diff options
Diffstat (limited to 'source4/torture/smb2/util.c')
| -rw-r--r-- | source4/torture/smb2/util.c | 1045 |
1 files changed, 1045 insertions, 0 deletions
diff --git a/source4/torture/smb2/util.c b/source4/torture/smb2/util.c new file mode 100644 index 0000000..233f589 --- /dev/null +++ b/source4/torture/smb2/util.c @@ -0,0 +1,1045 @@ +/* + Unix SMB/CIFS implementation. + + helper functions for SMB2 test suite + + Copyright (C) Andrew Tridgell 2005 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "includes.h" +#include "libcli/security/security_descriptor.h" +#include "libcli/smb2/smb2.h" +#include "libcli/smb2/smb2_calls.h" +#include "../libcli/smb/smbXcli_base.h" +#include "lib/cmdline/cmdline.h" +#include "system/time.h" +#include "librpc/gen_ndr/ndr_security.h" +#include "param/param.h" +#include "libcli/resolve/resolve.h" +#include "lib/util/tevent_ntstatus.h" + +#include "torture/torture.h" +#include "torture/smb2/proto.h" +#include "source4/torture/util.h" +#include "libcli/security/dom_sid.h" +#include "librpc/gen_ndr/lsa.h" +#include "libcli/util/clilsa.h" + + +/* + write to a file on SMB2 +*/ +NTSTATUS smb2_util_write(struct smb2_tree *tree, + struct smb2_handle handle, + const void *buf, off_t offset, size_t size) +{ + struct smb2_write w; + + ZERO_STRUCT(w); + w.in.file.handle = handle; + w.in.offset = offset; + w.in.data = data_blob_const(buf, size); + + return smb2_write(tree, &w); +} + +/* + create a complex file/dir using the SMB2 protocol +*/ +static NTSTATUS smb2_create_complex(struct torture_context *tctx, + struct smb2_tree *tree, + const char *fname, + struct smb2_handle *handle, + bool dir) +{ + TALLOC_CTX *tmp_ctx = talloc_new(tree); + char buf[7] = "abc"; + struct smb2_create io; + union smb_setfileinfo setfile; + union smb_fileinfo fileinfo; + time_t t = (time(NULL) & ~1); + NTSTATUS status; + + smb2_util_unlink(tree, fname); + ZERO_STRUCT(io); + io.in.desired_access = SEC_FLAG_MAXIMUM_ALLOWED; + io.in.file_attributes = FILE_ATTRIBUTE_NORMAL; + io.in.create_disposition = NTCREATEX_DISP_OVERWRITE_IF; + io.in.share_access = + NTCREATEX_SHARE_ACCESS_DELETE| + NTCREATEX_SHARE_ACCESS_READ| + NTCREATEX_SHARE_ACCESS_WRITE; + io.in.create_options = 0; + io.in.fname = fname; + if (dir) { + io.in.create_options = NTCREATEX_OPTIONS_DIRECTORY; + io.in.share_access &= ~NTCREATEX_SHARE_ACCESS_DELETE; + io.in.file_attributes = FILE_ATTRIBUTE_DIRECTORY; + io.in.create_disposition = NTCREATEX_DISP_CREATE; + } + + /* it seems vista is now fussier about alignment? */ + if (strchr(fname, ':') == NULL) { + /* setup some EAs */ + io.in.eas.num_eas = 2; + io.in.eas.eas = talloc_array(tmp_ctx, struct ea_struct, 2); + io.in.eas.eas[0].flags = 0; + io.in.eas.eas[0].name.s = "EAONE"; + io.in.eas.eas[0].value = data_blob_talloc(tmp_ctx, "VALUE1", 6); + io.in.eas.eas[1].flags = 0; + io.in.eas.eas[1].name.s = "SECONDEA"; + io.in.eas.eas[1].value = data_blob_talloc(tmp_ctx, "ValueTwo", 8); + } + + status = smb2_create(tree, tmp_ctx, &io); + if (NT_STATUS_EQUAL(status, NT_STATUS_EAS_NOT_SUPPORTED)) { + torture_comment( + tctx, "EAs not supported, creating: %s\n", fname); + io.in.eas.num_eas = 0; + status = smb2_create(tree, tmp_ctx, &io); + } + + talloc_free(tmp_ctx); + NT_STATUS_NOT_OK_RETURN(status); + + *handle = io.out.file.handle; + + if (!dir) { + status = smb2_util_write(tree, *handle, buf, 0, sizeof(buf)); + NT_STATUS_NOT_OK_RETURN(status); + } + + /* make sure all the timestamps aren't the same, and are also + in different DST zones*/ + setfile.generic.level = RAW_SFILEINFO_BASIC_INFORMATION; + setfile.generic.in.file.handle = *handle; + + unix_to_nt_time(&setfile.basic_info.in.create_time, t + 9*30*24*60*60); + unix_to_nt_time(&setfile.basic_info.in.access_time, t + 6*30*24*60*60); + unix_to_nt_time(&setfile.basic_info.in.write_time, t + 3*30*24*60*60); + unix_to_nt_time(&setfile.basic_info.in.change_time, t + 1*30*24*60*60); + setfile.basic_info.in.attrib = FILE_ATTRIBUTE_NORMAL; + + status = smb2_setinfo_file(tree, &setfile); + if (!NT_STATUS_IS_OK(status)) { + torture_comment(tctx, "Failed to setup file times - %s\n", nt_errstr(status)); + return status; + } + + /* make sure all the timestamps aren't the same */ + fileinfo.generic.level = RAW_FILEINFO_SMB2_ALL_INFORMATION; + fileinfo.generic.in.file.handle = *handle; + + status = smb2_getinfo_file(tree, tree, &fileinfo); + if (!NT_STATUS_IS_OK(status)) { + torture_comment(tctx, "Failed to query file times - %s\n", nt_errstr(status)); + return status; + + } + +#define CHECK_TIME(field) do {\ + if (setfile.basic_info.in.field != fileinfo.all_info2.out.field) { \ + torture_comment(tctx, "(%s) " #field " not setup correctly: %s(%llu) => %s(%llu)\n", \ + __location__, \ + nt_time_string(tree, setfile.basic_info.in.field), \ + (unsigned long long)setfile.basic_info.in.field, \ + nt_time_string(tree, fileinfo.basic_info.out.field), \ + (unsigned long long)fileinfo.basic_info.out.field); \ + status = NT_STATUS_INVALID_PARAMETER; \ + } \ +} while (0) + + CHECK_TIME(create_time); + CHECK_TIME(access_time); + CHECK_TIME(write_time); + CHECK_TIME(change_time); + + return status; +} + +/* + create a complex file using the SMB2 protocol +*/ +NTSTATUS smb2_create_complex_file(struct torture_context *tctx, + struct smb2_tree *tree, const char *fname, + struct smb2_handle *handle) +{ + return smb2_create_complex(tctx, tree, fname, handle, false); +} + +/* + create a complex dir using the SMB2 protocol +*/ +NTSTATUS smb2_create_complex_dir(struct torture_context *tctx, + struct smb2_tree *tree, const char *fname, + struct smb2_handle *handle) +{ + return smb2_create_complex(tctx, tree, fname, handle, true); +} + +/* + show lots of information about a file +*/ +void torture_smb2_all_info(struct torture_context *tctx, + struct smb2_tree *tree, struct smb2_handle handle) +{ + NTSTATUS status; + TALLOC_CTX *tmp_ctx = talloc_new(tree); + union smb_fileinfo io; + + io.generic.level = RAW_FILEINFO_SMB2_ALL_INFORMATION; + io.generic.in.file.handle = handle; + + status = smb2_getinfo_file(tree, tmp_ctx, &io); + if (!NT_STATUS_IS_OK(status)) { + DEBUG(0,("getinfo failed - %s\n", nt_errstr(status))); + talloc_free(tmp_ctx); + return; + } + + torture_comment(tctx, "all_info for '%s'\n", io.all_info2.out.fname.s); + torture_comment(tctx, "\tcreate_time: %s\n", nt_time_string(tmp_ctx, io.all_info2.out.create_time)); + torture_comment(tctx, "\taccess_time: %s\n", nt_time_string(tmp_ctx, io.all_info2.out.access_time)); + torture_comment(tctx, "\twrite_time: %s\n", nt_time_string(tmp_ctx, io.all_info2.out.write_time)); + torture_comment(tctx, "\tchange_time: %s\n", nt_time_string(tmp_ctx, io.all_info2.out.change_time)); + torture_comment(tctx, "\tattrib: 0x%x\n", io.all_info2.out.attrib); + torture_comment(tctx, "\tunknown1: 0x%x\n", io.all_info2.out.unknown1); + torture_comment(tctx, "\talloc_size: %llu\n", (long long)io.all_info2.out.alloc_size); + torture_comment(tctx, "\tsize: %llu\n", (long long)io.all_info2.out.size); + torture_comment(tctx, "\tnlink: %u\n", io.all_info2.out.nlink); + torture_comment(tctx, "\tdelete_pending: %u\n", io.all_info2.out.delete_pending); + torture_comment(tctx, "\tdirectory: %u\n", io.all_info2.out.directory); + torture_comment(tctx, "\tfile_id: %llu\n", (long long)io.all_info2.out.file_id); + torture_comment(tctx, "\tea_size: %u\n", io.all_info2.out.ea_size); + torture_comment(tctx, "\taccess_mask: 0x%08x\n", io.all_info2.out.access_mask); + torture_comment(tctx, "\tposition: 0x%llx\n", (long long)io.all_info2.out.position); + torture_comment(tctx, "\tmode: 0x%llx\n", (long long)io.all_info2.out.mode); + + /* short name, if any */ + io.generic.level = RAW_FILEINFO_ALT_NAME_INFORMATION; + status = smb2_getinfo_file(tree, tmp_ctx, &io); + if (NT_STATUS_IS_OK(status)) { + torture_comment(tctx, "\tshort name: '%s'\n", io.alt_name_info.out.fname.s); + } + + /* the EAs, if any */ + io.generic.level = RAW_FILEINFO_SMB2_ALL_EAS; + status = smb2_getinfo_file(tree, tmp_ctx, &io); + if (NT_STATUS_IS_OK(status)) { + int i; + for (i=0;i<io.all_eas.out.num_eas;i++) { + torture_comment(tctx, "\tEA[%d] flags=%d len=%d '%s'\n", i, + io.all_eas.out.eas[i].flags, + (int)io.all_eas.out.eas[i].value.length, + io.all_eas.out.eas[i].name.s); + } + } + + /* streams, if available */ + io.generic.level = RAW_FILEINFO_STREAM_INFORMATION; + status = smb2_getinfo_file(tree, tmp_ctx, &io); + if (NT_STATUS_IS_OK(status)) { + int i; + for (i=0;i<io.stream_info.out.num_streams;i++) { + torture_comment(tctx, "\tstream %d:\n", i); + torture_comment(tctx, "\t\tsize %ld\n", + (long)io.stream_info.out.streams[i].size); + torture_comment(tctx, "\t\talloc size %ld\n", + (long)io.stream_info.out.streams[i].alloc_size); + torture_comment(tctx, "\t\tname %s\n", io.stream_info.out.streams[i].stream_name.s); + } + } + + if (DEBUGLVL(1)) { + /* the security descriptor */ + io.query_secdesc.level = RAW_FILEINFO_SEC_DESC; + io.query_secdesc.in.secinfo_flags = + SECINFO_OWNER|SECINFO_GROUP| + SECINFO_DACL; + status = smb2_getinfo_file(tree, tmp_ctx, &io); + if (NT_STATUS_IS_OK(status)) { + NDR_PRINT_DEBUG(security_descriptor, io.query_secdesc.out.sd); + } + } + + talloc_free(tmp_ctx); +} + +/* + get granted access of a file handle +*/ +NTSTATUS torture_smb2_get_allinfo_access(struct smb2_tree *tree, + struct smb2_handle handle, + uint32_t *granted_access) +{ + NTSTATUS status; + TALLOC_CTX *tmp_ctx = talloc_new(tree); + union smb_fileinfo io; + + io.generic.level = RAW_FILEINFO_SMB2_ALL_INFORMATION; + io.generic.in.file.handle = handle; + + status = smb2_getinfo_file(tree, tmp_ctx, &io); + if (!NT_STATUS_IS_OK(status)) { + DEBUG(0, ("getinfo failed - %s\n", nt_errstr(status))); + goto out; + } + + *granted_access = io.all_info2.out.access_mask; + +out: + talloc_free(tmp_ctx); + return status; +} + +/** + * open a smb2 tree connect + */ +bool torture_smb2_tree_connect(struct torture_context *tctx, + struct smb2_session *session, + TALLOC_CTX *mem_ctx, + struct smb2_tree **_tree) +{ + NTSTATUS status; + const char *host = torture_setting_string(tctx, "host", NULL); + const char *share = torture_setting_string(tctx, "share", NULL); + const char *unc; + struct smb2_tree *tree; + struct tevent_req *subreq; + uint32_t timeout_msec; + + unc = talloc_asprintf(tctx, "\\\\%s\\%s", host, share); + torture_assert(tctx, unc != NULL, "talloc_asprintf"); + + tree = smb2_tree_init(session, mem_ctx, false); + torture_assert(tctx, tree != NULL, "smb2_tree_init"); + + timeout_msec = session->transport->options.request_timeout * 1000; + + subreq = smb2cli_tcon_send(tree, tctx->ev, + session->transport->conn, + timeout_msec, + session->smbXcli, + tree->smbXcli, + 