2 Test the SMB_WHOAMI Unix extension.
4 Copyright (C) 2007 James Peach
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 #include "libcli/libcli.h"
22 #include "libcli/raw/interfaces.h"
23 #include "libcli/raw/raw_proto.h"
24 #include "torture/torture.h"
25 #include "torture/basic/proto.h"
26 #include "lib/cmdline/popt_common.h"
27 #include "auth/credentials/credentials.h"
28 #include "param/param.h"
29 #include "libcli/resolve/resolve.h"
31 /* Size (in bytes) of the required fields in the SMBwhoami response. */
32 #define WHOAMI_REQUIRED_SIZE 40
34 enum smb_whoami_flags
{
35 SMB_WHOAMI_GUEST
= 0x1 /* Logged in as (or squashed to) guest */
39 SMBWhoami - Query the user mapping performed by the server for the
40 connected tree. This is a subcommand of the TRANS2_QFSINFO.
43 4 bytes unsigned - mapping flags (smb_whoami_flags)
44 4 bytes unsigned - flags mask
46 8 bytes unsigned - primary UID
47 8 bytes unsigned - primary GID
48 4 bytes unsigned - number of supplementary GIDs
49 4 bytes unsigned - number of SIDs
50 4 bytes unsigned - SID list byte count
51 4 bytes - pad / reserved (must be zero)
53 8 bytes unsigned[] - list of GIDs (may be empty)
54 DOM_SID[] - list of SIDs (may be empty)
59 uint32_t mapping_flags
;
60 uint32_t mapping_mask
;
65 uint32_t num_sid_bytes
;
66 uint32_t reserved
; /* Must be zero */
68 struct dom_sid
** sid_list
;
71 static struct smbcli_state
*connect_to_server(struct torture_context
*tctx
,
72 struct cli_credentials
*creds
)
75 struct smbcli_state
*cli
;
77 const char *host
= torture_setting_string(tctx
, "host", NULL
);
78 const char *share
= torture_setting_string(tctx
, "share", NULL
);
79 struct smbcli_options options
;
80 struct smbcli_session_options session_options
;
82 lp_smbcli_options(tctx
->lp_ctx
, &options
);
83 lp_smbcli_session_options(tctx
->lp_ctx
, &session_options
);
85 status
= smbcli_full_connection(tctx
, &cli
, host
,
86 lp_smb_ports(tctx
->lp_ctx
),
87 share
, NULL
, lp_socket_options(tctx
->lp_ctx
),
88 creds
, lp_resolve_context(tctx
->lp_ctx
),
89 tctx
->ev
, &options
, &session_options
,
90 lp_iconv_convenience(tctx
->lp_ctx
),
91 lp_gensec_settings(tctx
, tctx
->lp_ctx
));
93 if (!NT_STATUS_IS_OK(status
)) {
94 printf("failed to connect to //%s/%s: %s\n",
95 host
, share
, nt_errstr(status
));
102 static bool sid_parse(void *mem_ctx
,
103 struct torture_context
*torture
,
104 DATA_BLOB
*data
, size_t *offset
,
105 struct dom_sid
**psid
)
107 size_t remain
= data
->length
- *offset
;
110 *psid
= talloc_zero(mem_ctx
, struct dom_sid
);
111 torture_assert(torture
, *psid
!= NULL
, "out of memory");
113 torture_assert(torture
, remain
>= 8,
114 "invalid SID format");
116 (*psid
)->sid_rev_num
= CVAL(data
->data
, *offset
);
117 (*psid
)->num_auths
= CVAL(data
->data
, *offset
+ 1);
118 memcpy((*psid
)->id_auth
, data
->data
+ *offset
+ 2, 6);
121 remain
= data
->length
- *offset
;
123 torture_assert(torture
, remain
>= ((*psid
)->num_auths
* 4),
124 "invalid sub_auth byte count");
