[SCM] Samba Shared Repository - branch master updated

[Stefan Metzmacher]

The branch, master has been updated
       via  462b74da79c vfs_default: also call vfs_offload_token_ctx_init in vfswrap_offload_write_send
       via  372476aeb00 s4:torture/smb2: add smb2.ioctl.copy_chunk_bug15644
      from  35f6c3f3d4a ctdb/docs: Include ceph rados namespace support in man page

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 462b74da79c51f9ba6dbd24e603aa904485d5123
Author: Stefan Metzmacher <metze at samba.org>
Date:   Mon Jun 17 10:41:53 2024 +0200

    vfs_default: also call vfs_offload_token_ctx_init in vfswrap_offload_write_send
    
    If a client for whatever reason calls FSCTL_SRV_COPYCHUNK[_WRITE] without
    FSCTL_SRV_REQUEST_RESUME_KEY, we call vfswrap_offload_write_send
    before vfswrap_offload_read_send.
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=15664
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>
    Reviewed-by: Noel Power <noel.power at suse.com>
    
    Autobuild-User(master): Stefan Metzmacher <metze at samba.org>
    Autobuild-Date(master): Mon Jun 17 18:02:27 UTC 2024 on atb-devel-224

commit 372476aeb003e9c608cd2c0a78a9c577b57ba8f4
Author: Stefan Metzmacher <metze at samba.org>
Date:   Mon Jun 17 11:18:07 2024 +0200

    s4:torture/smb2: add smb2.ioctl.copy_chunk_bug15644
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=15664
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>
    Reviewed-by: Noel Power <noel.power at suse.com>

-----------------------------------------------------------------------

Summary of changes:
 source3/modules/vfs_default.c |  6 ++++
 source4/torture/smb2/ioctl.c  | 64 +++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 70 insertions(+)


Changeset truncated at 500 lines:

diff --git a/source3/modules/vfs_default.c b/source3/modules/vfs_default.c
index 48b5dd9e39f..e0ebc7bd1a2 100644
--- a/source3/modules/vfs_default.c
+++ b/source3/modules/vfs_default.c
@@ -2148,6 +2148,12 @@ static struct tevent_req *vfswrap_offload_write_send(
 		.remaining = to_copy,
 	};
 
+	status = vfs_offload_token_ctx_init(handle->conn->sconn->client,
+					    &vfswrap_offload_ctx);
+	if (tevent_req_nterror(req, status)) {
+		return tevent_req_post(req, ev);
+	}
+
 	tevent_req_set_cleanup_fn(req, vfswrap_offload_write_cleanup);
 
 	switch (fsctl) {
diff --git a/source4/torture/smb2/ioctl.c b/source4/torture/smb2/ioctl.c
index 3765dc0c1bd..beceaa5c551 100644
--- a/source4/torture/smb2/ioctl.c
+++ b/source4/torture/smb2/ioctl.c
@@ -7388,6 +7388,68 @@ static bool test_ioctl_bug14788_NETWORK_INTERFACE(struct torture_context *tortur
 	return true;
 }
 
+/*
+ * basic regression test for BUG 15664
+ * https://bugzilla.samba.org/show_bug.cgi?id=15664
+ */
+static bool test_ioctl_copy_chunk_bug15644(struct torture_context *torture,
+					   struct smb2_tree *tree)
+{
+	struct smb2_handle dest_h;
+	NTSTATUS status;
+	union smb_ioctl ioctl;
+	TALLOC_CTX *tmp_ctx = talloc_new(tree);
+	struct srv_copychunk chunk;
+	struct srv_copychunk_copy cc_copy;
+	enum ndr_err_code ndr_ret;
+	bool ok;
+
+	ok = test_setup_create_fill(torture,
+				    tree,
+				    tmp_ctx,
+				    FNAME2,
+				    &dest_h,
+				    0,
+				    SEC_RIGHTS_FILE_ALL,
+				    FILE_ATTRIBUTE_NORMAL);
+	torture_assert(torture, ok, "dest file create fill");
+
+	ZERO_STRUCT(ioctl);
+	ioctl.smb2.level = RAW_IOCTL_SMB2;
+	ioctl.smb2.in.file.handle = dest_h;
+	ioctl.smb2.in.function = FSCTL_SRV_COPYCHUNK;
+	ioctl.smb2.in.max_output_response = sizeof(struct srv_copychunk_rsp);
+	ioctl.smb2.in.flags = SMB2_IOCTL_FLAG_IS_FSCTL;
+
+	ZERO_STRUCT(chunk);
+	ZERO_STRUCT(cc_copy);
+	/* overwrite the resume key with a bogus value */
+	memcpy(cc_copy.source_key, "deadbeefdeadbeefdeadbeef", 24);
+	cc_copy.chunk_count = 1;
+	cc_copy.chunks = &chunk;
+	cc_copy.chunks[0].source_off = 0;
+	cc_copy.chunks[0].target_off = 0;
+	cc_copy.chunks[0].length = 4096;
+
+	ndr_ret = ndr_push_struct_blob(&ioctl.smb2.in.out, tmp_ctx,
+				       &cc_copy,
+			(ndr_push_flags_fn_t)ndr_push_srv_copychunk_copy);
+	torture_assert_ndr_success(torture, ndr_ret,
+				   "ndr_push_srv_copychunk_copy");
+
+	/* Server 2k12 returns NT_STATUS_OBJECT_NAME_NOT_FOUND */
+	status = smb2_ioctl(tree, tmp_ctx, &ioctl.smb2);
+	torture_assert_ntstatus_equal(torture, status,
+				      NT_STATUS_OBJECT_NAME_NOT_FOUND,
+				      "FSCTL_SRV_COPYCHUNK");
+
+	status = smb2_util_close(tree, dest_h);
+	torture_assert_ntstatus_ok(torture, status, "close");
+
+	talloc_free(tmp_ctx);
+	return true;
+}
+
 /*
  * testing of SMB2 ioctls
  */
@@ -7420,6 +7482,8 @@ struct torture_suite *torture_smb2_ioctl_init(TALLOC_CTX *ctx)
 				     test_ioctl_copy_chunk_dest_lck);
 	torture_suite_add_1smb2_test(suite, "copy_chunk_bad_key",
 				     test_ioctl_copy_chunk_bad_key);
+	torture_suite_add_1smb2_test(suite, "copy_chunk_bug15644",
+				     test_ioctl_copy_chunk_bug15644);
 	torture_suite_add_1smb2_test(suite, "copy_chunk_src_is_dest",
 				     test_ioctl_copy_chunk_src_is_dest);
 	torture_suite_add_1smb2_test(suite, "copy_chunk_src_is_dest_overlap",


-- 
Samba Shared Repository