Attachment 9793 Details for Bug 10422 – Patch for v4-0-test

[patch] Patch for v4-0-test

tmp40.diff (text/plain), 23.30 KB, created by Stefan Metzmacher on 2014-03-20 15:25:50 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Stefan Metzmacher

Created: 2014-03-20 15:25:50 UTC

Size: 23.30 KB

patch

obsolete

>From dd6b3b8a3ad762640e25e813b506d08d535498a8 Mon Sep 17 00:00:00 2001
>From: Stefan Metzmacher <metze@samba.org>
>Date: Wed, 19 Feb 2014 13:54:44 +0100
>Subject: [PATCH 01/17] s3:utils/smbfilter: use a local variable for the
> packet buffer
>
>Signed-off-by: Stefan Metzmacher <metze@samba.org>
>Reviewed-by: Jeremy Allison <jra@samba.org>
>(cherry picked from commit 3667a2eee388915fca2b894ae37375eeed46e941)
>---
> source3/utils/smbfilter.c |    2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/source3/utils/smbfilter.c b/source3/utils/smbfilter.c
>index 33f1a90..734971b 100644
>--- a/source3/utils/smbfilter.c
>+++ b/source3/utils/smbfilter.c
>@@ -35,7 +35,6 @@
> #define CLI_CAPABILITY_SET  0
> 
> static char *netbiosname;
>-static char packet[BUFFER_SIZE];
> 
> static void save_file(const char *fname, void *ppacket, size_t length)
> {
>@@ -178,6 +177,7 @@ static void filter_child(int c, struct sockaddr_storage *dest_ss)
> {
> 	NTSTATUS status;
> 	int s = -1;
>+	uint8_t packet[128*1024];
> 
> 	/* we have a connection from a new client, now connect to the server */
> 	status = open_socket_out(dest_ss, TCP_SMB_PORT, LONG_CONNECT_TIMEOUT, &s);
>-- 
>1.7.9.5
>
>
>From 8943813ff52c3c07ed6d3b126e90a3df14ae82c8 Mon Sep 17 00:00:00 2001
>From: Stefan Metzmacher <metze@samba.org>
>Date: Wed, 19 Feb 2014 13:56:06 +0100
>Subject: [PATCH 02/17] s3:torture: use CLI_BUFFER_SIZE instead of BUFFER_SIZE
>
>Signed-off-by: Stefan Metzmacher <metze@samba.org>
>Reviewed-by: Jeremy Allison <jra@samba.org>
>(cherry picked from commit 05e821b220328b88dd9eece919b8adee3e4281ac)
>---
> source3/torture/torture.c |    2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/source3/torture/torture.c b/source3/torture/torture.c
>index a33deb9..f8bef2d 100644
>--- a/source3/torture/torture.c
>+++ b/source3/torture/torture.c
>@@ -3088,7 +3088,7 @@ static bool run_randomipc(int dummy)
> 
> 		cli_api(cli, 
> 			param, param_len, 8,  
>-			NULL, 0, BUFFER_SIZE, 
>+			NULL, 0, CLI_BUFFER_SIZE,
> 			&rparam, &rprcnt,     
> 			&rdata, &rdrcnt);
> 		if (i % 100 == 0) {
>-- 
>1.7.9.5
>
>
>From e8c2f8c90f78b555041a04a3ccbc70bd59e7a158 Mon Sep 17 00:00:00 2001
>From: Stefan Metzmacher <metze@samba.org>
>Date: Wed, 19 Feb 2014 13:57:28 +0100
>Subject: [PATCH 03/17] s3:client: only limit the buffer by the given length
> 'n'
>
>Signed-off-by: Stefan Metzmacher <metze@samba.org>
>Reviewed-by: Jeremy Allison <jra@samba.org>
>(cherry picked from commit f0f245f4c8b1a506e8d06c72d3d6680b95738714)
>---
> source3/client/client.c |    2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/source3/client/client.c b/source3/client/client.c
>index 49519af..a3a1d0a 100644
>--- a/source3/client/client.c
>+++ b/source3/client/client.c
>@@ -235,7 +235,7 @@ static int readfile(uint8_t *b, int n, XFILE *f)
> 		return x_fread(b,1,n,f);
> 
> 	i = 0;
>-	while (i < (n - 1) && (i < BUFFER_SIZE)) {
>+	while (i < (n - 1)) {
> 		if ((c = x_getc(f)) == EOF) {
> 			break;
> 		}
>-- 
>1.7.9.5
>
>
>From 64d4d7f4ec8608f485ec7d841dfbf066d1fbe9a7 Mon Sep 17 00:00:00 2001
>From: Stefan Metzmacher <metze@samba.org>
>Date: Wed, 19 Feb 2014 13:59:07 +0100
>Subject: [PATCH 04/17] s3:param: avoid using BUFFER_SIZE to limit the
> lp_min_receive_file_size()
>
>There's really no reason to add such limit.
