source4/torture/rpc/testjoin.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    utility code to join/leave a domain
   5
   6    Copyright (C) Andrew Tridgell 2004
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 2 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program; if not, write to the Free Software
  20    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21 */
  22
  23 /*
  24   this code is used by other torture modules to join/leave a domain
  25   as either a member, bdc or thru a trust relationship
  26 */
  27
  28 #include "includes.h"
  29 #include "librpc/gen_ndr/ndr_samr.h"
  30 #include "system/time.h"
  31 #include "lib/crypto/crypto.h"
  32 #include "libnet/libnet.h"
  33 #include "lib/cmdline/popt_common.h"
  34 #include "lib/ldb/include/ldb.h"
  35
  36
  37 struct test_join {
  38         struct dcerpc_pipe *p;
  39         struct policy_handle user_handle;
  40         struct libnet_JoinDomain *libnet_r;
  41         const char *dom_sid;
  42 };
  43
  44
  45 static NTSTATUS DeleteUser_byname(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
  46                                   struct policy_handle *handle, const char *name)
  47 {
  48         NTSTATUS status;
  49         struct samr_DeleteUser d;
  50         struct policy_handle user_handle;
  51         uint32_t rid;
  52         struct samr_LookupNames n;
  53         struct lsa_String sname;
  54         struct samr_OpenUser r;
  55
  56         sname.string = name;
  57
  58         n.in.domain_handle = handle;
  59         n.in.num_names = 1;
  60         n.in.names = &sname;
  61
  62         status = dcerpc_samr_LookupNames(p, mem_ctx, &n);
  63         if (NT_STATUS_IS_OK(status)) {
  64                 rid = n.out.rids.ids[0];
  65         } else {
  66                 return status;
  67         }
  68
  69         r.in.domain_handle = handle;
  70         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
  71         r.in.rid = rid;
  72         r.out.user_handle = &user_handle;
  73
  74         status = dcerpc_samr_OpenUser(p, mem_ctx, &r);
  75         if (!NT_STATUS_IS_OK(status)) {
  76                 printf("OpenUser(%s) failed - %s\n", name, nt_errstr(status));
  77                 return status;
  78         }
  79
  80         d.in.user_handle = &user_handle;
  81         d.out.user_handle = &user_handle;
  82         status = dcerpc_samr_DeleteUser(p, mem_ctx, &d);
  83         if (!NT_STATUS_IS_OK(status)) {
  84                 return status;
  85         }
  86
  87         return NT_STATUS_OK;
  88 }
  89
  90 /*
  91   create a test user in the domain
  92   an opaque pointer is returned. Pass it to torture_leave_domain()
  93   when finished
  94 */
  95
  96 struct test_join *torture_create_testuser(const char *username,
  97                                           const char *domain,
  98                                           uint16_t acct_type,
  99                                           const char **random_password)
 100 {
 101         NTSTATUS status;
 102         struct samr_Connect c;
 103         struct samr_CreateUser2 r;
 104         struct samr_OpenDomain o;
 105         struct samr_LookupDomain l;
 106         struct samr_GetUserPwInfo pwp;
 107         struct samr_SetUserInfo s;
 108         union samr_UserInfo u;
 109         struct policy_handle handle;
 110         struct policy_handle domain_handle;
 111         uint32_t access_granted;
 112         uint32_t rid;
 113         DATA_BLOB session_key;
 114         struct lsa_String name;
 115         struct lsa_String comment;
 116         struct lsa_String full_name;
 117
 118         int policy_min_pw_len = 0;
 119         struct test_join *join;
 120         char *random_pw;
 121
 122         join = talloc(NULL, struct test_join);
 123         if (join == NULL) {
 124                 return NULL;
 125         }
 126
 127         ZERO_STRUCTP(join);
 128
 129         printf("Connecting to SAMR\n");
 130
 131         status = torture_rpc_connection(join,
 132                                         &join->p,
