source/torture/rpc/testjoin.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    utility code to join/leave a domain
   5
   6    Copyright (C) Andrew Tridgell 2004
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 2 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program; if not, write to the Free Software
  20    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21 */
  22
  23 /*
  24   this code is used by other torture modules to join/leave a domain
  25   as either a member, bdc or thru a trust relationship
  26 */
  27
  28 #include "includes.h"
  29 #include "torture/torture.h"
  30 #include "system/time.h"
  31 #include "lib/crypto/crypto.h"
  32 #include "libnet/libnet.h"
  33 #include "lib/cmdline/popt_common.h"
  34 #include "lib/ldb/include/ldb.h"
  35 #include "librpc/gen_ndr/ndr_samr_c.h"
  36
  37 #include "libcli/auth/libcli_auth.h"
  38 #include "torture/rpc/rpc.h"
  39 #include "libcli/security/security.h"
  40
  41 struct test_join {
  42         struct dcerpc_pipe *p;
  43         struct policy_handle user_handle;
  44         struct libnet_JoinDomain *libnet_r;
  45         struct dom_sid *dom_sid;
  46         const char *dom_netbios_name;
  47         const char *dom_dns_name;
  48         struct dom_sid *user_sid;
  49         struct GUID user_guid;
  50         const char *netbios_name;
  51 };
  52
  53
  54 static NTSTATUS DeleteUser_byname(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
  55                                   struct policy_handle *handle, const char *name)
  56 {
  57         NTSTATUS status;
  58         struct samr_DeleteUser d;
  59         struct policy_handle user_handle;
  60         uint32_t rid;
  61         struct samr_LookupNames n;
  62         struct lsa_String sname;
  63         struct samr_OpenUser r;
  64
  65         sname.string = name;
  66
  67         n.in.domain_handle = handle;
  68         n.in.num_names = 1;
  69         n.in.names = &sname;
  70
  71         status = dcerpc_samr_LookupNames(p, mem_ctx, &n);
  72         if (NT_STATUS_IS_OK(status)) {
  73                 rid = n.out.rids.ids[0];
  74         } else {
  75                 return status;
  76         }
  77
  78         r.in.domain_handle = handle;
  79         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
  80         r.in.rid = rid;
  81         r.out.user_handle = &user_handle;
  82
  83         status = dcerpc_samr_OpenUser(p, mem_ctx, &r);
  84         if (!NT_STATUS_IS_OK(status)) {
  85                 printf("OpenUser(%s) failed - %s\n", name, nt_errstr(status));
  86                 return status;
  87         }
  88
  89         d.in.user_handle = &user_handle;
  90         d.out.user_handle = &user_handle;
  91         status = dcerpc_samr_DeleteUser(p, mem_ctx, &d);
  92         if (!NT_STATUS_IS_OK(status)) {
  93                 return status;
  94         }
  95
  96         return NT_STATUS_OK;
  97 }
  98
  99 /*
 100   create a test user in the domain
 101   an opaque pointer is returned. Pass it to torture_leave_domain()
 102   when finished
 103 */
 104
 105 struct test_join *torture_create_testuser(const char *username,
 106                                           const char *domain,
 107                                           uint16_t acct_type,
 108                                           const char **random_password)
 109 {
 110         NTSTATUS status;
 111         struct samr_Connect c;
 112         struct samr_CreateUser2 r;
 113         struct samr_OpenDomain o;
 114         struct samr_LookupDomain l;
 115         struct samr_GetUserPwInfo pwp;
 116         struct samr_SetUserInfo s;
 117         union samr_UserInfo u;
 118         struct policy_handle handle;
 119         struct policy_handle domain_handle;
 120         uint32_t access_granted;
 121         uint32_t rid;
 122         DATA_BLOB session_key;
 123         struct lsa_String name;
 124
 125         int policy_min_pw_len = 0;
 126         struct test_join *join;
 127         char *random_pw;
 128
 129         join = talloc(NULL, struct test_join);
 130         if (join == NULL) {
 131                 return NULL;
 132         }
 133
 134         ZERO_STRUCTP(join);
 135
 136         printf("Connecting to SAMR\n");
 137
 138         status = torture_rpc_connection(join,
 139                                         &join->p,
 140                                         &dcerpc_table_samr);
 141         if (!NT_STATUS_IS_OK(status)) {
 142                 return NULL;
 143         }
 144
 145         c.in.system_name = NULL;
 146         c.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 147         c.out.connect_handle = &handle;
 148
 149         status = dcerpc_samr_Connect(join->p, join, &c);
 150         if (!NT_STATUS_IS_OK(status)) {
 151                 const char *errstr = nt_errstr(status);
 152                 if (NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
 153                         errstr = dcerpc_errstr(join, join->p->last_fault_code);
 154                 }
 155                 printf("samr_Connect failed - %s\n", errstr);
 156                 return NULL;
 157         }
 158
 159         printf("Opening domain %s\n", domain);
 160
 161         name.string = domain;
 162         l.in.connect_handle = &handle;
 163         l.in.domain_name = &name;
 164
 165         status = dcerpc_samr_LookupDomain(join->p, join, &l);
 166         if (!NT_STATUS_IS_OK(status)) {
 167                 printf("LookupDomain failed - %s\n", nt_errstr(status));
 168                 goto failed;
 169         }
 170
 171         talloc_steal(join, l.out.sid);
 172         join->dom_sid = l.out.sid;
 173         join->dom_netbios_name = talloc_strdup(join, domain);
 174         if (!join->dom_netbios_name) goto failed;
 175
 176         o.in.connect_handle = &handle;
