r5364: Rename string fields called 'domain' and 'name' to be 'domain_name'.
[samba.git] / source4 / torture / rpc / xplogin.c
1 /* 
2    Unix SMB/CIFS implementation.
3
4    Test code to simulate an XP logon.
5
6    Copyright (C) Volker Lendecke 2004
7    
8    This program is free software; you can redistribute it and/or modify
9    it under the terms of the GNU General Public License as published by
10    the Free Software Foundation; either version 2 of the License, or
11    (at your option) any later version.
12    
13    This program is distributed in the hope that it will be useful,
14    but WITHOUT ANY WARRANTY; without even the implied warranty of
15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16    GNU General Public License for more details.
17    
18    You should have received a copy of the GNU General Public License
19    along with this program; if not, write to the Free Software
20    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
21 */
22
23 #include "includes.h"
24 #include "libcli/auth/credentials.h"
25 #include "libcli/raw/libcliraw.h"
26 #include "librpc/gen_ndr/ndr_samr.h"
27 #include "librpc/gen_ndr/ndr_netlogon.h"
28 #include "librpc/gen_ndr/ndr_srvsvc.h"
29 #include "libcli/composite/composite.h"
30
31 static NTSTATUS after_negprot(struct smbcli_transport **dst_transport,
32                               const char *dest_host, uint16_t port,
33                               const char *my_name)
34 {
35         struct smbcli_socket *sock;
36         struct smbcli_transport *transport;
37         NTSTATUS status;
38
39         sock = smbcli_sock_init(NULL, NULL);
40         if (sock == NULL)
41                 return NT_STATUS_NO_MEMORY;
42
43         if (!smbcli_sock_connect_byname(sock, dest_host, port)) {
44                 talloc_free(sock);
45                 DEBUG(2,("Failed to establish socket connection - %s\n",
46                          strerror(errno)));
47                 return NT_STATUS_UNSUCCESSFUL;
48         }
49
50         transport = smbcli_transport_init(sock, NULL, True);
51         if (transport == NULL)
52                 return NT_STATUS_NO_MEMORY;
53
54         {
55                 struct nbt_name calling;
56                 struct nbt_name called;
57
58                 /* send a NBT session request, if applicable */
59                 calling.name = my_name;
60                 calling.type = NBT_NAME_CLIENT;
61                 calling.scope = NULL;
62
63                 nbt_choose_called_name(transport, &called, dest_host, NBT_NAME_SERVER);
64
65                 if (!smbcli_transport_connect(transport, &calling, &called)) {
66                         talloc_free(transport);
67                         return NT_STATUS_NO_MEMORY;
68                 }
69         }
70
71         /* negotiate protocol options with the server */
72         status = smb_raw_negotiate(transport, lp_maxprotocol());
73         if (!NT_STATUS_IS_OK(status)) {
74                 talloc_free(transport);
75                 return NT_STATUS_UNSUCCESSFUL;
76         }
77
78         *dst_transport = transport;
79
80         return NT_STATUS_OK;
81 }
82
83 static int destroy_session(void *ptr)
84 {
85         struct smbcli_session *session = ptr;
86         smb_raw_ulogoff(session);
87         return 0;
88 }
89
90 static int destroy_tree_and_session(void *ptr)
91 {
92         struct smbcli_tree *tree = ptr;
93         smb_tree_disconnect(tree);
94         talloc_free(tree->session);
95         return 0;
96 }
97
98 static NTSTATUS anon_ipc(struct smbcli_transport *transport,
99                          struct smbcli_tree **dst_tree)
100 {
101         struct smbcli_tree *tree;
102         struct smbcli_session *session;
103         struct smb_composite_sesssetup setup;
104         union smb_tcon tcon;
105         TALLOC_CTX *mem_ctx;
106         NTSTATUS status;
107
108         session = smbcli_session_init(transport, NULL, True);
109         if (session == NULL)
110                 return NT_STATUS_NO_MEMORY;
111
112         mem_ctx = talloc_init("session_init");
113         if (mem_ctx == NULL) {
114                 talloc_free(session);
115                 return NT_STATUS_NO_MEMORY;
116         }
117
118         /* prepare a session setup to establish a security context */
119         setup.in.sesskey = transport->negotiate.sesskey;
120         setup.in.capabilities = transport->negotiate.capabilities;
121         setup.in.password = NULL;
122         setup.in.user = "";
123         setup.in.domain = "";
124         setup.in.capabilities &= ~CAP_EXTENDED_SECURITY;
125
126         status = smb_composite_sesssetup(session, &setup);
127         if (!NT_STATUS_IS_OK(status)) {
128                 talloc_free(session);
129                 talloc_free(mem_ctx);
130                 return NT_STATUS_UNSUCCESSFUL;
131         }
132
133         session->vuid = setup.out.vuid;
134
135         talloc_set_destructor(session, destroy_session);
136
137         tree = smbcli_tree_init(session, NULL, True);
138         if (tree == NULL) {
139                 talloc_free(mem_ctx);
140                 return NT_STATUS_NO_MEMORY;
141         }
142
143         tcon.generic.level = RAW_TCON_TCONX;
144         tcon.tconx.in.flags = 0;
145         tcon.tconx.in.password = data_blob(NULL, 0);
146         tcon.tconx.in.path = talloc_asprintf(mem_ctx, "\\\\%s\\IPC$",
