source/torture/rpc/testjoin.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    utility code to join/leave a domain
   5
   6    Copyright (C) Andrew Tridgell 2004
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 2 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program; if not, write to the Free Software
  20    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21 */
  22
  23 /*
  24   this code is used by other torture modules to join/leave a domain
  25   as either a member, bdc or thru a trust relationship
  26 */
  27
  28 #include "includes.h"
  29 #include "system/time.h"
  30 #include "lib/crypto/crypto.h"
  31 #include "libnet/libnet.h"
  32 #include "lib/cmdline/popt_common.h"
  33 #include "lib/ldb/include/ldb.h"
  34
  35
  36 struct test_join {
  37         struct dcerpc_pipe *p;
  38         struct policy_handle user_handle;
  39         struct libnet_JoinDomain *libnet_r;
  40         const char *dom_sid;
  41 };
  42
  43
  44 static NTSTATUS DeleteUser_byname(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
  45                                   struct policy_handle *handle, const char *name)
  46 {
  47         NTSTATUS status;
  48         struct samr_DeleteUser d;
  49         struct policy_handle user_handle;
  50         uint32_t rid;
  51         struct samr_LookupNames n;
  52         struct lsa_String sname;
  53         struct samr_OpenUser r;
  54
  55         sname.string = name;
  56
  57         n.in.domain_handle = handle;
  58         n.in.num_names = 1;
  59         n.in.names = &sname;
  60
  61         status = dcerpc_samr_LookupNames(p, mem_ctx, &n);
  62         if (NT_STATUS_IS_OK(status)) {
  63                 rid = n.out.rids.ids[0];
  64         } else {
  65                 return status;
  66         }
  67
  68         r.in.domain_handle = handle;
  69         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
  70         r.in.rid = rid;
  71         r.out.user_handle = &user_handle;
  72
  73         status = dcerpc_samr_OpenUser(p, mem_ctx, &r);
  74         if (!NT_STATUS_IS_OK(status)) {
  75                 printf("OpenUser(%s) failed - %s\n", name, nt_errstr(status));
  76                 return status;
  77         }
  78
  79         d.in.user_handle = &user_handle;
  80         d.out.user_handle = &user_handle;
  81         status = dcerpc_samr_DeleteUser(p, mem_ctx, &d);
  82         if (!NT_STATUS_IS_OK(status)) {
  83                 return status;
  84         }
  85
  86         return NT_STATUS_OK;
  87 }
  88
  89 /*
  90   create a test user in the domain
  91   an opaque pointer is returned. Pass it to torture_leave_domain()
  92   when finished
  93 */
  94
  95 struct test_join *torture_create_testuser(const char *username,
  96                                           const char *domain,
  97                                           uint16_t acct_type,
  98                                           const char **random_password)
  99 {
 100         NTSTATUS status;
 101         struct samr_Connect c;
 102         struct samr_CreateUser2 r;
 103         struct samr_OpenDomain o;
 104         struct samr_LookupDomain l;
 105         struct samr_GetUserPwInfo pwp;
 106         struct samr_SetUserInfo s;
 107         union samr_UserInfo u;
 108         struct policy_handle handle;
 109         struct policy_handle domain_handle;
 110         uint32_t access_granted;
 111         uint32_t rid;
 112         DATA_BLOB session_key;
 113         struct lsa_String name;
 114
 115         int policy_min_pw_len = 0;
 116         struct test_join *join;
 117         char *random_pw;
 118
 119         join = talloc(NULL, struct test_join);
 120         if (join == NULL) {
 121                 return NULL;
 122         }
 123
 124         ZERO_STRUCTP(join);
 125
 126         printf("Connecting to SAMR\n");
 127
 128         status = torture_rpc_connection(join,
 129                                         &join->p,
 130                                         &dcerpc_table_samr);
 131         if (!NT_STATUS_IS_OK(status)) {
 132                 return NULL;
 133         }
 134
 135         c.in.system_name = NULL;
 136         c.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 137         c.out.connect_handle = &handle;
 138
 139         status = dcerpc_samr_Connect(join->p, join, &c);
 140         if (!NT_STATUS_IS_OK(status)) {
