2 Unix SMB/CIFS implementation.
4 test suite for netlogon PAC operations
6 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2012
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "auth/auth.h"
24 #include "auth/auth_sam_reply.h"
25 #include "auth/gensec/gensec.h"
26 #include "system/kerberos.h"
27 #include "auth/kerberos/kerberos.h"
28 #include "auth/credentials/credentials.h"
29 #include "auth/credentials/credentials_krb5.h"
30 #include "lib/cmdline/popt_common.h"
31 #include "torture/rpc/torture_rpc.h"
32 #include "libcli/auth/libcli_auth.h"
33 #include "libcli/security/security.h"
34 #include "librpc/gen_ndr/ndr_netlogon_c.h"
35 #include "librpc/gen_ndr/ndr_krb5pac.h"
36 #include "librpc/gen_ndr/ndr_samr_c.h"
37 #include "param/param.h"
39 #define TEST_MACHINE_NAME_BDC "torturepacbdc"
40 #define TEST_MACHINE_NAME_WKSTA "torturepacwksta"
41 #define TEST_MACHINE_NAME_WKSTA_DES "torturepacwkdes"
42 #define TEST_MACHINE_NAME_S2U4SELF_BDC "tests2u4selfbdc"
43 #define TEST_MACHINE_NAME_S2U4SELF_WKSTA "tests2u4selfwk"
46 struct PAC_SIGNATURE_DATA
*pac_srv_sig
;
47 struct PAC_SIGNATURE_DATA
*pac_kdc_sig
;
50 /* A helper function which avoids touching the local databases to
51 * generate the session info, as we just want to verify the PAC
52 * details, not the full local token */
53 static NTSTATUS
test_generate_session_info_pac(struct auth4_context
*auth_ctx
,
55 struct smb_krb5_context
*smb_krb5_context
,
57 const char *principal_name
,
58 const struct tsocket_address
*remote_address
,
59 uint32_t session_info_flags
,
60 struct auth_session_info
**session_info
)
63 struct auth_user_info_dc
*user_info_dc
;
65 struct pac_data
*pac_data
;
67 tmp_ctx
= talloc_named(mem_ctx
, 0, "gensec_gssapi_session_info context");
68 NT_STATUS_HAVE_NO_MEMORY(tmp_ctx
);
70 auth_ctx
->private_data
= pac_data
= talloc_zero(auth_ctx
, struct pac_data
);
72 pac_data
->pac_srv_sig
= talloc(tmp_ctx
, struct PAC_SIGNATURE_DATA
);
73 if (!pac_data
->pac_srv_sig
) {
75 return NT_STATUS_NO_MEMORY
;
77 pac_data
->pac_kdc_sig
= talloc(tmp_ctx
, struct PAC_SIGNATURE_DATA
);
78 if (!pac_data
->pac_kdc_sig
) {
80 return NT_STATUS_NO_MEMORY
;
83 nt_status
= kerberos_pac_blob_to_user_info_dc(tmp_ctx
,
85 smb_krb5_context
->krb5_context
,
87 pac_data
->pac_srv_sig
,
88 pac_data
->pac_kdc_sig
);
89 if (!NT_STATUS_IS_OK(nt_status
)) {
94 talloc_steal(pac_data
, pac_data
->pac_srv_sig
);
95 talloc_steal(pac_data
, pac_data
->pac_kdc_sig
);
97 if (user_info_dc
->info
->authenticated
) {
98 session_info_flags
|= AUTH_SESSION_INFO_AUTHENTICATED
;
101 session_info_flags
|= AUTH_SESSION_INFO_SIMPLE_PRIVILEGES
;
102 nt_status
= auth_generate_session_info(mem_ctx
,
105 user_info_dc
, session_info_flags
,
107 if (!NT_STATUS_IS_OK(nt_status
)) {
108 talloc_free(tmp_ctx
);
112 talloc_free(tmp_ctx
);
116 /* Check to see if we can pass the PAC across to the NETLOGON server for validation */
118 /* Also happens to be a really good one-step verfication of our Kerberos stack */
120 static bool test_PACVerify(struct torture_context
*tctx
,
121 struct dcerpc_pipe
*p
,
122 struct cli_credentials
*credentials
,
123 enum netr_SchannelType secure_channel_type
,
124 const char *test_machine_name
,
125 uint32_t negotiate_flags
)
129 struct netr_LogonSamLogon r
;
131 union netr_LogonLevel logon
;
132 union netr_Validation validation
;
133 uint8_t authoritative
;
134 struct netr_Authenticator return_authenticator
;
136 struct netr_GenericInfo generic
;
137 struct netr_Authenticator auth
, auth2
;
139 struct netlogon_creds_CredentialState
*creds
;
140 struct gensec_security
*gensec_client_context
;
141 struct gensec_security
*gensec_server_context
;
143 DATA_BLOB client_to_server
, server_to_client
, pac_wrapped
, payload
;
144 struct PAC_Validate pac_wrapped_struct
;
146 enum ndr_err_code ndr_err
;
148 struct auth4_context
*auth_context
;
149 struct auth_session_info
*session_info
;
150 struct pac_data
*pac_data
;
152 struct dcerpc_binding_handle
*b
= p
->binding_handle
;
153 TALLOC_CTX
*tmp_ctx
= talloc_new(tctx
);
154 torture_assert(tctx
, tmp_ctx
!= NULL
, "talloc_new() failed");
156 torture_comment(tctx
,
