From: Jeremy Allison Date: Tue, 19 Sep 2023 21:30:26 +0000 (-0700) Subject: s3: torture: Add a new SMB2 test: SMB2-PIPE-READ-ASYNC-DISCONNECT X-Git-Tag: tevent-0.16.0~535 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=66398dd03c46633b474438dddb771caa2d245e64;p=thirdparty%2Fsamba.git s3: torture: Add a new SMB2 test: SMB2-PIPE-READ-ASYNC-DISCONNECT Shows the server crashes if we open a named pipe, do an async read and then disconnect. Adds knownfail: BUG: https://bugzilla.samba.org/show_bug.cgi?id=15423 Signed-off-by: Jeremy Allison Reviewed-by: Ralph Boehme --- diff --git a/selftest/knownfail.d/smb2_pipe_read_async_disconnect b/selftest/knownfail.d/smb2_pipe_read_async_disconnect new file mode 100644 index 00000000000..342a308adec --- /dev/null +++ b/selftest/knownfail.d/smb2_pipe_read_async_disconnect @@ -0,0 +1 @@ +^samba3.smbtorture_s3.plain.SMB2-PIPE-READ-ASYNC-DISCONNECT.check_panic\(fileserver\) diff --git a/source3/script/tests/test_smbtorture_nocrash_s3.sh b/source3/script/tests/test_smbtorture_nocrash_s3.sh new file mode 100755 index 00000000000..b6ef1391262 --- /dev/null +++ b/source3/script/tests/test_smbtorture_nocrash_s3.sh @@ -0,0 +1,38 @@ +#!/bin/sh + +. $(dirname $0)/../../../testprogs/blackbox/subunit.sh + +# this runs the file serving tests that are expected to pass with samba3 + +if [ $# -lt 5 ]; then + cat < +EOF + exit 1 +fi + +t="$1" +unc="$2" +username="$3" +password="$4" +SMBTORTURE="$5" +shift 5 +ADDARGS="$*" + +incdir=$(dirname $0)/../../../testprogs/blackbox +. $incdir/subunit.sh + +panic_count_0=$(grep -c PANIC $SMBD_TEST_LOG) + +echo "$panic_count_0" >/tmp/look + +failed=0 +testit "smbtorture" $VALGRIND $SMBTORTURE $unc -U"$username"%"$password" $ADDARGS $t || failed=$(expr $failed + 1) + +panic_count_1=$(grep -c PANIC $SMBD_TEST_LOG) + +echo "$panic_count_1" >>/tmp/look + +testit "check_panic" test $panic_count_0 -eq $panic_count_1 || failed=$(expr $failed + 1) + +testok $0 $failed diff --git a/source3/selftest/tests.py b/source3/selftest/tests.py index 5fece702372..4b71ba1a1de 100755 --- a/source3/selftest/tests.py +++ b/source3/selftest/tests.py @@ -481,6 +481,22 @@ plantestsuite("samba3.smbtorture_s3.plain.%s" % "SMB2-DEL-ON-CLOSE-NONWRITE-DELE "", "-l $LOCAL_PATH"]) +# +# Test doing an async read + disconnect on a pipe doesn't crash the server. +# BUG: https://bugzilla.samba.org/show_bug.cgi?id=15423 +# +plantestsuite("samba3.smbtorture_s3.plain.%s" % "SMB2-PIPE-READ-ASYNC-DISCONNECT", + "fileserver", + [os.path.join(samba3srcdir, + "script/tests/test_smbtorture_nocrash_s3.sh"), + 'SMB2-PIPE-READ-ASYNC-DISCONNECT', + '//$SERVER_IP/tmp', + '$USERNAME', + '$PASSWORD', + smbtorture3, + "", + "-l $LOCAL_PATH"]) + shares = [ "vfs_aio_pthread_async_dosmode_default1", "vfs_aio_pthread_async_dosmode_default2" diff --git a/source3/torture/proto.h b/source3/torture/proto.h index 071e0d45103..17426458330 100644 --- a/source3/torture/proto.h +++ b/source3/torture/proto.h @@ -132,6 +132,7 @@ bool run_smb2_dfs_paths(int dummy); bool run_smb2_non_dfs_share(int dummy); bool run_smb2_dfs_share_non_dfs_path(int dummy); bool run_smb2_dfs_filename_leading_backslash(int dummy); +bool run_smb2_pipe_read_async_disconnect(int dummy); bool run_smb1_dfs_paths(int dummy); bool run_smb1_dfs_search_paths(int dummy); bool run_smb1_dfs_operations(int dummy); diff --git a/source3/torture/test_smb2.c b/source3/torture/test_smb2.c index 3cb6d13789a..672c38e2b55 100644 --- a/source3/torture/test_smb2.c +++ b/source3/torture/test_smb2.c @@ -5136,3 +5136,120 @@ bool run_smb2_dfs_filename_leading_backslash(int dummy) (void)smb2_dfs_delete(cli, dfs_filename_slash); return retval; } + +/* + * Ensure a named pipe async read followed by a disconnect + * doesn't crash the server (server crash checked for in + * containing test script: + * source3/script/tests/test_smbtorture_nocrash_s3.sh) + * BUG: https://bugzilla.samba.org/show_bug.cgi?id=15423 + */ + +bool run_smb2_pipe_read_async_disconnect(int dummy) +{ + struct cli_state *cli = NULL; + NTSTATUS status; + uint64_t fid_persistent = 0; + uint64_t fid_volatile = 0; + struct tevent_context *ev; + struct tevent_req *req; + bool retval = false; + + printf("Starting SMB2-PIPE-READ-ASYNC-DISCONNECT\n"); + + if (!torture_init_connection(&cli)) { + return false; + } + + status = smbXcli_negprot(cli->conn, + cli->timeout, + PROTOCOL_SMB2_02, + PROTOCOL_SMB3_11); + if (!NT_STATUS_IS_OK(status)) { + printf("smbXcli_negprot returned %s\n", nt_errstr(status)); + return false; + } + + status = cli_session_setup_creds(cli, torture_creds); + if (!NT_STATUS_IS_OK(status)) { + printf("cli_session_setup returned %s\n", nt_errstr(status)); + return false; + } + + status = cli_tree_connect_creds(cli, "IPC$", "IPC", torture_creds); + if (!NT_STATUS_IS_OK(status)) { + printf("cli_tree_connect to IPC$ returned %s\n", + nt_errstr(status)); + return false; + } + + /* Open the SAMR pipe. */ + status = smb2cli_create(cli->conn, + cli->timeout, + cli->smb2.session, + cli->smb2.tcon, + "SAMR", + SMB2_OPLOCK_LEVEL_NONE, /* oplock_level, */ + SMB2_IMPERSONATION_IMPERSONATION, /* impersonation_level, */ + SEC_STD_SYNCHRONIZE| + SEC_FILE_READ_DATA| + SEC_FILE_WRITE_DATA, /* desired_access, */ + FILE_ATTRIBUTE_NORMAL, /* file_attributes, */ + FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE, /* share_access, */ + FILE_OPEN, /* create_disposition, */ + 0, /* create_options, */ + NULL, /* smb2_create_blobs *blobs */ + &fid_persistent, + &fid_volatile, + NULL, /* struct smb_create_returns * */ + talloc_tos(), /* mem_ctx. */ + NULL, /* struct smb2_create_blobs * */ + NULL); /* psymlink */ + if (!NT_STATUS_IS_OK(status)) { + printf("%s:%d smb2cli_create on SAMR returned %s\n", + __FILE__, + __LINE__, + nt_errstr(status)); + goto err; + } + + ev = samba_tevent_context_init(talloc_tos()); + if (ev == NULL) { + goto err; + } + + /* Start an async read. */ + req = smb2cli_read_send(talloc_tos(), + ev, + cli->conn, + cli->timeout, + cli->smb2.session, + cli->smb2.tcon, + 16*1024, + 0, /* offset */ + fid_persistent, + fid_volatile, + 0, /* minimum_count */ + 0); /* remaining_bytes */ + if (req == NULL) { + goto err; + } + + /* Force disconnect. */ + smbXcli_conn_disconnect(cli->conn, NT_STATUS_LOCAL_DISCONNECT); + fid_volatile = 0; + retval = true; + + err: + + if (fid_volatile != 0) { + smb2cli_close(cli->conn, + cli->timeout, + cli->smb2.session, + cli->smb2.tcon, + 0, /* flags */ + fid_persistent, + fid_volatile); + } + return retval; +} diff --git a/source3/torture/torture.c b/source3/torture/torture.c index 486fb4c8115..3598e301174 100644 --- a/source3/torture/torture.c +++ b/source3/torture/torture.c @@ -15843,6 +15843,10 @@ static struct { .name = "SMB2-DFS-FILENAME-LEADING-BACKSLASH", .fn = run_smb2_dfs_filename_leading_backslash, }, + { + .name = "SMB2-PIPE-READ-ASYNC-DISCONNECT", + .fn = run_smb2_pipe_read_async_disconnect, + }, { .name = "SMB1-TRUNCATED-SESSSETUP", .fn = run_smb1_truncated_sesssetup,