source4/torture/rpc/testjoin.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    utility code to join/leave a domain
   5
   6    Copyright (C) Andrew Tridgell 2004
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 2 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program; if not, write to the Free Software
  20    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21 */
  22
  23 /*
  24   this code is used by other torture modules to join/leave a domain
  25   as either a member, bdc or thru a trust relationship
  26 */
  27
  28 #include "includes.h"
  29 #include "torture/torture.h"
  30 #include "system/time.h"
  31 #include "lib/crypto/crypto.h"
  32 #include "libnet/libnet.h"
  33 #include "lib/cmdline/popt_common.h"
  34 #include "smb.h"
  35 #include "lib/ldb/include/ldb.h"
  36 #include "librpc/gen_ndr/ndr_samr.h"
  37 #include "librpc/gen_ndr/ndr_samr_c.h"
  38
  39 #include "libcli/auth/libcli_auth.h"
  40 #include "torture/rpc/rpc.h"
  41 #include "libcli/security/proto.h"
  42
  43 struct test_join {
  44         struct dcerpc_pipe *p;
  45         struct policy_handle user_handle;
  46         struct libnet_JoinDomain *libnet_r;
  47         struct dom_sid *dom_sid;
  48         struct dom_sid *user_sid;
  49 };
  50
  51
  52 static NTSTATUS DeleteUser_byname(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
  53                                   struct policy_handle *handle, const char *name)
  54 {
  55         NTSTATUS status;
  56         struct samr_DeleteUser d;
  57         struct policy_handle user_handle;
  58         uint32_t rid;
  59         struct samr_LookupNames n;
  60         struct lsa_String sname;
  61         struct samr_OpenUser r;
  62
  63         sname.string = name;
  64
  65         n.in.domain_handle = handle;
  66         n.in.num_names = 1;
  67         n.in.names = &sname;
  68
  69         status = dcerpc_samr_LookupNames(p, mem_ctx, &n);
  70         if (NT_STATUS_IS_OK(status)) {
  71                 rid = n.out.rids.ids[0];
  72         } else {
  73                 return status;
  74         }
  75
  76         r.in.domain_handle = handle;
  77         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
  78         r.in.rid = rid;
  79         r.out.user_handle = &user_handle;
  80
  81         status = dcerpc_samr_OpenUser(p, mem_ctx, &r);
  82         if (!NT_STATUS_IS_OK(status)) {
  83                 printf("OpenUser(%s) failed - %s\n", name, nt_errstr(status));
  84                 return status;
  85         }
  86
  87         d.in.user_handle = &user_handle;
  88         d.out.user_handle = &user_handle;
  89         status = dcerpc_samr_DeleteUser(p, mem_ctx, &d);
  90         if (!NT_STATUS_IS_OK(status)) {
  91                 return status;
  92         }
  93
  94         return NT_STATUS_OK;
  95 }
  96
  97 /*
  98   create a test user in the domain
  99   an opaque pointer is returned. Pass it to torture_leave_domain()
 100   when finished
 101 */
 102
 103 struct test_join *torture_create_testuser(const char *username,
 104                                           const char *domain,
 105                                           uint16_t acct_type,
 106                                           const char **random_password)
 107 {
 108         NTSTATUS status;
 109         struct samr_Connect c;
 110         struct samr_CreateUser2 r;
 111         struct samr_OpenDomain o;
 112         struct samr_LookupDomain l;
 113         struct samr_GetUserPwInfo pwp;
 114         struct samr_SetUserInfo s;
 115         union samr_UserInfo u;
 116         struct policy_handle handle;
 117         struct policy_handle domain_handle;
 118         uint32_t access_granted;
 119         uint32_t rid;
 120         DATA_BLOB session_key;
 121         struct lsa_String name;
 122
 123         int policy_min_pw_len = 0;
 124         struct test_join *join;
 125         char *random_pw;
 126
 127         join = talloc(NULL, struct test_join);
 128         if (join == NULL) {
 129                 return NULL;
 130         }
 131
 132         ZERO_STRUCTP(join);
 133
 134         printf("Connecting to SAMR\n");
 135
 136         status = torture_rpc_connection(join,
 137                                         &join->p,
 138                                         &dcerpc_table_samr);
 139         if (!NT_STATUS_IS_OK(status)) {
 140                 return NULL;
 141         }
 142
 143         c.in.system_name = NULL;