157 "Testing PAC Verify (secure_channel_type: %d, machine: %s, negotiate_flags: 0x%08x\n",
158 secure_channel_type
, test_machine_name
, negotiate_flags
);
160 if (!test_SetupCredentials2(p
, tctx
, negotiate_flags
,
161 credentials
, secure_channel_type
,
166 auth_context
= talloc_zero(tmp_ctx
, struct auth4_context
);
167 torture_assert(tctx
, auth_context
!= NULL
, "talloc_new() failed");
169 auth_context
->generate_session_info_pac
= test_generate_session_info_pac
;
171 status
= gensec_client_start(tctx
, &gensec_client_context
,
172 lpcfg_gensec_settings(tctx
, tctx
->lp_ctx
));
173 torture_assert_ntstatus_ok(tctx
, status
, "gensec_client_start (client) failed");
175 status
= gensec_set_target_hostname(gensec_client_context
, test_machine_name
);
177 status
= gensec_set_credentials(gensec_client_context
, cmdline_credentials
);
178 torture_assert_ntstatus_ok(tctx
, status
, "gensec_set_credentials (client) failed");
180 status
= gensec_start_mech_by_sasl_name(gensec_client_context
, "GSSAPI");
181 torture_assert_ntstatus_ok(tctx
, status
, "gensec_start_mech_by_sasl_name (client) failed");
183 status
= gensec_server_start(tctx
,
184 lpcfg_gensec_settings(tctx
, tctx
->lp_ctx
),
185 auth_context
, &gensec_server_context
);
186 torture_assert_ntstatus_ok(tctx
, status
, "gensec_server_start (server) failed");
188 status
= gensec_set_credentials(gensec_server_context
, credentials
);
189 torture_assert_ntstatus_ok(tctx
, status
, "gensec_set_credentials (server) failed");
191 status
= gensec_start_mech_by_sasl_name(gensec_server_context
, "GSSAPI");
192 torture_assert_ntstatus_ok(tctx
, status
, "gensec_start_mech_by_sasl_name (server) failed");
194 server_to_client
= data_blob(NULL
, 0);
197 /* Do a client-server update dance */
198 status
= gensec_update(gensec_client_context
, tmp_ctx
, server_to_client
, &client_to_server
);
199 if (!NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {;
200 torture_assert_ntstatus_ok(tctx
, status
, "gensec_update (client) failed");
203 status
= gensec_update(gensec_server_context
, tmp_ctx
, client_to_server
, &server_to_client
);
204 if (!NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {;
205 torture_assert_ntstatus_ok(tctx
, status
, "gensec_update (server) failed");
208 if (NT_STATUS_IS_OK(status
)) {
213 /* Extract the PAC using Samba's code */
215 status
= gensec_session_info(gensec_server_context
, gensec_server_context
, &session_info
);
216 torture_assert_ntstatus_ok(tctx
, status
, "gensec_session_info failed");
218 pac_data
= talloc_get_type(auth_context
->private_data
, struct pac_data
);
220 torture_assert(tctx
, pac_data
!= NULL
, "gensec_update failed to fill in pac_data in auth_context");
221 torture_assert(tctx
, pac_data
->pac_srv_sig
!= NULL
, "pac_srv_sig not present");
222 torture_assert(tctx
, pac_data
->pac_kdc_sig
!= NULL
, "pac_kdc_sig not present");
224 pac_wrapped_struct
.ChecksumLength
= pac_data
->pac_srv_sig
->signature
.length
;
225 pac_wrapped_struct
.SignatureType
= pac_data
->pac_kdc_sig
->type
;
226 pac_wrapped_struct
.SignatureLength
= pac_data
->pac_kdc_sig
->signature
.length
;
227 pac_wrapped_struct
.ChecksumAndSignature
= payload
228 = data_blob_talloc(tmp_ctx
, NULL
,
229 pac_wrapped_struct
.ChecksumLength
230 + pac_wrapped_struct
.SignatureLength
);
231 memcpy(&payload
.data
[0],
232 pac_data
->pac_srv_sig
->signature
.data
,
233 pac_wrapped_struct
.ChecksumLength
);
234 memcpy(&payload
.data
[pac_wrapped_struct
.ChecksumLength
],
235 pac_data
->pac_kdc_sig
->signature
.data
,
236 pac_wrapped_struct
.SignatureLength
);
238 ndr_err
= ndr_push_struct_blob(&pac_wrapped
, tmp_ctx
, &pac_wrapped_struct
,
239 (ndr_push_flags_fn_t
)ndr_push_PAC_Validate
);
240 torture_assert(tctx
, NDR_ERR_CODE_IS_SUCCESS(ndr_err
), "ndr_push_struct_blob of PACValidate structure failed");
242 torture_assert(tctx
, (creds
->negotiate_flags
& NETLOGON_NEG_ARCFOUR
), "not willing to even try a PACValidate without RC4 encryption");
243 if (creds
->negotiate_flags
& NETLOGON_NEG_SUPPORTS_AES
) {
244 netlogon_creds_aes_encrypt(creds
, pac_wrapped
.data
, pac_wrapped
.length
);
246 netlogon_creds_arcfour_crypt(creds
, pac_wrapped
.data
, pac_wrapped
.length
);
249 generic
