samba/sme10/samba-v4-6-fix-spoolss-32bit-driver-upload.patch

From 7afb2ec722fa628a3b214252535a8e31aac16f12 Mon Sep 17 00:00:00 2001
From: Andreas Schneider <asn@samba.org>
Date: Thu, 4 May 2017 17:48:42 +0200
Subject: [PATCH 1/3] s3:printing: Change to GUID dir if we deal with
 COPY_FROM_DIRECTORY

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12761

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
(cherry picked from commit 5b15c7e8908697b157d2593b7caa9be760594a05)
---
 source3/printing/nt_printing.c | 51 +++++++++++++++++++++++++++++-------------
 1 file changed, 35 insertions(+), 16 deletions(-)

diff --git a/source3/printing/nt_printing.c b/source3/printing/nt_printing.c
index 394a3e5..49be5d9 100644
--- a/source3/printing/nt_printing.c
+++ b/source3/printing/nt_printing.c
@@ -666,16 +666,18 @@ Determine the correct cVersion associated with an architecture and driver
 static uint32_t get_correct_cversion(struct auth_session_info *session_info,
                                   const char *architecture,
                                   const char *driverpath_in,
+                                  const char *driver_directory,
                                   WERROR *perr)
 {
        int cversion = -1;
        NTSTATUS          nt_status;
        struct smb_filename *smb_fname = NULL;
-       char *driverpath = NULL;
        files_struct      *fsp = NULL;
        connection_struct *conn = NULL;
        char *oldcwd;
        char *printdollar = NULL;
+       char *printdollar_path = NULL;
+       char *working_dir = NULL;
        int printdollar_snum;
 
        *perr = WERR_INVALID_PARAMETER;
@@ -704,12 +706,33 @@ static uint32_t get_correct_cversion(struct auth_session_info *session_info,
                return -1;
        }
 
+       printdollar_path = lp_path(talloc_tos(), printdollar_snum);
+       if (printdollar_path == NULL) {
+               *perr = WERR_NOT_ENOUGH_MEMORY;
+               return -1;
+       }
+
+       working_dir = talloc_asprintf(talloc_tos(),
+                                     "%s/%s",
+                                     printdollar_path,
+                                     architecture);
+       /*
+        * If the driver has been uploaded into a temorpary driver
+        * directory, switch to the driver directory.
+        */
+       if (driver_directory != NULL) {
+               working_dir = talloc_asprintf(talloc_tos(), "%s/%s/%s",
+                                             printdollar_path,
+                                             architecture,
+                                             driver_directory);
+       }
+
        nt_status = create_conn_struct_cwd(talloc_tos(),
                                           server_event_context(),
                                           server_messaging_context(),
                                           &conn,
                                           printdollar_snum,
-                                          lp_path(talloc_tos(), printdollar_snum),
+                                          working_dir,
                                           session_info, &oldcwd);
        if (!NT_STATUS_IS_OK(nt_status)) {
                DEBUG(0,("get_correct_cversion: create_conn_struct "
@@ -731,18 +754,11 @@ static uint32_t get_correct_cversion(struct auth_session_info *session_info,
                goto error_free_conn;
        }
 
-       /* Open the driver file (Portable Executable format) and determine the
-        * deriver the cversion. */
-       driverpath = talloc_asprintf(talloc_tos(),
-                                       "%s/%s",
-                                       architecture,
-                                       driverpath_in);
-       if (!driverpath) {
-               *perr = WERR_NOT_ENOUGH_MEMORY;
-               goto error_exit;
-       }
-
-       nt_status = driver_unix_convert(conn, driverpath, &smb_fname);
+       /*
+        * We switch to the directory where the driver files are located,
+        * so only work on the file names
+        */
+       nt_status = driver_unix_convert(conn, driverpath_in, &smb_fname);
        if (!NT_STATUS_IS_OK(nt_status)) {
                *perr = ntstatus_to_werror(nt_status);
                goto error_exit;
@@ -956,8 +972,11 @@ static WERROR clean_up_driver_struct_level(TALLOC_CTX *mem_ctx,
         *      NT2K: cversion=3
         */
 
-       *version = get_correct_cversion(session_info, short_architecture,
-                                       *driver_path, &err);
+       *version = get_correct_cversion(session_info,
+                                       short_architecture,
+                                       *driver_path,
+                                       *driver_directory,
+                                       &err);
        if (*version == -1) {
                return err;
        }
-- 
2.9.3