 177         o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 178         o.in.sid = l.out.sid;
 179         o.out.domain_handle = &domain_handle;
 180
 181         status = dcerpc_samr_OpenDomain(join->p, join, &o);
 182         if (!NT_STATUS_IS_OK(status)) {
 183                 printf("OpenDomain failed - %s\n", nt_errstr(status));
 184                 goto failed;
 185         }
 186
 187         printf("Creating account %s\n", username);
 188
 189 again:
 190         name.string = username;
 191         r.in.domain_handle = &domain_handle;
 192         r.in.account_name = &name;
 193         r.in.acct_flags = acct_type;
 194         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 195         r.out.user_handle = &join->user_handle;
 196         r.out.access_granted = &access_granted;
 197         r.out.rid = &rid;
 198
 199         status = dcerpc_samr_CreateUser2(join->p, join, &r);
 200
 201         if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
 202                 status = DeleteUser_byname(join->p, join, &domain_handle, name.string);
 203                 if (NT_STATUS_IS_OK(status)) {
 204                         goto again;
 205                 }
 206         }
 207
 208         if (!NT_STATUS_IS_OK(status)) {
 209                 printf("CreateUser2 failed - %s\n", nt_errstr(status));
 210                 goto failed;
 211         }
 212
 213         join->user_sid = dom_sid_add_rid(join, join->dom_sid, rid);
 214
 215         pwp.in.user_handle = &join->user_handle;
 216
 217         status = dcerpc_samr_GetUserPwInfo(join->p, join, &pwp);
 218         if (NT_STATUS_IS_OK(status)) {
 219                 policy_min_pw_len = pwp.out.info.min_password_length;
 220         }
 221
 222         random_pw = generate_random_str(join, MAX(8, policy_min_pw_len));
 223
 224         printf("Setting account password '%s'\n", random_pw);
 225
 226         s.in.user_handle = &join->user_handle;
 227         s.in.info = &u;
 228         s.in.level = 24;
 229
 230         encode_pw_buffer(u.info24.password.data, random_pw, STR_UNICODE);
 231         u.info24.pw_len = strlen(random_pw);
 232
 233         status = dcerpc_fetch_session_key(join->p, &session_key);
 234         if (!NT_STATUS_IS_OK(status)) {
 235                 printf("SetUserInfo level %u - no session key - %s\n",
 236                        s.in.level, nt_errstr(status));
 237                 torture_leave_domain(join);
 238                 goto failed;
 239         }
 240
 241         arcfour_crypt_blob(u.info24.password.data, 516, &session_key);
 242
 243         status = dcerpc_samr_SetUserInfo(join->p, join, &s);
 244         if (!NT_STATUS_IS_OK(status)) {
 245                 printf("SetUserInfo failed - %s\n", nt_errstr(status));
 246                 goto failed;
 247         }
 248
 249         ZERO_STRUCT(u);
 250         s.in.user_handle = &join->user_handle;
 251         s.in.info = &u;
 252         s.in.level = 21;
 253
 254         u.info21.acct_flags = acct_type;
 255         u.info21.fields_present = SAMR_FIELD_ACCT_FLAGS | SAMR_FIELD_DESCRIPTION | SAMR_FIELD_COMMENT | SAMR_FIELD_FULL_NAME;
 256
 257         u.info21.comment.string = talloc_asprintf(join,
 258                                                   "Tortured by Samba4: %s",
 259                                                   timestring(join, time(NULL)));
 260
 261         u.info21.full_name.string = talloc_asprintf(join,
 262                                                     "Torture account for Samba4: %s",
 263                                                     timestring(join, time(NULL)));
 264
 265         u.info21.description.string = talloc_asprintf(join,
 266                                          "Samba4 torture account created by host %s: %s",
 267                                          lp_netbios_name(), timestring(join, time(NULL)));
 268
 269         printf("Resetting ACB flags, force pw change time\n");
 270
 271         status = dcerpc_samr_SetUserInfo(join->p, join, &s);
 272         if (!NT_STATUS_IS_OK(status)) {
 273                 printf("SetUserInfo failed - %s\n", nt_errstr(status));
 274                 goto failed;
 275         }
 276
 277         if (random_password) {
 278                 *random_password = random_pw;
 279         }
 280
 281         return join;
 282
 283 failed:
 284         torture_leave_domain(join);
 285         return NULL;
 286 }
 287
 288
 289 _PUBLIC_ struct test_join *torture_join_domain(const char *machine_name,
 290                                       uint32_t acct_flags,
 291                                       struct cli_credentials **machine_credentials)
 292 {
 293         NTSTATUS status;
 294         struct libnet_context *libnet_ctx;
 295         struct libnet_JoinDomain *libnet_r;
 296         struct test_join *tj;
 297         struct samr_SetUserInfo s;
 298         union samr_UserInfo u;
 299
 300         tj = talloc(NULL, struct test_join);
 301         if (!tj) return NULL;
 302
 303         libnet_r = talloc(tj, struct libnet_JoinDomain);
 304         if (!libnet_r) {
 305                 talloc_free(tj);
 306                 return NULL;
 307         }
 308
 309         libnet_ctx = libnet_context_init(NULL);
 310         if (!libnet_ctx) {
 311                 talloc_free(tj);
 312                 return NULL;
 313         }
 314
 315         tj->libnet_r = libnet_r;
 316
 317         libnet_ctx->cred = cmdline_credentials;
 318         libnet_r->in.binding = lp_parm_string(-1, "torture", "binding");
 319         if (!libnet_r->in.binding) {
 320                 libnet_r->in.binding = talloc_asprintf(libnet_r, "ncacn_np:%s", lp_parm_string(-1, "torture", "host"));
 321         }
 322         libnet_r->in.level = LIBNET_JOINDOMAIN_SPECIFIED;
 323         libnet_r->in.netbios_name = machine_name;
