source/torture/rpc/samba3rpc.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    dcerpc torture tests, designed to walk Samba3 code paths
   5
   6    Copyright (C) Volker Lendecke 2006
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 2 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program; if not, write to the Free Software
  20    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21 */
  22
  23 #include "includes.h"
  24 #include "torture/torture.h"
  25 #include "librpc/gen_ndr/ndr_lsa.h"
  26 #include "librpc/gen_ndr/ndr_lsa_c.h"
  27 #include "librpc/gen_ndr/ndr_samr.h"
  28 #include "librpc/gen_ndr/ndr_samr_c.h"
  29 #include "librpc/gen_ndr/ndr_netlogon.h"
  30 #include "librpc/gen_ndr/ndr_netlogon_c.h"
  31 #include "lib/cmdline/popt_common.h"
  32 #include "librpc/rpc/dcerpc.h"
  33 #include "torture/rpc/rpc.h"
  34 #include "libcli/libcli.h"
  35 #include "libcli/composite/composite.h"
  36 #include "libcli/smb_composite/smb_composite.h"
  37 #include "libcli/auth/libcli_auth.h"
  38 #include "libcli/auth/credentials.h"
  39 #include "lib/crypto/crypto.h"
  40
  41 /*
  42  * This tests a RPC call using an invalid vuid
  43  */
  44
  45 BOOL torture_bind_authcontext(struct torture_context *torture)
  46 {
  47         TALLOC_CTX *mem_ctx;
  48         NTSTATUS status;
  49         BOOL ret = False;
  50         struct lsa_ObjectAttribute objectattr;
  51         struct lsa_OpenPolicy2 openpolicy;
  52         struct policy_handle handle;
  53         struct lsa_Close close;
  54         struct smbcli_session *tmp;
  55         struct smbcli_session *session2;
  56         struct smbcli_state *cli;
  57         struct dcerpc_pipe *lsa_pipe;
  58         struct cli_credentials *anon_creds;
  59         struct smb_composite_sesssetup setup;
  60
  61         mem_ctx = talloc_init("torture_bind_authcontext");
  62
  63         if (mem_ctx == NULL) {
  64                 d_printf("talloc_init failed\n");
  65                 return False;
  66         }
  67
  68         status = smbcli_full_connection(mem_ctx, &cli,
  69                                         lp_parm_string(-1, "torture", "host"),
  70                                         "IPC$", NULL, cmdline_credentials,
  71                                         NULL);
  72         if (!NT_STATUS_IS_OK(status)) {
  73                 d_printf("smbcli_full_connection failed: %s\n",
  74                          nt_errstr(status));
  75                 goto done;
  76         }
  77
  78         lsa_pipe = dcerpc_pipe_init(mem_ctx, cli->transport->socket->event.ctx);
  79         if (lsa_pipe == NULL) {
  80                 d_printf("dcerpc_pipe_init failed\n");
  81                 goto done;
  82         }
  83
  84         status = dcerpc_pipe_open_smb(lsa_pipe->conn, cli->tree, "\\lsarpc");
  85         if (!NT_STATUS_IS_OK(status)) {
  86                 d_printf("dcerpc_pipe_open_smb failed: %s\n",
  87                          nt_errstr(status));
  88                 goto done;
  89         }
  90
  91         status = dcerpc_bind_auth_none(lsa_pipe, &dcerpc_table_lsarpc);
  92         if (!NT_STATUS_IS_OK(status)) {
  93                 d_printf("dcerpc_bind_auth_none failed: %s\n",
  94                          nt_errstr(status));
  95                 goto done;
  96         }
  97
  98         openpolicy.in.system_name =talloc_asprintf(
  99                 mem_ctx, "\\\\%s", dcerpc_server_name(lsa_pipe));
 100         ZERO_STRUCT(objectattr);
 101         openpolicy.in.attr = &objectattr;
 102         openpolicy.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 103         openpolicy.out.handle = &handle;
 104
 105         status = dcerpc_lsa_OpenPolicy2(lsa_pipe, mem_ctx, &openpolicy);
 106
 107         if (!NT_STATUS_IS_OK(status)) {
 108                 d_printf("dcerpc_lsa_OpenPolicy2 failed: %s\n",
 109                          nt_errstr(status));
 110                 goto done;
 111         }
 112
 113         close.in.handle = &handle;
 114         close.out.handle = &handle;
 115
 116         status = dcerpc_lsa_Close(lsa_pipe, mem_ctx, &close);
 117         if (!NT_STATUS_IS_OK(status)) {
 118                 d_printf("dcerpc_lsa_Close failed: %s\n",
 119                          nt_errstr(status));
 120                 goto done;
 121         }
 122
 123         session2 = smbcli_session_init(cli->transport, mem_ctx, False);
 124         if (session2 == NULL) {
 125                 d_printf("smbcli_session_init failed\n");
 126                 goto done;
 127         }
 128
 129         anon_creds = cli_credentials_init(mem_ctx);
 130         if (anon_creds == NULL) {
 131                 d_printf("cli_credentials_init failed\n");
 132                 goto done;
 133         }
 134
 135         cli_credentials_set_conf(anon_creds);
 136         cli_credentials_set_anonymous(anon_creds);
 137
 138         setup.in.sesskey = cli->transport->negotiate.sesskey;
