From 669344979238719d75f261a6b44671111e027c3a Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 17 Aug 2020 13:39:58 +0200 Subject: [PATCH 1/2] s3:tests: Add test for 'valid users = DOMAIN\%U' BUG: https://bugzilla.samba.org/show_bug.cgi?id=14467 Signed-off-by: Andreas Schneider Reviewed-by: Ralph Boehme (cherry picked from commit 53b6dd951249052772e1ffcf651b7efd0963b931) --- selftest/knownfail.d/samba3.substiutions | 1 + selftest/target/Samba3.pm | 4 ++++ source3/script/tests/test_substitutions.sh | 5 +++++ 3 files changed, 10 insertions(+) create mode 100644 selftest/knownfail.d/samba3.substiutions diff --git a/selftest/knownfail.d/samba3.substiutions b/selftest/knownfail.d/samba3.substiutions new file mode 100644 index 00000000000..f116d3b2fcf --- /dev/null +++ b/selftest/knownfail.d/samba3.substiutions @@ -0,0 +1 @@ +^samba3.substitutions.Test.login.to.share.with.substitution.for.valid.users diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm index 1bfb72af690..0bb2fa91044 100755 --- a/selftest/target/Samba3.pm +++ b/selftest/target/Samba3.pm @@ -427,6 +427,10 @@ sub setup_ad_member path = $share_dir/D_%D/u_%u/g_%g writeable = yes +[sub_valid_users] + path = $share_dir + valid users = ADDOMAIN/%U + "; my $ret = $self->provision($prefix, $dcvars->{DOMAIN}, diff --git a/source3/script/tests/test_substitutions.sh b/source3/script/tests/test_substitutions.sh index 1a46f11c85d..c813a8f9def 100755 --- a/source3/script/tests/test_substitutions.sh +++ b/source3/script/tests/test_substitutions.sh @@ -34,4 +34,9 @@ SMB_UNC="//$SERVER/sub_dug2" test_smbclient "Test login to share with substitution (Dug)" \ "ls" "$SMB_UNC" "-U$USERNAME%$PASSWORD" || failed=$(expr $failed + 1) +SMB_UNC="//$SERVER/sub_valid_users" + +test_smbclient "Test login to share with substitution for valid users" \ + "ls" "$SMB_UNC" "-U$USERNAME%$PASSWORD" || failed=$(expr $failed + 1) + exit $failed -- 2.28.0 From 113e8a3bcd76182006bf7f16e0ff580b3f459a7b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 17 Aug 2020 14:12:48 +0200 Subject: [PATCH 2/2] s3:smbd: Fix %U substitutions if it contains a domain name 'valid users = DOMAIN\%U' worked with Samba 3.6 and broke in a newer version. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14467 Signed-off-by: Andreas Schneider Reviewed-by: Ralph Boehme (cherry picked from commit 5de7c91e6d4e98f438157a7675c8582cabdd828d) --- selftest/knownfail.d/samba3.substiutions | 1 - source3/smbd/share_access.c | 18 +++++++++++++++++- 2 files changed, 17 insertions(+), 2 deletions(-) delete mode 100644 selftest/knownfail.d/samba3.substiutions diff --git a/selftest/knownfail.d/samba3.substiutions b/selftest/knownfail.d/samba3.substiutions deleted file mode 100644 index f116d3b2fcf..00000000000 --- a/selftest/knownfail.d/samba3.substiutions +++ /dev/null @@ -1 +0,0 @@ -^samba3.substitutions.Test.login.to.share.with.substitution.for.valid.users diff --git a/source3/smbd/share_access.c b/source3/smbd/share_access.c index 0b8f6e48e34..57754a0f766 100644 --- a/source3/smbd/share_access.c +++ b/source3/smbd/share_access.c @@ -79,7 +79,23 @@ static bool token_contains_name(TALLOC_CTX *mem_ctx, enum lsa_SidType type; if (username != NULL) { - name = talloc_sub_basic(mem_ctx, username, domain, name); + size_t domain_len = strlen(domain); + + /* Check if username starts with domain name */ + if (domain_len > 0) { + const char *sep = lp_winbind_separator(); + int cmp = strncasecmp_m(username, domain, domain_len); + if (cmp == 0 && sep[0] == username[domain_len]) { + /* Move after the winbind separator */ + domain_len += 1; + } else { + domain_len = 0; + } + } + name = talloc_sub_basic(mem_ctx, + username + domain_len, + domain, + name); } if (sharename != NULL) { name = talloc_string_sub(mem_ctx, name, "%S", sharename); -- 2.28.0