>
>Signed-off-by: Stefan Metzmacher <metze@samba.org>
>Reviewed-by: Jeremy Allison <jra@samba.org>
>(cherry picked from commit 74f8c3568a5dcdee108a0526cefac9d282361044)
>---
> source3/param/loadparm.c |    2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c
>index 2e05bac..2857765 100644
>--- a/source3/param/loadparm.c
>+++ b/source3/param/loadparm.c
>@@ -5434,7 +5434,7 @@ int lp_min_receive_file_size(void)
> 	if (Globals.iminreceivefile < 0) {
> 		return 0;
> 	}
>-	return MIN(Globals.iminreceivefile, BUFFER_SIZE);
>+	return Globals.iminreceivefile;
> }
> 
> /*******************************************************************
>-- 
>1.7.9.5
>
>
>From 0d68c52b3b0bd2989c4a8f9f8e087004d0812fc5 Mon Sep 17 00:00:00 2001
>From: Stefan Metzmacher <metze@samba.org>
>Date: Fri, 6 Dec 2013 13:28:35 +0100
>Subject: [PATCH 05/17] libcli/smb: add SMB_BUFFER_SIZE_MIN/MAX defines
>
>Bug: https://bugzilla.samba.org/show_bug.cgi?id=10422
>Signed-off-by: Stefan Metzmacher <metze@samba.org>
>Reviewed-by: Jeremy Allison <jra@samba.org>
>(cherry picked from commit 900839e2216048a614f2f0aeb1f79092fc93334f)
>---
> libcli/smb/smb_constants.h |    8 ++++++++
> 1 file changed, 8 insertions(+)
>
>diff --git a/libcli/smb/smb_constants.h b/libcli/smb/smb_constants.h
>index bcfd84e..639bd7c 100644
>--- a/libcli/smb/smb_constants.h
>+++ b/libcli/smb/smb_constants.h
>@@ -208,6 +208,14 @@ enum smb_signing_setting {
> #define NEGOTIATE_SECURITY_SIGNATURES_ENABLED	0x04
> #define NEGOTIATE_SECURITY_SIGNATURES_REQUIRED	0x08
> 
>+/*
>+ * The negotiated buffer size for non LARGE_READX/WRITEX
>+ * should be limited to uint16_t and has to be at least
>+ * 500, which is the default for MinClientBufferSize on Windows.
