2 Unix SMB/CIFS implementation.
4 test suite for netlogon PAC operations
6 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2012
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "auth/auth.h"
24 #include "auth/auth_sam_reply.h"
25 #include "auth/gensec/gensec.h"
26 #include "system/kerberos.h"
27 #include "auth/kerberos/kerberos.h"
28 #include "auth/credentials/credentials.h"
29 #include "auth/credentials/credentials_krb5.h"
30 #include "lib/cmdline/popt_common.h"
31 #include "torture/rpc/torture_rpc.h"
32 #include "libcli/auth/libcli_auth.h"
33 #include "libcli/security/security.h"
34 #include "librpc/gen_ndr/ndr_netlogon_c.h"
35 #include "librpc/gen_ndr/ndr_krb5pac.h"
36 #include "librpc/gen_ndr/ndr_samr_c.h"
37 #include "param/param.h"
39 #define TEST_MACHINE_NAME_BDC "torturepacbdc"
40 #define TEST_MACHINE_NAME_WKSTA "torturepacwksta"
41 #define TEST_MACHINE_NAME_WKSTA_DES "torturepacwkdes"
42 #define TEST_MACHINE_NAME_S2U4SELF_BDC "tests2u4selfbdc"
43 #define TEST_MACHINE_NAME_S2U4SELF_WKSTA "tests2u4selfwk"
46 struct PAC_SIGNATURE_DATA
*pac_srv_sig
;
47 struct PAC_SIGNATURE_DATA
*pac_kdc_sig
;
50 /* A helper function which avoids touching the local databases to
51 * generate the session info, as we just want to verify the PAC
52 * details, not the full local token */
53 static NTSTATUS
test_generate_session_info_pac(struct auth4_context
*auth_ctx
,
55 struct smb_krb5_context
*smb_krb5_context
,
57 const char *principal_name
,
58 const struct tsocket_address
*remote_address
,
59 uint32_t session_info_flags
,
60 struct auth_session_info
**session_info
)
63 struct auth_user_info_dc
*user_info_dc
;
65 struct pac_data
*pac_data
;
67 tmp_ctx
= talloc_named(mem_ctx
, 0, "gensec_gssapi_session_info context");
68 NT_STATUS_HAVE_NO_MEMORY(tmp_ctx
);
70 auth_ctx
->private_data
= pac_data
= talloc_zero(auth_ctx
, struct pac_data
);
72 pac_data
->pac_srv_sig
= talloc(tmp_ctx
, struct PAC_SIGNATURE_DATA
);
73 if (!pac_data
->pac_srv_sig
) {
75 return NT_STATUS_NO_MEMORY
;
77 pac_data
->pac_kdc_sig
= talloc(tmp_ctx
, struct PAC_SIGNATURE_DATA
);
78 if (!pac_data
->pac_kdc_sig
) {
80 return NT_STATUS_NO_MEMORY
;
83 nt_status
= kerberos_pac_blob_to_user_info_dc(tmp_ctx
,
85 smb_krb5_context
->krb5_context
,
87 pac_data
->pac_srv_sig
,
88 pac_data
->pac_kdc_sig
);
89 if (!NT_STATUS_IS_OK(nt_status
)) {
94 talloc_steal(pac_data
, pac_data
->pac_srv_sig
);
95 talloc_steal(pac_data
, pac_data
->pac_kdc_sig
);
97 if (user_info_dc
->info
->authenticated
) {
98 session_info_flags
|= AUTH_SESSION_INFO_AUTHENTICATED
;
101 session_info_flags
|= AUTH_SESSION_INFO_SIMPLE_PRIVILEGES
;
102 nt_status
= auth_generate_session_info(mem_ctx
,
105 user_info_dc
, session_info_flags
,
107 if (!NT_STATUS_IS_OK(nt_status
)) {
108 talloc_free(tmp_ctx
);
112 talloc_free(tmp_ctx
);
116 /* Check to see if we can pass the PAC across to the NETLOGON server for validation */
118 /* Also happens to be a really good one-step verfication of our Kerberos stack */
120 static bool test_PACVerify(struct torture_context
*tctx
,
121 struct dcerpc_pipe
*p
,
122 struct cli_credentials
*credentials
,
123 enum netr_SchannelType secure_channel_type
,
124 const char *test_machine_name
,
125 uint32_t negotiate_flags
)
129 struct netr_LogonSamLogon r
;
131 union netr_LogonLevel logon
;
132 union netr_Validation validation
;
133 uint8_t authoritative
;
134 struct netr_Authenticator return_authenticator
;
136 struct netr_GenericInfo generic
;
137 struct netr_Authenticator auth
, auth2
;
139 struct netlogon_creds_CredentialState
*creds
;
140 struct gensec_security
*gensec_client_context
;
141 struct gensec_security
*gensec_server_context
;
143 DATA_BLOB client_to_server
, server_to_client
, pac_wrapped
, payload
;
144 struct PAC_Validate pac_wrapped_struct
;
146 enum ndr_err_code ndr_err
;
148 struct auth4_context
*auth_context
;
149 struct auth_session_info
*session_info
;
150 struct pac_data
*pac_data
;
152 struct dcerpc_binding_handle
*b
= p
->binding_handle
;
153 TALLOC_CTX
*tmp_ctx
= talloc_new(tctx
);
154 torture_assert(tctx
, tmp_ctx
!= NULL
, "talloc_new() failed");
156 torture_comment(tctx
,
157 "Testing PAC Verify (secure_channel_type: %d, machine: %s, negotiate_flags: 0x%08x\n",
