s3: torture: Add a new SMB2 test: SMB2-PIPE-READ-ASYNC-DISCONNECT

Shows the server crashes if we open a named pipe, do an async read
and then disconnect.

Adds knownfail:

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15423

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit 66398dd03c46633b474438dddb771caa2d245e64)

diff --git a/selftest/knownfail.d/smb2_pipe_read_async_disconnect b/selftest/knownfail.d/smb2_pipe_read_async_disconnect
new file mode 100644 (file)
index 0000000..342a308
--- /dev/null
+++ b/selftest/knownfail.d/smb2_pipe_read_async_disconnect
@@ -0,0 +1 @@
+^samba3.smbtorture_s3.plain.SMB2-PIPE-READ-ASYNC-DISCONNECT.check_panic\(fileserver\)

diff --git a/source3/script/tests/test_smbtorture_nocrash_s3.sh b/source3/script/tests/test_smbtorture_nocrash_s3.sh
new file mode 100755 (executable)
index 0000000..b6ef139
--- /dev/null
+++ b/source3/script/tests/test_smbtorture_nocrash_s3.sh
@@ -0,0 +1,38 @@
+#!/bin/sh
+
+. $(dirname $0)/../../../testprogs/blackbox/subunit.sh
+
+# this runs the file serving tests that are expected to pass with samba3
+
+if [ $# -lt 5 ]; then
+       cat <<EOF
+Usage: test_smbtorture_s3.sh TEST UNC USERNAME PASSWORD SMBTORTURE <smbtorture args>
+EOF
+       exit 1
+fi
+
+t="$1"
+unc="$2"
+username="$3"
+password="$4"
+SMBTORTURE="$5"
+shift 5
+ADDARGS="$*"
+
+incdir=$(dirname $0)/../../../testprogs/blackbox
+. $incdir/subunit.sh
+
+panic_count_0=$(grep -c PANIC $SMBD_TEST_LOG)
+
+echo "$panic_count_0" >/tmp/look
+
+failed=0
+testit "smbtorture" $VALGRIND $SMBTORTURE $unc -U"$username"%"$password" $ADDARGS $t || failed=$(expr $failed + 1)
+
+panic_count_1=$(grep -c PANIC $SMBD_TEST_LOG)
+
+echo "$panic_count_1" >>/tmp/look
+
+testit "check_panic" test $panic_count_0 -eq $panic_count_1 || failed=$(expr $failed + 1)
+
+testok $0 $failed

diff --git a/source3/selftest/tests.py b/source3/selftest/tests.py
index 783cb486012ac0ecde997e8a830076d5f9074f7e..8986a73f03a40db53293241072c571b4db5101f6 100755 (executable)
--- a/source3/selftest/tests.py
+++ b/source3/selftest/tests.py
@@ -481,6 +481,22 @@ plantestsuite("samba3.smbtorture_s3.plain.%s" % "SMB2-DEL-ON-CLOSE-NONWRITE-DELE
                 "",
                 "-l $LOCAL_PATH"])
 
+#
+# Test doing an async read + disconnect on a pipe doesn't crash the server.
+# BUG: https://bugzilla.samba.org/show_bug.cgi?id=15423
+#
+plantestsuite("samba3.smbtorture_s3.plain.%s" % "SMB2-PIPE-READ-ASYNC-DISCONNECT",
+                "fileserver",
+                [os.path.join(samba3srcdir,
+                              "script/tests/test_smbtorture_nocrash_s3.sh"),
+                'SMB2-PIPE-READ-ASYNC-DISCONNECT',
+                '//$SERVER_IP/tmp',
+                '$USERNAME',
+                '$PASSWORD',
+                smbtorture3,
+                "",
+                "-l $LOCAL_PATH"])
+
 shares = [
     "vfs_aio_pthread_async_dosmode_default1",
     "vfs_aio_pthread_async_dosmode_default2"

diff --git a/source3/torture/proto.h b/source3/torture/proto.h
index 93d0727e93615bfdcde781ea453226ea90101e70..0206cf15c9a2dfc2203fe43f2fb53b9e69491a84 100644 (file)
--- a/source3/torture/proto.h
+++ b/source3/torture/proto.h
@@ -124,6 +124,7 @@ bool run_smb2_dfs_paths(int dummy);
 bool run_smb2_non_dfs_share(int dummy);
 bool run_smb2_dfs_share_non_dfs_path(int dummy);
 bool run_smb2_dfs_filename_leading_backslash(int dummy);
+bool run_smb2_pipe_read_async_disconnect(int dummy);
 bool run_smb1_dfs_paths(int dummy);
 bool run_smb1_dfs_search_paths(int dummy);
 bool run_smb1_dfs_operations(int dummy);

