Remove more event_context_init() uses from function calls within deep down the code.
[bbaumbach/samba-autobuild/.git] / source4 / torture / rpc / schannel.c
1 /* 
2    Unix SMB/CIFS implementation.
3
4    test suite for schannel operations
5
6    Copyright (C) Andrew Tridgell 2004
7    
8    This program is free software; you can redistribute it and/or modify
9    it under the terms of the GNU General Public License as published by
10    the Free Software Foundation; either version 3 of the License, or
11    (at your option) any later version.
12    
13    This program is distributed in the hope that it will be useful,
14    but WITHOUT ANY WARRANTY; without even the implied warranty of
15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16    GNU General Public License for more details.
17    
18    You should have received a copy of the GNU General Public License
19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
20 */
21
22 #include "includes.h"
23 #include "librpc/gen_ndr/ndr_netlogon_c.h"
24 #include "librpc/gen_ndr/ndr_lsa_c.h"
25 #include "librpc/gen_ndr/ndr_samr_c.h"
26 #include "auth/credentials/credentials.h"
27 #include "torture/rpc/rpc.h"
28 #include "lib/cmdline/popt_common.h"
29 #include "auth/gensec/schannel_proto.h"
30 #include "libcli/auth/libcli_auth.h"
31 #include "libcli/security/security.h"
32 #include "system/filesys.h"
33 #include "param/param.h"
34 #include "librpc/rpc/dcerpc_proto.h"
35 #include "auth/gensec/gensec.h"
36
37 #define TEST_MACHINE_NAME "schannel"
38
39 /*
40   try a netlogon SamLogon
41 */
42 bool test_netlogon_ex_ops(struct dcerpc_pipe *p, struct torture_context *tctx, 
43                           struct cli_credentials *credentials, 
44                           struct creds_CredentialState *creds)
45 {
46         NTSTATUS status;
47         struct netr_LogonSamLogonEx r;
48         struct netr_NetworkInfo ninfo;
49         DATA_BLOB names_blob, chal, lm_resp, nt_resp;
50         int i;
51         int flags = CLI_CRED_NTLM_AUTH;
52         if (lp_client_lanman_auth(tctx->lp_ctx)) {
53                 flags |= CLI_CRED_LANMAN_AUTH;
54         }
55
56         if (lp_client_ntlmv2_auth(tctx->lp_ctx)) {
57                 flags |= CLI_CRED_NTLMv2_AUTH;
58         }
59
60         cli_credentials_get_ntlm_username_domain(cmdline_credentials, tctx, 
61                                                  &ninfo.identity_info.account_name.string,
62                                                  &ninfo.identity_info.domain_name.string);
63         
64         generate_random_buffer(ninfo.challenge, 
65                                sizeof(ninfo.challenge));
66         chal = data_blob_const(ninfo.challenge, 
67                                sizeof(ninfo.challenge));
68
69         names_blob = NTLMv2_generate_names_blob(tctx, lp_iconv_convenience(tctx->lp_ctx), cli_credentials_get_workstation(credentials), 
70                                                 cli_credentials_get_domain(credentials));
71
72         status = cli_credentials_get_ntlm_response(cmdline_credentials, tctx, 
73                                                    &flags, 
74                                                    chal,
75                                                    names_blob,
76                                                    &lm_resp, &nt_resp,
77                                                    NULL, NULL);
78         torture_assert_ntstatus_ok(tctx, status, 
79                                    "cli_credentials_get_ntlm_response failed");
80
81         ninfo.lm.data = lm_resp.data;
82         ninfo.lm.length = lm_resp.length;
83
84         ninfo.nt.data = nt_resp.data;
85         ninfo.nt.length = nt_resp.length;
86
87         ninfo.identity_info.parameter_control = 0;
88         ninfo.identity_info.logon_id_low = 0;
89         ninfo.identity_info.logon_id_high = 0;
90         ninfo.identity_info.workstation.string = cli_credentials_get_workstation(credentials);
91
92         r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
93         r.in.computer_name = cli_credentials_get_workstation(credentials);
94         r.in.logon_level = 2;
95         r.in.logon.network = &ninfo;
96         r.in.flags = 0;
97
98         torture_comment(tctx, 
99                         "Testing LogonSamLogonEx with name %s\n", 
