source4/torture/rpc/testjoin.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    utility code to join/leave a domain
   5
   6    Copyright (C) Andrew Tridgell 2004
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 2 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program; if not, write to the Free Software
  20    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21 */
  22
  23 /*
  24   this code is used by other torture modules to join/leave a domain
  25   as either a member, bdc or thru a trust relationship
  26 */
  27
  28 #include "includes.h"
  29 #include "librpc/gen_ndr/ndr_samr.h"
  30 #include "system/time.h"
  31
  32 struct test_join {
  33         struct dcerpc_pipe *p;
  34         struct policy_handle user_handle;
  35 };
  36
  37
  38 static NTSTATUS DeleteUser_byname(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
  39                                   struct policy_handle *handle, const char *name)
  40 {
  41         NTSTATUS status;
  42         struct samr_DeleteUser d;
  43         struct policy_handle user_handle;
  44         uint32_t rid;
  45         struct samr_LookupNames n;
  46         struct samr_String sname;
  47         struct samr_OpenUser r;
  48
  49         sname.string = name;
  50
  51         n.in.domain_handle = handle;
  52         n.in.num_names = 1;
  53         n.in.names = &sname;
  54
  55         status = dcerpc_samr_LookupNames(p, mem_ctx, &n);
  56         if (NT_STATUS_IS_OK(status)) {
  57                 rid = n.out.rids.ids[0];
  58         } else {
  59                 return status;
  60         }
  61
  62         r.in.domain_handle = handle;
  63         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
  64         r.in.rid = rid;
  65         r.out.user_handle = &user_handle;
  66
  67         status = dcerpc_samr_OpenUser(p, mem_ctx, &r);
  68         if (!NT_STATUS_IS_OK(status)) {
  69                 printf("OpenUser(%s) failed - %s\n", name, nt_errstr(status));
  70                 return status;
  71         }
  72
  73         d.in.user_handle = &user_handle;
  74         d.out.user_handle = &user_handle;
  75         status = dcerpc_samr_DeleteUser(p, mem_ctx, &d);
  76         if (!NT_STATUS_IS_OK(status)) {
  77                 return status;
  78         }
  79
  80         return NT_STATUS_OK;
  81 }
  82
  83 /*
  84   create a test user in the domain
  85   an opaque pointer is returned. Pass it to torture_leave_domain()
  86   when finished
  87 */
  88
  89 struct test_join *torture_create_testuser(const char *username,
  90                                           const char *domain,
  91                                           uint16_t acct_type,
  92                                           const char **random_password)
  93 {
  94         NTSTATUS status;
  95         struct samr_Connect c;
  96         struct samr_CreateUser2 r;
  97         struct samr_OpenDomain o;
  98         struct samr_LookupDomain l;
  99         struct samr_GetUserPwInfo pwp;
 100         struct samr_SetUserInfo s;
 101         union samr_UserInfo u;
 102         struct policy_handle handle;
 103         struct policy_handle domain_handle;
 104         uint32_t access_granted;
 105         uint32_t rid;
 106         DATA_BLOB session_key;
 107         struct samr_String name;
 108         struct samr_String comment;
 109         struct samr_String full_name;
 110
 111         int policy_min_pw_len = 0;
 112         struct test_join *join;
 113         char *random_pw;
 114
 115         join = talloc(NULL, struct test_join);
 116         if (join == NULL) {
 117                 return NULL;
 118         }
 119
 120         ZERO_STRUCTP(join);
 121
 122         printf("Connecting to SAMR\n");
 123
 124         status = torture_rpc_connection(join,
 125                                         &join->p,
 126                                         DCERPC_SAMR_NAME,
 127                                         DCERPC_SAMR_UUID,
 128                                         DCERPC_SAMR_VERSION);
 129         if (!NT_STATUS_IS_OK(status)) {
 130                 goto failed;
 131         }
 132
 133         c.in.system_name = NULL;
 134         c.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 135         c.out.connect_handle = &handle;
 136
 137         status = dcerpc_samr_Connect(join->p, join, &c);
 138         if (!NT_STATUS_IS_OK(status)) {
 139                 const char *errstr = nt_errstr(status);
 140                 if (NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
 141                         errstr = dcerpc_errstr(join, join->p->last_fault_code);
 142                 }
 143                 printf("samr_Connect failed - %s\n", errstr);
 144                 goto failed;
 145         }
 146
 147         printf("Opening domain %s\n", domain);
