2 Unix SMB/CIFS implementation.
4 utility code to join/leave a domain
6 Copyright (C) Andrew Tridgell 2004
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 2 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program; if not, write to the Free Software
20 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
24 this code is used by other torture modules to join/leave a domain
25 as either a member, bdc or thru a trust relationship
29 #include "torture/torture.h"
30 #include "system/time.h"
31 #include "lib/crypto/crypto.h"
32 #include "libnet/libnet.h"
33 #include "lib/cmdline/popt_common.h"
35 #include "lib/ldb/include/ldb.h"
36 #include "librpc/gen_ndr/ndr_samr_c.h"
38 #include "libcli/auth/libcli_auth.h"
39 #include "torture/rpc/rpc.h"
40 #include "libcli/security/proto.h"
43 struct dcerpc_pipe *p;
44 struct policy_handle user_handle;
45 struct libnet_JoinDomain *libnet_r;
46 struct dom_sid *dom_sid;
47 struct dom_sid *user_sid;
51 static NTSTATUS DeleteUser_byname(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
52 struct policy_handle *handle, const char *name)
55 struct samr_DeleteUser d;
56 struct policy_handle user_handle;
58 struct samr_LookupNames n;
59 struct lsa_String sname;
60 struct samr_OpenUser r;
64 n.in.domain_handle = handle;
68 status = dcerpc_samr_LookupNames(p, mem_ctx, &n);
69 if (NT_STATUS_IS_OK(status)) {
70 rid = n.out.rids.ids[0];
75 r.in.domain_handle = handle;
76 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
78 r.out.user_handle = &user_handle;
80 status = dcerpc_samr_OpenUser(p, mem_ctx, &r);
81 if (!NT_STATUS_IS_OK(status)) {
82 printf("OpenUser(%s) failed - %s\n", name, nt_errstr(status));
86 d.in.user_handle = &user_handle;
87 d.out.user_handle = &user_handle;
88 status = dcerpc_samr_DeleteUser(p, mem_ctx, &d);
89 if (!NT_STATUS_IS_OK(status)) {
97 create a test user in the domain
98 an opaque pointer is returned. Pass it to torture_leave_domain()
102 struct test_join *torture_create_testuser(const char *username,
105 const char **random_password)
108 struct samr_Connect c;
109 struct samr_CreateUser2 r;
110 struct samr_OpenDomain o;
111 struct samr_LookupDomain l;
112 struct samr_GetUserPwInfo pwp;
113 struct samr_SetUserInfo s;
114 union samr_UserInfo u;
115 struct policy_handle handle;
116 struct policy_handle domain_handle;
117 uint32_t access_granted;
119 DATA_BLOB session_key;
120 struct lsa_String name;
122 int policy_min_pw_len = 0;
123 struct test_join *join;
126 join = talloc(NULL, struct test_join);
133 printf("Connecting to SAMR\n");
135 status = torture_rpc_connection(join,
138 if (!NT_STATUS_IS_OK(status)) {
142 c.in.system_name = NULL;
143 c.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
144 c.out.connect_handle = &handle;
146 status = dcerpc_samr_Connect(join->p, join, &c);
147 if (!NT_STATUS_IS_OK(status)) {
148 const char *errstr = nt_errstr(status);
149 if (NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
150 errstr = dcerpc_errstr(join, join->p->last_fault_code);
152 printf("samr_Connect failed - %s\n", errstr);
156 printf("Opening domain %s\n", domain);
158 name.string = domain;
159 l.in.connect_handle = &handle;
160 l.in.domain_name = &name;
162 status = dcerpc_samr_LookupDomain(join->p, join, &l);
163 if (!NT_STATUS_IS_OK(status)) {
164 printf("LookupDomain failed - %s\n", nt_errstr(status));
168 talloc_steal(join, l.out.sid);
169 join->dom_sid = l.out.sid;
171 o.in.connect_handle = &handle;
172 o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