147                                             transport->called.name);
148         tcon.tconx.in.device = "IPC";
149
150         status = smb_tree_connect(tree, mem_ctx, &tcon);
151
152         if (!NT_STATUS_IS_OK(status)) {
153                 talloc_free(tree);
154                 talloc_free(mem_ctx);
155                 return NT_STATUS_UNSUCCESSFUL;
156         }
157
158         tree->tid = tcon.tconx.out.tid;
159
160         if (tcon.tconx.out.dev_type != NULL)
161                 tree->device = talloc_strdup(tree, tcon.tconx.out.dev_type);
162
163         if (tcon.tconx.out.fs_type != NULL)
164                 tree->fs_type = talloc_strdup(tree, tcon.tconx.out.fs_type);
165
166         talloc_set_destructor(tree, destroy_tree_and_session);
167
168         talloc_free(mem_ctx);
169
170         *dst_tree = tree;
171
172         return NT_STATUS_OK;
173 }
174
175 static NTSTATUS connect_to_pipe(struct dcerpc_pipe **pp,
176                                 TALLOC_CTX *mem_ctx,
177                                 struct smbcli_transport *transport,
178                                 const char *pipe_name,
179                                 const char *pipe_uuid,
180                                 uint32_t pipe_version)
181 {
182         const char *binding = lp_parm_string(-1, "torture", "binding");
183         struct dcerpc_binding b;
184         NTSTATUS status;
185         struct dcerpc_pipe *p;
186         TALLOC_CTX *tmp_ctx;
187         struct smbcli_tree *tree;
188         
189         if (!NT_STATUS_IS_OK(status = anon_ipc(transport, &tree)))
190                 return status;
191
192         if (binding == NULL)
193                 return NT_STATUS_INVALID_PARAMETER;
194
195         p = dcerpc_pipe_init(mem_ctx);
196         if (p == NULL) {
197                 return NT_STATUS_NO_MEMORY;
198         }
199         tmp_ctx = talloc_new(p);
200
201         status = dcerpc_parse_binding(tmp_ctx, binding, &b);
202         if (!NT_STATUS_IS_OK(status)) {
203                 DEBUG(0,("Failed to parse dcerpc binding '%s'\n", binding));
204                 talloc_free(p);
205                 return status;
206         }
207
208         DEBUG(3,("Using binding %s\n", dcerpc_binding_string(tmp_ctx, &b)));
209
210         if (b.endpoint == NULL) {
211                 const struct dcerpc_interface_table *table =
212                         idl_iface_by_uuid(pipe_uuid);
213                 struct dcerpc_binding default_binding;
214                 int i;
215
216                 if (!table) {
217                         DEBUG(0,("Unknown interface endpoint '%s'\n",
218                                  pipe_uuid));
219                         talloc_free(tmp_ctx);
220                         return NT_STATUS_INVALID_PARAMETER;
221                 }
222
223                 /* Find one of the default pipes for this interface */
224                 for (i = 0; i < table->endpoints->count; i++) {
225                         const char * const *names = table->endpoints->names;
226                         status = dcerpc_parse_binding(tmp_ctx, names[i],
227                                                       &default_binding);
228
229                         if (NT_STATUS_IS_OK(status) &&
230                             default_binding.transport == NCACN_NP) {
231                                 pipe_name = default_binding.endpoint;   
232                                 break;
233                         }
234                 }
235         } else {
236                 pipe_name = b.endpoint;
237         }
238
239         if (!strncasecmp(pipe_name, "/pipe/", 6) || 
240                 !strncasecmp(pipe_name, "\\pipe\\", 6)) {
241                 pipe_name += 6;
242         }
243
244         if (pipe_name[0] != '\\') {
245                 pipe_name = talloc_asprintf(mem_ctx, "\\%s", pipe_name);
246         }
247         
248         status = dcerpc_pipe_open_smb(p->conn, tree, pipe_name);
249
250         if (!NT_STATUS_IS_OK(status)) {
251                 talloc_free(p);
252                 return status;
253         }
254
255         talloc_free(tmp_ctx);
256         (*pp) = p;
257         
258         return NT_STATUS_OK;
259 }
260
261 static NTSTATUS test_enumtrusts(struct smbcli_transport *transport)
262 {
263         struct policy_handle handle;
264         struct lsa_EnumTrustDom r2;
265         uint32_t resume_handle = 0;
266         struct lsa_ObjectAttribute attr;
267         struct lsa_OpenPolicy2 r1;
268         struct lsa_DomainList domains;
269         TALLOC_CTX *mem_ctx;
270         NTSTATUS status;
271         struct dcerpc_pipe *p;
272
273         mem_ctx = talloc_init("test_enumtrusts");
274         if (mem_ctx == NULL)
275                 return NT_STATUS_NO_MEMORY;
276
277         status = connect_to_pipe(&p, mem_ctx, transport, DCERPC_LSARPC_NAME,
278                                  DCERPC_LSARPC_UUID, 
279                                  DCERPC_LSARPC_VERSION);
280
281         if (!NT_STATUS_IS_OK(status)) {
282                 talloc_free(mem_ctx);
283                 return status;
284         }
285
286         status = dcerpc_bind_auth_none(p, DCERPC_LSARPC_UUID,
287                                        DCERPC_LSARPC_VERSION);
288
289         if (!NT_STATUS_IS_OK(status))
290                 return status;
291
292         printf("\ntesting OpenPolicy2\n");