 133                                         DCERPC_SAMR_NAME,
 134                                         DCERPC_SAMR_UUID,
 135                                         DCERPC_SAMR_VERSION);
 136         if (!NT_STATUS_IS_OK(status)) {
 137                 return NULL;
 138         }
 139
 140         c.in.system_name = NULL;
 141         c.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 142         c.out.connect_handle = &handle;
 143
 144         status = dcerpc_samr_Connect(join->p, join, &c);
 145         if (!NT_STATUS_IS_OK(status)) {
 146                 const char *errstr = nt_errstr(status);
 147                 if (NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
 148                         errstr = dcerpc_errstr(join, join->p->last_fault_code);
 149                 }
 150                 printf("samr_Connect failed - %s\n", errstr);
 151                 return NULL;
 152         }
 153
 154         printf("Opening domain %s\n", domain);
 155
 156         name.string = domain;
 157         l.in.connect_handle = &handle;
 158         l.in.domain_name = &name;
 159
 160         status = dcerpc_samr_LookupDomain(join->p, join, &l);
 161         if (!NT_STATUS_IS_OK(status)) {
 162                 printf("LookupDomain failed - %s\n", nt_errstr(status));
 163                 goto failed;
 164         }
 165
 166         join->dom_sid = dom_sid_string(join, l.out.sid);
 167
 168         o.in.connect_handle = &handle;
 169         o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 170         o.in.sid = l.out.sid;
 171         o.out.domain_handle = &domain_handle;
 172
 173         status = dcerpc_samr_OpenDomain(join->p, join, &o);
 174         if (!NT_STATUS_IS_OK(status)) {
 175                 printf("OpenDomain failed - %s\n", nt_errstr(status));
 176                 goto failed;
 177         }
 178
 179         printf("Creating account %s\n", username);
 180
 181 again:
 182         name.string = username;
 183         r.in.domain_handle = &domain_handle;
 184         r.in.account_name = &name;
 185         r.in.acct_flags = acct_type;
 186         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 187         r.out.user_handle = &join->user_handle;
 188         r.out.access_granted = &access_granted;
 189         r.out.rid = &rid;
 190
 191         status = dcerpc_samr_CreateUser2(join->p, join, &r);
 192
 193         if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
 194                 status = DeleteUser_byname(join->p, join, &domain_handle, name.string);
 195                 if (NT_STATUS_IS_OK(status)) {
 196                         goto again;
 197                 }
 198         }
 199
 200         if (!NT_STATUS_IS_OK(status)) {
 201                 printf("CreateUser2 failed - %s\n", nt_errstr(status));
 202                 goto failed;
 203         }
 204
 205         pwp.in.user_handle = &join->user_handle;
 206
 207         status = dcerpc_samr_GetUserPwInfo(join->p, join, &pwp);
 208         if (NT_STATUS_IS_OK(status)) {
 209                 policy_min_pw_len = pwp.out.info.min_password_length;
 210         }
 211
 212         random_pw = generate_random_str(join, MAX(8, policy_min_pw_len));
 213
 214         printf("Setting account password '%s'\n", random_pw);
 215
 216         s.in.user_handle = &join->user_handle;
 217         s.in.info = &u;
 218         s.in.level = 24;
 219
 220         encode_pw_buffer(u.info24.password.data, random_pw, STR_UNICODE);
 221         u.info24.pw_len = strlen(random_pw);
 222
 223         status = dcerpc_fetch_session_key(join->p, &session_key);
 224         if (!NT_STATUS_IS_OK(status)) {
 225                 printf("SetUserInfo level %u - no session key - %s\n",
 226                        s.in.level, nt_errstr(status));
 227                 torture_leave_domain(join);
 228                 goto failed;
 229         }
 230
 231         arcfour_crypt_blob(u.info24.password.data, 516, &session_key);
 232
 233         status = dcerpc_samr_SetUserInfo(join->p, join, &s);
 234         if (!NT_STATUS_IS_OK(status)) {
 235                 printf("SetUserInfo failed - %s\n", nt_errstr(status));