 324         libnet_r->in.account_name = talloc_asprintf(libnet_r, "%s$", machine_name);
 325         if (!libnet_r->in.account_name) {
 326                 talloc_free(tj);
 327                 return NULL;
 328         }
 329
 330         libnet_r->in.acct_type = acct_flags;
 331         libnet_r->in.recreate_account = True;
 332
 333         status = libnet_JoinDomain(libnet_ctx, libnet_r, libnet_r);
 334         if (!NT_STATUS_IS_OK(status)) {
 335                 if (libnet_r->out.error_string) {
 336                         DEBUG(0, ("Domain join failed - %s\n", libnet_r->out.error_string));
 337                 } else {
 338                         DEBUG(0, ("Domain join failed - %s\n", nt_errstr(status)));
 339                 }
 340                 talloc_free(tj);
 341                 return NULL;
 342         }
 343         tj->p = libnet_r->out.samr_pipe;
 344         tj->user_handle = *libnet_r->out.user_handle;
 345         tj->dom_sid = libnet_r->out.domain_sid;
 346         talloc_steal(tj, libnet_r->out.domain_sid);
 347         tj->dom_netbios_name    = libnet_r->out.domain_name;
 348         talloc_steal(tj, libnet_r->out.domain_name);
 349         tj->dom_dns_name        = libnet_r->out.realm;
 350         talloc_steal(tj, libnet_r->out.realm);
 351         tj->user_guid = libnet_r->out.account_guid;
 352         tj->netbios_name = talloc_strdup(tj, machine_name);
 353         if (!tj->netbios_name) {
 354                 talloc_free(tj);
 355                 return NULL;
 356         }
 357
 358         ZERO_STRUCT(u);
 359         s.in.user_handle = &tj->user_handle;
 360         s.in.info = &u;
 361         s.in.level = 21;
 362
 363         u.info21.fields_present = SAMR_FIELD_DESCRIPTION | SAMR_FIELD_COMMENT | SAMR_FIELD_FULL_NAME;
 364         u.info21.comment.string = talloc_asprintf(tj,
 365                                                   "Tortured by Samba4: %s",
 366                                                   timestring(tj, time(NULL)));
 367         u.info21.full_name.string = talloc_asprintf(tj,
 368                                                     "Torture account for Samba4: %s",
 369                                                     timestring(tj, time(NULL)));
 370
 371         u.info21.description.string = talloc_asprintf(tj,
 372                                                       "Samba4 torture account created by host %s: %s",
 373                                                       lp_netbios_name(), timestring(tj, time(NULL)));
 374
 375         status = dcerpc_samr_SetUserInfo(tj->p, tj, &s);
 376         if (!NT_STATUS_IS_OK(status)) {
 377                 printf("SetUserInfo (non-critical) failed - %s\n", nt_errstr(status));
 378         }
 379
 380         *machine_credentials = cli_credentials_init(tj);
 381         cli_credentials_set_conf(*machine_credentials);
 382         cli_credentials_set_workstation(*machine_credentials, machine_name, CRED_SPECIFIED);
 383         cli_credentials_set_domain(*machine_credentials, libnet_r->out.domain_name, CRED_SPECIFIED);
 384         if (libnet_r->out.realm) {
 385                 cli_credentials_set_realm(*machine_credentials, libnet_r->out.realm, CRED_SPECIFIED);
 386         }
 387         cli_credentials_set_username(*machine_credentials, libnet_r->in.account_name, CRED_SPECIFIED);
 388         cli_credentials_set_password(*machine_credentials, libnet_r->out.join_password, CRED_SPECIFIED);
 389         if (acct_flags & ACB_SVRTRUST) {
 390                 cli_credentials_set_secure_channel_type(*machine_credentials,
 391                                                         SEC_CHAN_BDC);
 392         } else if (acct_flags & ACB_WSTRUST) {
 393                 cli_credentials_set_secure_channel_type(*machine_credentials,
 394                                                         SEC_CHAN_WKSTA);
 395         } else {
 396                 DEBUG(0, ("Invalid account type specificed to torture_join_domain\n"));
 397                 talloc_free(*machine_credentials);
 398                 return NULL;
 399         }
 400
 401         return tj;
 402 }
 403
 404 struct dcerpc_pipe *torture_join_samr_pipe(struct test_join *join)
 405 {
 406         return join->p;
 407 }
 408
 409 struct policy_handle *torture_join_samr_user_policy(struct test_join *join)
 410 {
 411         return &join->user_handle;
 412 }
 413
 414 NTSTATUS torture_leave_ads_domain(TALLOC_CTX *mem_ctx, struct libnet_JoinDomain *libnet_r)
 415 {
 416         int rtn;
 417         TALLOC_CTX *tmp_ctx;
 418
 419         struct ldb_dn *server_dn;
 420         struct ldb_context *ldb_ctx;
 421
 422         char *remote_ldb_url;
 423
 424         /* Check if we are a domain controller. If not, exit. */
 425         if (!libnet_r->out.server_dn_str) {
 426                 return NT_STATUS_OK;
 427         }
 428
 429         tmp_ctx = talloc_named(mem_ctx, 0, "torture_leave temporary context");
 430         if (!tmp_ctx) {
 431                 libnet_r->out.error_string = NULL;
 432                 return NT_STATUS_NO_MEMORY;
 433         }
 434
 435         ldb_ctx = ldb_init(tmp_ctx);
 436         if (!ldb_ctx) {
 437                 libnet_r->out.error_string = NULL;
 438                 talloc_free(tmp_ctx);
 439                 return NT_STATUS_NO_MEMORY;
 440         }
 441
 442         /* Remove CN=Servers,... entry from the AD. */
 443         server_dn = ldb_dn_new(tmp_ctx, ldb_ctx, libnet_r->out.server_dn_str);
 444         if (! ldb_dn_validate(server_dn)) {
 445                 libnet_r->out.error_string = NULL;
 446                 talloc_free(tmp_ctx);
 447                 return NT_STATUS_NO_MEMORY;
 448         }
 449
 450         remote_ldb_url = talloc_asprintf(tmp_ctx, "ldap://%s", libnet_r->out.samr_binding->host);
 451         if (!remote_ldb_url) {