From f0c2a79e1312d2f8231940c12e08b09d65d03648 Mon Sep 17 00:00:00 2001
From: Andreas Schneider <asn@samba.org>
Date: Fri, 5 May 2017 11:11:25 +0200
Subject: [PATCH 2/3] smbtorture:spoolss: Rename the copy_from_directory test
 for 64bit

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12761

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
(cherry picked from commit 86798a0fa16b4cc89c35d698bffe0b436fc4eb2e)
---
 source4/torture/rpc/spoolss.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/source4/torture/rpc/spoolss.c b/source4/torture/rpc/spoolss.c
index 409ba57..c4b7bf1 100644
--- a/source4/torture/rpc/spoolss.c
+++ b/source4/torture/rpc/spoolss.c
@@ -11109,7 +11109,8 @@ static bool test_multiple_drivers(struct torture_context *tctx,
 }
 
 static bool test_driver_copy_from_directory(struct torture_context *tctx,
-                                           struct dcerpc_pipe *p)
+                                           struct dcerpc_pipe *p,
+                                           const char *architecture)
 {
        struct torture_driver_context *d;
        struct spoolss_StringArray *a;
@@ -11125,8 +11126,7 @@ static bool test_driver_copy_from_directory(struct torture_context *tctx,
        d = talloc_zero(tctx, struct torture_driver_context);
        torture_assert_not_null(tctx, d, "ENOMEM");
 
-       d->local.environment            =
-               talloc_asprintf(d, SPOOLSS_ARCHITECTURE_x64);
+       d->local.environment            = talloc_strdup(d, architecture);
        torture_assert_not_null_goto(tctx, d->local.environment, ok, done, "ENOMEM");
 
        d->local.driver_directory       =
@@ -11208,6 +11208,12 @@ done:
        return ok;
 }
 
+static bool test_driver_copy_from_directory_64(struct torture_context *tctx,
+                                              struct dcerpc_pipe *p)
+{
+       return test_driver_copy_from_directory(tctx, p, SPOOLSS_ARCHITECTURE_x64);
+}
+
 static bool test_del_driver_all_files(struct torture_context *tctx,
                                      struct dcerpc_pipe *p)
 {
@@ -11401,8 +11407,8 @@ struct torture_suite *torture_rpc_spoolss_driver(TALLOC_CTX *mem_ctx)
        torture_rpc_tcase_add_test(tcase, "multiple_drivers", test_multiple_drivers);
 
        torture_rpc_tcase_add_test(tcase,
-                                  "test_driver_copy_from_directory",
-                                  test_driver_copy_from_directory);
+                                  "test_driver_copy_from_directory_64",
+                                  test_driver_copy_from_directory_64);
 
        torture_rpc_tcase_add_test(tcase, "del_driver_all_files", test_del_driver_all_files);
 
-- 
2.9.3


From daca3311db095c96a471f49dcfe291e5e048ed19 Mon Sep 17 00:00:00 2001
From: Andreas Schneider <asn@samba.org>
Date: Fri, 5 May 2017 11:12:02 +0200
Subject: [PATCH 3/3] smbtorture:spoolss: Add a 32bit test for
 copy_from_directory

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12761

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
(cherry picked from commit 23009b97bf2f831811c4690141db7355537659d0)
---
 source4/torture/rpc/spoolss.c | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/source4/torture/rpc/spoolss.c b/source4/torture/rpc/spoolss.c
index c4b7bf1..e17ac6f 100644
--- a/source4/torture/rpc/spoolss.c
+++ b/source4/torture/rpc/spoolss.c
@@ -11129,8 +11129,13 @@ static bool test_driver_copy_from_directory(struct torture_context *tctx,
        d->local.environment            = talloc_strdup(d, architecture);
        torture_assert_not_null_goto(tctx, d->local.environment, ok, done, "ENOMEM");
 
-       d->local.driver_directory       =
-               talloc_asprintf(d, "/usr/share/cups/drivers/x64");
+       if (strequal(architecture, SPOOLSS_ARCHITECTURE_x64)) {
+               d->local.driver_directory =
+                       talloc_strdup(d, "/usr/share/cups/drivers/x64");
+       } else {
+               d->local.driver_directory =
+                       talloc_strdup(d, "/usr/share/cups/drivers/i386");
+       }
        torture_assert_not_null_goto(tctx, d->local.driver_directory, ok, done, "ENOMEM");
 
        d->remote.driver_upload_directory = GUID_string2(d, &guid);
@@ -11214,6 +11219,12 @@ static bool test_driver_copy_from_directory_64(struct torture_context *tctx,
        return test_driver_copy_from_directory(tctx, p, SPOOLSS_ARCHITECTURE_x64);
 }
 
