2 Test the SMB_WHOAMI Unix extension.
4 Copyright (C) 2007 James Peach
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 #include "libcli/libcli.h"
22 #include "libcli/raw/raw_proto.h"
23 #include "torture/torture.h"
24 #include "lib/cmdline/popt_common.h"
25 #include "auth/credentials/credentials.h"
26 #include "param/param.h"
27 #include "libcli/resolve/resolve.h"
29 /* Size (in bytes) of the required fields in the SMBwhoami response. */
30 #define WHOAMI_REQUIRED_SIZE 40
33 SMBWhoami - Query the user mapping performed by the server for the
34 connected tree. This is a subcommand of the TRANS2_QFSINFO.
37 4 bytes unsigned - mapping flags (smb_whoami_flags)
38 4 bytes unsigned - flags mask
40 8 bytes unsigned - primary UID
41 8 bytes unsigned - primary GID
42 4 bytes unsigned - number of supplementary GIDs
43 4 bytes unsigned - number of SIDs
44 4 bytes unsigned - SID list byte count
45 4 bytes - pad / reserved (must be zero)
47 8 bytes unsigned[] - list of GIDs (may be empty)
48 struct dom_sid[] - list of SIDs (may be empty)
53 uint32_t mapping_flags
;
54 uint32_t mapping_mask
;
59 uint32_t num_sid_bytes
;
60 uint32_t reserved
; /* Must be zero */
62 struct dom_sid
** sid_list
;
65 static struct smbcli_state
*connect_to_server(struct torture_context
*tctx
,
66 struct cli_credentials
*creds
)
69 struct smbcli_state
*cli
;
71 const char *host
= torture_setting_string(tctx
, "host", NULL
);
72 const char *share
= torture_setting_string(tctx
, "share", NULL
);
73 struct smbcli_options options
;
74 struct smbcli_session_options session_options
;
76 lpcfg_smbcli_options(tctx
->lp_ctx
, &options
);
77 lpcfg_smbcli_session_options(tctx
->lp_ctx
, &session_options
);
79 status
= smbcli_full_connection(tctx
, &cli
, host
,
80 lpcfg_smb_ports(tctx
->lp_ctx
),
81 share
, NULL
, lpcfg_socket_options(tctx
->lp_ctx
),
82 creds
, lpcfg_resolve_context(tctx
->lp_ctx
),
83 tctx
->ev
, &options
, &session_options
,
84 lpcfg_gensec_settings(tctx
, tctx
->lp_ctx
));
86 if (!NT_STATUS_IS_OK(status
)) {
87 printf("failed to connect to //%s/%s: %s\n",
88 host
, share
, nt_errstr(status
));
95 static bool sid_parse(void *mem_ctx
,
96 struct torture_context
*torture
,
97 DATA_BLOB
*data
, size_t *offset
,
98 struct dom_sid
**psid
)
100 size_t remain
= data
->length
- *offset
;
103 *psid
= talloc_zero(mem_ctx
, struct dom_sid
);
104 torture_assert(torture
, *psid
!= NULL
, "out of memory");
106 torture_assert(torture
, remain
>= 8,
107 "invalid SID format");
109 (*psid
)->sid_rev_num
= CVAL(data
->data
, *offset
);
110 (*psid
)->num_auths
= CVAL(data
->data
, *offset
+ 1);
111 memcpy((*psid
)->id_auth
, data
->data
+ *offset
+ 2, 6);
114 remain
= data
->length
- *offset
;
116 torture_assert(torture
, remain
>= ((*psid
)->num_auths
* 4),
117 "invalid sub_auth byte count");
118 torture_assert(torture
, (*psid
)->num_auths
>= 0,
119 "invalid sub_auth value");
120 torture_assert(torture
, (*psid
)->num_auths
<= 15,
121 "invalid sub_auth value");
123 for (i
= 0; i
< (*psid
)->num_auths
; i
++) {
124 (*psid
)->sub_auths
[i
] = IVAL(data
->data
, *offset
);
131 static bool smb_raw_query_posix_whoami(void *mem_ctx
,
132 struct torture_context
*torture
,
133 struct smbcli_state
*cli
,
134 struct smb_whoami
*whoami
,
137 struct smb_trans2 tp
;
142 uint16_t setup
= TRANSACT2_QFSINFO
;
145 ZERO_STRUCTP(whoami
);
150 tp
.in
.setup_count
= 1;
151 tp
.in
.max_param
= 10;
152 tp
.in
.max_data
= (uint16_t)max_data
;
153 tp
.in
.setup
= &setup
;
154 tp
.in
.trans_name
= NULL
;
155 SSVAL(&info_level
, 0, SMB_QFS_POSIX_WHOAMI
);
156 tp
.in
.params
= data_blob_talloc(mem_ctx
, &info_level
, 2);
157 tp
.in
.data
= data_blob_talloc(mem_ctx
, NULL
, 0);
159 status
= smb_raw_trans2(cli
->tree
, mem_ctx
, &tp
);
160 torture_assert_ntstatus_equal(torture
, status
, NT_STATUS_OK
,
161 "doing SMB_QFS_POSIX_WHOAMI");
163 /* Make sure we got back all the required fields. */
164 torture_assert(torture
, tp
.out
.params
.length
== 0,
165 "trans2 params should be empty");
166 torture_assert(torture
, tp
.out
.data
.length
>= WHOAMI_REQUIRED_SIZE
,
167 "checking for required response fields");
169 whoami
->mapping_flags
= IVAL(tp
.out
.data
.data
, 0);
170 whoami
->mapping_mask
= IVAL(tp
.out
.data
.data
, 4);
171 whoami
->server_uid
= BVAL(tp
.out
.data
.data
, 8);
172 whoami
->server_gid
= BVAL(tp
.out
.data
.data
, 16);
173 whoami
->num_gids
= IVAL(tp
.out
.data
.data
, 24);
