2 Unix SMB/CIFS implementation.
4 utility code to join/leave a domain
6 Copyright (C) Andrew Tridgell 2004
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 this code is used by other torture modules to join/leave a domain
24 as either a member, bdc or thru a trust relationship
28 #include "torture/torture.h"
29 #include "system/time.h"
30 #include "lib/crypto/crypto.h"
31 #include "libnet/libnet.h"
32 #include "lib/cmdline/popt_common.h"
33 #include "lib/ldb/include/ldb.h"
34 #include "librpc/gen_ndr/ndr_samr_c.h"
36 #include "libcli/auth/libcli_auth.h"
37 #include "torture/rpc/rpc.h"
38 #include "libcli/security/security.h"
39 #include "param/param.h"
42 struct dcerpc_pipe *p;
43 struct policy_handle user_handle;
44 struct libnet_JoinDomain *libnet_r;
45 struct dom_sid *dom_sid;
46 const char *dom_netbios_name;
47 const char *dom_dns_name;
48 struct dom_sid *user_sid;
49 struct GUID user_guid;
50 const char *netbios_name;
54 static NTSTATUS DeleteUser_byname(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
55 struct policy_handle *handle, const char *name)
58 struct samr_DeleteUser d;
59 struct policy_handle user_handle;
61 struct samr_LookupNames n;
62 struct lsa_String sname;
63 struct samr_OpenUser r;
67 n.in.domain_handle = handle;
71 status = dcerpc_samr_LookupNames(p, mem_ctx, &n);
72 if (NT_STATUS_IS_OK(status)) {
73 rid = n.out.rids.ids[0];
78 r.in.domain_handle = handle;
79 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
81 r.out.user_handle = &user_handle;
83 status = dcerpc_samr_OpenUser(p, mem_ctx, &r);
84 if (!NT_STATUS_IS_OK(status)) {
85 printf("OpenUser(%s) failed - %s\n", name, nt_errstr(status));
89 d.in.user_handle = &user_handle;
90 d.out.user_handle = &user_handle;
91 status = dcerpc_samr_DeleteUser(p, mem_ctx, &d);
92 if (!NT_STATUS_IS_OK(status)) {
100 create a test user in the domain
101 an opaque pointer is returned. Pass it to torture_leave_domain()
105 struct test_join *torture_create_testuser(struct torture_context *torture,
106 const char *username,
109 const char **random_password)
112 struct samr_Connect c;
113 struct samr_CreateUser2 r;
114 struct samr_OpenDomain o;
115 struct samr_LookupDomain l;
116 struct samr_GetUserPwInfo pwp;
117 struct samr_SetUserInfo s;
118 union samr_UserInfo u;
119 struct policy_handle handle;
120 struct policy_handle domain_handle;
121 uint32_t access_granted;
123 DATA_BLOB session_key;
124 struct lsa_String name;
126 int policy_min_pw_len = 0;
127 struct test_join *join;
129 const char *dc_binding = lp_parm_string(global_loadparm, NULL, "torture", "dc_binding");
131 join = talloc(NULL, struct test_join);
138 printf("Connecting to SAMR\n");
141 status = dcerpc_pipe_connect(join,
145 cmdline_credentials, NULL);
148 status = torture_rpc_connection(torture,
152 if (!NT_STATUS_IS_OK(status)) {
156 c.in.system_name = NULL;
157 c.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
158 c.out.connect_handle = &handle;
160 status = dcerpc_samr_Connect(join->p, join, &c);
161 if (!NT_STATUS_IS_OK(status)) {
162 const char *errstr = nt_errstr(status);
163 if (NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
164 errstr = dcerpc_errstr(join, join->p->last_fault_code);
166 printf("samr_Connect failed - %s\n", errstr);
170 printf("Opening domain %s\n", domain);
172 name.string = domain;
173 l.in.connect_handle = &handle;
174 l.in.domain_name = &name;
176 status = dcerpc_samr_LookupDomain(join->p, join, &l);
177 if (!NT_STATUS_IS_OK(status)) {
