source4/torture/krb5/kdc.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Validate the krb5 pac generation routines
   5
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2015
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include "system/kerberos.h"
  25 #include "torture/smbtorture.h"
  26 #include "torture/winbind/proto.h"
  27 #include "torture/krb5/proto.h"
  28 #include "auth/credentials/credentials.h"
  29 #include "lib/cmdline/popt_common.h"
  30 #include "source4/auth/kerberos/kerberos.h"
  31 #include "source4/auth/kerberos/kerberos_util.h"
  32 #include "lib/util/util_net.h"
  33
  34 enum torture_krb5_test {
  35         TORTURE_KRB5_TEST_PLAIN,
  36         TORTURE_KRB5_TEST_WIN2K,
  37         TORTURE_KRB5_TEST_PAC_REQUEST,
  38         TORTURE_KRB5_TEST_BREAK_PW,
  39         TORTURE_KRB5_TEST_CLOCK_SKEW,
  40 };
  41
  42 struct torture_krb5_context {
  43         struct torture_context *tctx;
  44         struct addrinfo *server;
  45         enum torture_krb5_test test;
  46         int packet_count;
  47         AS_REQ as_req;
  48         AS_REP as_rep;
  49 };
  50
  51 static bool torture_krb5_pre_send_test(struct torture_krb5_context *test_context, const krb5_data *send_buf)
  52 {
  53         size_t used;
  54         switch (test_context->test)
  55         {
  56         case TORTURE_KRB5_TEST_PLAIN:
  57         case TORTURE_KRB5_TEST_WIN2K:
  58         case TORTURE_KRB5_TEST_PAC_REQUEST:
  59         case TORTURE_KRB5_TEST_BREAK_PW:
  60         case TORTURE_KRB5_TEST_CLOCK_SKEW:
  61                 torture_assert_int_equal(test_context->tctx,
  62                                          decode_AS_REQ(send_buf->data, send_buf->length, &test_context->as_req, &used), 0,
  63                                          "decode_AS_REQ failed");
  64                 torture_assert_int_equal(test_context->tctx, used, send_buf->length, "length mismatch");
  65                 torture_assert_int_equal(test_context->tctx, test_context->as_req.pvno, 5, "Got wrong as_req->pvno");
  66                 break;
  67         }
  68         return true;
  69 }
  70
  71 static bool torture_krb5_post_recv_test(struct torture_krb5_context *test_context, const krb5_data *recv_buf)
  72 {
  73         KRB_ERROR error;
  74         size_t used;
  75         switch (test_context->test)
  76         {
  77         case TORTURE_KRB5_TEST_PLAIN:
  78         case TORTURE_KRB5_TEST_WIN2K:
  79                 if (test_context->packet_count == 0) {
  80                         torture_assert_int_equal(test_context->tctx,
  81                                                  decode_KRB_ERROR(recv_buf->data, recv_buf->length, &error, &used), 0,
  82                                                  "decode_AS_REP failed");
  83                         torture_assert_int_equal(test_context->tctx, used, recv_buf->length, "length mismatch");
  84                         torture_assert_int_equal(test_context->tctx, error.pvno, 5, "Got wrong error.pvno");
  85                         torture_assert_int_equal(test_context->tctx, error.error_code, KRB5KDC_ERR_PREAUTH_REQUIRED - KRB5KDC_ERR_NONE,
  86                                                  "Got wrong error.error_code");
  87                         free_KRB_ERROR(&error);
  88                 } else if ((decode_KRB_ERROR(recv_buf->data, recv_buf->length, &error, &used) == 0)
  89                            && (test_context->packet_count == 1)) {
  90                         torture_assert_int_equal(test_context->tctx, used, recv_buf->length, "length mismatch");
  91                         torture_assert_int_equal(test_context->tctx, error.pvno, 5, "Got wrong error.pvno");
  92                         torture_assert_int_equal(test_context->tctx, error.error_code, KRB5KRB_ERR_RESPONSE_TOO_BIG - KRB5KDC_ERR_NONE,
  93                                                  "Got wrong error.error_code");
  94                         free_KRB_ERROR(&error);
  95                 } else {
  96                         torture_assert_int_equal(test_context->tctx,
