2 Test the SMB_WHOAMI Unix extension.
4 Copyright (C) 2007 James Peach
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 #include "libcli/libcli.h"
22 #include "libcli/raw/raw_proto.h"
23 #include "torture/torture.h"
24 #include "torture/unix/proto.h"
25 #include "lib/cmdline/popt_common.h"
26 #include "auth/credentials/credentials.h"
27 #include "param/param.h"
28 #include "libcli/resolve/resolve.h"
30 #include "lib/util/util_ldb.h"
32 #include "dsdb/samdb/samdb.h"
33 #include "../libcli/security/security.h"
36 /* Size (in bytes) of the required fields in the SMBwhoami response. */
37 #define WHOAMI_REQUIRED_SIZE 40
40 SMBWhoami - Query the user mapping performed by the server for the
41 connected tree. This is a subcommand of the TRANS2_QFSINFO.
44 4 bytes unsigned - mapping flags (smb_whoami_flags)
45 4 bytes unsigned - flags mask
47 8 bytes unsigned - primary UID
48 8 bytes unsigned - primary GID
49 4 bytes unsigned - number of supplementary GIDs
50 4 bytes unsigned - number of SIDs
51 4 bytes unsigned - SID list byte count
52 4 bytes - pad / reserved (must be zero)
54 8 bytes unsigned[] - list of GIDs (may be empty)
55 struct dom_sid[] - list of SIDs (may be empty)
60 uint32_t mapping_flags
;
61 uint32_t mapping_mask
;
66 uint32_t num_sid_bytes
;
67 uint32_t reserved
; /* Must be zero */
69 struct dom_sid
** sid_list
;
72 static struct smbcli_state
*connect_to_server(struct torture_context
*tctx
,
73 struct cli_credentials
*creds
)
76 struct smbcli_state
*cli
;
78 const char *host
= torture_setting_string(tctx
, "host", NULL
);
79 const char *share
= torture_setting_string(tctx
, "share", NULL
);
80 struct smbcli_options options
;
81 struct smbcli_session_options session_options
;
83 lpcfg_smbcli_options(tctx
->lp_ctx
, &options
);
84 lpcfg_smbcli_session_options(tctx
->lp_ctx
, &session_options
);
86 status
= smbcli_full_connection(tctx
, &cli
, host
,
87 lpcfg_smb_ports(tctx
->lp_ctx
),
88 share
, NULL
, lpcfg_socket_options(tctx
->lp_ctx
),
89 creds
, lpcfg_resolve_context(tctx
->lp_ctx
),
90 tctx
->ev
, &options
, &session_options
,
91 lpcfg_gensec_settings(tctx
, tctx
->lp_ctx
));
93 if (!NT_STATUS_IS_OK(status
)) {
94 printf("failed to connect to //%s/%s: %s\n",
95 host
, share
, nt_errstr(status
));
102 static bool whoami_sid_parse(void *mem_ctx
,
103 struct torture_context
*torture
,
104 DATA_BLOB
*data
, size_t *offset
,
105 struct dom_sid
**psid
)
107 size_t remain
= data
->length
- *offset
;
110 *psid
= talloc_zero(mem_ctx
, struct dom_sid
);
111 torture_assert(torture
, *psid
!= NULL
, "out of memory");
113 torture_assert(torture
, remain
>= 8,
114 "invalid SID format");
116 (*psid
)->sid_rev_num
= CVAL(data
->data
, *offset
);
117 (*psid
)->num_auths
= CVAL(data
->data
, *offset
+ 1);
118 memcpy((*psid
)->id_auth
, data
->data
+ *offset
+ 2, 6);
121 remain
= data
->length
- *offset
;
123 torture_assert(torture
, remain
>= ((*psid
)->num_auths
* 4),
124 "invalid sub_auth byte count");
125 torture_assert(torture
, (*psid
)->num_auths
>= 0,
126 "invalid sub_auth value");
127 torture_assert(torture
, (*psid
)->num_auths
<= 15,
128 "invalid sub_auth value");
130 for (i
= 0; i
< (*psid
)->num_auths
; i
++) {
131 (*psid