293
294         attr.len = 0;
295         attr.root_dir = NULL;
296         attr.object_name = NULL;
297         attr.attributes = 0;
298         attr.sec_desc = NULL;
299         attr.sec_qos = NULL;
300
301         r1.in.system_name = talloc_asprintf(mem_ctx,
302                                             "\\\\%s", dcerpc_server_name(p));
303         r1.in.attr = &attr;
304         r1.in.access_mask = 1;
305         r1.out.handle = &handle;
306
307         status = dcerpc_lsa_OpenPolicy2(p, mem_ctx, &r1);
308         if (!NT_STATUS_IS_OK(status)) {
309                 printf("OpenPolicy2 failed - %s\n", nt_errstr(status));
310                 return status;
311         }
312
313         printf("\nTesting EnumTrustDom\n");
314
315         r2.in.handle = &handle;
316         r2.in.resume_handle = &resume_handle;
317         r2.in.max_size = 1000;
318         r2.out.domains = &domains;
319         r2.out.resume_handle = &resume_handle;
320
321         status = dcerpc_lsa_EnumTrustDom(p, mem_ctx, &r2);
322
323         if (!NT_STATUS_IS_OK(status) &&
324             !NT_STATUS_EQUAL(status, NT_STATUS_NO_MORE_ENTRIES))
325                 return status;
326
327         talloc_free(p);
328
329         talloc_free(mem_ctx);
330
331         return NT_STATUS_OK;
332 }
333
334 static NTSTATUS test_lookupnames(struct smbcli_transport *transport,
335                                  const char *name)
336 {
337         struct policy_handle handle;
338         struct lsa_ObjectAttribute attr;
339         struct lsa_OpenPolicy2 r1;
340         TALLOC_CTX *mem_ctx;
341         NTSTATUS status;
342         struct dcerpc_pipe *p;
343
344         mem_ctx = talloc_init("test_lookupnames");
345         if (mem_ctx == NULL)
346                 return NT_STATUS_NO_MEMORY;
347
348         status = connect_to_pipe(&p, mem_ctx, transport, DCERPC_LSARPC_NAME,
349                                  DCERPC_LSARPC_UUID, 
350                                  DCERPC_LSARPC_VERSION);
351
352         if (!NT_STATUS_IS_OK(status)) {
353                 talloc_free(mem_ctx);
354                 return status;
355         }
356
357         status = dcerpc_bind_auth_none(p, DCERPC_LSARPC_UUID,
358                                        DCERPC_LSARPC_VERSION);
359
360         if (!NT_STATUS_IS_OK(status))
361                 return status;
362
363         attr.len = 0;
364         attr.root_dir = NULL;
365         attr.object_name = NULL;
366         attr.attributes = 0;
367         attr.sec_desc = NULL;
368         attr.sec_qos = NULL;
369
370         r1.in.system_name = talloc_asprintf(mem_ctx,
371                                             "\\\\%s", dcerpc_server_name(p));
372         r1.in.attr = &attr;
373         r1.in.access_mask = 0x801;
374         r1.out.handle = &handle;
375
376         status = dcerpc_lsa_OpenPolicy2(p, mem_ctx, &r1);
377         if (!NT_STATUS_IS_OK(status)) {
378                 printf("OpenPolicy2 failed - %s\n", nt_errstr(status));
379                 return status;
380         }
381
382         {
383                 struct lsa_LookupNames l;
384                 struct lsa_TransSidArray sids;
385                 struct lsa_String lsaname;
386                 uint32_t count = 0;
387
388                 sids.count = 0;
389                 sids.sids = NULL;
390
391                 lsaname.string = name;
392
393                 l.in.handle = &handle;
394                 l.in.num_names = 1;
395                 l.in.names = &lsaname;
396                 l.in.sids = &sids;
397                 l.in.level = 2;
398                 l.in.count = &count;
399                 l.out.count = &count;
400                 l.out.sids = &sids;
401
402                 status = dcerpc_lsa_LookupNames(p, mem_ctx, &l);
403                 if (!NT_STATUS_IS_OK(status) &&
404                     !NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED)) {
405                         printf("LookupNames failed - %s\n", nt_errstr(status));
406                         talloc_free(p);
407                         talloc_free(mem_ctx);
408                         return NT_STATUS_OK;
409                 }
410         }
411
412         {
413                 struct lsa_Close c;
414                 struct policy_handle handle2;
415
416                 c.in.handle = &handle;
417                 c.out.handle = &handle2;
418
419                 status = dcerpc_lsa_Close(p, mem_ctx, &c);
420                 if (!NT_STATUS_IS_OK(status)) {
421                         printf("Close failed - %s\n", nt_errstr(status));
422                         return status;
423                 }
424         }
425
426         talloc_free(p);
427
428         talloc_free(mem_ctx);
429
430         return NT_STATUS_OK;
431 }
432
433 static NTSTATUS setup_netlogon_creds(struct smbcli_transport *transport,
434                                      struct dcerpc_pipe **p,
435                                      const char *machine_name,
436                                      const char *domain,
437                                      const char *machine_pwd,
438                                      struct creds_CredentialState *creds)
439 {
440         NTSTATUS status;
441         TALLOC_CTX *mem_ctx;
442         struct netr_ServerReqChallenge r;
443         struct netr_ServerAuthenticate2 a;