178 printf("LookupDomain failed - %s\n", nt_errstr(status));
182 talloc_steal(join, l.out.sid);
183 join->dom_sid = l.out.sid;
184 join->dom_netbios_name = talloc_strdup(join, domain);
185 if (!join->dom_netbios_name) goto failed;
187 o.in.connect_handle = &handle;
188 o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
189 o.in.sid = l.out.sid;
190 o.out.domain_handle = &domain_handle;
192 status = dcerpc_samr_OpenDomain(join->p, join, &o);
193 if (!NT_STATUS_IS_OK(status)) {
194 printf("OpenDomain failed - %s\n", nt_errstr(status));
198 printf("Creating account %s\n", username);
201 name.string = username;
202 r.in.domain_handle = &domain_handle;
203 r.in.account_name = &name;
204 r.in.acct_flags = acct_type;
205 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
206 r.out.user_handle = &join->user_handle;
207 r.out.access_granted = &access_granted;
210 status = dcerpc_samr_CreateUser2(join->p, join, &r);
212 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
213 status = DeleteUser_byname(join->p, join, &domain_handle, name.string);
214 if (NT_STATUS_IS_OK(status)) {
219 if (!NT_STATUS_IS_OK(status)) {
220 printf("CreateUser2 failed - %s\n", nt_errstr(status));
224 join->user_sid = dom_sid_add_rid(join, join->dom_sid, rid);
226 pwp.in.user_handle = &join->user_handle;
228 status = dcerpc_samr_GetUserPwInfo(join->p, join, &pwp);
229 if (NT_STATUS_IS_OK(status)) {
230 policy_min_pw_len = pwp.out.info.min_password_length;
233 random_pw = generate_random_str(join, MAX(8, policy_min_pw_len));
235 printf("Setting account password '%s'\n", random_pw);
238 s.in.user_handle = &join->user_handle;
242 encode_pw_buffer(u.info24.password.data, random_pw, STR_UNICODE);
243 u.info24.pw_len = strlen(random_pw);
245 status = dcerpc_fetch_session_key(join->p, &session_key);
246 if (!NT_STATUS_IS_OK(status)) {
247 printf("SetUserInfo level %u - no session key - %s\n",
248 s.in.level, nt_errstr(status));
249 torture_leave_domain(join);
253 arcfour_crypt_blob(u.info24.password.data, 516, &session_key);
255 status = dcerpc_samr_SetUserInfo(join->p, join, &s);
256 if (!NT_STATUS_IS_OK(status)) {
257 printf("SetUserInfo failed - %s\n", nt_errstr(status));
262 s.in.user_handle = &join->user_handle;
266 u.info21.acct_flags = acct_type | ACB_PWNOEXP;
267 u.info21.fields_present = SAMR_FIELD_ACCT_FLAGS | SAMR_FIELD_DESCRIPTION | SAMR_FIELD_COMMENT | SAMR_FIELD_FULL_NAME;
269 u.info21.comment.string = talloc_asprintf(join,
270 "Tortured by Samba4: %s",
271 timestring(join, time(NULL)));
273 u.info21.full_name.string = talloc_asprintf(join,
274 "Torture account for Samba4: %s",
275 timestring(join, time(NULL)));
277 u.info21.description.string = talloc_asprintf(join,
278 "Samba4 torture account created by host %s: %s",
279 lp_netbios_name(global_loadparm),
280 timestring(join, time(NULL)));
282 printf("Resetting ACB flags, force pw change time\n");
284 status = dcerpc_samr_SetUserInfo(join->p, join, &s);
285 if (!NT_STATUS_IS_OK(status)) {
286 printf("SetUserInfo failed - %s\n", nt_errstr(status));
290 if (random_password) {
291 *random_password = random_pw;
297 torture_leave_domain(join);
302 _PUBLIC_ struct test_join *torture_join_domain(const char *machine_name,
304 struct cli_credentials **machine_credentials)
307 struct libnet_context *libnet_ctx;
308 struct libnet_JoinDomain *libnet_r;
309 struct test_join *tj;
310 struct samr_SetUserInfo s;
311 union samr_UserInfo u;
313 tj = talloc(NULL, struct test_join);