)->sub_auths
[i
] = IVAL(data
->data
, *offset
);
138 static bool smb_raw_query_posix_whoami(void *mem_ctx
,
139 struct torture_context
*torture
,
140 struct smbcli_state
*cli
,
141 struct smb_whoami
*whoami
,
144 struct smb_trans2 tp
;
149 uint16_t setup
= TRANSACT2_QFSINFO
;
152 ZERO_STRUCTP(whoami
);
157 tp
.in
.setup_count
= 1;
158 tp
.in
.max_param
= 10;
159 tp
.in
.max_data
= (uint16_t)max_data
;
160 tp
.in
.setup
= &setup
;
161 tp
.in
.trans_name
= NULL
;
162 SSVAL(&info_level
, 0, SMB_QFS_POSIX_WHOAMI
);
163 tp
.in
.params
= data_blob_talloc(mem_ctx
, &info_level
, 2);
164 tp
.in
.data
= data_blob_talloc(mem_ctx
, NULL
, 0);
166 status
= smb_raw_trans2(cli
->tree
, mem_ctx
, &tp
);
167 torture_assert_ntstatus_equal(torture
, status
, NT_STATUS_OK
,
168 "doing SMB_QFS_POSIX_WHOAMI");
170 /* Make sure we got back all the required fields. */
171 torture_assert(torture
, tp
.out
.params
.length
== 0,
172 "trans2 params should be empty");
173 torture_assert(torture
, tp
.out
.data
.length
>= WHOAMI_REQUIRED_SIZE
,
174 "checking for required response fields");
176 whoami
->mapping_flags
= IVAL(tp
.out
.data
.data
, 0);
177 whoami
->mapping_mask
= IVAL(tp
.out
.data
.data
, 4);
178 whoami
->server_uid
= BVAL(tp
.out
.data
.data
, 8);
179 whoami
->server_gid
= BVAL(tp
.out
.data
.data
, 16);
180 whoami
->num_gids
= IVAL(tp
.out
.data
.data
, 24);
181 whoami
->num_sids
= IVAL(tp
.out
.data
.data
, 28);
182 whoami
->num_sid_bytes
= IVAL(tp
.out
.data
.data
, 32);
183 whoami
->reserved
= IVAL(tp
.out
.data
.data
, 36);
185 /* The GID list and SID list are optional, depending on the count
188 if (whoami
->num_sids
!= 0) {
189 torture_assert(torture
, whoami
->num_sid_bytes
!= 0,
190 "SID count does not match byte count");
193 printf("\tmapping_flags=0x%08x mapping_mask=0x%08x\n",
194 whoami
->mapping_flags
, whoami
->mapping_mask
);
195 printf("\tserver UID=%llu GID=%llu\n",
196 (unsigned long long)whoami
->server_uid
, (unsigned long long)whoami
->server_gid
);
197 printf("\t%u GIDs, %u SIDs, %u SID bytes\n",
198 whoami
->num_gids
, whoami
->num_sids
,
199 whoami
->num_sid_bytes
);
201 offset
= WHOAMI_REQUIRED_SIZE
;
203 torture_assert_int_equal(torture
, whoami
->reserved
, 0,
204 "invalid reserved field");
206 if (tp
.out
.data
.length
== offset
) {
207 /* No SIDs or GIDs returned */
208 torture_assert_int_equal(torture
, whoami
->num_gids
, 0,
209 "invalid GID count");
210 torture_assert_int_equal(torture
, whoami
->num_sids
, 0,
211 "invalid SID count");
212 torture_assert_int_equal(torture
, whoami
->num_sid_bytes
, 0,
213 "invalid SID byte count");
217 if (whoami
->num_gids
!= 0) {
218 int remain
= tp
.out
.data
.length
- offset
;
219 int gid_bytes
= whoami
->num_gids
* 8;
221 if (whoami
->num_sids
== 0) {
222 torture_assert_int_equal(torture
, remain
, gid_bytes
,
223 "GID count does not match data length");
225 torture_assert(torture
, remain
> gid_bytes
,
226 "invalid GID count");
229 whoami
->gid_list
= talloc_array(mem_ctx
, uint64_t, whoami
->num_gids
);
230 torture_assert(torture
, whoami
->gid_list
!= NULL
, "out of memory");
232 torture_comment(torture
, "\tGIDs:\n");
234 for (i
= 0; i
< whoami
->num_gids
; ++i
) {
235 whoami