173 o.in.sid = l.out.sid;
174 o.out.domain_handle = &domain_handle;
176 status = dcerpc_samr_OpenDomain(join->p, join, &o);
177 if (!NT_STATUS_IS_OK(status)) {
178 printf("OpenDomain failed - %s\n", nt_errstr(status));
182 printf("Creating account %s\n", username);
185 name.string = username;
186 r.in.domain_handle = &domain_handle;
187 r.in.account_name = &name;
188 r.in.acct_flags = acct_type;
189 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
190 r.out.user_handle = &join->user_handle;
191 r.out.access_granted = &access_granted;
194 status = dcerpc_samr_CreateUser2(join->p, join, &r);
196 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
197 status = DeleteUser_byname(join->p, join, &domain_handle, name.string);
198 if (NT_STATUS_IS_OK(status)) {
203 if (!NT_STATUS_IS_OK(status)) {
204 printf("CreateUser2 failed - %s\n", nt_errstr(status));
208 join->user_sid = dom_sid_add_rid(join, join->dom_sid, rid);
210 pwp.in.user_handle = &join->user_handle;
212 status = dcerpc_samr_GetUserPwInfo(join->p, join, &pwp);
213 if (NT_STATUS_IS_OK(status)) {
214 policy_min_pw_len = pwp.out.info.min_password_length;
217 random_pw = generate_random_str(join, MAX(8, policy_min_pw_len));
219 printf("Setting account password '%s'\n", random_pw);
221 s.in.user_handle = &join->user_handle;
225 encode_pw_buffer(u.info24.password.data, random_pw, STR_UNICODE);
226 u.info24.pw_len = strlen(random_pw);
228 status = dcerpc_fetch_session_key(join->p, &session_key);
229 if (!NT_STATUS_IS_OK(status)) {
230 printf("SetUserInfo level %u - no session key - %s\n",
231 s.in.level, nt_errstr(status));
232 torture_leave_domain(join);
236 arcfour_crypt_blob(u.info24.password.data, 516, &session_key);
238 status = dcerpc_samr_SetUserInfo(join->p, join, &s);
239 if (!NT_STATUS_IS_OK(status)) {
240 printf("SetUserInfo failed - %s\n", nt_errstr(status));
245 s.in.user_handle = &join->user_handle;
249 u.info21.acct_flags = acct_type;
250 u.info21.fields_present = SAMR_FIELD_ACCT_FLAGS | SAMR_FIELD_DESCRIPTION | SAMR_FIELD_COMMENT | SAMR_FIELD_FULL_NAME;
252 u.info21.comment.string = talloc_asprintf(join,
253 "Tortured by Samba4: %s",
254 timestring(join, time(NULL)));
256 u.info21.full_name.string = talloc_asprintf(join,
257 "Torture account for Samba4: %s",
258 timestring(join, time(NULL)));
260 u.info21.description.string = talloc_asprintf(join,
261 "Samba4 torture account created by host %s: %s",
262 lp_netbios_name(), timestring(join, time(NULL)));
264 printf("Resetting ACB flags, force pw change time\n");
266 status = dcerpc_samr_SetUserInfo(join->p, join, &s);
267 if (!NT_STATUS_IS_OK(status)) {
268 printf("SetUserInfo failed - %s\n", nt_errstr(status));
272 if (random_password) {
273 *random_password = random_pw;
279 torture_leave_domain(join);
284 struct test_join *torture_join_domain(const char *machine_name,
286 struct cli_credentials **machine_credentials)
289 struct libnet_context *libnet_ctx;
290 struct libnet_JoinDomain *libnet_r;
291 struct test_join *tj;
292 struct samr_SetUserInfo s;
293 union samr_UserInfo u;
295 tj = talloc(NULL, struct test_join);
296 if (!tj) return NULL;
298 libnet_r = talloc(tj, struct libnet_JoinDomain);
304 libnet_ctx = libnet_context_init(NULL);
310 tj->libnet_r = libnet_r;
312 libnet_ctx->cred = cmdline_credentials;
313 libnet_r->in.binding = lp_parm_string(-1, "torture", "binding");
314 if (!libnet_r->in.binding) {
315 libnet_r->in.binding = talloc_asprintf(libnet_r, "ncacn_np:%s", lp_parm_string(-1, "torture", "host"));
