1/* 2 Test the SMB_WHOAMI Unix extension. 3 4 Copyright (C) 2007 James Peach 5 6 This program is free software; you can redistribute it and/or modify 7 it under the terms of the GNU General Public License as published by 8 the Free Software Foundation; either version 3 of the License, or 9 (at your option) any later version. 10 11 This program is distributed in the hope that it will be useful, 12 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 GNU General Public License for more details. 15 16 You should have received a copy of the GNU General Public License 17 along with this program. If not, see <http://www.gnu.org/licenses/>. 18*/ 19 20#include "includes.h" 21#include "libcli/libcli.h" 22#include "libcli/raw/interfaces.h" 23#include "libcli/raw/raw_proto.h" 24#include "torture/torture.h" 25#include "torture/basic/proto.h" 26#include "lib/cmdline/popt_common.h" 27#include "auth/credentials/credentials.h" 28#include "param/param.h" 29#include "libcli/resolve/resolve.h" 30 31/* Size (in bytes) of the required fields in the SMBwhoami response. */ 32#define WHOAMI_REQUIRED_SIZE 40 33 34enum smb_whoami_flags { 35 SMB_WHOAMI_GUEST = 0x1 /* Logged in as (or squashed to) guest */ 36}; 37 38/* 39 SMBWhoami - Query the user mapping performed by the server for the 40 connected tree. This is a subcommand of the TRANS2_QFSINFO. 41 42 Returns: 43 4 bytes unsigned - mapping flags (smb_whoami_flags) 44 4 bytes unsigned - flags mask 45 46 8 bytes unsigned - primary UID 47 8 bytes unsigned - primary GID 48 4 bytes unsigned - number of supplementary GIDs 49 4 bytes unsigned - number of SIDs 50 4 bytes unsigned - SID list byte count 51 4 bytes - pad / reserved (must be zero) 52 53 8 bytes unsigned[] - list of GIDs (may be empty) 54 DOM_SID[] - list of SIDs (may be empty) 55*/ 56 57struct smb_whoami 58{ 59 uint32_t mapping_flags; 60 uint32_t mapping_mask; 61 uint64_t server_uid; 62 uint64_t server_gid; 63 uint32_t num_gids; 64 uint32_t num_sids; 65 uint32_t num_sid_bytes; 66 uint32_t reserved; /* Must be zero */ 67 uint64_t * gid_list; 68 struct dom_sid ** sid_list; 69}; 70 71static struct smbcli_state *connect_to_server(struct torture_context *tctx, 72 struct cli_credentials *creds) 73{ 74 NTSTATUS status; 75 struct smbcli_state *cli; 76 77 const char *host = torture_setting_string(tctx, "host", NULL); 78 const char *share = torture_setting_string(tctx, "share", NULL); 79 struct smbcli_options options; 80 struct smbcli_session_options session_options; 81 82 lp_smbcli_options(tctx->lp_ctx, &options); 83 lp_smbcli_session_options(tctx->lp_ctx, &session_options); 84 85 status = smbcli_full_connection(tctx, &cli, host, 86 lp_smb_ports(tctx->lp_ctx), 87 share, NULL, lp_socket_options(tctx->lp_ctx), 88 creds, lp_resolve_context(tctx->lp_ctx), 89 tctx->ev, &options, &session_options, 90 lp_iconv_convenience(tctx->lp_ctx), 91 lp_gensec_settings(tctx, tctx->lp_ctx)); 92 93 if (!NT_STATUS_IS_OK(status)) { 94 printf("failed to connect to //%s/%s: %s\n", 95 host, share, nt_errstr(status)); 96 return NULL; 97 } 98 99 return cli; 100} 101 102static bool sid_parse(void *mem_ctx, 103 struct torture_context *torture, 104 DATA_BLOB *data, size_t *offset, 105 struct dom_sid **psid) 106{ 107 size_t remain = data->length - *offset; 108 int i; 109 110 *psid = talloc_zero(mem_ctx, struct dom_sid); 111 torture_assert(torture, *psid != NULL, "out of memory"); 112 113 torture_assert(torture, remain >= 8, 114 "invalid SID format"); 115 116 (*psid)->sid_rev_num = CVAL(data->data, *offset); 117 (*psid)->num_auths = CVAL(data->data, *offset + 1); 118 memcpy((*psid)->id_auth, data->data + *offset + 2, 6); 119 120 (*offset) += 8; 121 remain = data->length - *offset; 122 123 torture_assert(torture, remain >= ((*psid)->num_auths * 4), 124 "invalid sub_auth byte count"); 125 torture_assert(torture, (*psid)->num_auths >= 0, 126 "invalid sub_auth value"); 127 torture_assert(torture, (*psid)->num_auths <= 15, 128 "invalid sub_auth value"); 129 130 for (i = 0; i < (*psid)->num_auths; i++) { 131 (*psid)->sub_auths[i] = IVAL(data->data, *offset); 132 (*offset) += 4; 133 } 134 135 return true; 136} 137 138static bool smb_raw_query_posix_whoami(void *mem_ctx, 139 struct torture_context *torture, 140 struct smbcli_state *cli, 141 struct smb_whoami *whoami, 142 unsigned max_data) 143{ 144 struct smb_trans2 tp; 145 NTSTATUS status; 146 size_t offset; 147 int i; 148 149 uint16_t setup = TRANSACT2_QFSINFO; 150 uint16_t info_level; 151 152 ZERO_STRUCTP(whoami); 153 154 tp.in.max_setup = 0; 155 tp.in.flags = 0; 156 tp.in.timeout = 0; 157 tp.in.setup_count = 1; 158 tp.in.max_param = 10; 159 tp.in.max_data = (uint16_t)max_data; 160 tp.in.setup = &setup; 161 tp.in.trans_name = NULL; 162 SSVAL(&info_level, 0, SMB_QFS_POSIX_WHOAMI); 163 tp.in.params = data_blob_talloc(mem_ctx, &info_level, 2); 164 tp.in.data = data_blob_talloc(mem_ctx, NULL, 0); 165 166 status = smb_raw_trans2(cli->tree, mem_ctx, &tp); 167 torture_assert_ntstatus_equal(torture, status, NT_STATUS_OK, 168 "doing SMB_QFS_POSIX_WHOAMI"); 169 170 /* Make sure we got back all the required fields. */ 171 torture_assert(torture, tp.out.params.length == 0, 172 "trans2 params should be empty"); 173 torture_assert(torture, tp.out.data.length >= WHOAMI_REQUIRED_SIZE, 174 "checking for required response fields"); 175 176 whoami->mapping_flags = IVAL(tp.out.data.data, 0); 177 whoami->mapping_mask = IVAL(tp.out.data.data, 4); 178 whoami->server_uid = BVAL(tp.out.data.data, 8); 179 whoami->server_gid = BVAL(tp.out.data.data, 16); 180 whoami->num_gids = IVAL(tp.out.data.data, 24); 181 whoami->num_sids = IVAL(tp.out.data.data, 28); 182 whoami->num_sid_bytes = IVAL(tp.out.data.data, 32); 183 whoami->reserved = IVAL(tp.out.data.data, 36); 184 185 /* The GID list and SID list are optional, depending on the count 186 * and length fields. 187 */ 188 if (whoami->num_sids != 0) { 189 torture_assert(torture, whoami->num_sid_bytes != 0, 190 "SID count does not match byte count"); 191 } 192 193 printf("\tmapping_flags=0x%08x mapping_mask=0x%08x\n", 194 whoami->mapping_flags, whoami->mapping_mask); 195 printf("\tserver UID=%llu GID=%llu\n", 196 (unsigned long long)whoami->server_uid, (unsigned long long)whoami->server_gid); 197 printf("\t%u GIDs, %u SIDs, %u SID bytes\n", 198 whoami->num_gids, whoami->num_sids, 199 whoami->num_sid_bytes); 200 201 offset = WHOAMI_REQUIRED_SIZE; 202 203 torture_assert_int_equal(torture, whoami->reserved, 0, 204 "invalid reserved field"); 205 206 if (tp.out.data.length == offset) { 207 /* No SIDs or GIDs returned */ 208 torture_assert_int_equal(torture, whoami->num_gids, 0, 209 "invalid GID count"); 210 torture_assert_int_equal(torture, whoami->num_sids, 0, 211 "invalid SID count"); 212 torture_assert_int_equal(torture, whoami->num_sid_bytes, 0, 213 "invalid SID byte count"); 214 return true; 215 } 216 217 if (whoami->num_gids != 0) { 218 int remain = tp.out.data.length - offset; 219 int gid_bytes = whoami->num_gids * 8; 220 221 if (whoami->num_sids == 0) { 222 torture_assert_int_equal(torture, remain, gid_bytes, 223 "GID count does not match data length"); 224 } else { 225 torture_assert(torture, remain > gid_bytes, 226 "invalid GID count"); 227 } 228 229 whoami->gid_list = talloc_array(mem_ctx, uint64_t, whoami->num_gids); 230 torture_assert(torture, whoami->gid_list != NULL, "out of memory"); 231 232 for (i = 0; i < whoami->num_gids; ++i) { 233 whoami->gid_list[i] = BVAL(tp.out.data.data, offset); 234 offset += 8; 235 } 236 } 237 238 /* Check if there should be data left for the SID list. */ 239 if (tp.out.data.length == offset) { 240 torture_assert_int_equal(torture, whoami->num_sids, 0, 241 "invalid SID count"); 242 return true; 243 } 244 245 /* All the remaining bytes must be the SID list. */ 246 torture_assert_int_equal(torture, 247 whoami->num_sid_bytes, (tp.out.data.length - offset), 248 "invalid SID byte count"); 249 250 if (whoami->num_sids != 0) { 251 252 whoami->sid_list = talloc_array(mem_ctx, struct dom_sid *, 253 whoami->num_sids); 254 torture_assert(torture, whoami->sid_list != NULL, 255 "out of memory"); 256 257 for (i = 0; i < whoami->num_sids; ++i) { 258 if (!sid_parse(mem_ctx, torture, 259 &tp.out.data, &offset, 260 &whoami->sid_list[i])) { 261 return false; 262 } 263 264 } 265 } 266 267 /* We should be at the end of the response now. */ 268 torture_assert_int_equal(torture, tp.out.data.length, offset, 269 "trailing garbage bytes"); 270 271 return true; 272} 273 274bool torture_unix_whoami(struct torture_context *torture) 275{ 276 struct smbcli_state *cli; 277 struct cli_credentials *anon_credentials; 278 struct smb_whoami whoami; 279 280 if (!(cli = connect_to_server(torture, cmdline_credentials))) { 281 return false; 282 } 283 284 /* Test basic authenticated mapping. */ 285 printf("calling SMB_QFS_POSIX_WHOAMI on an authenticated connection\n"); 286 if (!smb_raw_query_posix_whoami(torture, torture, 287 cli, &whoami, 0xFFFF)) { 288 smbcli_tdis(cli); 289 return false; 290 } 291 292 /* Test that the server drops the UID and GID list. */ 293 printf("calling SMB_QFS_POSIX_WHOAMI with a small buffer\n"); 294 if (!smb_raw_query_posix_whoami(torture, torture, 295 cli, &whoami, 0x40)) { 296 smbcli_tdis(cli); 297 return false; 298 } 299 300 torture_assert_int_equal(torture, whoami.num_gids, 0, 301 "invalid GID count"); 302 torture_assert_int_equal(torture, whoami.num_sids, 0, 303 "invalid SID count"); 304 torture_assert_int_equal(torture, whoami.num_sid_bytes, 0, 305 "invalid SID bytes count"); 306 307 smbcli_tdis(cli); 308 309 printf("calling SMB_QFS_POSIX_WHOAMI on an anonymous connection\n"); 310 anon_credentials = cli_credentials_init_anon(torture); 311 312 if (!(cli = connect_to_server(torture, anon_credentials))) { 313 return false; 314 } 315 316 if (!smb_raw_query_posix_whoami(torture, torture, 317 cli, &whoami, 0xFFFF)) { 318 smbcli_tdis(cli); 319 return false; 320 } 321 322 smbcli_tdis(cli); 323 324 /* Check that our anonymous login mapped us to guest on the server, but 325 * only if the server supports this. 326 */ 327 if (whoami.mapping_mask & SMB_WHOAMI_GUEST) { 328 printf("checking whether we were logged in as guest... %s\n", 329 whoami.mapping_flags & SMB_WHOAMI_GUEST ? "YES" : "NO"); 330 torture_assert(torture, whoami.mapping_flags & SMB_WHOAMI_GUEST, 331 "anonymous login did not map to guest"); 332 } else { 333 printf("server does not support SMB_WHOAMI_GUEST flag\n"); 334 } 335 336 return true; 337} 338 339/* vim: set sts=8 sw=8 : */ 340