Merge ~kstenerud/ubuntu/+source/samba:bionic-samba-eexist-1801227 into ubuntu/+source/samba:ubuntu/bionic-devel

[Karl Stenerud]

This upstream patch fixes a regression in Samba 4.7, where the server responds with EEXISTS rather than EACCESS or EPERM on a failed login (or attempt to use guest access on a protected resource), resulting in confusing error messages to the user.

PPA: https://launchpad.net/~kstenerud/+archive/ubuntu/bionic-samba-eexist-3-1801227

Steps to test:

# lxc launch ubuntu:bionic tester && lxc exec tester bash
# apt update && apt dist-upgrade -y && apt install -y samba gvfs libglib2.0-bin gvfs-bin gvfs-backends dbus-x11 &&
echo "
[global]
workgroup = WORKGROUP
security = user
map to guest = bad user
[test]
    path = /tmp
    browseable = yes
    read only = yes
    valid users = someone
" >/etc/samba/smb.conf &&
service smbd restart
# su - -c "dbus-launch gio mount -a smb://localhost/test" ubuntu
gio: smb://localhost/test/: Failed to mount Windows share: File exists

# add-apt-repository -y ppa:kstenerud/bionic-samba-eexist-3-1801227 && apt update && apt dist-upgrade -y
# su - -c "dbus-launch gio mount -a smb://localhost/test" ubuntu
gio: smb://localhost/test/: Anonymous access denied

[Andreas Hasenack (ahasenack)]

n/f, comments inline

review: Needs Fixing

[Andreas Hasenack (ahasenack)]

You also need to rebase, as the security team issued a security release which took over your ubuntu2.5 version.

review: Needs Fixing

[Karl Stenerud (kstenerud)]

Rebased and updated to have dep3 header, version ubuntu2.6.

[Karl Stenerud (kstenerud)]

Whoops. I updated it in one place only. Now updated in both.

[Andreas Hasenack (ahasenack)]

Thanks, looks good now. I created a bileto ticket to check the dep8 tests on all arches: https://bileto.ubuntu.com/#/ticket/3544

I'm handling that bit, but you are welcome to monitor it as well. Once it's done and we are satisfied with the results (should take a few hours), I'll sponsor 4f81d752ad1daac7575255baba1721358d5fa52e

[Andreas Hasenack (ahasenack)]

The tests completed fine (https://bileto.ubuntu.com/excuses/3544/bionic.html) Just one red on a test that commonly fails and can be retried.

Can you confirm the hash you want sponsored please?

[Karl Stenerud (kstenerud)]

YEs, please sponsor 4f81d752ad1daac7575255baba1721358d5fa52e

[Andreas Hasenack (ahasenack)]

Tagged and uploaded.

[Andreas Hasenack (ahasenack)]

review: Approve

diff --git a/debian/changelog b/debian/changelog
index 572262e..2a821f6 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+samba (2:4.7.6+dfsg~ubuntu-0ubuntu2.6) bionic; urgency=medium
+
+  * d/p/auth-fail-eexist.diff: smbc_opendir should not return EEXIST with
+    invalid login credentials. Thanks to David Mulder. (LP: #1801227)
+
+ -- Karl Stenerud <[e-mail]>  Fri, 23 Nov 2018 15:58:41 +0100
+
 samba (2:4.7.6+dfsg~ubuntu-0ubuntu2.5) bionic-security; urgency=medium
 
   * SECURITY UPDATE: Unprivileged adding of CNAME record causing loop in AD
diff --git a/debian/patches/auth-fail-eexist.diff b/debian/patches/auth-fail-eexist.diff
new file mode 100644
index 0000000..3107250
--- /dev/null
+++ b/debian/patches/auth-fail-eexist.diff
@@ -0,0 +1,32 @@
+Description: smbc_opendir should not return EEXIST with invalid login credentials.
+Author: David Mulder <[e-mail]>
+Origin: upstream, https://github.com/samba-team/samba/commit/7470b9b18af282a742929d3fc90f4be5520428a1
+Bug: https://bugzilla.samba.org/show_bug.cgi?id=13050
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/bionic/+source/samba/+bug/1801227
+Last-Update: 2018-11-28
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+diff --git a/source3/libsmb/libsmb_server.c b/source3/libsmb/libsmb_server.c
+index 2d41f2fac..e6067be20 100644
+--- a/source3/libsmb/libsmb_server.c
++++ b/source3/libsmb/libsmb_server.c
+@@ -360,8 +360,8 @@ SMBC_server_internal(TALLOC_CTX *ctx,
+ 						  "?????",
+ 						  *pp_password);
+ 			if (!NT_STATUS_IS_OK(status)) {
+-                                errno = map_errno_from_nt_status(status);
+                                 cli_shutdown(srv->cli);
++                                errno = map_errno_from_nt_status(status);
+ 				srv->cli = NULL;
+                                 smbc_getFunctionRemoveCachedServer(context)(context,
+                                                                             srv);
+@@ -571,8 +571,8 @@ SMBC_server_internal(TALLOC_CTX *ctx,
+ 
+ 	status = cli_tree_connect_creds(c, share, "?????", creds);
+ 	if (!NT_STATUS_IS_OK(status)) {
+-		errno = map_errno_from_nt_status(status);
+ 		cli_shutdown(c);
++		errno = map_errno_from_nt_status(status);
+ 		return NULL;
+ 	}
+ 
diff --git a/debian/patches/series b/debian/patches/series
index 659a49f..288dfdf 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -37,3 +37,4 @@ CVE-2018-14629.patch
 CVE-2018-16841-1.patch
 CVE-2018-16841-2.patch
 CVE-2018-16851.patch
+auth-fail-eexist.diff