source4/torture/rpc/testjoin.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    utility code to join/leave a domain
   5
   6    Copyright (C) Andrew Tridgell 2004
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 2 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program; if not, write to the Free Software
  20    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21 */
  22
  23 /*
  24   this code is used by other torture modules to join/leave a domain
  25   as either a member, bdc or thru a trust relationship
  26 */
  27
  28 #include "includes.h"
  29 #include "torture/torture.h"
  30 #include "system/time.h"
  31 #include "lib/crypto/crypto.h"
  32 #include "libnet/libnet.h"
  33 #include "lib/cmdline/popt_common.h"
  34 #include "smb.h"
  35 #include "lib/ldb/include/ldb.h"
  36
  37 #include "torture/rpc/proto.h"
  38
  39 struct test_join {
  40         struct dcerpc_pipe *p;
  41         struct policy_handle user_handle;
  42         struct libnet_JoinDomain *libnet_r;
  43         struct dom_sid *dom_sid;
  44         struct dom_sid *user_sid;
  45 };
  46
  47
  48 static NTSTATUS DeleteUser_byname(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
  49                                   struct policy_handle *handle, const char *name)
  50 {
  51         NTSTATUS status;
  52         struct samr_DeleteUser d;
  53         struct policy_handle user_handle;
  54         uint32_t rid;
  55         struct samr_LookupNames n;
  56         struct lsa_String sname;
  57         struct samr_OpenUser r;
  58
  59         sname.string = name;
  60
  61         n.in.domain_handle = handle;
  62         n.in.num_names = 1;
  63         n.in.names = &sname;
  64
  65         status = dcerpc_samr_LookupNames(p, mem_ctx, &n);
  66         if (NT_STATUS_IS_OK(status)) {
  67                 rid = n.out.rids.ids[0];
  68         } else {
  69                 return status;
  70         }
  71
  72         r.in.domain_handle = handle;
  73         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
  74         r.in.rid = rid;
  75         r.out.user_handle = &user_handle;
  76
  77         status = dcerpc_samr_OpenUser(p, mem_ctx, &r);
  78         if (!NT_STATUS_IS_OK(status)) {
  79                 printf("OpenUser(%s) failed - %s\n", name, nt_errstr(status));
  80                 return status;
  81         }
  82
  83         d.in.user_handle = &user_handle;
  84         d.out.user_handle = &user_handle;
  85         status = dcerpc_samr_DeleteUser(p, mem_ctx, &d);
  86         if (!NT_STATUS_IS_OK(status)) {
  87                 return status;
  88         }
  89
  90         return NT_STATUS_OK;
  91 }
  92
  93 /*
  94   create a test user in the domain
  95   an opaque pointer is returned. Pass it to torture_leave_domain()
  96   when finished
  97 */
  98
  99 struct test_join *torture_create_testuser(const char *username,
 100                                           const char *domain,
 101                                           uint16_t acct_type,
 102                                           const char **random_password)
 103 {
 104         NTSTATUS status;
 105         struct samr_Connect c;
 106         struct samr_CreateUser2 r;
 107         struct samr_OpenDomain o;
 108         struct samr_LookupDomain l;
 109         struct samr_GetUserPwInfo pwp;
 110         struct samr_SetUserInfo s;
 111         union samr_UserInfo u;
 112         struct policy_handle handle;
 113         struct policy_handle domain_handle;
 114         uint32_t access_granted;
 115         uint32_t rid;
 116         DATA_BLOB session_key;
 117         struct lsa_String name;
 118
 119         int policy_min_pw_len = 0;
 120         struct test_join *join;
 121         char *random_pw;
 122
 123         join = talloc(NULL, struct test_join);
 124         if (join == NULL) {
 125                 return NULL;
 126         }
 127
 128         ZERO_STRUCTP(join);
 129
 130         printf("Connecting to SAMR\n");
 131
 132         status = torture_rpc_connection(join,
 133                                         &join->p,
 134                                         &dcerpc_table_samr);
 135         if (!NT_STATUS_IS_OK(status)) {
 136                 return NULL;
 137         }
 138
 139         c.in.system_name = NULL;
 140         c.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 141         c.out.connect_handle = &handle;
 142