444         struct netr_Credential credentials1, credentials2, credentials3;
445         const char *plain_pass;
446         struct samr_Password mach_password;
447         uint32_t negotiate_flags = NETLOGON_NEG_AUTH2_FLAGS;
448
449         
450         mem_ctx = talloc_init("torture_rpc_login");
451
452         if (mem_ctx == NULL)
453                 return NT_STATUS_NO_MEMORY;
454
455         status = connect_to_pipe(p, mem_ctx, transport, DCERPC_NETLOGON_NAME,
456                                  DCERPC_NETLOGON_UUID,
457                                  DCERPC_NETLOGON_VERSION);
458
459         if (!NT_STATUS_IS_OK(status)) {
460                 talloc_free(mem_ctx);
461                 return status;
462         }
463
464         status = dcerpc_bind_auth_none(*p, DCERPC_NETLOGON_UUID,
465                                        DCERPC_NETLOGON_VERSION);
466
467         if (!NT_STATUS_IS_OK(status))
468                 return status;
469
470         printf("Testing ServerReqChallenge\n");
471
472         r.in.server_name = talloc_asprintf(mem_ctx, "\\\\%s",
473                                            dcerpc_server_name(*p));
474         r.in.computer_name = machine_name;
475         r.in.credentials = &credentials1;
476         r.out.credentials = &credentials2;
477
478         generate_random_buffer(credentials1.data, sizeof(credentials1.data));
479
480         status = dcerpc_netr_ServerReqChallenge(*p, mem_ctx, &r);
481         if (!NT_STATUS_IS_OK(status)) {
482                 printf("ServerReqChallenge - %s\n", nt_errstr(status));
483                 return status;
484         }
485
486         plain_pass = machine_pwd;
487         if (!plain_pass) {
488                 printf("Unable to fetch machine password!\n");
489                 return status;
490         }
491
492         E_md4hash(plain_pass, mach_password.hash);
493
494         a.in.server_name = talloc_asprintf(mem_ctx, "\\\\%s",
495                                            dcerpc_server_name(*p));
496         a.in.account_name = talloc_asprintf(mem_ctx, "%s$", machine_name);
497         a.in.secure_channel_type = SEC_CHAN_WKSTA;
498         a.in.computer_name = machine_name;
499         a.in.negotiate_flags = &negotiate_flags;
500         a.out.negotiate_flags = &negotiate_flags;
501         a.in.credentials = &credentials3;
502         a.out.credentials = &credentials3;
503
504         creds_client_init(creds, &credentials1, &credentials2,
505                           &mach_password, &credentials3, 
506                           negotiate_flags);
507
508         printf("Testing ServerAuthenticate2\n");
509
510         status = dcerpc_netr_ServerAuthenticate2(*p, mem_ctx, &a);
511         if (!NT_STATUS_IS_OK(status)) {
512                 printf("ServerAuthenticate2 - %s\n", nt_errstr(status));
513                 return status;
514         }
515
516         if (!creds_client_check(creds, &credentials3)) {
517                 printf("Credential chaining failed\n");
518                 return status;
519         }
520
521         printf("negotiate_flags=0x%08x\n", negotiate_flags);
522
523         talloc_free(mem_ctx);
524         return NT_STATUS_OK;
525 }
526
527 static NTSTATUS torture_samlogon(struct dcerpc_pipe *p,
528                                  struct creds_CredentialState *netlogon_creds,
529                                  const char *workstation,
530                                  const char *domain,
531                                  const char *username,
532                                  const char *password)
533 {
534         TALLOC_CTX *mem_ctx;
535         struct netr_LogonSamLogon log;
536         struct netr_NetworkInfo ninfo;
537         struct netr_Authenticator auth, auth2;
538         uint8_t user_session_key[16];
539         DATA_BLOB ntlmv2_response = data_blob(NULL, 0);
540         DATA_BLOB lmv2_response = data_blob(NULL, 0);
541         DATA_BLOB names_blob;
542         DATA_BLOB chall;
543         NTSTATUS status;
544
545         mem_ctx = talloc_init("torture_samlogon");
546
547         ZERO_STRUCT(user_session_key);
548
549         printf("testing netr_LogonSamLogon\n");
550
551         log.in.server_name = talloc_asprintf(mem_ctx, "\\\\%s",
552                                              dcerpc_server_name(p));
553         log.in.workstation = workstation;
554         log.in.credential = &auth;
555         log.in.return_authenticator = &auth2;
556         log.in.validation_level = 3;
557         log.in.logon_level = 2;
558         log.in.logon.network = &ninfo;
559
560         chall = data_blob_talloc(mem_ctx, NULL, 8);
561         generate_random_buffer(chall.data, 8);  
562
563         names_blob = NTLMv2_generate_names_blob(mem_ctx, workstation,
564                                                 lp_workgroup());
565         ZERO_STRUCT(user_session_key);
566
567         if (!SMBNTLMv2encrypt(username, domain, password,
568                               &chall, &names_blob,
569                               &lmv2_response, &ntlmv2_response, 
570                               NULL, NULL)) {
571                 data_blob_free(&names_blob);
572                 talloc_free(mem_ctx);
573                 return NT_STATUS_UNSUCCESSFUL;
574         }
575         data_blob_free(&names_blob);
576
577         ninfo.identity_info.domain_name.string = domain;