174 whoami
->num_sids
= IVAL(tp
.out
.data
.data
, 28);
175 whoami
->num_sid_bytes
= IVAL(tp
.out
.data
.data
, 32);
176 whoami
->reserved
= IVAL(tp
.out
.data
.data
, 36);
178 /* The GID list and SID list are optional, depending on the count
181 if (whoami
->num_sids
!= 0) {
182 torture_assert(torture
, whoami
->num_sid_bytes
!= 0,
183 "SID count does not match byte count");
186 printf("\tmapping_flags=0x%08x mapping_mask=0x%08x\n",
187 whoami
->mapping_flags
, whoami
->mapping_mask
);
188 printf("\tserver UID=%llu GID=%llu\n",
189 (unsigned long long)whoami
->server_uid
, (unsigned long long)whoami
->server_gid
);
190 printf("\t%u GIDs, %u SIDs, %u SID bytes\n",
191 whoami
->num_gids
, whoami
->num_sids
,
192 whoami
->num_sid_bytes
);
194 offset
= WHOAMI_REQUIRED_SIZE
;
196 torture_assert_int_equal(torture
, whoami
->reserved
, 0,
197 "invalid reserved field");
199 if (tp
.out
.data
.length
== offset
) {
200 /* No SIDs or GIDs returned */
201 torture_assert_int_equal(torture
, whoami
->num_gids
, 0,
202 "invalid GID count");
203 torture_assert_int_equal(torture
, whoami
->num_sids
, 0,
204 "invalid SID count");
205 torture_assert_int_equal(torture
, whoami
->num_sid_bytes
, 0,
206 "invalid SID byte count");
210 if (whoami
->num_gids
!= 0) {
211 int remain
= tp
.out
.data
.length
- offset
;
212 int gid_bytes
= whoami
->num_gids
* 8;
214 if (whoami
->num_sids
== 0) {
215 torture_assert_int_equal(torture
, remain
, gid_bytes
,
216 "GID count does not match data length");
218 torture_assert(torture
, remain
> gid_bytes
,
219 "invalid GID count");
222 whoami
->gid_list
= talloc_array(mem_ctx
, uint64_t, whoami
->num_gids
);
223 torture_assert(torture
, whoami
->gid_list
!= NULL
, "out of memory");
225 for (i
= 0; i
< whoami
->num_gids
; ++i
) {
226 whoami
->gid_list
[i
] = BVAL(tp
.out
.data
.data
, offset
);
231 /* Check if there should be data left for the SID list. */
232 if (tp
.out
.data
.length
== offset
) {
233 torture_assert_int_equal(torture
, whoami
->num_sids
, 0,
234 "invalid SID count");
238 /* All the remaining bytes must be the SID list. */
239 torture_assert_int_equal(torture
,
240 whoami
->num_sid_bytes
, (tp
.out
.data
.length
- offset
),
241 "invalid SID byte count");
243 if (whoami
->num_sids
!= 0) {
245 whoami
->sid_list
= talloc_array(mem_ctx
, struct dom_sid
*,
247 torture_assert(torture
, whoami
->sid_list
!= NULL
,
250 for (i
= 0; i
< whoami
->num_sids
; ++i
) {
251 if (!sid_parse(mem_ctx
, torture
,
252 &tp
.out
.data
, &offset
,
253 &whoami
->sid_list
[i
])) {
260 /* We should be at the end of the response now. */
261 torture_assert_int_equal(torture
, tp
.out
.data
.length
, offset
,
262 "trailing garbage bytes");
267 bool torture_unix_whoami(struct torture_context
*torture
)
269 struct smbcli_state
*cli
;
270 struct cli_credentials
*anon_credentials
;
271 struct smb_whoami whoami
;
273 if (!(cli
= connect_to_server(torture
, cmdline_credentials
))) {
277 /* Test basic authenticated mapping. */
278 printf("calling SMB_QFS_POSIX_WHOAMI on an authenticated connection\n");
279 if (!smb_raw_query_posix_whoami(torture
, torture
,
280 cli
, &whoami
, 0xFFFF)) {
285 /* Test that the server drops the UID and GID list. */
286 printf("calling SMB_QFS_POSIX_WHOAMI with a small buffer\n");
287 if (!smb_raw_query_posix_whoami(torture
, torture
,
288 cli
, &whoami
, 0x40)) {
293 torture_assert_int_equal(torture
, whoami
.num_gids
, 0,
294 "invalid GID count");
295 torture_assert_int_equal(torture
, whoami
.num_sids
, 0,
296 "invalid SID count");
297 torture_assert_int_equal(torture
, whoami
.num_sid_bytes
, 0,
298 "invalid SID bytes count");
302 printf("calling SMB_QFS_POSIX_WHOAMI on an anonymous connection\n");
303 anon_credentials
= cli_credentials_init_anon(torture
);
305 if (!(cli
= connect_to_server(torture
, anon_credentials
))) {
309 if (!smb_raw_query_posix_whoami(torture
, torture
,
310 cli
, &whoami
, 0xFFFF)) {
317 /* Check that our anonymous login mapped us to guest on the server, but
318 * only if the server supports this.
320 if (whoami
.mapping_mask
& SMB_WHOAMI_GUEST
) {
321 printf("checking whether we were logged in as guest... %s\n",
322 whoami
.mapping_flags
& SMB_WHOAMI_GUEST
? "YES" : "NO");
323 torture_assert(torture
, whoami
.mapping_flags
& SMB_WHOAMI_GUEST
,
324 "anonymous login did not map to guest");
326 printf("server does not support SMB_WHOAMI_GUEST flag\n");
332 /* vim: set sts=8 sw=8 : */