source/torture/winbind/struct_based.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    SMB torture tester - winbind struct based protocol
   4    Copyright (C) Stefan Metzmacher 2007
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "pstring.h"
  22 #include "torture/torture.h"
  23 #include "torture/winbind/proto.h"
  24 #include "nsswitch/winbind_client.h"
  25 #include "libcli/security/security.h"
  26 #include "librpc/gen_ndr/netlogon.h"
  27 #include "param/param.h"
  28 #include "auth/pam_errors.h"
  29
  30 #define DO_STRUCT_REQ_REP_EXT(op,req,rep,expected,strict,warnaction,cmt) do { \
  31         NSS_STATUS __got, __expected = (expected); \
  32         __got = winbindd_request_response(op, req, rep); \
  33         if (__got != __expected) { \
  34                 const char *__cmt = (cmt); \
  35                 if (strict) { \
  36                         torture_result(torture, TORTURE_FAIL, \
  37                                 __location__ ": " __STRING(op) \
  38                                 " returned %d, expected %d%s%s", \
  39                                 __got, __expected, \
  40                                 (__cmt) ? ": " : "", \
  41                                 (__cmt) ? (__cmt) : ""); \
  42                         return false; \
  43                 } else { \
  44                         torture_warning(torture, \
  45                                 __location__ ": " __STRING(op) \
  46                                 " returned %d, expected %d%s%s", \
  47                                 __got, __expected, \
  48                                 (__cmt) ? ": " : "", \
  49                                 (__cmt) ? (__cmt) : ""); \
  50                         warnaction; \
  51                 } \
  52         } \
  53 } while(0)
  54
  55 #define DO_STRUCT_REQ_REP(op,req,rep) do { \
  56         bool __noop = false; \
  57         DO_STRUCT_REQ_REP_EXT(op,req,rep,NSS_STATUS_SUCCESS,true,__noop=true,NULL); \
  58 } while (0)
  59
  60 static bool torture_winbind_struct_interface_version(struct torture_context *torture)
  61 {
  62         struct winbindd_request req;
  63         struct winbindd_response rep;
  64
  65         ZERO_STRUCT(req);
  66         ZERO_STRUCT(rep);
  67
  68         torture_comment(torture, "Running WINBINDD_INTERFACE_VERSION (struct based)\n");
  69
  70         DO_STRUCT_REQ_REP(WINBINDD_INTERFACE_VERSION, &req, &rep);
  71
  72         torture_assert_int_equal(torture,
  73                                  rep.data.interface_version,
  74                                  WINBIND_INTERFACE_VERSION,
  75                                  "winbind server and client doesn't match");
  76
  77         return true;
  78 }
  79
  80 static bool torture_winbind_struct_ping(struct torture_context *torture)
  81 {
  82         struct timeval tv = timeval_current();
  83         int timelimit = torture_setting_int(torture, "timelimit", 5);
  84         uint32_t total = 0;
  85
  86         torture_comment(torture,
  87                         "Running WINBINDD_PING (struct based) for %d seconds\n",
  88                         timelimit);
  89
  90         while (timeval_elapsed(&tv) < timelimit) {
  91                 DO_STRUCT_REQ_REP(WINBINDD_PING, NULL, NULL);
  92                 total++;
  93         }
  94
  95         torture_comment(torture,
  96                         "%u (%.1f/s) WINBINDD_PING (struct based)\n",
  97                         total, total / timeval_elapsed(&tv));
  98
  99         return true;
 100 }
 101
 102 static bool torture_winbind_struct_info(struct torture_context *torture)
 103 {
 104         struct winbindd_response rep;
 105         const char *separator;
 106
 107         ZERO_STRUCT(rep);
 108
 109         torture_comment(torture, "Running WINBINDD_INFO (struct based)\n");
 110
 111         DO_STRUCT_REQ_REP(WINBINDD_INFO, NULL, &rep);
 112
 113         separator = torture_setting_string(torture,
 114                                            "winbindd separator",
 115                                            lp_winbind_separator());
 116         torture_assert_int_equal(torture,
 117                                  rep.data.info.winbind_separator,
 118                                  *separator,
 119                                  "winbind separator doesn't match");
 120
 121         torture_comment(torture, "Samba Version '%s'\n",
 122                         rep.data.info.samba_version);
 123
 124         return true;
 125 }
 126
 127 static bool torture_winbind_struct_priv_pipe_dir(struct torture_context *torture)
 128 {
 129         struct winbindd_response rep;