578         ninfo.identity_info.parameter_control = 0;
579         ninfo.identity_info.logon_id_low = 0;
580         ninfo.identity_info.logon_id_high = 0;
581         ninfo.identity_info.account_name.string = username;
582         ninfo.identity_info.workstation.string = workstation;
583         memcpy(ninfo.challenge, chall.data, 8);
584         ninfo.nt.data = ntlmv2_response.data;
585         ninfo.nt.length = ntlmv2_response.length;
586         ninfo.lm.data = NULL;
587         ninfo.lm.length = 0;
588
589         ZERO_STRUCT(auth2);
590         creds_client_authenticator(netlogon_creds, &auth);
591
592         log.out.return_authenticator = NULL;
593         status = dcerpc_netr_LogonSamLogon(p, mem_ctx, &log);
594         talloc_free(mem_ctx);
595         data_blob_free(&lmv2_response);
596         data_blob_free(&ntlmv2_response);
597         return status;
598 }
599
600 static NTSTATUS test_getgroups(struct smbcli_transport *transport,
601                                const char *name)
602 {
603         TALLOC_CTX *mem_ctx;
604         NTSTATUS status;
605         struct dcerpc_pipe *p;
606
607         struct samr_Connect4 r4;
608         struct policy_handle connect_handle, domain_handle, user_handle;
609
610         mem_ctx = talloc_init("test_lookupnames");
611         if (mem_ctx == NULL)
612                 return NT_STATUS_NO_MEMORY;
613
614         status = connect_to_pipe(&p, mem_ctx, transport, DCERPC_SAMR_NAME,
615                                  DCERPC_SAMR_UUID, 
616                                  DCERPC_SAMR_VERSION);
617
618         if (!NT_STATUS_IS_OK(status)) {
619                 talloc_free(mem_ctx);
620                 return status;
621         }
622
623         status = dcerpc_bind_auth_none(p, DCERPC_SAMR_UUID,
624                                        DCERPC_SAMR_VERSION);
625
626         if (!NT_STATUS_IS_OK(status))
627                 return status;
628
629         r4.in.system_name = talloc_asprintf(mem_ctx, "\\\\%s",
630                                             dcerpc_server_name(p));
631         r4.in.unknown = 0;
632         r4.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
633         r4.out.connect_handle = &connect_handle;
634
635         status = dcerpc_samr_Connect4(p, mem_ctx, &r4);
636         if (!NT_STATUS_IS_OK(status))
637                 return status;
638
639         {
640                 struct samr_EnumDomains e;
641                 uint32_t resume_handle = 0;
642                 int i;
643
644                 e.in.connect_handle = &connect_handle;
645                 e.in.resume_handle = &resume_handle;
646                 e.in.buf_size = (uint32_t)-1;
647                 e.out.resume_handle = &resume_handle;
648                 status = dcerpc_samr_EnumDomains(p, mem_ctx, &e);
649                 if (!NT_STATUS_IS_OK(status))
650                         return status;
651
652                 for (i=0; i<e.out.sam->count; i++) {
653
654                         struct samr_LookupDomain l;
655                         struct samr_OpenDomain o;
656
657                         if (strcmp(e.out.sam->entries[i].name.string,
658                                    "Builtin") == 0)
659                                 continue;
660
661                         l.in.connect_handle = &connect_handle;
662                         l.in.domain_name = &e.out.sam->entries[i].name;
663
664                         status = dcerpc_samr_LookupDomain(p, mem_ctx, &l);
665
666                         if (!NT_STATUS_IS_OK(status))
667                                 return status;
668
669                         o.in.connect_handle = &connect_handle;
670                         o.in.access_mask = 0x200;
671                         o.in.sid = l.out.sid;
672                         o.out.domain_handle = &domain_handle;
673
674                         status = dcerpc_samr_OpenDomain(p, mem_ctx, &o);
675
676                         if (!NT_STATUS_IS_OK(status))
677                                 return status;
678
679                         break;
680                 }
681         }
682
683         {
684                 struct samr_LookupNames l;
685                 struct samr_String samr_name;
686                 struct samr_OpenUser o;
687
688                 samr_name.string = name;
689
690                 l.in.domain_handle = &domain_handle;
691                 l.in.num_names = 1;
692                 l.in.names = &samr_name;
693
694                 status = dcerpc_samr_LookupNames(p, mem_ctx, &l);
695
696                 if (!NT_STATUS_IS_OK(status))
697                         return status;
698
699                 o.in.domain_handle = &domain_handle;
700                 o.in.rid = l.out.rids.ids[0];
701                 o.in.access_mask = 0x100;
702                 o.out.user_handle = &user_handle;
703
704                 status = dcerpc_samr_OpenUser(p, mem_ctx, &o);
705                 
706                 if (!NT_STATUS_IS_OK(status))
707                         return status;
708         }
709
710         {
711                 struct samr_GetGroupsForUser g;
712                 struct samr_LookupRids l;
713                 int i;
714
715                 g.in.user_handle = &user_handle;
716
717                 status = dcerpc_samr_GetGroupsForUser(p, mem_ctx, &g);
718                 if (!NT_STATUS_IS_OK(status))
719                         return status;
