From 704fadfb60e74bbaee41f0e37415c1f31734fb34 Mon Sep 17 00:00:00 2001
From: Joseph Sutton <josephsutton@catalyst.net.nz>
Date: Tue, 14 Feb 2023 17:19:27 +1300
Subject: [PATCH 09/28] CVE-2023-4154 s4-dsdb: Remove
 DSDB_ACL_CHECKS_DIRSYNC_FLAG

It's no longer used anywhere.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15424

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

(cherry picked from commit 8b4e6f7b3fb8018cb64deef9b8e1cbc2e5ba12cf)

Conflict: NA
Reference: https://download.samba.org/pub/samba/patches/security/samba-4.18.8-security-2023-10-10.patch
[PATCH 09/28] CVE-2023-4154 s4-dsdb: Remove
 DSDB_ACL_CHECKS_DIRSYNC_FLAG
---
 source4/dsdb/samdb/ldb_modules/dirsync.c | 11 ++---------
 source4/dsdb/samdb/samdb.h               |  1 -
 2 files changed, 2 insertions(+), 10 deletions(-)

diff --git a/source4/dsdb/samdb/ldb_modules/dirsync.c b/source4/dsdb/samdb/ldb_modules/dirsync.c
index fa57af49e8f..b3c463741c8 100644
--- a/source4/dsdb/samdb/ldb_modules/dirsync.c
+++ b/source4/dsdb/samdb/ldb_modules/dirsync.c
@@ -1005,7 +1005,6 @@ static int dirsync_ldb_search(struct ldb_module *module, struct ldb_request *req
 	struct dirsync_context *dsc;
 	struct ldb_context *ldb;
 	struct ldb_parse_tree *new_tree = req->op.search.tree;
-	uint32_t flags = 0;
 	enum ndr_err_code ndr_err;
 	DATA_BLOB blob;
 	const char **attrs;
@@ -1117,13 +1116,8 @@ static int dirsync_ldb_search(struct ldb_module *module, struct ldb_request *req
 			return ret;
 		}
 		talloc_free(acl_res);
-	} else {
-		flags |= DSDB_ACL_CHECKS_DIRSYNC_FLAG;
-
-		if (ret != LDB_SUCCESS) {
-			return ret;
-		}
-
+	} else if (ret != LDB_SUCCESS) {
+		return ret;
 	}
 
 	dsc->functional_level = dsdb_functional_level(ldb);
@@ -1394,7 +1388,6 @@ static int dirsync_ldb_search(struct ldb_module *module, struct ldb_request *req
 				      req->controls,
 				      dsc, dirsync_search_callback,
 				      req);
-	ldb_req_set_custom_flags(down_req, flags);
 	LDB_REQ_SET_LOCATION(down_req);
 	if (ret != LDB_SUCCESS) {
 		return ret;
diff --git a/source4/dsdb/samdb/samdb.h b/source4/dsdb/samdb/samdb.h
index d054244b20d..9fbff1e119e 100644
--- a/source4/dsdb/samdb/samdb.h
+++ b/source4/dsdb/samdb/samdb.h
@@ -374,7 +374,6 @@ struct dsdb_extended_dn_store_format {
 
 #define DSDB_FULL_JOIN_REPLICATION_COMPLETED_OPAQUE_NAME "DSDB_FULL_JOIN_REPLICATION_COMPLETED"
 
-#define DSDB_ACL_CHECKS_DIRSYNC_FLAG 0x1
 #define DSDB_SAMDB_MINIMUM_ALLOWED_RID   1000
 
 #define DSDB_METADATA_SCHEMA_SEQ_NUM	"SCHEMA_SEQ_NUM"
-- 
2.34.1