 130         const char *default_dir;
 131         const char *expected_dir;
 132         const char *got_dir;
 133
 134         ZERO_STRUCT(rep);
 135
 136         torture_comment(torture, "Running WINBINDD_PRIV_PIPE_DIR (struct based)\n");
 137
 138         DO_STRUCT_REQ_REP(WINBINDD_PRIV_PIPE_DIR, NULL, &rep);
 139
 140         got_dir = (const char *)rep.extra_data.data;
 141
 142         torture_assert(torture, got_dir, "NULL WINBINDD_PRIV_PIPE_DIR\n");
 143
 144         default_dir = lock_path(torture, WINBINDD_PRIV_SOCKET_SUBDIR);
 145         expected_dir = torture_setting_string(torture,
 146                                               "winbindd private pipe dir",
 147                                               default_dir);
 148
 149         torture_assert_str_equal(torture, got_dir, expected_dir,
 150                                  "WINBINDD_PRIV_PIPE_DIR doesn't match");
 151
 152         SAFE_FREE(rep.extra_data.data);
 153         return true;
 154 }
 155
 156 static bool torture_winbind_struct_netbios_name(struct torture_context *torture)
 157 {
 158         struct winbindd_response rep;
 159         const char *expected;
 160
 161         ZERO_STRUCT(rep);
 162
 163         torture_comment(torture, "Running WINBINDD_NETBIOS_NAME (struct based)\n");
 164
 165         DO_STRUCT_REQ_REP(WINBINDD_NETBIOS_NAME, NULL, &rep);
 166
 167         expected = torture_setting_string(torture,
 168                                           "winbindd netbios name",
 169                                           lp_netbios_name());
 170
 171         torture_assert_str_equal(torture,
 172                                  rep.data.netbios_name, expected,
 173                                  "winbindd's netbios name doesn't match");
 174
 175         return true;
 176 }
 177
 178 static bool torture_winbind_struct_domain_name(struct torture_context *torture)
 179 {
 180         struct winbindd_response rep;
 181         const char *expected;
 182
 183         ZERO_STRUCT(rep);
 184
 185         torture_comment(torture, "Running WINBINDD_DOMAIN_NAME (struct based)\n");
 186
 187         DO_STRUCT_REQ_REP(WINBINDD_DOMAIN_NAME, NULL, &rep);
 188
 189         expected = torture_setting_string(torture,
 190                                           "winbindd netbios domain",
 191                                           lp_workgroup());
 192
 193         torture_assert_str_equal(torture,
 194                                  rep.data.domain_name, expected,
 195                                  "winbindd's netbios domain doesn't match");
 196
 197         return true;
 198 }
 199
 200 static bool torture_winbind_struct_check_machacc(struct torture_context *torture)
 201 {
 202         bool ok;
 203         bool strict = torture_setting_bool(torture, "strict mode", false);
 204         struct winbindd_response rep;
 205
 206         ZERO_STRUCT(rep);
 207
 208         torture_comment(torture, "Running WINBINDD_CHECK_MACHACC (struct based)\n");
 209
 210         ok = true;
 211         DO_STRUCT_REQ_REP_EXT(WINBINDD_CHECK_MACHACC, NULL, &rep,
 212                               NSS_STATUS_SUCCESS, strict, ok = false,
 213                               "WINBINDD_CHECK_MACHACC");
 214
 215         if (!ok) {
 216                 torture_assert(torture,
 217                                strlen(rep.data.auth.nt_status_string)>0,
 218                                "Failed with empty nt_status_string");
 219
 220                 torture_warning(torture,"%s:%s:%s:%d\n",
 221                                 nt_errstr(NT_STATUS(rep.data.auth.nt_status)),
 222                                 rep.data.auth.nt_status_string,
 223                                 rep.data.auth.error_string,
 224                                 rep.data.auth.pam_error);
 225                 return true;
 226         }
 227
 228         torture_assert_ntstatus_ok(torture,
 229                                    NT_STATUS(rep.data.auth.nt_status),
 230                                    "WINBINDD_CHECK_MACHACC ok: nt_status");
 231
 232         torture_assert_str_equal(torture,
 233                                  rep.data.auth.nt_status_string,
 234                                  nt_errstr(NT_STATUS_OK),
 235                                  "WINBINDD_CHECK_MACHACC ok:nt_status_string");
 236
 237         torture_assert_str_equal(torture,
 238                                  rep.data.auth.error_string,
 239                                  nt_errstr(NT_STATUS_OK),
 240                                  "WINBINDD_CHECK_MACHACC ok: error_string");
 241
 242         torture_assert_int_equal(torture,
 243                                  rep.data.auth.pam_error,
