[SCM] Samba Shared Repository - branch v4-15-test updated

Jule Anger janger at samba.org
Mon Feb 14 11:36:01 UTC 2022


The branch, v4-15-test has been updated
       via  1d0ba388223 s3:modules: Fix virusfilter_vfs_openat
       via  a47cc216156 s3:selftest: Add test for virus scanner
       via  a117fca9196 selftest: Fix trailing whitespace in Samba3.pm
       via  517266c75d0 docs-xml:manpages: Document 'dummy' virusfilter and 'virusfilter:infected files'
       via  b78a62a1f9f s3:modules: Implement dummy virus scanner that uses filename matching
       via  11fadec1ca5 selftest: Do not force -d0 for smbd/nmbd/winbindd
      from  62d33564f73 libcli/smb: let smb2_signing_decrypt_pdu() cope with gnutls_aead_cipher_decrypt() ptext_len bug

https://git.samba.org/?p=samba.git;a=shortlog;h=v4-15-test


- Log -----------------------------------------------------------------
commit 1d0ba38822398f9df66ca9e1b6e620d07b026c92
Author: Pavel Filipenský <pfilipen at redhat.com>
Date:   Mon Feb 7 23:06:10 2022 +0100

    s3:modules: Fix virusfilter_vfs_openat
    
    Bug: https://bugzilla.samba.org/show_bug.cgi?id=14971
    
    Signed-off-by: Pavel Filipenský <pfilipen at redhat.com>
    
    Pair-Programmed-With: Andreas Schneider <asn at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    Reviewed-by: Andreas Schneider <asn at samba.org>
    
    Autobuild-User(master): Jeremy Allison <jra at samba.org>
    Autobuild-Date(master): Thu Feb 10 22:09:06 UTC 2022 on sn-devel-184
    
    (cherry picked from commit 3f1c958f6fa9d2991185f4e281a377a295d09f9c)
    
    Autobuild-User(v4-15-test): Jule Anger <janger at samba.org>
    Autobuild-Date(v4-15-test): Mon Feb 14 11:35:40 UTC 2022 on sn-devel-184

commit a47cc2161569557bdb5c8c4ab896dd727e2de999
Author: Pavel Filipenský <pfilipen at redhat.com>
Date:   Tue Feb 8 15:35:48 2022 +0100

    s3:selftest: Add test for virus scanner
    
    Bug: https://bugzilla.samba.org/show_bug.cgi?id=14971
    
    Signed-off-by: Pavel Filipenský <pfilipen at redhat.com>
    
    Pair-Programmed-With: Andreas Schneider <asn at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    Reviewed-by: Andreas Schneider <asn at samba.org>
    (cherry picked from commit a25c714c34d3e00e0f3c29d2acfa98cf9cdbc544)

commit a117fca9196e83640cec1c36ea90516afec8114b
Author: Pavel Filipenský <pfilipen at redhat.com>
Date:   Tue Feb 8 15:34:56 2022 +0100

    selftest: Fix trailing whitespace in Samba3.pm
    
    Bug: https://bugzilla.samba.org/show_bug.cgi?id=14971
    
    Signed-off-by: Pavel Filipenský <pfilipen at redhat.com>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    Reviewed-by: Andreas Schneider <asn at samba.org>
    (cherry picked from commit 547b4c595a8513a4be99177edbaa39ce43840f7a)

commit 517266c75d071d41b33042db164f4f1cb7b3a5d3
Author: Pavel Filipenský <pfilipen at redhat.com>
Date:   Tue Feb 8 22:35:29 2022 +0100

    docs-xml:manpages: Document 'dummy' virusfilter and 'virusfilter:infected files'
    