.length
= pac_wrapped
.length
;
250 generic
.data
= pac_wrapped
.data
;
252 /* Validate it over the netlogon pipe */
254 generic
.identity_info
.parameter_control
= 0;
255 generic
.identity_info
.logon_id_high
= 0;
256 generic
.identity_info
.logon_id_low
= 0;
257 generic
.identity_info
.domain_name
.string
= session_info
->info
->domain_name
;
258 generic
.identity_info
.account_name
.string
= session_info
->info
->account_name
;
259 generic
.identity_info
.workstation
.string
= test_machine_name
;
261 generic
.package_name
.string
= "Kerberos";
263 logon
.generic
= &generic
;
266 netlogon_creds_client_authenticator(creds
, &auth
);
267 r
.in
.credential
= &auth
;
268 r
.in
.return_authenticator
= &auth2
;
270 r
.in
.logon_level
= NetlogonGenericInformation
;
271 r
.in
.server_name
= talloc_asprintf(tctx
, "\\\\%s", dcerpc_server_name(p
));
272 r
.in
.computer_name
= cli_credentials_get_workstation(credentials
);
273 r
.in
.validation_level
= NetlogonValidationGenericInfo2
;
274 r
.out
.validation
= &validation
;
275 r
.out
.authoritative
= &authoritative
;
276 r
.out
.return_authenticator
= &return_authenticator
;
278 torture_assert_ntstatus_ok(tctx
, dcerpc_netr_LogonSamLogon_r(b
, tctx
, &r
),
279 "LogonSamLogon failed");
281 torture_assert_ntstatus_ok(tctx
, r
.out
.result
, "LogonSamLogon failed");
283 /* This will break the signature nicely (even in the crypto wrapping), check we get a logon failure */
284 generic
.data
[generic
.length
-1]++;
286 logon
.generic
= &generic
;
289 netlogon_creds_client_authenticator(creds
, &auth
);
290 r
.in
.credential
= &auth
;
291 r
.in
.return_authenticator
= &auth2
;
292 r
.in
.logon_level
= NetlogonGenericInformation
;
294 r
.in
.server_name
= talloc_asprintf(tctx
, "\\\\%s", dcerpc_server_name(p
));
295 r
.in
.computer_name
= cli_credentials_get_workstation(credentials
);
296 r
.in
.validation_level
= NetlogonValidationGenericInfo2
;
298 torture_assert_ntstatus_ok(tctx
, dcerpc_netr_LogonSamLogon_r(b
, tctx
, &r
),
299 "LogonSamLogon failed");
301 torture_assert_ntstatus_equal(tctx
, r
.out
.result
, NT_STATUS_LOGON_FAILURE
, "LogonSamLogon failed");
303 torture_assert(tctx
, netlogon_creds_client_check(creds
, &r
.out
.return_authenticator
->cred
),
304 "Credential chaining failed");
306 /* This will break the parsing nicely (even in the crypto wrapping), check we get INVALID_PARAMETER */
309 logon
.generic
= &generic
;
312 netlogon_creds_client_authenticator(creds
, &auth
);
313 r
.in
.credential
= &auth
;
314 r
.in
.return_authenticator
= &auth2
;
315 r
.in
.logon_level
= NetlogonGenericInformation
;
317 r
.in
.server_name
= talloc_asprintf(tctx
, "\\\\%s", dcerpc_server_name(p
));
318 r
.in
.computer_name
= cli_credentials_get_workstation(credentials
);
319 r
.in
.validation_level
= NetlogonValidationGenericInfo2
;
321 torture_assert_ntstatus_ok(tctx
, dcerpc_netr_LogonSamLogon_r(b
, tctx
, &r
),
322 "LogonSamLogon failed");
324 torture_assert_ntstatus_equal(tctx
, r
.out
.result
, NT_STATUS_INVALID_PARAMETER
, "LogonSamLogon failed");
326 torture_assert(tctx
, netlogon_creds_client_check(creds
,
327 &r
.out
.return_authenticator
->cred
),
328 "Credential chaining failed");
330 pac_wrapped_struct
.ChecksumLength
= pac_data
->pac_srv_sig
->signature
.length
;
331 pac_wrapped_struct
.SignatureType
= pac_data
->pac_kdc_sig
->type
;
333 /* Break the SignatureType */
334 pac_wrapped_struct
.SignatureType
++;
336 pac_wrapped_struct
.SignatureLength
= pac_data
->pac_kdc_sig
->signature
.length
;
337 pac_wrapped_struct
.ChecksumAndSignature
= payload
338 = data_blob_talloc(tmp_ctx
, NULL
,
339 pac_wrapped_struct
.ChecksumLength
340 + pac_wrapped_struct
.SignatureLength
);
341 memcpy(&payload
.data
[0],
342 pac_data
->pac_srv_sig
->signature
.data
,
343 pac_wrapped_struct
.ChecksumLength
);
344 memcpy(&payload
.data
[pac_wrapped_struct
.ChecksumLength
],
345 pac_data
->pac_kdc_sig
->signature
.data
,
346 pac_wrapped_struct
.SignatureLength
);
348 ndr_err
= ndr_push_struct_blob(&pac_wrapped
, tmp_ctx
, &pac_wrapped_struct
,
349 (ndr_push_flags_fn_t
)ndr_push_PAC_Validate
);
350 torture_assert(tctx
, NDR_ERR_CODE_IS_SUCCESS(ndr_err