0, /* flags */ + unc); + torture_assert(tctx, subreq != NULL, "smb2cli_tcon_send"); + + torture_assert(tctx, + tevent_req_poll_ntstatus(subreq, tctx->ev, &status), + "tevent_req_poll_ntstatus"); + + status = smb2cli_tcon_recv(subreq); + TALLOC_FREE(subreq); + torture_assert_ntstatus_ok(tctx, status, "smb2cli_tcon_recv"); + + *_tree = tree; + + return true; +} + +/** + * do a smb2 session setup (without a tree connect) + */ +bool torture_smb2_session_setup(struct torture_context *tctx, + struct smb2_transport *transport, + uint64_t previous_session_id, + TALLOC_CTX *mem_ctx, + struct smb2_session **_session) +{ + NTSTATUS status; + struct smb2_session *session; + + session = smb2_session_init(transport, + lpcfg_gensec_settings(tctx, tctx->lp_ctx), + mem_ctx); + + if (session == NULL) { + return false; + } + + status = smb2_session_setup_spnego(session, + samba_cmdline_get_creds(), + previous_session_id); + if (!NT_STATUS_IS_OK(status)) { + torture_comment(tctx, "session setup failed: %s\n", nt_errstr(status)); + talloc_free(session); + return false; + } + + *_session = session; + + return true; +} + +/* + open a smb2 connection +*/ +bool torture_smb2_connection_ext(struct torture_context *tctx, + uint64_t previous_session_id, + const struct smbcli_options *options, + struct smb2_tree **tree) +{ + NTSTATUS status; + const char *host = torture_setting_string(tctx, "host", NULL); + const char *share = torture_setting_string(tctx, "share", NULL); + const char *p = torture_setting_string(tctx, "unclist", NULL); + TALLOC_CTX *mem_ctx = NULL; + bool ok; + + if (p != NULL) { + char *host2 = NULL; + char *share2 = NULL; + + mem_ctx = talloc_new(tctx); + if (mem_ctx == NULL) { + return false; + } + + ok = torture_get_conn_index(tctx->conn_index++, mem_ctx, tctx, + &host2, &share2); + if (!ok) { + TALLOC_FREE(mem_ctx); + return false; + } + + host = host2; + share = share2; + } + + status = smb2_connect_ext(tctx, + host, + lpcfg_smb_ports(tctx->lp_ctx), + share, + lpcfg_resolve_context(tctx->lp_ctx), + samba_cmdline_get_creds(), + NULL, /* existing_conn */ + previous_session_id, + tree, + tctx->ev, + options, + lpcfg_socket_options(tctx->lp_ctx), + lpcfg_gensec_settings(tctx, tctx->lp_ctx) + ); + if (!NT_STATUS_IS_OK(status)) { + torture_comment(tctx, "Failed to connect to SMB2 share \\\\%s\\%s - %s\n", + host, share, nt_errstr(status)); + TALLOC_FREE(mem_ctx); + return false; + } + + TALLOC_FREE(mem_ctx); + return true; +} + +bool torture_smb2_connection(struct torture_context *tctx, struct smb2_tree **tree) +{ + bool ret; + struct smbcli_options options; + + lpcfg_smbcli_options(tctx->lp_ctx, &options); + + ret = torture_smb2_connection_ext(tctx, 0, &options, tree); + + return ret; +} + +/** + * SMB2 connect with share from soption + **/ +bool torture_smb2_con_share(struct torture_context *tctx, + const char *share, + struct smb2_tree **tree) +{ + struct smbcli_options options; + NTSTATUS status; + const char *host = torture_setting_string(tctx, "host", NULL); + + lpcfg_smbcli_options(tctx->lp_ctx, &options); + + status = smb2_connect(tctx, + host, + lpcfg_smb_ports(tctx->lp_ctx), + share, + lpcfg_resolve_context(tctx->lp_ctx), + samba_cmdline_get_creds(), + tree, + tctx->ev, + &options, + lpcfg_socket_options(tctx->lp_ctx), + lpcfg_gensec_settings(tctx, tctx->lp_ctx) + ); + if (!NT_STATUS_IS_OK(status)) { + torture_comment(tctx, "Failed to connect to SMB2 share \\\\%s\\%s - %s\n", + host, share, nt_errstr(status)); + return false; + } + return true; +} + +/** + * SMB2 connect