2 Unix SMB/CIFS implementation.
4 test suite for netlogon PAC operations
6 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2012
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "auth/auth.h"
24 #include "auth/auth_sam_reply.h"
25 #include "auth/gensec/gensec.h"
26 #include "system/kerberos.h"
27 #include "auth/kerberos/kerberos.h"
28 #include "auth/credentials/credentials.h"
29 #include "auth/credentials/credentials_krb5.h"
30 #include "lib/cmdline/popt_common.h"
31 #include "torture/rpc/torture_rpc.h"
32 #include "libcli/auth/libcli_auth.h"
33 #include "libcli/security/security.h"
34 #include "librpc/gen_ndr/ndr_netlogon_c.h"
35 #include "librpc/gen_ndr/ndr_krb5pac.h"
36 #include "librpc/gen_ndr/ndr_samr_c.h"
37 #include "param/param.h"
39 #define TEST_MACHINE_NAME_BDC "torturepacbdc"
40 #define TEST_MACHINE_NAME_WKSTA "torturepacwksta"
41 #define TEST_MACHINE_NAME_WKSTA_DES "torturepacwkdes"
42 #define TEST_MACHINE_NAME_S2U4SELF_BDC "tests2u4selfbdc"
43 #define TEST_MACHINE_NAME_S2U4SELF_WKSTA "tests2u4selfwk"
46 struct PAC_SIGNATURE_DATA
*pac_srv_sig
;
47 struct PAC_SIGNATURE_DATA
*pac_kdc_sig
;
50 /* A helper function which avoids touching the local databases to
51 * generate the session info, as we just want to verify the PAC
52 * details, not the full local token */
53 static NTSTATUS
test_generate_session_info_pac(struct auth4_context
*auth_ctx
,
55 struct smb_krb5_context
*smb_krb5_context
,
57 const char *principal_name
,
58 const struct tsocket_address
*remote_address
,
59 uint32_t session_info_flags
,
60 struct auth_session_info
**session_info
)
63 struct auth_user_info_dc
*user_info_dc
;
65 struct pac_data
*pac_data
;
67 tmp_ctx
= talloc_named(mem_ctx
, 0, "gensec_gssapi_session_info context");
68 NT_STATUS_HAVE_NO_MEMORY(tmp_ctx
);
70 auth_ctx
->private_data
= pac_data
= talloc_zero(auth_ctx
, struct pac_data
);
72 pac_data
->pac_srv_sig
= talloc(tmp_ctx
, struct PAC_SIGNATURE_DATA
);
73 if (!pac_data
->pac_srv_sig
) {
75 return NT_STATUS_NO_MEMORY
;
77 pac_data
->pac_kdc_sig
= talloc(tmp_ctx
, struct PAC_SIGNATURE_DATA
);
78 if (!pac_data
->pac_kdc_sig
) {
80 return NT_STATUS_NO_MEMORY
;
83 nt_status
= kerberos_pac_blob_to_user_info_dc(tmp_ctx
,
85 smb_krb5_context
->krb5_context
,
87 pac_data
->pac_srv_sig
,
88 pac_data
->pac_kdc_sig
);
89 if (!NT_STATUS_IS_OK(nt_status
)) {
94 talloc_steal(pac_data
, pac_data
->pac_srv_sig
);
95 talloc_steal(pac_data
, pac_data
->pac_kdc_sig
);
97 if (user_info_dc
->info
->authenticated
) {
98 session_info_flags
|= AUTH_SESSION_INFO_AUTHENTICATED
;
101 session_info_flags
|= AUTH_SESSION_INFO_SIMPLE_PRIVILEGES
;
102 nt_status
= auth_generate_session_info(mem_ctx
,
105 user_info_dc
, session_info_flags
,
107 if (!NT_STATUS_IS_OK(nt_status
)) {
108 talloc_free(tmp_ctx
);
112 talloc_free(tmp_ctx
);
116 /* Check to see if we can pass the PAC across to the NETLOGON server for validation */
118 /* Also happens to be a really good one-step verfication of our Kerberos stack */
120 static bool test_PACVerify(struct torture_context
*tctx
,
121 struct dcerpc_pipe
*p
,
122 struct cli_credentials
*credentials
,
123 enum netr_SchannelType secure_channel_type
,
124 const char *test_machine_name
,
125 uint32_t negotiate_flags
)