>+ */
>+#define SMB_BUFFER_SIZE_MIN 500
>+#define SMB_BUFFER_SIZE_MAX 65535
>+
> /* Capabilities.  see ftp.microsoft.com/developr/drg/cifs/cifs/cifs4.txt */
> 
> #define CAP_RAW_MODE		0x00000001
>-- 
>1.7.9.5
>
>
>From b063c5454349fcde97d48a4d01e67f17dd46385d Mon Sep 17 00:00:00 2001
>From: Stefan Metzmacher <metze@samba.org>
>Date: Fri, 6 Dec 2013 13:57:15 +0100
>Subject: [PATCH 06/17] s3:include: let CLI_BUFFER_SIZE be an alias of
> SMB_BUFFER_SIZE_MAX
>
>Bug: https://bugzilla.samba.org/show_bug.cgi?id=10422
>Signed-off-by: Stefan Metzmacher <metze@samba.org>
>Reviewed-by: Jeremy Allison <jra@samba.org>
>(cherry picked from commit 7f3faa1f1837870195352253fe220e0677565d9e)
>---
> source3/include/client.h |    2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/source3/include/client.h b/source3/include/client.h
>index f6aacea..6ba843c 100644
>--- a/source3/include/client.h
>+++ b/source3/include/client.h
>@@ -22,7 +22,7 @@
> #ifndef _CLIENT_H
> #define _CLIENT_H
> 
>-#define CLI_BUFFER_SIZE (0xFFFF)
>+#define CLI_BUFFER_SIZE SMB_BUFFER_SIZE_MAX
> 
> /*
>  * These definitions depend on smb.h
>-- 
>1.7.9.5
>
>
>From 4b39f71234014e89e967cbe6ad6fa3d2f0bd2c20 Mon Sep 17 00:00:00 2001
>From: Stefan Metzmacher <metze@samba.org>
>Date: Fri, 6 Dec 2013 13:45:35 +0100
>Subject: [PATCH 07/17] s3:smbd: use SMB_BUFFER_SIZE_MIN/MAX to limit
> lp_max_xmit()
>
>The current limit of 128*1024 causes problems as the value has to be
><= UINT16_MAX otherwise some clients get confused, as they want to
>use the MaxBufferSize value from the negprot response (uint32_t)
>for the MaxBufferSize value in thet session setup request (uint16_t).
>E.g. Windows 7 (as client) sends MaxBufferSize = 0 if the server value
>is > UINT16_MAX.
>
>Bug: https://bugzilla.samba.org/show_bug.cgi?id=10422
>Signed-off-by: Stefan Metzmacher <metze@samba.org>
>Reviewed-by: Jeremy Allison <jra@samba.org>
>(cherry picked from commit a349b0bef9085fd139640ec92399bc63d8029cb9)
>---
> source3/smbd/process.c |    7 ++++++-
> 1 file changed, 6 insertions(+), 1 deletion(-)
>
>diff --git a/source3/smbd/process.c b/source3/smbd/process.c
>index 3bf10de..3bb4dd7 100644
>--- a/source3/smbd/process.c
>+++ b/source3/smbd/process.c
>@@ -3302,6 +3302,7 @@ void smbd_process(struct tevent_context *ev_ctx,
> 	const char *remaddr = NULL;
> 	char *rhost;
> 	int ret;
>+	int tmp;
> 
> 	conn = talloc_zero(ev_ctx, struct smbXsrv_connection);
> 	if (conn == NULL) {
>@@ -3589,7 +3590,11 @@ void smbd_process(struct tevent_context *ev_ctx,
> 
> 	sconn->nbt.got_session = false;
> 
>-	sconn->smb1.negprot.max_recv = MIN(lp_max_xmit(),BUFFER_SIZE);
>+	tmp = lp_max_xmit();
>+	tmp = MAX(tmp, SMB_BUFFER_SIZE_MIN);
>+	tmp = MIN(tmp, SMB_BUFFER_SIZE_MAX);
>+
>+	sconn->smb1.negprot.max_recv = tmp;
> 
> 	sconn->smb1.sessions.done_sesssetup = false;
> 	sconn->smb1.sessions.max_send = BUFFER_SIZE;
>-- 
>1.7.9.5
>
>
>From 02d8041415f11755c5e1b08a5f3f085b6148b39f Mon Sep 17 00:00:00 2001
>From: Stefan Metzmacher <metze@samba.org>
>Date: Fri, 6 Dec 2013 13:50:49 +0100
>Subject: [PATCH 08/17] s3:smbd: use sconn->smb1.sessions.max_send =
> SMB_BUFFER_SIZE_MAX
>
>SMB_BUFFER_SIZE_MAX is UINT16_MAX and the largest value a client
>can possibly specify in the session setup request.
