source4/torture/rpc/testjoin.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    utility code to join/leave a domain
   5
   6    Copyright (C) Andrew Tridgell 2004
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 2 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program; if not, write to the Free Software
  20    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21 */
  22
  23 /*
  24   this code is used by other torture modules to join/leave a domain
  25   as either a member, bdc or thru a trust relationship
  26 */
  27
  28 #include "includes.h"
  29 #include "librpc/gen_ndr/ndr_samr.h"
  30 #include "system/time.h"
  31 #include "lib/crypto/crypto.h"
  32 #include "libnet/libnet.h"
  33 #include "lib/cmdline/popt_common.h"
  34 #include "lib/ldb/include/ldb.h"
  35
  36
  37 struct test_join {
  38         struct dcerpc_pipe *p;
  39         struct policy_handle user_handle;
  40         struct libnet_JoinDomain *libnet_r;
  41         const char *dom_sid;
  42 };
  43
  44
  45 static NTSTATUS DeleteUser_byname(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
  46                                   struct policy_handle *handle, const char *name)
  47 {
  48         NTSTATUS status;
  49         struct samr_DeleteUser d;
  50         struct policy_handle user_handle;
  51         uint32_t rid;
  52         struct samr_LookupNames n;
  53         struct lsa_String sname;
  54         struct samr_OpenUser r;
  55
  56         sname.string = name;
  57
  58         n.in.domain_handle = handle;
  59         n.in.num_names = 1;
  60         n.in.names = &sname;
  61
  62         status = dcerpc_samr_LookupNames(p, mem_ctx, &n);
  63         if (NT_STATUS_IS_OK(status)) {
  64                 rid = n.out.rids.ids[0];
  65         } else {
  66                 return status;
  67         }
  68
  69         r.in.domain_handle = handle;
  70         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
  71         r.in.rid = rid;
  72         r.out.user_handle = &user_handle;
  73
  74         status = dcerpc_samr_OpenUser(p, mem_ctx, &r);
  75         if (!NT_STATUS_IS_OK(status)) {
  76                 printf("OpenUser(%s) failed - %s\n", name, nt_errstr(status));
  77                 return status;
  78         }
  79
  80         d.in.user_handle = &user_handle;
  81         d.out.user_handle = &user_handle;
  82         status = dcerpc_samr_DeleteUser(p, mem_ctx, &d);
  83         if (!NT_STATUS_IS_OK(status)) {
  84                 return status;
  85         }
  86
  87         return NT_STATUS_OK;
  88 }
  89
  90 /*
  91   create a test user in the domain
  92   an opaque pointer is returned. Pass it to torture_leave_domain()
  93   when finished
  94 */
  95
  96 struct test_join *torture_create_testuser(const char *username,
  97                                           const char *domain,
  98                                           uint16_t acct_type,
  99                                           const char **random_password)
 100 {
 101         NTSTATUS status;
 102         struct samr_Connect c;
 103         struct samr_CreateUser2 r;
 104         struct samr_OpenDomain o;
 105         struct samr_LookupDomain l;
 106         struct samr_GetUserPwInfo pwp;
 107         struct samr_SetUserInfo s;
 108         union samr_UserInfo u;
 109         struct policy_handle handle;
 110         struct policy_handle domain_handle;
 111         uint32_t access_granted;
 112         uint32_t rid;
 113         DATA_BLOB session_key;
 114         struct lsa_String name;
 115
 116         int policy_min_pw_len = 0;
 117         struct test_join *join;
 118         char *random_pw;
 119
 120         join = talloc(NULL, struct test_join);
 121         if (join == NULL) {
 122                 return NULL;
 123         }
 124
 125         ZERO_STRUCTP(join);
 126
 127         printf("Connecting to SAMR\n");
 128
 129         status = torture_rpc_connection(join,
 130                                         &join->p,
 131                                         &dcerpc_table_samr);
 132         if (!NT_STATUS_IS_OK(status)) {
 133                 return NULL;
 134         }
 135
 136         c.in.system_name = NULL;
 137         c.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 138         c.out.connect_handle = &handle;
 139
 140         status = dcerpc_samr_Connect(join->p, join, &c);