158 secure_channel_type
, test_machine_name
, negotiate_flags
);
160 if (!test_SetupCredentials2(p
, tctx
, negotiate_flags
,
161 credentials
, secure_channel_type
,
166 auth_context
= talloc_zero(tmp_ctx
, struct auth4_context
);
167 torture_assert(tctx
, auth_context
!= NULL
, "talloc_new() failed");
169 auth_context
->generate_session_info_pac
= test_generate_session_info_pac
;
171 status
= gensec_client_start(tctx
, &gensec_client_context
,
172 lpcfg_gensec_settings(tctx
, tctx
->lp_ctx
));
173 torture_assert_ntstatus_ok(tctx
, status
, "gensec_client_start (client) failed");
175 status
= gensec_set_target_hostname(gensec_client_context
, test_machine_name
);
177 status
= gensec_set_credentials(gensec_client_context
, cmdline_credentials
);
178 torture_assert_ntstatus_ok(tctx
, status
, "gensec_set_credentials (client) failed");
180 status
= gensec_start_mech_by_sasl_name(gensec_client_context
, "GSSAPI");
181 torture_assert_ntstatus_ok(tctx
, status
, "gensec_start_mech_by_sasl_name (client) failed");
183 status
= gensec_server_start(tctx
,
184 lpcfg_gensec_settings(tctx
, tctx
->lp_ctx
),
185 auth_context
, &gensec_server_context
);
186 torture_assert_ntstatus_ok(tctx
, status
, "gensec_server_start (server) failed");
188 status
= gensec_set_credentials(gensec_server_context
, credentials
);
189 torture_assert_ntstatus_ok(tctx
, status
, "gensec_set_credentials (server) failed");
191 status
= gensec_start_mech_by_sasl_name(gensec_server_context
, "GSSAPI");
192 torture_assert_ntstatus_ok(tctx
, status
, "gensec_start_mech_by_sasl_name (server) failed");
194 server_to_client
= data_blob(NULL
, 0);
197 /* Do a client-server update dance */
198 status
= gensec_update(gensec_client_context
, tmp_ctx
, tctx
->ev
, server_to_client
, &client_to_server
);
199 if (!NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {;
200 torture_assert_ntstatus_ok(tctx
, status
, "gensec_update (client) failed");
203 status
= gensec_update(gensec_server_context
, tmp_ctx
, tctx
->ev
, client_to_server
, &server_to_client
);
204 if (!NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {;
205 torture_assert_ntstatus_ok(tctx
, status
, "gensec_update (server) failed");
208 if (NT_STATUS_IS_OK(status
)) {
213 /* Extract the PAC using Samba's code */
215 status
= gensec_session_info(gensec_server_context
, gensec_server_context
, &session_info
);
216 torture_assert_ntstatus_ok(tctx
, status
, "gensec_session_info failed");
218 pac_data
= talloc_get_type(auth_context
->private_data
, struct pac_data
);
220 torture_assert(tctx
, pac_data
!= NULL
, "gensec_update failed to fill in pac_data in auth_context");
221 torture_assert(tctx
, pac_data
->pac_srv_sig
!= NULL
, "pac_srv_sig not present");
222 torture_assert(tctx
, pac_data
->pac_kdc_sig
!= NULL
, "pac_kdc_sig not present");
224 pac_wrapped_struct
.ChecksumLength
= pac_data
->pac_srv_sig
->signature
.length
;
225 pac_wrapped_struct
.SignatureType
= pac_data
->pac_kdc_sig
->type
;
226 pac_wrapped_struct
.SignatureLength
= pac_data
->pac_kdc_sig
->signature
.length
;
227 pac_wrapped_struct
.ChecksumAndSignature
= payload
228 = data_blob_talloc(tmp_ctx
, NULL
,
229 pac_wrapped_struct
.ChecksumLength
230 + pac_wrapped_struct
.SignatureLength
);
231 memcpy(&payload
.data
[0],
232 pac_data
->pac_srv_sig
->signature
.data
,
233 pac_wrapped_struct
.ChecksumLength
);
234 memcpy(&payload
.data
[pac_wrapped_struct
.ChecksumLength
],
235 pac_data
->pac_kdc_sig
->signature
.data
,
236 pac_wrapped_struct
.SignatureLength
);
238 ndr_err
= ndr_push_struct_blob(&pac_wrapped
, tmp_ctx
, &pac_wrapped_struct
,
239 (ndr_push_flags_fn_t
)ndr_push_PAC_Validate
);
240 torture_assert(tctx
, NDR_ERR_CODE_IS_SUCCESS(ndr_err
), "ndr_push_struct_blob of PACValidate structure failed");
242 torture_assert(tctx
, (creds
->negotiate_flags
& NETLOGON_NEG_ARCFOUR
), "not willing to even try a PACValidate without RC4 encryption");
243 if (creds
->negotiate_flags
& NETLOGON_NEG_SUPPORTS_AES
) {
244 netlogon_creds_aes_encrypt(creds
, pac_wrapped
.data
, pac_wrapped
.length
);
246 netlogon_creds_arcfour_crypt(creds
, pac_wrapped
.data
, pac_wrapped
.length
);
249 generic
.length
