s3: smbd: Add IS_VETO_PATH check to openat_pathref_dirfsp_nosymlink().

Returns NT_STATUS_OBJECT_PATH_NOT_FOUND for directory component.
Note IS_VETO_PATH only looks at the last component, so we must
do it during the directory walk on each component.

Note, we also have to check after a call to get_real_filename_at()
as it may have demangled the client sent name into a filesystem
name that matches the "veto files" parameter.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15143

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

diff --git a/source3/smbd/files.c b/source3/smbd/files.c
index af135d6e95a54774e93168ea52dadd84f4262213..a6c41f2b9280de866945555bfcdb100527e41601 100644 (file)
--- a/source3/smbd/files.c
+++ b/source3/smbd/files.c
@@ -817,6 +817,14 @@ NTSTATUS openat_pathref_dirfsp_nosymlink(
                        goto fail;
                }
 
+               /* Check veto files. */
+               if (IS_VETO_PATH(conn, rel_fname.base_name)) {
+                       DBG_DEBUG("%s contains veto files path component %s\n",
+                                 path_in, rel_fname.base_name);
+                       status = NT_STATUS_OBJECT_PATH_NOT_FOUND;
+                       goto fail;
+               }
+
                rel_fname.base_name = next;
        }
 
@@ -903,6 +911,8 @@ next:
                &how);
 
        if ((fd == -1) && (errno == ENOENT)) {
+               const char *orig_base_name = rel_fname.base_name;
+
                status = get_real_filename_at(
                        dirfsp,
                        rel_fname.base_name,
@@ -915,6 +925,14 @@ next:
                        goto fail;
                }
 
+               /* Name might have been demangled - check veto files. */
+               if (IS_VETO_PATH(conn, rel_fname.base_name)) {
+                       DBG_DEBUG("%s contains veto files path component %s => %s\n",
+                                 path_in, orig_base_name, rel_fname.base_name);
+                       status = NT_STATUS_OBJECT_PATH_NOT_FOUND;
+                       goto fail;
+               }
+
                fd = SMB_VFS_OPENAT(
                        conn,
                        dirfsp,