python/samba/tests/smbd_fuzztest.py

   1 # Unix SMB/CIFS implementation. Tests for smbd fuzzing.
   2 # Copyright (C) Jeremy Allison 2019.
   3 #
   4 # This program is free software; you can redistribute it and/or modify
   5 # it under the terms of the GNU General Public License as published by
   6 # the Free Software Foundation; either version 3 of the License, or
   7 # (at your option) any later version.
   8 #
   9 # This program is distributed in the hope that it will be useful,
  10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12 # GNU General Public License for more details.
  13 #
  14 # You should have received a copy of the GNU General Public License
  15 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
  16 #
  17
  18 import samba
  19 import os
  20 import binascii
  21 import socket
  22
  23 class fuzzsmbd(samba.tests.TestCase):
  24     def test_bug_14205(self):
  25         #
  26         # badblob consists of an incorrectly
  27         # terminated SMB1 Negprot, with a valid SessionSetup after.
  28         # BUG: #14205 causes the smbd server to crash.
  29         #
  30         state = True
  31         badblob = binascii.a2b_base64("AAAA1P9TTUJyAAAAABhDyAAAAAAAAAAAAAAAACcA/v8AAAAAALEAAlBDIE5F"
  32                                       "VFdPUksgUFJPR1JBTSD//jAAAk1JQ1JPU09GVCBOR1RXT1JLUyAxLjANDAJN"
  33                                       "SR3hkXOl0mb+QXW4Da/jp0f+AAAA1P9TTUJyAAAAABgDyAAABDQAAAAAAAAA"
  34                                       "ACcA/v8AAAAAALEAAlBDIE5FVFdPUksgUFJPR1JBFBX//jAAAk1JQ1JPU09G"
  35                                       "VCBOR1RXT1JLUyAxLjANDAJNSR3hkUal0mb+QXW4Da/jp0f+AAAA1P9TTUJz"
  36                                       "LTE0OEF1uA2v46dH/gqAIIwiAoRiVHWgODu8OdksJQAAAAAnAP7/AAAAAACx"
  37                                       "AAJQQyBORVRXT1JLIFBST0dSQU0g//4wAAJNSUNST1NPRlQgTkdUV09SS1Mg"
  38                                       "MS4wDQwCTUkd4ZFGpdJm/kF1uA2v46dH/gAAANT/U01Ccy0xNDgyMTIyOTE3"
  39                                       "Nzk2MzIAAAAAGAPIAAAAAAAAAAAAAAAAJwD+/wAAAAAAsQACUEMgTkVUV09S"
  40                                       "SyBQUk9HUkFNIP/+MAACTUlDUk9TT0ZUIE5HVFdPUktTIDEuMA0GAAAAAAAA"
  41                                       "AKXSZv5BdbgNr+OnR/4AAADU/1NNQnMtMTQ4MjEyMjkxNzc5NjMyNDQ4NDNA"
  42                                       "ujcyNjgAsQACUEMgTkVUF09SSyAgAAAAAAAAAP/+MAACTUlDUk9TT0bAIE5H"
  43                                       "BwAtMjMxODIxMjE4MTM5OTU0ODA2OP5BdbgNr+OnR/4KgCCMIgKEYlR1oDg7"
  44                                       "vDnZLCWy")
  45         s = None
  46         try:
  47             s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  48             s.connect(("fileserver", 445))
  49             s.send(badblob)
  50             # Read the 39-byte SMB1 reply to the SMB1 Negprot.
  51             # This is an error message saying the Negprot was
  52             # invalid.
  53             rb = s.recv(1024)
  54             try:
  55                 # Read again to wait for the server to exit.
  56                 rb = s.recv(1024)
  57             except socket.error as e:
  58                 # We expect a socket error here as
  59                 # in both success and fail cases the
  60                 # server just resets the connection.
  61                 pass
  62             finally:
  63                 pass
  64         finally:
  65             if s is not None:
  66                 s.close()
  67         #
  68         # If the server crashed there is the
  69         # following message in the debug log.
  70         #
  71         for line in open(os.environ['SMBD_TEST_LOG']):
  72             if "INTERNAL ERROR: Signal 11 in pid" in line:
  73                 print("Found crash in smbd log")
  74                 state = False
  75                 break
  76         self.assertTrue(state)