struct smbd_server_connection *sconn)
TALLOC_FREE(conn);
return NULL;
}
+ conn->cwd_fsp = talloc_zero(conn, struct files_struct);
+ if (conn->cwd_fsp == NULL) {
+ DBG_ERR("talloc_zero failed\n");
+ TALLOC_FREE(conn);
+ return NULL;
+ }
+ conn->cwd_fsp->fh = talloc_zero(conn->cwd_fsp, struct fd_handle);
+ if (conn->cwd_fsp->fh == NULL) {
+ DBG_ERR("talloc_zero failed\n");
+ TALLOC_FREE(conn);
+ return NULL;
+ }
conn->sconn = sconn;
conn->force_group_gid = (gid_t)-1;
+ conn->cwd_fsp->fh->fd = -1;
+ conn->cwd_fsp->fnum = FNUM_FIELD_INVALID;
+ conn->cwd_fsp->conn = conn;
DLIST_ADD(sconn->connections, conn);
sconn->num_connections++;
diff --git a/source3/smbd/service.c b/source3/smbd/service.c
index 732cd237b66e..fa84d78ab3b4 100644
--- a/source3/smbd/service.c
+++ b/source3/smbd/service.c
@@ -72,16 +72,16 @@ bool set_conn_connectpath(connection_struct *conn, const char *connectpath)
talloc_free(conn->connectpath);
conn->connectpath = destname;
/*
- * Ensure conn->cwd_fname is initialized.
+ * Ensure conn->cwd_fsp->fsp_name is initialized.
* start as conn->connectpath.
*/
- TALLOC_FREE(conn->cwd_fname);
- conn->cwd_fname = synthetic_smb_fname(conn,
+ TALLOC_FREE(conn->cwd_fsp->fsp_name);
+ conn->cwd_fsp->fsp_name = synthetic_smb_fname(conn,
conn->connectpath,
NULL,
NULL,
0);
- if (conn->cwd_fname == NULL) {
+ if (conn->cwd_fsp->fsp_name == NULL) {
return false;
}
return true;
diff --git a/source3/smbd/uid.c b/source3/smbd/uid.c
index a4bcb747d37e..53c7aa7b7980 100644
--- a/source3/smbd/uid.c
+++ b/source3/smbd/uid.c
@@ -581,7 +581,7 @@ static void pop_conn_ctx(void)
if (current_user.done_chdir && ctx_p->need_chdir) {
int ret;
- ret = vfs_ChDir(ctx_p->conn, ctx_p->conn->cwd_fname);
+ ret = vfs_ChDir(ctx_p->conn, ctx_p->conn->cwd_fsp->fsp_name);
if (ret != 0) {
DBG_ERR("vfs_ChDir() failed!\n");
smb_panic("vfs_ChDir() failed!\n");
diff --git a/source3/smbd/vfs.c b/source3/smbd/vfs.c
index b8b482e758ef..467c3e39db1e 100644
--- a/source3/smbd/vfs.c
+++ b/source3/smbd/vfs.c
@@ -787,7 +787,7 @@ const char *vfs_readdirname(connection_struct *conn, void *p,
int vfs_ChDir(connection_struct *conn, const struct smb_filename *smb_fname)
{
int ret;
- struct smb_filename *old_cwd = conn->cwd_fname;
+ struct smb_filename *cwd = NULL;
if (!LastDir) {
LastDir = SMB_STRDUP("");
@@ -810,14 +810,14 @@ int vfs_ChDir(connection_struct *conn, const struct smb_filename *smb_fname)
}
/*
- * Always replace conn->cwd_fname. We
+ * Always replace conn->cwd_fsp. We
* don't know if it's been modified by
* VFS modules in the stack.
*/
/* conn cache. */
- conn->cwd_fname = vfs_GetWd(conn, conn);
- if (conn->cwd_fname == NULL) {
+ cwd = vfs_GetWd(conn, conn);
+ if (cwd == NULL) {
/*
* vfs_GetWd() failed.
* We must be able to read cwd.
@@ -826,7 +826,7 @@ int vfs_ChDir(connection_struct *conn, const struct smb_filename *smb_fname)
*/
int saved_errno = errno;
- if (old_cwd == NULL) {
+ if (conn->cwd_fsp->fsp_name == NULL) {
/*
* Failed on the very first chdir()+getwd()
* for this connection. We can't
@@ -836,11 +836,9 @@ int vfs_ChDir(connection_struct *conn, const struct smb_filename *smb_fname)
/* NOTREACHED */
return -1;
}
- /* Restore original conn->cwd_fname. */
- conn->cwd_fname = old_cwd;
/* Return to the previous $cwd. */
- ret = SMB_VFS_CHDIR(conn, conn->cwd_fname);
+ ret = SMB_VFS_CHDIR(conn, conn->cwd_fsp->fsp_name);
if (ret != 0) {
smb_panic("conn->cwd getwd failed\n");
/* NOTREACHED */
@@ -856,9 +854,18 @@ int vfs_ChDir(connection_struct *conn, const struct smb_filename *smb_fname)
SAFE_FREE(LastDir);
LastDir = SMB_STRDUP(smb_fname->base_name);
- DEBUG(4,("vfs_ChDir got %s\n", conn->cwd_fname->base_name));
+ /*
+ * (Indirect) Callers of vfs_ChDir() may still hold references to the
+ * old conn->cwd_fsp->fsp_name. Move it to talloc_tos(), that way
+ * callers can use it for the lifetime of the SMB request.
+ */
+ talloc_move(talloc_tos(), &conn->cwd_fsp->fsp_name);
+
+ conn->cwd_fsp->fsp_name = talloc_move(conn->cwd_fsp, &cwd);
+ conn->cwd_fsp->fh->fd = AT_FDCWD;
+
+ DBG_INFO("vfs_ChDir got %s\n", fsp_str_dbg(conn->cwd_fsp));
- TALLOC_FREE(old_cwd);
return ret;
}
Reference in New Issue View Git Blame Copy Permalink