314 if (!tj) return NULL;
316 libnet_r = talloc(tj, struct libnet_JoinDomain);
322 libnet_ctx = libnet_context_init(NULL);
328 tj->libnet_r = libnet_r;
330 libnet_ctx->cred = cmdline_credentials;
331 libnet_r->in.binding = lp_parm_string(global_loadparm, NULL, "torture", "binding");
332 if (!libnet_r->in.binding) {
333 libnet_r->in.binding = talloc_asprintf(libnet_r, "ncacn_np:%s", lp_parm_string(global_loadparm, NULL, "torture", "host"));
335 libnet_r->in.level = LIBNET_JOINDOMAIN_SPECIFIED;
336 libnet_r->in.netbios_name = machine_name;
337 libnet_r->in.account_name = talloc_asprintf(libnet_r, "%s$", machine_name);
338 if (!libnet_r->in.account_name) {
343 libnet_r->in.acct_type = acct_flags;
344 libnet_r->in.recreate_account = true;
346 status = libnet_JoinDomain(libnet_ctx, libnet_r, libnet_r);
347 if (!NT_STATUS_IS_OK(status)) {
348 if (libnet_r->out.error_string) {
349 DEBUG(0, ("Domain join failed - %s\n", libnet_r->out.error_string));
351 DEBUG(0, ("Domain join failed - %s\n", nt_errstr(status)));
356 tj->p = libnet_r->out.samr_pipe;
357 tj->user_handle = *libnet_r->out.user_handle;
358 tj->dom_sid = libnet_r->out.domain_sid;
359 talloc_steal(tj, libnet_r->out.domain_sid);
360 tj->dom_netbios_name = libnet_r->out.domain_name;
361 talloc_steal(tj, libnet_r->out.domain_name);
362 tj->dom_dns_name = libnet_r->out.realm;
363 talloc_steal(tj, libnet_r->out.realm);
364 tj->user_guid = libnet_r->out.account_guid;
365 tj->netbios_name = talloc_strdup(tj, machine_name);
366 if (!tj->netbios_name) {
372 s.in.user_handle = &tj->user_handle;
376 u.info21.fields_present = SAMR_FIELD_DESCRIPTION | SAMR_FIELD_COMMENT | SAMR_FIELD_FULL_NAME;
377 u.info21.comment.string = talloc_asprintf(tj,
378 "Tortured by Samba4: %s",
379 timestring(tj, time(NULL)));
380 u.info21.full_name.string = talloc_asprintf(tj,
381 "Torture account for Samba4: %s",
382 timestring(tj, time(NULL)));
384 u.info21.description.string = talloc_asprintf(tj,
385 "Samba4 torture account created by host %s: %s",
386 lp_netbios_name(global_loadparm), timestring(tj, time(NULL)));
388 status = dcerpc_samr_SetUserInfo(tj->p, tj, &s);
389 if (!NT_STATUS_IS_OK(status)) {
390 printf("SetUserInfo (non-critical) failed - %s\n", nt_errstr(status));
393 *machine_credentials = cli_credentials_init(tj);
394 cli_credentials_set_conf(*machine_credentials, global_loadparm);
395 cli_credentials_set_workstation(*machine_credentials, machine_name, CRED_SPECIFIED);
396 cli_credentials_set_domain(*machine_credentials, libnet_r->out.domain_name, CRED_SPECIFIED);
397 if (libnet_r->out.realm) {
398 cli_credentials_set_realm(*machine_credentials, libnet_r->out.realm, CRED_SPECIFIED);
400 cli_credentials_set_username(*machine_credentials, libnet_r->in.account_name, CRED_SPECIFIED);
401 cli_credentials_set_password(*machine_credentials, libnet_r->out.join_password, CRED_SPECIFIED);
402 if (acct_flags & ACB_SVRTRUST) {
403 cli_credentials_set_secure_channel_type(*machine_credentials,
405 } else if (acct_flags & ACB_WSTRUST) {
406 cli_credentials_set_secure_channel_type(*machine_credentials,
409 DEBUG(0, ("Invalid account type specificed to torture_join_domain\n"));
410 talloc_free(*machine_credentials);
417 struct dcerpc_pipe *torture_join_samr_pipe(struct test_join *join)
422 struct policy_handle *torture_join_samr_user_policy(struct test_join *join)
424 return &join->user_handle;
427 static NTSTATUS torture_leave_ads_domain(TALLOC_CTX *mem_ctx, struct libnet_JoinDomain *libnet_r)