 141                 const char *errstr = nt_errstr(status);
 142                 if (NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
 143                         errstr = dcerpc_errstr(join, join->p->last_fault_code);
 144                 }
 145                 printf("samr_Connect failed - %s\n", errstr);
 146                 return NULL;
 147         }
 148
 149         printf("Opening domain %s\n", domain);
 150
 151         name.string = domain;
 152         l.in.connect_handle = &handle;
 153         l.in.domain_name = &name;
 154
 155         status = dcerpc_samr_LookupDomain(join->p, join, &l);
 156         if (!NT_STATUS_IS_OK(status)) {
 157                 printf("LookupDomain failed - %s\n", nt_errstr(status));
 158                 goto failed;
 159         }
 160
 161         join->dom_sid = dom_sid_string(join, l.out.sid);
 162
 163         o.in.connect_handle = &handle;
 164         o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 165         o.in.sid = l.out.sid;
 166         o.out.domain_handle = &domain_handle;
 167
 168         status = dcerpc_samr_OpenDomain(join->p, join, &o);
 169         if (!NT_STATUS_IS_OK(status)) {
 170                 printf("OpenDomain failed - %s\n", nt_errstr(status));
 171                 goto failed;
 172         }
 173
 174         printf("Creating account %s\n", username);
 175
 176 again:
 177         name.string = username;
 178         r.in.domain_handle = &domain_handle;
 179         r.in.account_name = &name;
 180         r.in.acct_flags = acct_type;
 181         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 182         r.out.user_handle = &join->user_handle;
 183         r.out.access_granted = &access_granted;
 184         r.out.rid = &rid;
 185
 186         status = dcerpc_samr_CreateUser2(join->p, join, &r);
 187
 188         if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
 189                 status = DeleteUser_byname(join->p, join, &domain_handle, name.string);
 190                 if (NT_STATUS_IS_OK(status)) {
 191                         goto again;
 192                 }
 193         }
 194
 195         if (!NT_STATUS_IS_OK(status)) {
 196                 printf("CreateUser2 failed - %s\n", nt_errstr(status));
 197                 goto failed;
 198         }
 199
 200         pwp.in.user_handle = &join->user_handle;
 201
 202         status = dcerpc_samr_GetUserPwInfo(join->p, join, &pwp);
 203         if (NT_STATUS_IS_OK(status)) {
 204                 policy_min_pw_len = pwp.out.info.min_password_length;
 205         }
 206
 207         random_pw = generate_random_str(join, MAX(8, policy_min_pw_len));
 208
 209         printf("Setting account password '%s'\n", random_pw);
 210
 211         s.in.user_handle = &join->user_handle;
 212         s.in.info = &u;
 213         s.in.level = 24;
 214
 215         encode_pw_buffer(u.info24.password.data, random_pw, STR_UNICODE);
 216         u.info24.pw_len = strlen(random_pw);
 217
 218         status = dcerpc_fetch_session_key(join->p, &session_key);
 219         if (!NT_STATUS_IS_OK(status)) {
 220                 printf("SetUserInfo level %u - no session key - %s\n",
 221                        s.in.level, nt_errstr(status));
 222                 torture_leave_domain(join);
 223                 goto failed;
 224         }
 225
 226         arcfour_crypt_blob(u.info24.password.data, 516, &session_key);
 227
 228         status = dcerpc_samr_SetUserInfo(join->p, join, &s);
 229         if (!NT_STATUS_IS_OK(status)) {
 230                 printf("SetUserInfo failed - %s\n", nt_errstr(status));
 231                 goto failed;
 232         }
 233
 234         ZERO_STRUCT(u);
 235         s.in.user_handle = &join->user_handle;
 236         s.in.info = &u;
 237         s.in.level = 21;
 238
 239         u.info21.acct_flags = acct_type;
 240         u.info21.fields_present = SAMR_FIELD_ACCT_FLAGS | SAMR_FIELD_DESCRIPTION | SAMR_FIELD_COMMENT | SAMR_FIELD_FULL_NAME;
 241
 242         u.info21.comment.string = talloc_asprintf(join,
 243                                                   "Tortured by Samba4: %s",
 244                                                   timestring(join, time(NULL)));
 245
 246         u.info21.full_name.string = talloc_asprintf(join,
 247                                                     "Torture account for Samba4: %s",