100                         ninfo.identity_info.account_name.string);
101         
102         for (i=2;i<3;i++) {
103                 r.in.validation_level = i;
104                 
105                 status = dcerpc_netr_LogonSamLogonEx(p, tctx, &r);
106                 torture_assert_ntstatus_ok(tctx, status, "LogonSamLogon failed");
107         }
108
109         return true;
110 }
111
112 /*
113   do some samr ops using the schannel connection
114  */
115 static bool test_samr_ops(struct torture_context *tctx,
116                           struct dcerpc_pipe *p)
117 {
118         NTSTATUS status;
119         struct samr_GetDomPwInfo r;
120         struct samr_Connect connect;
121         struct samr_OpenDomain opendom;
122         int i;
123         struct lsa_String name;
124         struct policy_handle handle;
125         struct policy_handle domain_handle;
126
127         name.string = lp_workgroup(tctx->lp_ctx);
128         r.in.domain_name = &name;
129
130         connect.in.system_name = 0;
131         connect.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
132         connect.out.connect_handle = &handle;
133         
134         printf("Testing Connect and OpenDomain on BUILTIN\n");
135
136         status = dcerpc_samr_Connect(p, tctx, &connect);
137         if (!NT_STATUS_IS_OK(status)) {
138                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
139                         printf("Connect failed (expected, schannel mapped to anonymous): %s\n",
140                                nt_errstr(status));
141                 } else {
142                         printf("Connect failed - %s\n", nt_errstr(status));
143                         return false;
144                 }
145         } else {
146                 opendom.in.connect_handle = &handle;
147                 opendom.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
148                 opendom.in.sid = dom_sid_parse_talloc(tctx, "S-1-5-32");
149                 opendom.out.domain_handle = &domain_handle;
150                 
151                 status = dcerpc_samr_OpenDomain(p, tctx, &opendom);
152                 if (!NT_STATUS_IS_OK(status)) {
153                         printf("OpenDomain failed - %s\n", nt_errstr(status));
154                         return false;
155                 }
156         }
157
158         printf("Testing GetDomPwInfo with name %s\n", r.in.domain_name->string);
159         
160         /* do several ops to test credential chaining */
161         for (i=0;i<5;i++) {
162                 status = dcerpc_samr_GetDomPwInfo(p, tctx, &r);
163                 if (!NT_STATUS_IS_OK(status)) {
164                         if (!NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
165                                 printf("GetDomPwInfo op %d failed - %s\n", i, nt_errstr(status));
166                                 return false;
167                         }
168                 }
169         }
170
171         return true;
172 }
173
174
175 /*
176   do some lsa ops using the schannel connection
177  */
178 static bool test_lsa_ops(struct torture_context *tctx, struct dcerpc_pipe *p)
179 {
180         struct lsa_GetUserName r;
181         NTSTATUS status;
182         bool ret = true;
183         struct lsa_StringPointer authority_name_p;
184
185         printf("\nTesting GetUserName\n");
186
187         r.in.system_name = "\\";        
188         r.in.account_name = NULL;       
189         r.in.authority_name = &authority_name_p;
190         authority_name_p.string = NULL;
191
192         /* do several ops to test credential chaining and various operations */
193         status = dcerpc_lsa_GetUserName(p, tctx, &r);
194         
195         if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROTSEQ_NOT_SUPPORTED)) {
196                 printf("not considering %s to be an error\n", nt_errstr(status));
197         } else if (!NT_STATUS_IS_OK(status)) {
198                 printf("GetUserName failed - %s\n", nt_errstr(status));
199                 return false;
200         } else {
201                 if (!r.out.account_name) {
202                         return false;
203                 }
204                 
205                 if (strcmp(r.out.account_name->string, "ANONYMOUS LOGON") != 0) {
206                         printf("GetUserName returned wrong user: %s, expected %s\n",