>
>Bug: https://bugzilla.samba.org/show_bug.cgi?id=10422
>Signed-off-by: Stefan Metzmacher <metze@samba.org>
>Reviewed-by: Jeremy Allison <jra@samba.org>
>(cherry picked from commit 5cd5c1613996ecebdcd632e932957947f4c27308)
>---
> source3/smbd/process.c |    2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/source3/smbd/process.c b/source3/smbd/process.c
>index 3bb4dd7..6646222 100644
>--- a/source3/smbd/process.c
>+++ b/source3/smbd/process.c
>@@ -3597,7 +3597,7 @@ void smbd_process(struct tevent_context *ev_ctx,
> 	sconn->smb1.negprot.max_recv = tmp;
> 
> 	sconn->smb1.sessions.done_sesssetup = false;
>-	sconn->smb1.sessions.max_send = BUFFER_SIZE;
>+	sconn->smb1.sessions.max_send = SMB_BUFFER_SIZE_MAX;
> 
> 	if (!init_dptrs(sconn)) {
> 		exit_server("init_dptrs() failed");
>-- 
>1.7.9.5
>
>
>From 79ea5d6120628a7aa33496be886936bb766da6c7 Mon Sep 17 00:00:00 2001
>From: Stefan Metzmacher <metze@samba.org>
>Date: Fri, 6 Dec 2013 13:52:09 +0100
>Subject: [PATCH 09/17] s3:smbd: reject a MaxBufferSize < SMB_BUFFER_SIZE_MIN
> (500) in a session setup request
>
>This makes sure sconn->smb1.sessions.max_send is always >= SMB_BUFFER_SIZE_MIN.
>
>Bug: https://bugzilla.samba.org/show_bug.cgi?id=10422
>Signed-off-by: Stefan Metzmacher <metze@samba.org>
>Reviewed-by: Jeremy Allison <jra@samba.org>
>(cherry picked from commit cce1eaea91088efd742891befdaafade0c1fdce6)
>---
> source3/smbd/sesssetup.c |   19 +++++++++++++------
> 1 file changed, 13 insertions(+), 6 deletions(-)
>
>diff --git a/source3/smbd/sesssetup.c b/source3/smbd/sesssetup.c
>index 4728759..5128328 100644
>--- a/source3/smbd/sesssetup.c
>+++ b/source3/smbd/sesssetup.c
>@@ -379,10 +379,13 @@ static void reply_sesssetup_and_X_spnego(struct smb_request *req)
> 		}
> 
> 		if (!sconn->smb1.sessions.done_sesssetup) {
>-			sconn->smb1.sessions.max_send =
>-				MIN(sconn->smb1.sessions.max_send,smb_bufsize);
>+			if (smb_bufsize < SMB_BUFFER_SIZE_MIN) {
>+				reply_force_doserror(req, ERRSRV, ERRerror);
>+				return;
>+			}
>+			sconn->smb1.sessions.max_send = smb_bufsize;
>+			sconn->smb1.sessions.done_sesssetup = true;
> 		}
>-		sconn->smb1.sessions.done_sesssetup = true;
> 
> 		/* current_user_info is changed on new vuid */
> 		reload_services(sconn, conn_snum_used, true);
>@@ -1084,10 +1087,14 @@ void reply_sesssetup_and_X(struct smb_request *req)
> 	req->vuid = sess_vuid;
> 
> 	if (!sconn->smb1.sessions.done_sesssetup) {
>-		sconn->smb1.sessions.max_send =
>-			MIN(sconn->smb1.sessions.max_send,smb_bufsize);
>+		if (smb_bufsize < SMB_BUFFER_SIZE_MIN) {
>+			reply_force_doserror(req, ERRSRV, ERRerror);
>+			END_PROFILE(SMBsesssetupX);
>+			return;
>+		}
>+		sconn->smb1.sessions.max_send = smb_bufsize;
>+		sconn->smb1.sessions.done_sesssetup = true;
> 	}
>-	sconn->smb1.sessions.done_sesssetup = true;
> 
> 	END_PROFILE(SMBsesssetupX);
> }
>-- 
>1.7.9.5
>
>
>From 841da5a1c6d262d22c066a4157fa0cef144c8f43 Mon Sep 17 00:00:00 2001
>From: Stefan Metzmacher <metze@samba.org>
>Date: Fri, 6 Dec 2013 13:53:45 +0100
>Subject: [PATCH 10/17] s3:smbd: take less than SMB_BUFFER_SIZE_MIN ('500') as
> header overhead in ipc.c
>
>We're now sure that sconn->smb1.sessions.max_send is >= SMB_BUFFER_SIZE_MIN.
>in order to garantee some progress we need to make sure our assumed
>header overhead is less than SMB_BUFFER_SIZE_MIN.
