From: Pavel Filipenský <pfilipensky@samba.org>
Date: Tue, 20 Jun 2023 14:24:55 +0000 (+0200)
Subject: s3:rpc_server: Fix double blackslash issue in dfs path
X-Git-Tag: talloc-2.4.1~80
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=6f073f258f1f4f03a8eb568ea05be78fdbec49eb;p=thirdparty%2Fsamba.git

s3:rpc_server: Fix double blackslash issue in dfs path

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15400

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Wed Jul  5 20:24:35 UTC 2023 on atb-devel-224
---

diff --git a/selftest/knownfail.d/rpc-dfs b/selftest/knownfail.d/rpc-dfs
index 50499bf3662..8ab72ff7b38 100644
--- a/selftest/knownfail.d/rpc-dfs
+++ b/selftest/knownfail.d/rpc-dfs
@@ -1,3 +1,2 @@
 #_dfs_EnumEx() is not implemented on RPC server side
 ^samba3.blackbox.rpcclient_dfs.dfsenumex
-^samba3.blackbox.rpcclient_dfs.dfsgetinfo
diff --git a/source3/rpc_server/dfs/srv_dfs_nt.c b/source3/rpc_server/dfs/srv_dfs_nt.c
index 34b49419b07..8eaa59a8b0e 100644
--- a/source3/rpc_server/dfs/srv_dfs_nt.c
+++ b/source3/rpc_server/dfs/srv_dfs_nt.c
@@ -63,6 +63,7 @@ WERROR _dfs_Add(struct pipes_struct *p, struct dfs_Add *r)
 	char *altpath = NULL;
 	NTSTATUS status;
 	TALLOC_CTX *ctx = talloc_tos();
+	const char *pathnamep = r->in.path;
 
 	if (session_info->unix_token->uid != sec_initial_uid()) {
 		DEBUG(10,("_dfs_add: uid != 0. Access denied.\n"));
@@ -84,10 +85,15 @@ WERROR _dfs_Add(struct pipes_struct *p, struct dfs_Add *r)
 		return WERR_NOT_ENOUGH_MEMORY;
 	}
 
+	while (IS_DIRECTORY_SEP(pathnamep[0]) &&
+	       IS_DIRECTORY_SEP(pathnamep[1])) {
+		pathnamep++;
+	}
+
 	/* The following call can change the cwd. */
 	status = get_referred_path(ctx,
 				   session_info,
-				   r->in.path,
+				   pathnamep,
 				   remote_address,
 				   local_address,
 				   jn, &consumedcnt, &self_ref);
@@ -141,6 +147,7 @@ WERROR _dfs_Remove(struct pipes_struct *p, struct dfs_Remove *r)
 	TALLOC_CTX *ctx = talloc_tos();
 	char *altpath = NULL;
 	NTSTATUS status;
+	const char *pathnamep = r->in.dfs_entry_path;
 
 	if (session_info->unix_token->uid != sec_initial_uid()) {
 		DEBUG(10,("_dfs_remove: uid != 0. Access denied.\n"));
@@ -166,9 +173,14 @@ WERROR _dfs_Remove(struct pipes_struct *p, struct dfs_Remove *r)
 			r->in.dfs_entry_path, r->in.servername, r->in.sharename));
 	}
 
+	while (IS_DIRECTORY_SEP(pathnamep[0]) &&
+	       IS_DIRECTORY_SEP(pathnamep[1])) {
+		pathnamep++;
+	}
+
 	status = get_referred_path(ctx,
 				   session_info,
-				   r->in.dfs_entry_path,
+				   pathnamep,
 				   remote_address,
 				   local_address,
 				   jn, &consumedcnt, &self_ref);
@@ -396,14 +408,19 @@ WERROR _dfs_GetInfo(struct pipes_struct *p, struct dfs_GetInfo *r)
 	TALLOC_CTX *ctx = talloc_tos();
 	bool ret;
 	NTSTATUS status;
+	const char *pathnamep = r->in.dfs_entry_path;
 
 	jn = talloc_zero(ctx, struct junction_map);
 	if (!jn) {
 		return WERR_NOT_ENOUGH_MEMORY;
 	}
 
-	ret = create_junction(ctx, r->in.dfs_entry_path,
-			      jn);
+	while (IS_DIRECTORY_SEP(pathnamep[0]) &&
+	       IS_DIRECTORY_SEP(pathnamep[1])) {
+		pathnamep++;
+	}
+
+	ret = create_junction(ctx, pathnamep, jn);
 	if (!ret) {
 		return WERR_NERR_DFSNOSUCHSERVER;
 	}
@@ -411,12 +428,11 @@ WERROR _dfs_GetInfo(struct pipes_struct *p, struct dfs_GetInfo *r)
 	/* The following call can change the cwd. */
 	status = get_referred_path(ctx,
 				   session_info,
-				   r->in.dfs_entry_path,
+				   pathnamep,
 				   remote_address,
 				   local_address,
 				   jn, &consumedcnt, &self_ref);
-	if(!NT_STATUS_IS_OK(status) ||
-			consumedcnt < strlen(r->in.dfs_entry_path)) {
+	if(!NT_STATUS_IS_OK(status) || consumedcnt < strlen(pathnamep)) {
 		return WERR_NERR_DFSNOSUCHVOLUME;
 	}