 143         status = dcerpc_samr_Connect(join->p, join, &c);
 144         if (!NT_STATUS_IS_OK(status)) {
 145                 const char *errstr = nt_errstr(status);
 146                 if (NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
 147                         errstr = dcerpc_errstr(join, join->p->last_fault_code);
 148                 }
 149                 printf("samr_Connect failed - %s\n", errstr);
 150                 return NULL;
 151         }
 152
 153         printf("Opening domain %s\n", domain);
 154
 155         name.string = domain;
 156         l.in.connect_handle = &handle;
 157         l.in.domain_name = &name;
 158
 159         status = dcerpc_samr_LookupDomain(join->p, join, &l);
 160         if (!NT_STATUS_IS_OK(status)) {
 161                 printf("LookupDomain failed - %s\n", nt_errstr(status));
 162                 goto failed;
 163         }
 164
 165         talloc_steal(join, l.out.sid);
 166         join->dom_sid = l.out.sid;
 167
 168         o.in.connect_handle = &handle;
 169         o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 170         o.in.sid = l.out.sid;
 171         o.out.domain_handle = &domain_handle;
 172
 173         status = dcerpc_samr_OpenDomain(join->p, join, &o);
 174         if (!NT_STATUS_IS_OK(status)) {
 175                 printf("OpenDomain failed - %s\n", nt_errstr(status));
 176                 goto failed;
 177         }
 178
 179         printf("Creating account %s\n", username);
 180
 181 again:
 182         name.string = username;
 183         r.in.domain_handle = &domain_handle;
 184         r.in.account_name = &name;
 185         r.in.acct_flags = acct_type;
 186         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 187         r.out.user_handle = &join->user_handle;
 188         r.out.access_granted = &access_granted;
 189         r.out.rid = &rid;
 190
 191         status = dcerpc_samr_CreateUser2(join->p, join, &r);
 192
 193         if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
 194                 status = DeleteUser_byname(join->p, join, &domain_handle, name.string);
 195                 if (NT_STATUS_IS_OK(status)) {
 196                         goto again;
 197                 }
 198         }
 199
 200         if (!NT_STATUS_IS_OK(status)) {
 201                 printf("CreateUser2 failed - %s\n", nt_errstr(status));
 202                 goto failed;
 203         }
 204
 205         join->user_sid = dom_sid_add_rid(join, join->dom_sid, rid);
 206
 207         pwp.in.user_handle = &join->user_handle;
 208
 209         status = dcerpc_samr_GetUserPwInfo(join->p, join, &pwp);
 210         if (NT_STATUS_IS_OK(status)) {
 211                 policy_min_pw_len = pwp.out.info.min_password_length;
 212         }
 213
 214         random_pw = generate_random_str(join, MAX(8, policy_min_pw_len));
 215
 216         printf("Setting account password '%s'\n", random_pw);
 217
 218         s.in.user_handle = &join->user_handle;
 219         s.in.info = &u;
 220         s.in.level = 24;
 221
 222         encode_pw_buffer(u.info24.password.data, random_pw, STR_UNICODE);
 223         u.info24.pw_len = strlen(random_pw);
 224
 225         status = dcerpc_fetch_session_key(join->p, &session_key);
 226         if (!NT_STATUS_IS_OK(status)) {
 227                 printf("SetUserInfo level %u - no session key - %s\n",
 228                        s.in.level, nt_errstr(status));
 229                 torture_leave_domain(join);
 230                 goto failed;
 231         }
 232
 233         arcfour_crypt_blob(u.info24.password.data, 516, &session_key);
 234
 235         status = dcerpc_samr_SetUserInfo(join->p, join, &s);
 236         if (!NT_STATUS_IS_OK(status)) {
 237                 printf("SetUserInfo failed - %s\n", nt_errstr(status));
 238                 goto failed;
 239         }
 240
 241         ZERO_STRUCT(u);
 242         s.in.user_handle = &join->user_handle;
 243         s.in.info = &u;
 244         s.in.level = 21;
 245
 246         u.info21.acct_flags = acct_type;
 247         u.info21.fields_present = SAMR_FIELD_ACCT_FLAGS | SAMR_FIELD_DESCRIPTION | SAMR_FIELD_COMMENT | SAMR_FIELD_FULL_NAME;
 248
 249         u.info21.comment.string = talloc_asprintf(join,
 250                                                   "Tortured by Samba4: %s",
 251                                                   timestring(join, time(NULL)));
 252