129 struct netr_LogonSamLogon r
;
131 union netr_LogonLevel logon
;
132 union netr_Validation validation
;
133 uint8_t authoritative
;
134 struct netr_Authenticator return_authenticator
;
136 struct netr_GenericInfo generic
;
137 struct netr_Authenticator auth
, auth2
;
139 struct netlogon_creds_CredentialState
*creds
;
140 struct gensec_security
*gensec_client_context
;
141 struct gensec_security
*gensec_server_context
;
143 DATA_BLOB client_to_server
, server_to_client
, pac_wrapped
, payload
;
144 struct PAC_Validate pac_wrapped_struct
;
146 enum ndr_err_code ndr_err
;
148 struct auth4_context
*auth_context
;
149 struct auth_session_info
*session_info
;
150 struct pac_data
*pac_data
;
152 struct dcerpc_binding_handle
*b
= p
->binding_handle
;
153 TALLOC_CTX
*tmp_ctx
= talloc_new(tctx
);
154 torture_assert(tctx
, tmp_ctx
!= NULL
, "talloc_new() failed");
156 torture_comment(tctx
,
157 "Testing PAC Verify (secure_channel_type: %d, machine: %s, negotiate_flags: 0x%08x\n",
158 secure_channel_type
, test_machine_name
, negotiate_flags
);
160 if (!test_SetupCredentials2(p
, tctx
, negotiate_flags
,
161 credentials
, secure_channel_type
,
166 auth_context
= talloc_zero(tmp_ctx
, struct auth4_context
);
167 torture_assert(tctx
, auth_context
!= NULL
, "talloc_new() failed");
169 auth_context
->generate_session_info_pac
= test_generate_session_info_pac
;
171 status
= gensec_client_start(tctx
, &gensec_client_context
,
172 lpcfg_gensec_settings(tctx
, tctx
->lp_ctx
));
173 torture_assert_ntstatus_ok(tctx
, status
, "gensec_client_start (client) failed");
175 status
= gensec_set_target_hostname(gensec_client_context
, test_machine_name
);
177 status
= gensec_set_credentials(gensec_client_context
, cmdline_credentials
);
178 torture_assert_ntstatus_ok(tctx
, status
, "gensec_set_credentials (client) failed");
180 status
= gensec_start_mech_by_sasl_name(gensec_client_context
, "GSSAPI");
181 torture_assert_ntstatus_ok(tctx
, status
, "gensec_start_mech_by_sasl_name (client) failed");
183 status
= gensec_server_start(tctx
,
184 lpcfg_gensec_settings(tctx
, tctx
->lp_ctx
),
185 auth_context
, &gensec_server_context
);
186 torture_assert_ntstatus_ok(tctx
, status
, "gensec_server_start (server) failed");
188 status
= gensec_set_credentials(gensec_server_context
, credentials
);
189 torture_assert_ntstatus_ok(tctx
, status
, "gensec_set_credentials (server) failed");
191 status
= gensec_start_mech_by_sasl_name(gensec_server_context
, "GSSAPI");
192 torture_assert_ntstatus_ok(tctx
, status
, "gensec_start_mech_by_sasl_name (server) failed");
194 server_to_client
= data_blob(NULL
, 0);
197 /* Do a client-server update dance */
198 status
= gensec_update(gensec_client_context
, tmp_ctx
, tctx
->ev
, server_to_client
, &client_to_server
);
199 if (!NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {;
200 torture_assert_ntstatus_ok(tctx
, status
, "gensec_update (client) failed");
203 status
= gensec_update(gensec_server_context
, tmp_ctx
, tctx
->ev
, client_to_server
, &server_to_client
);
204 if (!NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {;
205 torture_assert_ntstatus_ok(tctx
, status
, "gensec_update (server) failed");
208 if (NT_STATUS_IS_OK(status
)) {
213 /* Extract the PAC using Samba's code */