720
721                 l.in.domain_handle = &domain_handle;
722                 l.in.num_rids = g.out.rids->count;
723                 l.in.rids = talloc_array(mem_ctx, uint32_t, g.out.rids->count);
724
725                 for (i=0; i<g.out.rids->count; i++)
726                         l.in.rids[i] = g.out.rids->rid[i].rid;
727
728                 status = dcerpc_samr_LookupRids(p, mem_ctx, &l);
729                 if (!NT_STATUS_IS_OK(status)) {
730                         talloc_free(mem_ctx);
731                         return status;
732                 }
733         }
734
735         {
736                 struct samr_Close c;
737
738                 c.in.handle = &user_handle;
739                 c.out.handle = &user_handle;
740                 dcerpc_samr_Close(p, mem_ctx, &c);
741
742                 c.in.handle = &domain_handle;
743                 c.out.handle = &domain_handle;
744                 dcerpc_samr_Close(p, mem_ctx, &c);
745
746                 c.in.handle = &connect_handle;
747                 c.out.handle = &connect_handle;
748                 dcerpc_samr_Close(p, mem_ctx, &c);
749         }
750
751         talloc_free(p);
752         talloc_free(mem_ctx);
753
754         return NT_STATUS_OK;
755 }
756
757 static NTSTATUS test_getallsids(struct smbcli_transport *transport,
758                                 const char *name, BOOL includeDomain)
759 {
760         TALLOC_CTX *mem_ctx;
761         NTSTATUS status;
762         struct dcerpc_pipe *p;
763
764         struct samr_Connect4 r4;
765         struct policy_handle connect_handle, user_handle;
766         struct policy_handle builtin_handle, domain_handle;
767         struct dom_sid *domain_sid = NULL;
768
769         struct dom_sid *user_sid;
770         struct dom_sid *primary_group_sid;
771         struct samr_GetGroupsForUser g;
772
773
774         mem_ctx = talloc_init("test_getallsids");
775         if (mem_ctx == NULL)
776                 return NT_STATUS_NO_MEMORY;
777
778         status = connect_to_pipe(&p, mem_ctx, transport, DCERPC_SAMR_NAME,
779                                  DCERPC_SAMR_UUID, 
780                                  DCERPC_SAMR_VERSION);
781
782         if (!NT_STATUS_IS_OK(status)) {
783                 talloc_free(mem_ctx);
784                 return status;
785         }
786
787         status = dcerpc_bind_auth_none(p, DCERPC_SAMR_UUID,
788                                        DCERPC_SAMR_VERSION);
789
790         if (!NT_STATUS_IS_OK(status))
791                 return status;
792
793         r4.in.system_name = talloc_asprintf(mem_ctx, "\\\\%s",
794                                             dcerpc_server_name(p));
795         r4.in.unknown = 0;
796         r4.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
797         r4.out.connect_handle = &connect_handle;
798
799         status = dcerpc_samr_Connect4(p, mem_ctx, &r4);
800         if (!NT_STATUS_IS_OK(status))
801                 return status;
802
803         {
804                 struct samr_EnumDomains e;
805                 struct samr_OpenDomain o;
806                 uint32_t resume_handle = 0;
807                 int i;
808
809                 e.in.connect_handle = &connect_handle;
810                 e.in.resume_handle = &resume_handle;
811                 e.in.buf_size = (uint32_t)-1;
812                 e.out.resume_handle = &resume_handle;
813                 status = dcerpc_samr_EnumDomains(p, mem_ctx, &e);
814                 if (!NT_STATUS_IS_OK(status))
815                         return status;
816
817                 for (i=0; i<e.out.sam->count; i++) {
818
819                         struct samr_LookupDomain l;
820
821                         if (strcmp(e.out.sam->entries[i].name.string,
822                                    "Builtin") == 0)
823                                 continue;
824
825                         l.in.connect_handle = &connect_handle;
826                         l.in.domain_name = &e.out.sam->entries[i].name;
827
828                         status = dcerpc_samr_LookupDomain(p, mem_ctx, &l);
829
830                         if (!NT_STATUS_IS_OK(status))
831                                 return status;
832
833                         o.in.connect_handle = &connect_handle;
834                         o.in.access_mask = 0x280;
835                         domain_sid = l.out.sid;
836                         o.in.sid = l.out.sid;
837                         o.out.domain_handle = &domain_handle;
838
839                         status = dcerpc_samr_OpenDomain(p, mem_ctx, &o);
840
841                         if (!NT_STATUS_IS_OK(status))
842                                 return status;
843                         break;
844                 }
845                 o.in.connect_handle = &connect_handle;
846                 o.in.access_mask = 0x280;
847                 o.in.sid = dom_sid_parse_talloc(mem_ctx, "S-1-5-32");
848                 o.out.domain_handle = &builtin_handle;
849
850                 status = dcerpc_samr_OpenDomain(p, mem_ctx, &o);
851
852                 if (!NT_STATUS_IS_OK(status))
853                         return status;
854         }
855
856         {
857                 struct samr_LookupNames l;
858                 struct samr_String samr_name;
859                 struct samr_OpenUser o;
860
861                 samr_name.string = name;