= pac_wrapped
.length
;
250 generic
.data
= pac_wrapped
.data
;
252 /* Validate it over the netlogon pipe */
254 generic
.identity_info
.parameter_control
= 0;
255 generic
.identity_info
.logon_id_high
= 0;
256 generic
.identity_info
.logon_id_low
= 0;
257 generic
.identity_info
.domain_name
.string
= session_info
->info
->domain_name
;
258 generic
.identity_info
.account_name
.string
= session_info
->info
->account_name
;
259 generic
.identity_info
.workstation
.string
= test_machine_name
;
261 generic
.package_name
.string
= "Kerberos";
263 logon
.generic
= &generic
;
266 netlogon_creds_client_authenticator(creds
, &auth
);
267 r
.in
.credential
= &auth
;
268 r
.in
.return_authenticator
= &auth2
;
270 r
.in
.logon_level
= NetlogonGenericInformation
;
271 r
.in
.server_name
= talloc_asprintf(tctx
, "\\\\%s", dcerpc_server_name(p
));
272 r
.in
.computer_name
= cli_credentials_get_workstation(credentials
);
273 r
.in
.validation_level
= NetlogonValidationGenericInfo2
;
274 r
.out
.validation
= &validation
;
275 r
.out
.authoritative
= &authoritative
;
276 r
.out
.return_authenticator
= &return_authenticator
;
278 torture_assert_ntstatus_ok(tctx
, dcerpc_netr_LogonSamLogon_r(b
, tctx
, &r
),
279 "LogonSamLogon failed");
281 torture_assert_ntstatus_ok(tctx
, r
.out
.result
, "LogonSamLogon failed");
283 /* This will break the signature nicely (even in the crypto wrapping), check we get a logon failure */
284 generic
.data
[generic
.length
-1]++;
286 logon
.generic
= &generic
;
289 netlogon_creds_client_authenticator(creds
, &auth
);
290 r
.in
.credential
= &auth
;
291 r
.in
.return_authenticator
= &auth2
;
292 r
.in
.logon_level
= NetlogonGenericInformation
;
294 r
.in
.server_name
= talloc_asprintf(tctx
, "\\\\%s", dcerpc_server_name(p
));
295 r
.in
.computer_name
= cli_credentials_get_workstation(credentials
);
296 r
.in
.validation_level
= NetlogonValidationGenericInfo2
;
298 torture_assert_ntstatus_ok(tctx
, dcerpc_netr_LogonSamLogon_r(b
, tctx
, &r
),
299 "LogonSamLogon failed");
301 torture_assert_ntstatus_equal(tctx
, r
.out
.result
, NT_STATUS_LOGON_FAILURE
, "LogonSamLogon failed");
303 torture_assert(tctx
, netlogon_creds_client_check(creds
, &r
.out
.return_authenticator
->cred
),
304 "Credential chaining failed");
306 /* This will break the parsing nicely (even in the crypto wrapping), check we get INVALID_PARAMETER */
309 logon
.generic
= &generic
;
312 netlogon_creds_client_authenticator(creds
, &auth
);
313 r
.in
.credential
= &auth
;
314 r
.in
.return_authenticator
= &auth2
;
315 r
.in
.logon_level
= NetlogonGenericInformation
;
317 r
.in
.server_name
= talloc_asprintf(tctx
, "\\\\%s", dcerpc_server_name(p
));
318 r
.in
.computer_name
= cli_credentials_get_workstation(credentials
);
319 r
.in
.validation_level
= NetlogonValidationGenericInfo2
;
321 torture_assert_ntstatus_ok(tctx
, dcerpc_netr_LogonSamLogon_r(b
, tctx
, &r
),
322 "LogonSamLogon failed");
324 torture_assert_ntstatus_equal(tctx
, r
.out
.result
, NT_STATUS_INVALID_PARAMETER
, "LogonSamLogon failed");
326 torture_assert(tctx
, netlogon_creds_client_check(creds
,
327 &r
.out
.return_authenticator
->cred
),
328 "Credential chaining failed");
330 pac_wrapped_struct
.ChecksumLength
= pac_data
->pac_srv_sig
->signature
.length
;
331 pac_wrapped_struct
.SignatureType
= pac_data
->pac_kdc_sig
->type
;
333 /* Break the SignatureType */
334 pac_wrapped_struct
.SignatureType
++;
336 pac_wrapped_struct
.SignatureLength
= pac_data
->pac_kdc_sig
->signature
.length
;
337 pac_wrapped_struct
.ChecksumAndSignature
= payload
338 = data_blob_talloc(tmp_ctx
, NULL
,
339 pac_wrapped_struct
.ChecksumLength
340 + pac_wrapped_struct
.SignatureLength
);
341 memcpy(&payload
.data
[0],
342 pac_data
->pac_srv_sig
->signature
.data
,
343 pac_wrapped_struct
.ChecksumLength
);
344 memcpy(&payload
.data
[pac_wrapped_struct
.ChecksumLength
],
345 pac_data
->pac_kdc_sig
->signature
.data
,
346 pac_wrapped_struct
.SignatureLength
);
348 ndr_err
= ndr_push_struct_blob(&pac_wrapped
, tmp_ctx
, &pac_wrapped_struct
,
349 (ndr_push_flags_fn_t
)ndr_push_PAC_Validate
);
350 torture_assert(tctx
, NDR_ERR_CODE_IS_SUCCESS(ndr_err
), "ndr_push_struct_blob of PACValidate structure failed");
