Line data Source code
1 : /*
2 : Unix SMB/CIFS implementation.
3 : SMB torture tester
4 : Copyright (C) Andrew Tridgell 1997-2003
5 : Copyright (C) Jelmer Vernooij 2006
6 : Copyright (C) David Mulder 2020
7 :
8 : This program is free software; you can redistribute it and/or modify
9 : it under the terms of the GNU General Public License as published by
10 : the Free Software Foundation; either version 3 of the License, or
11 : (at your option) any later version.
12 :
13 : This program is distributed in the hope that it will be useful,
14 : but WITHOUT ANY WARRANTY; without even the implied warranty of
15 : MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 : GNU General Public License for more details.
17 :
18 : You should have received a copy of the GNU General Public License
19 : along with this program. If not, see <http://www.gnu.org/licenses/>.
20 : */
21 :
22 : #include "includes.h"
23 : #include "libcli/smb2/smb2.h"
24 : #include "libcli/smb2/smb2_calls.h"
25 : #include "torture/smbtorture.h"
26 : #include "torture/smb2/proto.h"
27 : #include "libcli/smb/smbXcli_base.h"
28 : #include "torture/util.h"
29 : #include "system/filesys.h"
30 : #include "system/time.h"
31 : #include "libcli/resolve/resolve.h"
32 : #include "lib/events/events.h"
33 : #include "param/param.h"
34 :
35 8 : static void smb2cli_session_set_id(struct smbXcli_session *session,
36 : uint64_t session_id)
37 : {
38 8 : smb2cli_session_set_id_and_flags(session, session_id,
39 8 : smb2cli_session_get_flags(session));
40 8 : }
41 :
42 : /**
43 : this checks to see if a secondary tconx can use open files from an
44 : earlier tconx
45 : */
46 4 : bool run_tcon_test(struct torture_context *tctx, struct smb2_tree *tree)
47 : {
48 4 : const char *fname = "tcontest.tmp";
49 0 : struct smb2_handle fnum1;
50 0 : uint32_t cnum1, cnum2, cnum3;
51 0 : uint64_t sessid1, sessid2;
52 0 : uint8_t buf[4];
53 4 : bool ret = true;
54 4 : struct smb2_tree *tree1 = NULL;
55 4 : const char *host = torture_setting_string(tctx, "host", NULL);
56 4 : struct smb2_create io = {0};
57 0 : NTSTATUS status;
58 0 : bool ok;
59 :
60 4 : if (smb2_deltree(tree, fname) == -1) {
61 0 : torture_comment(tctx, "unlink of %s failed\n", fname);
62 : }
63 :
64 4 : io.in.fname = fname;
65 4 : io.in.desired_access = SEC_FILE_READ_DATA | SEC_FILE_WRITE_DATA;
66 4 : io.in.create_disposition = NTCREATEX_DISP_CREATE;
67 4 : io.in.share_access = NTCREATEX_SHARE_ACCESS_READ |
68 : NTCREATEX_SHARE_ACCESS_WRITE |
69 : NTCREATEX_SHARE_ACCESS_DELETE;
70 4 : status = smb2_create(tree, tree, &io);
71 4 : if (NT_STATUS_IS_ERR(status)) {
72 0 : torture_result(tctx, TORTURE_FAIL, "open of %s failed (%s)\n", fname, nt_errstr(status));
73 0 : return false;
74 : }
75 4 : fnum1 = io.out.file.handle;
76 :
77 4 : cnum1 = smb2cli_tcon_current_id(tree->smbXcli);
78 4 : sessid1 = smb2cli_session_current_id(tree->session->smbXcli);
79 :
80 4 : memset(buf, 0, 4); /* init buf so valgrind won't complain */
81 4 : status = smb2_util_write(tree, fnum1, buf, 130, 4);
82 4 : if (NT_STATUS_IS_ERR(status)) {
83 0 : torture_result(tctx, TORTURE_FAIL, "initial write failed (%s)\n", nt_errstr(status));
84 0 : return false;
85 : }
86 :
87 4 : ok = torture_smb2_tree_connect(tctx, tree->session, tctx, &tree1);
88 4 : if (!ok) {
89 0 : torture_result(tctx, TORTURE_FAIL, "%s refused 2nd tree connect\n", host);
90 0 : return false;
91 : }
92 :
93 4 : cnum2 = smb2cli_tcon_current_id(tree1->smbXcli);
94 4 : cnum3 = MAX(cnum1, cnum2) + 1; /* any invalid number */
95 4 : sessid2 = smb2cli_session_current_id(tree1->session->smbXcli) + 1;
96 :
97 : /* try a write with the wrong tid */
98 4 : smb2cli_tcon_set_id(tree1->smbXcli, cnum2);
99 :
100 4 : status = smb2_util_write(tree1, fnum1, buf, 130, 4);
101 4 : if (NT_STATUS_IS_OK(status)) {
102 0 : torture_result(tctx, TORTURE_FAIL, "* server allows write with wrong TID\n");
103 0 : ret = false;
104 : } else {
105 4 : torture_comment(tctx, "server fails write with wrong TID : %s\n", nt_errstr(status));
106 : }
107 :
108 :
109 : /* try a write with an invalid tid */
110 4 : smb2cli_tcon_set_id(tree1->smbXcli, cnum3);
111 :
112 4 : status = smb2_util_write(tree1, fnum1, buf, 130, 4);
113 4 : if (NT_STATUS_IS_OK(status)) {
114 0 : torture_result(tctx, TORTURE_FAIL, "* server allows write with invalid TID\n");
115 0 : ret = false;
116 : } else {
117 4 : torture_comment(tctx, "server fails write with invalid TID : %s\n", nt_errstr(status));
118 : }
119 :
120 : /* try a write with an invalid session id */
121 4 : smb2cli_session_set_id(tree1->session->smbXcli, sessid2);
122 4 : smb2cli_tcon_set_id(tree1->smbXcli, cnum1);
123 :
124 4 : status = smb2_util_write(tree1, fnum1, buf, 130, 4);
125 4 : if (NT_STATUS_IS_OK(status)) {
126 0 : torture_result(tctx, TORTURE_FAIL, "* server allows write with invalid VUID\n");
127 0 : ret = false;
128 : } else {
129 4 : torture_comment(tctx, "server fails write with invalid VUID : %s\n", nt_errstr(status));
130 : }
131 :
132 4 : smb2cli_session_set_id(tree1->session->smbXcli, sessid1);
133 4 : smb2cli_tcon_set_id(tree1->smbXcli, cnum1);
134 :
135 4 : status = smb2_util_close(tree1, fnum1);
136 4 : if (NT_STATUS_IS_ERR(status)) {
137 0 : torture_result(tctx, TORTURE_FAIL, "close failed (%s)\n", nt_errstr(status));
138 0 : return false;
139 : }
140 :
141 4 : smb2cli_tcon_set_id(tree1->smbXcli, cnum2);
142 :
143 4 : smb2_util_unlink(tree1, fname);
144 :
145 4 : return ret;
146 : }
|