432 struct ldb_dn *server_dn;
433 struct ldb_context *ldb_ctx;
435 char *remote_ldb_url;
437 /* Check if we are a domain controller. If not, exit. */
438 if (!libnet_r->out.server_dn_str) {
442 tmp_ctx = talloc_named(mem_ctx, 0, "torture_leave temporary context");
444 libnet_r->out.error_string = NULL;
445 return NT_STATUS_NO_MEMORY;
448 ldb_ctx = ldb_init(tmp_ctx);
450 libnet_r->out.error_string = NULL;
451 talloc_free(tmp_ctx);
452 return NT_STATUS_NO_MEMORY;
455 /* Remove CN=Servers,... entry from the AD. */
456 server_dn = ldb_dn_new(tmp_ctx, ldb_ctx, libnet_r->out.server_dn_str);
457 if (! ldb_dn_validate(server_dn)) {
458 libnet_r->out.error_string = NULL;
459 talloc_free(tmp_ctx);
460 return NT_STATUS_NO_MEMORY;
463 remote_ldb_url = talloc_asprintf(tmp_ctx, "ldap://%s", libnet_r->out.samr_binding->host);
464 if (!remote_ldb_url) {
465 libnet_r->out.error_string = NULL;
466 talloc_free(tmp_ctx);
467 return NT_STATUS_NO_MEMORY;
470 ldb_set_opaque(ldb_ctx, "credentials", cmdline_credentials);
472 rtn = ldb_connect(ldb_ctx, remote_ldb_url, 0, NULL);
474 libnet_r->out.error_string = NULL;
475 talloc_free(tmp_ctx);
476 return NT_STATUS_UNSUCCESSFUL;
479 rtn = ldb_delete(ldb_ctx, server_dn);
481 libnet_r->out.error_string = NULL;
482 talloc_free(tmp_ctx);
483 return NT_STATUS_UNSUCCESSFUL;
486 DEBUG(0, ("%s removed successfully.\n", libnet_r->out.server_dn_str));
488 talloc_free(tmp_ctx);
493 leave the domain, deleting the machine acct
496 _PUBLIC_ void torture_leave_domain(struct test_join *join)
498 struct samr_DeleteUser d;
504 d.in.user_handle = &join->user_handle;
505 d.out.user_handle = &join->user_handle;
507 /* Delete machine account */
508 status = dcerpc_samr_DeleteUser(join->p, join, &d);
509 if (!NT_STATUS_IS_OK(status)) {
510 printf("Delete of machine account failed\n");
512 printf("Delete of machine account was successful.\n");
515 if (join->libnet_r) {
516 status = torture_leave_ads_domain(join, join->libnet_r);
523 return the dom sid for a test join
525 _PUBLIC_ const struct dom_sid *torture_join_sid(struct test_join *join)
527 return join->dom_sid;
530 const struct dom_sid *torture_join_user_sid(struct test_join *join)
532 return join->user_sid;
535 const char *torture_join_netbios_name(struct test_join *join)
537 return join->netbios_name;
540 const struct GUID *torture_join_user_guid(struct test_join *join)
542 return &join->user_guid;
545 const char *torture_join_dom_netbios_name(struct test_join *join)
547 return join->dom_netbios_name;
550 const char *torture_join_dom_dns_name(struct test_join *join)
552 return join->dom_dns_name;
556 #if 0 /* Left as the documentation of the join process, but see new implementation in libnet_become_dc.c */
557 struct test_join_ads_dc {
558 struct test_join *join;
561 struct test_join_ads_dc *torture_join_domain_ads_dc(const char *machine_name,
563 struct cli_credentials **machine_credentials)
565 struct test_join_ads_dc *join;
567 join = talloc(NULL, struct test_join_ads_dc);
572 join->join = torture_join_domain(machine_name,
574 machine_credentials);
581 /* W2K: modify userAccountControl from 4096 to 532480 */
583 /* W2K: modify RDN to OU=Domain Controllers and skip the $ from server name */
585 /* ask objectVersion of Schema Partition */
587 /* ask rIDManagerReferenz of the Domain Partition */
589 /* ask fsMORoleOwner of the RID-Manager$ object
590 * returns CN=NTDS Settings,CN=<DC>,CN=Servers,CN=Default-First-Site-Name, ...
