s4: smbtorture: Add a proper change_notify going async followed by tdis test.

[Bug 10344] SessionLogoff on a signed connection with an outstanding notify request crashes smbd.

https://bugzilla.samba.org/show_bug.cgi?id=10344

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Wed Mar 12 20:12:58 CET 2014 on sn-devel-104

diff --git a/source4/torture/smb2/notify.c b/source4/torture/smb2/notify.c
index 83ed7cb3de07c837d17323da1910e3d722114e96..a7376614088535050470e5446fdd3ee674024eef 100644 (file)
--- a/source4/torture/smb2/notify.c
+++ b/source4/torture/smb2/notify.c
@@ -1195,7 +1195,7 @@ static bool torture_smb2_notify_tree_disconnect(
        smb2_deltree(tree, BASEDIR);
        smb2_util_rmdir(tree, BASEDIR);
 
-       torture_comment(torture, "TESTING CHANGE NOTIFY FOLLOWED BY "
+       torture_comment(torture, "TESTING CHANGE NOTIFY+CANCEL FOLLOWED BY "
                        "TREE-DISCONNECT\n");
 
        /*
@@ -1246,6 +1246,71 @@ done:
        return ret;
 }
 
+/*
+  testing of change notifies followed by a tdis - no cancel
+*/
+
+static bool torture_smb2_notify_tree_disconnect_1(
+               struct torture_context *torture,
+               struct smb2_tree *tree)
+{
+       bool ret = true;
+       NTSTATUS status;
+       union smb_notify notify;
+       union smb_open io;
+       struct smb2_handle h1;
+       struct smb2_request *req;
+
+       smb2_deltree(tree, BASEDIR);
+       smb2_util_rmdir(tree, BASEDIR);
+
+       torture_comment(torture, "TESTING CHANGE NOTIFY ASYNC FOLLOWED BY "
+                       "TREE-DISCONNECT\n");
+
+       /*
+         get a handle on the directory
+       */
+       ZERO_STRUCT(io.smb2);
+       io.generic.level = RAW_OPEN_SMB2;
+       io.smb2.in.create_flags = 0;
+       io.smb2.in.desired_access = SEC_FILE_ALL;
+       io.smb2.in.create_options = NTCREATEX_OPTIONS_DIRECTORY;
+       io.smb2.in.file_attributes = FILE_ATTRIBUTE_NORMAL;
+       io.smb2.in.share_access = NTCREATEX_SHARE_ACCESS_READ |
+                               NTCREATEX_SHARE_ACCESS_WRITE;
+       io.smb2.in.alloc_size = 0;
+       io.smb2.in.create_disposition = NTCREATEX_DISP_CREATE;
+       io.smb2.in.impersonation_level = SMB2_IMPERSONATION_ANONYMOUS;
+       io.smb2.in.security_flags = 0;
+       io.smb2.in.fname = BASEDIR;
+
+       status = smb2_create(tree, torture, &(io.smb2));
+       CHECK_STATUS(status, NT_STATUS_OK);
+       h1 = io.smb2.out.file.handle;
+
+       /* ask for a change notify,
+          on file or directory name changes */
+       ZERO_STRUCT(notify.smb2);
+       notify.smb2.level = RAW_NOTIFY_SMB2;
+       notify.smb2.in.buffer_size = 1000;
+       notify.smb2.in.completion_filter = FILE_NOTIFY_CHANGE_NAME;
+       notify.smb2.in.file.handle = h1;
+       notify.smb2.in.recursive = true;
+
+       req = smb2_notify_send(tree, &(notify.smb2));
+       WAIT_FOR_ASYNC_RESPONSE(req);
+
+       status = smb2_tdis(tree);
+       CHECK_STATUS(status, NT_STATUS_OK);
+
+       status = smb2_notify_recv(req, torture, &(notify.smb2));
+       CHECK_VAL(notify.smb2.out.num_changes, 0);
+
+done:
+       smb2_deltree(tree, BASEDIR);
+       return ret;
+}
+
 /*
   basic testing of change notifies followed by a ulogoff
 */
@@ -1999,6 +2064,7 @@ struct torture_suite *torture_smb2_notify_init(void)
        torture_suite_add_2smb2_test(suite, "dir", torture_smb2_notify_dir);
        torture_suite_add_2smb2_test(suite, "mask", torture_smb2_notify_mask);
        torture_suite_add_1smb2_test(suite, "tdis", torture_smb2_notify_tree_disconnect);
+       torture_suite_add_1smb2_test(suite, "tdis1", torture_smb2_notify_tree_disconnect_1);
        torture_suite_add_2smb2_test(suite, "mask-change", torture_smb2_notify_mask_change);
        torture_suite_add_1smb2_test(suite, "logoff", torture_smb2_notify_ulogoff);
        torture_suite_add_1smb2_test(suite, "tree", torture_smb2_notify_tree);