215 status
= gensec_session_info(gensec_server_context
, gensec_server_context
, &session_info
);
216 torture_assert_ntstatus_ok(tctx
, status
, "gensec_session_info failed");
218 pac_data
= talloc_get_type(auth_context
->private_data
, struct pac_data
);
220 torture_assert(tctx
, pac_data
!= NULL
, "gensec_update failed to fill in pac_data in auth_context");
221 torture_assert(tctx
, pac_data
->pac_srv_sig
!= NULL
, "pac_srv_sig not present");
222 torture_assert(tctx
, pac_data
->pac_kdc_sig
!= NULL
, "pac_kdc_sig not present");
224 pac_wrapped_struct
.ChecksumLength
= pac_data
->pac_srv_sig
->signature
.length
;
225 pac_wrapped_struct
.SignatureType
= pac_data
->pac_kdc_sig
->type
;
226 pac_wrapped_struct
.SignatureLength
= pac_data
->pac_kdc_sig
->signature
.length
;
227 pac_wrapped_struct
.ChecksumAndSignature
= payload
228 = data_blob_talloc(tmp_ctx
, NULL
,
229 pac_wrapped_struct
.ChecksumLength
230 + pac_wrapped_struct
.SignatureLength
);
231 memcpy(&payload
.data
[0],
232 pac_data
->pac_srv_sig
->signature
.data
,
233 pac_wrapped_struct
.ChecksumLength
);
234 memcpy(&payload
.data
[pac_wrapped_struct
.ChecksumLength
],
235 pac_data
->pac_kdc_sig
->signature
.data
,
236 pac_wrapped_struct
.SignatureLength
);
238 ndr_err
= ndr_push_struct_blob(&pac_wrapped
, tmp_ctx
, &pac_wrapped_struct
,
239 (ndr_push_flags_fn_t
)ndr_push_PAC_Validate
);
240 torture_assert(tctx
, NDR_ERR_CODE_IS_SUCCESS(ndr_err
), "ndr_push_struct_blob of PACValidate structure failed");
242 torture_assert(tctx
, (creds
->negotiate_flags
& NETLOGON_NEG_ARCFOUR
), "not willing to even try a PACValidate without RC4 encryption");
243 if (creds
->negotiate_flags
& NETLOGON_NEG_SUPPORTS_AES
) {
244 netlogon_creds_aes_encrypt(creds
, pac_wrapped
.data
, pac_wrapped
.length
);
246 netlogon_creds_arcfour_crypt(creds
, pac_wrapped
.data
, pac_wrapped
.length
);
249 generic
.length
= pac_wrapped
.length
;
250 generic
.data
= pac_wrapped
.data
;
252 /* Validate it over the netlogon pipe */
254 generic
.identity_info
.parameter_control
= 0;
255 generic
.identity_info
.logon_id_high
= 0;
256 generic
.identity_info
.logon_id_low
= 0;
257 generic
.identity_info
.domain_name
.string
= session_info
->info
->domain_name
;
258 generic
.identity_info
.account_name
.string
= session_info
->info
->account_name
;
259 generic
.identity_info
.workstation
.string
= test_machine_name
;
261 generic
.package_name
.string
= "Kerberos";
263 logon
.generic
= &generic
;
266 netlogon_creds_client_authenticator(creds
, &auth
);
267 r
.in
.credential
= &auth
;
268 r
.in
.return_authenticator
= &auth2
;
270 r
.in
.logon_level
= NetlogonGenericInformation
;
271 r
.in
.server_name
= talloc_asprintf(tctx
, "\\\\%s", dcerpc_server_name(p
));
272 r
.in
.computer_name
= cli_credentials_get_workstation(credentials
);
273 r
.in
.validation_level
= NetlogonValidationGenericInfo2
;
274 r
.out
.validation
= &validation
;
275 r
.out
.authoritative
= &authoritative
;
276 r
.out
.return_authenticator
= &return_authenticator
;
278 torture_assert_ntstatus_ok(tctx
, dcerpc_netr_LogonSamLogon_r(b
, tctx
, &r
),
279 "LogonSamLogon failed");
281 torture_assert_ntstatus_ok(tctx
, r
.out
.result
, "LogonSamLogon failed");