352 torture_assert(tctx
, (creds
->negotiate_flags
& NETLOGON_NEG_ARCFOUR
), "not willing to even try a PACValidate without RC4 encryption");
353 if (creds
->negotiate_flags
& NETLOGON_NEG_SUPPORTS_AES
) {
354 netlogon_creds_aes_encrypt(creds
, pac_wrapped
.data
, pac_wrapped
.length
);
356 netlogon_creds_arcfour_crypt(creds
, pac_wrapped
.data
, pac_wrapped
.length
);
359 generic
.length
= pac_wrapped
.length
;
360 generic
.data
= pac_wrapped
.data
;
362 logon
.generic
= &generic
;
365 netlogon_creds_client_authenticator(creds
, &auth
);
366 r
.in
.credential
= &auth
;
367 r
.in
.return_authenticator
= &auth2
;
368 r
.in
.logon_level
= NetlogonGenericInformation
;
370 r
.in
.server_name
= talloc_asprintf(tctx
, "\\\\%s", dcerpc_server_name(p
));
371 r
.in
.computer_name
= cli_credentials_get_workstation(credentials
);
372 r
.in
.validation_level
= NetlogonValidationGenericInfo2
;
374 torture_assert_ntstatus_ok(tctx
, dcerpc_netr_LogonSamLogon_r(b
, tctx
, &r
),
375 "LogonSamLogon failed");
377 torture_assert_ntstatus_equal(tctx
, r
.out
.result
, NT_STATUS_LOGON_FAILURE
, "LogonSamLogon failed");
379 torture_assert(tctx
, netlogon_creds_client_check(creds
, &r
.out
.return_authenticator
->cred
),
380 "Credential chaining failed");
382 pac_wrapped_struct
.ChecksumLength
= pac_data
->pac_srv_sig
->signature
.length
;
383 pac_wrapped_struct
.SignatureType
= pac_data
->pac_kdc_sig
->type
;
384 pac_wrapped_struct
.SignatureLength
= pac_data
->pac_kdc_sig
->signature
.length
;
386 pac_wrapped_struct
.ChecksumAndSignature
= payload
387 = data_blob_talloc(tmp_ctx
, NULL
,
388 pac_wrapped_struct
.ChecksumLength
389 + pac_wrapped_struct
.SignatureLength
);
390 memcpy(&payload
.data
[0],
391 pac_data
->pac_srv_sig
->signature
.data
,
392 pac_wrapped_struct
.ChecksumLength
);
393 memcpy(&payload
.data
[pac_wrapped_struct
.ChecksumLength
],
394 pac_data
->pac_kdc_sig
->signature
.data
,
395 pac_wrapped_struct
.SignatureLength
);
397 /* Break the signature length */
398 pac_wrapped_struct
.SignatureLength
++;
400 ndr_err
= ndr_push_struct_blob(&pac_wrapped
, tmp_ctx
, &pac_wrapped_struct
,
401 (ndr_push_flags_fn_t
)ndr_push_PAC_Validate
);
402 torture_assert(tctx
, NDR_ERR_CODE_IS_SUCCESS(ndr_err
), "ndr_push_struct_blob of PACValidate structure failed");
404 torture_assert(tctx
, (creds
->negotiate_flags
& NETLOGON_NEG_ARCFOUR
), "not willing to even try a PACValidate without RC4 encryption");
405 if (creds
->negotiate_flags
& NETLOGON_NEG_SUPPORTS_AES
) {
406 netlogon_creds_aes_encrypt(creds
, pac_wrapped
.data
, pac_wrapped
.length
);
408 netlogon_creds_arcfour_crypt(creds
, pac_wrapped
.data
, pac_wrapped
.length
);
411 generic
.length
= pac_wrapped
.length
;
412 generic
.data
= pac_wrapped
.data
;
414 logon
.generic
= &generic
;
417 netlogon_creds_client_authenticator(creds
, &auth
);
418 r
.in
.credential
= &auth
;
419 r
.in
.return_authenticator
= &auth2
;
420 r
.in
.logon_level
= NetlogonGenericInformation
;
422 r
.in
.server_name
= talloc_asprintf(tctx
, "\\\\%s", dcerpc_server_name(p
));
423 r
.in
.computer_name
= cli_credentials_get_workstation(credentials
);
424 r
.in
.validation_level
= NetlogonValidationGenericInfo2
;
426 torture_assert_ntstatus_ok(tctx
, dcerpc_netr_LogonSamLogon_r(b
, tctx
, &r
),
427 "LogonSamLogon failed");
429 torture_assert_ntstatus_equal(tctx
, r
.out
.result
, NT_STATUS_INVALID_PARAMETER
, "LogonSamLogon failed");
431 torture_assert(tctx
, netlogon_creds_client_check(creds
, &r
.out
.return_authenticator
->cred
),
432 "Credential chaining failed");
437 static bool test_PACVerify_bdc_arcfour(struct torture_context
*tctx
,
438 struct dcerpc_pipe
*p
,
439 struct cli_credentials
*credentials
)
441 return test_PACVerify(tctx
, p
, credentials
, SEC_CHAN_BDC
,
442 TEST_MACHINE_NAME_BDC
,
443 NETLOGON_NEG_AUTH2_ADS_FLAGS
);
446 static bool test_PACVerify_bdc_aes(struct torture_context
*tctx
,
447 struct dcerpc_pipe
*p
,
448 struct cli_credentials
*credentials
)
450 return test_PACVerify(tctx
, p
, credentials
, SEC_CHAN_BDC
,
451 TEST_MACHINE_NAME_BDC
,
452 NETLOGON_NEG_AUTH2_ADS_FLAGS
| NETLOGON_NEG_SUPPORTS_AES
);
455 static bool test_PACVerify_workstation_arcfour(struct torture_context