862
863                 l.in.domain_handle = &domain_handle;
864                 l.in.num_names = 1;
865                 l.in.names = &samr_name;
866
867                 status = dcerpc_samr_LookupNames(p, mem_ctx, &l);
868
869                 if (!NT_STATUS_IS_OK(status))
870                         return status;
871
872                 o.in.domain_handle = &domain_handle;
873                 o.in.rid = l.out.rids.ids[0];
874                 o.in.access_mask = 0x100;
875                 o.out.user_handle = &user_handle;
876
877                 status = dcerpc_samr_OpenUser(p, mem_ctx, &o);
878                 
879                 if (!NT_STATUS_IS_OK(status))
880                         return status;
881         }
882
883         {
884                 struct samr_QueryUserInfo q;
885
886                 q.in.user_handle = &user_handle;
887                 q.in.level = 21;
888
889                 status = dcerpc_samr_QueryUserInfo(p, mem_ctx, &q);
890
891                 if (!NT_STATUS_IS_OK(status))
892                         return status;
893
894                 user_sid = dom_sid_add_rid(mem_ctx, domain_sid,
895                                            q.out.info->info21.rid);
896                 primary_group_sid = dom_sid_add_rid(mem_ctx, domain_sid,
897                                                     q.out.info->info21.primary_gid);
898         }
899
900         g.in.user_handle = &user_handle;
901
902         status = dcerpc_samr_GetGroupsForUser(p, mem_ctx, &g);
903         if (!NT_STATUS_IS_OK(status))
904                 return status;
905
906         {
907                 struct lsa_SidArray sids;
908                 struct samr_Ids rids;
909                 struct samr_GetAliasMembership ga;
910                 int i;
911
912                 ga.in.domain_handle = &builtin_handle;
913
914                 sids.num_sids = g.out.rids->count+2;
915                 sids.sids = talloc_array(mem_ctx, struct lsa_SidPtr,
916                                            g.out.rids->count+2);
917                 sids.sids[0].sid = user_sid;
918                 sids.sids[1].sid = primary_group_sid;
919                 for (i=0; i<g.out.rids->count; i++) {
920                         sids.sids[i+2].sid = dom_sid_add_rid(mem_ctx,
921                                                              domain_sid,
922                                                              g.out.rids->rid[i].rid);
923                 }
924                 ga.in.sids = &sids;
925                 ga.out.rids = &rids;
926
927                 status = dcerpc_samr_GetAliasMembership(p, mem_ctx, &ga);
928                 if (!NT_STATUS_IS_OK(status))
929                         return status;
930
931                 if (includeDomain) {
932                         ga.in.domain_handle = &domain_handle;
933                         status = dcerpc_samr_GetAliasMembership(p, mem_ctx,
934                                                                 &ga);
935                         if (!NT_STATUS_IS_OK(status))
936                                 return status;
937                 }
938         }
939
940         {
941                 struct samr_Close c;
942
943                 c.in.handle = &user_handle;
944                 c.out.handle = &user_handle;
945                 dcerpc_samr_Close(p, mem_ctx, &c);
946
947                 c.in.handle = &domain_handle;
948                 c.out.handle = &domain_handle;
949                 dcerpc_samr_Close(p, mem_ctx, &c);
950
951                 c.in.handle = &builtin_handle;
952                 c.out.handle = &builtin_handle;
953                 dcerpc_samr_Close(p, mem_ctx, &c);
954
955                 c.in.handle = &connect_handle;
956                 c.out.handle = &connect_handle;
957                 dcerpc_samr_Close(p, mem_ctx, &c);
958         }
959
960         talloc_free(p);
961         talloc_free(mem_ctx);
962
963         return NT_STATUS_OK;
964 }
965
966 static NTSTATUS test_remoteTOD(struct smbcli_transport *transport)
967 {
968         TALLOC_CTX *mem_ctx;
969         NTSTATUS status;
970         struct dcerpc_pipe *p;
971         struct srvsvc_NetRemoteTOD r;
972
973         mem_ctx = talloc_init("test_lookupnames");
974         if (mem_ctx == NULL)
975                 return NT_STATUS_NO_MEMORY;
976
977         status = connect_to_pipe(&p, mem_ctx, transport, DCERPC_SRVSVC_NAME,
978                                  DCERPC_SRVSVC_UUID,
979                                  DCERPC_SRVSVC_VERSION);
980
981         if (!NT_STATUS_IS_OK(status)) {
982                 talloc_free(mem_ctx);
983                 return status;
984         }
985
986         status = dcerpc_bind_auth_none(p, DCERPC_SRVSVC_UUID,
987                                        DCERPC_SRVSVC_VERSION);
988
989         if (!NT_STATUS_IS_OK(status))
990                 return status;
991
992         r.in.server_unc = talloc_asprintf(mem_ctx,"\\\\%s",dcerpc_server_name(p));
993
994         ZERO_STRUCT(r.out);
995         status = dcerpc_srvsvc_NetRemoteTOD(p, mem_ctx, &r);
996         talloc_free(mem_ctx);
997         talloc_free(p);
998         return status;
999 }
1000
1001 static BOOL xp_login(const char *dcname, const char *wksname,
1002                      const char *domain, const char *wkspwd,
1003                      const char *user1name, const char *user1pw,
