From: Ralph Boehme <slow@samba.org>
Date: Thu, 12 Nov 2020 14:51:59 +0000 (+0100)
Subject: smbd: use openat_pathref_fsp() in call_trans2findfirst()
X-Git-Tag: samba-4.14.0rc1~342
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=83ecda17a20cf25696698cb7693cea509a642575;p=thirdparty%2Fsamba.git

smbd: use openat_pathref_fsp() in call_trans2findfirst()

Ensures we have a pathref handle in the smb_fname we pass to
SMB_VFS_CREATE_FILE().

Also drop pathref fsp from filename_convert() in call_trans2findfirst(), because
the call to filename_convert() is on the path from the client including the
search mask.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
---

diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c
index 01931962432..11f98ce349b 100644
--- a/source3/smbd/trans2.c
+++ b/source3/smbd/trans2.c
@@ -2833,6 +2833,19 @@ close_if_end = %d requires_resume_key = %d backup_priv = %d level = 0x%x, max_da
 		goto out;
 	}
 
+	/*
+	 * The above call to filename_convert() is on the path from the client
+	 * including the search mask. Until the code that chops of the search
+	 * mask from the path below is moved before the call to
+	 * filename_convert(), we close a possible pathref fsp to ensure
+	 * SMB_VFS_CREATE_FILE() below will internally open a pathref fsp on the
+	 * correct path.
+	 */
+	if (smb_dname->fsp != NULL) {
+		fsp_free(smb_dname->fsp);
+		smb_dname->fsp = NULL;
+	}
+
 	mask = get_original_lcomp(talloc_tos(),
 				conn,
 				directory,
@@ -2951,6 +2964,15 @@ total_data=%u (should be %u)\n", (unsigned int)total_data, (unsigned int)IVAL(pd
 		goto out;
 	}
 
+	ntstatus = openat_pathref_fsp(conn->cwd_fsp, smb_dname);
+	if (NT_STATUS_EQUAL(ntstatus, NT_STATUS_STOPPED_ON_SYMLINK)) {
+		ntstatus = NT_STATUS_OBJECT_NAME_NOT_FOUND;
+	}
+	if (!NT_STATUS_IS_OK(ntstatus)) {
+		reply_nterror(req, ntstatus);
+		goto out;
+	}
+
 	/*
 	 * Open an fsp on this directory for the dptr.
 	 */