 452                 libnet_r->out.error_string = NULL;
 453                 talloc_free(tmp_ctx);
 454                 return NT_STATUS_NO_MEMORY;
 455         }
 456
 457         ldb_set_opaque(ldb_ctx, "credentials", cmdline_credentials);
 458
 459         rtn = ldb_connect(ldb_ctx, remote_ldb_url, 0, NULL);
 460         if (rtn != 0) {
 461                 libnet_r->out.error_string = NULL;
 462                 talloc_free(tmp_ctx);
 463                 return NT_STATUS_UNSUCCESSFUL;
 464         }
 465
 466         rtn = ldb_delete(ldb_ctx, server_dn);
 467         if (rtn != 0) {
 468                 libnet_r->out.error_string = NULL;
 469                 talloc_free(tmp_ctx);
 470                 return NT_STATUS_UNSUCCESSFUL;
 471         }
 472
 473         DEBUG(0, ("%s removed successfully.\n", libnet_r->out.server_dn_str));
 474
 475         talloc_free(tmp_ctx);
 476         return NT_STATUS_OK;
 477 }
 478
 479 /*
 480   leave the domain, deleting the machine acct
 481 */
 482
 483 _PUBLIC_ void torture_leave_domain(struct test_join *join)
 484 {
 485         struct samr_DeleteUser d;
 486         NTSTATUS status;
 487
 488         if (!join) {
 489                 return;
 490         }
 491         d.in.user_handle = &join->user_handle;
 492         d.out.user_handle = &join->user_handle;
 493
 494         /* Delete machine account */
 495         status = dcerpc_samr_DeleteUser(join->p, join, &d);
 496         if (!NT_STATUS_IS_OK(status)) {
 497                 printf("Delete of machine account failed\n");
 498         } else {
 499                 printf("Delete of machine account was successful.\n");
 500         }
 501
 502         if (join->libnet_r) {
 503                 status = torture_leave_ads_domain(join, join->libnet_r);
 504         }
 505
 506         talloc_free(join);
 507 }
 508
 509 /*
 510   return the dom sid for a test join
 511 */
 512 _PUBLIC_ const struct dom_sid *torture_join_sid(struct test_join *join)
 513 {
 514         return join->dom_sid;
 515 }
 516
 517 const struct dom_sid *torture_join_user_sid(struct test_join *join)
 518 {
 519         return join->user_sid;
 520 }
 521
 522 const char *torture_join_netbios_name(struct test_join *join)
 523 {
 524         return join->netbios_name;
 525 }
 526
 527 const struct GUID *torture_join_user_guid(struct test_join *join)
 528 {
 529         return &join->user_guid;
 530 }
 531
 532 const char *torture_join_dom_netbios_name(struct test_join *join)
 533 {
 534         return join->dom_netbios_name;
 535 }
 536
 537 const char *torture_join_dom_dns_name(struct test_join *join)
 538 {
 539         return join->dom_dns_name;
 540 }
 541
 542
 543 struct test_join_ads_dc {
 544         struct test_join *join;
 545 };
 546
 547 struct test_join_ads_dc *torture_join_domain_ads_dc(const char *machine_name,
 548                                                     const char *domain,
 549                                                     struct cli_credentials **machine_credentials)
 550 {
 551         struct test_join_ads_dc *join;
 552
 553         join = talloc(NULL, struct test_join_ads_dc);
 554         if (join == NULL) {
 555                 return NULL;
 556         }
 557
 558         join->join = torture_join_domain(machine_name,
 559                                         ACB_SVRTRUST,
 560                                         machine_credentials);
 561
 562         if (!join->join) {
 563                 return NULL;
 564         }
 565
 566 /* W2K: */
 567         /* W2K: modify userAccountControl from 4096 to 532480 */
 568
 569         /* W2K: modify RDN to OU=Domain Controllers and skip the $ from server name */
 570
 571         /* ask objectVersion of Schema Partition */
 572
 573         /* ask rIDManagerReferenz of the Domain Partition */
 574
 575         /* ask fsMORoleOwner of the RID-Manager$ object
 576          * returns CN=NTDS Settings,CN=<DC>,CN=Servers,CN=Default-First-Site-Name, ...
 577          */
 578
 579         /* ask for dnsHostName of CN=<DC>,CN=Servers,CN=Default-First-Site-Name, ... */
 580
 581         /* ask for objectGUID of CN=NTDS Settings,CN=<DC>,CN=Servers,CN=Default-First-Site-Name, ... */
 582
 583         /* ask for * of CN=Default-First-Site-Name, ... */
 584
 585         /* search (&(|(objectClass=user)(objectClass=computer))(sAMAccountName=<machine_name>$)) in Domain Partition
 586          * attributes : distinguishedName, userAccountControl
 587          */
 588
 589         /* ask * for CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
 590          * should fail with noSuchObject
 591          */
 592
 593         /* add CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
 594          *
 595          * objectClass = server
 596          * systemFlags = 50000000
 597          * serverReferenz = CN=<machine_name>,OU=Domain Controllers,...
 598          */
 599
 600         /* ask for * of CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
 601          * should fail with noSuchObject
 602          */
 603
 604         /* search for (ncname=<domain_nc>) in CN=Partitions,CN=Configuration,...
 605          * attributes: ncName, dnsRoot
 606          */
 607
 608         /* modify add CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
 609          * serverReferenz = CN=<machine_name>,OU=Domain Controllers,...
 610          * should fail with attributeOrValueExists
 611          */
 612
 613         /* modify replace CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
 614          * serverReferenz = CN=<machine_name>,OU=Domain Controllers,...
 615          */
 616
 617         /* DsAddEntry to create the CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
 618          *
 619          */
 620
 621         /* replicate CN=Schema,CN=Configuration,...