 139         setup.in.capabilities = cli->transport->negotiate.capabilities;
 140         setup.in.workgroup = "";
 141         setup.in.credentials = anon_creds;
 142
 143         status = smb_composite_sesssetup(session2, &setup);
 144         if (!NT_STATUS_IS_OK(status)) {
 145                 d_printf("anon session setup failed: %s\n",
 146                          nt_errstr(status));
 147                 goto done;
 148         }
 149
 150         tmp = cli->tree->session;
 151         cli->tree->session = session2;
 152
 153         status = dcerpc_lsa_OpenPolicy2(lsa_pipe, mem_ctx, &openpolicy);
 154
 155         cli->tree->session = tmp;
 156         talloc_free(lsa_pipe);
 157         lsa_pipe = NULL;
 158
 159         if (!NT_STATUS_EQUAL(status, NT_STATUS_INVALID_HANDLE)) {
 160                 d_printf("dcerpc_lsa_OpenPolicy2 with wrong vuid gave %s, "
 161                          "expected NT_STATUS_INVALID_HANDLE\n",
 162                          nt_errstr(status));
 163                 goto done;
 164         }
 165
 166         ret = True;
 167  done:
 168         talloc_free(mem_ctx);
 169         return ret;
 170 }
 171
 172 /*
 173  * Bind to lsa using a specific auth method
 174  */
 175
 176 static BOOL bindtest(struct smbcli_state *cli,
 177                      struct cli_credentials *credentials,
 178                      uint8_t auth_type, uint8_t auth_level)
 179 {
 180         TALLOC_CTX *mem_ctx;
 181         BOOL ret = False;
 182         NTSTATUS status;
 183
 184         struct dcerpc_pipe *lsa_pipe;
 185         struct lsa_ObjectAttribute objectattr;
 186         struct lsa_OpenPolicy2 openpolicy;
 187         struct lsa_QueryInfoPolicy query;
 188         struct policy_handle handle;
 189         struct lsa_Close close;
 190
 191         if ((mem_ctx = talloc_init("bindtest")) == NULL) {
 192                 d_printf("talloc_init failed\n");
 193                 return False;
 194         }
 195
 196         lsa_pipe = dcerpc_pipe_init(mem_ctx,
 197                                     cli->transport->socket->event.ctx);
 198         if (lsa_pipe == NULL) {
 199                 d_printf("dcerpc_pipe_init failed\n");
 200                 goto done;
 201         }
 202
 203         status = dcerpc_pipe_open_smb(lsa_pipe->conn, cli->tree, "\\lsarpc");
 204         if (!NT_STATUS_IS_OK(status)) {
 205                 d_printf("dcerpc_pipe_open_smb failed: %s\n",
 206                          nt_errstr(status));
 207                 goto done;
 208         }
 209
 210         status = dcerpc_bind_auth(lsa_pipe, &dcerpc_table_lsarpc,
 211                                   credentials, auth_type, auth_level,
 212                                   NULL);
 213         if (!NT_STATUS_IS_OK(status)) {
 214                 d_printf("dcerpc_bind_auth failed: %s\n", nt_errstr(status));
 215                 goto done;
 216         }
 217
 218         openpolicy.in.system_name =talloc_asprintf(
 219                 mem_ctx, "\\\\%s", dcerpc_server_name(lsa_pipe));
 220         ZERO_STRUCT(objectattr);
 221         openpolicy.in.attr = &objectattr;
 222         openpolicy.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 223         openpolicy.out.handle = &handle;
 224
 225         status = dcerpc_lsa_OpenPolicy2(lsa_pipe, mem_ctx, &openpolicy);
 226
 227         if (!NT_STATUS_IS_OK(status)) {
 228                 d_printf("dcerpc_lsa_OpenPolicy2 failed: %s\n",
 229                          nt_errstr(status));
 230                 goto done;
 231         }
 232
 233         query.in.handle = &handle;
 234         query.in.level = LSA_POLICY_INFO_DOMAIN;
 235
 236         status = dcerpc_lsa_QueryInfoPolicy(lsa_pipe, mem_ctx, &query);
 237         if (!NT_STATUS_IS_OK(status)) {
 238                 d_printf("dcerpc_lsa_QueryInfoPolicy failed: %s\n",
 239                          nt_errstr(status));
 240                 goto done;
 241         }
 242
 243         close.in.handle = &handle;
 244         close.out.handle = &handle;
 245
 246         status = dcerpc_lsa_Close(lsa_pipe, mem_ctx, &close);
 247         if (!NT_STATUS_IS_OK(status)) {
 248                 d_printf("dcerpc_lsa_Close failed: %s\n",
 249                          nt_errstr(status));
 250                 goto done;
 251         }
 252
 253         ret = True;
 254  done:
 255         talloc_free(mem_ctx);
 256         return ret;
 257 }
 258
 259 /*
 260  * test authenticated RPC binds with the variants Samba3 does support
 261  */
 262
 263 BOOL torture_bind_samba3(struct torture_context *torture)
 264 {
 265         TALLOC_CTX *mem_ctx;
 266         NTSTATUS status;
 267         BOOL ret = False;
 268         struct smbcli_state *cli;
 269
 270         mem_ctx = talloc_init("torture_bind_authcontext");
 271
 272         if (mem_ctx == NULL) {
 273                 d_printf("talloc_init failed\n");
 274                 return False;
