import samba-4.14.5-10.el8_5
This commit is contained in:
CentOS Sources
Stepan Oksanichenko
parent
85b413e4a9
commit
9db6553941
563
SOURCES/samba-4.14-fix-virus-scanner.patch
Normal file
563
SOURCES/samba-4.14-fix-virus-scanner.patch
Normal file
@ -0,0 +1,563 @@
|
|||||||
|
From e4baa05c6f73b364843f0ddd5394bf4298aca0d7 Mon Sep 17 00:00:00 2001
|
||||||
|
From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= <pfilipen@redhat.com>
|
||||||
|
Date: Tue, 8 Feb 2022 12:07:03 +0100
|
||||||
|
Subject: [PATCH 1/5] s3:modules: Implement dummy virus scanner that uses
|
||||||
|
filename matching
|
||||||
|
MIME-Version: 1.0
|
||||||
|
Content-Type: text/plain; charset=UTF-8
|
||||||
|
Content-Transfer-Encoding: 8bit
|
||||||
|
|
||||||
|
Bug: https://bugzilla.samba.org/show_bug.cgi?id=14971
|
||||||
|
|
||||||
|
Signed-off-by: Pavel Filipenský <pfilipen@redhat.com>
|
||||||
|
Reviewed-by: Jeremy Allison <jra@samba.org>
|
||||||
|
Reviewed-by: Andreas Schneider <asn@samba.org>
|
||||||
|
(cherry picked from commit 9f34babec7c6aca3d91f226705d3b3996792e5f1)
|
||||||
|
---
|
||||||
|
source3/modules/vfs_virusfilter.c | 12 +++++
|
||||||
|
source3/modules/vfs_virusfilter_common.h | 4 ++
|
||||||
|
source3/modules/vfs_virusfilter_dummy.c | 58 ++++++++++++++++++++++++
|
||||||
|
source3/modules/wscript_build | 1 +
|
||||||
|
4 files changed, 75 insertions(+)
|
||||||
|
create mode 100644 source3/modules/vfs_virusfilter_dummy.c
|
||||||
|
|
||||||
|
diff --git a/source3/modules/vfs_virusfilter.c b/source3/modules/vfs_virusfilter.c
|
||||||
|
index 524e7dfbad9..5ae8a02a369 100644
|
||||||
|
--- a/source3/modules/vfs_virusfilter.c
|
||||||
|
+++ b/source3/modules/vfs_virusfilter.c
|
||||||
|
@@ -35,12 +35,14 @@
|
||||||
|
|
||||||
|
enum virusfilter_scanner_enum {
|
||||||
|
VIRUSFILTER_SCANNER_CLAMAV,
|
||||||
|
+ VIRUSFILTER_SCANNER_DUMMY,
|
||||||
|
VIRUSFILTER_SCANNER_FSAV,
|
||||||
|
VIRUSFILTER_SCANNER_SOPHOS
|
||||||
|
};
|
||||||
|
|
||||||
|
static const struct enum_list scanner_list[] = {
|
||||||
|
{ VIRUSFILTER_SCANNER_CLAMAV, "clamav" },
|
||||||
|
+ { VIRUSFILTER_SCANNER_DUMMY, "dummy" },
|
||||||
|
{ VIRUSFILTER_SCANNER_FSAV, "fsav" },
|
||||||
|
{ VIRUSFILTER_SCANNER_SOPHOS, "sophos" },
|
||||||
|
{ -1, NULL }
|
||||||
|
@@ -199,6 +201,7 @@ static int virusfilter_vfs_connect(
|
||||||
|
int snum = SNUM(handle->conn);
|
||||||
|
struct virusfilter_config *config = NULL;
|
||||||
|
const char *exclude_files = NULL;
|
||||||
|
+ const char *infected_files = NULL;
|
||||||
|
const char *temp_quarantine_dir_mode = NULL;
|
||||||
|
const char *infected_file_command = NULL;
|
||||||
|
const char *scan_error_command = NULL;
|
||||||
|
@@ -255,6 +258,12 @@ static int virusfilter_vfs_connect(
|
||||||
|
set_namearray(&config->exclude_files, exclude_files);
|
||||||
|
}
|
||||||
|
|
||||||
|
+ infected_files = lp_parm_const_string(
|
||||||
|
+ snum, "virusfilter", "infected files", NULL);
|
||||||
|
+ if (infected_files != NULL) {
|
||||||
|
+ set_namearray(&config->infected_files, infected_files);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
config->cache_entry_limit = lp_parm_int(
|
||||||
