[PATCH] Fix for bug 11684

[Ralph Boehme]

Hi!

Reportedly, copying data from a Win 7 client's CD drive to a Samba
share can fail.

It turns out the Windows client sends a directory creation request
with an initial allocation size > 0 which is currently rejected in
create_file_unixpath() with NT_STATUS_ACCESS_DENIED.

Windows behaviour is to allow the directory creation, ignoring the
allocation size.

Attached patch fixes this.

Fwiw, from initial investigation I guess we can also allow querying
the allocation size for directories in vfswrap_get_alloc_size() by
removing:

--- a/source3/modules/vfs_default.c
+++ b/source3/modules/vfs_default.c
@@ -1614,11 +1614,6 @@ static uint64_t vfswrap_get_alloc_size(vfs_handle_struct *handle,

        START_PROFILE(syscall_get_alloc_size);

-       if(S_ISDIR(sbuf->st_ex_mode)) {
-               result = 0;
-               goto out;
-       }
-

Currently we always return 0 here for directories while Windows
reports values > 0 (once directorires have more then 2 or 3 entries)
that seem to reflect the actual allocation size.

But I that's something for another patch.

-Ralph

-- 
SerNet GmbH, Bahnhofsallee 1b, 37081 Göttingen
phone: +49-551-370000-0, fax: +49-551-370000-9
AG Göttingen, HRB 2816, GF: Dr. Johannes Loxen
http://www.sernet.de,mailto:kontakt@sernet.de
-------------- next part --------------
From aa0cedbb153ab12e478d72656e729419615294bf Mon Sep 17 00:00:00 2001
From: Ralph Boehme <slow at samba.org>
Date: Wed, 25 Nov 2015 15:23:26 +0100
Subject: [PATCH 1/2] s3:smbd: Ignore initial allocation size for directory
 creation

We reject directory creation with an initial allocation size > 0 with
NT_STATUS_ACCESS_DENIED. Windows servers ignore the initial allocation
size on directories.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11684

Pair-Programmed-With: Volker Lendecke <vl at samba.org>
Signed-off-by: Ralph Boehme <slow at samba.org>
---
 source3/smbd/open.c | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/source3/smbd/open.c b/source3/smbd/open.c
index 3c0a7a3..ed0594b 100644
--- a/source3/smbd/open.c
+++ b/source3/smbd/open.c
@@ -4708,15 +4708,11 @@ static NTSTATUS create_file_unixpath(connection_struct *conn,
 
 	/* Save the requested allocation size. */
 	if ((info == FILE_WAS_CREATED) || (info == FILE_WAS_OVERWRITTEN)) {
-		if (allocation_size
-		    && (allocation_size > fsp->fsp_name->st.st_ex_size)) {
+		if ((allocation_size > fsp->fsp_name->st.st_ex_size)
+		    && !(fsp->is_directory))
+		{
 			fsp->initial_allocation_size = smb_roundup(
 				fsp->conn, allocation_size);
-			if (fsp->is_directory) {
-				/* Can't set allocation size on a directory. */
-				status = NT_STATUS_ACCESS_DENIED;
-				goto fail;
-			}
 			if (vfs_allocate_file_space(
 				    fsp, fsp->initial_allocation_size) == -1) {
 				status = NT_STATUS_DISK_FULL;
-- 
2.5.0


From ef52e885038308635a4063eb10d888b0b1447bd0 Mon Sep 17 00:00:00 2001
From: Ralph Boehme <slow at samba.org>
Date: Wed, 20 Jan 2016 17:46:38 +0100
Subject: [PATCH 2/2] s4:torture: add SMB2 test for directory creation initial
 allocation size

Test that directory creation with an initial allocation size > 0
succeeds.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11684

Signed-off-by: Ralph Boehme <slow at samba.org>
---
 source4/torture/smb2/create.c | 64 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 64 insertions(+)

diff --git a/source4/torture/smb2/create.c b/source4/torture/smb2/create.c
index 68dbbc1..a520e78 100644
--- a/source4/torture/smb2/create.c
+++ b/source4/torture/smb2/create.c
@@ -1666,6 +1666,69 @@ done:
 	return ret;
 }
 
+/*
+  test directory creation with an initial allocation size > 0
+*/
+static bool test_dir_alloc_size(struct torture_context *tctx,
+				struct smb2_tree *tree)
+{
+	bool ret = true;
+	const char *dname = DNAME "\\torture_alloc_size.dir";
+	NTSTATUS status;
+	struct smb2_create c;
+	struct smb2_handle h1 = { 0 }, h2;
+
+	torture_comment(tctx, "Checking initial allocation size on directories\n");
+
+	smb2_deltree(tree, dname);
+
+	status = torture_smb2_testdir(tree, DNAME, &h1);
+	torture_assert_ntstatus_ok_goto(tctx, status, ret, done, "torture_smb2_testdir failed");
+
+	ZERO_STRUCT(c);
+	c.in.create_disposition = NTCREATEX_DISP_CREATE;
+	c.in.desired_access = SEC_FLAG_MAXIMUM_ALLOWED;
+	c.in.file_attributes = FILE_ATTRIBUTE_DIRECTORY;
+	c.in.share_access = NTCREATEX_SHARE_ACCESS_NONE;
+	c.in.create_options = NTCREATEX_OPTIONS_DIRECTORY;
+	c.in.fname = dname;
+	/*
+	 * An insanely large value so we can check the value is
+	 * ignored: Samba either returns 0 (current behaviour), or,
+	 * once vfswrap_get_alloc_size() is fixed to allow retrieving
+	 * the allocated size for directories, returns
+	 * smb_roundup(..., stat.st_size) which would be 1 MB by
+	 * default.
+	 *
+	 * Windows returns 0 for emtpy directories, once directories
+	 * have a few entries it starts replying with values > 0.
+	 */
+	c.in.alloc_size = 1024*1024*1024;
+
+	status = smb2_create(tree, tctx, &c);
+	h2 = c.out.file.handle;
+	torture_assert_ntstatus_ok_goto(tctx, status, ret, done,
+					"dir create with initial alloc size failed");
+
+	smb2_util_close(tree, h2);
+
+	torture_comment(tctx, "Got directory alloc size: %ju\n", (uintmax_t)c.out.alloc_size);
+
+	/*
+	 * See above for the rational for this test
+	 */
+	if (c.out.alloc_size > 1024*1024) {
+		torture_fail_goto(tctx, done, talloc_asprintf(tctx, "bad alloc size: %ju",
+							      (uintmax_t)c.out.alloc_size));
+	}
+
+done:
+	if (!smb2_util_handle_empty(h1)) {
+		smb2_util_close(tree, h1);
+	}
+	smb2_deltree(tree, DNAME);
+	return ret;
+}
 
 /*
    basic testing of SMB2 read
@@ -1686,6 +1749,7 @@ struct torture_suite *torture_smb2_create_init(void)
 	torture_suite_add_1smb2_test(suite, "acldir", test_create_acl_dir);
 	torture_suite_add_1smb2_test(suite, "nulldacl", test_create_null_dacl);
 	torture_suite_add_1smb2_test(suite, "mkdir-dup", test_mkdir_dup);
+	torture_suite_add_1smb2_test(suite, "dir-alloc-size", test_dir_alloc_size);
 
 	suite->description = talloc_strdup(suite, "SMB2-CREATE tests");
 
-- 
2.5.0