 141         if (!NT_STATUS_IS_OK(status)) {
 142                 const char *errstr = nt_errstr(status);
 143                 if (NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
 144                         errstr = dcerpc_errstr(join, join->p->last_fault_code);
 145                 }
 146                 printf("samr_Connect failed - %s\n", errstr);
 147                 return NULL;
 148         }
 149
 150         printf("Opening domain %s\n", domain);
 151
 152         name.string = domain;
 153         l.in.connect_handle = &handle;
 154         l.in.domain_name = &name;
 155
 156         status = dcerpc_samr_LookupDomain(join->p, join, &l);
 157         if (!NT_STATUS_IS_OK(status)) {
 158                 printf("LookupDomain failed - %s\n", nt_errstr(status));
 159                 goto failed;
 160         }
 161
 162         join->dom_sid = dom_sid_string(join, l.out.sid);
 163
 164         o.in.connect_handle = &handle;
 165         o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 166         o.in.sid = l.out.sid;
 167         o.out.domain_handle = &domain_handle;
 168
 169         status = dcerpc_samr_OpenDomain(join->p, join, &o);
 170         if (!NT_STATUS_IS_OK(status)) {
 171                 printf("OpenDomain failed - %s\n", nt_errstr(status));
 172                 goto failed;
 173         }
 174
 175         printf("Creating account %s\n", username);
 176
 177 again:
 178         name.string = username;
 179         r.in.domain_handle = &domain_handle;
 180         r.in.account_name = &name;
 181         r.in.acct_flags = acct_type;
 182         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 183         r.out.user_handle = &join->user_handle;
 184         r.out.access_granted = &access_granted;
 185         r.out.rid = &rid;
 186
 187         status = dcerpc_samr_CreateUser2(join->p, join, &r);
 188
 189         if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
 190                 status = DeleteUser_byname(join->p, join, &domain_handle, name.string);
 191                 if (NT_STATUS_IS_OK(status)) {
 192                         goto again;
 193                 }
 194         }
 195
 196         if (!NT_STATUS_IS_OK(status)) {
 197                 printf("CreateUser2 failed - %s\n", nt_errstr(status));
 198                 goto failed;
 199         }
 200
 201         pwp.in.user_handle = &join->user_handle;
 202
 203         status = dcerpc_samr_GetUserPwInfo(join->p, join, &pwp);
 204         if (NT_STATUS_IS_OK(status)) {
 205                 policy_min_pw_len = pwp.out.info.min_password_length;
 206         }
 207
 208         random_pw = generate_random_str(join, MAX(8, policy_min_pw_len));
 209
 210         printf("Setting account password '%s'\n", random_pw);
 211
 212         s.in.user_handle = &join->user_handle;
 213         s.in.info = &u;
 214         s.in.level = 24;
 215
 216         encode_pw_buffer(u.info24.password.data, random_pw, STR_UNICODE);
 217         u.info24.pw_len = strlen(random_pw);
 218
 219         status = dcerpc_fetch_session_key(join->p, &session_key);
 220         if (!NT_STATUS_IS_OK(status)) {
 221                 printf("SetUserInfo level %u - no session key - %s\n",
 222                        s.in.level, nt_errstr(status));
 223                 torture_leave_domain(join);
 224                 goto failed;
 225         }
 226
 227         arcfour_crypt_blob(u.info24.password.data, 516, &session_key);
 228
 229         status = dcerpc_samr_SetUserInfo(join->p, join, &s);
 230         if (!NT_STATUS_IS_OK(status)) {
 231                 printf("SetUserInfo failed - %s\n", nt_errstr(status));
 232                 goto failed;
 233         }
 234
 235         ZERO_STRUCT(u);
 236         s.in.user_handle = &join->user_handle;
 237         s.in.info = &u;
 238         s.in.level = 21;
 239
 240         u.info21.acct_flags = acct_type;
 241         u.info21.fields_present = SAMR_FIELD_ACCT_FLAGS | SAMR_FIELD_DESCRIPTION | SAMR_FIELD_COMMENT | SAMR_FIELD_FULL_NAME;
 242
 243         u.info21.comment.string = talloc_asprintf(join,
 244                                                   "Tortured by Samba4: %s",
 245                                                   timestring(join, time(NULL)));
 246
 247         u.info21.full_name.string = talloc_asprintf(join,
 248                                                     "Torture account for Samba4: %s",
