r24253: From Jan Martin <Jan.Martin@rwedea.com>.

----------------------------------------------------------
In rare cases, Samba 3.0.25b shows directory contents at the wrong
position in the file tree when displaying a subdirectory of a DFS link.

The problem occurs whenever Windows XP asks for a DFS referral for a
subdirectory of a DFS link with a trailing backslash.
Windows does not do this very often, but we saw it several times per day
on our central DFS server.

smbd/msdfs.c, dfs_path_lookup() does the following with the requested
path:
- in line 390, the local copy 'localpath' is 'unix_convert'ed; the
trailing backslash is removed inside unix_convert
- in lines 417-20, 'dfspath' (another copy of the requested path) is
mangled another way without removing trailing backslashes

That's why the following loop (lines 435-461) that is meant to
synchronously cut off the last path component from both strings until it
comes to a DFS link, does not handle both strings the same.  When the
original path ended with a backslash, 'canon_dfspath' has always one
component more than 'localpath', so that *consumedcntp gets too big in
line 446. This value is reported to the client.
----------------------------------------------------------

Bug #4860.

Jeremy.

1 files changed, 8 insertions, 0 deletions

diff --git a/source/smbd/msdfs.c b/source/smbd/msdfs.c
index a89f4ceffcb..16f3cd4370c 100644
--- a/source/smbd/msdfs.c
+++ b/source/smbd/msdfs.c
@@ -422,6 +422,14 @@ static NTSTATUS dfs_path_lookup(connection_struct *conn,
 	}
 
 	/*
+	 * localpath comes out of unix_convert, so it has
+	 * no trailing backslash. Make sure that canon_dfspath hasn't either.
+	 * Fix for bug #4860 from Jan Martin <Jan.Martin@rwedea.com>.
+	 */
+
+	trim_char(canon_dfspath,0,'/');
+
+	/*
 	 * Redirect if any component in the path is a link.
 	 * We do this by walking backwards through the 
 	 * local path, chopping off the last component