|
snum, "virusfilter", "cache entry limit", 100);
|
||||||
|
|
||||||
|
@@ -532,6 +541,9 @@ static int virusfilter_vfs_connect(
|
||||||
|
case VIRUSFILTER_SCANNER_CLAMAV:
|
||||||
|
ret = virusfilter_clamav_init(config);
|
||||||
|
break;
|
||||||
|
+ case VIRUSFILTER_SCANNER_DUMMY:
|
||||||
|
+ ret = virusfilter_dummy_init(config);
|
||||||
|
+ break;
|
||||||
|
default:
|
||||||
|
DBG_ERR("Unhandled scanner %d\n", backend);
|
||||||
|
return -1;
|
||||||
|
diff --git a/source3/modules/vfs_virusfilter_common.h b/source3/modules/vfs_virusfilter_common.h
|
||||||
|
index f71b0b949a7..463a9d74e9c 100644
|
||||||
|
--- a/source3/modules/vfs_virusfilter_common.h
|
||||||
|
+++ b/source3/modules/vfs_virusfilter_common.h
|
||||||
|
@@ -83,6 +83,9 @@ struct virusfilter_config {
|
||||||
|
/* Exclude files */
|
||||||
|
name_compare_entry *exclude_files;
|
||||||
|
|
||||||
|
+ /* Infected files */
|
||||||
|
+ name_compare_entry *infected_files;
|
||||||
|
+
|
||||||
|
/* Scan result cache */
|
||||||
|
struct virusfilter_cache *cache;
|
||||||
|
int cache_entry_limit;
|
||||||
|
@@ -149,5 +152,6 @@ struct virusfilter_backend {
|
||||||
|
int virusfilter_sophos_init(struct virusfilter_config *config);
|
||||||
|
int virusfilter_fsav_init(struct virusfilter_config *config);
|
||||||
|
int virusfilter_clamav_init(struct virusfilter_config *config);
|
||||||
|
+int virusfilter_dummy_init(struct virusfilter_config *config);
|
||||||
|
|
||||||
|
#endif /* _VIRUSFILTER_COMMON_H */
|
||||||
|
diff --git a/source3/modules/vfs_virusfilter_dummy.c b/source3/modules/vfs_virusfilter_dummy.c
|
||||||
|
new file mode 100644
|
||||||
|
index 00000000000..03405cd6629
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/source3/modules/vfs_virusfilter_dummy.c
|
||||||
|
@@ -0,0 +1,58 @@
|
||||||
|
+/*
|
||||||
|
+ Samba-VirusFilter VFS modules
|
||||||
|
+ Dummy scanner with infected files support.
|
||||||
|
+ Copyright (C) 2022 Pavel Filipenský <pfilipen@redhat.com>
|
||||||
|
+
|
||||||
|
+ This program is free software; you can redistribute it and/or modify
|
||||||
|
+ it under the terms of the GNU General Public License as published by
|
||||||
|
+ the Free Software Foundation; either version 3 of the License, or
|
||||||
|
+ (at your option) any later version.
|
||||||
|
+
|
||||||
|
+ This program is distributed in the hope that it will be useful,
|
||||||
|
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
+ GNU General Public License for more details.
|
||||||
|
+
|
||||||
|
+ You should have received a copy of the GNU General Public License
|
||||||
|
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||||
|
+*/
|
||||||
|
+
|
||||||
|
+#include "modules/vfs_virusfilter_utils.h"
|
||||||
|
+
|
||||||
|
+static virusfilter_result virusfilter_dummy_scan(
|
||||||
|
+ struct vfs_handle_struct *handle,
|
||||||
|
+ struct virusfilter_config *config,
|
||||||
|
+ const struct files_struct *fsp,
|
||||||
|
+ char **reportp)
|
||||||
|
+{
|
||||||
|
+ bool ok;
|
||||||
|
+
|
||||||
|
+ DBG_INFO("Scanning file: %s\n", fsp_str_dbg(fsp));
|
||||||
|
+ ok = is_in_path(fsp->fsp_name->base_name,
|
||||||
|