283 /* This will break the signature nicely (even in the crypto wrapping), check we get a logon failure */
284 generic
.data
[generic
.length
-1]++;
286 logon
.generic
= &generic
;
289 netlogon_creds_client_authenticator(creds
, &auth
);
290 r
.in
.credential
= &auth
;
291 r
.in
.return_authenticator
= &auth2
;
292 r
.in
.logon_level
= NetlogonGenericInformation
;
294 r
.in
.server_name
= talloc_asprintf(tctx
, "\\\\%s", dcerpc_server_name(p
));
295 r
.in
.computer_name
= cli_credentials_get_workstation(credentials
);
296 r
.in
.validation_level
= NetlogonValidationGenericInfo2
;
298 torture_assert_ntstatus_ok(tctx
, dcerpc_netr_LogonSamLogon_r(b
, tctx
, &r
),
299 "LogonSamLogon failed");
301 torture_assert_ntstatus_equal(tctx
, r
.out
.result
, NT_STATUS_LOGON_FAILURE
, "LogonSamLogon failed");
303 torture_assert(tctx
, netlogon_creds_client_check(creds
, &r
.out
.return_authenticator
->cred
),
304 "Credential chaining failed");
306 /* This will break the parsing nicely (even in the crypto wrapping), check we get INVALID_PARAMETER */
309 logon
.generic
= &generic
;
312 netlogon_creds_client_authenticator(creds
, &auth
);
313 r
.in
.credential
= &auth
;
314 r
.in
.return_authenticator
= &auth2
;
315 r
.in
.logon_level
= NetlogonGenericInformation
;
317 r
.in
.server_name
= talloc_asprintf(tctx
, "\\\\%s", dcerpc_server_name(p
));
318 r
.in
.computer_name
= cli_credentials_get_workstation(credentials
);
319 r
.in
.validation_level
= NetlogonValidationGenericInfo2
;
321 torture_assert_ntstatus_ok(tctx
, dcerpc_netr_LogonSamLogon_r(b
, tctx
, &r
),
322 "LogonSamLogon failed");
324 torture_assert_ntstatus_equal(tctx
, r
.out
.result
, NT_STATUS_INVALID_PARAMETER
, "LogonSamLogon failed");
326 torture_assert(tctx
, netlogon_creds_client_check(creds
,
327 &r
.out
.return_authenticator
->cred
),
328 "Credential chaining failed");
330 pac_wrapped_struct
.ChecksumLength
= pac_data
->pac_srv_sig
->signature
.length
;
331 pac_wrapped_struct
.SignatureType
= pac_data
->pac_kdc_sig
->type
;
333 /* Break the SignatureType */
334 pac_wrapped_struct
.SignatureType
++;
336 pac_wrapped_struct
.SignatureLength
= pac_data
->pac_kdc_sig
->signature
.length
;
337 pac_wrapped_struct
.ChecksumAndSignature
= payload
338 = data_blob_talloc(tmp_ctx
, NULL
,
339 pac_wrapped_struct
.ChecksumLength
340 + pac_wrapped_struct
.SignatureLength
);
341 memcpy(&payload
.data
[0],
342 pac_data
->pac_srv_sig
->signature
.data
,
343 pac_wrapped_struct
.ChecksumLength
);
344 memcpy(&payload
.data
[pac_wrapped_struct
.ChecksumLength
],
345 pac_data
->pac_kdc_sig
->signature
.data
,
346 pac_wrapped_struct
.SignatureLength
);
348 ndr_err
= ndr_push_struct_blob(&pac_wrapped
, tmp_ctx
, &pac_wrapped_struct
,
349 (ndr_push_flags_fn_t
)ndr_push_PAC_Validate
);
350 torture_assert(tctx
, NDR_ERR_CODE_IS_SUCCESS(ndr_err
), "ndr_push_struct_blob of PACValidate structure failed");
352 torture_assert(tctx
, (creds
->negotiate_flags
& NETLOGON_NEG_ARCFOUR
), "not willing to even try a PACValidate without RC4 encryption");
353 if (creds
->negotiate_flags
& NETLOGON_NEG_SUPPORTS_AES
) {
354 netlogon_creds_aes_encrypt(creds
, pac_wrapped
.data
, pac_wrapped
.length
);
356 netlogon_creds_arcfour_crypt(creds
, pac_wrapped
.data
, pac_wrapped
.length
);
359 generic