 622          * using DRSUAPI_DS_BIND_GUID_W2K ("6abec3d1-3054-41c8-a362-5a0c5b7d5d71")
 623          *
 624          */
 625
 626         /* replicate CN=Configuration,...
 627          * using DRSUAPI_DS_BIND_GUID_W2K ("6abec3d1-3054-41c8-a362-5a0c5b7d5d71")
 628          *
 629          */
 630
 631         /* replicate Domain Partition
 632          * using DRSUAPI_DS_BIND_GUID_W2K ("6abec3d1-3054-41c8-a362-5a0c5b7d5d71")
 633          *
 634          */
 635
 636         /* call DsReplicaUpdateRefs() for all partitions like this:
 637          *     req1: struct drsuapi_DsReplicaUpdateRefsRequest1
 638          *           naming_context           : *
 639          *                 naming_context: struct drsuapi_DsReplicaObjectIdentifier
 640          *                     __ndr_size               : 0x000000ae (174)
 641          *                     __ndr_size_sid           : 0x00000000 (0)
 642          *                     guid                     : 00000000-0000-0000-0000-000000000000
 643          *                     sid                      : S-0-0
 644          *                     dn                       : 'CN=Schema,CN=Configuration,DC=w2k3,DC=vmnet1,DC=vm,DC=base'
 645          *           dest_dsa_dns_name        : *
 646          *                 dest_dsa_dns_name        : '4a0df188-a0b8-47ea-bbe5-e614723f16dd._msdcs.w2k3.vmnet1.vm.base'
 647          *           dest_dsa_guid            : 4a0df188-a0b8-47ea-bbe5-e614723f16dd
 648          *           options                  : 0x0000001c (28)
 649          *                 0: DRSUAPI_DS_REPLICA_UPDATE_ASYNCHRONOUS_OPERATION
 650          *                 0: DRSUAPI_DS_REPLICA_UPDATE_WRITEABLE
 651          *                 1: DRSUAPI_DS_REPLICA_UPDATE_ADD_REFERENCE
 652          *                 1: DRSUAPI_DS_REPLICA_UPDATE_DELETE_REFERENCE
 653          *                 1: DRSUAPI_DS_REPLICA_UPDATE_0x00000010
 654          *
 655          * 4a0df188-a0b8-47ea-bbe5-e614723f16dd is the objectGUID the DsAddEntry() returned for the
 656          * CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
 657          */
 658
 659 /* W2K3: */
 660         /*
 661          * lookup DC:
 662          * - using nbt name<1C> request and a samlogon mailslot request
 663          * or
 664          * - using a DNS SRV _ldap._tcp.dc._msdcs. request and a CLDAP netlogon request
 665          */
 666         /*
 667          * Open 1st LDAP connection to the DC using admin credentials
 668          */
 669
 670         /*
 671          * LDAP search 1st LDAP connection:
 672          *
 673          * Request:
 674          *      basedn: ""
 675          *      scope:  base
 676          *      filter: (objectClass=*)
 677          *      attrs:  *
 678          * Result:
 679          *      ""
 680          *              currentTime:            20061202155100.0Z
 681          *              subschemaSubentry:      CN=Aggregate,CN=Schema,CN=Configuration,<domain_partition>
 682          *              dsServiceName:          CN=<netbios_name>,CN=Servers,CN=<site_name>,CN=Sites,CN=Configuration,<domain_partition>
 683          *              namingContexts:         <domain_partition>
 684          *                                      CN=Configuration,<domain_partition>
 685          *                                      CN=Schema,CN=Configuration,<domain_partition>
 686          *              defaultNamingContext:   <domain_partition>
 687          *              schemaNamingContext:    CN=Schema,CN=Configuration,<domain_partition>
 688          *              configurationNamingContext:CN=Configuration,<domain_partition>
 689          *              rootDomainNamingContext:<domain_partition>
 690          *              supportedControl:       ...
 691          *              supportedLDAPVersion:   3
 692          *                                      2
 693          *              supportedLDAPPolicies:  ...
 694          *              highestCommitedUSN:     ...
 695          *              supportedSASLMechanisms:GSSAPI
 696          *                                      GSS-SPNEGO
 697          *                                      EXTERNAL
 698          *                                      DIGEST-MD5
 699          *              dnsHostName:            <dns_host_name>
 700          *              ldapServiceName:        <domain_dns_name>:<netbios_name>$@<REALM>
 701          *              serverName:             CN=Servers,CN=<site_name>,CN=Sites,CN=Configuration,<domain_partition>
 702          *              supportedCapabilities:  ...
 703          *              isSyncronized:          TRUE
 704          *              isGlobalCatalogReady:   TRUE
 705          *              domainFunctionality:    0
 706          *              forestFunctionality:    0
 707          *              domainControllerFunctionality: 2
 708          */
 709
 710         /*
 711          * LDAP search 1st LDAP connection:
 712          *
 713          * Request:
 714          *      basedn: CN=Configuration,<domain_partition>
 715          *      scope:  one
 716          *      filter: (cn=Partitions)
 717          *      attrs:  msDS-Behavior-Version
 718          * Result:
 719          *      CN=Partitions,CN=Configuration,<domain_partition>
 720          *              msDS-Behavior-Version:  0
 721          */
 722
 723         /*
 724          * LDAP search 1st LDAP connection:
 725          *
 726          * NOTE: this seems to be a bug! as the messageID of the LDAP message is corrupted!