  97                                                  decode_AS_REP(recv_buf->data, recv_buf->length, &test_context->as_rep, &used), 0,
  98                                                  "decode_AS_REP failed");
  99                         torture_assert_int_equal(test_context->tctx, used, recv_buf->length, "length mismatch");
 100                         torture_assert_int_equal(test_context->tctx,
 101                                                  test_context->as_rep.pvno, 5,
 102                                                  "Got wrong as_rep->pvno");
 103                         torture_assert_int_equal(test_context->tctx,
 104                                                  test_context->as_rep.ticket.tkt_vno, 5,
 105                                                  "Got wrong as_rep->ticket.tkt_vno");
 106                         torture_assert(test_context->tctx,
 107                                        test_context->as_rep.ticket.enc_part.kvno,
 108                                        "Did not get a KVNO in test_context->as_rep.ticket.enc_part.kvno");
 109                         if (torture_setting_bool(test_context->tctx, "expect_rodc", false)) {
 110                                 torture_assert_int_not_equal(test_context->tctx,
 111                                                              *test_context->as_rep.ticket.enc_part.kvno & 0xFFFF0000,
 112                                                              0, "Did not get a RODC number in the KVNO");
 113                         } else {
 114                                 torture_assert_int_equal(test_context->tctx,
 115                                                          *test_context->as_rep.ticket.enc_part.kvno & 0xFFFF0000,
 116                                                          0, "Unexpecedly got a RODC number in the KVNO");
 117                         }
 118                         free_AS_REP(&test_context->as_rep);
 119                 }
 120                 torture_assert(test_context->tctx, test_context->packet_count < 3, "too many packets");
 121                 free_AS_REQ(&test_context->as_req);
 122                 break;
 123         case TORTURE_KRB5_TEST_PAC_REQUEST:
 124                 if (test_context->packet_count == 0) {
 125                         torture_assert_int_equal(test_context->tctx,
 126                                                  decode_KRB_ERROR(recv_buf->data, recv_buf->length, &error, &used), 0,
 127                                                  "decode_AS_REP failed");
 128                         torture_assert_int_equal(test_context->tctx, used, recv_buf->length, "length mismatch");
 129                         torture_assert_int_equal(test_context->tctx, error.pvno, 5, "Got wrong error.pvno");
 130                         torture_assert_int_equal(test_context->tctx, error.error_code, KRB5KRB_ERR_RESPONSE_TOO_BIG - KRB5KDC_ERR_NONE,
 131                                                  "Got wrong error.error_code");
 132                         free_KRB_ERROR(&error);
 133                 } else if (test_context->packet_count == 1) {
 134                         torture_assert_int_equal(test_context->tctx,
 135                                                  decode_KRB_ERROR(recv_buf->data, recv_buf->length, &error, &used), 0,
 136                                                  "decode_AS_REP failed");
 137                         torture_assert_int_equal(test_context->tctx, used, recv_buf->length, "length mismatch");
 138                         torture_assert_int_equal(test_context->tctx, error.pvno, 5, "Got wrong error.pvno");
 139                         torture_assert_int_equal(test_context->tctx, error.error_code, KRB5KDC_ERR_PREAUTH_REQUIRED - KRB5KDC_ERR_NONE,
 140                                                  "Got wrong error.error_code");
 141                         free_KRB_ERROR(&error);
 142                 } else if ((decode_KRB_ERROR(recv_buf->data, recv_buf->length, &error, &used) == 0)
 143                            && (test_context->packet_count == 2)) {