.length
= pac_wrapped
.length
;
360 generic
.data
= pac_wrapped
.data
;
362 logon
.generic
= &generic
;
365 netlogon_creds_client_authenticator(creds
, &auth
);
366 r
.in
.credential
= &auth
;
367 r
.in
.return_authenticator
= &auth2
;
368 r
.in
.logon_level
= NetlogonGenericInformation
;
370 r
.in
.server_name
= talloc_asprintf(tctx
, "\\\\%s", dcerpc_server_name(p
));
371 r
.in
.computer_name
= cli_credentials_get_workstation(credentials
);
372 r
.in
.validation_level
= NetlogonValidationGenericInfo2
;
374 torture_assert_ntstatus_ok(tctx
, dcerpc_netr_LogonSamLogon_r(b
, tctx
, &r
),
375 "LogonSamLogon failed");
377 torture_assert_ntstatus_equal(tctx
, r
.out
.result
, NT_STATUS_LOGON_FAILURE
, "LogonSamLogon failed");
379 torture_assert(tctx
, netlogon_creds_client_check(creds
, &r
.out
.return_authenticator
->cred
),
380 "Credential chaining failed");
382 pac_wrapped_struct
.ChecksumLength
= pac_data
->pac_srv_sig
->signature
.length
;
383 pac_wrapped_struct
.SignatureType
= pac_data
->pac_kdc_sig
->type
;
384 pac_wrapped_struct
.SignatureLength
= pac_data
->pac_kdc_sig
->signature
.length
;
386 pac_wrapped_struct
.ChecksumAndSignature
= payload
387 = data_blob_talloc(tmp_ctx
, NULL
,
388 pac_wrapped_struct
.ChecksumLength
389 + pac_wrapped_struct
.SignatureLength
);
390 memcpy(&payload
.data
[0],
391 pac_data
->pac_srv_sig
->signature
.data
,
392 pac_wrapped_struct
.ChecksumLength
);
393 memcpy(&payload
.data
[pac_wrapped_struct
.ChecksumLength
],
394 pac_data
->pac_kdc_sig
->signature
.data
,
395 pac_wrapped_struct
.SignatureLength
);
397 /* Break the signature length */
398 pac_wrapped_struct
.SignatureLength
++;
400 ndr_err
= ndr_push_struct_blob(&pac_wrapped
, tmp_ctx
, &pac_wrapped_struct
,
401 (ndr_push_flags_fn_t
)ndr_push_PAC_Validate
);
402 torture_assert(tctx
, NDR_ERR_CODE_IS_SUCCESS(ndr_err
), "ndr_push_struct_blob of PACValidate structure failed");
404 torture_assert(tctx
, (creds
->negotiate_flags
& NETLOGON_NEG_ARCFOUR
), "not willing to even try a PACValidate without RC4 encryption");
405 if (creds
->negotiate_flags
& NETLOGON_NEG_SUPPORTS_AES
) {
406 netlogon_creds_aes_encrypt(creds
, pac_wrapped
.data
, pac_wrapped
.length
);
408 netlogon_creds_arcfour_crypt(creds
, pac_wrapped
.data
, pac_wrapped
.length
);
411 generic
.length
= pac_wrapped
.length
;
412 generic
.data
= pac_wrapped
.data
;
414 logon
.generic
= &generic
;
417 netlogon_creds_client_authenticator(creds
, &auth
);
418 r
.in
.credential
= &auth
;
419 r
.in
.return_authenticator
= &auth2
;
420 r
.in
.logon_level
= NetlogonGenericInformation
;
422 r
.in
.server_name
= talloc_asprintf(tctx
, "\\\\%s", dcerpc_server_name(p
));
423 r
.in
.computer_name
= cli_credentials_get_workstation(credentials
);
424 r
.in
.validation_level
= NetlogonValidationGenericInfo2
;
426 torture_assert_ntstatus_ok(tctx
, dcerpc_netr_LogonSamLogon_r(b
, tctx
, &r
),
427 "LogonSamLogon failed");
429 torture_assert_ntstatus_equal(tctx
, r
.out
.result
, NT_STATUS_INVALID_PARAMETER
, "LogonSamLogon failed");
431 torture_assert(tctx
, netlogon_creds_client_check(creds
, &r
.out
.return_authenticator
->cred
),
432 "Credential chaining failed");
437 static bool test_PACVerify_bdc_arcfour(struct torture_context
*tctx
,