), "ndr_push_struct_blob of PACValidate structure failed");
352 torture_assert(tctx
, (creds
->negotiate_flags
& NETLOGON_NEG_ARCFOUR
), "not willing to even try a PACValidate without RC4 encryption");
353 if (creds
->negotiate_flags
& NETLOGON_NEG_SUPPORTS_AES
) {
354 netlogon_creds_aes_encrypt(creds
, pac_wrapped
.data
, pac_wrapped
.length
);
356 netlogon_creds_arcfour_crypt(creds
, pac_wrapped
.data
, pac_wrapped
.length
);
359 generic
.length
= pac_wrapped
.length
;
360 generic
.data
= pac_wrapped
.data
;
362 logon
.generic
= &generic
;
365 netlogon_creds_client_authenticator(creds
, &auth
);
366 r
.in
.credential
= &auth
;
367 r
.in
.return_authenticator
= &auth2
;
368 r
.in
.logon_level
= NetlogonGenericInformation
;
370 r
.in
.server_name
= talloc_asprintf(tctx
, "\\\\%s", dcerpc_server_name(p
));
371 r
.in
.computer_name
= cli_credentials_get_workstation(credentials
);
372 r
.in
.validation_level
= NetlogonValidationGenericInfo2
;
374 torture_assert_ntstatus_ok(tctx
, dcerpc_netr_LogonSamLogon_r(b
, tctx
, &r
),
375 "LogonSamLogon failed");
377 torture_assert_ntstatus_equal(tctx
, r
.out
.result
, NT_STATUS_LOGON_FAILURE
, "LogonSamLogon failed");
379 torture_assert(tctx
, netlogon_creds_client_check(creds
, &r
.out
.return_authenticator
->cred
),
380 "Credential chaining failed");
382 pac_wrapped_struct
.ChecksumLength
= pac_data
->pac_srv_sig
->signature
.length
;
383 pac_wrapped_struct
.SignatureType
= pac_data
->pac_kdc_sig
->type
;
384 pac_wrapped_struct
.SignatureLength
= pac_data
->pac_kdc_sig
->signature
.length
;
386 pac_wrapped_struct
.ChecksumAndSignature
= payload
387 = data_blob_talloc(tmp_ctx
, NULL
,
388 pac_wrapped_struct
.ChecksumLength
389 + pac_wrapped_struct
.SignatureLength
);
390 memcpy(&payload
.data
[0],
391 pac_data
->pac_srv_sig
->signature
.data
,
392 pac_wrapped_struct
.ChecksumLength
);
393 memcpy(&payload
.data
[pac_wrapped_struct
.ChecksumLength
],
394 pac_data
->pac_kdc_sig
->signature
.data
,
395 pac_wrapped_struct
.SignatureLength
);
397 /* Break the signature length */
398 pac_wrapped_struct
.SignatureLength
++;
400 ndr_err
= ndr_push_struct_blob(&pac_wrapped
, tmp_ctx
, &pac_wrapped_struct
,
401 (ndr_push_flags_fn_t
)ndr_push_PAC_Validate
);
402 torture_assert(tctx
, NDR_ERR_CODE_IS_SUCCESS(ndr_err
), "ndr_push_struct_blob of PACValidate structure failed");
404 torture_assert(tctx
, (creds
->negotiate_flags
& NETLOGON_NEG_ARCFOUR
), "not willing to even try a PACValidate without RC4 encryption");
405 if (creds
->negotiate_flags
& NETLOGON_NEG_SUPPORTS_AES
) {
406 netlogon_creds_aes_encrypt(creds
, pac_wrapped
.data
, pac_wrapped
.length
);
408 netlogon_creds_arcfour_crypt(creds
, pac_wrapped
.data
, pac_wrapped
.length
);
411 generic
.length
= pac_wrapped
.length
;
412 generic
.data
= pac_wrapped
.data
;
414 logon
.generic
= &generic
;
417 netlogon_creds_client_authenticator(creds
, &auth
);
418 r
.in
.credential
= &auth
;
419 r
.in
.return_authenticator
= &auth2
;
420 r
.in
.logon_level
= NetlogonGenericInformation
;
422 r
.in
.server_name
= talloc_asprintf(tctx
, "\\\\%s", dcerpc_server_name(p
));
423 r
.in
.computer_name
= cli_credentials_get_workstation(credentials
);
424 r
.in
.validation_level
= NetlogonValidationGenericInfo2
;
426 torture_assert_ntstatus_ok(tctx
, dcerpc_netr_LogonSamLogon_r(b
, tctx
, &r
),
427 "LogonSamLogon failed");
429 torture_assert_ntstatus_equal(tctx
, r
.out
.result
, NT_STATUS_INVALID_PARAMETER
, "LogonSamLogon failed");
431 torture_assert(tctx
, netlogon_creds_client_check(creds
, &r
.out
.return_authenticator
->cred
),
432 "Credential chaining failed");
437 static bool test_PACVerify_bdc_arcfour(struct torture_context
*tctx
,
438 struct dcerpc_pipe
*p
,
439 struct cli_credentials
*credentials
)
441 return test_PACVerify(tctx
, p
, credentials
, SEC_CHAN_BDC
,
442 TEST_MACHINE_NAME_BDC
,
443 NETLOGON_NEG_AUTH2_ADS_FLAGS
);
446 static bool test_PACVerify_bdc_aes(struct torture_context
*tctx
,
447 struct dcerpc_pipe
*p
,
448 struct cli_credentials
*credentials
)
450 return test_PACVerify(tctx
, p
, credentials
, SEC_CHAN_BDC
,
451 TEST_MACHINE_NAME_BDC
,
452 NETLOGON_NEG_AUTH2_ADS_FLAGS
| NETLOGON_NEG_SUPPORTS_AES
);