 249                                                     timestring(join, time(NULL)));
 250
 251         u.info21.description.string = talloc_asprintf(join,
 252                                          "Samba4 torture account created by host %s: %s",
 253                                          lp_netbios_name(), timestring(join, time(NULL)));
 254
 255         printf("Resetting ACB flags, force pw change time\n");
 256
 257         status = dcerpc_samr_SetUserInfo(join->p, join, &s);
 258         if (!NT_STATUS_IS_OK(status)) {
 259                 printf("SetUserInfo failed - %s\n", nt_errstr(status));
 260                 goto failed;
 261         }
 262
 263         if (random_password) {
 264                 *random_password = random_pw;
 265         }
 266
 267         return join;
 268
 269 failed:
 270         torture_leave_domain(join);
 271         return NULL;
 272 }
 273
 274
 275 struct test_join *torture_join_domain(const char *machine_name,
 276                                       uint32_t acct_flags,
 277                                       struct cli_credentials **machine_credentials)
 278 {
 279         NTSTATUS status;
 280         struct libnet_context *libnet_ctx;
 281         struct libnet_JoinDomain *libnet_r;
 282         struct test_join *tj;
 283         struct samr_SetUserInfo s;
 284         union samr_UserInfo u;
 285
 286         tj = talloc(NULL, struct test_join);
 287         if (!tj) return NULL;
 288
 289         libnet_r = talloc(tj, struct libnet_JoinDomain);
 290         if (!libnet_r) {
 291                 talloc_free(tj);
 292                 return NULL;
 293         }
 294
 295         libnet_ctx = libnet_context_init(NULL);
 296         if (!libnet_ctx) {
 297                 talloc_free(tj);
 298                 return NULL;
 299         }
 300
 301         tj->libnet_r = libnet_r;
 302
 303         libnet_ctx->cred = cmdline_credentials;
 304         libnet_r->in.binding = lp_parm_string(-1, "torture", "binding");
 305         if (!libnet_r->in.binding) {
 306                 libnet_r->in.binding = talloc_asprintf(libnet_r, "ncacn_np:%s", lp_parm_string(-1, "torture", "host"));
 307         }
 308         libnet_r->in.level = LIBNET_JOINDOMAIN_SPECIFIED;
 309         libnet_r->in.netbios_name = machine_name;
 310         libnet_r->in.account_name = talloc_asprintf(libnet_r, "%s$", machine_name);
 311         if (!libnet_r->in.account_name) {
 312                 talloc_free(tj);
 313                 return NULL;
 314         }
 315
 316         libnet_r->in.acct_type = acct_flags;
 317         libnet_r->in.recreate_account = True;
 318
 319         status = libnet_JoinDomain(libnet_ctx, libnet_r, libnet_r);
 320         if (!NT_STATUS_IS_OK(status)) {
 321                 if (libnet_r->out.error_string) {
 322                         DEBUG(0, ("Domain join failed - %s.\n", libnet_r->out.error_string));
 323                 } else {
 324                         DEBUG(0, ("Domain join failed - %s.\n", nt_errstr(status)));
 325                 }
 326                 talloc_free(tj);
 327                 return NULL;
 328         }
 329         tj->p = libnet_r->out.samr_pipe;
 330         tj->user_handle = *libnet_r->out.user_handle;
 331         tj->dom_sid = dom_sid_string(tj, libnet_r->out.domain_sid);
 332
 333         ZERO_STRUCT(u);
 334         s.in.user_handle = &tj->user_handle;
 335         s.in.info = &u;
 336         s.in.level = 21;
 337
 338         u.info21.fields_present = SAMR_FIELD_DESCRIPTION | SAMR_FIELD_COMMENT | SAMR_FIELD_FULL_NAME;
 339         u.info21.comment.string = talloc_asprintf(tj,
 340                                                   "Tortured by Samba4: %s",
 341                                                   timestring(tj, time(NULL)));
 342         u.info21.full_name.string = talloc_asprintf(tj,
 343                                                     "Torture account for Samba4: %s",
 344                                                     timestring(tj, time(NULL)));
 345
 346         u.info21.description.string = talloc_asprintf(tj,
 347                                                       "Samba4 torture account created by host %s: %s",
 348                                                       lp_netbios_name(), timestring(tj, time(NULL)));
 349
 350         status = dcerpc_samr_SetUserInfo(tj->p, tj, &s);