 144                         torture_assert_int_equal(test_context->tctx, used, recv_buf->length, "length mismatch");
 145                         torture_assert_int_equal(test_context->tctx, error.pvno, 5, "Got wrong error.pvno");
 146                         torture_assert_int_equal(test_context->tctx, error.error_code, KRB5KRB_ERR_RESPONSE_TOO_BIG - KRB5KDC_ERR_NONE,
 147                                                  "Got wrong error.error_code");
 148                         free_KRB_ERROR(&error);
 149                 } else {
 150                         torture_assert_int_equal(test_context->tctx,
 151                                                  decode_AS_REP(recv_buf->data, recv_buf->length, &test_context->as_rep, &used), 0,
 152                                                  "decode_AS_REP failed");
 153                         torture_assert_int_equal(test_context->tctx, used, recv_buf->length, "length mismatch");
 154                         torture_assert_int_equal(test_context->tctx, test_context->as_rep.pvno, 5, "Got wrong as_rep->pvno");
 155                         free_AS_REP(&test_context->as_rep);
 156                 }
 157                 torture_assert(test_context->tctx, test_context->packet_count < 3, "too many packets");
 158                 free_AS_REQ(&test_context->as_req);
 159                 break;
 160         case TORTURE_KRB5_TEST_BREAK_PW:
 161                 if (test_context->packet_count == 0) {
 162                         torture_assert_int_equal(test_context->tctx,
 163                                                  decode_KRB_ERROR(recv_buf->data, recv_buf->length, &error, &used), 0,
 164                                                  "decode_AS_REP failed");
 165                         torture_assert_int_equal(test_context->tctx, used, recv_buf->length, "length mismatch");
 166                         torture_assert_int_equal(test_context->tctx, error.pvno, 5, "Got wrong error.pvno");
 167                         torture_assert_int_equal(test_context->tctx, error.error_code, KRB5KDC_ERR_PREAUTH_REQUIRED - KRB5KDC_ERR_NONE,
 168                                                  "Got wrong error.error_code");
 169                         free_KRB_ERROR(&error);
 170                 } else if (test_context->packet_count == 1) {
 171                         torture_assert_int_equal(test_context->tctx,
 172                                                  decode_KRB_ERROR(recv_buf->data, recv_buf->length, &error, &used), 0,
 173                                                  "decode_AS_REP failed");
 174                         torture_assert_int_equal(test_context->tctx, used, recv_buf->length, "length mismatch");
 175                         torture_assert_int_equal(test_context->tctx, error.pvno, 5, "Got wrong error.pvno");
 176                         torture_assert_int_equal(test_context->tctx, error.error_code, KRB5KDC_ERR_PREAUTH_FAILED - KRB5KDC_ERR_NONE,
 177                                                  "Got wrong error.error_code");
 178                         free_KRB_ERROR(&error);
 179                 }
 180                 torture_assert(test_context->tctx, test_context->packet_count < 2, "too many packets");
 181                 free_AS_REQ(&test_context->as_req);
 182                 break;
 183         case TORTURE_KRB5_TEST_CLOCK_SKEW:
 184                 if (test_context->packet_count == 0) {
 185                         torture_assert_int_equal(test_context->tctx,
 186                                                  decode_KRB_ERROR(recv_buf->data, recv_buf->length, &error, &used), 0,
 187                                                  "decode_AS_REP failed");
 188                         torture_assert_int_equal(test_context->tctx, used, recv_buf->length, "length mismatch");
 189                         torture_assert_int_equal(test_context->tctx, error.pvno, 5, "Got wrong error.pvno");
 190                         torture_assert_int_equal(test_context->tctx, error.error_code, KRB5KDC_ERR_PREAUTH_REQUIRED - KRB5KDC_ERR_NONE,