455 static bool test_PACVerify_workstation_arcfour(struct torture_context
*tctx
,
456 struct dcerpc_pipe
*p
,
457 struct cli_credentials
*credentials
)
459 return test_PACVerify(tctx
, p
, credentials
, SEC_CHAN_WKSTA
,
460 TEST_MACHINE_NAME_WKSTA
,
461 NETLOGON_NEG_AUTH2_ADS_FLAGS
);
464 static bool test_PACVerify_workstation_aes(struct torture_context
*tctx
,
465 struct dcerpc_pipe
*p
,
466 struct cli_credentials
*credentials
)
468 return test_PACVerify(tctx
, p
, credentials
, SEC_CHAN_WKSTA
,
469 TEST_MACHINE_NAME_WKSTA
,
470 NETLOGON_NEG_AUTH2_ADS_FLAGS
| NETLOGON_NEG_SUPPORTS_AES
);
473 static bool test_PACVerify_workstation_des(struct torture_context
*tctx
,
474 struct dcerpc_pipe
*p
, struct cli_credentials
*credentials
, struct test_join
*join_ctx
)
476 struct samr_SetUserInfo r
;
477 union samr_UserInfo user_info
;
478 struct dcerpc_pipe
*samr_pipe
= torture_join_samr_pipe(join_ctx
);
479 struct smb_krb5_context
*smb_krb5_context
;
482 ret
= cli_credentials_get_krb5_context(cmdline_credentials
, tctx
->lp_ctx
, &smb_krb5_context
);
483 torture_assert_int_equal(tctx
, ret
, 0, "cli_credentials_get_krb5_context() failed");
485 if (smb_krb5_get_allowed_weak_crypto(smb_krb5_context
->krb5_context
) == FALSE
) {
486 torture_skip(tctx
, "Cannot test DES without [libdefaults] allow_weak_crypto = yes");
489 /* Mark this workstation with DES-only */
490 user_info
.info16
.acct_flags
= ACB_USE_DES_KEY_ONLY
| ACB_WSTRUST
;
491 r
.in
.user_handle
= torture_join_samr_user_policy(join_ctx
);
493 r
.in
.info
= &user_info
;
495 torture_assert_ntstatus_ok(tctx
, dcerpc_samr_SetUserInfo_r(samr_pipe
->binding_handle
, tctx
, &r
),
496 "failed to set DES info account flags");
497 torture_assert_ntstatus_ok(tctx
, r
.out
.result
,
498 "failed to set DES into account flags");
500 return test_PACVerify(tctx
, p
, credentials
, SEC_CHAN_WKSTA
,
501 TEST_MACHINE_NAME_WKSTA_DES
,
502 NETLOGON_NEG_AUTH2_ADS_FLAGS
);
506 /* Check various ways to get the PAC, in particular check the group membership and other details between the PAC from a normal kinit, S2U4Self and a SamLogon */
507 static bool test_S2U4Self(struct torture_context
*tctx
,
508 struct dcerpc_pipe
*p
,
509 struct cli_credentials
*credentials
,
510 enum netr_SchannelType secure_channel_type
,
511 const char *test_machine_name
,
512 uint32_t negotiate_flags
)
515 struct dcerpc_binding_handle
*b
= p
->binding_handle
;
517 struct netr_LogonSamLogon r
;
519 union netr_LogonLevel logon
;
520 union netr_Validation validation
;
521 uint8_t authoritative
;
523 struct netr_Authenticator auth
, auth2
;
525 DATA_BLOB client_to_server
, server_to_client
;
527 struct netlogon_creds_CredentialState
*creds
;
528 struct gensec_security
*gensec_client_context
;
529 struct gensec_security
*gensec_server_context
;
531 struct auth4_context
*auth_context
;
532 struct auth_session_info
*kinit_session_info
;
533 struct auth_session_info
*s2u4self_session_info
;
534 struct auth_user_info_dc
*netlogon_user_info_dc
;
536 struct netr_NetworkInfo ninfo
;
537 DATA_BLOB names_blob
, chal
, lm_resp
, nt_resp
;
539 int flags
= CLI_CRED_NTLMv2_AUTH
;
541 struct dom_sid
*builtin_domain
;
543 TALLOC_CTX
*tmp_ctx
= talloc_new(tctx
);
545 torture_assert(tctx
, tmp_ctx
!= NULL
, "talloc_new() failed");
547 torture_comment(tctx
,
548 "Testing S4U2SELF (secure_channel_type: %d, machine: %s, negotiate_flags: 0x%08x\n",
549 secure_channel_type
, test_machine_name
, negotiate_flags
);
551 auth_context
= talloc_zero(tmp_ctx
, struct auth4_context
);
552 torture_assert(tctx
, auth_context
!= NULL
, "talloc_new() failed");
554 auth_context
->generate_session_info_pac
= test_generate_session_info_pac
;
556 /* First, do a normal Kerberos connection */
558 status
= gensec_client_start(tctx
, &gensec_client_context
,
559 lpcfg_gensec_settings(tctx
, tctx
->lp_ctx
));
560 torture_assert_ntstatus_ok(tctx
, status
, "gensec_client_start (client) failed");
562 status
= gensec_set_target_hostname(gensec_client_context
, test_machine_name
);
564 status
= gensec_set_credentials(gensec_client_context
, cmdline_credentials
);
565 torture_assert_ntstatus_ok(tctx
, status
, "gensec_set_credentials (client) failed");
