s3: smbd: Add test to show smbd crashes when doing an FSCTL on a named stream handle.

Add knownfail.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15236

Signed-off-by: Andrew Walker <awalker@ixsystems.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
(back-ported from commit abc4495e4591964bb4625c2669a1f84213faab77)

diff --git a/selftest/knownfail b/selftest/knownfail
index 7851ec397a0bbdb2ebfc9b107c6cce0e04eda207..41ff3ef7151ae3f6d5cba5896d116445b0acc240 100644 (file)
--- a/selftest/knownfail
+++ b/selftest/knownfail
@@ -203,6 +203,7 @@
 ^samba4.smb2.ioctl.copy_chunk_\w*\(ad_dc_ntvfs\)       # not supported by s4 ntvfs server
 ^samba4.smb2.ioctl.copy-chunk streams\(ad_dc_ntvfs\) # not supported by s4 ntvfs server
 ^samba4.smb2.ioctl.bug14769\(ad_dc_ntvfs\) # not supported by s4 ntvfs server
+^samba4.smb2.ioctl-on-stream.ioctl-on-stream\(ad_dc_ntvfs\)
 ^samba3.smb2.dir.one
 ^samba3.smb2.dir.modify
 ^samba3.smb2.oplock.batch20

diff --git a/selftest/knownfail.d/smb2-ioctl-stream b/selftest/knownfail.d/smb2-ioctl-stream
new file mode 100644 (file)
index 0000000..518726e
--- /dev/null
+++ b/selftest/knownfail.d/smb2-ioctl-stream
@@ -0,0 +1 @@
+^samba3.smb2.ioctl-on-stream.ioctl-on-stream\(fileserver\)

diff --git a/source3/selftest/tests.py b/source3/selftest/tests.py
index 2865657a91218a383bb84c441f11951cb8681d72..e0548fbc86df650bd0b727b305b26b16b6f0b87e 100755 (executable)
--- a/source3/selftest/tests.py
+++ b/source3/selftest/tests.py
@@ -927,6 +927,8 @@ for t in tests:
         plansmbtorture4testsuite(t, "nt4_dc", '//$SERVER_IP/fs_specific -U$USERNAME%$PASSWORD', 'fs_specific')
         plansmbtorture4testsuite(t, "nt4_dc", '//$SERVER_IP/tmp -U$USERNAME%$PASSWORD')
         plansmbtorture4testsuite(t, "ad_dc", '//$SERVER/tmp -U$USERNAME%$PASSWORD')
+    elif t == "smb2.ioctl-on-stream":
+        plansmbtorture4testsuite(t, "fileserver", '//$SERVER_IP/tmp -U$USERNAME%$PASSWORD')
     elif t == "smb2.lock":
         plansmbtorture4testsuite(t, "nt4_dc", '//$SERVER_IP/aio -U$USERNAME%$PASSWORD', 'aio')
         plansmbtorture4testsuite(t, "nt4_dc", '//$SERVER_IP/tmp -U$USERNAME%$PASSWORD')

diff --git a/source4/torture/smb2/ioctl.c b/source4/torture/smb2/ioctl.c
index a4d8885fe13499eb6e21fa22f3251d6dbdbc46ea..2fc8201c30c0312f6d08d1829aa5cdded3f7816e 100644 (file)
--- a/source4/torture/smb2/ioctl.c
+++ b/source4/torture/smb2/ioctl.c
@@ -3839,6 +3839,80 @@ static bool test_ioctl_sparse_qar_malformed(struct torture_context *torture,
        return true;
 }
 
