From 9c0a185060d63f4d8ccacb573aae0fc6fdbb695d Mon Sep 17 00:00:00 2001
From: Noel Power <noel.power@suse.com>
Date: Fri, 28 Jul 2023 09:40:57 +0100
Subject: [PATCH 1/4] selftest: Add new dfs share (with widelinks enabled)

Adds share (to be used in later test) that has dfs node
but additionally has widelinks set to yes

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15435

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit b57cdfd7efb161cf96b3a39dc7a1652db817e602)
---
 selftest/target/Samba3.pm | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm
index d3ee7388026..fb581451801 100755
--- a/selftest/target/Samba3.pm
+++ b/selftest/target/Samba3.pm
@@ -3030,6 +3030,11 @@ sub provision($$)
 	msdfs root = yes
 	msdfs shuffle referrals = yes
 	guest ok = yes
+[msdfs-share-wl]
+	path = $msdfs_shrdir
+	msdfs root = yes
+	wide links = yes
+	guest ok = yes
 [msdfs-share2]
 	path = $msdfs_shrdir2
 	msdfs root = yes
-- 
2.35.3


From 3a5937d56e8d67a353789d71ea6121f8ee2d477c Mon Sep 17 00:00:00 2001
From: Noel Power <noel.power@suse.com>
Date: Fri, 28 Jul 2023 09:41:59 +0100
Subject: [PATCH 2/4] sefltest: Add new regression test dfs with widelinks =
 yes

Adds a new test trying to cd into dfs path on share with
widelinks enabled, should generate an error (see BUG:)

Add a knownfail so CI continues

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15435

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 3d2e9db8b95f9f45d486f8272e53584975f177fa)
---
 selftest/knownfail.d/smbclient-bug15435       |  1 +
 .../tests/test_bug15435_widelink_dfs.sh       | 28 +++++++++++++++++++
 source3/selftest/tests.py                     | 10 +++++++
 3 files changed, 39 insertions(+)
 create mode 100644 selftest/knownfail.d/smbclient-bug15435
 create mode 100755 source3/script/tests/test_bug15435_widelink_dfs.sh

diff --git a/selftest/knownfail.d/smbclient-bug15435 b/selftest/knownfail.d/smbclient-bug15435
new file mode 100644
index 00000000000..c7d64a1e66a
--- /dev/null
+++ b/selftest/knownfail.d/smbclient-bug15435
@@ -0,0 +1 @@
+^samba3.blackbox.smbclient-bug15435.smbclient
diff --git a/source3/script/tests/test_bug15435_widelink_dfs.sh b/source3/script/tests/test_bug15435_widelink_dfs.sh
new file mode 100755
index 00000000000..e239cd0c274
--- /dev/null
+++ b/source3/script/tests/test_bug15435_widelink_dfs.sh
@@ -0,0 +1,28 @@
+#!/bin/sh
+
+# regression test for dfs access with wide links enabled on dfs share
+
+if [ $# -lt 5 ]; then
+	cat <<EOF
+Usage: test_smbclient_basic.sh SERVER SERVER_IP DOMAIN USERNAME PASSWORD SMBCLIENT <smbclient arguments>
+EOF
+	exit 1
+fi
+
+SERVER="$1"
+SERVER_IP="$2"
+USERNAME="$3"
+PASSWORD="$4"
+smbclient="$5"
+CONFIGURATION="$6"
+shift 6
+ADDARGS="$@"
+
+incdir=$(dirname $0)/../../../testprogs/blackbox
+. $incdir/subunit.sh
+. $incdir/common_test_fns.inc
+
+# TEST
+test_smbclient "smbclient as $DOMAIN\\$USERNAME" 'ls' "//$SERVER/msdfs-share-wl" -U$DOMAIN\\$USERNAME%$PASSWORD $ADDARGS -c 'cd msdfs-src1' || failed=$(expr $failed + 1)
+
+exit $failed
diff --git a/source3/selftest/tests.py b/source3/selftest/tests.py
index afe408e0f64..83d72db003c 100755
--- a/source3/selftest/tests.py
+++ b/source3/selftest/tests.py
@@ -1673,6 +1673,16 @@ plantestsuite(
      "",
      "-b $PREFIX/clusteredmember/unclists/tmp.txt -N 5 -o 10"])
 
+plantestsuite("samba3.blackbox.smbclient-bug15435",
+              "fileserver",
+              [os.path.join(samba3srcdir, "script/tests/test_bug15435_widelink_dfs.sh"),
+               "$SERVER",
+               "$SERVER_IP",
+               "$USERNAME",
+               "$PASSWORD",
+               smbclient3,
+               configuration])
+
 plantestsuite(
     "samba3.net_machine_account",
     "clusteredmember",
-- 
2.35.3


From 9e1ea62ad30af7c274700dcb91d8e91ebba8a6d5 Mon Sep 17 00:00:00 2001
From: Noel Power <noel.power@suse.com>
Date: Thu, 27 Jul 2023 17:36:29 +0100
Subject: [PATCH 3/4] s3/modules: Add flag indicating if connected share is a
 dfs share

Not used yet, will be used in the next commit to avoid testing
if the connected share is a dfs one.