 144         c.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 145         c.out.connect_handle = &handle;
 146
 147         status = dcerpc_samr_Connect(join->p, join, &c);
 148         if (!NT_STATUS_IS_OK(status)) {
 149                 const char *errstr = nt_errstr(status);
 150                 if (NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
 151                         errstr = dcerpc_errstr(join, join->p->last_fault_code);
 152                 }
 153                 printf("samr_Connect failed - %s\n", errstr);
 154                 return NULL;
 155         }
 156
 157         printf("Opening domain %s\n", domain);
 158
 159         name.string = domain;
 160         l.in.connect_handle = &handle;
 161         l.in.domain_name = &name;
 162
 163         status = dcerpc_samr_LookupDomain(join->p, join, &l);
 164         if (!NT_STATUS_IS_OK(status)) {
 165                 printf("LookupDomain failed - %s\n", nt_errstr(status));
 166                 goto failed;
 167         }
 168
 169         talloc_steal(join, l.out.sid);
 170         join->dom_sid = l.out.sid;
 171
 172         o.in.connect_handle = &handle;
 173         o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 174         o.in.sid = l.out.sid;
 175         o.out.domain_handle = &domain_handle;
 176
 177         status = dcerpc_samr_OpenDomain(join->p, join, &o);
 178         if (!NT_STATUS_IS_OK(status)) {
 179                 printf("OpenDomain failed - %s\n", nt_errstr(status));
 180                 goto failed;
 181         }
 182
 183         printf("Creating account %s\n", username);
 184
 185 again:
 186         name.string = username;
 187         r.in.domain_handle = &domain_handle;
 188         r.in.account_name = &name;
 189         r.in.acct_flags = acct_type;
 190         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 191         r.out.user_handle = &join->user_handle;
 192         r.out.access_granted = &access_granted;
 193         r.out.rid = &rid;
 194
 195         status = dcerpc_samr_CreateUser2(join->p, join, &r);
 196
 197         if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
 198                 status = DeleteUser_byname(join->p, join, &domain_handle, name.string);
 199                 if (NT_STATUS_IS_OK(status)) {
 200                         goto again;
 201                 }
 202         }
 203
 204         if (!NT_STATUS_IS_OK(status)) {
 205                 printf("CreateUser2 failed - %s\n", nt_errstr(status));
 206                 goto failed;
 207         }
 208
 209         join->user_sid = dom_sid_add_rid(join, join->dom_sid, rid);
 210
 211         pwp.in.user_handle = &join->user_handle;
 212
 213         status = dcerpc_samr_GetUserPwInfo(join->p, join, &pwp);
 214         if (NT_STATUS_IS_OK(status)) {
 215                 policy_min_pw_len = pwp.out.info.min_password_length;
 216         }
 217
 218         random_pw = generate_random_str(join, MAX(8, policy_min_pw_len));
 219
 220         printf("Setting account password '%s'\n", random_pw);
 221
 222         s.in.user_handle = &join->user_handle;
 223         s.in.info = &u;
 224         s.in.level = 24;
 225
 226         encode_pw_buffer(u.info24.password.data, random_pw, STR_UNICODE);
 227         u.info24.pw_len = strlen(random_pw);
 228
 229         status = dcerpc_fetch_session_key(join->p, &session_key);
 230         if (!NT_STATUS_IS_OK(status)) {
 231                 printf("SetUserInfo level %u - no session key - %s\n",
 232                        s.in.level, nt_errstr(status));
 233                 torture_leave_domain(join);
 234                 goto failed;
 235         }
 236
 237         arcfour_crypt_blob(u.info24.password.data, 516, &session_key);
 238
 239         status = dcerpc_samr_SetUserInfo(join->p, join, &s);
 240         if (!NT_STATUS_IS_OK(status)) {
 241                 printf("SetUserInfo failed - %s\n", nt_errstr(status));
 242                 goto failed;
 243         }
 244
 245         ZERO_STRUCT(u);
 246         s.in.user_handle = &join->user_handle;
 247         s.in.info = &u;
 248         s.in.level = 21;
 249
 250         u.info21.acct_flags = acct_type;
 251         u.info21.fields_present = SAMR_FIELD_ACCT_FLAGS | SAMR_FIELD_DESCRIPTION | SAMR_FIELD_COMMENT | SAMR_FIELD_FULL_NAME;
 252
 253         u.info21.comment.string = talloc_asprintf(join,
 254                                                   "Tortured by Samba4: %s",