 275         }
 276
 277         status = smbcli_full_connection(mem_ctx, &cli,
 278                                         lp_parm_string(-1, "torture", "host"),
 279                                         "IPC$", NULL, cmdline_credentials,
 280                                         NULL);
 281         if (!NT_STATUS_IS_OK(status)) {
 282                 d_printf("smbcli_full_connection failed: %s\n",
 283                          nt_errstr(status));
 284                 goto done;
 285         }
 286
 287         ret = True;
 288
 289         ret &= bindtest(cli, cmdline_credentials, DCERPC_AUTH_TYPE_NTLMSSP,
 290                         DCERPC_AUTH_LEVEL_INTEGRITY);
 291         ret &= bindtest(cli, cmdline_credentials, DCERPC_AUTH_TYPE_NTLMSSP,
 292                         DCERPC_AUTH_LEVEL_PRIVACY);
 293         ret &= bindtest(cli, cmdline_credentials, DCERPC_AUTH_TYPE_SPNEGO,
 294                         DCERPC_AUTH_LEVEL_INTEGRITY);
 295         ret &= bindtest(cli, cmdline_credentials, DCERPC_AUTH_TYPE_SPNEGO,
 296                         DCERPC_AUTH_LEVEL_PRIVACY);
 297
 298  done:
 299         talloc_free(mem_ctx);
 300         return ret;
 301 }
 302
 303 /*
 304  * Lookup or create a user and return all necessary info
 305  */
 306
 307 static NTSTATUS get_usr_handle(struct smbcli_state *cli,
 308                                TALLOC_CTX *mem_ctx,
 309                                struct cli_credentials *admin_creds,
 310                                const char *wks_name,
 311                                char **domain,
 312                                struct dcerpc_pipe **result_pipe,
 313                                struct policy_handle **result_handle)
 314 {
 315         struct dcerpc_pipe *samr_pipe;
 316         NTSTATUS status;
 317         struct policy_handle conn_handle;
 318         struct policy_handle domain_handle;
 319         struct policy_handle *user_handle;
 320         struct samr_Connect2 conn;
 321         struct samr_EnumDomains enumdom;
 322         uint32_t resume_handle = 0;
 323         struct samr_LookupDomain l;
 324         int dom_idx;
 325         struct lsa_String domain_name;
 326         struct lsa_String user_name;
 327         struct samr_OpenDomain o;
 328         struct samr_CreateUser2 c;
 329         uint32_t user_rid,access_granted;
 330
 331         samr_pipe = dcerpc_pipe_init(mem_ctx,
 332                                      cli->transport->socket->event.ctx);
 333         if (samr_pipe == NULL) {
 334                 d_printf("dcerpc_pipe_init failed\n");
 335                 status = NT_STATUS_NO_MEMORY;
 336                 goto fail;
 337         }
 338
 339         status = dcerpc_pipe_open_smb(samr_pipe->conn, cli->tree, "\\samr");
 340         if (!NT_STATUS_IS_OK(status)) {
 341                 d_printf("dcerpc_pipe_open_smb failed: %s\n",
 342                          nt_errstr(status));
 343                 goto fail;
 344         }
 345
 346         status = dcerpc_bind_auth(samr_pipe, &dcerpc_table_samr,
 347                                   admin_creds, DCERPC_AUTH_TYPE_NTLMSSP,
 348                                   DCERPC_AUTH_LEVEL_INTEGRITY, NULL);
 349         if (!NT_STATUS_IS_OK(status)) {
 350                 d_printf("dcerpc_bind_auth failed: %s\n", nt_errstr(status));
 351                 goto fail;
 352         }
 353
 354         conn.in.system_name = talloc_asprintf(
 355                 mem_ctx, "\\\\%s", dcerpc_server_name(samr_pipe));
 356         conn.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 357         conn.out.connect_handle = &conn_handle;
 358
 359         status = dcerpc_samr_Connect2(samr_pipe, mem_ctx, &conn);
 360         if (!NT_STATUS_IS_OK(status)) {
 361                 d_printf("samr_Connect2 failed: %s\n", nt_errstr(status));
 362                 goto fail;
 363         }
 364
 365         enumdom.in.connect_handle = &conn_handle;
 366         enumdom.in.resume_handle = &resume_handle;
 367         enumdom.in.buf_size = (uint32_t)-1;
 368         enumdom.out.resume_handle = &resume_handle;
 369
 370         status = dcerpc_samr_EnumDomains(samr_pipe, mem_ctx, &enumdom);
 371         if (!NT_STATUS_IS_OK(status)) {
 372                 d_printf("samr_EnumDomains failed: %s\n", nt_errstr(status));
 373                 goto fail;
 374         }
 375
 376         if (enumdom.out.num_entries != 2) {
 377                 d_printf("samr_EnumDomains returned %d entries, expected 2\n",
 378                          enumdom.out.num_entries);
 379                 status = NT_STATUS_UNSUCCESSFUL;
 380                 goto fail;
 381         }
 382
 383         dom_idx = strequal(enumdom.out.sam->entries[0].name.string,
 384                            "builtin") ? 1:0;
 385
 386         l.in.connect_handle = &conn_handle;
 387         domain_name.string = enumdom.out.sam->entries[0].name.string;
 388         *domain = talloc_strdup(mem_ctx, domain_name.string);