*tctx
,
456 struct dcerpc_pipe
*p
,
457 struct cli_credentials
*credentials
)
459 return test_PACVerify(tctx
, p
, credentials
, SEC_CHAN_WKSTA
,
460 TEST_MACHINE_NAME_WKSTA
,
461 NETLOGON_NEG_AUTH2_ADS_FLAGS
);
464 static bool test_PACVerify_workstation_aes(struct torture_context
*tctx
,
465 struct dcerpc_pipe
*p
,
466 struct cli_credentials
*credentials
)
468 return test_PACVerify(tctx
, p
, credentials
, SEC_CHAN_WKSTA
,
469 TEST_MACHINE_NAME_WKSTA
,
470 NETLOGON_NEG_AUTH2_ADS_FLAGS
| NETLOGON_NEG_SUPPORTS_AES
);
473 static bool test_PACVerify_workstation_des(struct torture_context
*tctx
,
474 struct dcerpc_pipe
*p
, struct cli_credentials
*credentials
, struct test_join
*join_ctx
)
476 struct samr_SetUserInfo r
;
477 union samr_UserInfo user_info
;
478 struct dcerpc_pipe
*samr_pipe
= torture_join_samr_pipe(join_ctx
);
480 #ifdef AD_DC_BUILD_IS_ENABLED
481 struct smb_krb5_context
*smb_krb5_context
;
484 ret
= cli_credentials_get_krb5_context(cmdline_credentials
, tctx
->lp_ctx
, &smb_krb5_context
);
485 torture_assert_int_equal(tctx
, ret
, 0, "cli_credentials_get_krb5_context() failed");
487 if (krb5_config_get_bool_default(smb_krb5_context
->krb5_context
, NULL
, FALSE
,
489 "allow_weak_crypto", NULL
) == FALSE
) {
490 torture_skip(tctx
, "Cannot test DES without [libdefaults] allow_weak_crypto = yes");
493 torture_skip(tctx
, "Skipping DES test in non-AD DC build");
496 /* Mark this workstation with DES-only */
497 user_info
.info16
.acct_flags
= ACB_USE_DES_KEY_ONLY
| ACB_WSTRUST
;
498 r
.in
.user_handle
= torture_join_samr_user_policy(join_ctx
);
500 r
.in
.info
= &user_info
;
502 torture_assert_ntstatus_ok(tctx
, dcerpc_samr_SetUserInfo_r(samr_pipe
->binding_handle
, tctx
, &r
),
503 "failed to set DES info account flags");
504 torture_assert_ntstatus_ok(tctx
, r
.out
.result
,
505 "failed to set DES into account flags");
507 return test_PACVerify(tctx
, p
, credentials
, SEC_CHAN_WKSTA
,
508 TEST_MACHINE_NAME_WKSTA_DES
,
509 NETLOGON_NEG_AUTH2_ADS_FLAGS
);
513 /* Check various ways to get the PAC, in particular check the group membership and other details between the PAC from a normal kinit, S2U4Self and a SamLogon */
514 static bool test_S2U4Self(struct torture_context
*tctx
,
515 struct dcerpc_pipe
*p
,
516 struct cli_credentials
*credentials
,
517 enum netr_SchannelType secure_channel_type
,
518 const char *test_machine_name
,
519 uint32_t negotiate_flags
)
522 struct dcerpc_binding_handle
*b
= p
->binding_handle
;
524 struct netr_LogonSamLogon r
;
526 union netr_LogonLevel logon
;
527 union netr_Validation validation
;
528 uint8_t authoritative
;
530 struct netr_Authenticator auth
, auth2
;
532 DATA_BLOB client_to_server
, server_to_client
;
534 struct netlogon_creds_CredentialState
*creds
;
535 struct gensec_security
*gensec_client_context
;
536 struct gensec_security
*gensec_server_context
;
538 struct auth4_context
*auth_context
;
539 struct auth_session_info
*kinit_session_info
;
540 struct auth_session_info
*s2u4self_session_info
;
541 struct auth_user_info_dc
*netlogon_user_info_dc
;
543 struct netr_NetworkInfo ninfo
;
544 DATA_BLOB names_blob
, chal
, lm_resp
, nt_resp
;
546 int flags
= CLI_CRED_NTLMv2_AUTH
;
548 struct dom_sid
*builtin_domain
;
550 TALLOC_CTX
*tmp_ctx
= talloc_new(tctx
);
552 torture_assert(tctx
, tmp_ctx
!= NULL
, "talloc_new() failed");
554 torture_comment(tctx
,
555 "Testing S4U2SELF (secure_channel_type: %d, machine: %s, negotiate_flags: 0x%08x\n",
556 secure_channel_type
, test_machine_name
, negotiate_flags
);
558 auth_context
= talloc_zero(tmp_ctx
, struct auth4_context
);
559 torture_assert(tctx
, auth_context
!= NULL
, "talloc_new() failed");
561 auth_context
->generate_session_info_pac
= test_generate_session_info_pac
;
563 /* First, do a normal Kerberos connection */
565 status
= gensec_client_start(tctx
, &gensec_client_context
,
566 lpcfg_gensec_settings(tctx
, tctx
->lp_ctx
));
567 torture_assert_ntstatus_ok(tctx
, status
, "gensec_client_start (client) failed");
569 status
= gensec_set_target_hostname(gensec_client_context
, test_machine_name
);
571 status
= gensec_set_credentials(gensec_client_context
, cmdline_credentials
);
