From 5f4419008430d3cc1a0f62dff5e6941f3b122c2c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B6rn=20Jacke?= <bjacke@samba.org>
Date: Sat, 30 Dec 2023 19:46:53 +0100
Subject: [PATCH 15/38] tests: add test for vfs_worm

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15997
[backported for CVE-2026-2340]

Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
(cherry picked from commit 85f7d9d5b943c237966e6b466beca0cbe8076b04)
---
 selftest/target/Samba3.pm         |  10 +++
 source3/script/tests/test_worm.sh | 121 ++++++++++++++++++++++++++++++
 source3/selftest/tests.py         |   2 +
 3 files changed, 133 insertions(+)
 create mode 100755 source3/script/tests/test_worm.sh

--- a/selftest/target/Samba3.pm
+++ b/selftest/target/Samba3.pm
@@ -2672,6 +2672,9 @@ sub provision($$)
 	my $local_symlinks_shrdir="$shrdir/local_symlinks";
 	push(@dirs,$local_symlinks_shrdir);
 
+	my $worm_shrdir="$shrdir/worm";
+	push(@dirs,$worm_shrdir);
+
 	my $fruit_resource_stream_shrdir="$shrdir/fruit_resource_stream";
 	push(@dirs,$fruit_resource_stream_shrdir);
 
@@ -3493,6 +3496,13 @@ sub provision($$)
 	path = $local_symlinks_shrdir
 	follow symlinks = yes
 