>
>Assuming 372 bytes for the SMBtrans headers should still be more than
>enough.
>
>Bug: https://bugzilla.samba.org/show_bug.cgi?id=10422
>Signed-off-by: Stefan Metzmacher <metze@samba.org>
>Reviewed-by: Jeremy Allison <jra@samba.org>
>(cherry picked from commit 2ec49cf57c88735be962b0681b487df5efe7ed6b)
>---
> source3/smbd/ipc.c |   10 ++++++----
> 1 file changed, 6 insertions(+), 4 deletions(-)
>
>diff --git a/source3/smbd/ipc.c b/source3/smbd/ipc.c
>index 91d5047..dbb259c 100644
>--- a/source3/smbd/ipc.c
>+++ b/source3/smbd/ipc.c
>@@ -109,12 +109,14 @@ void send_trans_reply(connection_struct *conn,
> 	int lparam = rparam ? rparam_len : 0;
> 	struct smbd_server_connection *sconn = req->sconn;
> 	int max_send = sconn->smb1.sessions.max_send;
>+	/* HACK: make sure we send at least 128 byte in one go */
>+	int hdr_overhead = SMB_BUFFER_SIZE_MIN - 128;
> 
> 	if (buffer_too_large)
> 		DEBUG(5,("send_trans_reply: buffer %d too large\n", ldata ));
> 
>-	this_lparam = MIN(lparam,max_send - 500); /* hack */
>-	this_ldata  = MIN(ldata,max_send - (500+this_lparam));
>+	this_lparam = MIN(lparam,max_send - hdr_overhead);
>+	this_ldata  = MIN(ldata,max_send - (hdr_overhead+this_lparam));
> 
> 	align = ((this_lparam)%4);
> 
>@@ -163,9 +165,9 @@ void send_trans_reply(connection_struct *conn,
> 	while (tot_data_sent < ldata || tot_param_sent < lparam)
> 	{
> 		this_lparam = MIN(lparam-tot_param_sent,
>-				  max_send - 500); /* hack */
>+				  max_send - hdr_overhead);
> 		this_ldata  = MIN(ldata -tot_data_sent,
>-				  max_send - (500+this_lparam));
>+				  max_send - (hdr_overhead+this_lparam));
> 
> 		if(this_lparam < 0)
> 			this_lparam = 0;
>-- 
>1.7.9.5
>
>
>From 4d1c3491c90b22c30f536c0d506c3cb411c61483 Mon Sep 17 00:00:00 2001
>From: Stefan Metzmacher <metze@samba.org>
>Date: Tue, 4 Mar 2014 14:07:26 +0100
>Subject: [PATCH 11/17] s3:smbd: fix lockread numtoread calculation to match
> reply_outbuf() arguments.
>
>Signed-off-by: Stefan Metzmacher <metze@samba.org>
>Reviewed-by: Jeremy Allison <jra@samba.org>
>(cherry picked from commit 3dac00b568613f5a1322883237e40b98ddd1d71d)
>---
> source3/smbd/reply.c |    2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c
>index f293b69..e07b40b 100644
>--- a/source3/smbd/reply.c
>+++ b/source3/smbd/reply.c
>@@ -3499,7 +3499,7 @@ void reply_lockread(struct smb_request *req)
> 	numtoread = SVAL(req->vwv+1, 0);
> 	startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
> 
>-	numtoread = MIN(BUFFER_SIZE - (smb_size + 3*2 + 3), numtoread);
>+	numtoread = MIN(BUFFER_SIZE - (smb_size + 5*2 + 3), numtoread);
> 
> 	reply_outbuf(req, 5, numtoread + 3);
> 
>-- 
>1.7.9.5
>
>
>From 160bf3cefd98b632c26975441e236063cd9954f2 Mon Sep 17 00:00:00 2001
>From: Stefan Metzmacher <metze@samba.org>
>Date: Tue, 4 Mar 2014 14:07:26 +0100
>Subject: [PATCH 12/17] s3:smbd: pass the final numtoread reply_outbuf() for
> the lockread reply.