 389         l.in.domain_name = &domain_name;
 390
 391         status = dcerpc_samr_LookupDomain(samr_pipe, mem_ctx, &l);
 392         if (!NT_STATUS_IS_OK(status)) {
 393                 d_printf("samr_LookupDomain failed: %s\n", nt_errstr(status));
 394                 goto fail;
 395         }
 396
 397         o.in.connect_handle = &conn_handle;
 398         o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 399         o.in.sid = l.out.sid;
 400         o.out.domain_handle = &domain_handle;
 401
 402         status = dcerpc_samr_OpenDomain(samr_pipe, mem_ctx, &o);
 403         if (!NT_STATUS_IS_OK(status)) {
 404                 d_printf("samr_OpenDomain failed: %s\n", nt_errstr(status));
 405                 goto fail;
 406         }
 407
 408         c.in.domain_handle = &domain_handle;
 409         user_name.string = talloc_asprintf(mem_ctx, "%s$", wks_name);
 410         c.in.account_name = &user_name;
 411         c.in.acct_flags = ACB_WSTRUST;
 412         c.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 413         user_handle = talloc(mem_ctx, struct policy_handle);
 414         c.out.user_handle = user_handle;
 415         c.out.access_granted = &access_granted;
 416         c.out.rid = &user_rid;
 417
 418         status = dcerpc_samr_CreateUser2(samr_pipe, mem_ctx, &c);
 419
 420         if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
 421                 struct samr_LookupNames ln;
 422                 struct samr_OpenUser ou;
 423
 424                 ln.in.domain_handle = &domain_handle;
 425                 ln.in.num_names = 1;
 426                 ln.in.names = &user_name;
 427
 428                 status = dcerpc_samr_LookupNames(samr_pipe, mem_ctx, &ln);
 429                 if (!NT_STATUS_IS_OK(status)) {
 430                         d_printf("samr_LookupNames failed: %s\n",
 431                                  nt_errstr(status));
 432                         goto fail;
 433                 }
 434
 435                 ou.in.domain_handle = &domain_handle;
 436                 ou.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 437                 ou.in.rid = ln.out.rids.ids[0];
 438                 ou.out.user_handle = user_handle;
 439
 440                 status = dcerpc_samr_OpenUser(samr_pipe, mem_ctx, &ou);
 441                 if (!NT_STATUS_IS_OK(status)) {
 442                         d_printf("samr_OpenUser failed: %s\n",
 443                                  nt_errstr(status));
 444                         goto fail;
 445                 }
 446         }
 447
 448         if (!NT_STATUS_IS_OK(status)) {
 449                 d_printf("samr_CreateUser failed: %s\n", nt_errstr(status));
 450                 goto fail;
 451         }
 452
 453         *result_pipe = samr_pipe;
 454         *result_handle = user_handle;
 455         return NT_STATUS_OK;
 456
 457  fail:
 458         return status;
 459 }
 460
 461 /*
 462  * Do a Samba3-style join
 463  */
 464
 465 static BOOL join3(struct smbcli_state *cli,
 466                   struct cli_credentials *admin_creds,
 467                   struct cli_credentials *wks_creds)
 468 {
 469         TALLOC_CTX *mem_ctx;
 470         NTSTATUS status;
 471         char *dom_name;
 472         struct dcerpc_pipe *samr_pipe;
 473         struct policy_handle *wks_handle;
 474         BOOL ret = False;
 475
 476         if ((mem_ctx = talloc_init("join3")) == NULL) {
 477                 d_printf("talloc_init failed\n");
 478                 return False;
 479         }
 480
 481         status = get_usr_handle(cli, mem_ctx, admin_creds,
 482                                 cli_credentials_get_workstation(wks_creds),
 483                                 &dom_name, &samr_pipe, &wks_handle);
 484
 485         if (!NT_STATUS_IS_OK(status)) {
 486                 d_printf("get_wks_handle failed: %s\n", nt_errstr(status));
 487                 goto done;
 488         }
 489
 490         cli_credentials_set_domain(wks_creds, dom_name, CRED_SPECIFIED);
 491
 492         {
 493                 struct samr_SetUserInfo2 sui2;
 494                 struct samr_SetUserInfo sui;
 495                 union samr_UserInfo u_info;
 496                 DATA_BLOB session_key;
 497
 498                 encode_pw_buffer(u_info.info24.password.data,
 499                                  cli_credentials_get_password(wks_creds),
 500                                  STR_UNICODE);
 501                 u_info.info24.pw_len =
 502                         strlen_m(cli_credentials_get_password(wks_creds))*2;
 503
 504                 status = dcerpc_fetch_session_key(samr_pipe, &session_key);
 505                 if (!NT_STATUS_IS_OK(status)) {
 506                         d_printf("dcerpc_fetch_session_key failed\n");
 507                         goto done;
 508                 }
 509                 arcfour_crypt_blob(u_info.info24.password.data, 516,