438 struct dcerpc_pipe
*p
,
439 struct cli_credentials
*credentials
)
441 return test_PACVerify(tctx
, p
, credentials
, SEC_CHAN_BDC
,
442 TEST_MACHINE_NAME_BDC
,
443 NETLOGON_NEG_AUTH2_ADS_FLAGS
);
446 static bool test_PACVerify_bdc_aes(struct torture_context
*tctx
,
447 struct dcerpc_pipe
*p
,
448 struct cli_credentials
*credentials
)
450 return test_PACVerify(tctx
, p
, credentials
, SEC_CHAN_BDC
,
451 TEST_MACHINE_NAME_BDC
,
452 NETLOGON_NEG_AUTH2_ADS_FLAGS
| NETLOGON_NEG_SUPPORTS_AES
);
455 static bool test_PACVerify_workstation_arcfour(struct torture_context
*tctx
,
456 struct dcerpc_pipe
*p
,
457 struct cli_credentials
*credentials
)
459 return test_PACVerify(tctx
, p
, credentials
, SEC_CHAN_WKSTA
,
460 TEST_MACHINE_NAME_WKSTA
,
461 NETLOGON_NEG_AUTH2_ADS_FLAGS
);
464 static bool test_PACVerify_workstation_aes(struct torture_context
*tctx
,
465 struct dcerpc_pipe
*p
,
466 struct cli_credentials
*credentials
)
468 return test_PACVerify(tctx
, p
, credentials
, SEC_CHAN_WKSTA
,
469 TEST_MACHINE_NAME_WKSTA
,
470 NETLOGON_NEG_AUTH2_ADS_FLAGS
| NETLOGON_NEG_SUPPORTS_AES
);
473 static bool test_PACVerify_workstation_des(struct torture_context
*tctx
,
474 struct dcerpc_pipe
*p
, struct cli_credentials
*credentials
, struct test_join
*join_ctx
)
476 struct samr_SetUserInfo r
;
477 union samr_UserInfo user_info
;
478 struct dcerpc_pipe
*samr_pipe
= torture_join_samr_pipe(join_ctx
);
480 #ifdef AD_DC_BUILD_IS_ENABLED
481 struct smb_krb5_context
*smb_krb5_context
;
484 ret
= cli_credentials_get_krb5_context(cmdline_credentials
, tctx
->lp_ctx
, &smb_krb5_context
);
485 torture_assert_int_equal(tctx
, ret
, 0, "cli_credentials_get_krb5_context() failed");
487 if (krb5_config_get_bool_default(smb_krb5_context
->krb5_context
, NULL
, FALSE
,
489 "allow_weak_crypto", NULL
) == FALSE
) {
490 torture_skip(tctx
, "Cannot test DES without [libdefaults] allow_weak_crypto = yes");
493 torture_skip(tctx
, "Skipping DES test in non-AD DC build");
496 /* Mark this workstation with DES-only */
497 user_info
.info16
.acct_flags
= ACB_USE_DES_KEY_ONLY
| ACB_WSTRUST
;
498 r
.in
.user_handle
= torture_join_samr_user_policy(join_ctx
);
500 r
.in
.info
= &user_info
;
502 torture_assert_ntstatus_ok(tctx
, dcerpc_samr_SetUserInfo_r(samr_pipe
->binding_handle
, tctx
, &r
),
503 "failed to set DES info account flags");
504 torture_assert_ntstatus_ok(tctx
, r
.out
.result
,
505 "failed to set DES into account flags");
507 return test_PACVerify(tctx
, p
, credentials
, SEC_CHAN_WKSTA
,
508 TEST_MACHINE_NAME_WKSTA_DES
,
509 NETLOGON_NEG_AUTH2_ADS_FLAGS
);
513 /* Check various ways to get the PAC, in particular check the group membership and other details between the PAC from a normal kinit, S2U4Self and a SamLogon */
514 static bool test_S2U4Self(struct torture_context
*tctx
,
515 struct dcerpc_pipe
*p
,
516 struct cli_credentials
*credentials
,
517 enum netr_SchannelType secure_channel_type
,
518 const char *test_machine_name
)
521 struct dcerpc_binding_handle
*b
= p
->binding_handle
;
523 struct netr_LogonSamLogon r
;
525 union netr_LogonLevel logon
;
526 union netr_Validation validation
;
527 uint8_t authoritative
;
529 struct netr_Authenticator auth
, auth2
;
531 DATA_BLOB client_to_server
, server_to_client