 253         u.info21.full_name.string = talloc_asprintf(join,
 254                                                     "Torture account for Samba4: %s",
 255                                                     timestring(join, time(NULL)));
 256
 257         u.info21.description.string = talloc_asprintf(join,
 258                                          "Samba4 torture account created by host %s: %s",
 259                                          lp_netbios_name(), timestring(join, time(NULL)));
 260
 261         printf("Resetting ACB flags, force pw change time\n");
 262
 263         status = dcerpc_samr_SetUserInfo(join->p, join, &s);
 264         if (!NT_STATUS_IS_OK(status)) {
 265                 printf("SetUserInfo failed - %s\n", nt_errstr(status));
 266                 goto failed;
 267         }
 268
 269         if (random_password) {
 270                 *random_password = random_pw;
 271         }
 272
 273         return join;
 274
 275 failed:
 276         torture_leave_domain(join);
 277         return NULL;
 278 }
 279
 280
 281 struct test_join *torture_join_domain(const char *machine_name,
 282                                       uint32_t acct_flags,
 283                                       struct cli_credentials **machine_credentials)
 284 {
 285         NTSTATUS status;
 286         struct libnet_context *libnet_ctx;
 287         struct libnet_JoinDomain *libnet_r;
 288         struct test_join *tj;
 289         struct samr_SetUserInfo s;
 290         union samr_UserInfo u;
 291
 292         tj = talloc(NULL, struct test_join);
 293         if (!tj) return NULL;
 294
 295         libnet_r = talloc(tj, struct libnet_JoinDomain);
 296         if (!libnet_r) {
 297                 talloc_free(tj);
 298                 return NULL;
 299         }
 300
 301         libnet_ctx = libnet_context_init(NULL);
 302         if (!libnet_ctx) {
 303                 talloc_free(tj);
 304                 return NULL;
 305         }
 306
 307         tj->libnet_r = libnet_r;
 308
 309         libnet_ctx->cred = cmdline_credentials;
 310         libnet_r->in.binding = lp_parm_string(-1, "torture", "binding");
 311         if (!libnet_r->in.binding) {
 312                 libnet_r->in.binding = talloc_asprintf(libnet_r, "ncacn_np:%s", lp_parm_string(-1, "torture", "host"));
 313         }
 314         libnet_r->in.level = LIBNET_JOINDOMAIN_SPECIFIED;
 315         libnet_r->in.netbios_name = machine_name;
 316         libnet_r->in.account_name = talloc_asprintf(libnet_r, "%s$", machine_name);
 317         if (!libnet_r->in.account_name) {
 318                 talloc_free(tj);
 319                 return NULL;
 320         }
 321
 322         libnet_r->in.acct_type = acct_flags;
 323         libnet_r->in.recreate_account = True;
 324
 325         status = libnet_JoinDomain(libnet_ctx, libnet_r, libnet_r);
 326         if (!NT_STATUS_IS_OK(status)) {
 327                 if (libnet_r->out.error_string) {
 328                         DEBUG(0, ("Domain join failed - %s.\n", libnet_r->out.error_string));
 329                 } else {
 330                         DEBUG(0, ("Domain join failed - %s.\n", nt_errstr(status)));
 331                 }
 332                 talloc_free(tj);
 333                 return NULL;
 334         }
 335         tj->p = libnet_r->out.samr_pipe;
 336         tj->user_handle = *libnet_r->out.user_handle;
 337         tj->dom_sid = libnet_r->out.domain_sid;
 338         talloc_steal(tj, libnet_r->out.domain_sid);
 339
 340         ZERO_STRUCT(u);
 341         s.in.user_handle = &tj->user_handle;
 342         s.in.info = &u;
 343         s.in.level = 21;
 344
 345         u.info21.fields_present = SAMR_FIELD_DESCRIPTION | SAMR_FIELD_COMMENT | SAMR_FIELD_FULL_NAME;
 346         u.info21.comment.string = talloc_asprintf(tj,
 347                                                   "Tortured by Samba4: %s",
 348                                                   timestring(tj, time(NULL)));
 349         u.info21.full_name.string = talloc_asprintf(tj,
 350                                                     "Torture account for Samba4: %s",
 351                                                     timestring(tj, time(NULL)));
 352
 353         u.info21.description.string = talloc_asprintf(tj,
 354                                                       "Samba4 torture account created by host %s: %s",