 351         if (!NT_STATUS_IS_OK(status)) {
 352                 printf("SetUserInfo (non-critical) failed - %s\n", nt_errstr(status));
 353         }
 354
 355         DEBUG(0, ("%s joined domain %s (%s).\n",
 356                   libnet_r->in.netbios_name,
 357                   libnet_r->out.domain_name,
 358                   tj->dom_sid));
 359
 360         *machine_credentials = cli_credentials_init(tj);
 361         cli_credentials_set_conf(*machine_credentials);
 362         cli_credentials_set_workstation(*machine_credentials, machine_name, CRED_SPECIFIED);
 363         cli_credentials_set_domain(*machine_credentials, libnet_r->out.domain_name, CRED_SPECIFIED);
 364         if (libnet_r->out.realm) {
 365                 cli_credentials_set_realm(*machine_credentials, libnet_r->out.realm, CRED_SPECIFIED);
 366         }
 367         cli_credentials_set_username(*machine_credentials, libnet_r->in.account_name, CRED_SPECIFIED);
 368         cli_credentials_set_password(*machine_credentials, libnet_r->out.join_password, CRED_SPECIFIED);
 369         if (acct_flags & ACB_SVRTRUST) {
 370                 cli_credentials_set_secure_channel_type(*machine_credentials,
 371                                                         SEC_CHAN_BDC);
 372         } else if (acct_flags & ACB_WSTRUST) {
 373                 cli_credentials_set_secure_channel_type(*machine_credentials,
 374                                                         SEC_CHAN_WKSTA);
 375         } else {
 376                 DEBUG(0, ("Invalid account type specificed to torture_join_domain\n"));
 377                 talloc_free(*machine_credentials);
 378                 return NULL;
 379         }
 380
 381         return tj;
 382 }
 383
 384 struct dcerpc_pipe *torture_join_samr_pipe(struct test_join *join)
 385 {
 386         return join->p;
 387 }
 388
 389 struct policy_handle *torture_join_samr_user_policy(struct test_join *join)
 390 {
 391         return &join->user_handle;
 392 }
 393
 394 NTSTATUS torture_leave_ads_domain(TALLOC_CTX *mem_ctx, struct libnet_JoinDomain *libnet_r)
 395 {
 396         int rtn;
 397         TALLOC_CTX *tmp_ctx;
 398
 399         struct ldb_dn *server_dn;
 400         struct ldb_context *ldb_ctx;
 401
 402         char *remote_ldb_url;
 403
 404         /* Check if we are a domain controller. If not, exit. */
 405         if (!libnet_r->out.server_dn_str) {
 406                 return NT_STATUS_OK;
 407         }
 408
 409         tmp_ctx = talloc_named(mem_ctx, 0, "torture_leave temporary context");
 410         if (!tmp_ctx) {
 411                 libnet_r->out.error_string = NULL;
 412                 return NT_STATUS_NO_MEMORY;
 413         }
 414
 415         ldb_ctx = ldb_init(tmp_ctx);
 416         if (!ldb_ctx) {
 417                 libnet_r->out.error_string = NULL;
 418                 talloc_free(tmp_ctx);
 419                 return NT_STATUS_NO_MEMORY;
 420         }
 421
 422         /* Remove CN=Servers,... entry from the AD. */
 423         server_dn = ldb_dn_explode(tmp_ctx, libnet_r->out.server_dn_str);
 424         if (!server_dn) {
 425                 libnet_r->out.error_string = NULL;
 426                 talloc_free(tmp_ctx);
 427                 return NT_STATUS_NO_MEMORY;
 428         }
 429
 430         remote_ldb_url = talloc_asprintf(tmp_ctx, "ldap://%s", libnet_r->out.samr_binding->host);
 431         if (!remote_ldb_url) {
 432                 libnet_r->out.error_string = NULL;
 433                 talloc_free(tmp_ctx);
 434                 return NT_STATUS_NO_MEMORY;
 435         }
 436
 437         rtn = ldb_connect(ldb_ctx, remote_ldb_url, 0, NULL);
 438         if (rtn != 0) {
 439                 libnet_r->out.error_string = NULL;
 440                 talloc_free(tmp_ctx);
 441                 return NT_STATUS_UNSUCCESSFUL;
 442         }
 443
 444         rtn = ldb_delete(ldb_ctx, server_dn);
 445         if (rtn != 0) {
 446                 libnet_r->out.error_string = NULL;
 447                 talloc_free(tmp_ctx);
 448                 return NT_STATUS_UNSUCCESSFUL;
 449         }
 450
 451         DEBUG(0, ("%s removed successfully.\n", libnet_r->out.server_dn_str));
 452
 453         talloc_free(tmp_ctx);
 454         return NT_STATUS_OK;
 455 }
 456
 457 /*
 458   leave the domain, deleting the machine acct
 459 */
 460