 236                 goto failed;
 237         }
 238
 239         ZERO_STRUCT(u);
 240         s.in.user_handle = &join->user_handle;
 241         s.in.info = &u;
 242         s.in.level = 21;
 243
 244         u.info21.acct_flags = acct_type;
 245         u.info21.fields_present = SAMR_FIELD_ACCT_FLAGS | SAMR_FIELD_DESCRIPTION | SAMR_FIELD_COMMENT | SAMR_FIELD_FULL_NAME;
 246         comment.string = talloc_asprintf(join,
 247                                          "Tortured by Samba4: %s",
 248                                          timestring(join, time(NULL)));
 249         u.info21.comment = comment;
 250         full_name.string = talloc_asprintf(join,
 251                                          "Torture account for Samba4: %s",
 252                                          timestring(join, time(NULL)));
 253         u.info21.full_name = full_name;
 254
 255         u.info21.description.string = talloc_asprintf(join,
 256                                          "Samba4 torture account created by host %s: %s",
 257                                          lp_netbios_name(), timestring(join, time(NULL)));
 258
 259         printf("Resetting ACB flags, force pw change time\n");
 260
 261         status = dcerpc_samr_SetUserInfo(join->p, join, &s);
 262         if (!NT_STATUS_IS_OK(status)) {
 263                 printf("SetUserInfo failed - %s\n", nt_errstr(status));
 264                 goto failed;
 265         }
 266
 267         if (random_password) {
 268                 *random_password = random_pw;
 269         }
 270
 271         return join;
 272
 273 failed:
 274         torture_leave_domain(join);
 275         return NULL;
 276 }
 277
 278
 279 struct test_join *torture_join_domain(const char *machine_name,
 280                                       uint32_t acct_flags,
 281                                       const char **machine_password)
 282 {
 283         NTSTATUS status;
 284         struct libnet_context *libnet_ctx;
 285         struct libnet_JoinDomain *libnet_r;
 286         struct test_join *tj;
 287         struct samr_SetUserInfo s;
 288         union samr_UserInfo u;
 289         struct lsa_String comment;
 290         struct lsa_String full_name;
 291
 292         tj = talloc(NULL, struct test_join);
 293         if (!tj) return NULL;
 294
 295         libnet_r = talloc(tj, struct libnet_JoinDomain);
 296         if (!libnet_r) {
 297                 talloc_free(tj);
 298                 return NULL;
 299         }
 300
 301         libnet_ctx = libnet_context_init(NULL);
 302         if (!libnet_ctx) {
 303                 talloc_free(tj);
 304                 return NULL;
 305         }
 306
 307         tj->libnet_r = libnet_r;
 308
 309         libnet_ctx->cred = cmdline_credentials;
 310         libnet_r->in.binding = lp_parm_string(-1, "torture", "binding");
 311         libnet_r->in.level = LIBNET_JOINDOMAIN_SPECIFIED;
 312         libnet_r->in.netbios_name = machine_name;
 313         libnet_r->in.account_name = talloc_asprintf(libnet_r, "%s$", machine_name);
 314         if (!libnet_r->in.account_name) {
 315                 talloc_free(tj);
 316                 return NULL;
 317         }
 318
 319         libnet_r->in.acct_type = acct_flags;
 320
 321         status = libnet_JoinDomain(libnet_ctx, libnet_r, libnet_r);
 322         if (!NT_STATUS_IS_OK(status)) {
 323                 DEBUG(0, ("Domain join failed - %s.\n", nt_errstr(status)));
 324                 talloc_free(tj);
 325                 return NULL;
 326         }
 327         tj->p = libnet_r->out.samr_pipe;
 328         tj->user_handle = *libnet_r->out.user_handle;
 329         tj->dom_sid = dom_sid_string(tj, libnet_r->out.domain_sid);
 330         *machine_password = libnet_r->out.join_password;
 331
 332         ZERO_STRUCT(u);
 333         s.in.user_handle = &tj->user_handle;
 334         s.in.info = &u;
 335         s.in.level = 21;
 336
 337         u.info21.fields_present = SAMR_FIELD_DESCRIPTION | SAMR_FIELD_COMMENT | SAMR_FIELD_FULL_NAME;
 338         comment.string = talloc_asprintf(tj,