 355                                                       lp_netbios_name(), timestring(tj, time(NULL)));
 356
 357         status = dcerpc_samr_SetUserInfo(tj->p, tj, &s);
 358         if (!NT_STATUS_IS_OK(status)) {
 359                 printf("SetUserInfo (non-critical) failed - %s\n", nt_errstr(status));
 360         }
 361
 362         *machine_credentials = cli_credentials_init(tj);
 363         cli_credentials_set_conf(*machine_credentials);
 364         cli_credentials_set_workstation(*machine_credentials, machine_name, CRED_SPECIFIED);
 365         cli_credentials_set_domain(*machine_credentials, libnet_r->out.domain_name, CRED_SPECIFIED);
 366         if (libnet_r->out.realm) {
 367                 cli_credentials_set_realm(*machine_credentials, libnet_r->out.realm, CRED_SPECIFIED);
 368         }
 369         cli_credentials_set_username(*machine_credentials, libnet_r->in.account_name, CRED_SPECIFIED);
 370         cli_credentials_set_password(*machine_credentials, libnet_r->out.join_password, CRED_SPECIFIED);
 371         if (acct_flags & ACB_SVRTRUST) {
 372                 cli_credentials_set_secure_channel_type(*machine_credentials,
 373                                                         SEC_CHAN_BDC);
 374         } else if (acct_flags & ACB_WSTRUST) {
 375                 cli_credentials_set_secure_channel_type(*machine_credentials,
 376                                                         SEC_CHAN_WKSTA);
 377         } else {
 378                 DEBUG(0, ("Invalid account type specificed to torture_join_domain\n"));
 379                 talloc_free(*machine_credentials);
 380                 return NULL;
 381         }
 382
 383         return tj;
 384 }
 385
 386 struct dcerpc_pipe *torture_join_samr_pipe(struct test_join *join)
 387 {
 388         return join->p;
 389 }
 390
 391 struct policy_handle *torture_join_samr_user_policy(struct test_join *join)
 392 {
 393         return &join->user_handle;
 394 }
 395
 396 NTSTATUS torture_leave_ads_domain(TALLOC_CTX *mem_ctx, struct libnet_JoinDomain *libnet_r)
 397 {
 398         int rtn;
 399         TALLOC_CTX *tmp_ctx;
 400
 401         struct ldb_dn *server_dn;
 402         struct ldb_context *ldb_ctx;
 403
 404         char *remote_ldb_url;
 405
 406         /* Check if we are a domain controller. If not, exit. */
 407         if (!libnet_r->out.server_dn_str) {
 408                 return NT_STATUS_OK;
 409         }
 410
 411         tmp_ctx = talloc_named(mem_ctx, 0, "torture_leave temporary context");
 412         if (!tmp_ctx) {
 413                 libnet_r->out.error_string = NULL;
 414                 return NT_STATUS_NO_MEMORY;
 415         }
 416
 417         ldb_ctx = ldb_init(tmp_ctx);
 418         if (!ldb_ctx) {
 419                 libnet_r->out.error_string = NULL;
 420                 talloc_free(tmp_ctx);
 421                 return NT_STATUS_NO_MEMORY;
 422         }
 423
 424         /* Remove CN=Servers,... entry from the AD. */
 425         server_dn = ldb_dn_explode(tmp_ctx, libnet_r->out.server_dn_str);
 426         if (!server_dn) {
 427                 libnet_r->out.error_string = NULL;
 428                 talloc_free(tmp_ctx);
 429                 return NT_STATUS_NO_MEMORY;
 430         }
 431
 432         remote_ldb_url = talloc_asprintf(tmp_ctx, "ldap://%s", libnet_r->out.samr_binding->host);
 433         if (!remote_ldb_url) {
 434                 libnet_r->out.error_string = NULL;
 435                 talloc_free(tmp_ctx);
 436                 return NT_STATUS_NO_MEMORY;
 437         }
 438
 439         rtn = ldb_connect(ldb_ctx, remote_ldb_url, 0, NULL);
 440         if (rtn != 0) {
 441                 libnet_r->out.error_string = NULL;
 442                 talloc_free(tmp_ctx);
 443                 return NT_STATUS_UNSUCCESSFUL;
 444         }
 445
 446         rtn = ldb_delete(ldb_ctx, server_dn);
 447         if (rtn != 0) {
 448                 libnet_r->out.error_string = NULL;
 449                 talloc_free(tmp_ctx);
 450                 return NT_STATUS_UNSUCCESSFUL;
 451         }
 452
 453         DEBUG(0, ("%s removed successfully.\n", libnet_r->out.server_dn_str));
 454
 455         talloc_free(tmp_ctx);
 456         return NT_STATUS_OK;
 457 }
 458
 459 /*
 460   leave the domain, deleting the machine acct
 461 */
 462
 463 void torture_leave_domain(struct test_join *join)
 464 {
 465         struct samr_DeleteUser d;
 466         NTSTATUS status;