 244                                  nt_status_to_pam(NT_STATUS_OK),
 245                                  "WINBINDD_CHECK_MACHACC ok: pam_error");
 246
 247         return true;
 248 }
 249
 250 struct torture_trust_domain {
 251         const char *netbios_name;
 252         const char *dns_name;
 253         struct dom_sid *sid;
 254 };
 255
 256 static bool get_trusted_domains(struct torture_context *torture,
 257                                 struct torture_trust_domain **_d)
 258 {
 259         struct winbindd_request req;
 260         struct winbindd_response rep;
 261         struct torture_trust_domain *d = NULL;
 262         uint32_t dcount = 0;
 263         fstring line;
 264         const char *extra_data;
 265
 266         ZERO_STRUCT(req);
 267         ZERO_STRUCT(rep);
 268
 269         DO_STRUCT_REQ_REP(WINBINDD_LIST_TRUSTDOM, &req, &rep);
 270
 271         extra_data = (char *)rep.extra_data.data;
 272         torture_assert(torture, extra_data, "NULL trust list");
 273
 274         while (next_token(&extra_data, line, "\n", sizeof(fstring))) {
 275                 char *p, *lp;
 276
 277                 d = talloc_realloc(torture, d,
 278                                    struct torture_trust_domain,
 279                                    dcount + 2);
 280                 ZERO_STRUCT(d[dcount+1]);
 281
 282                 lp = line;
 283                 p = strchr(lp, '\\');
 284                 torture_assert(torture, p, "missing 1st '\\' in line");
 285                 *p = 0;
 286                 d[dcount].netbios_name = talloc_strdup(d, lp);
 287                 torture_assert(torture, strlen(d[dcount].netbios_name) > 0,
 288                                "empty netbios_name");
 289
 290                 lp = p+1;
 291                 p = strchr(lp, '\\');
 292                 torture_assert(torture, p, "missing 2nd '\\' in line");
 293                 *p = 0;
 294                 d[dcount].dns_name = talloc_strdup(d, lp);
 295                 /* it's ok to have an empty dns_name */
 296
 297                 lp = p+1;
 298                 d[dcount].sid = dom_sid_parse_talloc(d, lp);
 299                 torture_assert(torture, d[dcount].sid,
 300                                "failed to parse sid");
 301
 302                 dcount++;
 303         }
 304         SAFE_FREE(rep.extra_data.data);
 305
 306         torture_assert(torture, dcount >= 2,
 307                        "The list of trusted domain should contain 2 entries");
 308
 309         *_d = d;
 310         return true;
 311 }
 312
 313 static bool torture_winbind_struct_list_trustdom(struct torture_context *torture)
 314 {
 315         struct winbindd_request req;
 316         struct winbindd_response rep;
 317         char *list1;
 318         char *list2;
 319         bool ok;
 320         struct torture_trust_domain *listd = NULL;
 321         uint32_t i;
 322
 323         torture_comment(torture, "Running WINBINDD_LIST_TRUSTDOM (struct based)\n");
 324
 325         ZERO_STRUCT(req);
 326         ZERO_STRUCT(rep);
 327
 328         req.data.list_all_domains = false;
 329
 330         DO_STRUCT_REQ_REP(WINBINDD_LIST_TRUSTDOM, &req, &rep);
 331
 332         list1 = (char *)rep.extra_data.data;
 333         torture_assert(torture, list1, "NULL trust list");
 334
 335         torture_comment(torture, "%s\n", list1);
 336
 337         ZERO_STRUCT(req);
 338         ZERO_STRUCT(rep);
 339
 340         req.data.list_all_domains = true;
 341
 342         DO_STRUCT_REQ_REP(WINBINDD_LIST_TRUSTDOM, &req, &rep);
 343
 344         list2 = (char *)rep.extra_data.data;
 345         torture_assert(torture, list2, "NULL trust list");
 346
 347         /*
 348          * The list_all_domains parameter should be ignored
 349          */
 350         torture_assert_str_equal(torture, list2, list1, "list_all_domains not ignored");
 351
 352         SAFE_FREE(list1);
 353         SAFE_FREE(list2);
 354
 355         ok = get_trusted_domains(torture, &listd);
 356         torture_assert(torture, ok, "failed to get trust list");
 357
 358         for (i=0; listd[i].netbios_name; i++) {
 359                 if (i == 0) {
 360                         struct dom_sid *builtin_sid;
 361
 362                         builtin_sid = dom_sid_parse_talloc(torture, SID_BUILTIN);
 363
 364                         torture_assert_str_equal(torture,
 365                                                  listd[i].netbios_name,
 366                                                  NAME_BUILTIN,
 367                                                  "first domain should be 'BUILTIN'");
 368