    Bug: https://bugzilla.samba.org/show_bug.cgi?id=14971
    
    Signed-off-by: Pavel Filipenský <pfilipen at redhat.com>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    Reviewed-by: Andreas Schneider <asn at samba.org>
    (cherry picked from commit 2fd518e5cc63221c162c9b3f8526b9b7c9e34969)

commit b78a62a1f9f501b400366710d571765afe66277a
Author: Pavel Filipenský <pfilipen at redhat.com>
Date:   Tue Feb 8 12:07:03 2022 +0100

    s3:modules: Implement dummy virus scanner that uses filename matching
    
    Bug: https://bugzilla.samba.org/show_bug.cgi?id=14971
    
    Signed-off-by: Pavel Filipenský <pfilipen at redhat.com>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    Reviewed-by: Andreas Schneider <asn at samba.org>
    (cherry picked from commit 9f34babec7c6aca3d91f226705d3b3996792e5f1)

commit 11fadec1ca5cf5a756f178f9246dda47c9bfb23e
Author: Andreas Schneider <asn at samba.org>
Date:   Wed Feb 9 16:33:10 2022 +0100

    selftest: Do not force -d0 for smbd/nmbd/winbindd
    
    We have the env variable SERVER_LOG_LEVEL which allows you to change
    the log level on the command line. If we force -d0 this will not work.
    
    make test TESTS="samba" SERVER_LOG_LEVEL=10
    
    Signed-off-by: Andreas Schneider <asn at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    (cherry picked from commit 9693f7ea7383c6a51ab58b7c8255b30206f18a3b)

-----------------------------------------------------------------------

Summary of changes:
 docs-xml/manpages/vfs_virusfilter.8.xml    |  12 +++
 selftest/target/Samba3.pm                  |  20 ++++-
 source3/modules/vfs_virusfilter.c          |  18 ++++-
 source3/modules/vfs_virusfilter_common.h   |   4 +
 source3/modules/vfs_virusfilter_dummy.c    |  58 ++++++++++++++
 source3/modules/wscript_build              |   1 +
 source3/script/tests/test_virus_scanner.sh | 124 +++++++++++++++++++++++++++++
 source3/selftest/tests.py                  |   9 +++
 8 files changed, 239 insertions(+), 7 deletions(-)
 create mode 100644 source3/modules/vfs_virusfilter_dummy.c
 create mode 100755 source3/script/tests/test_virus_scanner.sh


Changeset truncated at 500 lines:

diff --git a/docs-xml/manpages/vfs_virusfilter.8.xml b/docs-xml/manpages/vfs_virusfilter.8.xml
index 329a35af68a..88f91d73a42 100644
--- a/docs-xml/manpages/vfs_virusfilter.8.xml
+++ b/docs-xml/manpages/vfs_virusfilter.8.xml
@@ -48,6 +48,10 @@
 		  scanner</para></listitem>
 		  <listitem><para><emphasis>clamav</emphasis>, the ClamAV
 		  scanner</para></listitem>
+		  <listitem><para><emphasis>dummy</emphasis>, dummy scanner used in
+		  tests. Checks against the <emphasis>infected files</emphasis>
+		  parameter and flags any name that matches as infected.
+		  </para></listitem>
 		</itemizedlist>
 		</listitem>
 		</varlistentry>
@@ -264,6 +268,14 @@
 		</listitem>
 		</varlistentry>
 
+		<varlistentry>
+		<term>virusfilter:infected files = empty</term>
+		<listitem>
+		<para>Files that virusfilter <emphasis>dummy</emphasis> flags as infected.</para>
+		<para>If this option is not set, the default is empty.</para>
+		</listitem>
+		</varlistentry>
+
 		<varlistentry>
 		<term>virusfilter:block access on error = false</term>
 		<listitem>
diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm
index b901fd2677a..c1d0c60d96a 100755
--- a/selftest/target/Samba3.pm
+++ b/selftest/target/Samba3.pm
@@ -188,7 +188,7 @@ sub getlog_env_app($$$)
 	close(LOG);
 
 	return "" if $out eq $title;
- 
+
 	return $out;
 }
 
@@ -1688,6 +1688,9 @@ sub setup_fileserver
 	my $veto_sharedir="$share_dir/veto";
 	push(@dirs,$veto_sharedir);
 