207                                r.out.account_name->string, "ANONYMOUS LOGON");
208                         return false;
209                 }
210                 if (!r.out.authority_name || !r.out.authority_name->string) {
211                         return false;
212                 }
213                 
214                 if (strcmp(r.out.authority_name->string->string, "NT AUTHORITY") != 0) {
215                         printf("GetUserName returned wrong user: %s, expected %s\n",
216                                r.out.authority_name->string->string, "NT AUTHORITY");
217                         return false;
218                 }
219         }
220         if (!test_many_LookupSids(p, tctx, NULL)) {
221                 printf("LsaLookupSids3 failed!\n");
222                 return false;
223         }
224
225         return ret;
226 }
227
228
229 /*
230   test a schannel connection with the given flags
231  */
232 static bool test_schannel(struct torture_context *tctx,
233                           uint16_t acct_flags, uint32_t dcerpc_flags,
234                           int i)
235 {
236         struct test_join *join_ctx;
237         NTSTATUS status;
238         const char *binding = torture_setting_string(tctx, "binding", NULL);
239         struct dcerpc_binding *b;
240         struct dcerpc_pipe *p = NULL;
241         struct dcerpc_pipe *p_netlogon = NULL;
242         struct dcerpc_pipe *p_netlogon2 = NULL;
243         struct dcerpc_pipe *p_netlogon3 = NULL;
244         struct dcerpc_pipe *p_samr2 = NULL;
245         struct dcerpc_pipe *p_lsa = NULL;
246         struct creds_CredentialState *creds;
247         struct cli_credentials *credentials;
248
249         join_ctx = torture_join_domain(tctx, 
250                                        talloc_asprintf(tctx, "%s%d", TEST_MACHINE_NAME, i), 
251                                        acct_flags, &credentials);
252         torture_assert(tctx, join_ctx != NULL, "Failed to join domain");
253
254         status = dcerpc_parse_binding(tctx, binding, &b);
255         torture_assert_ntstatus_ok(tctx, status, "Bad binding string");
256
257         b->flags &= ~DCERPC_AUTH_OPTIONS;
258         b->flags |= dcerpc_flags;
259
260         status = dcerpc_pipe_connect_b(tctx, &p, b, &ndr_table_samr,
261                                        credentials, tctx->ev, tctx->lp_ctx);
262         torture_assert_ntstatus_ok(tctx, status, 
263                 "Failed to connect with schannel");
264
265         torture_assert(tctx, test_samr_ops(tctx, p), 
266                        "Failed to process schannel secured SAMR ops");
267
268         /* Also test that when we connect to the netlogon pipe, that
269          * the credentials we setup on the first pipe are valid for
270          * the second */
271
272         /* Swap the binding details from SAMR to NETLOGON */
273         status = dcerpc_epm_map_binding(tctx, b, &ndr_table_netlogon, tctx->ev, tctx->lp_ctx);
274         torture_assert_ntstatus_ok(tctx, status, "epm map");
275
276         status = dcerpc_secondary_connection(p, &p_netlogon, 
277                                              b);
278         torture_assert_ntstatus_ok(tctx, status, "seconday connection");
279
280         status = dcerpc_bind_auth(p_netlogon, &ndr_table_netlogon, 
281                                   credentials, tctx->lp_ctx,
282                                   DCERPC_AUTH_TYPE_SCHANNEL,
283                                   dcerpc_auth_level(p->conn),
284                                   NULL);
285
286         torture_assert_ntstatus_ok(tctx, status, "bind auth");
287
288         status = dcerpc_schannel_creds(p_netlogon->conn->security_state.generic_state, tctx, &creds);
289         torture_assert_ntstatus_ok(tctx, status, "schannel creds");
290
291         /* do a couple of logins */
292         torture_assert(tctx, test_netlogon_ops(p_netlogon, tctx, credentials, creds),
293                 "Failed to process schannel secured NETLOGON ops");
294
295         torture_assert(tctx, test_netlogon_ex_ops(p_netlogon, tctx, credentials, creds),
296                 "Failed to process schannel secured NETLOGON EX ops");
297
298         /* Swap the binding details from SAMR to LSARPC */
299         status = dcerpc_epm_map_binding(tctx, b, &ndr_table_lsarpc, tctx->ev, tctx->lp_ctx);