572 torture_assert_ntstatus_ok(tctx
, status
, "gensec_set_credentials (client) failed");
574 status
= gensec_start_mech_by_sasl_name(gensec_client_context
, "GSSAPI");
575 torture_assert_ntstatus_ok(tctx
, status
, "gensec_start_mech_by_sasl_name (client) failed");
577 status
= gensec_server_start(tctx
,
578 lpcfg_gensec_settings(tctx
, tctx
->lp_ctx
),
579 auth_context
, &gensec_server_context
);
580 torture_assert_ntstatus_ok(tctx
, status
, "gensec_server_start (server) failed");
582 status
= gensec_set_credentials(gensec_server_context
, credentials
);
583 torture_assert_ntstatus_ok(tctx
, status
, "gensec_set_credentials (server) failed");
585 status
= gensec_start_mech_by_sasl_name(gensec_server_context
, "GSSAPI");
586 torture_assert_ntstatus_ok(tctx
, status
, "gensec_start_mech_by_sasl_name (server) failed");
588 server_to_client
= data_blob(NULL
, 0);
591 /* Do a client-server update dance */
592 status
= gensec_update(gensec_client_context
, tmp_ctx
, tctx
->ev
, server_to_client
, &client_to_server
);
593 if (!NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {;
594 torture_assert_ntstatus_ok(tctx
, status
, "gensec_update (client) failed");
597 status
= gensec_update(gensec_server_context
, tmp_ctx
, tctx
->ev
, client_to_server
, &server_to_client
);
598 if (!NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {;
599 torture_assert_ntstatus_ok(tctx
, status
, "gensec_update (server) failed");
602 if (NT_STATUS_IS_OK(status
)) {
607 /* Extract the PAC using Samba's code */
609 status
= gensec_session_info(gensec_server_context
, gensec_server_context
, &kinit_session_info
);
610 torture_assert_ntstatus_ok(tctx
, status
, "gensec_session_info failed");
613 /* Now do the dance with S2U4Self */
615 /* Wipe out any existing ccache */
616 cli_credentials_invalidate_ccache(credentials
, CRED_SPECIFIED
);
617 cli_credentials_set_impersonate_principal(credentials
,
618 cli_credentials_get_principal(cmdline_credentials
, tmp_ctx
),
619 talloc_asprintf(tmp_ctx
, "host/%s", test_machine_name
));
621 status
= gensec_client_start(tctx
, &gensec_client_context
,
622 lpcfg_gensec_settings(tctx
, tctx
->lp_ctx
));
623 torture_assert_ntstatus_ok(tctx
, status
, "gensec_client_start (client) failed");
625 status
= gensec_set_target_hostname(gensec_client_context
, test_machine_name
);
627 /* We now set the same credentials on both client and server contexts */
628 status
= gensec_set_credentials(gensec_client_context
, credentials
);
629 torture_assert_ntstatus_ok(tctx
, status
, "gensec_set_credentials (client) failed");
631 status
= gensec_start_mech_by_sasl_name(gensec_client_context
, "GSSAPI");
632 torture_assert_ntstatus_ok(tctx
, status
, "gensec_start_mech_by_sasl_name (client) failed");
634 status
= gensec_server_start(tctx
,
635 lpcfg_gensec_settings(tctx
, tctx
->lp_ctx
),
636 auth_context
, &gensec_server_context
);
637 torture_assert_ntstatus_ok(tctx
, status
, "gensec_server_start (server) failed");
639 status
= gensec_set_credentials(gensec_server_context
, credentials
);
640 torture_assert_ntstatus_ok(tctx
, status
, "gensec_set_credentials (server) failed");
642 status
= gensec_start_mech_by_sasl_name(gensec_server_context
, "GSSAPI");
643 torture_assert_ntstatus_ok(tctx
, status
, "gensec_start_mech_by_sasl_name (server) failed");
645 server_to_client
= data_blob(NULL
, 0);
648 /* Do a client-server update dance */
649 status
= gensec_update(gensec_client_context
, tmp_ctx
, tctx
->ev
, server_to_client
, &client_to_server
);
650 if (!NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {;
651 torture_assert_ntstatus_ok(tctx
, status
, "gensec_update (client) failed");
654 status
= gensec_update(gensec_server_context
, tmp_ctx
, tctx
->ev
, client_to_server
, &server_to_client
);
655 if (!NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {;
656 torture_assert_ntstatus_ok(tctx
, status
, "gensec_update (server) failed");
659 if (NT_STATUS_IS_OK(status
)) {
664 /* Don't pollute the remaining tests with the changed credentials */
665 cli_credentials_invalidate_ccache(credentials
, CRED_SPECIFIED
);
666 cli_credentials_set_target_service(credentials
, NULL
);
667 cli_credentials_set_impersonate_principal(credentials
