/*
Unix SMB/CIFS implementation.
SMB torture tester - mangling test
Copyright (C) Andrew Tridgell 2002
Copyright (C) David Mulder 2019
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see .
*/
#include "includes.h"
#include "system/filesys.h"
#include "system/dir.h"
#include
#include "../lib/util/util_tdb.h"
#include "libcli/smb2/smb2.h"
#include "libcli/smb2/smb2_calls.h"
#include "torture/util.h"
#include "torture/smb2/proto.h"
#undef strcasecmp
static TDB_CONTEXT *tdb;
#define NAME_LENGTH 20
static unsigned int total, collisions, failures;
static bool test_one(struct torture_context *tctx, struct smb2_tree *tree,
const char *name)
{
struct smb2_handle fnum;
const char *shortname;
const char *name2;
NTSTATUS status;
TDB_DATA data;
struct smb2_create io = {0};
total++;
io.in.fname = name;
io.in.desired_access = SEC_FILE_READ_DATA | SEC_FILE_WRITE_DATA |
SEC_FILE_EXECUTE;
io.in.create_disposition = NTCREATEX_DISP_CREATE;
io.in.share_access = NTCREATEX_SHARE_ACCESS_READ |
NTCREATEX_SHARE_ACCESS_WRITE |
NTCREATEX_SHARE_ACCESS_DELETE;
io.in.file_attributes = FILE_ATTRIBUTE_NORMAL;
status = smb2_create(tree, tree, &io);
if (!NT_STATUS_IS_OK(status)) {
torture_comment(tctx, "open of %s failed (%s)\n", name,
nt_errstr(status));
return false;
}
fnum = io.out.file.handle;
status = smb2_util_close(tree, fnum);
if (NT_STATUS_IS_ERR(status)) {
torture_comment(tctx, "close of %s failed (%s)\n", name,
nt_errstr(status));
return false;
}
/* get the short name */
status = smb2_qpathinfo_alt_name(tctx, tree, name, &shortname);
if (!NT_STATUS_IS_OK(status)) {
torture_comment(tctx, "query altname of %s failed (%s)\n",
name, nt_errstr(status));
return false;
}
name2 = talloc_asprintf(tctx, "mangle_test\\%s", shortname);
status = smb2_util_unlink(tree, name2);
if (NT_STATUS_IS_ERR(status)) {
torture_comment(tctx, "unlink of %s (%s) failed (%s)\n",
name2, name, nt_errstr(status));
return false;
}
/* recreate by short name */
io = (struct smb2_create){0};
io.in.fname = name2;
io.in.desired_access = SEC_FILE_READ_DATA | SEC_FILE_WRITE_DATA |
SEC_FILE_EXECUTE;
io.in.create_disposition = NTCREATEX_DISP_CREATE;
io.in.share_access = NTCREATEX_SHARE_ACCESS_READ |
NTCREATEX_SHARE_ACCESS_WRITE |
NTCREATEX_SHARE_ACCESS_DELETE;
io.in.file_attributes = FILE_ATTRIBUTE_NORMAL;
status = smb2_create(tree, tree, &io);
if (!NT_STATUS_IS_OK(status)) {
torture_comment(tctx, "open2 of %s failed (%s)\n", name2,
nt_errstr(status));
return false;
}
fnum = io.out.file.handle;
status = smb2_util_close(tree, fnum);
if (NT_STATUS_IS_ERR(status)) {
torture_comment(tctx, "close of %s failed (%s)\n", name,
nt_errstr(status));
return false;
}
/* and unlink by long name */
status = smb2_util_unlink(tree, name);
if (NT_STATUS_IS_ERR(status)) {
torture_comment(tctx, "unlink2 of %s (%s) failed (%s)\n",
name, name2, nt_errstr(status));
failures++;
smb2_util_unlink(tree, name2);
return true;
}
/* see if the short name is already in the tdb */
data = tdb_fetch_bystring(tdb, shortname);
if (data.dptr) {
/* maybe its a duplicate long name? */
if (strcasecmp(name, (const char *)data.dptr) != 0) {
/* we have a collision */
collisions++;
torture_comment(tctx, "Collision between %s and %s"
" -> %s (coll/tot: %u/%u)\n",
name, data.dptr, shortname, collisions,
total);
}
free(data.dptr);
} else {
TDB_DATA namedata;
/* store it for later */
namedata.dptr = discard_const_p(uint8_t, name);
namedata.dsize = strlen(name)+1;
tdb_store_bystring(tdb, shortname, namedata, TDB_REPLACE);
}
return true;
}
static char *gen_name(struct torture_context *tctx)
{
const char *chars = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz._-$~...";
unsigned int max_idx = strlen(chars);
unsigned int len;
int i;
char *p = NULL;
char *name = NULL;
name = talloc_strdup(tctx, "mangle_test\\");
if (!name) {
return NULL;
}
len = 1 + random() % NAME_LENGTH;
name = talloc_realloc(tctx, name, char, strlen(name) + len + 6);
if (!name) {
return NULL;
}
p = name + strlen(name);
for (i=0;i 5) && (random() % 10 == 0)) {
strlcpy(p, "ABCDE", 6);
}
/* and a high probability of a good extension length */
if (random() % 2 == 0) {
char *s = strrchr(p, '.');
if (s) {
s[4] = 0;
}
}
return name;
}
bool torture_smb2_mangle(struct torture_context *torture,
struct smb2_tree *tree)
{
extern int torture_numops;
int i;
bool ok;
NTSTATUS status;
/* we will use an internal tdb to store the names we have used */
tdb = tdb_open(NULL, 100000, TDB_INTERNAL, 0, 0);
torture_assert(torture, tdb, "ERROR: Failed to open tdb\n");
ok = smb2_util_setup_dir(torture, tree, "mangle_test");
torture_assert(torture, ok, "smb2_util_setup_dir failed\n");
for (i=0;i