 191                                                  "Got wrong error.error_code");
 192                         free_KRB_ERROR(&error);
 193                 } else if (test_context->packet_count == 1) {
 194                         torture_assert_int_equal(test_context->tctx,
 195                                                  decode_KRB_ERROR(recv_buf->data, recv_buf->length, &error, &used), 0,
 196                                                  "decode_AS_REP failed");
 197                         torture_assert_int_equal(test_context->tctx, used, recv_buf->length, "length mismatch");
 198                         torture_assert_int_equal(test_context->tctx, error.pvno, 5, "Got wrong error.pvno");
 199                         torture_assert_int_equal(test_context->tctx, error.error_code, KRB5KRB_AP_ERR_SKEW - KRB5KDC_ERR_NONE,
 200                                                  "Got wrong error.error_code");
 201                         free_KRB_ERROR(&error);
 202                 }
 203                 torture_assert(test_context->tctx, test_context->packet_count < 2, "too many packets");
 204                 free_AS_REQ(&test_context->as_req);
 205                 break;
 206         }
 207         return true;
 208 }
 209
 210 static krb5_error_code smb_krb5_send_and_recv_func_override(krb5_context context,
 211                                                     void *data, /* struct torture_krb5_context */
 212                                                     krb5_krbhst_info *hi,
 213                                                     time_t timeout,
 214                                                     const krb5_data *send_buf,
 215                                                     krb5_data *recv_buf)
 216 {
 217         krb5_error_code k5ret;
 218         bool ok;
 219
 220         struct torture_krb5_context *test_context
 221                 = talloc_get_type_abort(data, struct torture_krb5_context);
 222
 223         ok = torture_krb5_pre_send_test(test_context, send_buf);
 224         if (ok == false) {
 225                 return EINVAL;
 226         }
 227
 228         k5ret = smb_krb5_send_and_recv_func_forced(context, test_context->server,
 229                                                     hi, timeout, send_buf, recv_buf);
 230
 231         ok = torture_krb5_post_recv_test(test_context, recv_buf);
 232         if (ok == false) {
 233                 return EINVAL;
 234         }
 235
 236         test_context->packet_count++;
 237
 238         return k5ret;
 239 }
 240
 241 static int test_context_destructor(struct torture_krb5_context *test_context)
 242 {
 243         freeaddrinfo(test_context->server);
 244         return 0;
 245 }
 246
 247
 248 static bool torture_krb5_init_context(struct torture_context *tctx,
 249                                       enum torture_krb5_test test,
 250                                       struct smb_krb5_context **smb_krb5_context)
 251 {
 252         const char *host = torture_setting_string(tctx, "host", NULL);
 253         krb5_error_code k5ret;
 254         bool ok;
 255
 256         struct torture_krb5_context *test_context = talloc_zero(tctx, struct torture_krb5_context);
 257         torture_assert(tctx, test_context != NULL, "Failed to allocate");
 258
 259         test_context->test = test;
 260         test_context->tctx = tctx;
 261
 262         k5ret = smb_krb5_init_context(tctx, tctx->lp_ctx, smb_krb5_context);
 263         torture_assert_int_equal(tctx, k5ret, 0, "smb_krb5_init_context failed");
 264
 265         ok = interpret_string_addr_internal(&test_context->server, host, AI_NUMERICHOST);
 266         torture_assert(tctx, ok, "Failed to parse target server");
 267
 268         talloc_set_destructor(test_context, test_context_destructor);
 269
 270         set_sockaddr_port(test_context->server->ai_addr, 88);
 271
 272         k5ret = krb5_set_send_to_kdc_func((*smb_krb5_context)->krb5_context,
 273                                           smb_krb5_send_and_recv_func_override,