 510                                    &session_key);
 511                 sui2.in.user_handle = wks_handle;
 512                 sui2.in.info = &u_info;
 513                 sui2.in.level = 24;
 514
 515                 status = dcerpc_samr_SetUserInfo2(samr_pipe, mem_ctx, &sui2);
 516                 if (!NT_STATUS_IS_OK(status)) {
 517                         d_printf("samr_SetUserInfo(24) failed\n");
 518                         goto done;
 519                 }
 520
 521                 u_info.info16.acct_flags = ACB_WSTRUST;
 522                 sui.in.user_handle = wks_handle;
 523                 sui.in.info = &u_info;
 524                 sui.in.level = 16;
 525
 526                 status = dcerpc_samr_SetUserInfo(samr_pipe, mem_ctx, &sui);
 527                 if (!NT_STATUS_IS_OK(status)) {
 528                         d_printf("samr_SetUserInfo(16) failed\n");
 529                         goto done;
 530                 }
 531         }
 532
 533         ret = True;
 534
 535  done:
 536         talloc_free(mem_ctx);
 537         return ret;
 538 }
 539
 540 /*
 541  * Do a ReqChallenge/Auth2 and get the wks creds
 542  */
 543
 544 static BOOL auth2(struct smbcli_state *cli,
 545                   struct cli_credentials *wks_cred)
 546 {
 547         TALLOC_CTX *mem_ctx;
 548         struct dcerpc_pipe *net_pipe;
 549         BOOL result = False;
 550         NTSTATUS status;
 551         struct netr_ServerReqChallenge r;
 552         struct netr_Credential netr_cli_creds;
 553         struct netr_Credential netr_srv_creds;
 554         uint32_t negotiate_flags;
 555         struct netr_ServerAuthenticate2 a;
 556         struct creds_CredentialState *creds_state;
 557         struct netr_Credential netr_cred;
 558         struct samr_Password mach_pw;
 559
 560         mem_ctx = talloc_new(NULL);
 561         if (mem_ctx == NULL) {
 562                 d_printf("talloc_new failed\n");
 563                 return False;
 564         }
 565
 566         net_pipe = dcerpc_pipe_init(mem_ctx,
 567                                     cli->transport->socket->event.ctx);
 568         if (net_pipe == NULL) {
 569                 d_printf("dcerpc_pipe_init failed\n");
 570                 goto done;
 571         }
 572
 573         status = dcerpc_pipe_open_smb(net_pipe->conn, cli->tree, "\\netlogon");
 574         if (!NT_STATUS_IS_OK(status)) {
 575                 d_printf("dcerpc_pipe_open_smb failed: %s\n",
 576                          nt_errstr(status));
 577                 goto done;
 578         }
 579
 580         d_printf("Got the netlogon pipe\n");
 581
 582         status = dcerpc_bind_auth_none(net_pipe, &dcerpc_table_netlogon);
 583         if (!NT_STATUS_IS_OK(status)) {
 584                 d_printf("dcerpc_bind_auth_none failed: %s\n",
 585                          nt_errstr(status));
 586                 goto done;
 587         }
 588
 589         r.in.computer_name = cli_credentials_get_workstation(wks_cred);
 590         r.in.server_name = talloc_asprintf(
 591                 mem_ctx, "\\\\%s", dcerpc_server_name(net_pipe));
 592         if (r.in.server_name == NULL) {
 593                 d_printf("talloc_asprintf failed\n");
 594                 goto done;
 595         }
 596         generate_random_buffer(netr_cli_creds.data,
 597                                sizeof(netr_cli_creds.data));
 598         r.in.credentials = &netr_cli_creds;
 599         r.out.credentials = &netr_srv_creds;
 600
 601         status = dcerpc_netr_ServerReqChallenge(net_pipe, mem_ctx, &r);
 602         if (!NT_STATUS_IS_OK(status)) {
 603                 d_printf("netr_ServerReqChallenge failed: %s\n",
 604                          nt_errstr(status));
 605                 goto done;
 606         }
 607
 608         negotiate_flags = NETLOGON_NEG_AUTH2_FLAGS;
 609         E_md4hash(cli_credentials_get_password(wks_cred), mach_pw.hash);
 610
 611         creds_state = talloc(mem_ctx, struct creds_CredentialState);
 612         creds_client_init(creds_state, r.in.credentials,
 613                           r.out.credentials, &mach_pw,
 614                           &netr_cred, negotiate_flags);
 615
 616         a.in.server_name = talloc_asprintf(
 617                 mem_ctx, "\\\\%s", dcerpc_server_name(net_pipe));
 618         a.in.account_name = talloc_asprintf(
 619                 mem_ctx, "%s$", cli_credentials_get_workstation(wks_cred));
 620         a.in.computer_name = cli_credentials_get_workstation(wks_cred);
 621         a.in.secure_channel_type = SEC_CHAN_WKSTA;
 622         a.in.negotiate_flags = &negotiate_flags;
 623         a.out.negotiate_flags = &negotiate_flags;
 624         a.in.credentials = &netr_cred;
 625         a.out.credentials = &netr_cred;
 626
 627         status = dcerpc_netr_ServerAuthenticate2(net_pipe, mem_ctx, &a);
 628         if (!NT_STATUS_IS_OK(status)) {
 629                 d_printf("netr_ServerServerAuthenticate2 failed: %s\n",