+bool test_ioctl_alternate_data_stream(struct torture_context *tctx)
+{
+       bool ret = false;
+       const char *fname = DNAME "\\test_stream_ioctl_dir";
+       const char *sname = DNAME "\\test_stream_ioctl_dir:stream";
+       NTSTATUS status;
+       struct smb2_create create = {};
+       struct smb2_tree *tree = NULL;
+       struct smb2_handle h1 = {{0}};
+       union smb_ioctl ioctl;
+
+       if (!torture_smb2_connection(tctx, &tree)) {
+               torture_comment(tctx, "Initializing smb2 connection failed.\n");
+               return false;
+       }
+
+       smb2_deltree(tree, DNAME);
+
+       status = torture_smb2_testdir(tree, DNAME, &h1);
+       torture_assert_ntstatus_ok_goto(tctx, status, ret, done,
+                                       "torture_smb2_testdir failed\n");
+
+       status = smb2_util_close(tree, h1);
+       torture_assert_ntstatus_ok_goto(tctx, status, ret, done,
+                                       "smb2_util_close failed\n");
+       create = (struct smb2_create) {
+               .in.desired_access = SEC_FILE_ALL,
+               .in.share_access = NTCREATEX_SHARE_ACCESS_MASK,
+               .in.file_attributes = FILE_ATTRIBUTE_HIDDEN,
+               .in.create_disposition = NTCREATEX_DISP_CREATE,
+               .in.impersonation_level = SMB2_IMPERSONATION_IMPERSONATION,
+               .in.fname = fname,
+       };
+
+       status = smb2_create(tree, tctx, &create);
+       torture_assert_ntstatus_ok_goto(tctx, status, ret, done,
+                                       "smb2_create failed\n");
+
+       h1 = create.out.file.handle;
+       status = smb2_util_close(tree, h1);
+       torture_assert_ntstatus_ok_goto(tctx, status, ret, done,
+                                       "smb2_util_close failed\n");
+
+       create = (struct smb2_create) {
+               .in.desired_access = SEC_FILE_ALL,
+               .in.share_access = NTCREATEX_SHARE_ACCESS_MASK,
+               .in.file_attributes = FILE_ATTRIBUTE_NORMAL,
+               .in.create_disposition = NTCREATEX_DISP_CREATE,
+               .in.impersonation_level = SMB2_IMPERSONATION_IMPERSONATION,
+               .in.fname = sname,
+       };
+       status = smb2_create(tree, tctx, &create);
+       torture_assert_ntstatus_ok_goto(tctx, status, ret, done,
+                                       "smb2_create failed\n");
+       h1 = create.out.file.handle;
+
+       ZERO_STRUCT(ioctl);
+       ioctl.smb2.level = RAW_IOCTL_SMB2;
+       ioctl.smb2.in.file.handle = h1;
+       ioctl.smb2.in.function = FSCTL_CREATE_OR_GET_OBJECT_ID,
+       ioctl.smb2.in.max_output_response = 64;
+       ioctl.smb2.in.flags = SMB2_IOCTL_FLAG_IS_FSCTL;
+       status = smb2_ioctl(tree, tctx, &ioctl.smb2);
+       torture_assert_ntstatus_ok_goto(tctx, status, ret, done,
+                                       "smb2_ioctl failed\n");
+       ret = true;
+
+done:
+
+       smb2_util_close(tree, h1);
+       smb2_deltree(tree, DNAME);
+       return ret;
+}
+
 /*
  * 2.3.57 FSCTL_SET_ZERO_DATA Request
  *

diff --git a/source4/torture/smb2/smb2.c b/source4/torture/smb2/smb2.c
index c0057d595e491021f218bdd8afbebc94788c8ae0..0216cdb9ddd6bf44189e6fe81f1396ce3eef26d3 100644 (file)
--- a/source4/torture/smb2/smb2.c
+++ b/source4/torture/smb2/smb2.c
@@ -182,6 +182,8 @@ NTSTATUS torture_smb2_init(TALLOC_CTX *ctx)
                                      test_ioctl_set_sparse);
        torture_suite_add_simple_test(suite, "zero-data-ioctl",
                                      test_ioctl_zero_data);
+       torture_suite_add_simple_test(suite, "ioctl-on-stream",
+                                     test_ioctl_alternate_data_stream);
        torture_suite_add_suite(suite, torture_smb2_rename_init(suite));
        torture_suite_add_1smb2_test(suite, "bench-oplock", test_smb2_bench_oplock);
        torture_suite_add_suite(suite, torture_smb2_sharemode_init(suite));