+	my $virusfilter_sharedir="$share_dir/virusfilter";
+	push(@dirs,$virusfilter_sharedir);
+
 	my $ip4 = Samba::get_ipv4_addr("FILESERVER");
 	my $fileserver_options = "
 	kernel change notify = yes
@@ -1813,6 +1816,15 @@ sub setup_fileserver
 	path = $veto_sharedir
 	delete veto files = yes
 
+[virusfilter]
+	path = $virusfilter_sharedir
+	vfs objects = acl_xattr virusfilter
+	virusfilter:scanner = dummy
+	virusfilter:min file size = 0
+	virusfilter:infected files = *infected*
+	virusfilter:infected file action = rename
+	virusfilter:scan on close = yes
+
 [homes]
 	comment = Home directories
 	browseable = No
@@ -2153,7 +2165,7 @@ sub make_bin_cmd
 {
 	my ($self, $binary, $env_vars, $options, $valgrind, $dont_log_stdout) = @_;
 
-	my @optargs = ("-d0");
+	my @optargs = ();
 	if (defined($options)) {
 		@optargs = split(/ /, $options);
 	}
@@ -2426,7 +2438,7 @@ sub provision($$)
 	my $nmbdsockdir="$prefix_abs/nmbd";
 	unlink($nmbdsockdir);
 
-	## 
+	##
 	## create the test directory layout
 	##
 	die ("prefix_abs = ''") if $prefix_abs eq "";
@@ -3290,7 +3302,7 @@ sub provision($$)
 	unless (open(PASSWD, ">$nss_wrapper_passwd")) {
            warn("Unable to open $nss_wrapper_passwd");
            return undef;
-        } 
+        }
 	print PASSWD "nobody:x:$uid_nobody:$gid_nobody:nobody gecos:$prefix_abs:/bin/false
 $unix_name:x:$unix_uid:$unix_gids[0]:$unix_name gecos:$prefix_abs:/bin/false
 pdbtest:x:$uid_pdbtest:$gid_nogroup:pdbtest gecos:$prefix_abs:/bin/false
diff --git a/source3/modules/vfs_virusfilter.c b/source3/modules/vfs_virusfilter.c
index 9fafe4e5d41..d1554967ad1 100644
--- a/source3/modules/vfs_virusfilter.c
+++ b/source3/modules/vfs_virusfilter.c
@@ -35,12 +35,14 @@
 
 enum virusfilter_scanner_enum {
 	VIRUSFILTER_SCANNER_CLAMAV,
+	VIRUSFILTER_SCANNER_DUMMY,
 	VIRUSFILTER_SCANNER_FSAV,
 	VIRUSFILTER_SCANNER_SOPHOS
 };
 
 static const struct enum_list scanner_list[] = {
 	{ VIRUSFILTER_SCANNER_CLAMAV,	"clamav" },
+	{ VIRUSFILTER_SCANNER_DUMMY,	"dummy" },
 	{ VIRUSFILTER_SCANNER_FSAV,	"fsav" },
 	{ VIRUSFILTER_SCANNER_SOPHOS,	"sophos" },
 	{ -1,				NULL }
@@ -199,6 +201,7 @@ static int virusfilter_vfs_connect(
 	int snum = SNUM(handle->conn);
 	struct virusfilter_config *config = NULL;
 	const char *exclude_files = NULL;
+	const char *infected_files = NULL;
 	const char *temp_quarantine_dir_mode = NULL;
 	const char *infected_file_command = NULL;
 	const char *scan_error_command = NULL;
@@ -255,6 +258,12 @@ static int virusfilter_vfs_connect(
 		set_namearray(&config->exclude_files, exclude_files);
 	}
 