 727          *
 728          * Request:
 729          *      basedn: CN=Schema,CN=Configuration,<domain_partition>
 730          *      scope:  one
 731          *      filter: (cn=Partitions)
 732          *      attrs:  msDS-Behavior-Version
 733          * Result:
 734          *      <none>
 735          *
 736          */
 737
 738         /*
 739          * LDAP search 1st LDAP connection:
 740          *
 741          * Request:
 742          *      basedn: <domain_partition>
 743          *      scope:  base
 744          *      filter: (objectClass=*)
 745          *      attrs:  msDS-Behavior-Version
 746          * Result:
 747          *      <domain_partition>
 748          *              msDS-Behavior-Version:  0
 749          */
 750
 751         /*
 752          * LDAP search 1st LDAP connection:
 753          *
 754          * Request:
 755          *      basedn: CN=Schema,CN=Configuration,<domain_partition>
 756          *      scope:  base
 757          *      filter: (objectClass=*)
 758          *      attrs:  objectVersion
 759          * Result:
 760          *      CN=Schema,CN=Configuration,<domain_partition>
 761          *              objectVersion:  30
 762          */
 763
 764         /*
 765          * LDAP search 1st LDAP connection:
 766          *
 767          * Request:
 768          *      basedn: ""
 769          *      scope:  base
 770          *      filter: (objectClass=*)
 771          *      attrs:  defaultNamingContext
 772          *              dnsHostName
 773          * Result:
 774          *      ""
 775          *              defaultNamingContext:   <domain_partition>
 776          *              dnsHostName:            <dns_host_name>
 777          */
 778
 779         /* START: Infrastructure FSMO */
 780         /*
 781          * LDAP search 1st LDAP connection:
 782          *
 783          * Request:
 784          *      basedn: <WKGUID=2fbac1870ade11d297c400c04fd8d5cd,domain_partition>
 785          *      scope:  base
 786          *      filter: (objectClass=*)
 787          *      attrs:  1.1
 788          * Result:
 789          *      CN=Infrastructure,<domain_partition>
 790          */
 791
 792         /*
 793          * LDAP search 1st LDAP connection:
 794          *
 795          * Request:
 796          *      basedn: CN=Windows2003Update,CN=DomainUpdates,CN=System,<domain_partition>
 797          *      scope:  base
 798          *      filter: (objectClass=*)
 799          *      attrs:  revision
 800          * Result:
 801          *      CN=Windows2003Update,CN=DomainUpdates,CN=System,<domain_partition>
 802          *              revision:       8
 803          */
 804
 805         /*
 806          * LDAP search 1st LDAP connection:
 807          *
 808          * Request:
 809          *      basedn: CN=Infrastructure,<domain_partition>
 810          *      scope:  base
 811          *      filter: (objectClass=*)
 812          *      attrs:  fSMORoleOwner
 813          * Result:
 814          *      CN=Infrastructure,<domain_partition>
 815          *              fSMORoleOwner:  CN=NTDS Settings,<infrastructure_fsmo_server_object>
 816          */
 817
 818         /*
 819          * LDAP search 1st LDAP connection:
 820          *
 821          * Request:
 822          *      basedn: <infrastructure_fsmo_server_object>
 823          *      scope:  base
 824          *      filter: (objectClass=*)
 825          *      attrs:  dnsHostName
 826          * Result:
 827          *      <infrastructure_fsmo_server_object>
 828          *              dnsHostName:    <dns_host_name>
 829          */
 830
 831         /*
 832          * LDAP search 1st LDAP connection:
 833          *
 834          * Request:
 835          *      basedn: CN=NTDS Settings,<infrastructure_fsmo_server_object>
 836          *      scope:  base
 837          *      filter: (objectClass=*)
 838          *      attrs:  objectGUID
 839          * Result:
 840          *      CN=NTDS Settings,<infrastructure_fsmo_server_object>
 841          *              objectGUID:     <object_guid>
 842          */
 843         /* END: Infrastructure FSMO */
 844
 845         /* START: RID Manager FSMO */
 846         /*
 847          * LDAP search 1st LDAP connection:
 848          *
 849          * Request:
 850          *      basedn: <domain_partition>
 851          *      scope:  base
 852          *      filter: (objectClass=*)
 853          *      attrs:  rIDManagerReference
 854          * Result:
 855          *      <domain_partition>
 856          *              rIDManagerReference:    CN=RID Manager$,CN=System,<domain_partition>
 857          */
 858
 859         /*
 860          * LDAP search 1st LDAP connection:
 861          *
 862          * Request:
 863          *      basedn: CN=RID Manager$,CN=System,<domain_partition>
 864          *      scope:  base
 865          *      filter: (objectClass=*)
 866          *      attrs:  fSMORoleOwner
 867          * Result:
 868          *      CN=Infrastructure,<domain_partition>
 869          *              fSMORoleOwner:  CN=NTDS Settings,<rid_manager_fsmo_server_object>
 870          */
 871
 872         /*
 873          * LDAP search 1st LDAP connection:
 874          *
 875          * Request:
 876          *      basedn: <rid_manager_fsmo_server_object>
 877          *      scope:  base
 878          *      filter: (objectClass=*)
 879          *      attrs:  dnsHostName
 880          * Result:
 881          *      <rid_manager_fsmo_server_object>
 882          *              dnsHostName:    <dns_host_name>
 883          */
 884
 885         /*
 886          * LDAP search 1st LDAP connection:
 887          *
 888          * Request:
 889          *      basedn: CN=NTDS Settings,<rid_manager_fsmo_server_object>
 890          *      scope:  base
 891          *      filter: (objectClass=*)
 892          *      attrs:  msDs-ReplicationEpoch
 893          * Result:
 894          *      CN=NTDS Settings,<rid_manager_fsmo_server_object>
 895          */
 896         /* END: RID Manager FSMO */
 897
 898         /*
 899          * LDAP search 1st LDAP connection:
 900          *
 901          * Request:
 902          *      basedn: CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
 903          *      scope:  base
 904          *      filter: (objectClass=*)
 905          *      attrs:
 906          * Result:
 907          *      CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
 908          *              objectClass:    top
 909          *                              site
 910          *              cn:             <new_dc_site_name>
 911          *              distinguishedName:CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
 912          *              instanceType:   4
 913          *              whenCreated:    ...
 914          *              whenChanged:    ...
 915          *              uSNCreated:     ...
 916          *              uSNChanged:     ...