 248                                                     timestring(join, time(NULL)));
 249
 250         u.info21.description.string = talloc_asprintf(join,
 251                                          "Samba4 torture account created by host %s: %s",
 252                                          lp_netbios_name(), timestring(join, time(NULL)));
 253
 254         printf("Resetting ACB flags, force pw change time\n");
 255
 256         status = dcerpc_samr_SetUserInfo(join->p, join, &s);
 257         if (!NT_STATUS_IS_OK(status)) {
 258                 printf("SetUserInfo failed - %s\n", nt_errstr(status));
 259                 goto failed;
 260         }
 261
 262         if (random_password) {
 263                 *random_password = random_pw;
 264         }
 265
 266         return join;
 267
 268 failed:
 269         torture_leave_domain(join);
 270         return NULL;
 271 }
 272
 273
 274 struct test_join *torture_join_domain(const char *machine_name,
 275                                       uint32_t acct_flags,
 276                                       struct cli_credentials **machine_credentials)
 277 {
 278         NTSTATUS status;
 279         struct libnet_context *libnet_ctx;
 280         struct libnet_JoinDomain *libnet_r;
 281         struct test_join *tj;
 282         struct samr_SetUserInfo s;
 283         union samr_UserInfo u;
 284
 285         tj = talloc(NULL, struct test_join);
 286         if (!tj) return NULL;
 287
 288         libnet_r = talloc(tj, struct libnet_JoinDomain);
 289         if (!libnet_r) {
 290                 talloc_free(tj);
 291                 return NULL;
 292         }
 293
 294         libnet_ctx = libnet_context_init(NULL);
 295         if (!libnet_ctx) {
 296                 talloc_free(tj);
 297                 return NULL;
 298         }
 299
 300         tj->libnet_r = libnet_r;
 301
 302         libnet_ctx->cred = cmdline_credentials;
 303         libnet_r->in.binding = lp_parm_string(-1, "torture", "binding");
 304         if (!libnet_r->in.binding) {
 305                 libnet_r->in.binding = talloc_asprintf(libnet_r, "ncacn_np:%s", lp_parm_string(-1, "torture", "host"));
 306         }
 307         libnet_r->in.level = LIBNET_JOINDOMAIN_SPECIFIED;
 308         libnet_r->in.netbios_name = machine_name;
 309         libnet_r->in.account_name = talloc_asprintf(libnet_r, "%s$", machine_name);
 310         if (!libnet_r->in.account_name) {
 311                 talloc_free(tj);
 312                 return NULL;
 313         }
 314
 315         libnet_r->in.acct_type = acct_flags;
 316         libnet_r->in.recreate_account = True;
 317
 318         status = libnet_JoinDomain(libnet_ctx, libnet_r, libnet_r);
 319         if (!NT_STATUS_IS_OK(status)) {
 320                 if (libnet_r->out.error_string) {
 321                         DEBUG(0, ("Domain join failed - %s.\n", libnet_r->out.error_string));
 322                 } else {
 323                         DEBUG(0, ("Domain join failed - %s.\n", nt_errstr(status)));
 324                 }
 325                 talloc_free(tj);
 326                 return NULL;
 327         }
 328         tj->p = libnet_r->out.samr_pipe;
 329         tj->user_handle = *libnet_r->out.user_handle;
 330         tj->dom_sid = dom_sid_string(tj, libnet_r->out.domain_sid);
 331
 332         ZERO_STRUCT(u);
 333         s.in.user_handle = &tj->user_handle;
 334         s.in.info = &u;
 335         s.in.level = 21;
 336
 337         u.info21.fields_present = SAMR_FIELD_DESCRIPTION | SAMR_FIELD_COMMENT | SAMR_FIELD_FULL_NAME;
 338         u.info21.comment.string = talloc_asprintf(tj,
 339                                                   "Tortured by Samba4: %s",
 340                                                   timestring(tj, time(NULL)));
 341         u.info21.full_name.string = talloc_asprintf(tj,
 342                                                     "Torture account for Samba4: %s",
 343                                                     timestring(tj, time(NULL)));
 344
 345         u.info21.description.string = talloc_asprintf(tj,
 346                                                       "Samba4 torture account created by host %s: %s",
 347                                                       lp_netbios_name(), timestring(tj, time(NULL)));
 348
 349         status = dcerpc_samr_SetUserInfo(tj->p, tj, &s);