+ config->infected_files,
|
||||||
|
+ false);
|
||||||
|
+ return ok ? VIRUSFILTER_RESULT_INFECTED : VIRUSFILTER_RESULT_CLEAN;
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+static struct virusfilter_backend_fns virusfilter_backend_dummy = {
|
||||||
|
+ .connect = NULL,
|
||||||
|
+ .disconnect = NULL,
|
||||||
|
+ .scan_init = NULL,
|
||||||
|
+ .scan = virusfilter_dummy_scan,
|
||||||
|
+ .scan_end = NULL,
|
||||||
|
+};
|
||||||
|
+
|
||||||
|
+int virusfilter_dummy_init(struct virusfilter_config *config)
|
||||||
|
+{
|
||||||
|
+ struct virusfilter_backend *backend = NULL;
|
||||||
|
+
|
||||||
|
+ backend = talloc_zero(config, struct virusfilter_backend);
|
||||||
|
+ if (backend == NULL) {
|
||||||
|
+ return -1;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ backend->fns = &virusfilter_backend_dummy;
|
||||||
|
+ backend->name = "dummy";
|
||||||
|
+ config->backend = backend;
|
||||||
|
+ return 0;
|
||||||
|
+}
|
||||||
|
diff --git a/source3/modules/wscript_build b/source3/modules/wscript_build
|
||||||
|
index 36b047ef79b..444a16f2cc0 100644
|
||||||
|
--- a/source3/modules/wscript_build
|
||||||
|
+++ b/source3/modules/wscript_build
|
||||||
|
@@ -598,6 +598,7 @@ bld.SAMBA3_MODULE('vfs_virusfilter',
|
||||||
|
vfs_virusfilter_sophos.c
|
||||||
|
vfs_virusfilter_fsav.c
|
||||||
|
vfs_virusfilter_clamav.c
|
||||||
|
+ vfs_virusfilter_dummy.c
|
||||||
|
''',
|
||||||
|
deps='samba-util VFS_VIRUSFILTER_UTILS',
|
||||||
|
init_function='',
|
||||||
|
--
|
||||||
|
2.34.1
|
||||||
|
|
||||||
|
|
||||||
|
From f3c9a2e7c524b25558550ed7fb1b7778975a3f2b Mon Sep 17 00:00:00 2001
|
||||||
|
From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= <pfilipen@redhat.com>
|
||||||
|
Date: Tue, 8 Feb 2022 22:35:29 +0100
|
||||||
|
Subject: [PATCH 2/5] docs-xml:manpages: Document 'dummy' virusfilter and
|
||||||
|
'virusfilter:infected files'
|
||||||
|
MIME-Version: 1.0
|
||||||
|
Content-Type: text/plain; charset=UTF-8
|
||||||
|
Content-Transfer-Encoding: 8bit
|
||||||
|
|
||||||
|
Bug: https://bugzilla.samba.org/show_bug.cgi?id=14971
|
||||||
|
|
||||||
|
Signed-off-by: Pavel Filipenský <pfilipen@redhat.com>
|
||||||
|
Reviewed-by: Jeremy Allison <jra@samba.org>
|
||||||
|
Reviewed-by: Andreas Schneider <asn@samba.org>
|
||||||
|
(cherry picked from commit 2fd518e5cc63221c162c9b3f8526b9b7c9e34969)
|
||||||
|
---
|
||||||
|
docs-xml/manpages/vfs_virusfilter.8.xml | 12 ++++++++++++
|
||||||
|
1 file changed, 12 insertions(+)
|
||||||
|
|
||||||
|
diff --git a/docs-xml/manpages/vfs_virusfilter.8.xml b/docs-xml/manpages/vfs_virusfilter.8.xml
|
||||||
|
index 329a35af68a..88f91d73a42 100644
|
||||||
|
--- a/docs-xml/manpages/vfs_virusfilter.8.xml
|
||||||
|
+++ b/docs-xml/manpages/vfs_virusfilter.8.xml
|
||||||
|
@@ -48,6 +48,10 @@
|
||||||
|
scanner</para></listitem>
|
||||||
|
<listitem><para><emphasis>clamav</emphasis>, the ClamAV
|
||||||
|
scanner</para></listitem>
|
||||||
|
+ <listitem><para><emphasis>dummy</emphasis>, dummy scanner used in
|
||||||
|
+ tests. Checks against the <emphasis>infected files</emphasis>
|
||||||
|
+ parameter and flags any name that matches as infected.