 369                         torture_assert_str_equal(torture,
 370                                                  listd[i].dns_name,
 371                                                  "",
 372                                                  "BUILTIN domain should not have a dns name");
 373
 374                         ok = dom_sid_equal(builtin_sid,
 375                                            listd[i].sid);
 376                         torture_assert(torture, ok, "BUILTIN domain should have S-1-5-32");
 377
 378                         continue;
 379                 }
 380
 381                 /*
 382                  * TODO: verify the content of the 2nd and 3rd (in member server mode)
 383                  *       domain entries
 384                  */
 385         }
 386
 387         return true;
 388 }
 389
 390 static bool torture_winbind_struct_domain_info(struct torture_context *torture)
 391 {
 392         bool ok;
 393         struct torture_trust_domain *listd = NULL;
 394         uint32_t i;
 395
 396         torture_comment(torture, "Running WINBINDD_DOMAIN_INFO (struct based)\n");
 397
 398         ok = get_trusted_domains(torture, &listd);
 399         torture_assert(torture, ok, "failed to get trust list");
 400
 401         for (i=0; listd[i].netbios_name; i++) {
 402                 struct winbindd_request req;
 403                 struct winbindd_response rep;
 404                 struct dom_sid *sid;
 405                 char *flagstr = talloc_strdup(torture," ");
 406
 407                 ZERO_STRUCT(req);
 408                 ZERO_STRUCT(rep);
 409
 410                 fstrcpy(req.domain_name, listd[i].netbios_name);
 411
 412                 DO_STRUCT_REQ_REP(WINBINDD_DOMAIN_INFO, &req, &rep);
 413
 414                 torture_assert_str_equal(torture,
 415                                          rep.data.domain_info.name,
 416                                          listd[i].netbios_name,
 417                                          "Netbios domain name doesn't match");
 418
 419                 torture_assert_str_equal(torture,
 420                                          rep.data.domain_info.alt_name,
 421                                          listd[i].dns_name,
 422                                          "DNS domain name doesn't match");
 423
 424                 sid = dom_sid_parse_talloc(torture, rep.data.domain_info.sid);
 425                 torture_assert(torture, sid, "Failed to parse SID");
 426
 427                 ok = dom_sid_equal(listd[i].sid, sid);
 428                 torture_assert(torture, ok, "SID's doesn't match");
 429
 430                 if (rep.data.domain_info.primary) {
 431                         flagstr = talloc_strdup_append(flagstr, "PR ");
 432                 }
 433
 434                 if (rep.data.domain_info.active_directory) {
 435                         torture_assert(torture,
 436                                        strlen(rep.data.domain_info.alt_name)>0,
 437                                        "Active Directory without DNS name");
 438                         flagstr = talloc_strdup_append(flagstr, "AD ");
 439                 }
 440
 441                 if (rep.data.domain_info.native_mode) {
 442                         torture_assert(torture,
 443                                        rep.data.domain_info.active_directory,
 444                                        "Native-Mode, but no Active Directory");
 445                         flagstr = talloc_strdup_append(flagstr, "NA ");
 446                 }
 447
 448                 torture_comment(torture, "DOMAIN '%s' => '%s' [%s]\n",
 449                                 rep.data.domain_info.name,
 450                                 rep.data.domain_info.alt_name,
 451                                 flagstr);
 452         }
 453
 454         return true;
 455 }
 456
 457 static bool torture_winbind_struct_getdcname(struct torture_context *torture)
 458 {
 459         bool ok;
 460         bool strict = torture_setting_bool(torture, "strict mode", false);
 461         struct torture_trust_domain *listd = NULL;
 462         uint32_t i;
 463
 464         torture_comment(torture, "Running WINBINDD_GETDCNAME (struct based)\n");
 465
 466         ok = get_trusted_domains(torture, &listd);
 467         torture_assert(torture, ok, "failed to get trust list");
 468
 469         for (i=0; listd[i].netbios_name; i++) {
 470                 struct winbindd_request req;
 471                 struct winbindd_response rep;
 472
 473                 ZERO_STRUCT(req);
 474                 ZERO_STRUCT(rep);
 475
 476                 fstrcpy(req.domain_name, listd[i].netbios_name);
 477