 350         if (!NT_STATUS_IS_OK(status)) {
 351                 printf("SetUserInfo (non-critical) failed - %s\n", nt_errstr(status));
 352         }
 353
 354         DEBUG(0, ("%s joined domain %s (%s).\n",
 355                   libnet_r->in.netbios_name,
 356                   libnet_r->out.domain_name,
 357                   tj->dom_sid));
 358
 359         *machine_credentials = cli_credentials_init(tj);
 360         cli_credentials_set_conf(*machine_credentials);
 361         cli_credentials_set_workstation(*machine_credentials, machine_name, CRED_SPECIFIED);
 362         cli_credentials_set_domain(*machine_credentials, libnet_r->out.domain_name, CRED_SPECIFIED);
 363         if (libnet_r->out.realm) {
 364                 cli_credentials_set_realm(*machine_credentials, libnet_r->out.realm, CRED_SPECIFIED);
 365         }
 366         cli_credentials_set_username(*machine_credentials, libnet_r->in.account_name, CRED_SPECIFIED);
 367         cli_credentials_set_password(*machine_credentials, libnet_r->out.join_password, CRED_SPECIFIED);
 368         if (acct_flags & ACB_SVRTRUST) {
 369                 cli_credentials_set_secure_channel_type(*machine_credentials,
 370                                                         SEC_CHAN_BDC);
 371         } else if (acct_flags & ACB_WSTRUST) {
 372                 cli_credentials_set_secure_channel_type(*machine_credentials,
 373                                                         SEC_CHAN_WKSTA);
 374         } else {
 375                 DEBUG(0, ("Invalid account type specificed to torture_join_domain\n"));
 376                 talloc_free(*machine_credentials);
 377                 return NULL;
 378         }
 379
 380         return tj;
 381 }
 382
 383 struct dcerpc_pipe *torture_join_samr_pipe(struct test_join *join)
 384 {
 385         return join->p;
 386 }
 387
 388 struct policy_handle *torture_join_samr_user_policy(struct test_join *join)
 389 {
 390         return &join->user_handle;
 391 }
 392
 393 NTSTATUS torture_leave_ads_domain(TALLOC_CTX *mem_ctx, struct libnet_JoinDomain *libnet_r)
 394 {
 395         int rtn;
 396         TALLOC_CTX *tmp_ctx;
 397
 398         struct ldb_dn *server_dn;
 399         struct ldb_context *ldb_ctx;
 400
 401         char *remote_ldb_url;
 402
 403         /* Check if we are a domain controller. If not, exit. */
 404         if (!libnet_r->out.server_dn_str) {
 405                 return NT_STATUS_OK;
 406         }
 407
 408         tmp_ctx = talloc_named(mem_ctx, 0, "torture_leave temporary context");
 409         if (!tmp_ctx) {
 410                 libnet_r->out.error_string = NULL;
 411                 return NT_STATUS_NO_MEMORY;
 412         }
 413
 414         ldb_ctx = ldb_init(tmp_ctx);
 415         if (!ldb_ctx) {
 416                 libnet_r->out.error_string = NULL;
 417                 talloc_free(tmp_ctx);
 418                 return NT_STATUS_NO_MEMORY;
 419         }
 420
 421         /* Remove CN=Servers,... entry from the AD. */
 422         server_dn = ldb_dn_explode(tmp_ctx, libnet_r->out.server_dn_str);
 423         if (!server_dn) {
 424                 libnet_r->out.error_string = NULL;
 425                 talloc_free(tmp_ctx);
 426                 return NT_STATUS_NO_MEMORY;
 427         }
 428
 429         remote_ldb_url = talloc_asprintf(tmp_ctx, "ldap://%s", libnet_r->out.samr_binding->host);
 430         if (!remote_ldb_url) {
 431                 libnet_r->out.error_string = NULL;
 432                 talloc_free(tmp_ctx);
 433                 return NT_STATUS_NO_MEMORY;
 434         }
 435
 436         rtn = ldb_connect(ldb_ctx, remote_ldb_url, 0, NULL);
 437         if (rtn != 0) {
 438                 libnet_r->out.error_string = NULL;
 439                 talloc_free(tmp_ctx);
 440                 return NT_STATUS_UNSUCCESSFUL;
 441         }
 442
 443         rtn = ldb_delete(ldb_ctx, server_dn);
 444         if (rtn != 0) {
 445                 libnet_r->out.error_string = NULL;
 446                 talloc_free(tmp_ctx);
 447                 return NT_STATUS_UNSUCCESSFUL;
 448         }
 449
 450         DEBUG(0, ("%s removed successfully.\n", libnet_r->out.server_dn_str));
 451
 452         talloc_free(tmp_ctx);
 453         return NT_STATUS_OK;
 454 }
 455
 456 /*
 457   leave the domain, deleting the machine acct
 458 */
 459
 460 void torture_leave_domain(struct test_join *join)