 630                          nt_errstr(status));
 631                 goto done;
 632         }
 633
 634         if (!creds_client_check(creds_state, a.out.credentials)) {
 635                 d_printf("creds_client_check failed\n");
 636                 goto done;
 637         }
 638
 639         cli_credentials_set_netlogon_creds(wks_cred, creds_state);
 640
 641         result = True;
 642
 643  done:
 644         talloc_free(mem_ctx);
 645         return result;
 646 }
 647
 648 /*
 649  * Do a couple of channel protected Netlogon ops: Interactive and Network
 650  * login, and change the wks password
 651  */
 652
 653 static BOOL schan(struct smbcli_state *cli,
 654                   struct cli_credentials *wks_creds,
 655                   struct cli_credentials *user_creds)
 656 {
 657         TALLOC_CTX *mem_ctx;
 658         NTSTATUS status;
 659         BOOL ret = False;
 660         struct dcerpc_pipe *net_pipe;
 661         int i;
 662
 663         mem_ctx = talloc_new(NULL);
 664         if (mem_ctx == NULL) {
 665                 d_printf("talloc_new failed\n");
 666                 return False;
 667         }
 668
 669         net_pipe = dcerpc_pipe_init(mem_ctx,
 670                                     cli->transport->socket->event.ctx);
 671         if (net_pipe == NULL) {
 672                 d_printf("dcerpc_pipe_init failed\n");
 673                 goto done;
 674         }
 675
 676         status = dcerpc_pipe_open_smb(net_pipe->conn, cli->tree, "\\netlogon");
 677         if (!NT_STATUS_IS_OK(status)) {
 678                 d_printf("dcerpc_pipe_open_smb failed: %s\n",
 679                          nt_errstr(status));
 680                 goto done;
 681         }
 682
 683 #if 0
 684         net_pipe->conn->flags |= DCERPC_DEBUG_PRINT_IN |
 685                 DCERPC_DEBUG_PRINT_OUT;
 686 #endif
 687 #if 1
 688         net_pipe->conn->flags |= (DCERPC_SIGN | DCERPC_SEAL);
 689         status = dcerpc_bind_auth(net_pipe, &dcerpc_table_netlogon,
 690                                   wks_creds, DCERPC_AUTH_TYPE_SCHANNEL,
 691                                   DCERPC_AUTH_LEVEL_PRIVACY,
 692                                   NULL);
 693 #else
 694         status = dcerpc_bind_auth_none(net_pipe, &dcerpc_table_netlogon);
 695 #endif
 696         if (!NT_STATUS_IS_OK(status)) {
 697                 d_printf("schannel bind failed: %s\n", nt_errstr(status));
 698                 goto done;
 699         }
 700
 701
 702         for (i=2; i<4; i++) {
 703                 int flags;
 704                 DATA_BLOB chal, nt_resp, lm_resp, names_blob, session_key;
 705                 struct creds_CredentialState *creds_state;
 706                 struct netr_Authenticator netr_auth, netr_auth2;
 707                 struct netr_NetworkInfo ninfo;
 708                 struct netr_PasswordInfo pinfo;
 709                 struct netr_LogonSamLogon r;
 710
 711                 flags = CLI_CRED_LANMAN_AUTH | CLI_CRED_NTLM_AUTH |
 712                         CLI_CRED_NTLMv2_AUTH;
 713
 714                 chal = data_blob_talloc(mem_ctx, NULL, 8);
 715                 if (chal.data == NULL) {
 716                         d_printf("data_blob_talloc failed\n");
 717                         goto done;
 718                 }
 719
 720                 generate_random_buffer(chal.data, chal.length);
 721                 names_blob = NTLMv2_generate_names_blob(
 722                         mem_ctx, cli_credentials_get_workstation(user_creds),
 723                         cli_credentials_get_domain(user_creds));
 724                 status = cli_credentials_get_ntlm_response(
 725                         user_creds, mem_ctx, &flags, chal, names_blob,
 726                         &lm_resp, &nt_resp, NULL, NULL);
 727                 if (!NT_STATUS_IS_OK(status)) {
 728                         d_printf("cli_credentials_get_ntlm_response failed:"
 729                                  " %s\n", nt_errstr(status));
 730                         goto done;
 731                 }
 732
 733                 creds_state = cli_credentials_get_netlogon_creds(wks_creds);
 734                 creds_client_authenticator(creds_state, &netr_auth);
 735
 736                 ninfo.identity_info.account_name.string =
 737                         cli_credentials_get_username(user_creds);
 738                 ninfo.identity_info.domain_name.string =
 739                         cli_credentials_get_domain(user_creds);
 740                 ninfo.identity_info.parameter_control = 0;
 741                 ninfo.identity_info.logon_id_low = 0;
 742                 ninfo.identity_info.logon_id_high = 0;
 743                 ninfo.identity_info.workstation.string =
 744                         cli_credentials_get_workstation(user_creds);
 745                 memcpy(ninfo.challenge, chal.data, sizeof(ninfo.challenge));