+static bool test_driver_copy_from_directory_32(struct torture_context *tctx,
+                                              struct dcerpc_pipe *p)
+{
+       return test_driver_copy_from_directory(tctx, p, SPOOLSS_ARCHITECTURE_NT_X86);
+}
+
 static bool test_del_driver_all_files(struct torture_context *tctx,
                                      struct dcerpc_pipe *p)
 {
@@ -11410,6 +11421,10 @@ struct torture_suite *torture_rpc_spoolss_driver(TALLOC_CTX *mem_ctx)
                                   "test_driver_copy_from_directory_64",
                                   test_driver_copy_from_directory_64);
 
+       torture_rpc_tcase_add_test(tcase,
+                                  "test_driver_copy_from_directory_32",
+                                  test_driver_copy_from_directory_32);
+
        torture_rpc_tcase_add_test(tcase, "del_driver_all_files", test_del_driver_all_files);
 
        torture_rpc_tcase_add_test(tcase, "del_driver_unused_files", test_del_driver_unused_files);
-- 
2.9.3

1	jpp	1.1	From 7afb2ec722fa628a3b214252535a8e31aac16f12 Mon Sep 17 00:00:00 2001
2			From: Andreas Schneider <asn@samba.org>
3			Date: Thu, 4 May 2017 17:48:42 +0200
4			Subject: [PATCH 1/3] s3:printing: Change to GUID dir if we deal with
5			COPY_FROM_DIRECTORY
6
7			BUG: https://bugzilla.samba.org/show_bug.cgi?id=12761
8
9			Signed-off-by: Andreas Schneider <asn@samba.org>
10			Reviewed-by: Guenther Deschner <gd@samba.org>
11			(cherry picked from commit 5b15c7e8908697b157d2593b7caa9be760594a05)
12			---
13			source3/printing/nt_printing.c \| 51 +++++++++++++++++++++++++++++-------------
14			1 file changed, 35 insertions(+), 16 deletions(-)
15
16			diff --git a/source3/printing/nt_printing.c b/source3/printing/nt_printing.c
17			index 394a3e5..49be5d9 100644
18			--- a/source3/printing/nt_printing.c
19			+++ b/source3/printing/nt_printing.c
20			@@ -666,16 +666,18 @@ Determine the correct cVersion associated with an architecture and driver
21			static uint32_t get_correct_cversion(struct auth_session_info *session_info,
22			const char *architecture,
23			const char *driverpath_in,
24			+ const char *driver_directory,
25			WERROR *perr)
26			{
27			int cversion = -1;
28			NTSTATUS nt_status;
29			struct smb_filename *smb_fname = NULL;
30			- char *driverpath = NULL;
31			files_struct *fsp = NULL;
32			connection_struct *conn = NULL;
33			char *oldcwd;
34			char *printdollar = NULL;
35			+ char *printdollar_path = NULL;
36			+ char *working_dir = NULL;
37			int printdollar_snum;
38
39			*perr = WERR_INVALID_PARAMETER;
40			@@ -704,12 +706,33 @@ static uint32_t get_correct_cversion(struct auth_session_info *session_info,
41			return -1;
42			}
43
44			+ printdollar_path = lp_path(talloc_tos(), printdollar_snum);
45			+ if (printdollar_path == NULL) {
46			+ *perr = WERR_NOT_ENOUGH_MEMORY;
47			+ return -1;
48			+ }
49			+
50			+ working_dir = talloc_asprintf(talloc_tos(),
51			+ "%s/%s",
52			+ printdollar_path,
53			+ architecture);
54			+ /*
55			+ * If the driver has been uploaded into a temorpary driver
56			+ * directory, switch to the driver directory.
57			+ */
58			+ if (driver_directory != NULL) {
59			+ working_dir = talloc_asprintf(talloc_tos(), "%s/%s/%s",
60			+ printdollar_path,
61			+ architecture,
62			+ driver_directory);
63			+ }
64			+
65			nt_status = create_conn_struct_cwd(talloc_tos(),
66			server_event_context(),
67			server_messaging_context(),
68			&conn,