|
||||||
|
+ </para></listitem>
|
||||||
|
</itemizedlist>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
@@ -264,6 +268,14 @@
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
|
||||||
|
+ <varlistentry>
|
||||||
|
+ <term>virusfilter:infected files = empty</term>
|
||||||
|
+ <listitem>
|
||||||
|
+ <para>Files that virusfilter <emphasis>dummy</emphasis> flags as infected.</para>
|
||||||
|
+ <para>If this option is not set, the default is empty.</para>
|
||||||
|
+ </listitem>
|
||||||
|
+ </varlistentry>
|
||||||
|
+
|
||||||
|
<varlistentry>
|
||||||
|
<term>virusfilter:block access on error = false</term>
|
||||||
|
<listitem>
|
||||||
|
--
|
||||||
|
2.34.1
|
||||||
|
|
||||||
|
|
||||||
|
From 3758a9612862c88a17ed20787b60346859c03eea Mon Sep 17 00:00:00 2001
|
||||||
|
From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= <pfilipen@redhat.com>
|
||||||
|
Date: Tue, 8 Feb 2022 15:34:56 +0100
|
||||||
|
Subject: [PATCH 3/5] selftest: Fix trailing whitespace in Samba3.pm
|
||||||
|
MIME-Version: 1.0
|
||||||
|
Content-Type: text/plain; charset=UTF-8
|
||||||
|
Content-Transfer-Encoding: 8bit
|
||||||
|
|
||||||
|
Bug: https://bugzilla.samba.org/show_bug.cgi?id=14971
|
||||||
|
|
||||||
|
Signed-off-by: Pavel Filipenský <pfilipen@redhat.com>
|
||||||
|
Reviewed-by: Jeremy Allison <jra@samba.org>
|
||||||
|
Reviewed-by: Andreas Schneider <asn@samba.org>
|
||||||
|
(cherry picked from commit 547b4c595a8513a4be99177edbaa39ce43840f7a)
|
||||||
|
---
|
||||||
|
selftest/target/Samba3.pm | 6 +++---
|
||||||
|
1 file changed, 3 insertions(+), 3 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm
|
||||||
|
index 9a8c9ee2604..306783931e0 100755
|
||||||
|
--- a/selftest/target/Samba3.pm
|
||||||
|
+++ b/selftest/target/Samba3.pm
|
||||||
|
@@ -188,7 +188,7 @@ sub getlog_env_app($$$)
|
||||||
|
close(LOG);
|
||||||
|
|
||||||
|
return "" if $out eq $title;
|
||||||
|
-
|
||||||
|
+
|
||||||
|
return $out;
|
||||||
|
}
|
||||||
|
|
||||||
|
@@ -2205,7 +2205,7 @@ sub provision($$)
|
||||||
|
my $nmbdsockdir="$prefix_abs/nmbd";
|
||||||
|
unlink($nmbdsockdir);
|
||||||
|
|
||||||
|
- ##
|
||||||
|
+ ##
|
||||||
|
## create the test directory layout
|
||||||
|
##
|
||||||
|
die ("prefix_abs = ''") if $prefix_abs eq "";
|
||||||
|
@@ -3057,7 +3057,7 @@ sub provision($$)
|
||||||
|
unless (open(PASSWD, ">$nss_wrapper_passwd")) {
|
||||||
|
warn("Unable to open $nss_wrapper_passwd");
|
||||||
|
return undef;
|
||||||
|
- }
|
||||||
|
+ }
|
||||||
|
print PASSWD "nobody:x:$uid_nobody:$gid_nobody:nobody gecos:$prefix_abs:/bin/false
|
||||||
|
$unix_name:x:$unix_uid:$unix_gids[0]:$unix_name gecos:$prefix_abs:/bin/false
|
||||||
|
pdbtest:x:$uid_pdbtest:$gid_nogroup:pdbtest gecos:$prefix_abs:/bin/false
|
||||||
|
--
|
||||||
|
2.34.1
|
||||||
|
|
||||||
|
|
||||||
|
From e92fbd282c584cadcd0ed513c414b5377282ed64 Mon Sep 17 00:00:00 2001
|
||||||
|
From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= <pfilipen@redhat.com>
|
||||||
|
Date: Tue, 8 Feb 2022 15:35:48 +0100
|
||||||
|
Subject: [PATCH 4/5] s3:selftest: Add test for virus scanner
|
||||||
|
MIME-Version: 1.0
|
||||||
|
Content-Type: text/plain; charset=UTF-8
|
||||||
|
Content-Transfer-Encoding: 8bit
|
||||||
|
|
||||||
|
Bug: https://bugzilla.samba.org/show_bug.cgi?id=14971
|
||||||
|
|
||||||
|
Signed-off-by: Pavel Filipenský <pfilipen@redhat.com>
|
||||||
|
|
||||||
|
Pair-Programmed-With: Andreas Schneider <asn@samba.org>
|
||||||
|
Reviewed-by: Jeremy Allison <jra@samba.org>
|
||||||
|
Reviewed-by: Andreas Schneider <asn@samba.org>
|
||||||
|
(cherry picked from commit a25c714c34d3e00e0f3c29d2acfa98cf9cdbc544)
|
||||||
|
---
|
||||||
|
selftest/knownfail.d/virus_scanner | 2 +
|
||||||
|