;
533 struct netlogon_creds_CredentialState
*creds
;
534 struct gensec_security
*gensec_client_context
;
535 struct gensec_security
*gensec_server_context
;
537 struct auth4_context
*auth_context
;
538 struct auth_session_info
*kinit_session_info
;
539 struct auth_session_info
*s2u4self_session_info
;
540 struct auth_user_info_dc
*netlogon_user_info_dc
;
542 struct netr_NetworkInfo ninfo
;
543 DATA_BLOB names_blob
, chal
, lm_resp
, nt_resp
;
545 int flags
= CLI_CRED_NTLMv2_AUTH
;
547 struct dom_sid
*builtin_domain
;
549 TALLOC_CTX
*tmp_ctx
= talloc_new(tctx
);
551 torture_assert(tctx
, tmp_ctx
!= NULL
, "talloc_new() failed");
553 auth_context
= talloc_zero(tmp_ctx
, struct auth4_context
);
554 torture_assert(tctx
, auth_context
!= NULL
, "talloc_new() failed");
556 auth_context
->generate_session_info_pac
= test_generate_session_info_pac
;
558 /* First, do a normal Kerberos connection */
560 status
= gensec_client_start(tctx
, &gensec_client_context
,
561 lpcfg_gensec_settings(tctx
, tctx
->lp_ctx
));
562 torture_assert_ntstatus_ok(tctx
, status
, "gensec_client_start (client) failed");
564 status
= gensec_set_target_hostname(gensec_client_context
, test_machine_name
);
566 status
= gensec_set_credentials(gensec_client_context
, cmdline_credentials
);
567 torture_assert_ntstatus_ok(tctx
, status
, "gensec_set_credentials (client) failed");
569 status
= gensec_start_mech_by_sasl_name(gensec_client_context
, "GSSAPI");
570 torture_assert_ntstatus_ok(tctx
, status
, "gensec_start_mech_by_sasl_name (client) failed");
572 status
= gensec_server_start(tctx
,
573 lpcfg_gensec_settings(tctx
, tctx
->lp_ctx
),
574 auth_context
, &gensec_server_context
);
575 torture_assert_ntstatus_ok(tctx
, status
, "gensec_server_start (server) failed");
577 status
= gensec_set_credentials(gensec_server_context
, credentials
);
578 torture_assert_ntstatus_ok(tctx
, status
, "gensec_set_credentials (server) failed");
580 status
= gensec_start_mech_by_sasl_name(gensec_server_context
, "GSSAPI");
581 torture_assert_ntstatus_ok(tctx
, status
, "gensec_start_mech_by_sasl_name (server) failed");
583 server_to_client
= data_blob(NULL
, 0);
586 /* Do a client-server update dance */
587 status
= gensec_update(gensec_client_context
, tmp_ctx
, tctx
->ev
, server_to_client
, &client_to_server
);
588 if (!NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {;
589 torture_assert_ntstatus_ok(tctx
, status
, "gensec_update (client) failed");
592 status
= gensec_update(gensec_server_context
, tmp_ctx
, tctx
->ev
, client_to_server
, &server_to_client
);
593 if (!NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {;
594 torture_assert_ntstatus_ok(tctx
, status
, "gensec_update (server) failed");
597 if (NT_STATUS_IS_OK(status
)) {
602 /* Extract the PAC using Samba's code */
604 status
= gensec_session_info(gensec_server_context
, gensec_server_context
, &kinit_session_info
);
605 torture_assert_ntstatus_ok(tctx
, status
, "gensec_session_info failed");
608 /* Now do the dance with S2U4Self */
610 /* Wipe out any existing ccache */
611 cli_credentials_invalidate_ccache(credentials
, CRED_SPECIFIED
);
612 cli_credentials_set_impersonate_principal(credentials
,
613 cli_credentials_get_principal(cmdline_credentials