69			printdollar_snum,
70			- lp_path(talloc_tos(), printdollar_snum),
71			+ working_dir,
72			session_info, &oldcwd);
73			if (!NT_STATUS_IS_OK(nt_status)) {
74			DEBUG(0,("get_correct_cversion: create_conn_struct "
75			@@ -731,18 +754,11 @@ static uint32_t get_correct_cversion(struct auth_session_info *session_info,
76			goto error_free_conn;
77			}
78
79			- /* Open the driver file (Portable Executable format) and determine the
80			- * deriver the cversion. */
81			- driverpath = talloc_asprintf(talloc_tos(),
82			- "%s/%s",
83			- architecture,
84			- driverpath_in);
85			- if (!driverpath) {
86			- *perr = WERR_NOT_ENOUGH_MEMORY;
87			- goto error_exit;
88			- }
89			-
90			- nt_status = driver_unix_convert(conn, driverpath, &smb_fname);
91			+ /*
92			+ * We switch to the directory where the driver files are located,
93			+ * so only work on the file names
94			+ */
95			+ nt_status = driver_unix_convert(conn, driverpath_in, &smb_fname);
96			if (!NT_STATUS_IS_OK(nt_status)) {
97			*perr = ntstatus_to_werror(nt_status);
98			goto error_exit;
99			@@ -956,8 +972,11 @@ static WERROR clean_up_driver_struct_level(TALLOC_CTX *mem_ctx,
100			* NT2K: cversion=3
101			*/
102
103			- *version = get_correct_cversion(session_info, short_architecture,
104			- *driver_path, &err);
105			+ *version = get_correct_cversion(session_info,
106			+ short_architecture,
107			+ *driver_path,
108			+ *driver_directory,
109			+ &err);
110			if (*version == -1) {
111			return err;
112			}
113			--
114			2.9.3
115
116
117			From f0c2a79e1312d2f8231940c12e08b09d65d03648 Mon Sep 17 00:00:00 2001
118			From: Andreas Schneider <asn@samba.org>
119			Date: Fri, 5 May 2017 11:11:25 +0200
120			Subject: [PATCH 2/3] smbtorture:spoolss: Rename the copy_from_directory test
121			for 64bit
122
123			BUG: https://bugzilla.samba.org/show_bug.cgi?id=12761
124
125			Signed-off-by: Andreas Schneider <asn@samba.org>
126			Reviewed-by: Guenther Deschner <gd@samba.org>
127			(cherry picked from commit 86798a0fa16b4cc89c35d698bffe0b436fc4eb2e)
128			---
129			source4/torture/rpc/spoolss.c \| 16 +++++++++++-----
130			1 file changed, 11 insertions(+), 5 deletions(-)
131
132			diff --git a/source4/torture/rpc/spoolss.c b/source4/torture/rpc/spoolss.c
133			index 409ba57..c4b7bf1 100644
134			--- a/source4/torture/rpc/spoolss.c
135			+++ b/source4/torture/rpc/spoolss.c
136			@@ -11109,7 +11109,8 @@ static bool test_multiple_drivers(struct torture_context *tctx,
137			}
138
139			static bool test_driver_copy_from_directory(struct torture_context *tctx,
140			- struct dcerpc_pipe *p)
141			+ struct dcerpc_pipe *p,
142			+ const char *architecture)
143			{
144			struct torture_driver_context *d;
145			struct spoolss_StringArray *a;
146			@@ -11125,8 +11126,7 @@ static bool test_driver_copy_from_directory(struct torture_context *tctx,
147			d = talloc_zero(tctx, struct torture_driver_context);
148			torture_assert_not_null(tctx, d, "ENOMEM");
149
150			- d->local.environment =
151			- talloc_asprintf(d, SPOOLSS_ARCHITECTURE_x64);
152			+ d->local.environment = talloc_strdup(d, architecture);
153			torture_assert_not_null_goto(tctx, d->local.environment, ok, done, "ENOMEM");
154
155			d->local.driver_directory =
156			@@ -11208,6 +11208,12 @@ done:
157			return ok;
158			}
159
160			+static bool test_driver_copy_from_directory_64(struct torture_context *tctx,
161			+ struct dcerpc_pipe *p)
162			+{