+	infected_files = lp_parm_const_string(
+		snum, "virusfilter", "infected files", NULL);
+	if (infected_files != NULL) {
+		set_namearray(&config->infected_files, infected_files);
+	}
+
 	config->cache_entry_limit = lp_parm_int(
 		snum, "virusfilter", "cache entry limit", 100);
 
@@ -537,6 +546,9 @@ static int virusfilter_vfs_connect(
 	case VIRUSFILTER_SCANNER_CLAMAV:
 		ret = virusfilter_clamav_init(config);
 		break;
+	case VIRUSFILTER_SCANNER_DUMMY:
+		ret = virusfilter_dummy_init(config);
+		break;
 	default:
 		DBG_ERR("Unhandled scanner %d\n", backend);
 		return -1;
@@ -1297,21 +1309,21 @@ static int virusfilter_vfs_openat(struct vfs_handle_struct *handle,
 		 */
 		goto virusfilter_vfs_open_next;
 	}
-	ret = S_ISREG(smb_fname->st.st_ex_mode);
+	ret = S_ISREG(sbuf.st_ex_mode);
 	if (ret == 0) {
 		DBG_INFO("Not scanned: Directory or special file: %s/%s\n",
 			 cwd_fname, fname);
 		goto virusfilter_vfs_open_next;
 	}
 	if (config->max_file_size > 0 &&
-	    smb_fname->st.st_ex_size > config->max_file_size)
+	    sbuf.st_ex_size > config->max_file_size)
 	{
 		DBG_INFO("Not scanned: file size > max file size: %s/%s\n",
 			 cwd_fname, fname);
 		goto virusfilter_vfs_open_next;
 	}
 	if (config->min_file_size > 0 &&
-	    smb_fname->st.st_ex_size < config->min_file_size)
+	    sbuf.st_ex_size < config->min_file_size)
 	{
 		DBG_INFO("Not scanned: file size < min file size: %s/%s\n",
 		      cwd_fname, fname);
diff --git a/source3/modules/vfs_virusfilter_common.h b/source3/modules/vfs_virusfilter_common.h
index f71b0b949a7..463a9d74e9c 100644
--- a/source3/modules/vfs_virusfilter_common.h
+++ b/source3/modules/vfs_virusfilter_common.h
@@ -83,6 +83,9 @@ struct virusfilter_config {
 	/* Exclude files */
 	name_compare_entry		*exclude_files;
 
+	/* Infected files */
+	name_compare_entry		*infected_files;
+
 	/* Scan result cache */
 	struct virusfilter_cache	*cache;
 	int				cache_entry_limit;
@@ -149,5 +152,6 @@ struct virusfilter_backend {
 int virusfilter_sophos_init(struct virusfilter_config *config);
 int virusfilter_fsav_init(struct virusfilter_config *config);
 int virusfilter_clamav_init(struct virusfilter_config *config);
+int virusfilter_dummy_init(struct virusfilter_config *config);
 
