s3: smbd: Add test to show smbd crashes when doing an FSCTL on a named stream handle.

Add knownfail.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15236

Signed-off-by: Andrew Walker <awalker@ixsystems.com>
Reviewed-by: Jeremy Allison <jra@samba.org>

diff --git a/selftest/knownfail b/selftest/knownfail
index f130d2dc3c5ad4a4500ea11692eb1bd453974a3e..cd91a7a50e61212aee696b3ca753ac7eb79ccf5d 100644 (file)
--- a/selftest/knownfail
+++ b/selftest/knownfail
@@ -202,6 +202,7 @@
 ^samba4.smb2.ioctl.copy_chunk_\w*\(ad_dc_ntvfs\)       # not supported by s4 ntvfs server
 ^samba4.smb2.ioctl.copy-chunk streams\(ad_dc_ntvfs\) # not supported by s4 ntvfs server
 ^samba4.smb2.ioctl.bug14769\(ad_dc_ntvfs\) # not supported by s4 ntvfs server
+^samba4.smb2.ioctl-on-stream.ioctl-on-stream\(ad_dc_ntvfs\)
 ^samba3.smb2.dir.one
 ^samba3.smb2.dir.modify
 ^samba3.smb2.oplock.batch20

diff --git a/selftest/knownfail.d/smb2-ioctl-stream b/selftest/knownfail.d/smb2-ioctl-stream
new file mode 100644 (file)
index 0000000..518726e
--- /dev/null
+++ b/selftest/knownfail.d/smb2-ioctl-stream
@@ -0,0 +1 @@
+^samba3.smb2.ioctl-on-stream.ioctl-on-stream\(fileserver\)

diff --git a/source3/selftest/tests.py b/source3/selftest/tests.py
index 182283d9c9d048fc3d120d52c21c1e615dc41976..67ba7b104844a28b8ff01016d1cb985f8d690642 100755 (executable)
--- a/source3/selftest/tests.py
+++ b/source3/selftest/tests.py
@@ -1098,6 +1098,8 @@ for t in tests:
         plansmbtorture4testsuite(t, "nt4_dc", '//$SERVER_IP/fs_specific -U$USERNAME%$PASSWORD', 'fs_specific')
         plansmbtorture4testsuite(t, "nt4_dc", '//$SERVER_IP/tmp -U$USERNAME%$PASSWORD')
         plansmbtorture4testsuite(t, "ad_dc", '//$SERVER/tmp -U$USERNAME%$PASSWORD')
+    elif t == "smb2.ioctl-on-stream":
+        plansmbtorture4testsuite(t, "fileserver", '//$SERVER_IP/tmp -U$USERNAME%$PASSWORD')
     elif t == "smb2.lock":
         plansmbtorture4testsuite(t, "nt4_dc", '//$SERVER_IP/aio -U$USERNAME%$PASSWORD', 'aio')
         plansmbtorture4testsuite(t, "nt4_dc", '//$SERVER_IP/tmp -U$USERNAME%$PASSWORD')

diff --git a/source4/torture/smb2/ioctl.c b/source4/torture/smb2/ioctl.c
index d5ebf93bd6a2498367aae8fd2d426abb66e088e3..6ceaccfc7ca4f8d5b9fbe41338f32fc9b8146e82 100644 (file)
--- a/source4/torture/smb2/ioctl.c
+++ b/source4/torture/smb2/ioctl.c
@@ -3838,6 +3838,80 @@ static bool test_ioctl_sparse_qar_malformed(struct torture_context *torture,
        return true;
 }
 