317 libnet_r->in.level = LIBNET_JOINDOMAIN_SPECIFIED;
318 libnet_r->in.netbios_name = machine_name;
319 libnet_r->in.account_name = talloc_asprintf(libnet_r, "%s$", machine_name);
320 if (!libnet_r->in.account_name) {
325 libnet_r->in.acct_type = acct_flags;
326 libnet_r->in.recreate_account = True;
328 status = libnet_JoinDomain(libnet_ctx, libnet_r, libnet_r);
329 if (!NT_STATUS_IS_OK(status)) {
330 if (libnet_r->out.error_string) {
331 DEBUG(0, ("Domain join failed - %s.\n", libnet_r->out.error_string));
333 DEBUG(0, ("Domain join failed - %s.\n", nt_errstr(status)));
338 tj->p = libnet_r->out.samr_pipe;
339 tj->user_handle = *libnet_r->out.user_handle;
340 tj->dom_sid = libnet_r->out.domain_sid;
341 talloc_steal(tj, libnet_r->out.domain_sid);
344 s.in.user_handle = &tj->user_handle;
348 u.info21.fields_present = SAMR_FIELD_DESCRIPTION | SAMR_FIELD_COMMENT | SAMR_FIELD_FULL_NAME;
349 u.info21.comment.string = talloc_asprintf(tj,
350 "Tortured by Samba4: %s",
351 timestring(tj, time(NULL)));
352 u.info21.full_name.string = talloc_asprintf(tj,
353 "Torture account for Samba4: %s",
354 timestring(tj, time(NULL)));
356 u.info21.description.string = talloc_asprintf(tj,
357 "Samba4 torture account created by host %s: %s",
358 lp_netbios_name(), timestring(tj, time(NULL)));
360 status = dcerpc_samr_SetUserInfo(tj->p, tj, &s);
361 if (!NT_STATUS_IS_OK(status)) {
362 printf("SetUserInfo (non-critical) failed - %s\n", nt_errstr(status));
365 *machine_credentials = cli_credentials_init(tj);
366 cli_credentials_set_conf(*machine_credentials);
367 cli_credentials_set_workstation(*machine_credentials, machine_name, CRED_SPECIFIED);
368 cli_credentials_set_domain(*machine_credentials, libnet_r->out.domain_name, CRED_SPECIFIED);
369 if (libnet_r->out.realm) {
370 cli_credentials_set_realm(*machine_credentials, libnet_r->out.realm, CRED_SPECIFIED);
372 cli_credentials_set_username(*machine_credentials, libnet_r->in.account_name, CRED_SPECIFIED);
373 cli_credentials_set_password(*machine_credentials, libnet_r->out.join_password, CRED_SPECIFIED);
374 if (acct_flags & ACB_SVRTRUST) {
375 cli_credentials_set_secure_channel_type(*machine_credentials,
377 } else if (acct_flags & ACB_WSTRUST) {
378 cli_credentials_set_secure_channel_type(*machine_credentials,
381 DEBUG(0, ("Invalid account type specificed to torture_join_domain\n"));
382 talloc_free(*machine_credentials);
389 struct dcerpc_pipe *torture_join_samr_pipe(struct test_join *join)
394 struct policy_handle *torture_join_samr_user_policy(struct test_join *join)
396 return &join->user_handle;
399 NTSTATUS torture_leave_ads_domain(TALLOC_CTX *mem_ctx, struct libnet_JoinDomain *libnet_r)
404 struct ldb_dn *server_dn;
405 struct ldb_context *ldb_ctx;
407 char *remote_ldb_url;
409 /* Check if we are a domain controller. If not, exit. */
410 if (!libnet_r->out.server_dn_str) {
414 tmp_ctx = talloc_named(mem_ctx, 0, "torture_leave temporary context");
416 libnet_r->out.error_string = NULL;
417 return NT_STATUS_NO_MEMORY;
420 ldb_ctx = ldb_init(tmp_ctx);
422 libnet_r->out.error_string = NULL;
423 talloc_free(tmp_ctx);
424 return NT_STATUS_NO_MEMORY;
427 /* Remove CN=Servers,... entry from the AD. */
428 server_dn = ldb_dn_explode(tmp_ctx, libnet_r->out.server_dn_str);
430 libnet_r->out.error_string = NULL;
431 talloc_free(tmp_ctx);
432 return NT_STATUS_NO_MEMORY;
435 remote_ldb_url = talloc_asprintf(tmp_ctx, "ldap://%s", libnet_r->out.samr_binding->host);
436 if (!remote_ldb_url) {