, NULL
, NULL
);
669 /* Extract the PAC using Samba's code */
671 status
= gensec_session_info(gensec_server_context
, gensec_server_context
, &s2u4self_session_info
);
672 torture_assert_ntstatus_ok(tctx
, status
, "gensec_session_info failed");
674 cli_credentials_get_ntlm_username_domain(cmdline_credentials
, tctx
,
675 &ninfo
.identity_info
.account_name
.string
,
676 &ninfo
.identity_info
.domain_name
.string
);
678 /* Now try with SamLogon */
679 generate_random_buffer(ninfo
.challenge
,
680 sizeof(ninfo
.challenge
));
681 chal
= data_blob_const(ninfo
.challenge
,
682 sizeof(ninfo
.challenge
));
684 names_blob
= NTLMv2_generate_names_blob(tctx
, cli_credentials_get_workstation(credentials
),
685 cli_credentials_get_domain(credentials
));
687 status
= cli_credentials_get_ntlm_response(cmdline_credentials
, tctx
,
693 torture_assert_ntstatus_ok(tctx
, status
, "cli_credentials_get_ntlm_response failed");
695 ninfo
.lm
.data
= lm_resp
.data
;
696 ninfo
.lm
.length
= lm_resp
.length
;
698 ninfo
.nt
.data
= nt_resp
.data
;
699 ninfo
.nt
.length
= nt_resp
.length
;
701 ninfo
.identity_info
.parameter_control
= 0;
702 ninfo
.identity_info
.logon_id_low
= 0;
703 ninfo
.identity_info
.logon_id_high
= 0;
704 ninfo
.identity_info
.workstation
.string
= cli_credentials_get_workstation(credentials
);
706 logon
.network
= &ninfo
;
708 r
.in
.server_name
= talloc_asprintf(tctx
, "\\\\%s", dcerpc_server_name(p
));
709 r
.in
.computer_name
= cli_credentials_get_workstation(credentials
);
710 r
.in
.credential
= &auth
;
711 r
.in
.return_authenticator
= &auth2
;
712 r
.in
.logon_level
= NetlogonNetworkInformation
;
714 r
.out
.validation
= &validation
;
715 r
.out
.authoritative
= &authoritative
;
717 if (!test_SetupCredentials2(p
, tctx
, negotiate_flags
,
718 credentials
, secure_channel_type
,
724 netlogon_creds_client_authenticator(creds
, &auth
);
726 r
.in
.validation_level
= 3;
728 status
= dcerpc_netr_LogonSamLogon_r(b
, tctx
, &r
);
729 torture_assert_ntstatus_ok(tctx
, status
, "LogonSamLogon failed");
731 torture_assert(tctx
, netlogon_creds_client_check(creds
,
732 &r
.out
.return_authenticator
->cred
),
733 "Credential chaining failed");
735 status
= make_user_info_dc_netlogon_validation(tmp_ctx
,
736 ninfo
.identity_info
.account_name
.string
,
737 r
.in
.validation_level
,
739 true, /* This user was authenticated */
740 &netlogon_user_info_dc
);
742 torture_assert_ntstatus_ok(tctx
, status
, "make_user_info_dc_netlogon_validation failed");
744 torture_assert_str_equal(tctx
, netlogon_user_info_dc
->info
->account_name
== NULL
? "" : netlogon_user_info_dc
->info
->account_name
,
745 kinit_session_info
->info
->account_name
, "Account name differs for kinit-based PAC");
746 torture_assert_str_equal(tctx
,netlogon_user_info_dc
->info
->account_name
== NULL
? "" : netlogon_user_info_dc
->info
->account_name
,
747 s2u4self_session_info
->info
->account_name
, "Account name differs for S2U4Self");
748 torture_assert_str_equal(tctx
, netlogon_user_info_dc
->info
->full_name
== NULL
? "" : netlogon_user_info_dc
->info
->full_name
, kinit_session_info
->info
->full_name
, "Full name differs for kinit-based PAC");
749 torture_assert_str_equal(tctx
, netlogon_user_info_dc
->info
->full_name
== NULL
? "" : netlogon_user_info_dc
->info
->full_name
, s2u4self_session_info
->info
->full_name
, "Full name differs for S2U4Self");
750 torture_assert_int_equal(tctx
, netlogon_user_info_dc
->num_sids
, kinit_session_info
->torture
->num_dc_sids
, "Different numbers of domain groups for kinit-based PAC");
751 torture_assert_int_equal(tctx
, netlogon_user_info_dc
->num_sids
, s2u4self_session_info
->torture
->num_dc_sids
, "Different numbers of domain groups for S2U4Self");
753 builtin_domain
= dom_sid_parse_talloc(tmp_ctx
, SID_BUILTIN
);
755 for (i
= 0; i
< kinit_session_info
->torture
->num_dc_sids
; i
++) {
756 torture_assert(tctx
, dom_sid_equal(&netlogon_user_info_dc
->sids
[i
], &kinit_session_info
->torture
->dc_sids
[i
]), "Different domain groups for kinit-based PAC");
757 torture_assert(tctx
, dom_sid_equal(&netlogon_user_info_dc
->sids
[i
], &s2u4self_session_info
->torture
->dc_sids
[i