 148
 149         name.string = domain;
 150         l.in.connect_handle = &handle;
 151         l.in.domain_name = &name;
 152
 153         status = dcerpc_samr_LookupDomain(join->p, join, &l);
 154         if (!NT_STATUS_IS_OK(status)) {
 155                 printf("LookupDomain failed - %s\n", nt_errstr(status));
 156                 goto failed;
 157         }
 158
 159         o.in.connect_handle = &handle;
 160         o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 161         o.in.sid = l.out.sid;
 162         o.out.domain_handle = &domain_handle;
 163
 164         status = dcerpc_samr_OpenDomain(join->p, join, &o);
 165         if (!NT_STATUS_IS_OK(status)) {
 166                 printf("OpenDomain failed - %s\n", nt_errstr(status));
 167                 goto failed;
 168         }
 169
 170         printf("Creating account %s\n", username);
 171
 172 again:
 173         name.string = username;
 174         r.in.domain_handle = &domain_handle;
 175         r.in.account_name = &name;
 176         r.in.acct_flags = acct_type;
 177         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 178         r.out.user_handle = &join->user_handle;
 179         r.out.access_granted = &access_granted;
 180         r.out.rid = &rid;
 181
 182         status = dcerpc_samr_CreateUser2(join->p, join, &r);
 183
 184         if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
 185                 status = DeleteUser_byname(join->p, join, &domain_handle, name.string);
 186                 if (NT_STATUS_IS_OK(status)) {
 187                         goto again;
 188                 }
 189         }
 190
 191         if (!NT_STATUS_IS_OK(status)) {
 192                 printf("CreateUser2 failed - %s\n", nt_errstr(status));
 193                 goto failed;
 194         }
 195
 196         pwp.in.user_handle = &join->user_handle;
 197
 198         status = dcerpc_samr_GetUserPwInfo(join->p, join, &pwp);
 199         if (NT_STATUS_IS_OK(status)) {
 200                 policy_min_pw_len = pwp.out.info.min_password_length;
 201         }
 202
 203         random_pw = generate_random_str(join, MAX(8, policy_min_pw_len));
 204
 205         printf("Setting account password '%s'\n", random_pw);
 206
 207         s.in.user_handle = &join->user_handle;
 208         s.in.info = &u;
 209         s.in.level = 24;
 210
 211         encode_pw_buffer(u.info24.password.data, random_pw, STR_UNICODE);
 212         u.info24.pw_len = strlen(random_pw);
 213
 214         status = dcerpc_fetch_session_key(join->p, &session_key);
 215         if (!NT_STATUS_IS_OK(status)) {
 216                 printf("SetUserInfo level %u - no session key - %s\n",
 217                        s.in.level, nt_errstr(status));
 218                 torture_leave_domain(join);
 219                 goto failed;
 220         }
 221
 222         arcfour_crypt_blob(u.info24.password.data, 516, &session_key);
 223
 224         status = dcerpc_samr_SetUserInfo(join->p, join, &s);
 225         if (!NT_STATUS_IS_OK(status)) {
 226                 printf("SetUserInfo failed - %s\n", nt_errstr(status));
 227                 goto failed;
 228         }
 229
 230         ZERO_STRUCT(u);
 231         s.in.user_handle = &join->user_handle;
 232         s.in.info = &u;
 233         s.in.level = 21;
 234
 235         u.info21.acct_flags = acct_type;
 236         u.info21.fields_present = SAMR_FIELD_ACCT_FLAGS | SAMR_FIELD_DESCRIPTION | SAMR_FIELD_COMMENT | SAMR_FIELD_FULL_NAME;
 237         comment.string = talloc_asprintf(join,
 238                                          "Tortured by Samba4: %s",
 239                                          timestring(join, time(NULL)));
 240         u.info21.comment = comment;
 241         full_name.string = talloc_asprintf(join,
 242                                          "Torture account for Samba4: %s",
 243                                          timestring(join, time(NULL)));
 244         u.info21.full_name = full_name;
 245
 246         u.info21.description.string = talloc_asprintf(join,
 247                                          "Samba4 torture account created by host %s: %s",
 248                                          lp_netbios_name(), timestring(join, time(NULL)));
 249
 250         printf("Resetting ACB flags, force pw change time\n");
 251
 252         status = dcerpc_samr_SetUserInfo(join->p, join, &s);
 253         if (!NT_STATUS_IS_OK(status)) {
 254                 printf("SetUserInfo failed - %s\n", nt_errstr(status));
 255                 goto failed;
 256         }
 257
 258         if (random_password) {
 259                 *random_password = random_pw;
 260         }
 261
 262         return join;
 263
 264 failed:
 265         torture_leave_domain(join);
 266         return NULL;
 267 }
 268
 269