 461 {
 462         struct samr_DeleteUser d;
 463         NTSTATUS status;
 464
 465         if (!join) {
 466                 return;
 467         }
 468         d.in.user_handle = &join->user_handle;
 469         d.out.user_handle = &join->user_handle;
 470
 471         /* Delete machine account */
 472         status = dcerpc_samr_DeleteUser(join->p, join, &d);
 473         if (!NT_STATUS_IS_OK(status)) {
 474                 printf("Delete of machine account failed\n");
 475         } else {
 476                 printf("Delete of machine account was successful.\n");
 477         }
 478
 479         if (join->libnet_r) {
 480                 status = torture_leave_ads_domain(join, join->libnet_r);
 481         }
 482
 483         talloc_free(join);
 484 }
 485
 486 /*
 487   return the dom sid for a test join
 488 */
 489 const char *torture_join_sid(struct test_join *join)
 490 {
 491         return join->dom_sid;
 492 }
 493
 494
 495 struct test_join_ads_dc {
 496         struct test_join *join;
 497 };
 498
 499 struct test_join_ads_dc *torture_join_domain_ads_dc(const char *machine_name,
 500                                                     const char *domain,
 501                                                     struct cli_credentials **machine_credentials)
 502 {
 503         struct test_join_ads_dc *join;
 504
 505         join = talloc(NULL, struct test_join_ads_dc);
 506         if (join == NULL) {
 507                 return NULL;
 508         }
 509
 510         join->join = torture_join_domain(machine_name,
 511                                         ACB_SVRTRUST,
 512                                         machine_credentials);
 513
 514         if (!join->join) {
 515                 return NULL;
 516         }
 517
 518         /* do netlogon DrsEnumerateDomainTrusts */
 519
 520         /* modify userAccountControl from 4096 to 532480 */
 521
 522         /* modify RDN to OU=Domain Controllers and skip the $ from server name */
 523
 524         /* ask objectVersion of Schema Partition */
 525
 526         /* ask rIDManagerReferenz of the Domain Partition */
 527
 528         /* ask fsMORoleOwner of the RID-Manager$ object
 529          * returns CN=NTDS Settings,CN=<DC>,CN=Servers,CN=Default-First-Site-Name, ...
 530          */
 531
 532         /* ask for dnsHostName of CN=<DC>,CN=Servers,CN=Default-First-Site-Name, ... */
 533
 534         /* ask for objectGUID of CN=NTDS Settings,CN=<DC>,CN=Servers,CN=Default-First-Site-Name, ... */
 535
 536         /* ask for * of CN=Default-First-Site-Name, ... */
 537
 538         /* search (&(|(objectClass=user)(objectClass=computer))(sAMAccountName=<machine_name>$)) in Domain Partition
 539          * attributes : distinguishedName, userAccountControl
 540          */
 541
 542         /* ask * for CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
 543          * should fail with noSuchObject
 544          */
 545
 546         /* add CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
 547          *
 548          * objectClass = server
 549          * systemFlags = 50000000
 550          * serverReferenz = CN=<machine_name>,OU=Domain Controllers,...
 551          */
 552
 553         /* ask for * of CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
 554          * should fail with noSuchObject
 555          */
 556
 557         /* search for (ncname=<domain_nc>) in CN=Partitions,CN=Configuration,...
 558          * attributes: ncName, dnsRoot
 559          */
 560
 561         /* modify add CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
 562          * serverReferenz = CN=<machine_name>,OU=Domain Controllers,...
 563          * should fail with attributeOrValueExists
 564          */
 565
 566         /* modify replace CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
 567          * serverReferenz = CN=<machine_name>,OU=Domain Controllers,...
 568          */
 569
 570         /* DsReplicaAdd to create the CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
 571          * needs to be tested
 572          */
 573
 574         return join;
 575 }
 576
 577 void torture_leave_domain_ads_dc(struct test_join_ads_dc *join)
 578 {
 579
 580         if (join->join) {
 581                 torture_leave_domain(join->join);
 582         }
 583
 584         talloc_free(join);
 585 }