300         torture_assert_ntstatus_ok(tctx, status, "epm map");
301
302         status = dcerpc_secondary_connection(p, &p_lsa, 
303                                              b);
304
305         torture_assert_ntstatus_ok(tctx, status, "seconday connection");
306
307         status = dcerpc_bind_auth(p_lsa, &ndr_table_lsarpc,
308                                   credentials, tctx->lp_ctx,
309                                   DCERPC_AUTH_TYPE_SCHANNEL,
310                                   dcerpc_auth_level(p->conn),
311                                   NULL);
312
313         torture_assert_ntstatus_ok(tctx, status, "bind auth");
314
315         torture_assert(tctx, test_lsa_ops(tctx, p_lsa), 
316                 "Failed to process schannel secured LSA ops");
317
318         /* Drop the socket, we want to start from scratch */
319         talloc_free(p);
320         p = NULL;
321
322         /* Now see what we are still allowed to do */
323         
324         status = dcerpc_parse_binding(tctx, binding, &b);
325         torture_assert_ntstatus_ok(tctx, status, "Bad binding string");
326
327         b->flags &= ~DCERPC_AUTH_OPTIONS;
328         b->flags |= dcerpc_flags;
329
330         status = dcerpc_pipe_connect_b(tctx, &p_samr2, b, &ndr_table_samr,
331                                        credentials, tctx->ev, tctx->lp_ctx);
332         torture_assert_ntstatus_ok(tctx, status, 
333                 "Failed to connect with schannel");
334
335         /* do a some SAMR operations.  We have *not* done a new serverauthenticate */
336         torture_assert (tctx, test_samr_ops(tctx, p_samr2), 
337                         "Failed to process schannel secured SAMR ops (on fresh connection)");
338
339         /* Swap the binding details from SAMR to NETLOGON */
340         status = dcerpc_epm_map_binding(tctx, b, &ndr_table_netlogon, tctx->ev, tctx->lp_ctx);
341         torture_assert_ntstatus_ok(tctx, status, "epm");
342
343         status = dcerpc_secondary_connection(p_samr2, &p_netlogon2, 
344                                              b);
345         torture_assert_ntstatus_ok(tctx, status, "seconday connection");
346
347         /* and now setup an SCHANNEL bind on netlogon */
348         status = dcerpc_bind_auth(p_netlogon2, &ndr_table_netlogon,
349                                   credentials, tctx->lp_ctx,
350                                   DCERPC_AUTH_TYPE_SCHANNEL,
351                                   dcerpc_auth_level(p_samr2->conn),
352                                   NULL);
353
354         torture_assert_ntstatus_ok(tctx, status, "auth failed");
355         
356         /* Try the schannel-only SamLogonEx operation */
357         torture_assert(tctx, test_netlogon_ex_ops(p_netlogon2, tctx, credentials, creds), 
358                        "Failed to process schannel secured NETLOGON EX ops (on fresh connection)");
359                 
360
361         /* And the more traditional style, proving that the
362          * credentials chaining state is fully present */
363         torture_assert(tctx, test_netlogon_ops(p_netlogon2, tctx, credentials, creds),
364                              "Failed to process schannel secured NETLOGON ops (on fresh connection)");
365
366         /* Drop the socket, we want to start from scratch (again) */
367         talloc_free(p_samr2);
368
369         /* We don't want schannel for this test */
370         b->flags &= ~DCERPC_AUTH_OPTIONS;
371
372         status = dcerpc_pipe_connect_b(tctx, &p_netlogon3, b, &ndr_table_netlogon,
373                                        credentials, tctx->ev, tctx->lp_ctx);
374         torture_assert_ntstatus_ok(tctx, status, "Failed to connect without schannel");
375
376         torture_assert(tctx, !test_netlogon_ex_ops(p_netlogon3, tctx, credentials, creds),
377                         "Processed NOT schannel secured NETLOGON EX ops without SCHANNEL (unsafe)");
378
379         /* Required because the previous call will mark the current context as having failed */
380         tctx->last_result = TORTURE_OK;
381         tctx->last_reason = NULL;
382
383         torture_assert(tctx, test_netlogon_ops(p_netlogon3, tctx, credentials, creds),
384                         "Failed to processed NOT schannel secured NETLOGON ops without new ServerAuth");
385