+[worm]
+	copy = tmp
+	path = $worm_shrdir
+	vfs objects = worm
+	worm:grace_period = 1
+	comment = vfs_worm with 1s grace_period
+
 [kernel_oplocks]
 	copy = tmp
 	kernel oplocks = yes
--- /dev/null
+++ b/source3/script/tests/test_worm.sh
@@ -0,0 +1,121 @@
+#!/bin/sh
+
+if [ $# -lt 7 ]; then
+	cat <<EOF
+Usage: test_worm.sh SERVER SERVER_IP USERNAME PASSWORD LOCAL_PATH PREFIX SMBCLIENT ADDARGS
+EOF
+	exit 1
+fi
+
+SERVER="${1}"
+SERVER_IP="${2}"
+USERNAME="${3}"
+PASSWORD="${4}"
+LOCAL_PATH="${5}"
+PREFIX="${6}"
+SMBCLIENT="${7}"
+SMBCLIENT="$VALGRIND ${SMBCLIENT}"
+shift 7
+ADDARGS="$*"
+
+incdir=$(dirname "$0")/../../../testprogs/blackbox
+. "$incdir"/subunit.sh
+
+failed=0
+
+# Do not let deprecated option warnings muck this up
+SAMBA_DEPRECATED_SUPPRESS=1
+export SAMBA_DEPRECATED_SUPPRESS
+
+# Define the test environment/filenames.
+#
+share_test_dir="$LOCAL_PATH"
+
+#
+# Cleanup function.
+#
+do_cleanup()
+{
+	(
+		#subshell.
+		cd "$share_test_dir" || return
+		rm -f must-be-deleted must-not-be-deleted must-be-deleted-after-ctime-refresh
+	)
+	rm -f $tmpfile
+}
+
+#
+# Ensure we start from a clean slate.
+#
+do_cleanup
+
+tmpfile=$PREFIX/smbclient_interactive_prompt_commands
+
+test_worm()
+{
+	# use echo because helo scripts don't support variables
+	echo "
+put $tmpfile must-be-deleted
+put $tmpfile must-be-deleted-after-ctime-refresh
+put $tmpfile must-not-be-deleted
+del must-be-deleted
+quit" > $tmpfile
+	# make sure the directory is not too old for worm:
+	touch $share_test_dir
+	cmd='CLI_FORCE_INTERACTIVE=yes $SMBCLIENT -U$USERNAME%$PASSWORD //$SERVER/worm -I$SERVER_IP $ADDARGS < $tmpfile 2>&1'
+	eval echo "$cmd"
+	out=$(eval "$cmd")
+	ret=$?
+	rm -f "$tmpfile"
+
+	if [ $ret != 0 ]; then
+		printf "%s\n" "$out"
+		printf "failed worm smbclient run with error %s\n" "$ret"
+		return 1
+	fi
+	test -e $share_test_dir/must-be-deleted && {
+		printf "$0: ERROR: must-be-deleted was NOT deleted\n"
+		return 1
+	}
+
+	# now sleep grace_period (1s) and check if worm works properly:
+	sleep 1
+	echo "
+posix
+chmod 700 must-not-be-deleted
+del must-not-be-deleted
+del must-be-deleted-after-ctime-refresh
+quit" > $tmpfile
+	# make sure the directory itself is not too old for worm:
+	touch $share_test_dir
+	# set a fresh ctime by doing a chmod:
+	chmod 644 $share_test_dir/must-be-deleted-after-ctime-refresh
+	cmd='CLI_FORCE_INTERACTIVE=yes $SMBCLIENT -U$USERNAME%$PASSWORD //$SERVER/worm -I$SERVER_IP $ADDARGS < $tmpfile 2>&1'
+	eval echo "$cmd"
+	out=$(eval "$cmd")
+	test -e $share_test_dir/must-not-be-deleted || {
+		printf "$0: ERROR: must-not-be-deleted WAS deleted\n"
+		return 1
+	}
+	# if we're not root, return here:
+	test "$UID" = "0" ||  {
+		return 0
+	}
+
+	test -e $share_test_dir/must-be-deleted-after-ctime-refresh && {
+		printf "$0: ERROR: must-be-deleted-after-ctime-refresh was NOT deleted\n"
+		return 1
+	}
+	return 0
+}
+
+
+testit "worm" \
+	test_worm ||
+	failed=$((failed + 1))
+
+#
+# Cleanup.
+do_cleanup
+
+testok "$0" "$failed"
--- a/source3/selftest/tests.py
+++ b/source3/selftest/tests.py
@@ -769,6 +769,8 @@ for env in ["fileserver"]:
     plantestsuite("samba3.blackbox.netshareenum", env, [os.path.join(samba3srcdir, "script/tests/test_shareenum.sh"), '$SERVER', '$USERNAME', '$PASSWORD', rpcclient])
     plantestsuite("samba3.blackbox.acl_xattr.NT1", env + "_smb1_done", [os.path.join(samba3srcdir, "script/tests/test_acl_xattr.sh"), '$SERVER', '$USERNAME', '$PASSWORD', '$PREFIX', smbclient3, smbcacls, '-mNT1'])
     plantestsuite("samba3.blackbox.acl_xattr.SMB3", env, [os.path.join(samba3srcdir, "script/tests/test_acl_xattr.sh"), '$SERVER', '$USERNAME', '$PASSWORD', '$PREFIX', smbclient3, smbcacls, '-mSMB3'])
+    plantestsuite("samba3.blackbox.worm.NT1", env + "_smb1_done", [os.path.join(samba3srcdir, "script/tests/test_worm.sh"), '$SERVER', '$SERVER_IP', '$USERNAME', '$PASSWORD', '$LOCAL_PATH/worm', '$PREFIX', smbclient3, '-mNT1'])
+    plantestsuite("samba3.blackbox.worm.SMB3", env, [os.path.join(samba3srcdir, "script/tests/test_worm.sh"), '$SERVER', '$SERVER_IP', '$USERNAME', '$PASSWORD', '$LOCAL_PATH/worm', '$PREFIX', smbclient3, '-mSMB3'])
     plantestsuite("samba3.blackbox.smb2.not_casesensitive", env, [os.path.join(samba3srcdir, "script/tests/test_smb2_not_casesensitive.sh"), '//$SERVER/tmp', '$SERVER_IP', '$USERNAME', '$PASSWORD', '$LOCAL_PATH', smbclient3])
     plantestsuite("samba3.blackbox.inherit_owner.default.NT1", env + "_smb1_done", [os.path.join(samba3srcdir, "script/tests/test_inherit_owner.sh"), '$SERVER', '$USERNAME', '$PASSWORD', '$PREFIX', smbclient3, smbcacls, net, 'tmp', '0', '0', '-m', 'NT1'])
     plantestsuite("samba3.blackbox.inherit_owner.default.SMB3", env, [os.path.join(samba3srcdir, "script/tests/test_inherit_owner.sh"), '$SERVER', '$USERNAME', '$PASSWORD', '$PREFIX', smbclient3, smbcacls, net, 'tmp', '0', '0', '-m', 'SMB3'])