 746                 ninfo.nt.length = nt_resp.length;
 747                 ninfo.nt.data = nt_resp.data;
 748                 ninfo.lm.length = lm_resp.length;
 749                 ninfo.lm.data = lm_resp.data;
 750
 751                 r.in.server_name = talloc_asprintf(
 752                         mem_ctx, "\\\\%s", dcerpc_server_name(net_pipe));
 753                 ZERO_STRUCT(netr_auth2);
 754                 r.in.computer_name =
 755                         cli_credentials_get_workstation(wks_creds);
 756                 r.in.credential = &netr_auth;
 757                 r.in.return_authenticator = &netr_auth2;
 758                 r.in.logon_level = 2;
 759                 r.in.validation_level = i;
 760                 r.in.logon.network = &ninfo;
 761                 r.out.return_authenticator = NULL;
 762
 763                 status = dcerpc_netr_LogonSamLogon(net_pipe, mem_ctx, &r);
 764                 if (!NT_STATUS_IS_OK(status)) {
 765                         d_printf("netr_LogonSamLogon failed: %s\n",
 766                                  nt_errstr(status));
 767                         goto done;
 768                 }
 769
 770                 if ((r.out.return_authenticator == NULL) ||
 771                     (!creds_client_check(creds_state,
 772                                          &r.out.return_authenticator->cred))) {
 773                         d_printf("Credentials check failed!\n");
 774                         goto done;
 775                 }
 776
 777                 creds_client_authenticator(creds_state, &netr_auth);
 778
 779                 pinfo.identity_info = ninfo.identity_info;
 780                 ZERO_STRUCT(pinfo.lmpassword.hash);
 781                 E_md4hash(cli_credentials_get_password(user_creds),
 782                           pinfo.ntpassword.hash);
 783                 session_key = data_blob_talloc(mem_ctx,
 784                                                creds_state->session_key, 16);
 785                 arcfour_crypt_blob(pinfo.ntpassword.hash,
 786                                    sizeof(pinfo.ntpassword.hash),
 787                                    &session_key);
 788
 789                 r.in.logon_level = 1;
 790                 r.in.logon.password = &pinfo;
 791                 r.out.return_authenticator = NULL;
 792
 793                 status = dcerpc_netr_LogonSamLogon(net_pipe, mem_ctx, &r);
 794                 if (!NT_STATUS_IS_OK(status)) {
 795                         d_printf("netr_LogonSamLogon failed: %s\n",
 796                                  nt_errstr(status));
 797                         goto done;
 798                 }
 799
 800                 if ((r.out.return_authenticator == NULL) ||
 801                     (!creds_client_check(creds_state,
 802                                          &r.out.return_authenticator->cred))) {
 803                         d_printf("Credentials check failed!\n");
 804                         goto done;
 805                 }
 806         }
 807
 808         {
 809                 struct netr_ServerPasswordSet s;
 810                 char *password = generate_random_str(wks_creds, 8);
 811                 struct creds_CredentialState *creds_state;
 812
 813                 s.in.server_name = talloc_asprintf(
 814                         mem_ctx, "\\\\%s", dcerpc_server_name(net_pipe));
 815                 s.in.computer_name = cli_credentials_get_workstation(wks_creds);
 816                 s.in.account_name = talloc_asprintf(
 817                         mem_ctx, "%s$", s.in.computer_name);
 818                 s.in.secure_channel_type = SEC_CHAN_WKSTA;
 819                 E_md4hash(password, s.in.new_password.hash);
 820                 creds_des_encrypt(creds_state, &s.in.new_password);
 821
 822                 creds_state = cli_credentials_get_netlogon_creds(wks_creds);
 823                 creds_client_authenticator(creds_state, &s.in.credential);
 824
 825                 status = dcerpc_netr_ServerPasswordSet(net_pipe, mem_ctx, &s);
 826                 if (!NT_STATUS_IS_OK(status)) {
 827                         printf("ServerPasswordSet - %s\n", nt_errstr(status));
 828                         goto done;
 829                 }
 830
 831                 if (!creds_client_check(creds_state,
 832                                         &s.out.return_authenticator.cred)) {
 833                         printf("Credential chaining failed\n");
 834                 }
 835
 836                 cli_credentials_set_password(wks_creds, password,
 837                                              CRED_SPECIFIED);
 838         }
 839
 840         ret = True;
 841  done:
 842         talloc_free(mem_ctx);
 843         return ret;
 844 }
 845
 846 /*
 847  * Delete the wks account again
 848  */
 849
 850 static BOOL leave(struct smbcli_state *cli,
 851                   struct cli_credentials *admin_creds,
 852                   struct cli_credentials *wks_creds)
