[SCM] Samba Shared Repository - branch master updated

[Jeremy Allison]

The branch, master has been updated
       via  a52c7f4 torture3: Add test for smbd crash
       via  cf9acf9 smbd: Do an early exit on negprot failure
      from  1e0c79d s3: smbd: Restart reading the incoming SMB2 fd when the send queue is drained.

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit a52c7f4d52df6853f925e680eadefcdfdc7bea85
Author: Volker Lendecke <vl at samba.org>
Date:   Tue Feb 28 16:17:03 2017 +0100

    torture3: Add test for smbd crash
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=12610
    
    Signed-off-by: Volker Lendecke <vl at samba.org>
    Reviewed-by: Ralph Böhme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    
    Autobuild-User(master): Jeremy Allison <jra at samba.org>
    Autobuild-Date(master): Fri Mar  3 06:20:50 CET 2017 on sn-devel-144

commit cf9acf9a3da932fca115967eb3d9d9ed48fcbbfc
Author: Volker Lendecke <vl at samba.org>
Date:   Tue Feb 28 15:03:45 2017 +0000

    smbd: Do an early exit on negprot failure
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=12610
    
    Signed-off-by: Volker Lendecke <vl at samba.org>
    Reviewed-by: Ralph Böhme <slow at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

-----------------------------------------------------------------------

Summary of changes:
 source3/smbd/negprot.c    | 21 +++++++++----
 source3/torture/torture.c | 76 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 91 insertions(+), 6 deletions(-)


Changeset truncated at 500 lines:

diff --git a/source3/smbd/negprot.c b/source3/smbd/negprot.c
index cdde334..838ff45 100644
--- a/source3/smbd/negprot.c
+++ b/source3/smbd/negprot.c
@@ -723,17 +723,26 @@ void reply_negprot(struct smb_request *req)
 			break;
 	}
 
-	if(choice != -1) {
-		fstrcpy(remote_proto,supported_protocols[protocol].short_name);
-		reload_services(sconn, conn_snum_used, true);
-		supported_protocols[protocol].proto_reply_fn(req, choice);
-		DEBUG(3,("Selected protocol %s\n",supported_protocols[protocol].proto_name));
-	} else {
+	if (choice == -1) {
+		bool ok;
+
 		DBG_NOTICE("No protocol supported !\n");
 		reply_outbuf(req, 1, 0);
 		SSVAL(req->outbuf, smb_vwv0, choice);
+
+		ok = srv_send_smb(xconn, (char *)req->outbuf,
+				  false, 0, false, NULL);
+		if (!ok) {
+			DBG_NOTICE("srv_send_smb failed\n");
+		}
+		exit_server_cleanly("no protocol supported\n");
 	}
 
+	fstrcpy(remote_proto,supported_protocols[protocol].short_name);
+	reload_services(sconn, conn_snum_used, true);
+	supported_protocols[protocol].proto_reply_fn(req, choice);
+	DEBUG(3,("Selected protocol %s\n",supported_protocols[protocol].proto_name));
+
 	DEBUG( 5, ( "negprot index=%d\n", choice ) );
 
 	/* We always have xconn->smb1.signing_state also for >= SMB2_02 */
diff --git a/source3/torture/torture.c b/source3/torture/torture.c
index 3062122..2c10ae8 100644
--- a/source3/torture/torture.c
+++ b/source3/torture/torture.c
@@ -11163,6 +11163,81 @@ static bool run_local_canonicalize_path(int dummy)
 	return true;
 }
 
+static bool run_ign_bad_negprot(int dummy)
+{
+	struct tevent_context *ev;
+	struct tevent_req *req;
+	struct smbXcli_conn *conn;
+	struct sockaddr_storage ss;
+	NTSTATUS status;
+	int fd;
+	bool ok;
+
+	printf("starting ignore bad negprot\n");
+
+	ok = resolve_name(host, &ss, 0x20, true);
+	if (!ok) {
+		d_fprintf(stderr, "Could not resolve name %s\n", host);
+		return false;
+	}
+
+	status = open_socket_out(&ss, 445, 10000, &fd);
+	if (!NT_STATUS_IS_OK(status)) {
+		d_fprintf(stderr, "open_socket_out failed: %s\n",
+			  nt_errstr(status));
+		return false;
+	}
+
+	conn = smbXcli_conn_create(talloc_tos(), fd, host, SMB_SIGNING_OFF, 0,
+				   NULL, 0);
+	if (conn == NULL) {
+		d_fprintf(stderr, "smbXcli_conn_create failed\n");
+		return false;
+	}
+
+	status = smbXcli_negprot(conn, 0, PROTOCOL_CORE, PROTOCOL_CORE);
+	if (NT_STATUS_IS_OK(status)) {
+		d_fprintf(stderr, "smbXcli_negprot succeeded!\n");
+		return false;
+	}
+
+	ev = samba_tevent_context_init(talloc_tos());
+	if (ev == NULL) {
+		d_fprintf(stderr, "samba_tevent_context_init failed\n");
+		return false;
+	}
+
+	req = smb1cli_session_setup_nt1_send(
+		ev, ev, conn, 0, getpid(), NULL, 65503, 2, 1, 0, "", "",
+		data_blob_null, data_blob_null, 0x40,
+		"Windows 2000 2195", "Windows 2000 5.0");
+	if (req == NULL) {
+		d_fprintf(stderr, "smb1cli_session_setup_nt1_send failed\n");
+		return false;
+	}
+
+	ok = tevent_req_poll_ntstatus(req, ev, &status);
+	if (!ok) {
+		d_fprintf(stderr, "tevent_req_poll failed\n");
+		return false;
+	}
+
+	status = smb1cli_session_setup_nt1_recv(req, NULL, NULL, NULL, NULL,
+						NULL, NULL);
+	if (!NT_STATUS_EQUAL(status, NT_STATUS_CONNECTION_RESET)) {
+		d_fprintf(stderr, "smb1cli_session_setup_nt1_recv returned "
+			  "%s, expected NT_STATUS_CONNECTION_RESET\n",
+			  nt_errstr(status));
+		return false;
+	}
+
+	TALLOC_FREE(conn);
+
+	printf("starting ignore bad negprot\n");
+
+	return true;
+}
+
 static double create_procs(bool (*fn)(int), bool *result)
 {
 	int i, status;
@@ -11353,6 +11428,7 @@ static struct {
 	{ "NOTIFY-BENCH2", run_notify_bench2 },
 	{ "NOTIFY-BENCH3", run_notify_bench3 },
 	{ "BAD-NBT-SESSION", run_bad_nbt_session },
+	{ "IGN-BAD-NEGPROT", run_ign_bad_negprot },
 	{ "SMB-ANY-CONNECT", run_smb_any_connect },
 	{ "NOTIFY-ONLINE", run_notify_online },
 	{ "SMB2-BASIC", run_smb2_basic },


-- 
Samba Shared Repository