diff --git a/source3/torture/test_smb2.c b/source3/torture/test_smb2.c
index 3cb6d13789a3b6b337d7111b68bb7ce01e32d073..672c38e2b55e2e9b73b288c60f7fd06e95c748d1 100644 (file)
--- a/source3/torture/test_smb2.c
+++ b/source3/torture/test_smb2.c
@@ -5136,3 +5136,120 @@ bool run_smb2_dfs_filename_leading_backslash(int dummy)
        (void)smb2_dfs_delete(cli, dfs_filename_slash);
        return retval;
 }
+
+/*
+ * Ensure a named pipe async read followed by a disconnect
+ * doesn't crash the server (server crash checked for in
+ * containing test script:
+ * source3/script/tests/test_smbtorture_nocrash_s3.sh)
+ * BUG: https://bugzilla.samba.org/show_bug.cgi?id=15423
+ */
+
+bool run_smb2_pipe_read_async_disconnect(int dummy)
+{
+       struct cli_state *cli = NULL;
+       NTSTATUS status;
+       uint64_t fid_persistent = 0;
+       uint64_t fid_volatile = 0;
+       struct tevent_context *ev;
+       struct tevent_req *req;
+       bool retval = false;
+
+       printf("Starting SMB2-PIPE-READ-ASYNC-DISCONNECT\n");
+
+       if (!torture_init_connection(&cli)) {
+               return false;
+       }
+
+       status = smbXcli_negprot(cli->conn,
+                               cli->timeout,
+                               PROTOCOL_SMB2_02,
+                               PROTOCOL_SMB3_11);
+       if (!NT_STATUS_IS_OK(status)) {
+               printf("smbXcli_negprot returned %s\n", nt_errstr(status));
+               return false;
+       }
+
+       status = cli_session_setup_creds(cli, torture_creds);
+       if (!NT_STATUS_IS_OK(status)) {
+               printf("cli_session_setup returned %s\n", nt_errstr(status));
+               return false;
+       }
+
+       status = cli_tree_connect_creds(cli, "IPC$", "IPC", torture_creds);
+       if (!NT_STATUS_IS_OK(status)) {
+               printf("cli_tree_connect to IPC$ returned %s\n",
+                       nt_errstr(status));
+               return false;
+       }
+
+       /* Open the SAMR pipe. */
+       status = smb2cli_create(cli->conn,
+                               cli->timeout,
+                               cli->smb2.session,
+                               cli->smb2.tcon,
+                               "SAMR",
+                               SMB2_OPLOCK_LEVEL_NONE, /* oplock_level, */
+                               SMB2_IMPERSONATION_IMPERSONATION, /* impersonation_level, */
+                               SEC_STD_SYNCHRONIZE|
+                                       SEC_FILE_READ_DATA|
+                                       SEC_FILE_WRITE_DATA, /* desired_access, */
+                               FILE_ATTRIBUTE_NORMAL, /* file_attributes, */
+                               FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE, /* share_access, */
+                               FILE_OPEN, /* create_disposition, */
+                               0, /* create_options, */
+                               NULL, /* smb2_create_blobs *blobs */
+                               &fid_persistent,
+                               &fid_volatile,
+                               NULL, /* struct smb_create_returns * */
+                               talloc_tos(), /* mem_ctx. */
+                               NULL, /* struct smb2_create_blobs * */
+                               NULL); /* psymlink */
+       if (!NT_STATUS_IS_OK(status)) {
+               printf("%s:%d smb2cli_create on SAMR returned %s\n",
+                       __FILE__,
+                       __LINE__,
+                       nt_errstr(status));
+               goto err;
+       }
+
+       ev = samba_tevent_context_init(talloc_tos());
+       if (ev == NULL) {
+               goto err;
+       }
+
+       /* Start an async read. */
+       req = smb2cli_read_send(talloc_tos(),
+                               ev,
+                               cli->conn,
+                               cli->timeout,
+                               cli->smb2.session,
+                               cli->smb2.tcon,
+                               16*1024,
+                               0, /* offset */
+                               fid_persistent,
+                               fid_volatile,
+                               0, /* minimum_count */
+                               0); /* remaining_bytes */
+       if (req == NULL) {
+               goto err;
+       }
+
+       /* Force disconnect. */
+       smbXcli_conn_disconnect(cli->conn, NT_STATUS_LOCAL_DISCONNECT);
+       fid_volatile = 0;
+       retval = true;
+
+  err:
+
+       if (fid_volatile != 0) {
+               smb2cli_close(cli->conn,
+                             cli->timeout,
+                             cli->smb2.session,
+                             cli->smb2.tcon,
+                             0, /* flags */
+                             fid_persistent,
+                             fid_volatile);
+       }
+       return retval;
+}

diff --git a/source3/torture/torture.c b/source3/torture/torture.c
index 2a8b8dec22f137ced05da31e6828ddfed4fa5fea..9a1420c9e3a03dce19c2e4e4ce1ff9609e27a60c 100644 (file)
--- a/source3/torture/torture.c
+++ b/source3/torture/torture.c
@@ -15763,6 +15763,10 @@ static struct {
                .name  = "SMB2-DFS-FILENAME-LEADING-BACKSLASH",
                .fn    = run_smb2_dfs_filename_leading_backslash,
        },
+       {
+               .name  = "SMB2-PIPE-READ-ASYNC-DISCONNECT",
+               .fn    = run_smb2_pipe_read_async_disconnect,
+       },
        {
                .name  = "SMB1-TRUNCATED-SESSSETUP",
                .fn    = run_smb1_truncated_sesssetup,