with share from soption + **/ +bool torture_smb2_con_sopt(struct torture_context *tctx, + const char *soption, + struct smb2_tree **tree) +{ + const char *share = torture_setting_string(tctx, soption, NULL); + + if (share == NULL) { + torture_comment(tctx, "No share for option %s\n", soption); + return false; + } + + return torture_smb2_con_share(tctx, share, tree); +} + +/* + create and return a handle to a test file + with a specific access mask +*/ +NTSTATUS torture_smb2_testfile_access(struct smb2_tree *tree, const char *fname, + struct smb2_handle *handle, + uint32_t desired_access) +{ + struct smb2_create io; + NTSTATUS status; + + ZERO_STRUCT(io); + io.in.oplock_level = 0; + io.in.desired_access = desired_access; + io.in.file_attributes = FILE_ATTRIBUTE_NORMAL; + io.in.create_disposition = NTCREATEX_DISP_OPEN_IF; + io.in.share_access = + NTCREATEX_SHARE_ACCESS_DELETE| + NTCREATEX_SHARE_ACCESS_READ| + NTCREATEX_SHARE_ACCESS_WRITE; + io.in.create_options = 0; + io.in.fname = fname; + + status = smb2_create(tree, tree, &io); + NT_STATUS_NOT_OK_RETURN(status); + + *handle = io.out.file.handle; + + return NT_STATUS_OK; +} + +/* + create and return a handle to a test file +*/ +NTSTATUS torture_smb2_testfile(struct smb2_tree *tree, const char *fname, + struct smb2_handle *handle) +{ + return torture_smb2_testfile_access(tree, fname, handle, + SEC_RIGHTS_FILE_ALL); +} + +/* + create and return a handle to a test file + with a specific access mask +*/ +NTSTATUS torture_smb2_open(struct smb2_tree *tree, + const char *fname, + uint32_t desired_access, + struct smb2_handle *handle) +{ + struct smb2_create io; + NTSTATUS status; + + io = (struct smb2_create) { + .in.fname = fname, + .in.desired_access = desired_access, + .in.file_attributes = FILE_ATTRIBUTE_NORMAL, + .in.create_disposition = NTCREATEX_DISP_OPEN, + .in.share_access = NTCREATEX_SHARE_ACCESS_MASK, + }; + + status = smb2_create(tree, tree, &io); + if (!NT_STATUS_IS_OK(status)) { + return status; + } + + *handle = io.out.file.handle; + + return NT_STATUS_OK; +} + +/* + create and return a handle to a test directory + with specific desired access +*/ +NTSTATUS torture_smb2_testdir_access(struct smb2_tree *tree, const char *fname, + struct smb2_handle *handle, + uint32_t desired_access) +{ + struct smb2_create io; + NTSTATUS status; + + ZERO_STRUCT(io); + io.in.oplock_level = 0; + io.in.desired_access = desired_access; + io.in.file_attributes = FILE_ATTRIBUTE_DIRECTORY; + io.in.create_disposition = NTCREATEX_DISP_OPEN_IF; + io.in.share_access = NTCREATEX_SHARE_ACCESS_READ|NTCREATEX_SHARE_ACCESS_WRITE|NTCREATEX_SHARE_ACCESS_DELETE; + io.in.create_options = NTCREATEX_OPTIONS_DIRECTORY; + io.in.fname = fname; + + status = smb2_create(tree, tree, &io); + NT_STATUS_NOT_OK_RETURN(status); + + *handle = io.out.file.handle; + + return NT_STATUS_OK; +} + +/* + create and return a handle to a test directory +*/ +NTSTATUS torture_smb2_testdir(struct smb2_tree *tree, const char *fname, + struct smb2_handle *handle) +{ + return torture_smb2_testdir_access(tree, fname, handle, + SEC_RIGHTS_DIR_ALL); +} + +/* + create a simple file using the SMB2 protocol +*/ +NTSTATUS smb2_create_simple_file(struct torture_context *tctx, + struct smb2_tree *tree, const char *fname, + struct smb2_handle *handle) +{ + char buf[7] = "abc"; + NTSTATUS status; + + smb2_util_unlink(tree, fname); + status = torture_smb2_testfile_access(tree, + fname, handle, + SEC_FLAG_MAXIMUM_ALLOWED); + NT_STATUS_NOT_OK_RETURN(status); + + status = smb2_util_write(tree, *handle, buf, 