 274                                           test_context);
 275         torture_assert_int_equal(tctx, k5ret, 0, "krb5_set_send_to_kdc_func failed");
 276         return true;
 277 }
 278
 279 static bool torture_krb5_as_req_creds(struct torture_context *tctx,
 280                                       struct cli_credentials *credentials,
 281                                       enum torture_krb5_test test)
 282 {
 283         krb5_error_code k5ret;
 284         bool ok;
 285         krb5_creds my_creds;
 286         krb5_principal principal;
 287         struct smb_krb5_context *smb_krb5_context;
 288         enum credentials_obtained obtained;
 289         const char *error_string;
 290         const char *password = cli_credentials_get_password(credentials);
 291         krb5_get_init_creds_opt *krb_options = NULL;
 292
 293         ok = torture_krb5_init_context(tctx, test, &smb_krb5_context);
 294         torture_assert(tctx, ok, "torture_krb5_init_context failed");
 295
 296         k5ret = principal_from_credentials(tctx, credentials, smb_krb5_context,
 297                                            &principal, &obtained,  &error_string);
 298         torture_assert_int_equal(tctx, k5ret, 0, error_string);
 299
 300         switch (test)
 301         {
 302         case TORTURE_KRB5_TEST_PLAIN:
 303                 break;
 304
 305         case TORTURE_KRB5_TEST_WIN2K:
 306                 torture_assert_int_equal(tctx,
 307                                          krb5_get_init_creds_opt_alloc(smb_krb5_context->krb5_context, &krb_options),
 308                                          0, "krb5_get_init_creds_opt_alloc failed");
 309
 310                 torture_assert_int_equal(tctx,
 311                                          krb5_get_init_creds_opt_set_win2k(smb_krb5_context->krb5_context, krb_options, true),
 312                                          0, "krb5_get_init_creds_opt_set_win2k failed");
 313                 break;
 314
 315         case TORTURE_KRB5_TEST_PAC_REQUEST:
 316                 torture_assert_int_equal(tctx,
 317                                          krb5_get_init_creds_opt_alloc(smb_krb5_context->krb5_context, &krb_options),
 318                                          0, "krb5_get_init_creds_opt_alloc failed");
 319
 320                 torture_assert_int_equal(tctx,
 321                                          krb5_get_init_creds_opt_set_pac_request(smb_krb5_context->krb5_context, krb_options, true),
 322                                          0, "krb5_get_init_creds_opt_set_pac_request failed");
 323                 break;
 324
 325         case TORTURE_KRB5_TEST_BREAK_PW:
 326                 password = "NOT the password";
 327                 break;
 328
 329         case TORTURE_KRB5_TEST_CLOCK_SKEW:
 330                 torture_assert_int_equal(tctx,
 331                                          krb5_set_real_time(smb_krb5_context->krb5_context, time(NULL) + 3600, 0),
 332                                          0, "krb5_set_real_time failed");
 333                 break;
 334
 335         break;
 336         }
 337         k5ret = krb5_get_init_creds_password(smb_krb5_context->krb5_context, &my_creds, principal,
 338                                              password, NULL, NULL, 0,
 339                                              NULL, krb_options);
 340         krb5_get_init_creds_opt_free(smb_krb5_context->krb5_context, krb_options);
 341
 342         switch (test)
 343         {
 344         case TORTURE_KRB5_TEST_PLAIN:
 345         case TORTURE_KRB5_TEST_WIN2K:
 346         case TORTURE_KRB5_TEST_PAC_REQUEST:
 347                 torture_assert_int_equal(tctx, k5ret, 0, "krb5_get_init_creds_password failed");
 348                 break;
 349
 350         case TORTURE_KRB5_TEST_BREAK_PW:
 351                 torture_assert_int_equal(tctx, k5ret, KRB5KDC_ERR_PREAUTH_FAILED, "krb5_get_init_creds_password should have failed");
 352                 return true;
 353
 354         case TORTURE_KRB5_TEST_CLOCK_SKEW:
 355                 torture_assert_int_equal(tctx, k5ret, KRB5KRB_AP_ERR_SKEW, "krb5_get_init_creds_password should have failed");
 356                 return true;
 357
 358         }
 359
 360         torture_assert_int_equal(tctx,
 361                                  krb5_principal_get_type(smb_krb5_context->krb5_context,
 362                                                          my_creds.client), KRB5_NT_PRINCIPAL,
 363                                  "smb_krb5_init_context gave incorrect client->name.name_type");
 364
 365         torture_assert(tctx, krb5_principal_compare(smb_krb5_context->krb5_context,
 366                                                     principal, my_creds.client),
 367                        "krb5_get_init_creds_password returned a different principal");
 368
 369         torture_assert_int_equal(tctx,
 370                                  krb5_principal_get_type(smb_krb5_context->krb5_context,
 371                                                          my_creds.server), KRB5_NT_SRV_INST,
 372                                  "smb_krb5_init_context gave incorrect client->name.name_type");
 373
 374         torture_assert_str_equal(tctx, krb5_principal_get_comp_string(smb_krb5_context->krb5_context,
 375                                                                       my_creds.server, 0),
 376                                  "krbtgt",
 377                                  "smb_krb5_init_context gave incorrect my_creds.server->name.name_string[0]");
 378
 379         k5ret = krb5_free_cred_contents(smb_krb5_context->krb5_context, &my_creds);
 380         torture_assert_int_equal(tctx, k5ret, 0, "krb5_free_creds failed");
 381
 382         return true;
 383 }
 384
 385 static bool torture_krb5_as_req_cmdline(struct torture_context *tctx)
 386 {
 387         return torture_krb5_as_req_creds(tctx, cmdline_credentials, TORTURE_KRB5_TEST_PLAIN);
 388 }
 389
 390 static bool torture_krb5_as_req_win2k(struct torture_context *tctx)
 391 {
 392         return torture_krb5_as_req_creds(tctx, cmdline_credentials, TORTURE_KRB5_TEST_WIN2K);
 393 }
 394
 395 static bool torture_krb5_as_req_pac_request(struct torture_context *tctx)
 396 {
 397         return torture_krb5_as_req_creds(tctx, cmdline_credentials, TORTURE_KRB5_TEST_PAC_REQUEST);
 398 }
 399
 400 static bool torture_krb5_as_req_break_pw(struct torture_context *tctx)
 401 {
 402         return torture_krb5_as_req_creds(tctx, cmdline_credentials, TORTURE_KRB5_TEST_BREAK_PW);
 403 }
 404
 405 static bool torture_krb5_as_req_clock_skew(struct torture_context *tctx)
 406 {
 407         return torture_krb5_as_req_creds(tctx, cmdline_credentials, TORTURE_KRB5_TEST_CLOCK_SKEW);
 408 }
 409
 410 NTSTATUS torture_krb5_init(void)
 411 {
 412         struct torture_suite *suite = torture_suite_create(talloc_autofree_context(), "krb5");
 413         struct torture_suite *kdc_suite = torture_suite_create(suite, "kdc");
 414         suite->description = talloc_strdup(suite, "Kerberos tests");
 415         kdc_suite->description = talloc_strdup(kdc_suite, "Kerberos KDC tests");
 416
 417         torture_suite_add_simple_test(kdc_suite, "as-req-cmdline",
 418                                       torture_krb5_as_req_cmdline);
 419
 420         torture_suite_add_simple_test(kdc_suite, "as-req-win2k",
 421                                       torture_krb5_as_req_win2k);
 422
 423         torture_suite_add_simple_test(kdc_suite, "as-req-pac-request",
 424                                       torture_krb5_as_req_pac_request);
 425
 426         torture_suite_add_simple_test(kdc_suite, "as-req-break-pw",
 427                                       torture_krb5_as_req_break_pw);
 428
 429         torture_suite_add_simple_test(kdc_suite, "as-req-clock-skew",
 430                                       torture_krb5_as_req_clock_skew);
 431
 432         torture_suite_add_suite(kdc_suite, torture_krb5_canon(kdc_suite));
 433         torture_suite_add_suite(suite, kdc_suite);
 434
 435         torture_register_suite(suite);
 436         return NT_STATUS_OK;
 437 }