 #endif /* _VIRUSFILTER_COMMON_H */
diff --git a/source3/modules/vfs_virusfilter_dummy.c b/source3/modules/vfs_virusfilter_dummy.c
new file mode 100644
index 00000000000..03405cd6629
--- /dev/null
+++ b/source3/modules/vfs_virusfilter_dummy.c
@@ -0,0 +1,58 @@
+/*
+   Samba-VirusFilter VFS modules
+   Dummy scanner with infected files support.
+   Copyright (C) 2022 Pavel Filipenský <pfilipen at redhat.com>
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "modules/vfs_virusfilter_utils.h"
+
+static virusfilter_result virusfilter_dummy_scan(
+	struct vfs_handle_struct *handle,
+	struct virusfilter_config *config,
+	const struct files_struct *fsp,
+	char **reportp)
+{
+	bool ok;
+
+	DBG_INFO("Scanning file: %s\n", fsp_str_dbg(fsp));
+	ok = is_in_path(fsp->fsp_name->base_name,
+			config->infected_files,
+			false);
+	return ok ? VIRUSFILTER_RESULT_INFECTED : VIRUSFILTER_RESULT_CLEAN;
+}
+
+static struct virusfilter_backend_fns virusfilter_backend_dummy = {
+	.connect = NULL,
+	.disconnect = NULL,
+	.scan_init = NULL,
+	.scan = virusfilter_dummy_scan,
+	.scan_end = NULL,
+};
+
+int virusfilter_dummy_init(struct virusfilter_config *config)
+{
+	struct virusfilter_backend *backend = NULL;
+
+	backend = talloc_zero(config, struct virusfilter_backend);
+	if (backend == NULL) {
+		return -1;
+	}
+
+	backend->fns = &virusfilter_backend_dummy;
+	backend->name = "dummy";
+	config->backend = backend;
+	return 0;
+}
diff --git a/source3/modules/wscript_build b/source3/modules/wscript_build
index 40df4539392..ff318c3fa06 100644
--- a/source3/modules/wscript_build
+++ b/source3/modules/wscript_build
@@ -591,6 +591,7 @@ bld.SAMBA3_MODULE('vfs_virusfilter',
                  vfs_virusfilter_sophos.c
                  vfs_virusfilter_fsav.c
                  vfs_virusfilter_clamav.c
+                 vfs_virusfilter_dummy.c
                  ''',
                  deps='samba-util VFS_VIRUSFILTER_UTILS',
                  init_function='',
diff --git a/source3/script/tests/test_virus_scanner.sh b/source3/script/tests/test_virus_scanner.sh
new file mode 100755
index 00000000000..2234ea6ca89
--- /dev/null
+++ b/source3/script/tests/test_virus_scanner.sh
@@ -0,0 +1,124 @@
+#!/bin/sh
+# Copyright (c) 2022      Pavel Filipenský <pfilipen at redhat.com>
+# shellcheck disable=1091
+
+if [ $# -lt 4 ]; then
+cat <<EOF
+Usage: $0 SERVER_IP SHARE LOCAL_PATH SMBCLIENT
+EOF
+exit 1;
+fi
+
+SERVER_IP=${1}
+SHARE=${2}
+LOCAL_PATH=${3}
+SMBCLIENT=${4}
+
+SMBCLIENT="${VALGRIND} ${SMBCLIENT}"
+
+failed=0
+sharedir="${LOCAL_PATH}/${SHARE}"
+
+incdir="$(dirname "$0")/../../../testprogs/blackbox"
+. "${incdir}/subunit.sh"
+
+check_infected_read()
+{
+    rm -rf "${sharedir:?}"/*
+
+    if ! touch "${sharedir}/infected.txt"; then
+        echo "ERROR: Cannot create ${sharedir}/infected.txt"
+        return 1
+    fi
+
+    ${SMBCLIENT} "//${SERVER_IP}/${SHARE}" -U"${USER}"%"${PASSWORD}" -c "get infected.txt ${sharedir}/infected.download.txt"
+
+    # check that virusfilter:rename prefix/suffix was added
+    if [ ! -f "${sharedir}/virusfilter.infected.txt.infected" ]; then
+        echo "ERROR: ${sharedir}/virusfilter.infected.txt.infected is missing."
+        return 1
+    fi
+
+    # check that file was not downloaded
+    if [ -f "${sharedir}/infected.download.txt" ]; then
+        echo "ERROR: {sharedir}/infected.download.txt should not exist."