0, sizeof(buf)); + NT_STATUS_NOT_OK_RETURN(status); + + return NT_STATUS_OK; +} + +/* + create a simple file using SMB2. +*/ +NTSTATUS torture_setup_simple_file(struct torture_context *tctx, + struct smb2_tree *tree, const char *fname) +{ + struct smb2_handle handle; + NTSTATUS status = smb2_create_simple_file(tctx, tree, fname, &handle); + NT_STATUS_NOT_OK_RETURN(status); + return smb2_util_close(tree, handle); +} + +/* + create a complex file using SMB2, to make it easier to + find fields in SMB2 getinfo levels +*/ +NTSTATUS torture_setup_complex_file(struct torture_context *tctx, + struct smb2_tree *tree, const char *fname) +{ + struct smb2_handle handle; + NTSTATUS status = smb2_create_complex_file(tctx, tree, fname, &handle); + NT_STATUS_NOT_OK_RETURN(status); + return smb2_util_close(tree, handle); +} + + +/* + create a complex dir using SMB2, to make it easier to + find fields in SMB2 getinfo levels +*/ +NTSTATUS torture_setup_complex_dir(struct torture_context *tctx, + struct smb2_tree *tree, const char *fname) +{ + struct smb2_handle handle; + NTSTATUS status = smb2_create_complex_dir(tctx, tree, fname, &handle); + NT_STATUS_NOT_OK_RETURN(status); + return smb2_util_close(tree, handle); +} + + +/* + return a handle to the root of the share +*/ +NTSTATUS smb2_util_roothandle(struct smb2_tree *tree, struct smb2_handle *handle) +{ + struct smb2_create io; + NTSTATUS status; + + ZERO_STRUCT(io); + io.in.oplock_level = 0; + io.in.desired_access = SEC_STD_SYNCHRONIZE | SEC_DIR_READ_ATTRIBUTE | SEC_DIR_LIST; + io.in.file_attributes = 0; + io.in.create_disposition = NTCREATEX_DISP_OPEN; + io.in.share_access = NTCREATEX_SHARE_ACCESS_READ|NTCREATEX_SHARE_ACCESS_DELETE; + io.in.create_options = NTCREATEX_OPTIONS_ASYNC_ALERT; + io.in.fname = ""; + + status = smb2_create(tree, tree, &io); + NT_STATUS_NOT_OK_RETURN(status); + + *handle = io.out.file.handle; + + return NT_STATUS_OK; +} + +/* Comparable to torture_setup_dir, but for SMB2. */ +bool smb2_util_setup_dir(struct torture_context *tctx, struct smb2_tree *tree, + const char *dname) +{ + NTSTATUS status; + + /* XXX: smb_raw_exit equivalent? + smb_raw_exit(cli->session); */ + if (smb2_deltree(tree, dname) == -1) { + torture_result(tctx, TORTURE_ERROR, "Unable to deltree when setting up %s.\n", dname); + return false; + } + + status = smb2_util_mkdir(tree, dname); + if (NT_STATUS_IS_ERR(status)) { + torture_result(tctx, TORTURE_ERROR, "Unable to mkdir when setting up %s - %s\n", dname, + nt_errstr(status)); + return false; + } + + return true; +} + +#define CHECK_STATUS(status, correct) do { \ + if (!NT_STATUS_EQUAL(status, correct)) { \ + torture_result(tctx, TORTURE_FAIL, "(%s) Incorrect status %s - should be %s\n", \ + __location__, nt_errstr(status), nt_errstr(correct)); \ + ret = false; \ + goto done; \ + }} while (0) + +/* + * Helper function to verify a security descriptor, by querying + * and comparing against the passed in sd. + */ +bool smb2_util_verify_sd(TALLOC_CTX *tctx, struct smb2_tree *tree, + struct smb2_handle handle, struct security_descriptor *sd) +{ + NTSTATUS status; + bool ret = true; + union smb_fileinfo q = {}; + + q.query_secdesc.level = RAW_FILEINFO_SEC_DESC; + q.query_secdesc.in.file.handle = handle; + q.query_secdesc.in.secinfo_flags = + SECINFO_OWNER | + SECINFO_GROUP | + SECINFO_DACL; + status = smb2_getinfo_file(tree, tctx, &q); + CHECK_STATUS(status, NT_STATUS_OK); + + if (!security_acl_equal( + q.query_secdesc.out.sd->dacl, sd->dacl)) { + torture_warning(tctx, "%s: security descriptors don't match!