 478                 ok = true;
 479                 DO_STRUCT_REQ_REP_EXT(WINBINDD_GETDCNAME, &req, &rep,
 480                                       NSS_STATUS_SUCCESS,
 481                                       (i <2 || strict), ok = false,
 482                                       talloc_asprintf(torture, "DOMAIN '%s'",
 483                                                       req.domain_name));
 484                 if (!ok) continue;
 485
 486                 /* TODO: check rep.data.dc_name; */
 487                 torture_comment(torture, "DOMAIN '%s' => DCNAME '%s'\n",
 488                                 req.domain_name, rep.data.dc_name);
 489         }
 490
 491         return true;
 492 }
 493
 494 static bool torture_winbind_struct_dsgetdcname(struct torture_context *torture)
 495 {
 496         bool ok;
 497         bool strict = torture_setting_bool(torture, "strict mode", false);
 498         struct torture_trust_domain *listd = NULL;
 499         uint32_t i;
 500         uint32_t count = 0;
 501
 502         torture_comment(torture, "Running WINBINDD_DSGETDCNAME (struct based)\n");
 503
 504         ok = get_trusted_domains(torture, &listd);
 505         torture_assert(torture, ok, "failed to get trust list");
 506
 507         for (i=0; listd[i].netbios_name; i++) {
 508                 struct winbindd_request req;
 509                 struct winbindd_response rep;
 510
 511                 ZERO_STRUCT(req);
 512                 ZERO_STRUCT(rep);
 513
 514                 if (strlen(listd[i].dns_name) == 0) continue;
 515
 516                 /*
 517                  * TODO: remove this and let winbindd give no dns name
 518                  *       for NT4 domains
 519                  */
 520                 if (strcmp(listd[i].dns_name, listd[i].netbios_name) == 0) {
 521                         continue;
 522                 }
 523
 524                 fstrcpy(req.domain_name, listd[i].dns_name);
 525
 526                 /* TODO: test more flag combinations */
 527                 req.flags = DS_DIRECTORY_SERVICE_REQUIRED;
 528
 529                 ok = true;
 530                 DO_STRUCT_REQ_REP_EXT(WINBINDD_DSGETDCNAME, &req, &rep,
 531                                       NSS_STATUS_SUCCESS,
 532                                       strict, ok = false,
 533                                       talloc_asprintf(torture, "DOMAIN '%s'",
 534                                                       req.domain_name));
 535                 if (!ok) continue;
 536
 537                 /* TODO: check rep.data.dc_name; */
 538                 torture_comment(torture, "DOMAIN '%s' => DCNAME '%s'\n",
 539                                 req.domain_name, rep.data.dc_name);
 540
 541                 count++;
 542         }
 543
 544         if (count == 0) {
 545                 torture_warning(torture, "WINBINDD_DSGETDCNAME"
 546                                 " was not tested with %d non-AD domains",
 547                                 i);
 548         }
 549
 550         if (strict) {
 551                 torture_assert(torture, count > 0,
 552                                "WiNBINDD_DSGETDCNAME was not tested");
 553         }
 554
 555         return true;
 556 }
 557
 558 struct torture_suite *torture_winbind_struct_init(void)
 559 {
 560         struct torture_suite *suite = torture_suite_create(talloc_autofree_context(), "STRUCT");
 561
 562         torture_suite_add_simple_test(suite, "INTERFACE_VERSION", torture_winbind_struct_interface_version);
 563         torture_suite_add_simple_test(suite, "PING", torture_winbind_struct_ping);
 564         torture_suite_add_simple_test(suite, "INFO", torture_winbind_struct_info);
 565         torture_suite_add_simple_test(suite, "PRIV_PIPE_DIR", torture_winbind_struct_priv_pipe_dir);
 566         torture_suite_add_simple_test(suite, "NETBIOS_NAME", torture_winbind_struct_netbios_name);
 567         torture_suite_add_simple_test(suite, "DOMAIN_NAME", torture_winbind_struct_domain_name);
 568         torture_suite_add_simple_test(suite, "CHECK_MACHACC", torture_winbind_struct_check_machacc);
 569         torture_suite_add_simple_test(suite, "LIST_TRUSTDOM", torture_winbind_struct_list_trustdom);
 570         torture_suite_add_simple_test(suite, "DOMAIN_INFO", torture_winbind_struct_domain_info);
 571         torture_suite_add_simple_test(suite, "GETDCNAME", torture_winbind_struct_getdcname);
 572         torture_suite_add_simple_test(suite, "DSGETDCNAME", torture_winbind_struct_dsgetdcname);
 573
 574         suite->description = talloc_strdup(suite, "WINBIND - struct based protocol tests");
 575
 576         return suite;
 577 }