>
>Signed-off-by: Stefan Metzmacher <metze@samba.org>
>Reviewed-by: Jeremy Allison <jra@samba.org>
>(cherry picked from commit b86f90611820bcf7826bd1de3c7b05488a8f1b0e)
>---
> source3/smbd/reply.c |    9 +++++----
> 1 file changed, 5 insertions(+), 4 deletions(-)
>
>diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c
>index e07b40b..04f1b7f 100644
>--- a/source3/smbd/reply.c
>+++ b/source3/smbd/reply.c
>@@ -3501,10 +3501,6 @@ void reply_lockread(struct smb_request *req)
> 
> 	numtoread = MIN(BUFFER_SIZE - (smb_size + 5*2 + 3), numtoread);
> 
>-	reply_outbuf(req, 5, numtoread + 3);
>-
>-	data = smb_buf(req->outbuf) + 3;
>-
> 	/*
> 	 * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
> 	 * protocol request that predates the read/write lock concept. 
>@@ -3543,6 +3539,11 @@ Returning short read of maximum allowed for compatibility with Windows 2000.\n",
> 			(unsigned int)sconn->smb1.negprot.max_recv));
> 		numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
> 	}
>+
>+	reply_outbuf(req, 5, numtoread + 3);
>+
>+	data = smb_buf(req->outbuf) + 3;
>+
> 	nread = read_file(fsp,data,startpos,numtoread);
> 
> 	if (nread < 0) {
>-- 
>1.7.9.5
>
>
>From ab1d3bd296cd50f8fb40e487f642f839640ffdde Mon Sep 17 00:00:00 2001
>From: Stefan Metzmacher <metze@samba.org>
>Date: Tue, 4 Mar 2014 14:07:26 +0100
>Subject: [PATCH 13/17] s3:smbd: fix the lockread numtoread calculation
> depending on the max_send.
>
>Signed-off-by: Stefan Metzmacher <metze@samba.org>
>Reviewed-by: Jeremy Allison <jra@samba.org>
>(cherry picked from commit f69be2c28e097c66907df264794706006fe0ae7f)
>---
> source3/smbd/reply.c |   18 +++++++++---------
> 1 file changed, 9 insertions(+), 9 deletions(-)
>
>diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c
>index 04f1b7f..8f6864b 100644
>--- a/source3/smbd/reply.c
>+++ b/source3/smbd/reply.c
>@@ -3469,6 +3469,7 @@ void reply_lockread(struct smb_request *req)
> 	char *data;
> 	off_t startpos;
> 	size_t numtoread;
>+	size_t maxtoread;
> 	NTSTATUS status;
> 	files_struct *fsp;
> 	struct byte_range_lock *br_lck = NULL;
>@@ -3499,14 +3500,12 @@ void reply_lockread(struct smb_request *req)
> 	numtoread = SVAL(req->vwv+1, 0);
> 	startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
> 
>-	numtoread = MIN(BUFFER_SIZE - (smb_size + 5*2 + 3), numtoread);
>-
> 	/*
> 	 * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
> 	 * protocol request that predates the read/write lock concept. 
> 	 * Thus instead of asking for a read lock here we need to ask
> 	 * for a write lock. JRA.
>-	 * Note that the requested lock size is unaffected by max_recv.
>+	 * Note that the requested lock size is unaffected by max_send.
> 	 */
> 
> 	br_lck = do_lock(req->sconn->msg_ctx,
>@@ -3529,15 +3528,16 @@ void reply_lockread(struct smb_request *req)
> 	}
> 
> 	/*
>-	 * However the requested READ size IS affected by max_recv. Insanity.... JRA.
>+	 * However the requested READ size IS affected by max_send. Insanity.... JRA.
> 	 */
>+	maxtoread = sconn->smb1.sessions.max_send - (smb_size + 5*2 + 3);
> 
>-	if (numtoread > sconn->smb1.negprot.max_recv) {
>-		DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u). \
>+	if (numtoread > maxtoread) {
>+		DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u/%u). \
> Returning short read of maximum allowed for compatibility with Windows 2000.\n",
>-			(unsigned int)numtoread,
>-			(unsigned int)sconn->smb1.negprot.max_recv));
>-		numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
>+			(unsigned int)numtoread, (unsigned int)maxtoread,
>+			(unsigned int)sconn->smb1.sessions.max_send));
>+		numtoread = maxtoread;
> 	}
> 
> 	reply_outbuf(req, 5, numtoread + 3);
>-- 
>1.7.9.5
>
>
>From 09936e3561d06e7bd5ae16a8307030886abfd562 Mon Sep 17 00:00:00 2001
>From: Stefan Metzmacher <metze@samba.org>
>Date: Tue, 4 Mar 2014 14:07:26 +0100
>Subject: [PATCH 14/17] s3:smbd: fix the read numtoread calculation depending
> on the max_send.