567 status
= gensec_start_mech_by_sasl_name(gensec_client_context
, "GSSAPI");
568 torture_assert_ntstatus_ok(tctx
, status
, "gensec_start_mech_by_sasl_name (client) failed");
570 status
= gensec_server_start(tctx
,
571 lpcfg_gensec_settings(tctx
, tctx
->lp_ctx
),
572 auth_context
, &gensec_server_context
);
573 torture_assert_ntstatus_ok(tctx
, status
, "gensec_server_start (server) failed");
575 status
= gensec_set_credentials(gensec_server_context
, credentials
);
576 torture_assert_ntstatus_ok(tctx
, status
, "gensec_set_credentials (server) failed");
578 status
= gensec_start_mech_by_sasl_name(gensec_server_context
, "GSSAPI");
579 torture_assert_ntstatus_ok(tctx
, status
, "gensec_start_mech_by_sasl_name (server) failed");
581 server_to_client
= data_blob(NULL
, 0);
584 /* Do a client-server update dance */
585 status
= gensec_update(gensec_client_context
, tmp_ctx
, server_to_client
, &client_to_server
);
586 if (!NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {;
587 torture_assert_ntstatus_ok(tctx
, status
, "gensec_update (client) failed");
590 status
= gensec_update(gensec_server_context
, tmp_ctx
, client_to_server
, &server_to_client
);
591 if (!NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {;
592 torture_assert_ntstatus_ok(tctx
, status
, "gensec_update (server) failed");
595 if (NT_STATUS_IS_OK(status
)) {
600 /* Extract the PAC using Samba's code */
602 status
= gensec_session_info(gensec_server_context
, gensec_server_context
, &kinit_session_info
);
603 torture_assert_ntstatus_ok(tctx
, status
, "gensec_session_info failed");
606 /* Now do the dance with S2U4Self */
608 /* Wipe out any existing ccache */
609 cli_credentials_invalidate_ccache(credentials
, CRED_SPECIFIED
);
610 cli_credentials_set_impersonate_principal(credentials
,
611 cli_credentials_get_principal(cmdline_credentials
, tmp_ctx
),
612 talloc_asprintf(tmp_ctx
, "host/%s", test_machine_name
));
614 status
= gensec_client_start(tctx
, &gensec_client_context
,
615 lpcfg_gensec_settings(tctx
, tctx
->lp_ctx
));
616 torture_assert_ntstatus_ok(tctx
, status
, "gensec_client_start (client) failed");
618 status
= gensec_set_target_hostname(gensec_client_context
, test_machine_name
);
620 /* We now set the same credentials on both client and server contexts */
621 status
= gensec_set_credentials(gensec_client_context
, credentials
);
622 torture_assert_ntstatus_ok(tctx
, status
, "gensec_set_credentials (client) failed");
624 status
= gensec_start_mech_by_sasl_name(gensec_client_context
, "GSSAPI");
625 torture_assert_ntstatus_ok(tctx
, status
, "gensec_start_mech_by_sasl_name (client) failed");
627 status
= gensec_server_start(tctx
,
628 lpcfg_gensec_settings(tctx
, tctx
->lp_ctx
),
629 auth_context
, &gensec_server_context
);
630 torture_assert_ntstatus_ok(tctx
, status
, "gensec_server_start (server) failed");
632 status
= gensec_set_credentials(gensec_server_context
, credentials
);
633 torture_assert_ntstatus_ok(tctx
, status
, "gensec_set_credentials (server) failed");
635 status
= gensec_start_mech_by_sasl_name(gensec_server_context
, "GSSAPI");
636 torture_assert_ntstatus_ok(tctx
, status
, "gensec_start_mech_by_sasl_name (server) failed");
638 server_to_client
= data_blob(NULL
, 0);
641 /* Do a client-server update dance */
642 status
= gensec_update(gensec_client_context
, tmp_ctx
, server_to_client
, &client_to_server
);
643 if (!NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {;
644 torture_assert_ntstatus_ok(tctx
, status
, "gensec_update (client) failed");
647 status
= gensec_update(gensec_server_context
, tmp_ctx
, client_to_server
, &server_to_client
);
648 if (!NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {;
649 torture_assert_ntstatus_ok(tctx
, status
, "gensec_update (server) failed");
652 if (NT_STATUS_IS_OK(status
)) {
657 /* Don't pollute the remaining tests with the changed credentials */
658 cli_credentials_invalidate_ccache(credentials
, CRED_SPECIFIED
);
659 cli_credentials_set_target_service(credentials
, NULL
);
660 cli_credentials_set_impersonate_principal(credentials
, NULL
, NULL
);
662 /* Extract the PAC using Samba's code */
664 status