 917          *              showInAdvancedViewOnly: TRUE
 918          *              name:           <new_dc_site_name>
 919          *              objectGUID:     <object_guid>
 920          *              systemFlags:    1107296256 <0x42000000>
 921          *              objectCategory: CN=Site,C=Schema,CN=Configuration,<domain_partition>
 922          */
 923
 924         /*
 925          * LDAP search 1st LDAP connection:
 926          *
 927          * Request:
 928          *      basedn: <domain_partition>
 929          *      scope:  sub
 930          *      filter: (&(|(objectClass=user)(objectClass=computer))(sAMAccountName=<new_dc_account_name>))
 931          *      attrs:  distinguishedName
 932          *              userAccountControl
 933          * Result:
 934          *      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 935          *              distinguishedName:      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 936          *              userAccoountControl:    4096 <0x1000>
 937          */
 938
 939         /*
 940          * LDAP search 1st LDAP connection:
 941          *
 942          * Request:
 943          *      basedn: CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
 944          *      scope:  base
 945          *      filter: (objectClass=*)
 946          *      attrs:
 947          * Result:
 948          *      <noSuchObject>
 949          *      <matchedDN:CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>>
 950          */
 951
 952         /*
 953          * LDAP search 1st LDAP connection:
 954          *
 955          * Request:
 956          *      basedn: CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 957          *      scope:  base
 958          *      filter: (objectClass=*)
 959          *      attrs:  serverReferenceBL
 960          *      typesOnly: TRUE!!!
 961          * Result:
 962          *      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 963          */
 964
 965         /*
 966          * LDAP add 1st LDAP connection:
 967          *
 968          * Request:
 969          *      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 970          *      objectClass:    server
 971          *      systemFlags:    50000000 <0x2FAF080>
 972          *      serverReference:CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 973          * Result:
 974          *      <success>
 975          */
 976
 977         /*
 978          * LDAP search 1st LDAP connection:
 979          *
 980          * Request:
 981          *      basedn: CN=NTDS Settings,CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
 982          *      scope:  base
 983          *      filter: (objectClass=*)
 984          *      attrs:
 985          * Result:
 986          *      <noSuchObject>
 987          *      <matchedDN:CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>>
 988          */
 989
 990         /*
 991          * LDAP search 1st LDAP connection:
 992          *
 993          * Request:
 994          *      basedn: CN=Partitions,CN=Configuration,<domain_partition>
 995          *      scope:  sub
 996          *      filter: (nCName=<domain_partition>)
 997          *      attrs:  nCName
 998          *              dnsRoot
 999          *      controls: LDAP_SERVER_EXTENDED_DN_OID:critical=false
1000          * Result:
1001          *      <GUID=<hex_guid>>;CN=<domain_netbios_name>,CN=Partitions,<domain_partition>>
1002          *              nCName:         <GUID=<hex_guid>>;<SID=<hex_sid>>;<domain_partition>>
1003          *              dnsRoot:        <domain_dns_name>
1004          */
1005
1006         /*
1007          * LDAP modify 1st LDAP connection:
1008          *
1009          * Request (add):
1010          *      CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>>
1011          *      serverReference:CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
1012          * Result:
1013          *      <attributeOrValueExist>
1014          */
1015
1016         /*
1017          * LDAP modify 1st LDAP connection:
1018          *
1019          * Request (replace):
1020          *      CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>>
1021          *      serverReference:CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
1022          * Result:
1023          *      <success>
1024          */
1025
1026         /*
1027          * Open 1st DRSUAPI connection to the DC using admin credentials
1028          * DsBind with DRSUAPI_DS_BIND_GUID_W2K3 ("6afab99c-6e26-464a-975f-f58f105218bc")
1029          * (w2k3 does 2 DsBind() calls here..., where is first is unused and contains garbage at the end)
1030          */
1031
1032         /*
1033          * DsAddEntry to create the CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
1034          * on the 1st DRSUAPI connection
1035          */
1036
1037         /*
1038          * Open 2nd and 3rd DRSUAPI connection to the DC using admin credentials
1039          * - a DsBind with DRSUAPI_DS_BIND_GUID_W2K3 ("6afab99c-6e26-464a-975f-f58f105218bc")
1040          *   on the 2nd connection
1041          */
1042
1043         /*
1044          * replicate CN=Schema,CN=Configuration,...
1045          * on the 3rd DRSUAPI connection and the bind_handle from the 2nd connection
1046          */
1047
1048         /*
1049          * replicate CN=Configuration,...
1050          * on the 3rd DRSUAPI connection and the bind_handle from the 2nd connection
1051          */
1052
1053         /*
1054          * LDAP unbind on the 1st LDAP connection
1055          */
1056
1057         /*
1058          * Open 2nd LDAP connection to the DC using admin credentials
1059          */
1060         /* ldap modify userAccountControl from 4096 to 532480 */
1061
1062         /* ldap modify RDN to OU=Domain Controllers and skip the $ from server name */
1063
1064         /*
1065          * replicate Domain Partition
1066          * on the 3rd DRSUAPI connection and the bind_handle from the 2nd connection
1067          */
1068
1069         /* call DsReplicaUpdateRefs() for all partitions like this:
1070          *     req1: struct drsuapi_DsReplicaUpdateRefsRequest1
1071          *           naming_context           : *
1072          *                 naming_context: struct drsuapi_DsReplicaObjectIdentifier
1073          *                     __ndr_size               : 0x000000ae (174)
1074          *                     __ndr_size_sid           : 0x00000000 (0)
1075          *                     guid                     : 00000000-0000-0000-0000-000000000000
1076          *                     sid                      : S-0-0
1077          *                     dn                       : 'CN=Schema,CN=Configuration,DC=w2k3,DC=vmnet1,DC=vm,DC=base'
1078          *           dest_dsa_dns_name        : *
1079          *                 dest_dsa_dns_name        : '4a0df188-a0b8-47ea-bbe5-e614723f16dd._msdcs.w2k3.vmnet1.vm.base'
1080          *           dest_dsa_guid            : 4a0df188-a0b8-47ea-bbe5-e614723f16dd
1081          *           options                  : 0x0000001c (28)
1082          *                 0: DRSUAPI_DS_REPLICA_UPDATE_ASYNCHRONOUS_OPERATION
1083          *                 0: DRSUAPI_DS_REPLICA_UPDATE_WRITEABLE
1084          *                 1: DRSUAPI_DS_REPLICA_UPDATE_ADD_REFERENCE
1085          *                 1: DRSUAPI_DS_REPLICA_UPDATE_DELETE_REFERENCE
1086          *                 1: DRSUAPI_DS_REPLICA_UPDATE_0x00000010
1087          *
1088          * 4a0df188-a0b8-47ea-bbe5-e614723f16dd is the objectGUID the DsAddEntry() returned for the
1089          * CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
1090          * on the 2nd!!! DRSUAPI connection
1091          */
1092
1093         /*
1094          * Windows does opens the 4th and 5th DRSUAPI connection...