\n", + __location__); + torture_warning(tctx, "got:\n"); + NDR_PRINT_DEBUG(security_descriptor, + q.query_secdesc.out.sd); + torture_warning(tctx, "expected:\n"); + NDR_PRINT_DEBUG(security_descriptor, sd); + ret = false; + } + + done: + return ret; +} + +/* + * Helper function to verify attributes, by querying + * and comparing against the passed in attrib. + */ +bool smb2_util_verify_attrib(TALLOC_CTX *tctx, struct smb2_tree *tree, + struct smb2_handle handle, uint32_t attrib) +{ + NTSTATUS status; + bool ret = true; + union smb_fileinfo q = {}; + + q.standard.level = RAW_FILEINFO_SMB2_ALL_INFORMATION; + q.standard.in.file.handle = handle; + status = smb2_getinfo_file(tree, tctx, &q); + CHECK_STATUS(status, NT_STATUS_OK); + + q.all_info2.out.attrib &= ~(FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NONINDEXED); + + if (q.all_info2.out.attrib != attrib) { + torture_warning(tctx, "%s: attributes don't match! " + "got %x, expected %x\n", __location__, + (uint32_t)q.standard.out.attrib, + (uint32_t)attrib); + ret = false; + } + + done: + return ret; +} + + +uint32_t smb2_util_lease_state(const char *ls) +{ + uint32_t val = 0; + int i; + + for (i = 0; i < strlen(ls); i++) { + switch (ls[i]) { + case 'R': + val |= SMB2_LEASE_READ; + break; + case 'H': + val |= SMB2_LEASE_HANDLE; + break; + case 'W': + val |= SMB2_LEASE_WRITE; + break; + } + } + + return val; +} + +char *smb2_util_lease_state_string(TALLOC_CTX *mem_ctx, uint32_t ls) +{ + return talloc_asprintf(mem_ctx, "0x%0x (%s%s%s)", + (unsigned)ls, + ls & SMB2_LEASE_READ ? "R": "", + ls & SMB2_LEASE_HANDLE ? "H": "", + ls & SMB2_LEASE_WRITE ? "W": ""); +} + +uint32_t smb2_util_share_access(const char *sharemode) +{ + uint32_t val = NTCREATEX_SHARE_ACCESS_NONE; /* 0 */ + int i; + + for (i = 0; i < strlen(sharemode); i++) { + switch(sharemode[i]) { + case 'R': + val |= NTCREATEX_SHARE_ACCESS_READ; + break; + case 'W': + val |= NTCREATEX_SHARE_ACCESS_WRITE; + break; + case 'D': + val |= NTCREATEX_SHARE_ACCESS_DELETE; + break; + } + } + + return val; +} + +uint8_t smb2_util_oplock_level(const char *op) +{ + uint8_t val = SMB2_OPLOCK_LEVEL_NONE; + int i; + + for (i = 0; i < strlen(op); i++) { + switch (op[i]) { + case 's': + return SMB2_OPLOCK_LEVEL_II; + case 'x': + return SMB2_OPLOCK_LEVEL_EXCLUSIVE; + case 'b': + return SMB2_OPLOCK_LEVEL_BATCH; + default: + continue; + } + } + + return val; +} + +/** + * Helper functions to fill a smb2_create struct for several + * open scenarios. + */ +void smb2_generic_create_share(struct smb2_create *io, struct smb2_lease *ls, + bool dir, const char *name, uint32_t disposition, + uint32_t share_access, + uint8_t oplock, uint64_t leasekey, + uint32_t leasestate) +{ + ZERO_STRUCT(*io); + io->in.security_flags = 0x00; + io->in.oplock_level = oplock; + io->in.impersonation_level = NTCREATEX_IMPERSONATION_IMPERSONATION; + io->in.create_flags = 0x00000000; + io->in.reserved = 0x00000000; + io->in.desired_access = SEC_RIGHTS_FILE_ALL; + io->in.file_attributes = FILE_ATTRIBUTE_NORMAL; + io->in.share_access = share_access; + io->in.create_disposition = disposition; + io->in.create_options = NTCREATEX_OPTIONS_SEQUENTIAL_ONLY | + NTCREATEX_OPTIONS_ASYNC_ALERT | + NTCREATEX_OPTIONS_NON_DIRECTORY_FILE | + 0x00200000; + io->in.fname = name; + + if (dir) { + io->in.create_options = NTCREATEX_OPTIONS_DIRECTORY; + io->in.file_attributes = FILE_ATTRIBUTE_DIRECTORY; + io->in.create_disposition = NTCREATEX_DISP_CREATE; + } + + if (ls) { + ZERO_STRUCTPN(ls); + ls->lease_key.data[0] = leasekey; + ls->lease_key.data[1] = ~leasekey; + ls->lease_state = leasestate; + io->in.lease_request = ls; + } +} + +void smb2_generic_create(struct smb2_create *io, struct smb2_lease *ls, + bool dir, const char *name, uint32_t disposition, + uint8_t oplock, uint64_t leasekey, + uint32_t leasestate) +{ + smb2_generic_create_share(io, ls, dir, name, disposition, + smb2_util_share_access("RWD"), + oplock, + leasekey, leasestate); +} + +void smb2_lease_create_share(struct smb2_create *io, struct smb2_lease *ls, + bool dir, const char *name, uint32_t share_access, + uint64_t leasekey, uint32_t leasestate) +{ + smb2_generic_create_share(io, ls, dir, name, NTCREATEX_DISP_OPEN_IF, + share_access, SMB2_OPLOCK_LEVEL_LEASE, + leasekey, leasestate); +} + +void smb2_lease_create(struct smb2_create *io, struct smb2_lease *ls, + bool dir, const char *name, uint64_t leasekey, + uint32_t leasestate) +{ + smb2_lease_create_share(io, ls, dir, name, + smb2_util_share_access("RWD"), + leasekey, leasestate); +} + +void smb2_lease_v2_create_share(struct smb2_create *io, + struct smb2_lease *ls, + bool dir, + const char *name, + uint32_t share_access, + uint64_t leasekey, + const uint64_t *parentleasekey, + uint32_t leasestate, + uint16_t lease_epoch) +{ + smb2_generic_create_share(io, NULL, dir, name, NTCREATEX_DISP_OPEN_IF, + share_access, SMB2_OPLOCK_LEVEL_LEASE, 0, 0); + + if (ls) { + ZERO_STRUCT(*ls); + ls->lease_key.data[0] = leasekey; + ls->lease_key.data[1] = ~leasekey; + ls->lease_state = leasestate; + if (parentleasekey != NULL) { + ls->lease_flags |= SMB2_LEASE_FLAG_PARENT_LEASE_KEY_SET; + ls->parent_lease_key.data[0] = *parentleasekey; + ls->parent_lease_key.data[1] = ~(*parentleasekey); + } + ls->lease_epoch = lease_epoch; + io->in.lease_request_v2 = ls; + } +} + +void smb2_lease_v2_create(struct smb2_create *io, + struct smb2_lease *ls, + bool dir, + const char *name, + uint64_t leasekey, + const uint64_t *parentleasekey, + uint32_t leasestate, + uint16_t lease_epoch) +{ + smb2_lease_v2_create_share(io, ls, dir, name, + smb2_util_share_access("RWD"), + leasekey, parentleasekey, + leasestate, lease_epoch); +} + + +void smb2_oplock_create_share(struct smb2_create *io, const char *name, + uint32_t share_access, uint8_t oplock) +{ + smb2_generic_create_share(io, NULL, false, name, NTCREATEX_DISP_OPEN_IF, + share_access, oplock, 0, 0); +} +void smb2_oplock_create(struct smb2_create *io, const char *name, uint8_t oplock) +{ + smb2_oplock_create_share(io, name, smb2_util_share_access("RWD"), + oplock); +} + +/* + a wrapper around smblsa_sid_check_privilege, that tries to take + account of the fact that the lsa privileges calls don't expand + group memberships, using an explicit check for administrator. There + must be a better way ... + */ +NTSTATUS torture_smb2_check_privilege(struct smb2_tree *tree, + const char *sid_str, + const char *privilege) +{ + struct dom_sid *sid = NULL; + TALLOC_CTX *tmp_ctx = NULL; + uint32_t rid; + NTSTATUS status; + + tmp_ctx = talloc_new(tree); + if (tmp_ctx == NULL) { + return NT_STATUS_NO_MEMORY; + } + + sid = dom_sid_parse_talloc(tmp_ctx, sid_str); + if (sid == NULL) { + talloc_free(tmp_ctx); + return NT_STATUS_INVALID_SID; + } + + status = dom_sid_split_rid(tmp_ctx, sid, NULL, &rid); + if (!NT_STATUS_IS_OK(status)) { + TALLOC_FREE(tmp_ctx); + return status; + } + + if (rid == DOMAIN_RID_ADMINISTRATOR) { + /* assume the administrator has them all */ + TALLOC_FREE(tmp_ctx); + return NT_STATUS_OK; + } + + talloc_free(tmp_ctx); + + return smb2lsa_sid_check_privilege(tree, sid_str, privilege); +} |