+bool test_ioctl_alternate_data_stream(struct torture_context *tctx)
+{
+       bool ret = false;
+       const char *fname = DNAME "\\test_stream_ioctl_dir";
+       const char *sname = DNAME "\\test_stream_ioctl_dir:stream";
+       NTSTATUS status;
+       struct smb2_create create = {};
+       struct smb2_tree *tree = NULL;
+       struct smb2_handle h1 = {{0}};
+       union smb_ioctl ioctl;
+
+       if (!torture_smb2_connection(tctx, &tree)) {
+               torture_comment(tctx, "Initializing smb2 connection failed.\n");
+               return false;
+       }
+
+       smb2_deltree(tree, DNAME);
+
+       status = torture_smb2_testdir(tree, DNAME, &h1);
+       torture_assert_ntstatus_ok_goto(tctx, status, ret, done,
+                                       "torture_smb2_testdir failed\n");
+
+       status = smb2_util_close(tree, h1);
+       torture_assert_ntstatus_ok_goto(tctx, status, ret, done,
+                                       "smb2_util_close failed\n");
+       create = (struct smb2_create) {
+               .in.desired_access = SEC_FILE_ALL,
+               .in.share_access = NTCREATEX_SHARE_ACCESS_MASK,
+               .in.file_attributes = FILE_ATTRIBUTE_HIDDEN,
+               .in.create_disposition = NTCREATEX_DISP_CREATE,
+               .in.impersonation_level = SMB2_IMPERSONATION_IMPERSONATION,
+               .in.fname = fname,
+       };
+
+       status = smb2_create(tree, tctx, &create);
+       torture_assert_ntstatus_ok_goto(tctx, status, ret, done,
+                                       "smb2_create failed\n");
+
+       h1 = create.out.file.handle;
+       status = smb2_util_close(tree, h1);
+       torture_assert_ntstatus_ok_goto(tctx, status, ret, done,
+                                       "smb2_util_close failed\n");
+
+       create = (struct smb2_create) {
+               .in.desired_access = SEC_FILE_ALL,
+               .in.share_access = NTCREATEX_SHARE_ACCESS_MASK,
+               .in.file_attributes = FILE_ATTRIBUTE_NORMAL,
+               .in.create_disposition = NTCREATEX_DISP_CREATE,
+               .in.impersonation_level = SMB2_IMPERSONATION_IMPERSONATION,
+               .in.fname = sname,
+       };
+       status = smb2_create(tree, tctx, &create);
+       torture_assert_ntstatus_ok_goto(tctx, status, ret, done,
+                                       "smb2_create failed\n");
+       h1 = create.out.file.handle;
+
+       ZERO_STRUCT(ioctl);
+       ioctl.smb2.level = RAW_IOCTL_SMB2;
+       ioctl.smb2.in.file.handle = h1;
+       ioctl.smb2.in.function = FSCTL_CREATE_OR_GET_OBJECT_ID,
+       ioctl.smb2.in.max_output_response = 64;
+       ioctl.smb2.in.flags = SMB2_IOCTL_FLAG_IS_FSCTL;
+       status = smb2_ioctl(tree, tctx, &ioctl.smb2);
+       torture_assert_ntstatus_ok_goto(tctx, status, ret, done,
+                                       "smb2_ioctl failed\n");
+       ret = true;
+
+done:
+
+       smb2_util_close(tree, h1);
+       smb2_deltree(tree, DNAME);
+       return ret;
+}
+
 /*
  * 2.3.57 FSCTL_SET_ZERO_DATA Request
  *

diff --git a/source4/torture/smb2/smb2.c b/source4/torture/smb2/smb2.c
index f61a2bf96f8bdd23c36f71ec066b5efb4fd4ed7e..d7476ec6b8953a9ca595734c0cdd1a7fd2835a2a 100644 (file)
--- a/source4/torture/smb2/smb2.c
+++ b/source4/torture/smb2/smb2.c
@@ -182,6 +182,8 @@ NTSTATUS torture_smb2_init(TALLOC_CTX *ctx)
                                      test_ioctl_set_sparse);
        torture_suite_add_simple_test(suite, "zero-data-ioctl",
                                      test_ioctl_zero_data);
+       torture_suite_add_simple_test(suite, "ioctl-on-stream",
+                                     test_ioctl_alternate_data_stream);
        torture_suite_add_suite(suite, torture_smb2_rename_init(suite));
        torture_suite_add_suite(suite, torture_smb2_sharemode_init(suite));
        torture_suite_add_1smb2_test(suite, "hold-oplock", test_smb2_hold_oplock);