selftest/target/Samba3.pm | 12 ++
|
||||||
|
source3/script/tests/test_virus_scanner.sh | 124 +++++++++++++++++++++
|
||||||
|
source3/selftest/tests.py | 9 ++
|
||||||
|
4 files changed, 147 insertions(+)
|
||||||
|
create mode 100644 selftest/knownfail.d/virus_scanner
|
||||||
|
create mode 100755 source3/script/tests/test_virus_scanner.sh
|
||||||
|
|
||||||
|
diff --git a/selftest/knownfail.d/virus_scanner b/selftest/knownfail.d/virus_scanner
|
||||||
|
new file mode 100644
|
||||||
|
index 00000000000..6df3fd20627
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/selftest/knownfail.d/virus_scanner
|
||||||
|
@@ -0,0 +1,2 @@
|
||||||
|
+^samba3.blackbox.virus_scanner.check_infected_read # test download infected file ('vfs objects = virusfilter')
|
||||||
|
+^samba3.blackbox.virus_scanner.check_infected_write # test upload infected file ('vfs objects = virusfilter')
|
||||||
|
diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm
|
||||||
|
index 306783931e0..baec3347c7d 100755
|
||||||
|
--- a/selftest/target/Samba3.pm
|
||||||
|
+++ b/selftest/target/Samba3.pm
|
||||||
|
@@ -1463,6 +1463,9 @@ sub setup_fileserver
|
||||||
|
my $veto_sharedir="$share_dir/veto";
|
||||||
|
push(@dirs,$veto_sharedir);
|
||||||
|
|
||||||
|
+ my $virusfilter_sharedir="$share_dir/virusfilter";
|
||||||
|
+ push(@dirs,$virusfilter_sharedir);
|
||||||
|
+
|
||||||
|
my $ip4 = Samba::get_ipv4_addr("FILESERVER");
|
||||||
|
my $fileserver_options = "
|
||||||
|
kernel change notify = yes
|
||||||
|
@@ -1588,6 +1591,15 @@ sub setup_fileserver
|
||||||
|
path = $veto_sharedir
|
||||||
|
delete veto files = yes
|
||||||
|
|
||||||
|
+[virusfilter]
|
||||||
|
+ path = $virusfilter_sharedir
|
||||||
|
+ vfs objects = acl_xattr virusfilter
|
||||||
|
+ virusfilter:scanner = dummy
|
||||||
|
+ virusfilter:min file size = 0
|
||||||
|
+ virusfilter:infected files = *infected*
|
||||||
|
+ virusfilter:infected file action = rename
|
||||||
|
+ virusfilter:scan on close = yes
|
||||||
|
+
|
||||||
|
[homes]
|
||||||
|
comment = Home directories
|
||||||
|
browseable = No
|
||||||
|
diff --git a/source3/script/tests/test_virus_scanner.sh b/source3/script/tests/test_virus_scanner.sh
|
||||||
|
new file mode 100755
|
||||||
|
index 00000000000..2234ea6ca89
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/source3/script/tests/test_virus_scanner.sh
|
||||||
|
@@ -0,0 +1,124 @@
|
||||||
|
+#!/bin/sh
|
||||||
|
+# Copyright (c) 2022 Pavel Filipenský <pfilipen@redhat.com>
|
||||||
|
+# shellcheck disable=1091
|
||||||
|
+
|
||||||
|
+if [ $# -lt 4 ]; then
|
||||||
|
+cat <<EOF
|
||||||
|
+Usage: $0 SERVER_IP SHARE LOCAL_PATH SMBCLIENT
|
||||||
|
+EOF
|
||||||
|
+exit 1;
|
||||||
|
+fi
|
||||||
|
+
|
||||||
|
+SERVER_IP=${1}
|
||||||
|
+SHARE=${2}
|
||||||
|
+LOCAL_PATH=${3}
|
||||||
|
+SMBCLIENT=${4}
|
||||||
|
+
|
||||||
|
+SMBCLIENT="${VALGRIND} ${SMBCLIENT}"
|
||||||
|
+
|
||||||
|
+failed=0
|
||||||
|
+sharedir="${LOCAL_PATH}/${SHARE}"
|
||||||
|
+
|
||||||
|
+incdir="$(dirname "$0")/../../../testprogs/blackbox"
|
||||||
|
+. "${incdir}/subunit.sh"
|
||||||
|
+
|
||||||
|
+check_infected_read()
|
||||||
|
+{
|
||||||
|
+ rm -rf "${sharedir:?}"/*
|
||||||
|
+
|
||||||
|
+ if ! touch "${sharedir}/infected.txt"; then
|
||||||
|
+ echo "ERROR: Cannot create ${sharedir}/infected.txt"
|
||||||
|
+ return 1
|
||||||
|
+ fi
|
||||||
|
+
|
||||||
|
+ ${SMBCLIENT} "//${SERVER_IP}/${SHARE}" -U"${USER}"%"${PASSWORD}" -c "get infected.txt ${sharedir}/infected.download.txt"
|
||||||
|
+
|
||||||
|
+ # check that virusfilter:rename prefix/suffix was added
|
||||||
|
+ if [ ! -f "${sharedir}/virusfilter.infected.txt.infected" ]; then
|
||||||
|
+ echo "ERROR: ${sharedir}/virusfilter.infected.txt.infected is missing."