386         torture_leave_domain(join_ctx);
387         return true;
388 }
389
390
391
392 /*
393   a schannel test suite
394  */
395 bool torture_rpc_schannel(struct torture_context *torture)
396 {
397         bool ret = true;
398         struct {
399                 uint16_t acct_flags;
400                 uint32_t dcerpc_flags;
401         } tests[] = {
402                 { ACB_WSTRUST,   DCERPC_SCHANNEL | DCERPC_SIGN},
403                 { ACB_WSTRUST,   DCERPC_SCHANNEL | DCERPC_SEAL},
404                 { ACB_WSTRUST,   DCERPC_SCHANNEL | DCERPC_SIGN | DCERPC_SCHANNEL_128},
405                 { ACB_WSTRUST,   DCERPC_SCHANNEL | DCERPC_SEAL | DCERPC_SCHANNEL_128 },
406                 { ACB_SVRTRUST,  DCERPC_SCHANNEL | DCERPC_SIGN },
407                 { ACB_SVRTRUST,  DCERPC_SCHANNEL | DCERPC_SEAL },
408                 { ACB_SVRTRUST,  DCERPC_SCHANNEL | DCERPC_SIGN | DCERPC_SCHANNEL_128 },
409                 { ACB_SVRTRUST,  DCERPC_SCHANNEL | DCERPC_SEAL | DCERPC_SCHANNEL_128 }
410         };
411         int i;
412
413         for (i=0;i<ARRAY_SIZE(tests);i++) {
414                 if (!test_schannel(torture, 
415                                    tests[i].acct_flags, tests[i].dcerpc_flags,
416                                    i)) {
417                         torture_comment(torture, "Failed with acct_flags=0x%x dcerpc_flags=0x%x \n",
418                                tests[i].acct_flags, tests[i].dcerpc_flags);
419                         ret = false;
420                 }
421         }
422
423         return ret;
424 }
425
426 /*
427   test two schannel connections
428  */
429 bool torture_rpc_schannel2(struct torture_context *torture)
430 {
431         struct test_join *join_ctx;
432         NTSTATUS status;
433         const char *binding = torture_setting_string(torture, "binding", NULL);
434         struct dcerpc_binding *b;
435         struct dcerpc_pipe *p1 = NULL, *p2 = NULL;
436         struct cli_credentials *credentials1, *credentials2;
437         uint32_t dcerpc_flags = DCERPC_SCHANNEL | DCERPC_SIGN;
438
439         join_ctx = torture_join_domain(torture, talloc_asprintf(torture, "%s2", TEST_MACHINE_NAME), 
440                                        ACB_WSTRUST, &credentials1);
441         torture_assert(torture, join_ctx != NULL, 
442                        "Failed to join domain with acct_flags=ACB_WSTRUST");
443
444         credentials2 = (struct cli_credentials *)talloc_memdup(torture, credentials1, sizeof(*credentials1));
445         credentials1->netlogon_creds = NULL;
446         credentials2->netlogon_creds = NULL;
447
448         status = dcerpc_parse_binding(torture, binding, &b);
449         torture_assert_ntstatus_ok(torture, status, "Bad binding string");
450
451         b->flags &= ~DCERPC_AUTH_OPTIONS;
452         b->flags |= dcerpc_flags;
453
454         printf("Opening first connection\n");
455         status = dcerpc_pipe_connect_b(torture, &p1, b, &ndr_table_netlogon,
456                                        credentials1, torture->ev, torture->lp_ctx);
457         torture_assert_ntstatus_ok(torture, status, "Failed to connect with schannel");
458
459         torture_comment(torture, "Opening second connection\n");
460         status = dcerpc_pipe_connect_b(torture, &p2, b, &ndr_table_netlogon,
461                                        credentials2, torture->ev, torture->lp_ctx);
462         torture_assert_ntstatus_ok(torture, status, "Failed to connect with schannel");
463
464         credentials1->netlogon_creds = NULL;
465         credentials2->netlogon_creds = NULL;
466
467         torture_comment(torture, "Testing logon on pipe1\n");
468         if (!test_netlogon_ex_ops(p1, torture, credentials1, NULL))
469                 return false;
470
471         torture_comment(torture, "Testing logon on pipe2\n");
472         if (!test_netlogon_ex_ops(p2, torture, credentials2, NULL))
473                 return false;
474
475         torture_comment(torture, "Again on pipe1\n");
476         if (!test_netlogon_ex_ops(p1, torture, credentials1, NULL))
477                 return false;
478
479         torture_comment(torture, "Again on pipe2\n");
480         if (!test_netlogon_ex_ops(p2, torture, credentials2, NULL))
481                 return false;
482
483         torture_leave_domain(join_ctx);
484         return true;
485 }
486