593 /* ask for dnsHostName of CN=<DC>,CN=Servers,CN=Default-First-Site-Name, ... */
595 /* ask for objectGUID of CN=NTDS Settings,CN=<DC>,CN=Servers,CN=Default-First-Site-Name, ... */
597 /* ask for * of CN=Default-First-Site-Name, ... */
599 /* search (&(|(objectClass=user)(objectClass=computer))(sAMAccountName=<machine_name>$)) in Domain Partition
600 * attributes : distinguishedName, userAccountControl
603 /* ask * for CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
604 * should fail with noSuchObject
607 /* add CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
609 * objectClass = server
610 * systemFlags = 50000000
611 * serverReferenz = CN=<machine_name>,OU=Domain Controllers,...
614 /* ask for * of CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
615 * should fail with noSuchObject
618 /* search for (ncname=<domain_nc>) in CN=Partitions,CN=Configuration,...
619 * attributes: ncName, dnsRoot
622 /* modify add CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
623 * serverReferenz = CN=<machine_name>,OU=Domain Controllers,...
624 * should fail with attributeOrValueExists
627 /* modify replace CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
628 * serverReferenz = CN=<machine_name>,OU=Domain Controllers,...
631 /* DsAddEntry to create the CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
635 /* replicate CN=Schema,CN=Configuration,...
636 * using DRSUAPI_DS_BIND_GUID_W2K ("6abec3d1-3054-41c8-a362-5a0c5b7d5d71")
640 /* replicate CN=Configuration,...
641 * using DRSUAPI_DS_BIND_GUID_W2K ("6abec3d1-3054-41c8-a362-5a0c5b7d5d71")
645 /* replicate Domain Partition
646 * using DRSUAPI_DS_BIND_GUID_W2K ("6abec3d1-3054-41c8-a362-5a0c5b7d5d71")
650 /* call DsReplicaUpdateRefs() for all partitions like this:
651 * req1: struct drsuapi_DsReplicaUpdateRefsRequest1
653 * naming_context: struct drsuapi_DsReplicaObjectIdentifier
654 * __ndr_size : 0x000000ae (174)
655 * __ndr_size_sid : 0x00000000 (0)
656 * guid : 00000000-0000-0000-0000-000000000000
658 * dn : 'CN=Schema,CN=Configuration,DC=w2k3,DC=vmnet1,DC=vm,DC=base'
659 * dest_dsa_dns_name : *
660 * dest_dsa_dns_name : '4a0df188-a0b8-47ea-bbe5-e614723f16dd._msdcs.w2k3.vmnet1.vm.base'
661 * dest_dsa_guid : 4a0df188-a0b8-47ea-bbe5-e614723f16dd
662 * options : 0x0000001c (28)
663 * 0: DRSUAPI_DS_REPLICA_UPDATE_ASYNCHRONOUS_OPERATION
664 * 0: DRSUAPI_DS_REPLICA_UPDATE_WRITEABLE
665 * 1: DRSUAPI_DS_REPLICA_UPDATE_ADD_REFERENCE
666 * 1: DRSUAPI_DS_REPLICA_UPDATE_DELETE_REFERENCE
667 * 1: DRSUAPI_DS_REPLICA_UPDATE_0x00000010
669 * 4a0df188-a0b8-47ea-bbe5-e614723f16dd is the objectGUID the DsAddEntry() returned for the
670 * CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
673 /* W2K3: see libnet/libnet_become_dc.c */