|
||||||
|
+ return 1
|
||||||
|
+ fi
|
||||||
|
+
|
||||||
|
+ # check that file was not downloaded
|
||||||
|
+ if [ -f "${sharedir}/infected.download.txt" ]; then
|
||||||
|
+ echo "ERROR: {sharedir}/infected.download.txt should not exist."
|
||||||
|
+ return 1
|
||||||
|
+ fi
|
||||||
|
+
|
||||||
|
+ return 0
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+check_infected_write()
|
||||||
|
+{
|
||||||
|
+ rm -rf "${sharedir:?}"/*
|
||||||
|
+ smbfile=infected.upload.txt
|
||||||
|
+ smbfilerenamed="virusfilter.${smbfile}.infected"
|
||||||
|
+
|
||||||
|
+ # non empty file is needed
|
||||||
|
+ # vsf_virusfilter performs a scan only if fsp->fsp_flags.modified
|
||||||
|
+ if ! echo "Hello Virus!" > "${sharedir}/infected.txt"; then
|
||||||
|
+ echo "ERROR: Cannot create ${sharedir}/infected.txt"
|
||||||
|
+ return 1
|
||||||
|
+ fi
|
||||||
|
+
|
||||||
|
+ ${SMBCLIENT} "//${SERVER_IP}/${SHARE}" -U"${USER}"%"${PASSWORD}" -c "put ${sharedir}/infected.txt ${smbfile}"
|
||||||
|
+
|
||||||
|
+ # check that virusfilter:rename prefix/suffix was added
|
||||||
|
+ if [ ! -f "${sharedir}/${smbfilerenamed}" ]; then
|
||||||
|
+ echo "ERROR: ${sharedir}/${smbfilerenamed} is missing."
|
||||||
|
+ return 1
|
||||||
|
+ fi
|
||||||
|
+
|
||||||
|
+ # check that file was not uploaded
|
||||||
|
+ if [ -f "${sharedir}/infected.upload.txt" ]; then
|
||||||
|
+ echo "ERROR: {sharedir}/${smbfile} should not exist."
|
||||||
|
+ return 1
|
||||||
|
+ fi
|
||||||
|
+
|
||||||
|
+ return 0
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+check_healthy_read()
|
||||||
|
+{
|
||||||
|
+ rm -rf "${sharedir:?}"/*
|
||||||
|
+
|
||||||
|
+ if ! echo "Hello Samba!" > "${sharedir}/healthy.txt"; then
|
||||||
|
+ echo "ERROR: Cannot create ${sharedir}/healthy.txt"
|
||||||
|
+ return 1
|
||||||
|
+ fi
|
||||||
|
+
|
||||||
|
+ ${SMBCLIENT} //"${SERVER_IP}"/"${SHARE}" -U"${USER}"%"${PASSWORD}" -c "get healthy.txt ${sharedir}/healthy.download.txt"
|
||||||
|
+
|
||||||
|
+ if ! cmp "${sharedir}/healthy.txt" "${sharedir}/healthy.download.txt"; then
|
||||||
|
+ echo "ERROR: cmp ${sharedir}/healthy.txt ${sharedir}/healthy.download.txt FAILED"
|
||||||
|
+ return 1
|
||||||
|
+ fi
|
||||||
|
+
|
||||||
|
+ return 0
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+check_healthy_write()
|
||||||
|
+{
|
||||||
|
+ rm -rf "${sharedir:?}"/*
|
||||||
|
+
|
||||||
|
+ if ! echo "Hello Samba!" > "${sharedir}/healthy.txt"; then
|
||||||
|
+ echo "ERROR: Cannot create ${sharedir}/healthy.txt"
|
||||||
|
+ return 1
|
||||||
|
+ fi
|
||||||
|
+
|
||||||
|
+ ${SMBCLIENT} //"${SERVER_IP}"/"${SHARE}" -U"${USER}"%"${PASSWORD}" -c "put ${sharedir}/healthy.txt healthy.upload.txt"
|
||||||
|
+
|
||||||
|
+ if ! cmp "${sharedir}/healthy.txt" "${sharedir}/healthy.upload.txt"; then
|
||||||
|
+ echo "ERROR: cmp ${sharedir}/healthy.txt ${sharedir}/healthy.upload.txt FAILED"
|
||||||
|
+ return 1
|
||||||
|
+ fi
|
||||||
|
+
|
||||||
|
+ return 0
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+testit "check_infected_read" check_infected_read || failed=$((failed + 1))
|
||||||
|