1004                      const char *user2name, const char *user2pw)
1005 {
1006         NTSTATUS status;
1007         TALLOC_CTX *mem_ctx;
1008         char *user1dom;
1009
1010         struct smbcli_transport *transport;
1011
1012         struct dcerpc_pipe *netlogon_pipe;
1013         struct creds_CredentialState *netlogon_creds;
1014
1015         struct dcerpc_pipe *netlogon_schannel_pipe;
1016
1017         talloc_enable_leak_report();
1018
1019         mem_ctx = talloc_init("rpc_login");
1020
1021         if (mem_ctx == NULL)
1022                 return False;
1023
1024         netlogon_creds = talloc(mem_ctx, struct creds_CredentialState);
1025         if (!netlogon_creds) {
1026                 return False;
1027         }
1028
1029         if (!NT_STATUS_IS_OK(after_negprot(&transport, dcname, 139,
1030                                            wksname)))
1031                 return False;
1032
1033         if (!NT_STATUS_IS_OK(setup_netlogon_creds(transport, &netlogon_pipe,
1034                                                   wksname, domain, wkspwd,
1035                                                   netlogon_creds)))
1036                 return False;
1037
1038         if (!NT_STATUS_IS_OK(test_enumtrusts(transport)))
1039                 return False;
1040
1041         user1dom = talloc_asprintf(mem_ctx, "%s\\%s", domain, user1name);
1042
1043         if (!NT_STATUS_IS_OK(test_lookupnames(transport, user1dom)))
1044                 return False;
1045
1046         status = connect_to_pipe(&netlogon_schannel_pipe,
1047                                  mem_ctx, transport, DCERPC_NETLOGON_NAME,
1048                                  DCERPC_NETLOGON_UUID,
1049                                  DCERPC_NETLOGON_VERSION);
1050
1051         if (!NT_STATUS_IS_OK(status))
1052                 return False;
1053
1054         netlogon_schannel_pipe->conn->flags |= DCERPC_SEAL;
1055
1056         status = dcerpc_bind_auth_schannel_withkey(netlogon_schannel_pipe,
1057                                                    DCERPC_NETLOGON_UUID,
1058                                                    DCERPC_NETLOGON_VERSION,
1059                                                    "", "", "",
1060                                                    netlogon_creds);
1061
1062         if (!NT_STATUS_IS_OK(status))
1063                 return False;
1064
1065         status = torture_samlogon(netlogon_schannel_pipe,
1066                                   netlogon_creds, wksname, domain,
1067                                   user1name, user1pw);
1068
1069         if (!NT_STATUS_IS_OK(status))
1070                 return False;
1071
1072         talloc_free(netlogon_pipe);
1073
1074         status = torture_samlogon(netlogon_schannel_pipe,
1075                                   netlogon_creds, wksname, domain,
1076                                   user2name, user2pw);
1077
1078         if (!NT_STATUS_IS_OK(status))
1079                 return False;
1080
1081         status = test_getgroups(transport, user2name);
1082         
1083         if (!NT_STATUS_IS_OK(status))
1084                 return False;
1085
1086         status = test_remoteTOD(transport);
1087         
1088         if (!NT_STATUS_IS_OK(status))
1089                 return False;
1090
1091         status = test_remoteTOD(transport);
1092         
1093         if (!NT_STATUS_IS_OK(status))
1094                 return False;
1095
1096         status = test_getallsids(transport, user2name, False);
1097         
1098         if (!NT_STATUS_IS_OK(status))
1099                 return False;
1100
1101         status = test_getgroups(transport, user2name);
1102         
1103         if (!NT_STATUS_IS_OK(status))
1104                 return False;
1105
1106         status = test_getallsids(transport, user2name, True);
1107         
1108         if (!NT_STATUS_IS_OK(status))
1109                 return False;
1110
1111         talloc_free(netlogon_schannel_pipe);
1112
1113         talloc_free(transport);
1114
1115         talloc_free(mem_ctx);
1116
1117         return True;
1118 }
1119
1120 struct user_pw {
1121         const char *username;
1122         const char *password;
1123 };
1124
1125 static const struct user_pw users[] = {
1126         { "username1", "password1" },
1127         { "username2", "password2" }
1128 };
1129
1130 static const struct user_pw machines[] = {
1131         { "machine1", "mpw1" },
1132         { "machine2", "mpw2" }
1133 };
1134
1135 BOOL torture_rpc_login(void)
1136 {
1137         const char *pdcname = "pdcname";
1138         const char *domainname = "domain";
1139
1140         int useridx1 = rand() % ARRAY_SIZE(users);
1141         int useridx2 = rand() % ARRAY_SIZE(users);
1142         int machidx = rand() % ARRAY_SIZE(machines);
1143         printf("machine: %s user1: %s user2: %s\n",
1144                machines[machidx].username,
1145                users[useridx1].username,
1146                users[useridx2].username);
1147
1148         return xp_login(pdcname, machines[machidx].username,
1149                         domainname, machines[machidx].password,
1150                         users[useridx1].username,
1151                         users[useridx1].password,
1152                         users[useridx2].username,
1153                         users[useridx2].password);
1154 }