 339                                          "Tortured by Samba4: %s",
 340                                          timestring(tj, time(NULL)));
 341         u.info21.comment = comment;
 342         full_name.string = talloc_asprintf(tj,
 343                                          "Torture account for Samba4: %s",
 344                                          timestring(tj, time(NULL)));
 345         u.info21.full_name = full_name;
 346
 347         u.info21.description.string = talloc_asprintf(tj,
 348                                                       "Samba4 torture account created by host %s: %s",
 349                                                       lp_netbios_name(), timestring(tj, time(NULL)));
 350
 351         status = dcerpc_samr_SetUserInfo(tj->p, tj, &s);
 352         if (!NT_STATUS_IS_OK(status)) {
 353                 printf("SetUserInfo (non-critical) failed - %s\n", nt_errstr(status));
 354         }
 355
 356         DEBUG(0, ("%s joined domain %s (%s).\n",
 357                   libnet_r->in.netbios_name,
 358                   libnet_r->out.domain_name,
 359                   tj->dom_sid));
 360
 361         return tj;
 362 }
 363
 364 struct dcerpc_pipe *torture_join_samr_pipe(struct test_join *join)
 365 {
 366         return join->p;
 367 }
 368
 369 struct policy_handle *torture_join_samr_user_policy(struct test_join *join)
 370 {
 371         return &join->user_handle;
 372 }
 373
 374 NTSTATUS torture_leave_ads_domain(TALLOC_CTX *mem_ctx, struct libnet_JoinDomain *libnet_r)
 375 {
 376         NTSTATUS status;
 377         int rtn;
 378         TALLOC_CTX *tmp_ctx;
 379
 380         struct ldb_dn *server_dn;
 381         struct ldb_context *ldb_ctx;
 382
 383         char *remote_ldb_url;
 384
 385         /* Check if we are a domain controller. If not, exit. */
 386         if (!libnet_r->out.server_dn_str) {
 387                 return NT_STATUS_OK;
 388         }
 389
 390         tmp_ctx = talloc_named(mem_ctx, 0, "torture_leave temporary context");
 391         if (!tmp_ctx) {
 392                 libnet_r->out.error_string = NULL;
 393                 return NT_STATUS_NO_MEMORY;
 394         }
 395
 396         ldb_ctx = ldb_init(tmp_ctx);
 397         if (!ldb_ctx) {
 398                 libnet_r->out.error_string = NULL;
 399                 talloc_free(tmp_ctx);
 400                 return NT_STATUS_NO_MEMORY;
 401         }
 402
 403         /* Remove CN=Servers,... entry from the AD. */
 404         server_dn = ldb_dn_explode(tmp_ctx, libnet_r->out.server_dn_str);
 405         if (!server_dn) {
 406                 libnet_r->out.error_string = NULL;
 407                 talloc_free(tmp_ctx);
 408                 return NT_STATUS_NO_MEMORY;
 409         }
 410
 411         remote_ldb_url = talloc_asprintf(tmp_ctx, "ldap://%s", libnet_r->out.samr_binding->host);
 412         if (!remote_ldb_url) {
 413                 libnet_r->out.error_string = NULL;
 414                 talloc_free(tmp_ctx);
 415                 return NT_STATUS_NO_MEMORY;
 416         }
 417
 418         rtn = ldb_connect(ldb_ctx, remote_ldb_url, 0, NULL);
 419         if (rtn != 0) {
 420                 libnet_r->out.error_string = NULL;
 421                 talloc_free(tmp_ctx);
 422                 return NT_STATUS_UNSUCCESSFUL;
 423         }
 424
 425         rtn = ldb_delete(ldb_ctx, server_dn);
 426         if (rtn != 0) {
 427                 libnet_r->out.error_string = NULL;
 428                 talloc_free(tmp_ctx);
 429                 return NT_STATUS_UNSUCCESSFUL;
 430         }
 431
 432         DEBUG(0, ("%s removed successfully.\n", libnet_r->out.server_dn_str));
 433
 434         talloc_free(tmp_ctx);
 435         return status;
 436 }
 437
 438 /*
 439   leave the domain, deleting the machine acct
 440 */
 441
 442 void torture_leave_domain(struct test_join *join)
 443 {
 444         struct samr_DeleteUser d;
 445         NTSTATUS status;
 446
 447         if (!join) {
 448                 return;
 449         }
 450         d.in.user_handle = &join->user_handle;