163			+ return test_driver_copy_from_directory(tctx, p, SPOOLSS_ARCHITECTURE_x64);
164			+}
165			+
166			static bool test_del_driver_all_files(struct torture_context *tctx,
167			struct dcerpc_pipe *p)
168			{
169			@@ -11401,8 +11407,8 @@ struct torture_suite torture_rpc_spoolss_driver(TALLOC_CTX mem_ctx)
170			torture_rpc_tcase_add_test(tcase, "multiple_drivers", test_multiple_drivers);
171
172			torture_rpc_tcase_add_test(tcase,
173			- "test_driver_copy_from_directory",
174			- test_driver_copy_from_directory);
175			+ "test_driver_copy_from_directory_64",
176			+ test_driver_copy_from_directory_64);
177
178			torture_rpc_tcase_add_test(tcase, "del_driver_all_files", test_del_driver_all_files);
179
180			--
181			2.9.3
182
183
184			From daca3311db095c96a471f49dcfe291e5e048ed19 Mon Sep 17 00:00:00 2001
185			From: Andreas Schneider <asn@samba.org>
186			Date: Fri, 5 May 2017 11:12:02 +0200
187			Subject: [PATCH 3/3] smbtorture:spoolss: Add a 32bit test for
188			copy_from_directory
189
190			BUG: https://bugzilla.samba.org/show_bug.cgi?id=12761
191
192			Signed-off-by: Andreas Schneider <asn@samba.org>
193			Reviewed-by: Guenther Deschner <gd@samba.org>
194			(cherry picked from commit 23009b97bf2f831811c4690141db7355537659d0)
195			---
196			source4/torture/rpc/spoolss.c \| 19 +++++++++++++++++--
197			1 file changed, 17 insertions(+), 2 deletions(-)
198
199			diff --git a/source4/torture/rpc/spoolss.c b/source4/torture/rpc/spoolss.c
200			index c4b7bf1..e17ac6f 100644
201			--- a/source4/torture/rpc/spoolss.c
202			+++ b/source4/torture/rpc/spoolss.c
203			@@ -11129,8 +11129,13 @@ static bool test_driver_copy_from_directory(struct torture_context *tctx,
204			d->local.environment = talloc_strdup(d, architecture);
205			torture_assert_not_null_goto(tctx, d->local.environment, ok, done, "ENOMEM");
206
207			- d->local.driver_directory =
208			- talloc_asprintf(d, "/usr/share/cups/drivers/x64");
209			+ if (strequal(architecture, SPOOLSS_ARCHITECTURE_x64)) {
210			+ d->local.driver_directory =
211			+ talloc_strdup(d, "/usr/share/cups/drivers/x64");
212			+ } else {
213			+ d->local.driver_directory =
214			+ talloc_strdup(d, "/usr/share/cups/drivers/i386");
215			+ }
216			torture_assert_not_null_goto(tctx, d->local.driver_directory, ok, done, "ENOMEM");
217
218			d->remote.driver_upload_directory = GUID_string2(d, &guid);
219			@@ -11214,6 +11219,12 @@ static bool test_driver_copy_from_directory_64(struct torture_context *tctx,
220			return test_driver_copy_from_directory(tctx, p, SPOOLSS_ARCHITECTURE_x64);
221			}
222
223			+static bool test_driver_copy_from_directory_32(struct torture_context *tctx,
224			+ struct dcerpc_pipe *p)
225			+{
226			+ return test_driver_copy_from_directory(tctx, p, SPOOLSS_ARCHITECTURE_NT_X86);
227			+}
228			+
229			static bool test_del_driver_all_files(struct torture_context *tctx,
230			struct dcerpc_pipe *p)
231			{
232			@@ -11410,6 +11421,10 @@ struct torture_suite torture_rpc_spoolss_driver(TALLOC_CTX mem_ctx)
233			"test_driver_copy_from_directory_64",
234			test_driver_copy_from_directory_64);
235
236			+ torture_rpc_tcase_add_test(tcase,
237			+ "test_driver_copy_from_directory_32",
238			+ test_driver_copy_from_directory_32);
239			+
240			torture_rpc_tcase_add_test(tcase, "del_driver_all_files", test_del_driver_all_files);
241
242			torture_rpc_tcase_add_test(tcase, "del_driver_unused_files", test_del_driver_unused_files);
243			--
244			2.9.3
245