125 torture_assert(torture
, (*psid
)->num_auths
>= 0,
126 "invalid sub_auth value");
127 torture_assert(torture
, (*psid
)->num_auths
<= 15,
128 "invalid sub_auth value");
130 for (i
= 0; i
< (*psid
)->num_auths
; i
++) {
131 (*psid
)->sub_auths
[i
] = IVAL(data
->data
, *offset
);
138 static bool smb_raw_query_posix_whoami(void *mem_ctx
,
139 struct torture_context
*torture
,
140 struct smbcli_state
*cli
,
141 struct smb_whoami
*whoami
,
144 struct smb_trans2 tp
;
149 uint16_t setup
= TRANSACT2_QFSINFO
;
152 ZERO_STRUCTP(whoami
);
157 tp
.in
.setup_count
= 1;
158 tp
.in
.max_param
= 10;
159 tp
.in
.max_data
= (uint16_t)max_data
;
160 tp
.in
.setup
= &setup
;
161 tp
.in
.trans_name
= NULL
;
162 SSVAL(&info_level
, 0, SMB_QFS_POSIX_WHOAMI
);
163 tp
.in
.params
= data_blob_talloc(mem_ctx
, &info_level
, 2);
164 tp
.in
.data
= data_blob_talloc(mem_ctx
, NULL
, 0);
166 status
= smb_raw_trans2(cli
->tree
, mem_ctx
, &tp
);
167 torture_assert_ntstatus_equal(torture
, status
, NT_STATUS_OK
,
168 "doing SMB_QFS_POSIX_WHOAMI");
170 /* Make sure we got back all the required fields. */
171 torture_assert(torture
, tp
.out
.params
.length
== 0,
172 "trans2 params should be empty");
173 torture_assert(torture
, tp
.out
.data
.length
>= WHOAMI_REQUIRED_SIZE
,
174 "checking for required response fields");
176 whoami
->mapping_flags
= IVAL(tp
.out
.data
.data
, 0);
177 whoami
->mapping_mask
= IVAL(tp
.out
.data
.data
, 4);
178 whoami
->server_uid
= BVAL(tp
.out
.data
.data
, 8);
179 whoami
->server_gid
= BVAL(tp
.out
.data
.data
, 16);
180 whoami
->num_gids
= IVAL(tp
.out
.data
.data
, 24);
181 whoami
->num_sids
= IVAL(tp
.out
.data
.data
, 28);
182 whoami
->num_sid_bytes
= IVAL(tp
.out
.data
.data
, 32);
183 whoami
->reserved
= IVAL(tp
.out
.data
.data
, 36);
185 /* The GID list and SID list are optional, depending on the count
188 if (whoami
->num_sids
!= 0) {
189 torture_assert(torture
, whoami
->num_sid_bytes
!= 0,
190 "SID count does not match byte count");
193 printf("\tmapping_flags=0x%08x mapping_mask=0x%08x\n",
194 whoami
->mapping_flags
, whoami
->mapping_mask
);
195 printf("\tserver UID=%llu GID=%llu\n",
196 (unsigned long long)whoami
->server_uid
, (unsigned long long)whoami
->server_gid
);
197 printf("\t%u GIDs, %u SIDs, %u SID bytes\n",
198 whoami
->num_gids
, whoami
->num_sids
,
199 whoami
->num_sid_bytes
);
201 offset
= WHOAMI_REQUIRED_SIZE
;
203 torture_assert_int_equal(torture
, whoami
->reserved
, 0,
204 "invalid reserved field");
206 if (tp
.out
.data
.length
== offset
) {
207 /* No SIDs or GIDs returned */
208 torture_assert_int_equal(torture
, whoami
->num_gids
, 0,
209 "invalid GID count");
210 torture_assert_int_equal(torture
, whoami
->num_sids
, 0,
211 "invalid SID count");
212 torture_assert_int_equal(torture
, whoami
->num_sid_bytes
, 0,
213 "invalid SID byte count");
217 if (whoami
->num_gids
!= 0) {
218 int remain
= tp
.out
.data
.length
- offset
;
219 int gid_bytes
= whoami
->num_gids
* 8;
221 if (whoami
->num_sids
== 0) {
222 torture_assert_int_equal(torture
