smbd: DH reconnect hardening

Verify the smbXsrv_open_global0 is marked as disconnected. This is similarily
checked in SMB_VFS_RECONNECT() for the share_mode_entry and that catches the
problem most of the times. But to be consistent we need this check also in
smb2srv_open_recreate_fn().

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15649
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15651

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

diff --git a/source3/smbd/smbXsrv_open.c b/source3/smbd/smbXsrv_open.c
index 6001b4bd09f4cb7864eb4dfcafd0b86192ef412a..467b2f394ee31ecb7ed0483810470c9bfa5ab95a 100644 (file)
--- a/source3/smbd/smbXsrv_open.c
+++ b/source3/smbd/smbXsrv_open.c
@@ -283,10 +283,10 @@ static NTSTATUS smbXsrv_open_global_verify_record(
        *_global0 = global0;
 
        if (server_id_is_disconnected(&global0->server_id)) {
-               return NT_STATUS_OK;
+               return NT_STATUS_REMOTE_DISCONNECT;
        }
        if (serverid_exists(&global0->server_id)) {
-               return NT_STATUS_OK;
+               return NT_STATUS_OBJECTID_EXISTS;
        }
 
        DBG_WARNING("smbd %s did not clean up record %s\n",
@@ -368,7 +368,7 @@ static void smbXsrv_open_global_allocate_fn(
        state->status = smbXsrv_open_global_verify_record(
                key, oldval, talloc_tos(), &tmp_global0);
 
-       if (NT_STATUS_IS_OK(state->status)) {
+       if (!NT_STATUS_EQUAL(state->status, NT_STATUS_NOT_FOUND)) {
                /*
                 * Found an existing record
                 */
@@ -1179,7 +1179,7 @@ static void smb2srv_open_recreate_fn(
 
        state->status = smbXsrv_open_global_verify_record(
                key, oldval, state->op, &state->op->global);
-       if (!NT_STATUS_IS_OK(state->status)) {
+       if (!NT_STATUS_EQUAL(state->status, NT_STATUS_REMOTE_DISCONNECT)) {
                DBG_WARNING("smbXsrv_open_global_verify_record for %s "
                            "failed: %s\n",
                            tdb_data_dbg(key),