From cc471448df91c43fe38e2fcdf9b3874636ca51a6 Mon Sep 17 00:00:00 2001
From: Andreas Schneider <asn@samba.org>
Date: Fri, 16 Nov 2018 15:40:59 +0100
Subject: [PATCH] s3:tests: Test for users connecting to their 'homes' share
MIME-Version: 1.0
Content-Type: text/plain; charset=utf8
Content-Transfer-Encoding: 8bit

This adds a test for CVE-2009-2813.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13699

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>
---
 selftest/target/Samba3.pm          |  4 ++
 source3/script/tests/test_homes.sh | 99 ++++++++++++++++++++++++++++++++++++++
 source3/selftest/tests.py          |  1 +
 3 files changed, 104 insertions(+)
 create mode 100755 source3/script/tests/test_homes.sh

diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm
index 0547418b657..d90945c3830 100755
--- a/selftest/target/Samba3.pm
+++ b/selftest/target/Samba3.pm
@@ -977,6 +977,10 @@ sub setup_fileserver
 	comment = inherit only unix owner
 	inherit owner = unix only
 	acl_xattr:ignore system acls = yes
+[homes]
+	comment = Home directories
+	browseable = No
+	read only = No
 ";
 
 	my $vars = $self->provision($path, "WORKGROUP",
diff --git a/source3/script/tests/test_homes.sh b/source3/script/tests/test_homes.sh
new file mode 100755
index 00000000000..06de0a0c301
--- /dev/null
+++ b/source3/script/tests/test_homes.sh
@@ -0,0 +1,99 @@
+#!/bin/sh
+
+# Copyright (c) Andreas Schneider <asn@samba.org>
+# License: GPLv3
+
+if [ $# -lt 7 ]; then
+	echo "Usage: test_homes.sh SERVER USERNAME PASSWORD LOCAL_PATH PREFIX SMBCLIENT CONFIGURATION"
+	exit 1
+fi
+
+SERVER="${1}"
+USERNAME="${2}"
+PASSWORD="${3}"
+LOCAL_PATH="${4}"
+PREFIX="${5}"
+SMBCLIENT="${6}"
+CONFIGURATION="${7}"
+shift 7
+
+incdir=`dirname $0`/../../../testprogs/blackbox
+. $incdir/subunit.sh
+
+failed=0
+
+test_gooduser_home()
+{
+    tmpfile=$PREFIX/smbclient_homes_gooduser_commands
+    cat > $tmpfile <<EOF
+ls
+quit
+EOF
+
+    USERNAME=gooduser
+
+    cmd='CLI_FORCE_INTERACTIVE=yes $SMBCLIENT "$@" -U$USERNAME%$PASSWORD //$SERVER/$USERNAME $CONFIGURATION < $tmpfile 2>&1'
+    eval echo "$cmd"
+    out=$(eval $cmd)
+    ret=$?
+    rm -f $tmpfile
+
+    if [ $ret -ne 0 ] ; then
+       echo "$out"
+       echo "failed to connect error $ret"
+       return 1
+    fi
+
+    echo "$out" | grep 'Try "help" to get a list of possible commands.'
+    ret=$?
+    if [ $ret -ne 0 ] ; then
+       echo "$out"
+       echo 'failed - should get: Try "help" to get a list of possible commands.'
+       return 1
+    fi
+
+    return 0
+}
+
+test_eviluser_home()
+{
+    tmpfile=$PREFIX/smbclient_homes_eviluser_commands
+    cat > $tmpfile <<EOF
+ls
+quit
+EOF
+
+    USERNAME=eviluser
+
+    cmd='CLI_FORCE_INTERACTIVE=yes $SMBCLIENT "$@" -U$USERNAME%$PASSWORD //$SERVER/$USERNAME $CONFIGURATION < $tmpfile 2>&1'
+    eval echo "$cmd"
+    out=$(eval $cmd)
+    ret=$?
+    rm -f $tmpfile
+
+    if [ $ret -ne 1 ] ; then
+       echo "$out"
+       echo "The server should reject connecting ret=$ret"
+       return 1
+    fi
+
+    echo "$out" | grep 'NT_STATUS_BAD_NETWORK_NAME'
+    ret=$?
+    if [ $ret -ne 0 ] ; then
+       echo "$out"
+       echo 'failed - should get: NT_STATUS_BAD_NETWORK_NAME.'
+       return 1
+    fi
+
+    return 0
+}
+
+testit "test gooduser home" \
+    test_gooduser_home || \
+    failed=`expr $failed + 1`
+
+testit "test eviluser home reject" \
+    test_eviluser_home || \
+    failed=`expr $failed + 1`
+
+testok $0 $failed
diff --git a/source3/selftest/tests.py b/source3/selftest/tests.py
index f30b03ce990..065a41899e8 100755
--- a/source3/selftest/tests.py
+++ b/source3/selftest/tests.py
@@ -326,6 +326,7 @@ for env in ["fileserver"]:
     plantestsuite("samba3.blackbox.large_acl.NT1", env, [os.path.join(samba3srcdir, "script/tests/test_large_acl.sh"), '$SERVER', '$USERNAME', '$PASSWORD', smbclient3, smbcacls, '-m', 'NT1'])
     plantestsuite("samba3.blackbox.large_acl.SMB3", env, [os.path.join(samba3srcdir, "script/tests/test_large_acl.sh"), '$SERVER', '$USERNAME', '$PASSWORD', smbclient3, smbcacls, '-m', 'SMB3'])
     plantestsuite("samba3.blackbox.give_owner", env, [os.path.join(samba3srcdir, "script/tests/test_give_owner.sh"), '$SERVER', '$SERVER_IP', '$USERNAME', '$PASSWORD', '$PREFIX', smbclient3, smbcacls, net, 'tmp'])
+    plantestsuite("samba3.blackbox.homes", env, [os.path.join(samba3srcdir, "script/tests/test_homes.sh"), '$SERVER', '$USERNAME', '$PASSWORD', '$LOCAL_PATH', '$PREFIX', smbclient3, configuration])
 
     #
     # tar command tests
-- 
2.11.4.GIT