, remain
, gid_bytes
,
223 "GID count does not match data length");
225 torture_assert(torture
, remain
> gid_bytes
,
226 "invalid GID count");
229 whoami
->gid_list
= talloc_array(mem_ctx
, uint64_t, whoami
->num_gids
);
230 torture_assert(torture
, whoami
->gid_list
!= NULL
, "out of memory");
232 for (i
= 0; i
< whoami
->num_gids
; ++i
) {
233 whoami
->gid_list
[i
] = BVAL(tp
.out
.data
.data
, offset
);
238 /* Check if there should be data left for the SID list. */
239 if (tp
.out
.data
.length
== offset
) {
240 torture_assert_int_equal(torture
, whoami
->num_sids
, 0,
241 "invalid SID count");
245 /* All the remaining bytes must be the SID list. */
246 torture_assert_int_equal(torture
,
247 whoami
->num_sid_bytes
, (tp
.out
.data
.length
- offset
),
248 "invalid SID byte count");
250 if (whoami
->num_sids
!= 0) {
252 whoami
->sid_list
= talloc_array(mem_ctx
, struct dom_sid
*,
254 torture_assert(torture
, whoami
->sid_list
!= NULL
,
257 for (i
= 0; i
< whoami
->num_sids
; ++i
) {
258 if (!sid_parse(mem_ctx
, torture
,
259 &tp
.out
.data
, &offset
,
260 &whoami
->sid_list
[i
])) {
267 /* We should be at the end of the response now. */
268 torture_assert_int_equal(torture
, tp
.out
.data
.length
, offset
,
269 "trailing garbage bytes");
274 bool torture_unix_whoami(struct torture_context
*torture
)
276 struct smbcli_state
*cli
;
277 struct cli_credentials
*anon_credentials
;
278 struct smb_whoami whoami
;
280 if (!(cli
= connect_to_server(torture
, cmdline_credentials
))) {
284 /* Test basic authenticated mapping. */
285 printf("calling SMB_QFS_POSIX_WHOAMI on an authenticated connection\n");
286 if (!smb_raw_query_posix_whoami(torture
, torture
,
287 cli
, &whoami
, 0xFFFF)) {
292 /* Test that the server drops the UID and GID list. */
293 printf("calling SMB_QFS_POSIX_WHOAMI with a small buffer\n");
294 if (!smb_raw_query_posix_whoami(torture
, torture
,
295 cli
, &whoami
, 0x40)) {
300 torture_assert_int_equal(torture
, whoami
.num_gids
, 0,
301 "invalid GID count");
302 torture_assert_int_equal(torture
, whoami
.num_sids
, 0,
303 "invalid SID count");
304 torture_assert_int_equal(torture
, whoami
.num_sid_bytes
, 0,
305 "invalid SID bytes count");
309 printf("calling SMB_QFS_POSIX_WHOAMI on an anonymous connection\n");
310 anon_credentials
= cli_credentials_init_anon(torture
);
312 if (!(cli
= connect_to_server(torture
, anon_credentials
))) {
316 if (!smb_raw_query_posix_whoami(torture
, torture
,
317 cli
, &whoami
, 0xFFFF)) {
324 /* Check that our anonymous login mapped us to guest on the server, but
325 * only if the server supports this.
327 if (whoami
.mapping_mask
& SMB_WHOAMI_GUEST
) {
328 printf("checking whether we were logged in as guest... %s\n",
329 whoami
.mapping_flags
& SMB_WHOAMI_GUEST
? "YES" : "NO");
330 torture_assert(torture
, whoami
.mapping_flags
& SMB_WHOAMI_GUEST
,
331 "anonymous login did not map to guest");
333 printf("server does not support SMB_WHOAMI_GUEST flag\n");
339 /* vim: set sts=8 sw=8 : */