CVE-2015-5252: s3: smbd: Fix symlink verification (file access outside the share).

New tests for fix.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11395

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm
index 94612b25a238a5d24bfe89208b4539e32f733416..c9e57ad206993df52c1cdc2414a1079bfa232c40 100755 (executable)
--- a/selftest/target/Samba3.pm
+++ b/selftest/target/Samba3.pm
@@ -1118,6 +1118,12 @@ sub provision($$$$$$$$)
        my $manglenames_shrdir="$shrdir/manglenames";
        push(@dirs,$manglenames_shrdir);
 
+       my $widelinks_shrdir="$shrdir/widelinks";
+       push(@dirs,$widelinks_shrdir);
+
+       my $widelinks_linkdir="$shrdir/widelinks_foo";
+       push(@dirs,$widelinks_linkdir);
+
        # this gets autocreated by winbindd
        my $wbsockdir="$prefix_abs/winbindd";
        my $wbsockprivdir="$lockdir/winbindd_privileged";
@@ -1207,6 +1213,25 @@ sub provision($$$$$$$$)
         my $manglename_target = "$manglenames_shrdir/foo:bar";
        mkdir($manglename_target, 0777);
 
+       ##
+       ## create symlinks for widelinks tests.
+       ##
+       my $widelinks_target = "$widelinks_linkdir/target";
+       unless (open(WIDELINKS_TARGET, ">$widelinks_target")) {
+               warn("Unable to open $widelinks_target");
+               return undef;
+       }
+       close(WIDELINKS_TARGET);
+       chmod 0666, $widelinks_target;
+       ##
+       ## This link should get ACCESS_DENIED
+       ##
+       symlink "$widelinks_target", "$widelinks_shrdir/source";
+       ##
+       ## This link should be allowed
+       ##
+       symlink "$widelinks_shrdir", "$widelinks_shrdir/dot";
+
        my $conffile="$libdir/server.conf";
 
        my $nss_wrapper_pl = "$ENV{PERL} $self->{srcdir}/lib/nss_wrapper/nss_wrapper.pl";
@@ -1512,6 +1537,11 @@ sub provision($$$$$$$$)
        path = $shrdir/%R
        guest ok = yes
 
+[widelinks_share]
+       path = $widelinks_shrdir
+       wide links = no
+       guest ok = yes
+
 [fsrvp_share]
        path = $shrdir
        comment = fake shapshots using rsync

diff --git a/source3/script/tests/test_smbclient_s3.sh b/source3/script/tests/test_smbclient_s3.sh
index c073b43de604061e39c62b8e7f72d215c5596d55..5e3db5d365b86cd710ed57a50ac1e626a0bf2f6c 100755 (executable)
--- a/source3/script/tests/test_smbclient_s3.sh
+++ b/source3/script/tests/test_smbclient_s3.sh
@@ -1003,6 +1003,62 @@ EOF
     fi
 }
 
+# Test wide links are restricted.
+test_widelinks()
+{
+    tmpfile=$PREFIX/smbclient_interactive_prompt_commands
+    cat > $tmpfile <<EOF
+cd dot
+ls
+quit
+EOF
+    cmd='CLI_FORCE_INTERACTIVE=yes $SMBCLIENT "$@" -U$USERNAME%$PASSWORD //$SERVER/widelinks_share -I $SERVER_IP $ADDARGS < $tmpfile 2>&1'
+    eval echo "$cmd"
+    out=`eval $cmd`
+    ret=$?
+    rm -f $tmpfile
+
+    if [ $ret != 0 ] ; then
+       echo "$out"
+       echo "failed accessing widelinks_share with error $ret"
+       false
+       return
+    fi
+
+    echo "$out" | grep 'NT_STATUS'
+    ret=$?
+    if [ $ret == 0 ] ; then
+       echo "$out"
+       echo "failed - NT_STATUS_XXXX listing \\widelinks_share\\dot"
+       false
+    fi
+
+    cat > $tmpfile <<EOF
+allinfo source
+quit
+EOF
+    cmd='CLI_FORCE_INTERACTIVE=yes $SMBCLIENT "$@" -U$USERNAME%$PASSWORD //$SERVER/widelinks_share -I $SERVER_IP $ADDARGS < $tmpfile 2>&1'
+    eval echo "$cmd"
+    out=`eval $cmd`
+    ret=$?
+    rm -f $tmpfile
+
+    if [ $ret != 0 ] ; then
+       echo "$out"
+       echo "failed accessing widelinks_share with error $ret"
+       false
+       return
+    fi
+
+# This should fail with NT_STATUS_ACCESS_DENIED
+    echo "$out" | grep 'NT_STATUS_ACCESS_DENIED'
+    ret=$?
+    if [ $ret != 0 ] ; then
+       echo "$out"
+       echo "failed - should get NT_STATUS_ACCESS_DENIED listing \\widelinks_share\\source"
+       false
+    fi
+}
 
 LOGDIR_PREFIX=test_smbclient_s3
 
@@ -1095,6 +1151,10 @@ testit "creating a :stream at root of share" \
     test_toplevel_stream || \
     failed=`expr $failed + 1`
 
+testit "Ensure widelinks are restricted" \
+    test_widelinks || \
+    failed=`expr $failed + 1`
+
 testit "rm -rf $LOGDIR" \
     rm -rf $LOGDIR || \
     failed=`expr $failed + 1`