+        return 1
+    fi
+
+    return 0
+}
+
+check_infected_write()
+{
+    rm -rf "${sharedir:?}"/*
+    smbfile=infected.upload.txt
+    smbfilerenamed="virusfilter.${smbfile}.infected"
+
+    # non empty file is needed
+    # vsf_virusfilter performs a scan only if fsp->fsp_flags.modified
+    if ! echo "Hello Virus!" > "${sharedir}/infected.txt"; then
+        echo "ERROR: Cannot create ${sharedir}/infected.txt"
+        return 1
+    fi
+
+    ${SMBCLIENT} "//${SERVER_IP}/${SHARE}" -U"${USER}"%"${PASSWORD}" -c "put ${sharedir}/infected.txt ${smbfile}"
+
+    # check that virusfilter:rename prefix/suffix was added
+    if [ ! -f "${sharedir}/${smbfilerenamed}" ]; then
+        echo "ERROR: ${sharedir}/${smbfilerenamed} is missing."
+        return 1
+    fi
+
+    # check that file was not uploaded
+    if [ -f "${sharedir}/infected.upload.txt" ]; then
+        echo "ERROR: {sharedir}/${smbfile} should not exist."
+        return 1
+    fi
+
+    return 0
+}
+
+check_healthy_read()
+{
+    rm -rf "${sharedir:?}"/*
+
+    if ! echo "Hello Samba!" > "${sharedir}/healthy.txt"; then
+        echo "ERROR: Cannot create ${sharedir}/healthy.txt"
+        return 1
+    fi
+
+    ${SMBCLIENT} //"${SERVER_IP}"/"${SHARE}" -U"${USER}"%"${PASSWORD}" -c "get healthy.txt ${sharedir}/healthy.download.txt"
+
+    if ! cmp "${sharedir}/healthy.txt" "${sharedir}/healthy.download.txt"; then
+        echo "ERROR: cmp ${sharedir}/healthy.txt ${sharedir}/healthy.download.txt FAILED"
+        return 1
+    fi
+
+    return 0
+}
+
+check_healthy_write()
+{
+    rm -rf "${sharedir:?}"/*
+
+    if ! echo "Hello Samba!" > "${sharedir}/healthy.txt"; then
+        echo "ERROR: Cannot create ${sharedir}/healthy.txt"
+        return 1
+    fi
+
+    ${SMBCLIENT} //"${SERVER_IP}"/"${SHARE}" -U"${USER}"%"${PASSWORD}" -c "put ${sharedir}/healthy.txt healthy.upload.txt"
+
+    if ! cmp "${sharedir}/healthy.txt" "${sharedir}/healthy.upload.txt"; then
+        echo "ERROR: cmp ${sharedir}/healthy.txt ${sharedir}/healthy.upload.txt FAILED"
+        return 1
+    fi
+
+    return 0
+}
+
+testit "check_infected_read"  check_infected_read  || failed=$((failed + 1))
+testit "check_infected_write" check_infected_write || failed=$((failed + 1))
+testit "check_healthy_read"   check_healthy_read   || failed=$((failed + 1))
+testit "check_healthy_write"  check_healthy_write  || failed=$((failed + 1))
+
+testok "$0" "$failed"
diff --git a/source3/selftest/tests.py b/source3/selftest/tests.py
index 701be011f70..6b146c76381 100755
--- a/source3/selftest/tests.py
+++ b/source3/selftest/tests.py
@@ -1240,6 +1240,15 @@ plantestsuite("samba3.blackbox.smbXsrv_client_dead_rec", "fileserver:local",
                '$SERVER_IP',
                "tmp"])
 
+env = 'fileserver'
+plantestsuite("samba3.blackbox.virus_scanner", "%s:local" % (env),
+              [os.path.join(samba3srcdir,
+                            "script/tests/test_virus_scanner.sh"),
+               '$SERVER_IP',
+               "virusfilter",
+               '$LOCAL_PATH',
+               smbclient3])
+
 for env in ['fileserver', 'simpleserver']:
     plantestsuite("samba3.blackbox.smbclient.encryption", env,
                   [os.path.join(samba3srcdir, "script/tests/test_smbclient_encryption.sh"),


-- 
Samba Shared Repository



More information about the samba-cvs mailing list