>
>Signed-off-by: Stefan Metzmacher <metze@samba.org>
>Reviewed-by: Jeremy Allison <jra@samba.org>
>(cherry picked from commit 8b746f5a2137b74e28bce5370f5aa9d4bcdac6c2)
>---
> source3/smbd/reply.c |   18 +++++++++---------
> 1 file changed, 9 insertions(+), 9 deletions(-)
>
>diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c
>index 8f6864b..9156125 100644
>--- a/source3/smbd/reply.c
>+++ b/source3/smbd/reply.c
>@@ -3578,10 +3578,10 @@ void reply_read(struct smb_request *req)
> {
> 	connection_struct *conn = req->conn;
> 	size_t numtoread;
>+	size_t maxtoread;
> 	ssize_t nread = 0;
> 	char *data;
> 	off_t startpos;
>-	int outsize = 0;
> 	files_struct *fsp;
> 	struct lock_struct lock;
> 	struct smbd_server_connection *sconn = req->sconn;
>@@ -3610,17 +3610,17 @@ void reply_read(struct smb_request *req)
> 	numtoread = SVAL(req->vwv+1, 0);
> 	startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
> 
>-	numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
>-
> 	/*
>-	 * The requested read size cannot be greater than max_recv. JRA.
>+	 * The requested read size cannot be greater than max_send. JRA.
> 	 */
>-	if (numtoread > sconn->smb1.negprot.max_recv) {
>-		DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u). \
>+	maxtoread = sconn->smb1.sessions.max_send - (smb_size + 5*2 + 3);
>+
>+	if (numtoread > maxtoread) {
>+		DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u/%u). \
> Returning short read of maximum allowed for compatibility with Windows 2000.\n",
>-			(unsigned int)numtoread,
>-			(unsigned int)sconn->smb1.negprot.max_recv));
>-		numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
>+			(unsigned int)numtoread, (unsigned int)maxtoread,
>+			(unsigned int)sconn->smb1.sessions.max_send));
>+		numtoread = maxtoread;
> 	}
> 
> 	reply_outbuf(req, 5, numtoread+3);
>-- 
>1.7.9.5
>
>
>From 255933e3e8dc2489f96997638d329d7d3f4f1dfb Mon Sep 17 00:00:00 2001
>From: Stefan Metzmacher <metze@samba.org>
>Date: Wed, 5 Mar 2014 14:00:40 +0100
>Subject: [PATCH 15/17] s3:smbd: simplify maxentries calculation in
> reply_search()
>
>Using helper variables make it much easier to understand.
>
>Signed-off-by: Stefan Metzmacher <metze@samba.org>
>Reviewed-by: Jeremy Allison <jra@samba.org>
>(cherry picked from commit 734e1b65044a33eba01b41695502c2257c1a4d9e)
>---
> source3/smbd/reply.c |    9 ++++-----
> 1 file changed, 4 insertions(+), 5 deletions(-)
>
>diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c
>index 9156125..2dea74d 100644
>--- a/source3/smbd/reply.c
>+++ b/source3/smbd/reply.c
>@@ -1697,11 +1697,10 @@ void reply_search(struct smb_request *req)
> 		}
> 	} else {
> 		unsigned int i;
>-		maxentries = MIN(
>-			maxentries,
>-			((BUFFER_SIZE -
>-			  ((uint8 *)smb_buf(req->outbuf) + 3 - req->outbuf))
>-			 /DIR_STRUCT_SIZE));
>+		size_t hdr_size = ((uint8_t *)smb_buf(req->outbuf) + 3 - req->outbuf);
>+		size_t available_space = BUFFER_SIZE - hdr_size;
>+
>+		maxentries = MIN(maxentries, available_space/DIR_STRUCT_SIZE);
> 
> 		DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
> 			 directory,lp_dontdescend(ctx, SNUM(conn))));
>-- 
>1.7.9.5
>
>
>From a822636db6edad9bd69ff60f8c247f5e218dd473 Mon Sep 17 00:00:00 2001
>From: Stefan Metzmacher <metze@samba.org>
>Date: Wed, 5 Mar 2014 14:03:42 +0100
>Subject: [PATCH 16/17] s3:smbd: fix the maxentries calculation depending on
> the max_send.