= gensec_session_info(gensec_server_context
, gensec_server_context
, &s2u4self_session_info
);
665 torture_assert_ntstatus_ok(tctx
, status
, "gensec_session_info failed");
667 cli_credentials_get_ntlm_username_domain(cmdline_credentials
, tctx
,
668 &ninfo
.identity_info
.account_name
.string
,
669 &ninfo
.identity_info
.domain_name
.string
);
671 /* Now try with SamLogon */
672 generate_random_buffer(ninfo
.challenge
,
673 sizeof(ninfo
.challenge
));
674 chal
= data_blob_const(ninfo
.challenge
,
675 sizeof(ninfo
.challenge
));
677 names_blob
= NTLMv2_generate_names_blob(tctx
, cli_credentials_get_workstation(credentials
),
678 cli_credentials_get_domain(credentials
));
680 status
= cli_credentials_get_ntlm_response(cmdline_credentials
, tctx
,
686 torture_assert_ntstatus_ok(tctx
, status
, "cli_credentials_get_ntlm_response failed");
688 ninfo
.lm
.data
= lm_resp
.data
;
689 ninfo
.lm
.length
= lm_resp
.length
;
691 ninfo
.nt
.data
= nt_resp
.data
;
692 ninfo
.nt
.length
= nt_resp
.length
;
694 ninfo
.identity_info
.parameter_control
= 0;
695 ninfo
.identity_info
.logon_id_low
= 0;
696 ninfo
.identity_info
.logon_id_high
= 0;
697 ninfo
.identity_info
.workstation
.string
= cli_credentials_get_workstation(credentials
);
699 logon
.network
= &ninfo
;
701 r
.in
.server_name
= talloc_asprintf(tctx
, "\\\\%s", dcerpc_server_name(p
));
702 r
.in
.computer_name
= cli_credentials_get_workstation(credentials
);
703 r
.in
.credential
= &auth
;
704 r
.in
.return_authenticator
= &auth2
;
705 r
.in
.logon_level
= NetlogonNetworkInformation
;
707 r
.out
.validation
= &validation
;
708 r
.out
.authoritative
= &authoritative
;
710 if (!test_SetupCredentials2(p
, tctx
, negotiate_flags
,
711 credentials
, secure_channel_type
,
717 netlogon_creds_client_authenticator(creds
, &auth
);
719 r
.in
.validation_level
= 3;
721 status
= dcerpc_netr_LogonSamLogon_r(b
, tctx
, &r
);
722 torture_assert_ntstatus_ok(tctx
, status
, "LogonSamLogon failed");
724 torture_assert(tctx
, netlogon_creds_client_check(creds
,
725 &r
.out
.return_authenticator
->cred
),
726 "Credential chaining failed");
728 torture_assert_ntstatus_ok(tctx
, r
.out
.result
, "LogonSamLogon failed");
730 status
= make_user_info_dc_netlogon_validation(tmp_ctx
,
731 ninfo
.identity_info
.account_name
.string
,
732 r
.in
.validation_level
,
734 true, /* This user was authenticated */
735 &netlogon_user_info_dc
);
737 torture_assert_ntstatus_ok(tctx
, status
, "make_user_info_dc_netlogon_validation failed");
739 torture_assert_str_equal(tctx
, netlogon_user_info_dc
->info
->account_name
== NULL
? "" : netlogon_user_info_dc
->info
->account_name
,
740 kinit_session_info
->info
->account_name
, "Account name differs for kinit-based PAC");
741 torture_assert_str_equal(tctx
,netlogon_user_info_dc
->info
->account_name
== NULL
? "" : netlogon_user_info_dc
->info
->account_name
,
742 s2u4self_session_info
->info
->account_name
, "Account name differs for S2U4Self");
743 torture_assert_str_equal(tctx
, netlogon_user_info_dc
->info
->full_name
== NULL
? "" : netlogon_user_info_dc
->info
->full_name
, kinit_session_info
->info
->full_name
, "Full name differs for kinit-based PAC");
744 torture_assert_str_equal(tctx
, netlogon_user_info_dc
->info
->full_name
== NULL
? "" : netlogon_user_info_dc
->info
->full_name
, s2u4self_session_info
->info
->full_name
, "Full name differs for S2U4Self");
745 torture_assert_int_equal(tctx
, netlogon_user_info_dc
->num_sids
, kinit_session_info
->torture
->num_dc_sids
, "Different numbers of domain groups for kinit-based PAC");
746 torture_assert_int_equal(tctx
, netlogon_user_info_dc
->num_sids
, s2u4self_session_info
->torture
->num_dc_sids
, "Different numbers of domain groups for S2U4Self");
748 builtin_domain
= dom_sid_parse_talloc(tmp_ctx
, SID_BUILTIN
);
750 for (i
= 0; i
< kinit_session_info
->torture
->num_dc_sids
; i
++) {
751 torture_assert(tctx
, dom_sid_equal(&netlogon_user_info_dc
->sids
[i
], &kinit_session_info
->torture
->dc_sids
[i
]), "Different domain groups for kinit-based PAC");
752 torture_assert(tctx
, dom_sid_equal(&netlogon_user_info_dc
->sids
[i
], &s2u4self_session_info
->torture
->dc_sids
[i