]), "Different domain groups for S2U4Self");
758 torture_assert(tctx
, !dom_sid_in_domain(builtin_domain
, &s2u4self_session_info
->torture
->dc_sids
[i
]), "Returned BUILTIN domain in groups for S2U4Self");
759 torture_assert(tctx
, !dom_sid_in_domain(builtin_domain
, &kinit_session_info
->torture
->dc_sids
[i
]), "Returned BUILTIN domain in groups kinit-based PAC");
760 torture_assert(tctx
, !dom_sid_in_domain(builtin_domain
, &netlogon_user_info_dc
->sids
[i
]), "Returned BUILTIN domian in groups from NETLOGON SamLogon reply");
766 static bool test_S2U4Self_bdc_arcfour(struct torture_context
*tctx
,
767 struct dcerpc_pipe
*p
,
768 struct cli_credentials
*credentials
)
770 return test_S2U4Self(tctx
, p
, credentials
, SEC_CHAN_BDC
,
771 TEST_MACHINE_NAME_S2U4SELF_BDC
,
772 NETLOGON_NEG_AUTH2_ADS_FLAGS
);
775 static bool test_S2U4Self_bdc_aes(struct torture_context
*tctx
,
776 struct dcerpc_pipe
*p
,
777 struct cli_credentials
*credentials
)
779 return test_S2U4Self(tctx
, p
, credentials
, SEC_CHAN_BDC
,
780 TEST_MACHINE_NAME_S2U4SELF_BDC
,
781 NETLOGON_NEG_AUTH2_ADS_FLAGS
| NETLOGON_NEG_SUPPORTS_AES
);
784 static bool test_S2U4Self_workstation_arcfour(struct torture_context
*tctx
,
785 struct dcerpc_pipe
*p
,
786 struct cli_credentials
*credentials
)
788 return test_S2U4Self(tctx
, p
, credentials
, SEC_CHAN_WKSTA
,
789 TEST_MACHINE_NAME_S2U4SELF_WKSTA
,
790 NETLOGON_NEG_AUTH2_ADS_FLAGS
);
793 static bool test_S2U4Self_workstation_aes(struct torture_context
*tctx
,
794 struct dcerpc_pipe
*p
,
795 struct cli_credentials
*credentials
)
797 return test_S2U4Self(tctx
, p
, credentials
, SEC_CHAN_WKSTA
,
798 TEST_MACHINE_NAME_S2U4SELF_WKSTA
,
799 NETLOGON_NEG_AUTH2_ADS_FLAGS
| NETLOGON_NEG_SUPPORTS_AES
);
802 struct torture_suite
*torture_rpc_remote_pac(TALLOC_CTX
*mem_ctx
)
804 struct torture_suite
*suite
= torture_suite_create(mem_ctx
, "pac");
805 struct torture_rpc_tcase
*tcase
;
807 /* It is important to use different names, so that old entries in our credential cache are not used */
808 tcase
= torture_suite_add_machine_bdc_rpc_iface_tcase(suite
, "netr-bdc-arcfour",
809 &ndr_table_netlogon
, TEST_MACHINE_NAME_BDC
);
810 torture_rpc_tcase_add_test_creds(tcase
, "verify-sig-arcfour", test_PACVerify_bdc_arcfour
);
812 tcase
= torture_suite_add_machine_bdc_rpc_iface_tcase(suite
, "netr-bdc-aes",
813 &ndr_table_netlogon
, TEST_MACHINE_NAME_BDC
);
814 torture_rpc_tcase_add_test_creds(tcase
, "verify-sig-aes", test_PACVerify_bdc_aes
);
816 tcase
= torture_suite_add_machine_workstation_rpc_iface_tcase(suite
, "netr-mem-arcfour",
817 &ndr_table_netlogon
, TEST_MACHINE_NAME_WKSTA
);
818 torture_rpc_tcase_add_test_creds(tcase
, "verify-sig-arcfour", test_PACVerify_workstation_arcfour
);
820 tcase
= torture_suite_add_machine_workstation_rpc_iface_tcase(suite
, "netr-mem-aes",
821 &ndr_table_netlogon
, TEST_MACHINE_NAME_WKSTA
);
822 torture_rpc_tcase_add_test_creds(tcase
, "verify-sig-aes", test_PACVerify_workstation_aes
);
824 tcase
= torture_suite_add_machine_workstation_rpc_iface_tcase(suite
, "netlogon-member-des",
825 &ndr_table_netlogon
, TEST_MACHINE_NAME_WKSTA_DES
);
826 torture_rpc_tcase_add_test_join(tcase
, "verify-sig", test_PACVerify_workstation_des
);
828 tcase
= torture_suite_add_machine_bdc_rpc_iface_tcase(suite
, "netr-bdc-arcfour",
829 &ndr_table_netlogon
, TEST_MACHINE_NAME_S2U4SELF_BDC
);
830 torture_rpc_tcase_add_test_creds(tcase
, "s2u4self-arcfour", test_S2U4Self_bdc_arcfour
);
832 tcase
= torture_suite_add_machine_bdc_rpc_iface_tcase(suite
, "netr-bcd-aes",
833 &ndr_table_netlogon
, TEST_MACHINE_NAME_S2U4SELF_BDC
);
834 torture_rpc_tcase_add_test_creds(tcase
, "s2u4self-aes", test_S2U4Self_bdc_aes
);
836 tcase
= torture_suite_add_machine_workstation_rpc_iface_tcase(suite
, "netr-mem-arcfour",
837 &ndr_table_netlogon
, TEST_MACHINE_NAME_S2U4SELF_WKSTA
);
838 torture_rpc_tcase_add_test_creds(tcase
, "s2u4self-arcfour", test_S2U4Self_workstation_arcfour
);
840 tcase
= torture_suite_add_machine_workstation_rpc_iface_tcase(suite
, "netr-mem-aes",
841 &ndr_table_netlogon
, TEST_MACHINE_NAME_S2U4SELF_WKSTA
);
842 torture_rpc_tcase_add_test_creds(tcase
, "s2u4self-aes", test_S2U4Self_workstation_aes
);