From b80fdc0b0b3d637afd9871493c5813916cef2f40 Mon Sep 17 00:00:00 2001
From: Jeremy Allison <jra@samba.org>
Date: Wed, 26 Jul 2023 16:37:11 -0700
Subject: [PATCH] s3: torture: Add test to show an SMB1 DFS path of "\\x//\\/"
 crashes smbd.

Adds knownfail.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15419

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit 2aa9ffa2f0fc79599efbfe0c37aac4ef5160f712)
---
 selftest/knownfail.d/dfs_badpath |  1 +
 source3/selftest/tests.py        | 14 ++++++++
 source3/torture/proto.h          |  1 +
 source3/torture/test_smb1_dfs.c  | 56 ++++++++++++++++++++++++++++++++
 source3/torture/torture.c        |  4 +++
 5 files changed, 76 insertions(+)
 create mode 100644 selftest/knownfail.d/dfs_badpath

diff --git a/selftest/knownfail.d/dfs_badpath b/selftest/knownfail.d/dfs_badpath
new file mode 100644
index 00000000000..9fd16e99075
--- /dev/null
+++ b/selftest/knownfail.d/dfs_badpath
@@ -0,0 +1 @@
+^samba3.smbtorture_s3.smb1.SMB1-DFS-BADPATH.smbtorture\(fileserver_smb1\)
diff --git a/source3/selftest/tests.py b/source3/selftest/tests.py
index 809a2be631b..0c834ed48b5 100755
--- a/source3/selftest/tests.py
+++ b/source3/selftest/tests.py
@@ -388,6 +388,20 @@ plantestsuite("samba3.smbtorture_s3.smb1.SMB1-DFS-OPERATIONS",
                 '$PASSWORD',
                 smbtorture3,
                 "-mNT1"])
+#
+# SMB1-DFS-BADPATH needs to run against a special share msdfs-pathname-share
+# BUG: https://bugzilla.samba.org/show_bug.cgi?id=15419
+#
+plantestsuite("samba3.smbtorture_s3.smb1.SMB1-DFS-BADPATH",
+                "fileserver_smb1",
+                [os.path.join(samba3srcdir,
+                              "script/tests/test_smbtorture_s3.sh"),
+                'SMB1-DFS-BADPATH',
+                '//$SERVER_IP/msdfs-pathname-share',
+                '$USERNAME',
+                '$PASSWORD',
+                smbtorture3,
+                "-mNT1"])
 
 #
 # SMB2-STREAM-ACL needs to run against a special share - vfs_wo_fruit
diff --git a/source3/torture/proto.h b/source3/torture/proto.h
index 5e6d914c3da..5bfe4cc8e02 100644
--- a/source3/torture/proto.h
+++ b/source3/torture/proto.h
@@ -127,6 +127,7 @@ bool run_smb2_dfs_filename_leading_backslash(int dummy);
 bool run_smb1_dfs_paths(int dummy);
 bool run_smb1_dfs_search_paths(int dummy);
 bool run_smb1_dfs_operations(int dummy);
+bool run_smb1_dfs_check_badpath(int dummy);
 bool run_list_dir_async_test(int dummy);
 bool run_delete_on_close_non_empty(int dummy);
 bool run_delete_on_close_nonwrite_delete_yes_test(int dummy);
diff --git a/source3/torture/test_smb1_dfs.c b/source3/torture/test_smb1_dfs.c
index 5dfa7b41b6e..6c8220844c1 100644
--- a/source3/torture/test_smb1_dfs.c
+++ b/source3/torture/test_smb1_dfs.c
@@ -3814,6 +3814,26 @@ static bool test_smb1_chkpath(struct cli_state *cli)
 	return retval;
 }
 
+/*
+ * Test BUG: https://bugzilla.samba.org/show_bug.cgi?id=15419
+ */
+
+static bool test_smb1_chkpath_bad(struct cli_state *cli)
+{
+	NTSTATUS status;
+
+	status = smb1_chkpath(cli, "\\x//\\/");
+	if (!NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_PATH_NOT_FOUND)) {
+		printf("%s:%d SMB1chkpath of %s failed (%s)\n",
+			__FILE__,
+			__LINE__,
+			"\\x//\\/",
+			nt_errstr(status));
+		return false;
+	}
+	return true;
+}
+
 static NTSTATUS smb1_ctemp(struct cli_state *cli,
 			   const char *path,
 			   char **tmp_path)
@@ -4230,3 +4250,39 @@ bool run_smb1_dfs_operations(int dummy)
 	(void)smb1_dfs_delete(cli, "\\BAD\\BAD\\file");
 	return retval;
 }
+
+/*
+ * Test BUG: https://bugzilla.samba.org/show_bug.cgi?id=15419
+ */
+
+bool run_smb1_dfs_check_badpath(int dummy)
+{
+	struct cli_state *cli = NULL;
+	bool dfs_supported = false;
+
+	printf("Starting SMB1-DFS-CHECK-BADPATH\n");
+
+	if (!torture_init_connection(&cli)) {
+		return false;
+	}
+
+	if (!torture_open_connection(&cli, 0)) {
+		return false;
+	}
+
+	/* Ensure this is a DFS share. */
+	dfs_supported = smbXcli_conn_dfs_supported(cli->conn);
+	if (!dfs_supported) {
+		printf("Server %s does not support DFS\n",
+			smbXcli_conn_remote_name(cli->conn));
+		return false;
+	}
+	dfs_supported = smbXcli_tcon_is_dfs_share(cli->smb1.tcon);
+	if (!dfs_supported) {
+		printf("Share %s does not support DFS\n",
+			cli->share);
+		return false;
+	}
+
+	return test_smb1_chkpath_bad(cli);
+}
diff --git a/source3/torture/torture.c b/source3/torture/torture.c
index 87ac0678526..14a0347882b 100644
--- a/source3/torture/torture.c
+++ b/source3/torture/torture.c
@@ -15787,6 +15787,10 @@ static struct {
 		.name  = "SMB1-DFS-OPERATIONS",
 		.fn    = run_smb1_dfs_operations,
 	},
+	{
+		.name  = "SMB1-DFS-BADPATH",
+		.fn    = run_smb1_dfs_check_badpath,
+	},
 	{
 		.name  = "CLEANUP1",
 		.fn    = run_cleanup1,
-- 
2.47.3