sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-03 01:18:10 +03:00
Code

s4:torture/smb2: add smb2.ioctl.copy_chunk_bug15644

Browse Source 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15664

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Noel Power <noel.power@suse.com>
This commit is contained in:
Stefan Metzmacher 2024-06-17 11:18:07 +02:00
parent 35f6c3f3d4
commit 372476aeb0
2 changed files with 65 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
selftest/knownfail.d/smb2.ioctl.copy_chunk Normal file
View File

@ -0,0 +1 @@
^samba3.smb2.ioctl.*.copy_chunk_bug15644

64
source4/torture/smb2/ioctl.c
View File

@ -7388,6 +7388,68 @@ static bool test_ioctl_bug14788_NETWORK_INTERFACE(struct torture_context *tortur
return true;
}
/*
* basic regression test for BUG 15664
* https://bugzilla.samba.org/show_bug.cgi?id=15664
*/
static bool test_ioctl_copy_chunk_bug15644(struct torture_context *torture,
struct smb2_tree *tree)
{
struct smb2_handle dest_h;
NTSTATUS status;
union smb_ioctl ioctl;
TALLOC_CTX *tmp_ctx = talloc_new(tree);
struct srv_copychunk chunk;
struct srv_copychunk_copy cc_copy;
enum ndr_err_code ndr_ret;
bool ok;
ok = test_setup_create_fill(torture,
tree,
tmp_ctx,
FNAME2,
&dest_h,
0,
SEC_RIGHTS_FILE_ALL,
FILE_ATTRIBUTE_NORMAL);
torture_assert(torture, ok, "dest file create fill");
ZERO_STRUCT(ioctl);
ioctl.smb2.level = RAW_IOCTL_SMB2;
ioctl.smb2.in.file.handle = dest_h;
ioctl.smb2.in.function = FSCTL_SRV_COPYCHUNK;
ioctl.smb2.in.max_output_response = sizeof(struct srv_copychunk_rsp);
ioctl.smb2.in.flags = SMB2_IOCTL_FLAG_IS_FSCTL;
ZERO_STRUCT(chunk);
ZERO_STRUCT(cc_copy);
/* overwrite the resume key with a bogus value */
memcpy(cc_copy.source_key, "deadbeefdeadbeefdeadbeef", 24);
cc_copy.chunk_count = 1;
cc_copy.chunks = &chunk;
cc_copy.chunks[0].source_off = 0;
cc_copy.chunks[0].target_off = 0;
cc_copy.chunks[0].length = 4096;
ndr_ret = ndr_push_struct_blob(&ioctl.smb2.in.out, tmp_ctx,
&cc_copy,
(ndr_push_flags_fn_t)ndr_push_srv_copychunk_copy);
torture_assert_ndr_success(torture, ndr_ret,
"ndr_push_srv_copychunk_copy");
/* Server 2k12 returns NT_STATUS_OBJECT_NAME_NOT_FOUND */
status = smb2_ioctl(tree, tmp_ctx, &ioctl.smb2);
torture_assert_ntstatus_equal(torture, status,
NT_STATUS_OBJECT_NAME_NOT_FOUND,
"FSCTL_SRV_COPYCHUNK");
status = smb2_util_close(tree, dest_h);
torture_assert_ntstatus_ok(torture, status, "close");
talloc_free(tmp_ctx);
return true;
}
/*
* testing of SMB2 ioctls
*/
@ -7420,6 +7482,8 @@ struct torture_suite *torture_smb2_ioctl_init(TALLOC_CTX *ctx)
test_ioctl_copy_chunk_dest_lck);
torture_suite_add_1smb2_test(suite, "copy_chunk_bad_key",
test_ioctl_copy_chunk_bad_key);
torture_suite_add_1smb2_test(suite, "copy_chunk_bug15644",
test_ioctl_copy_chunk_bug15644);
torture_suite_add_1smb2_test(suite, "copy_chunk_src_is_dest",
test_ioctl_copy_chunk_src_is_dest);
torture_suite_add_1smb2_test(suite, "copy_chunk_src_is_dest_overlap",