1095          * and does a DsBind() with the objectGUID from DsAddEntry() as bind_guid
1096          * on the 4th connection
1097          *
1098          * and then 2 full replications of the domain partition on the 5th connection
1099          * with the bind_handle from the 4th connection
1100          */
1101         return join;
1102 }
1103
1104 void torture_leave_domain_ads_dc(struct test_join_ads_dc *join)
1105 {
1106 /* W2K3: */
1107         /*
1108          * lookup DC:
1109          * - using nbt name<1C> request and a samlogon mailslot request
1110          * or
1111          * - using a DNS SRV _ldap._tcp.dc._msdcs. request and a CLDAP netlogon request
1112          */
1113         /*
1114          * Open 1st LDAP connection to the DC using admin credentials
1115          */
1116
1117         /*
1118          * LDAP search 1st LDAP connection:
1119          *
1120          * Request:
1121          *      basedn: ""
1122          *      scope:  base
1123          *      filter: (objectClass=*)
1124          *      attrs:  defaultNamingContext
1125          *              configurationNamingContext
1126          * Result:
1127          *      ""
1128          *              defaultNamingContext:   <domain_partition>
1129          *              configurationNamingContext:CN=Configuration,<domain_partition>
1130          */
1131
1132         /*
1133          * LDAP search 1st LDAP connection:
1134          *
1135          * Request:
1136          *      basedn: <domain_partition>
1137          *      scope:  sub
1138          *      filter: (&(|(objectClass=user)(objectClass=computer))(sAMAccountName=<new_dc_account_name>))
1139          *      attrs:  distinguishedName
1140          *              userAccountControl
1141          * Result:
1142          *      CN=<new_dc_netbios_name>,CN=Domain Controllers,<domain_partition>
1143          *              distinguishedName:      CN=<new_dc_netbios_name>,CN=Domain Controllers,<domain_partition>
1144          *              userAccoountControl:    532480 <0x82000>
1145          */
1146
1147         /*
1148          * LDAP search 1st LDAP connection:
1149          *
1150          * Request:
1151          *      basedn: CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
1152          *      scope:  base
1153          *      filter: (objectClass=*)
1154          *      attrs:  userAccountControl
1155          * Result:
1156          *      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
1157          *              userAccoountControl:    532480 <0x82000>
1158          */
1159
1160         /*
1161          * LDAP modify 1st LDAP connection:
1162          *
1163          * Request (replace):
1164          *      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
1165          *      userAccoountControl:    4096 <0x1000>
1166          * Result:
1167          *      <success>
1168          */
1169
1170         /*
1171          * LDAP search 1st LDAP connection:
1172          *
1173          * Request:
1174          *      basedn: <WKGUID=aa312825768811d1aded00c04fd8d5cd,<domain_partition>>
1175          *      scope:  base
1176          *      filter: (objectClass=*)
1177          *      attrs:  1.1
1178          * Result:
1179          *      CN=Computers,<domain_partition>
1180          */
1181
1182         /*
1183          * LDAP search 1st LDAP connection:
1184          *
1185          * Request:
1186          *      basedn: CN=Computers,<domain_partition>
1187          *      scope:  base
1188          *      filter: (objectClass=*)
1189          *      attrs:  distinguishedName
1190          * Result:
1191          *      CN=Computers,<domain_partition>
1192          *              distinguishedName:      CN=Computers,<domain_partition>
1193          */
1194
1195         /*
1196          * LDAP modifyRDN 1st LDAP connection:
1197          *
1198          * Request:
1199          *      entry:          CN=<new_dc_netbios_name>,CN=Domain Controllers,<domain_partition>
1200          *      newrdn:         CN=<new_dc_netbios_name>
1201          *      deleteoldrdn:   TRUE
1202          *      newparent:      CN=Computers,<domain_partition>
1203          * Result:
1204          *      <success>
1205          */
1206
1207         /*
1208          * LDAP unbind on the 1st LDAP connection
1209          */
1210
1211         /*
1212          * Open 1st DRSUAPI connection to the DC using admin credentials
1213          * DsBind with DRSUAPI_DS_BIND_GUID ("e24d201a-4fd6-11d1-a3da-0000f875ae0d")
1214          */
1215
1216         /*
1217          * DsRemoveDsServer to remove the
1218          * CN=<machine_name>,CN=Servers,CN=<site_name>,CN=Configuration,<domain_partition>
1219          * and CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=<site_name>,CN=Configuration,<domain_partition>
1220          * on the 1st DRSUAPI connection
1221          */
1222
1223         /*
1224          * DsUnbind on the 1st DRSUAPI connection
1225          */
1226
1227         if (join->join) {
1228                 torture_leave_domain(join->join);
1229         }
1230
1231         talloc_free(join);
1232 }