 853 {
 854         TALLOC_CTX *mem_ctx;
 855         NTSTATUS status;
 856         char *dom_name;
 857         struct dcerpc_pipe *samr_pipe;
 858         struct policy_handle *wks_handle;
 859         BOOL ret = False;
 860
 861         if ((mem_ctx = talloc_init("join3")) == NULL) {
 862                 d_printf("talloc_init failed\n");
 863                 return False;
 864         }
 865
 866         status = get_usr_handle(cli, mem_ctx, admin_creds,
 867                                 cli_credentials_get_workstation(wks_creds),
 868                                 &dom_name, &samr_pipe, &wks_handle);
 869
 870         if (!NT_STATUS_IS_OK(status)) {
 871                 d_printf("get_wks_handle failed: %s\n", nt_errstr(status));
 872                 goto done;
 873         }
 874
 875         {
 876                 struct samr_DeleteUser d;
 877
 878                 d.in.user_handle = wks_handle;
 879                 d.out.user_handle = wks_handle;
 880
 881                 status = dcerpc_samr_DeleteUser(samr_pipe, mem_ctx, &d);
 882                 if (!NT_STATUS_IS_OK(status)) {
 883                         d_printf("samr_DeleteUser failed\n");
 884                         goto done;
 885                 }
 886         }
 887
 888         ret = True;
 889
 890  done:
 891         talloc_free(mem_ctx);
 892         return ret;
 893 }
 894
 895 /*
 896  * Test the Samba3 DC code a bit. Join, do some schan netlogon ops, leave
 897  */
 898
 899 BOOL torture_netlogon_samba3(struct torture_context *torture)
 900 {
 901         TALLOC_CTX *mem_ctx;
 902         NTSTATUS status;
 903         BOOL ret = False;
 904         struct smbcli_state *cli;
 905         struct cli_credentials *anon_creds;
 906         struct cli_credentials *wks_creds;
 907         const char *wks_name;
 908         int i;
 909
 910         wks_name = lp_parm_string(-1, "torture", "wksname");
 911         if (wks_name == NULL) {
 912                 wks_name = get_myname();
 913         }
 914
 915         mem_ctx = talloc_init("torture_bind_authcontext");
 916
 917         if (mem_ctx == NULL) {
 918                 d_printf("talloc_init failed\n");
 919                 return False;
 920         }
 921
 922         anon_creds = cli_credentials_init(mem_ctx);
 923         if (anon_creds == NULL) {
 924                 d_printf("cli_credentials_init failed\n");
 925                 goto done;
 926         }
 927
 928         cli_credentials_set_conf(anon_creds);
 929         cli_credentials_set_anonymous(anon_creds);
 930
 931         status = smbcli_full_connection(mem_ctx, &cli,
 932                                         lp_parm_string(-1, "torture", "host"),
 933                                         "IPC$", NULL, anon_creds, NULL);
 934         if (!NT_STATUS_IS_OK(status)) {
 935                 d_printf("smbcli_full_connection failed: %s\n",
 936                          nt_errstr(status));
 937                 goto done;
 938         }
 939
 940         wks_creds = cli_credentials_init(mem_ctx);
 941         if (wks_creds == NULL) {
 942                 d_printf("cli_credentials_init failed\n");
 943                 goto done;
 944         }
 945
 946         cli_credentials_set_conf(wks_creds);
 947         cli_credentials_set_secure_channel_type(wks_creds, SEC_CHAN_WKSTA);
 948         cli_credentials_set_username(wks_creds, wks_name, CRED_SPECIFIED);
 949         cli_credentials_set_workstation(wks_creds, wks_name, CRED_SPECIFIED);
 950         cli_credentials_set_password(wks_creds, "blub", CRED_SPECIFIED);
 951
 952         if (!join3(cli, cmdline_credentials, wks_creds)) {
 953                 d_printf("join failed\n");
 954                 goto done;
 955         }
 956
 957         cli_credentials_set_domain(
 958                 cmdline_credentials, cli_credentials_get_domain(wks_creds),
 959                 CRED_SPECIFIED);
 960
 961         for (i=0; i<2; i++) {
 962
 963                 /* Do this more than once, the routine "schan" changes
 964                  * the workstation password using the netlogon
 965                  * password change routine */
 966
 967                 int j;
 968
 969                 if (!auth2(cli, wks_creds)) {
 970                         d_printf("auth2 failed\n");
 971                         goto done;
 972                 }
 973
 974                 for (j=0; j<2; j++) {
 975                         if (!schan(cli, wks_creds, cmdline_credentials)) {
 976                                 d_printf("schan failed\n");
 977                                 goto done;
 978                         }
 979                 }
 980         }
 981
 982         if (!leave(cli, cmdline_credentials, wks_creds)) {
 983                 d_printf("leave failed\n");
 984                 goto done;
 985         }
 986
 987         ret = True;
 988
 989  done:
 990         talloc_free(mem_ctx);
 991         return ret;
 992 }