+testit "check_infected_write" check_infected_write || failed=$((failed + 1))
|
||||||
|
+testit "check_healthy_read" check_healthy_read || failed=$((failed + 1))
|
||||||
|
+testit "check_healthy_write" check_healthy_write || failed=$((failed + 1))
|
||||||
|
+
|
||||||
|
+testok "$0" "$failed"
|
||||||
|
diff --git a/source3/selftest/tests.py b/source3/selftest/tests.py
|
||||||
|
index c78c9ea4ab8..3c8976874e6 100755
|
||||||
|
--- a/source3/selftest/tests.py
|
||||||
|
+++ b/source3/selftest/tests.py
|
||||||
|
@@ -1113,6 +1113,15 @@ plantestsuite("samba3.blackbox.smbclient.encryption_off", "simpleserver",
|
||||||
|
"$USERNAME", "$PASSWORD", "$SERVER",
|
||||||
|
smbclient3])
|
||||||
|
|
||||||
|
+env = 'fileserver'
|
||||||
|
+plantestsuite("samba3.blackbox.virus_scanner", "%s:local" % (env),
|
||||||
|
+ [os.path.join(samba3srcdir,
|
||||||
|
+ "script/tests/test_virus_scanner.sh"),
|
||||||
|
+ '$SERVER_IP',
|
||||||
|
+ "virusfilter",
|
||||||
|
+ '$LOCAL_PATH',
|
||||||
|
+ smbclient3])
|
||||||
|
+
|
||||||
|
for env in ['fileserver', 'simpleserver']:
|
||||||
|
plantestsuite("samba3.blackbox.smbclient.encryption", env,
|
||||||
|
[os.path.join(samba3srcdir, "script/tests/test_smbclient_encryption.sh"),
|
||||||
|
--
|
||||||
|
2.34.1
|
||||||
|
|
||||||
|
|
||||||
|
From 3e1a57b6d8528d7aa4c46b8ac76bff034523b273 Mon Sep 17 00:00:00 2001
|
||||||
|
From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= <pfilipen@redhat.com>
|
||||||
|
Date: Mon, 7 Feb 2022 23:06:10 +0100
|
||||||
|
Subject: [PATCH 5/5] s3:modules: Fix virusfilter_vfs_openat
|
||||||
|
MIME-Version: 1.0
|
||||||
|
Content-Type: text/plain; charset=UTF-8
|
||||||
|
Content-Transfer-Encoding: 8bit
|
||||||
|
|
||||||
|
Bug: https://bugzilla.samba.org/show_bug.cgi?id=14971
|
||||||
|
|
||||||
|
Signed-off-by: Pavel Filipenský <pfilipen@redhat.com>
|
||||||
|
|
||||||
|
Pair-Programmed-With: Andreas Schneider <asn@samba.org>
|
||||||
|
Reviewed-by: Jeremy Allison <jra@samba.org>
|
||||||
|
Reviewed-by: Andreas Schneider <asn@samba.org>
|
||||||
|
|
||||||
|
Autobuild-User(master): Jeremy Allison <jra@samba.org>
|
||||||
|
Autobuild-Date(master): Thu Feb 10 22:09:06 UTC 2022 on sn-devel-184
|
||||||
|
|
||||||
|
(cherry picked from commit 3f1c958f6fa9d2991185f4e281a377a295d09f9c)
|
||||||
|
---
|
||||||
|
selftest/knownfail.d/virus_scanner | 2 --
|
||||||
|
source3/modules/vfs_virusfilter.c | 6 +++---
|
||||||
|
2 files changed, 3 insertions(+), 5 deletions(-)
|
||||||
|
delete mode 100644 selftest/knownfail.d/virus_scanner
|
||||||
|
|
||||||
|
diff --git a/selftest/knownfail.d/virus_scanner b/selftest/knownfail.d/virus_scanner
|
||||||
|
deleted file mode 100644
|
||||||
|
index 6df3fd20627..00000000000
|
||||||
|
--- a/selftest/knownfail.d/virus_scanner
|
||||||
|
+++ /dev/null
|
||||||
|
@@ -1,2 +0,0 @@
|
||||||
|
-^samba3.blackbox.virus_scanner.check_infected_read # test download infected file ('vfs objects = virusfilter')
|
||||||
|
-^samba3.blackbox.virus_scanner.check_infected_write # test upload infected file ('vfs objects = virusfilter')
|
||||||
|