 461 void torture_leave_domain(struct test_join *join)
 462 {
 463         struct samr_DeleteUser d;
 464         NTSTATUS status;
 465
 466         if (!join) {
 467                 return;
 468         }
 469         d.in.user_handle = &join->user_handle;
 470         d.out.user_handle = &join->user_handle;
 471
 472         /* Delete machine account */
 473         status = dcerpc_samr_DeleteUser(join->p, join, &d);
 474         if (!NT_STATUS_IS_OK(status)) {
 475                 printf("Delete of machine account failed\n");
 476         } else {
 477                 printf("Delete of machine account was successful.\n");
 478         }
 479
 480         if (join->libnet_r) {
 481                 status = torture_leave_ads_domain(join, join->libnet_r);
 482         }
 483
 484         talloc_free(join);
 485 }
 486
 487 /*
 488   return the dom sid for a test join
 489 */
 490 const char *torture_join_sid(struct test_join *join)
 491 {
 492         return join->dom_sid;
 493 }
 494
 495
 496 struct test_join_ads_dc {
 497         struct test_join *join;
 498 };
 499
 500 struct test_join_ads_dc *torture_join_domain_ads_dc(const char *machine_name,
 501                                                     const char *domain,
 502                                                     struct cli_credentials **machine_credentials)
 503 {
 504         struct test_join_ads_dc *join;
 505
 506         join = talloc(NULL, struct test_join_ads_dc);
 507         if (join == NULL) {
 508                 return NULL;
 509         }
 510
 511         join->join = torture_join_domain(machine_name,
 512                                         ACB_SVRTRUST,
 513                                         machine_credentials);
 514
 515         if (!join->join) {
 516                 return NULL;
 517         }
 518
 519         /* do netlogon DrsEnumerateDomainTrusts */
 520
 521         /* modify userAccountControl from 4096 to 532480 */
 522
 523         /* modify RDN to OU=Domain Controllers and skip the $ from server name */
 524
 525         /* ask objectVersion of Schema Partition */
 526
 527         /* ask rIDManagerReferenz of the Domain Partition */
 528
 529         /* ask fsMORoleOwner of the RID-Manager$ object
 530          * returns CN=NTDS Settings,CN=<DC>,CN=Servers,CN=Default-First-Site-Name, ...
 531          */
 532
 533         /* ask for dnsHostName of CN=<DC>,CN=Servers,CN=Default-First-Site-Name, ... */
 534
 535         /* ask for objectGUID of CN=NTDS Settings,CN=<DC>,CN=Servers,CN=Default-First-Site-Name, ... */
 536
 537         /* ask for * of CN=Default-First-Site-Name, ... */
 538
 539         /* search (&(|(objectClass=user)(objectClass=computer))(sAMAccountName=<machine_name>$)) in Domain Partition
 540          * attributes : distinguishedName, userAccountControl
 541          */
 542
 543         /* ask * for CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
 544          * should fail with noSuchObject
 545          */
 546
 547         /* add CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
 548          *
 549          * objectClass = server
 550          * systemFlags = 50000000
 551          * serverReferenz = CN=<machine_name>,OU=Domain Controllers,...
 552          */
 553
 554         /* ask for * of CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
 555          * should fail with noSuchObject
 556          */
 557
 558         /* search for (ncname=<domain_nc>) in CN=Partitions,CN=Configuration,...
 559          * attributes: ncName, dnsRoot
 560          */
 561
 562         /* modify add CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
 563          * serverReferenz = CN=<machine_name>,OU=Domain Controllers,...
 564          * should fail with attributeOrValueExists
 565          */
 566
 567         /* modify replace CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
 568          * serverReferenz = CN=<machine_name>,OU=Domain Controllers,...
 569          */
 570
 571         /* DsReplicaAdd to create the CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
 572          * needs to be tested
 573          */
 574
 575         return join;
 576 }
 577
 578 void torture_leave_domain_ads_dc(struct test_join_ads_dc *join)
 579 {
 580
 581         if (join->join) {
 582                 torture_leave_domain(join->join);
 583         }
 584
 585         talloc_free(join);
 586 }