 270 struct test_join *torture_join_domain(const char *machine_name,
 271                                       const char *domain,
 272                                       uint16_t acct_flags,
 273                                       const char **machine_password)
 274 {
 275         char *username = talloc_asprintf(NULL, "%s$", machine_name);
 276         struct test_join *tj = torture_create_testuser(username, domain, acct_flags, machine_password);
 277         talloc_free(username);
 278         return tj;
 279 }
 280
 281 struct dcerpc_pipe *torture_join_samr_pipe(struct test_join *join)
 282 {
 283         return join->p;
 284 }
 285
 286 struct policy_handle *torture_join_samr_user_policy(struct test_join *join)
 287 {
 288         return &join->user_handle;
 289 }
 290
 291 /*
 292   leave the domain, deleting the machine acct
 293 */
 294 void torture_leave_domain(struct test_join *join)
 295 {
 296         struct samr_DeleteUser d;
 297         NTSTATUS status;
 298
 299         if (!GUID_all_zero(&join->user_handle.uuid)) {
 300                 d.in.user_handle = &join->user_handle;
 301                 d.out.user_handle = &join->user_handle;
 302
 303                 status = dcerpc_samr_DeleteUser(join->p, join, &d);
 304                 if (!NT_STATUS_IS_OK(status)) {
 305                         printf("Delete of machine account failed\n");
 306                 }
 307         }
 308
 309         talloc_free(join);
 310 }
 311
 312
 313 struct test_join_ads_dc {
 314         struct test_join *join;
 315 };
 316
 317 struct test_join_ads_dc *torture_join_domain_ads_dc(const char *machine_name,
 318                                                     const char *domain,
 319                                                     const char **machine_password)
 320 {
 321         struct test_join_ads_dc *join;
 322
 323         join = talloc(NULL, struct test_join_ads_dc);
 324         if (join == NULL) {
 325                 return NULL;
 326         }
 327
 328         join->join = torture_join_domain(machine_name, domain,
 329                                         ACB_SVRTRUST,
 330                                         machine_password);
 331
 332         if (!join->join) {
 333                 return NULL;
 334         }
 335
 336         /* do netlogon DrsEnumerateDomainTrusts */
 337
 338         /* modify userAccountControl from 4096 to 532480 */
 339
 340         /* modify RDN to OU=Domain Controllers and skip the $ from server name */
 341
 342         /* ask objectVersion of Schema Partition */
 343
 344         /* ask rIDManagerReferenz of the Domain Partition */
 345
 346         /* ask fsMORoleOwner of the RID-Manager$ object
 347          * returns CN=NTDS Settings,CN=<DC>,CN=Servers,CN=Default-First-Site-Name, ...
 348          */
 349
 350         /* ask for dnsHostName of CN=<DC>,CN=Servers,CN=Default-First-Site-Name, ... */
 351
 352         /* ask for objectGUID of CN=NTDS Settings,CN=<DC>,CN=Servers,CN=Default-First-Site-Name, ... */
 353
 354         /* ask for * of CN=Default-First-Site-Name, ... */
 355
 356         /* search (&(|(objectClass=user)(objectClass=computer))(sAMAccountName=<machine_name>$)) in Domain Partition
 357          * attributes : distinguishedName, userAccountControl
 358          */
 359
 360         /* ask * for CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
 361          * should fail with noSuchObject
 362          */
 363
 364         /* add CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
 365          *
 366          * objectClass = server
 367          * systemFlags = 50000000
 368          * serverReferenz = CN=<machine_name>,OU=Domain Controllers,...
 369          */
 370
 371         /* ask for * of CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
 372          * should fail with noSuchObject
 373          */
 374
 375         /* search for (ncname=<domain_nc>) in CN=Partitions,CN=Configuration,...
 376          * attributes: ncName, dnsRoot
 377          */
 378
 379         /* modify add CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
 380          * serverReferenz = CN=<machine_name>,OU=Domain Controllers,...
 381          * should fail with attributeOrValueExists
 382          */
 383
 384         /* modify replace CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
 385          * serverReferenz = CN=<machine_name>,OU=Domain Controllers,...
 386          */
 387
 388         /* DsReplicaAdd to create the CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
 389          * needs to be tested
 390          */
 391
 392         return join;
 393 }
 394
 395 void torture_leave_domain_ads_dc(struct test_join_ads_dc *join)
 396 {
 397
 398         if (join->join) {
 399                 torture_leave_domain(join->join);
 400         }
 401
 402         talloc_free(join);
 403 }