]), "Different domain groups for S2U4Self");
753 torture_assert(tctx
, !dom_sid_in_domain(builtin_domain
, &s2u4self_session_info
->torture
->dc_sids
[i
]), "Returned BUILTIN domain in groups for S2U4Self");
754 torture_assert(tctx
, !dom_sid_in_domain(builtin_domain
, &kinit_session_info
->torture
->dc_sids
[i
]), "Returned BUILTIN domain in groups kinit-based PAC");
755 torture_assert(tctx
, !dom_sid_in_domain(builtin_domain
, &netlogon_user_info_dc
->sids
[i
]), "Returned BUILTIN domian in groups from NETLOGON SamLogon reply");
761 static bool test_S2U4Self_bdc_arcfour(struct torture_context
*tctx
,
762 struct dcerpc_pipe
*p
,
763 struct cli_credentials
*credentials
)
765 return test_S2U4Self(tctx
, p
, credentials
, SEC_CHAN_BDC
,
766 TEST_MACHINE_NAME_S2U4SELF_BDC
,
767 NETLOGON_NEG_AUTH2_ADS_FLAGS
);
770 static bool test_S2U4Self_bdc_aes(struct torture_context
*tctx
,
771 struct dcerpc_pipe
*p
,
772 struct cli_credentials
*credentials
)
774 return test_S2U4Self(tctx
, p
, credentials
, SEC_CHAN_BDC
,
775 TEST_MACHINE_NAME_S2U4SELF_BDC
,
776 NETLOGON_NEG_AUTH2_ADS_FLAGS
| NETLOGON_NEG_SUPPORTS_AES
);
779 static bool test_S2U4Self_workstation_arcfour(struct torture_context
*tctx
,
780 struct dcerpc_pipe
*p
,
781 struct cli_credentials
*credentials
)
783 return test_S2U4Self(tctx
, p
, credentials
, SEC_CHAN_WKSTA
,
784 TEST_MACHINE_NAME_S2U4SELF_WKSTA
,
785 NETLOGON_NEG_AUTH2_ADS_FLAGS
);
788 static bool test_S2U4Self_workstation_aes(struct torture_context
*tctx
,
789 struct dcerpc_pipe
*p
,
790 struct cli_credentials
*credentials
)
792 return test_S2U4Self(tctx
, p
, credentials
, SEC_CHAN_WKSTA
,
793 TEST_MACHINE_NAME_S2U4SELF_WKSTA
,
794 NETLOGON_NEG_AUTH2_ADS_FLAGS
| NETLOGON_NEG_SUPPORTS_AES
);
797 struct torture_suite
*torture_rpc_remote_pac(TALLOC_CTX
*mem_ctx
)
799 struct torture_suite
*suite
= torture_suite_create(mem_ctx
, "pac");
800 struct torture_rpc_tcase
*tcase
;
802 /* It is important to use different names, so that old entries in our credential cache are not used */
803 tcase
= torture_suite_add_machine_bdc_rpc_iface_tcase(suite
, "netr-bdc-arcfour",
804 &ndr_table_netlogon
, TEST_MACHINE_NAME_BDC
);
805 torture_rpc_tcase_add_test_creds(tcase
, "verify-sig-arcfour", test_PACVerify_bdc_arcfour
);
807 tcase
= torture_suite_add_machine_bdc_rpc_iface_tcase(suite
, "netr-bdc-aes",
808 &ndr_table_netlogon
, TEST_MACHINE_NAME_BDC
);
809 torture_rpc_tcase_add_test_creds(tcase
, "verify-sig-aes", test_PACVerify_bdc_aes
);
811 tcase
= torture_suite_add_machine_workstation_rpc_iface_tcase(suite
, "netr-mem-arcfour",
812 &ndr_table_netlogon
, TEST_MACHINE_NAME_WKSTA
);
813 torture_rpc_tcase_add_test_creds(tcase
, "verify-sig-arcfour", test_PACVerify_workstation_arcfour
);
815 tcase
= torture_suite_add_machine_workstation_rpc_iface_tcase(suite
, "netr-mem-aes",
816 &ndr_table_netlogon
, TEST_MACHINE_NAME_WKSTA
);
817 torture_rpc_tcase_add_test_creds(tcase
, "verify-sig-aes", test_PACVerify_workstation_aes
);
819 tcase
= torture_suite_add_machine_workstation_rpc_iface_tcase(suite
, "netlogon-member-des",
820 &ndr_table_netlogon
, TEST_MACHINE_NAME_WKSTA_DES
);
821 torture_rpc_tcase_add_test_join(tcase
, "verify-sig", test_PACVerify_workstation_des
);
823 tcase
= torture_suite_add_machine_bdc_rpc_iface_tcase(suite
, "netr-bdc-arcfour",
824 &ndr_table_netlogon
, TEST_MACHINE_NAME_S2U4SELF_BDC
);
825 torture_rpc_tcase_add_test_creds(tcase
, "s2u4self-arcfour", test_S2U4Self_bdc_arcfour
);
827 tcase
= torture_suite_add_machine_bdc_rpc_iface_tcase(suite
, "netr-bcd-aes",
828 &ndr_table_netlogon
, TEST_MACHINE_NAME_S2U4SELF_BDC
);
829 torture_rpc_tcase_add_test_creds(tcase
, "s2u4self-aes", test_S2U4Self_bdc_aes
);
831 tcase
= torture_suite_add_machine_workstation_rpc_iface_tcase(suite
, "netr-mem-arcfour",
832 &ndr_table_netlogon
, TEST_MACHINE_NAME_S2U4SELF_WKSTA
);
833 torture_rpc_tcase_add_test_creds(tcase
, "s2u4self-arcfour", test_S2U4Self_workstation_arcfour
);
835 tcase
= torture_suite_add_machine_workstation_rpc_iface_tcase(suite
, "netr-mem-aes",
836 &ndr_table_netlogon
, TEST_MACHINE_NAME_S2U4SELF_WKSTA
);
837 torture_rpc_tcase_add_test_creds(tcase
, "s2u4self-aes", test_S2U4Self_workstation_aes
);