437 libnet_r->out.error_string = NULL;
438 talloc_free(tmp_ctx);
439 return NT_STATUS_NO_MEMORY;
442 rtn = ldb_connect(ldb_ctx, remote_ldb_url, 0, NULL);
444 libnet_r->out.error_string = NULL;
445 talloc_free(tmp_ctx);
446 return NT_STATUS_UNSUCCESSFUL;
449 rtn = ldb_delete(ldb_ctx, server_dn);
451 libnet_r->out.error_string = NULL;
452 talloc_free(tmp_ctx);
453 return NT_STATUS_UNSUCCESSFUL;
456 DEBUG(0, ("%s removed successfully.\n", libnet_r->out.server_dn_str));
458 talloc_free(tmp_ctx);
463 leave the domain, deleting the machine acct
466 void torture_leave_domain(struct test_join *join)
468 struct samr_DeleteUser d;
474 d.in.user_handle = &join->user_handle;
475 d.out.user_handle = &join->user_handle;
477 /* Delete machine account */
478 status = dcerpc_samr_DeleteUser(join->p, join, &d);
479 if (!NT_STATUS_IS_OK(status)) {
480 printf("Delete of machine account failed\n");
482 printf("Delete of machine account was successful.\n");
485 if (join->libnet_r) {
486 status = torture_leave_ads_domain(join, join->libnet_r);
493 return the dom sid for a test join
495 const struct dom_sid *torture_join_sid(struct test_join *join)
497 return join->dom_sid;
500 const struct dom_sid *torture_join_user_sid(struct test_join *join)
502 return join->user_sid;
506 struct test_join_ads_dc {
507 struct test_join *join;
510 struct test_join_ads_dc *torture_join_domain_ads_dc(const char *machine_name,
512 struct cli_credentials **machine_credentials)
514 struct test_join_ads_dc *join;
516 join = talloc(NULL, struct test_join_ads_dc);
521 join->join = torture_join_domain(machine_name,
523 machine_credentials);
529 /* do netlogon DrsEnumerateDomainTrusts */
531 /* modify userAccountControl from 4096 to 532480 */
533 /* modify RDN to OU=Domain Controllers and skip the $ from server name */
535 /* ask objectVersion of Schema Partition */
537 /* ask rIDManagerReferenz of the Domain Partition */
539 /* ask fsMORoleOwner of the RID-Manager$ object
540 * returns CN=NTDS Settings,CN=<DC>,CN=Servers,CN=Default-First-Site-Name, ...
543 /* ask for dnsHostName of CN=<DC>,CN=Servers,CN=Default-First-Site-Name, ... */
545 /* ask for objectGUID of CN=NTDS Settings,CN=<DC>,CN=Servers,CN=Default-First-Site-Name, ... */
547 /* ask for * of CN=Default-First-Site-Name, ... */
549 /* search (&(|(objectClass=user)(objectClass=computer))(sAMAccountName=<machine_name>$)) in Domain Partition
550 * attributes : distinguishedName, userAccountControl
553 /* ask * for CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
554 * should fail with noSuchObject
557 /* add CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
559 * objectClass = server
560 * systemFlags = 50000000
561 * serverReferenz = CN=<machine_name>,OU=Domain Controllers,...
564 /* ask for * of CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
565 * should fail with noSuchObject
568 /* search for (ncname=<domain_nc>) in CN=Partitions,CN=Configuration,...
569 * attributes: ncName, dnsRoot
572 /* modify add CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
573 * serverReferenz = CN=<machine_name>,OU=Domain Controllers,...
574 * should fail with attributeOrValueExists
577 /* modify replace CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
578 * serverReferenz = CN=<machine_name>,OU=Domain Controllers,...
581 /* DsReplicaAdd to create the CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
588 void torture_leave_domain_ads_dc(struct test_join_ads_dc *join)
592 torture_leave_domain(join->join);