 467
 468         if (!join) {
 469                 return;
 470         }
 471         d.in.user_handle = &join->user_handle;
 472         d.out.user_handle = &join->user_handle;
 473
 474         /* Delete machine account */
 475         status = dcerpc_samr_DeleteUser(join->p, join, &d);
 476         if (!NT_STATUS_IS_OK(status)) {
 477                 printf("Delete of machine account failed\n");
 478         } else {
 479                 printf("Delete of machine account was successful.\n");
 480         }
 481
 482         if (join->libnet_r) {
 483                 status = torture_leave_ads_domain(join, join->libnet_r);
 484         }
 485
 486         talloc_free(join);
 487 }
 488
 489 /*
 490   return the dom sid for a test join
 491 */
 492 const struct dom_sid *torture_join_sid(struct test_join *join)
 493 {
 494         return join->dom_sid;
 495 }
 496
 497 const struct dom_sid *torture_join_user_sid(struct test_join *join)
 498 {
 499         return join->user_sid;
 500 }
 501
 502
 503 struct test_join_ads_dc {
 504         struct test_join *join;
 505 };
 506
 507 struct test_join_ads_dc *torture_join_domain_ads_dc(const char *machine_name,
 508                                                     const char *domain,
 509                                                     struct cli_credentials **machine_credentials)
 510 {
 511         struct test_join_ads_dc *join;
 512
 513         join = talloc(NULL, struct test_join_ads_dc);
 514         if (join == NULL) {
 515                 return NULL;
 516         }
 517
 518         join->join = torture_join_domain(machine_name,
 519                                         ACB_SVRTRUST,
 520                                         machine_credentials);
 521
 522         if (!join->join) {
 523                 return NULL;
 524         }
 525
 526         /* do netlogon DrsEnumerateDomainTrusts */
 527
 528         /* modify userAccountControl from 4096 to 532480 */
 529
 530         /* modify RDN to OU=Domain Controllers and skip the $ from server name */
 531
 532         /* ask objectVersion of Schema Partition */
 533
 534         /* ask rIDManagerReferenz of the Domain Partition */
 535
 536         /* ask fsMORoleOwner of the RID-Manager$ object
 537          * returns CN=NTDS Settings,CN=<DC>,CN=Servers,CN=Default-First-Site-Name, ...
 538          */
 539
 540         /* ask for dnsHostName of CN=<DC>,CN=Servers,CN=Default-First-Site-Name, ... */
 541
 542         /* ask for objectGUID of CN=NTDS Settings,CN=<DC>,CN=Servers,CN=Default-First-Site-Name, ... */
 543
 544         /* ask for * of CN=Default-First-Site-Name, ... */
 545
 546         /* search (&(|(objectClass=user)(objectClass=computer))(sAMAccountName=<machine_name>$)) in Domain Partition
 547          * attributes : distinguishedName, userAccountControl
 548          */
 549
 550         /* ask * for CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
 551          * should fail with noSuchObject
 552          */
 553
 554         /* add CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
 555          *
 556          * objectClass = server
 557          * systemFlags = 50000000
 558          * serverReferenz = CN=<machine_name>,OU=Domain Controllers,...
 559          */
 560
 561         /* ask for * of CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
 562          * should fail with noSuchObject
 563          */
 564
 565         /* search for (ncname=<domain_nc>) in CN=Partitions,CN=Configuration,...
 566          * attributes: ncName, dnsRoot
 567          */
 568
 569         /* modify add CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
 570          * serverReferenz = CN=<machine_name>,OU=Domain Controllers,...
 571          * should fail with attributeOrValueExists
 572          */
 573
 574         /* modify replace CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
 575          * serverReferenz = CN=<machine_name>,OU=Domain Controllers,...
 576          */
 577
 578         /* DsReplicaAdd to create the CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
 579          * needs to be tested
 580          */
 581
 582         return join;
 583 }
 584
 585 void torture_leave_domain_ads_dc(struct test_join_ads_dc *join)
 586 {
 587
 588         if (join->join) {
 589                 torture_leave_domain(join->join);
 590         }
 591
 592         talloc_free(join);
 593 }