diff --git a/source3/modules/vfs_virusfilter.c b/source3/modules/vfs_virusfilter.c
|
||||||
|
index 5ae8a02a369..8c7e5323341 100644
|
||||||
|
--- a/source3/modules/vfs_virusfilter.c
|
||||||
|
+++ b/source3/modules/vfs_virusfilter.c
|
||||||
|
@@ -1304,21 +1304,21 @@ static int virusfilter_vfs_openat(struct vfs_handle_struct *handle,
|
||||||
|
*/
|
||||||
|
goto virusfilter_vfs_open_next;
|
||||||
|
}
|
||||||
|
- ret = S_ISREG(smb_fname->st.st_ex_mode);
|
||||||
|
+ ret = S_ISREG(sbuf.st_ex_mode);
|
||||||
|
if (ret == 0) {
|
||||||
|
DBG_INFO("Not scanned: Directory or special file: %s/%s\n",
|
||||||
|
cwd_fname, fname);
|
||||||
|
goto virusfilter_vfs_open_next;
|
||||||
|
}
|
||||||
|
if (config->max_file_size > 0 &&
|
||||||
|
- smb_fname->st.st_ex_size > config->max_file_size)
|
||||||
|
+ sbuf.st_ex_size > config->max_file_size)
|
||||||
|
{
|
||||||
|
DBG_INFO("Not scanned: file size > max file size: %s/%s\n",
|
||||||
|
cwd_fname, fname);
|
||||||
|
goto virusfilter_vfs_open_next;
|
||||||
|
}
|
||||||
|
if (config->min_file_size > 0 &&
|
||||||
|
- smb_fname->st.st_ex_size < config->min_file_size)
|
||||||
|
+ sbuf.st_ex_size < config->min_file_size)
|
||||||
|
{
|
||||||
|
DBG_INFO("Not scanned: file size < min file size: %s/%s\n",
|
||||||
|
cwd_fname, fname);
|
||||||
|
--
|
||||||
|
2.34.1
|
||||||
|
|
||||||
@ -108,7 +108,7 @@
|
|||||||
|
|
||||||
%define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not")
|
%define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not")
|
||||||
|
|
||||||
%global baserelease 9
|
%global baserelease 10
|
||||||
|
|
||||||
%global samba_version 4.14.5
|
%global samba_version 4.14.5
|
||||||
%global talloc_version 2.3.2
|
%global talloc_version 2.3.2
|
||||||
@ -189,6 +189,7 @@ Patch8: samba-4.14-del-dir-with-dangling-symlinks.patch
|
|||||||
Patch9: samba-4.14-fix-username-map-script.patch
|
Patch9: samba-4.14-fix-username-map-script.patch
|
||||||
Patch10: samba-4.14-fix-domain-join-segfault.patch
|
Patch10: samba-4.14-fix-domain-join-segfault.patch
|
||||||
Patch11: CVE-2021-44142-v4.14.patch
|
Patch11: CVE-2021-44142-v4.14.patch
|
||||||
|
Patch12: samba-4.14-fix-virus-scanner.patch
|
||||||
|
|
||||||
Requires(pre): /usr/sbin/groupadd
|
Requires(pre): /usr/sbin/groupadd
|
||||||
Requires(post): systemd
|
Requires(post): systemd
|
||||||
@ -3920,6 +3921,9 @@ fi
|
|||||||
%endif
|
%endif
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Tue Feb 22 2022 Pavel Filipenský <pfilipen@redhat.com> - 4.14.5-10
|
||||||
|
- resolves: rhbz#2029417 - Fix virusfilter_vfs_openat: Not scanned: Directory or special file
|
||||||
|
|
||||||
* Thu Jan 27 2022 Andreas Schneider <asn@redhat.com> - 4.14.5-9
|
* Thu Jan 27 2022 Andreas Schneider <asn@redhat.com> - 4.14.5-9
|
||||||
- resolves: rhbz#2046174 - Fix username map script regression of CVE-2020-25717
|
- resolves: rhbz#2046174 - Fix username map script regression of CVE-2020-25717
|
||||||
- resolves: rhbz#2046160 - Fix possible segfault while joining a domain
|
- resolves: rhbz#2046160 - Fix possible segfault while joining a domain
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user