 255                                                   timestring(join, time(NULL)));
 256
 257         u.info21.full_name.string = talloc_asprintf(join,
 258                                                     "Torture account for Samba4: %s",
 259                                                     timestring(join, time(NULL)));
 260
 261         u.info21.description.string = talloc_asprintf(join,
 262                                          "Samba4 torture account created by host %s: %s",
 263                                          lp_netbios_name(), timestring(join, time(NULL)));
 264
 265         printf("Resetting ACB flags, force pw change time\n");
 266
 267         status = dcerpc_samr_SetUserInfo(join->p, join, &s);
 268         if (!NT_STATUS_IS_OK(status)) {
 269                 printf("SetUserInfo failed - %s\n", nt_errstr(status));
 270                 goto failed;
 271         }
 272
 273         if (random_password) {
 274                 *random_password = random_pw;
 275         }
 276
 277         return join;
 278
 279 failed:
 280         torture_leave_domain(join);
 281         return NULL;
 282 }
 283
 284
 285 struct test_join *torture_join_domain(const char *machine_name,
 286                                       uint32_t acct_flags,
 287                                       struct cli_credentials **machine_credentials)
 288 {
 289         NTSTATUS status;
 290         struct libnet_context *libnet_ctx;
 291         struct libnet_JoinDomain *libnet_r;
 292         struct test_join *tj;
 293         struct samr_SetUserInfo s;
 294         union samr_UserInfo u;
 295
 296         tj = talloc(NULL, struct test_join);
 297         if (!tj) return NULL;
 298
 299         libnet_r = talloc(tj, struct libnet_JoinDomain);
 300         if (!libnet_r) {
 301                 talloc_free(tj);
 302                 return NULL;
 303         }
 304
 305         libnet_ctx = libnet_context_init(NULL);
 306         if (!libnet_ctx) {
 307                 talloc_free(tj);
 308                 return NULL;
 309         }
 310
 311         tj->libnet_r = libnet_r;
 312
 313         libnet_ctx->cred = cmdline_credentials;
 314         libnet_r->in.binding = lp_parm_string(-1, "torture", "binding");
 315         if (!libnet_r->in.binding) {
 316                 libnet_r->in.binding = talloc_asprintf(libnet_r, "ncacn_np:%s", lp_parm_string(-1, "torture", "host"));
 317         }
 318         libnet_r->in.level = LIBNET_JOINDOMAIN_SPECIFIED;
 319         libnet_r->in.netbios_name = machine_name;
 320         libnet_r->in.account_name = talloc_asprintf(libnet_r, "%s$", machine_name);
 321         if (!libnet_r->in.account_name) {
 322                 talloc_free(tj);
 323                 return NULL;
 324         }
 325
 326         libnet_r->in.acct_type = acct_flags;
 327         libnet_r->in.recreate_account = True;
 328
 329         status = libnet_JoinDomain(libnet_ctx, libnet_r, libnet_r);
 330         if (!NT_STATUS_IS_OK(status)) {
 331                 if (libnet_r->out.error_string) {
 332                         DEBUG(0, ("Domain join failed - %s.\n", libnet_r->out.error_string));
 333                 } else {
 334                         DEBUG(0, ("Domain join failed - %s.\n", nt_errstr(status)));
 335                 }
 336                 talloc_free(tj);
 337                 return NULL;
 338         }
 339         tj->p = libnet_r->out.samr_pipe;
 340         tj->user_handle = *libnet_r->out.user_handle;
 341         tj->dom_sid = libnet_r->out.domain_sid;
 342         talloc_steal(tj, libnet_r->out.domain_sid);
 343
 344         ZERO_STRUCT(u);
 345         s.in.user_handle = &tj->user_handle;
 346         s.in.info = &u;
 347         s.in.level = 21;
 348
 349         u.info21.fields_present = SAMR_FIELD_DESCRIPTION | SAMR_FIELD_COMMENT | SAMR_FIELD_FULL_NAME;
 350         u.info21.comment.string = talloc_asprintf(tj,
 351                                                   "Tortured by Samba4: %s",
 352                                                   timestring(tj, time(NULL)));
 353         u.info21.full_name.string = talloc_asprintf(tj,
 354                                                     "Torture account for Samba4: %s",
 355                                                     timestring(tj, time(NULL)));
 356
 357         u.info21.description.string = talloc_asprintf(tj,
 358                                                       "Samba4 torture account created by host %s: %s",