Pair-Programmed-With: Jeremy Alison <jra@samba.org>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15435

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 2668dcd0968133cca4f8410bf8c41ed0483f5d87)
---
 source3/modules/vfs_widelinks.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/source3/modules/vfs_widelinks.c b/source3/modules/vfs_widelinks.c
index 2a35ea5eb68..a86f62572ac 100644
--- a/source3/modules/vfs_widelinks.c
+++ b/source3/modules/vfs_widelinks.c
@@ -106,6 +106,7 @@
 
 struct widelinks_config {
 	bool active;
+	bool is_dfs_share;
 	char *cwd;
 };
 
@@ -134,7 +135,8 @@ static int widelinks_connect(struct vfs_handle_struct *handle,
 		DBG_ERR("vfs_widelinks module loaded with "
 			"widelinks = no\n");
 	}
-
+	config->is_dfs_share =
+		(lp_host_msdfs() && lp_msdfs_root(SNUM(handle->conn)));
         SMB_VFS_HANDLE_SET_DATA(handle,
 				config,
 				NULL, /* free_fn */
-- 
2.35.3


From e0e57c08155d9df246fbdc7fd8bac97946df6c10 Mon Sep 17 00:00:00 2001
From: Noel Power <noel.power@suse.com>
Date: Thu, 27 Jul 2023 13:26:21 +0100
Subject: [PATCH 4/4] s3/modules: Fix DFS links when widelinks = yes

In openat(), even if we fail to open the file,
propagate stat if and only if the object is a link in
a DFS share. This allows calling code to further process
the link.

Also remove knownfail

Pair-Programmed-With: Jeremy Alison <jra@samba.org>

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15435

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Sat Jul 29 00:43:52 UTC 2023 on atb-devel-224

(cherry picked from commit 0bf8b25aacdf2f5c746922320b32e3f0886c81f5)
---
 selftest/knownfail.d/smbclient-bug15435 |  1 -
 source3/modules/vfs_widelinks.c         | 26 +++++++++++++++++++++++--
 2 files changed, 24 insertions(+), 3 deletions(-)
 delete mode 100644 selftest/knownfail.d/smbclient-bug15435

diff --git a/selftest/knownfail.d/smbclient-bug15435 b/selftest/knownfail.d/smbclient-bug15435
deleted file mode 100644
index c7d64a1e66a..00000000000
--- a/selftest/knownfail.d/smbclient-bug15435
+++ /dev/null
@@ -1 +0,0 @@
-^samba3.blackbox.smbclient-bug15435.smbclient
diff --git a/source3/modules/vfs_widelinks.c b/source3/modules/vfs_widelinks.c
index a86f62572ac..c68468a950b 100644
--- a/source3/modules/vfs_widelinks.c
+++ b/source3/modules/vfs_widelinks.c
@@ -348,7 +348,7 @@ static int widelinks_openat(vfs_handle_struct *handle,
 {
 	struct vfs_open_how how = *_how;
 	struct widelinks_config *config = NULL;
-
+	int ret;
 	SMB_VFS_HANDLE_GET_DATA(handle,
 				config,
 				struct widelinks_config,
@@ -365,11 +365,33 @@ static int widelinks_openat(vfs_handle_struct *handle,
 		how.flags = (how.flags & ~O_NOFOLLOW);
 	}
 
-	return SMB_VFS_NEXT_OPENAT(handle,
+	ret = SMB_VFS_NEXT_OPENAT(handle,
 				   dirfsp,
 				   smb_fname,
 				   fsp,
 				   &how);
+	if (config->is_dfs_share && ret == -1 && errno == ENOENT) {
+		struct smb_filename *full_fname = NULL;
+		int lstat_ret;
+
+		full_fname = full_path_from_dirfsp_atname(talloc_tos(),
+				dirfsp,
+				smb_fname);
+		if (full_fname == NULL) {
+			errno = ENOMEM;
+			return -1;
+		}
+		lstat_ret = SMB_VFS_NEXT_LSTAT(handle,
+				full_fname);
+		if (lstat_ret != -1 &&
+		    VALID_STAT(full_fname->st) &&
+		    S_ISLNK(full_fname->st.st_ex_mode)) {
+			fsp->fsp_name->st = full_fname->st;
+		}
+		TALLOC_FREE(full_fname);
+		errno = ENOENT;
+	}
+	return ret;
 }
 
 static struct dirent *widelinks_readdir(vfs_handle_struct *handle,
-- 
2.35.3