>
>Signed-off-by: Stefan Metzmacher <metze@samba.org>
>Reviewed-by: Jeremy Allison <jra@samba.org>
>(cherry picked from commit c899d4fd9c5a337ab82acdf11866df50fb0629e0)
>---
> source3/smbd/reply.c |    2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c
>index 2dea74d..adf4b6f 100644
>--- a/source3/smbd/reply.c
>+++ b/source3/smbd/reply.c
>@@ -1698,7 +1698,7 @@ void reply_search(struct smb_request *req)
> 	} else {
> 		unsigned int i;
> 		size_t hdr_size = ((uint8_t *)smb_buf(req->outbuf) + 3 - req->outbuf);
>-		size_t available_space = BUFFER_SIZE - hdr_size;
>+		size_t available_space = sconn->smb1.sessions.max_send - hdr_size;
> 
> 		maxentries = MIN(maxentries, available_space/DIR_STRUCT_SIZE);
> 
>-- 
>1.7.9.5
>
>
>From 77476b09ae6528845c57d4e725d9630772d1d0bb Mon Sep 17 00:00:00 2001
>From: Stefan Metzmacher <metze@samba.org>
>Date: Fri, 6 Dec 2013 13:56:12 +0100
>Subject: [PATCH 17/17] s3:smbd: s/BUFFER_SIZE/LARGE_WRITEX_BUFFER_SIZE
>
>Bug: https://bugzilla.samba.org/show_bug.cgi?id=10422
>Signed-off-by: Stefan Metzmacher <metze@samba.org>
>Reviewed-by: Jeremy Allison <jra@samba.org>
>
>Autobuild-User(master): Jeremy Allison <jra@samba.org>
>Autobuild-Date(master): Wed Mar  5 22:53:34 CET 2014 on sn-devel-104
>(cherry picked from commit 032621d5bf842e60dc9cd1cd0d3acc90482462a6)
>---
> source3/include/smb.h  |    4 +---
> source3/smbd/process.c |    2 +-
> 2 files changed, 2 insertions(+), 4 deletions(-)
>
>diff --git a/source3/include/smb.h b/source3/include/smb.h
>index 0057b44..e2603aa 100644
>--- a/source3/include/smb.h
>+++ b/source3/include/smb.h
>@@ -32,11 +32,9 @@
> /* logged when starting the various Samba daemons */
> #define COPYRIGHT_STARTUP_MESSAGE	"Copyright Andrew Tridgell and the Samba Team 1992-2012"
> 
>-
>-#define BUFFER_SIZE (128*1024)
>-
> #define SAFETY_MARGIN 1024
> #define LARGE_WRITEX_HDR_SIZE 65
>+#define LARGE_WRITEX_BUFFER_SIZE (128*1024)
> 
> #define NMB_PORT 137
> #define DGRAM_PORT 138
>diff --git a/source3/smbd/process.c b/source3/smbd/process.c
>index 6646222..9c1807e 100644
>--- a/source3/smbd/process.c
>+++ b/source3/smbd/process.c
>@@ -238,7 +238,7 @@ static bool valid_packet_size(size_t len)
> 	 * of header. Don't print the error if this fits.... JRA.
> 	 */
> 
>-	if (len > (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
>+	if (len > (LARGE_WRITEX_BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
> 		DEBUG(0,("Invalid packet length! (%lu bytes).\n",
> 					(unsigned long)len));
> 		return false;
>-- 
>1.7.9.5
>

Flags:

jra: review+

Actions: View

Attachments on bug 10422: 9673 | 9690 | 9691 | 9698 | 9792 | 9793