 359                                                       lp_netbios_name(), timestring(tj, time(NULL)));
 360
 361         status = dcerpc_samr_SetUserInfo(tj->p, tj, &s);
 362         if (!NT_STATUS_IS_OK(status)) {
 363                 printf("SetUserInfo (non-critical) failed - %s\n", nt_errstr(status));
 364         }
 365
 366         *machine_credentials = cli_credentials_init(tj);
 367         cli_credentials_set_conf(*machine_credentials);
 368         cli_credentials_set_workstation(*machine_credentials, machine_name, CRED_SPECIFIED);
 369         cli_credentials_set_domain(*machine_credentials, libnet_r->out.domain_name, CRED_SPECIFIED);
 370         if (libnet_r->out.realm) {
 371                 cli_credentials_set_realm(*machine_credentials, libnet_r->out.realm, CRED_SPECIFIED);
 372         }
 373         cli_credentials_set_username(*machine_credentials, libnet_r->in.account_name, CRED_SPECIFIED);
 374         cli_credentials_set_password(*machine_credentials, libnet_r->out.join_password, CRED_SPECIFIED);
 375         if (acct_flags & ACB_SVRTRUST) {
 376                 cli_credentials_set_secure_channel_type(*machine_credentials,
 377                                                         SEC_CHAN_BDC);
 378         } else if (acct_flags & ACB_WSTRUST) {
 379                 cli_credentials_set_secure_channel_type(*machine_credentials,
 380                                                         SEC_CHAN_WKSTA);
 381         } else {
 382                 DEBUG(0, ("Invalid account type specificed to torture_join_domain\n"));
 383                 talloc_free(*machine_credentials);
 384                 return NULL;
 385         }
 386
 387         return tj;
 388 }
 389
 390 struct dcerpc_pipe *torture_join_samr_pipe(struct test_join *join)
 391 {
 392         return join->p;
 393 }
 394
 395 struct policy_handle *torture_join_samr_user_policy(struct test_join *join)
 396 {
 397         return &join->user_handle;
 398 }
 399
 400 NTSTATUS torture_leave_ads_domain(TALLOC_CTX *mem_ctx, struct libnet_JoinDomain *libnet_r)
 401 {
 402         int rtn;
 403         TALLOC_CTX *tmp_ctx;
 404
 405         struct ldb_dn *server_dn;
 406         struct ldb_context *ldb_ctx;
 407
 408         char *remote_ldb_url;
 409
 410         /* Check if we are a domain controller. If not, exit. */
 411         if (!libnet_r->out.server_dn_str) {
 412                 return NT_STATUS_OK;
 413         }
 414
 415         tmp_ctx = talloc_named(mem_ctx, 0, "torture_leave temporary context");
 416         if (!tmp_ctx) {
 417                 libnet_r->out.error_string = NULL;
 418                 return NT_STATUS_NO_MEMORY;
 419         }
 420
 421         ldb_ctx = ldb_init(tmp_ctx);
 422         if (!ldb_ctx) {
 423                 libnet_r->out.error_string = NULL;
 424                 talloc_free(tmp_ctx);
 425                 return NT_STATUS_NO_MEMORY;
 426         }
 427
 428         /* Remove CN=Servers,... entry from the AD. */
 429         server_dn = ldb_dn_explode(tmp_ctx, libnet_r->out.server_dn_str);
 430         if (!server_dn) {
 431                 libnet_r->out.error_string = NULL;
 432                 talloc_free(tmp_ctx);
 433                 return NT_STATUS_NO_MEMORY;
 434         }
 435
 436         remote_ldb_url = talloc_asprintf(tmp_ctx, "ldap://%s", libnet_r->out.samr_binding->host);
 437         if (!remote_ldb_url) {
 438                 libnet_r->out.error_string = NULL;
 439                 talloc_free(tmp_ctx);
 440                 return NT_STATUS_NO_MEMORY;
 441         }
 442
 443         rtn = ldb_connect(ldb_ctx, remote_ldb_url, 0, NULL);
 444         if (rtn != 0) {
 445                 libnet_r->out.error_string = NULL;
 446                 talloc_free(tmp_ctx);
 447                 return NT_STATUS_UNSUCCESSFUL;
 448         }
 449
 450         rtn = ldb_delete(ldb_ctx, server_dn);
 451         if (rtn != 0) {
 452                 libnet_r->out.error_string = NULL;
 453                 talloc_free(tmp_ctx);
 454                 return NT_STATUS_UNSUCCESSFUL;
 455         }
 456
 457         DEBUG(0, ("%s removed successfully.\n", libnet_r->out.server_dn_str));
 458
 459         talloc_free(tmp_ctx);
 460         return NT_STATUS_OK;
 461 }
 462
 463 /*
 464   leave the domain, deleting the machine acct
 465 */
 466
 467 void torture_leave_domain(struct test_join *join)
 468 {
 469         struct samr_DeleteUser d;