->gid_list
[i
] = BVAL(tp
.out
.data
.data
, offset
);
237 torture_comment(torture
, "\t\t%u\n", (unsigned int)whoami
->gid_list
[i
]);
241 /* Check if there should be data left for the SID list. */
242 if (tp
.out
.data
.length
== offset
) {
243 torture_assert_int_equal(torture
, whoami
->num_sids
, 0,
244 "invalid SID count");
248 /* All the remaining bytes must be the SID list. */
249 torture_assert_int_equal(torture
,
250 whoami
->num_sid_bytes
, (tp
.out
.data
.length
- offset
),
251 "invalid SID byte count");
253 if (whoami
->num_sids
!= 0) {
255 whoami
->sid_list
= talloc_array(mem_ctx
, struct dom_sid
*,
257 torture_assert(torture
, whoami
->sid_list
!= NULL
,
260 torture_comment(torture
, "\tSIDs:\n");
262 for (i
= 0; i
< whoami
->num_sids
; ++i
) {
263 if (!whoami_sid_parse(mem_ctx
, torture
,
264 &tp
.out
.data
, &offset
,
265 &whoami
->sid_list
[i
])) {
269 torture_comment(torture
, "\t\t%s\n",
270 dom_sid_string(torture
, whoami
->sid_list
[i
]));
274 /* We should be at the end of the response now. */
275 torture_assert_int_equal(torture
, tp
.out
.data
.length
, offset
,
276 "trailing garbage bytes");
281 static bool test_against_ldap(struct torture_context
*torture
, struct ldb_context
*ldb
, bool is_dc
,
282 struct smb_whoami
*whoami
)
284 struct ldb_message
*msg
;
285 struct ldb_message_element
*el
;
287 const char *attrs
[] = { "tokenGroups", NULL
};
290 torture_assert_int_equal(torture
, dsdb_search_one(ldb
, torture
, &msg
, NULL
, LDB_SCOPE_BASE
, attrs
, 0, NULL
), LDB_SUCCESS
, "searching for tokenGroups");
291 el
= ldb_msg_find_element(msg
, "tokenGroups");
292 torture_assert(torture
, el
, "obtaining tokenGroups");
293 torture_assert(torture
, el
->num_values
> 0, "Number of SIDs from LDAP needs to be more than 0");
294 torture_assert(torture
, whoami
->num_sids
> 0, "Number of SIDs from LDAP needs to be more than 0");
297 torture_assert_int_equal(torture
, el
->num_values
, whoami
->num_sids
, "Number of SIDs from LDAP and number of SIDs from CIFS does not match!");
299 for (i
= 0; i
< el
->num_values
; i
++) {
300 struct dom_sid
*sid
= talloc(torture
, struct dom_sid
);
301 torture_assert(torture
, sid
!= NULL
, "talloc failed");
303 torture_assert(torture
, sid_blob_parse(el
->values
[i
], sid
), "sid parse failed");
304 torture_assert_str_equal(torture
, dom_sid_string(sid
, sid
), dom_sid_string(sid
, whoami
->sid_list
[i
]), "SID from LDAP and SID from CIFS does not match!");
308 unsigned int num_domain_sids_dc
= 0, num_domain_sids_member
= 0;
309 struct dom_sid
*user_sid
= talloc(torture
, struct dom_sid
);
310 struct dom_sid
*dom_sid
= talloc(torture
, struct dom_sid
);
311 struct dom_sid
*dc_sids
= talloc_array(torture
, struct dom_sid
, el
->num_values
);
312 struct dom_sid
*member_sids
= talloc_array(torture
, struct dom_sid
, whoami
->num_sids
);
313 torture_assert(torture
, user_sid
!= NULL
, "talloc failed");
314 torture_assert(torture
, sid_blob_parse(el
->values
[0], user_sid
), "sid parse failed");
315 torture_assert_ntstatus_equal(torture
, dom_sid_split_rid(torture
, user_sid
, &dom_sid
, NULL
), NT_STATUS_OK
, "failed to split domain SID from user SID");
316 for (i
= 0; i
< el
->num_values
; i