 451         d.out.user_handle = &join->user_handle;
 452
 453         /* Delete machine account */
 454         status = dcerpc_samr_DeleteUser(join->p, join, &d);
 455         if (!NT_STATUS_IS_OK(status)) {
 456                 printf("Delete of machine account failed\n");
 457         } else {
 458                 printf("Delete of machine account was successful.\n");
 459         }
 460
 461         if (join->libnet_r) {
 462                 status = torture_leave_ads_domain(join, join->libnet_r);
 463         }
 464
 465         talloc_free(join);
 466 }
 467
 468 /*
 469   return the dom sid for a test join
 470 */
 471 const char *torture_join_sid(struct test_join *join)
 472 {
 473         return join->dom_sid;
 474 }
 475
 476
 477 struct test_join_ads_dc {
 478         struct test_join *join;
 479 };
 480
 481 struct test_join_ads_dc *torture_join_domain_ads_dc(const char *machine_name,
 482                                                     const char *domain,
 483                                                     const char **machine_password)
 484 {
 485         struct test_join_ads_dc *join;
 486
 487         join = talloc(NULL, struct test_join_ads_dc);
 488         if (join == NULL) {
 489                 return NULL;
 490         }
 491
 492         join->join = torture_join_domain(machine_name,
 493                                         ACB_SVRTRUST,
 494                                         machine_password);
 495
 496         if (!join->join) {
 497                 return NULL;
 498         }
 499
 500         /* do netlogon DrsEnumerateDomainTrusts */
 501
 502         /* modify userAccountControl from 4096 to 532480 */
 503
 504         /* modify RDN to OU=Domain Controllers and skip the $ from server name */
 505
 506         /* ask objectVersion of Schema Partition */
 507
 508         /* ask rIDManagerReferenz of the Domain Partition */
 509
 510         /* ask fsMORoleOwner of the RID-Manager$ object
 511          * returns CN=NTDS Settings,CN=<DC>,CN=Servers,CN=Default-First-Site-Name, ...
 512          */
 513
 514         /* ask for dnsHostName of CN=<DC>,CN=Servers,CN=Default-First-Site-Name, ... */
 515
 516         /* ask for objectGUID of CN=NTDS Settings,CN=<DC>,CN=Servers,CN=Default-First-Site-Name, ... */
 517
 518         /* ask for * of CN=Default-First-Site-Name, ... */
 519
 520         /* search (&(|(objectClass=user)(objectClass=computer))(sAMAccountName=<machine_name>$)) in Domain Partition
 521          * attributes : distinguishedName, userAccountControl
 522          */
 523
 524         /* ask * for CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
 525          * should fail with noSuchObject
 526          */
 527
 528         /* add CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
 529          *
 530          * objectClass = server
 531          * systemFlags = 50000000
 532          * serverReferenz = CN=<machine_name>,OU=Domain Controllers,...
 533          */
 534
 535         /* ask for * of CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
 536          * should fail with noSuchObject
 537          */
 538
 539         /* search for (ncname=<domain_nc>) in CN=Partitions,CN=Configuration,...
 540          * attributes: ncName, dnsRoot
 541          */
 542
 543         /* modify add CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
 544          * serverReferenz = CN=<machine_name>,OU=Domain Controllers,...
 545          * should fail with attributeOrValueExists
 546          */
 547
 548         /* modify replace CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
 549          * serverReferenz = CN=<machine_name>,OU=Domain Controllers,...
 550          */
 551
 552         /* DsReplicaAdd to create the CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
 553          * needs to be tested
 554          */
 555
 556         return join;
 557 }
 558
 559 void torture_leave_domain_ads_dc(struct test_join_ads_dc *join)
 560 {
 561
 562         if (join->join) {
 563                 torture_leave_domain(join->join);
 564         }
 565
 566         talloc_free(join);
 567 }