 470         NTSTATUS status;
 471
 472         if (!join) {
 473                 return;
 474         }
 475         d.in.user_handle = &join->user_handle;
 476         d.out.user_handle = &join->user_handle;
 477
 478         /* Delete machine account */
 479         status = dcerpc_samr_DeleteUser(join->p, join, &d);
 480         if (!NT_STATUS_IS_OK(status)) {
 481                 printf("Delete of machine account failed\n");
 482         } else {
 483                 printf("Delete of machine account was successful.\n");
 484         }
 485
 486         if (join->libnet_r) {
 487                 status = torture_leave_ads_domain(join, join->libnet_r);
 488         }
 489
 490         talloc_free(join);
 491 }
 492
 493 /*
 494   return the dom sid for a test join
 495 */
 496 const struct dom_sid *torture_join_sid(struct test_join *join)
 497 {
 498         return join->dom_sid;
 499 }
 500
 501 const struct dom_sid *torture_join_user_sid(struct test_join *join)
 502 {
 503         return join->user_sid;
 504 }
 505
 506
 507 struct test_join_ads_dc {
 508         struct test_join *join;
 509 };
 510
 511 struct test_join_ads_dc *torture_join_domain_ads_dc(const char *machine_name,
 512                                                     const char *domain,
 513                                                     struct cli_credentials **machine_credentials)
 514 {
 515         struct test_join_ads_dc *join;
 516
 517         join = talloc(NULL, struct test_join_ads_dc);
 518         if (join == NULL) {
 519                 return NULL;
 520         }
 521
 522         join->join = torture_join_domain(machine_name,
 523                                         ACB_SVRTRUST,
 524                                         machine_credentials);
 525
 526         if (!join->join) {
 527                 return NULL;
 528         }
 529
 530         /* do netlogon DrsEnumerateDomainTrusts */
 531
 532         /* modify userAccountControl from 4096 to 532480 */
 533
 534         /* modify RDN to OU=Domain Controllers and skip the $ from server name */
 535
 536         /* ask objectVersion of Schema Partition */
 537
 538         /* ask rIDManagerReferenz of the Domain Partition */
 539
 540         /* ask fsMORoleOwner of the RID-Manager$ object
 541          * returns CN=NTDS Settings,CN=<DC>,CN=Servers,CN=Default-First-Site-Name, ...
 542          */
 543
 544         /* ask for dnsHostName of CN=<DC>,CN=Servers,CN=Default-First-Site-Name, ... */
 545
 546         /* ask for objectGUID of CN=NTDS Settings,CN=<DC>,CN=Servers,CN=Default-First-Site-Name, ... */
 547
 548         /* ask for * of CN=Default-First-Site-Name, ... */
 549
 550         /* search (&(|(objectClass=user)(objectClass=computer))(sAMAccountName=<machine_name>$)) in Domain Partition
 551          * attributes : distinguishedName, userAccountControl
 552          */
 553
 554         /* ask * for CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
 555          * should fail with noSuchObject
 556          */
 557
 558         /* add CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
 559          *
 560          * objectClass = server
 561          * systemFlags = 50000000
 562          * serverReferenz = CN=<machine_name>,OU=Domain Controllers,...
 563          */
 564
 565         /* ask for * of CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
 566          * should fail with noSuchObject
 567          */
 568
 569         /* search for (ncname=<domain_nc>) in CN=Partitions,CN=Configuration,...
 570          * attributes: ncName, dnsRoot
 571          */
 572
 573         /* modify add CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
 574          * serverReferenz = CN=<machine_name>,OU=Domain Controllers,...
 575          * should fail with attributeOrValueExists
 576          */
 577
 578         /* modify replace CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
 579          * serverReferenz = CN=<machine_name>,OU=Domain Controllers,...
 580          */
 581
 582         /* DsReplicaAdd to create the CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
 583          * needs to be tested
 584          */
 585
 586         return join;
 587 }
 588
 589 void torture_leave_domain_ads_dc(struct test_join_ads_dc *join)
 590 {
 591
 592         if (join->join) {
 593                 torture_leave_domain(join->join);
 594         }
 595
 596         talloc_free(join);
 597 }