++) {
317 struct dom_sid
*sid
= talloc(dc_sids
, struct dom_sid
);
318 torture_assert(torture
, sid
!= NULL
, "talloc failed");
320 torture_assert(torture
, sid_blob_parse(el
->values
[i
], sid
), "sid parse failed");
321 if (dom_sid_in_domain(dom_sid
, sid
)) {
322 dc_sids
[num_domain_sids_dc
] = *sid
;
323 num_domain_sids_dc
++;
328 for (i
= 0; i
< whoami
->num_sids
; i
++) {
329 if (dom_sid_in_domain(dom_sid
, whoami
->sid_list
[i
])) {
330 member_sids
[num_domain_sids_member
] = *whoami
->sid_list
[i
];
331 num_domain_sids_member
++;
335 torture_assert_int_equal(torture
, num_domain_sids_dc
, num_domain_sids_member
, "Number of Domain SIDs from LDAP DC and number of SIDs from CIFS member does not match!");
336 for (i
= 0; i
< num_domain_sids_dc
; i
++) {
337 torture_assert_str_equal(torture
, dom_sid_string(dc_sids
, &dc_sids
[i
]), dom_sid_string(member_sids
, &member_sids
[i
]), "Domain SID from LDAP DC and SID from CIFS member server does not match!");
339 talloc_free(dc_sids
);
340 talloc_free(member_sids
);
345 bool torture_unix_whoami(struct torture_context
*torture
)
347 struct smbcli_state
*cli
;
348 struct smb_whoami whoami
;
350 struct ldb_context
*ldb
;
351 const char *addc
, *host
;
353 cli
= connect_to_server(torture
, cmdline_credentials
);
354 torture_assert(torture
, cli
, "connecting to server with authenticated credentials");
356 /* Test basic authenticated mapping. */
357 torture_assert_goto(torture
, smb_raw_query_posix_whoami(torture
, torture
,
358 cli
, &whoami
, 0xFFFF), ret
, fail
,
359 "calling SMB_QFS_POSIX_WHOAMI on an authenticated connection");
361 /* Check that our anonymous login mapped us to guest on the server, but
362 * only if the server supports this.
364 if (whoami
.mapping_mask
& SMB_WHOAMI_GUEST
) {
365 bool guest
= whoami
.mapping_flags
& SMB_WHOAMI_GUEST
;
366 torture_comment(torture
, "checking whether we were logged in as guest... %s\n",
367 guest
? "YES" : "NO");
368 torture_assert(torture
, cli_credentials_is_anonymous(cmdline_credentials
) == guest
,
369 "login did not credentials map to guest");
371 torture_comment(torture
, "server does not support SMB_WHOAMI_GUEST flag\n");
374 addc
= torture_setting_string(torture
, "addc", NULL
);
375 host
= torture_setting_string(torture
, "host", NULL
);
378 ldb
= ldb_wrap_connect(torture
, torture
->ev
, torture
->lp_ctx
, talloc_asprintf(torture
, "ldap://%s", addc
),
379 NULL
, cmdline_credentials
, 0);
380 torture_assert(torture
, ldb
, "ldb connect failed");
382 /* We skip this testing if we could not contact the LDAP server */
383 if (!test_against_ldap(torture
, ldb
, strcasecmp(addc
, host
) == 0, &whoami
)) {
388 /* Test that the server drops the UID and GID list. */
389 torture_assert_goto(torture
, smb_raw_query_posix_whoami(torture
, torture
,
390 cli
, &whoami
, 0x40), ret
, fail
,
391 "calling SMB_QFS_POSIX_WHOAMI with a small buffer\n");
393 torture_assert_int_equal(torture
, whoami
.num_gids
, 0,
394 "invalid GID count");
395 torture_assert_int_equal(torture
, whoami
.num_sids
, 0,
396 "invalid SID count");
397 torture_assert_int_equal(torture
, whoami
.num_sid_bytes
, 0,
398 "invalid SID bytes count");
409 /* vim: set sts=8 sw=8 : */