, tmp_ctx
),
614 talloc_asprintf(tmp_ctx
, "host/%s", test_machine_name
));
616 status
= gensec_client_start(tctx
, &gensec_client_context
,
617 lpcfg_gensec_settings(tctx
, tctx
->lp_ctx
));
618 torture_assert_ntstatus_ok(tctx
, status
, "gensec_client_start (client) failed");
620 status
= gensec_set_target_hostname(gensec_client_context
, test_machine_name
);
622 /* We now set the same credentials on both client and server contexts */
623 status
= gensec_set_credentials(gensec_client_context
, credentials
);
624 torture_assert_ntstatus_ok(tctx
, status
, "gensec_set_credentials (client) failed");
626 status
= gensec_start_mech_by_sasl_name(gensec_client_context
, "GSSAPI");
627 torture_assert_ntstatus_ok(tctx
, status
, "gensec_start_mech_by_sasl_name (client) failed");
629 status
= gensec_server_start(tctx
,
630 lpcfg_gensec_settings(tctx
, tctx
->lp_ctx
),
631 auth_context
, &gensec_server_context
);
632 torture_assert_ntstatus_ok(tctx
, status
, "gensec_server_start (server) failed");
634 status
= gensec_set_credentials(gensec_server_context
, credentials
);
635 torture_assert_ntstatus_ok(tctx
, status
, "gensec_set_credentials (server) failed");
637 status
= gensec_start_mech_by_sasl_name(gensec_server_context
, "GSSAPI");
638 torture_assert_ntstatus_ok(tctx
, status
, "gensec_start_mech_by_sasl_name (server) failed");
640 server_to_client
= data_blob(NULL
, 0);
643 /* Do a client-server update dance */
644 status
= gensec_update(gensec_client_context
, tmp_ctx
, tctx
->ev
, server_to_client
, &client_to_server
);
645 if (!NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {;
646 torture_assert_ntstatus_ok(tctx
, status
, "gensec_update (client) failed");
649 status
= gensec_update(gensec_server_context
, tmp_ctx
, tctx
->ev
, client_to_server
, &server_to_client
);
650 if (!NT_STATUS_EQUAL(status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {;
651 torture_assert_ntstatus_ok(tctx
, status
, "gensec_update (server) failed");
654 if (NT_STATUS_IS_OK(status
)) {
659 /* Don't pollute the remaining tests with the changed credentials */
660 cli_credentials_invalidate_ccache(credentials
, CRED_SPECIFIED
);
661 cli_credentials_set_target_service(credentials
, NULL
);
662 cli_credentials_set_impersonate_principal(credentials
, NULL
, NULL
);
664 /* Extract the PAC using Samba's code */
666 status
= gensec_session_info(gensec_server_context
, gensec_server_context
, &s2u4self_session_info
);
667 torture_assert_ntstatus_ok(tctx
, status
, "gensec_session_info failed");
669 cli_credentials_get_ntlm_username_domain(cmdline_credentials
, tctx
,
670 &ninfo
.identity_info
.account_name
.string
,
671 &ninfo
.identity_info
.domain_name
.string
);
673 /* Now try with SamLogon */
674 generate_random_buffer(ninfo
.challenge
,
675 sizeof(ninfo
.challenge
));
676 chal
= data_blob_const(ninfo
.challenge
,
677 sizeof(ninfo
.challenge
));
679 names_blob
= NTLMv2_generate_names_blob(tctx
, cli_credentials_get_workstation(credentials
),
680 cli_credentials_get_domain(credentials
));
682 status
= cli_credentials_get_ntlm_response(cmdline_credentials
, tctx
,
688 torture_assert_ntstatus_ok(tctx
, status
, "cli_credentials_get_ntlm_response failed");
690 ninfo
.lm
.data
= lm_resp
.data
;
691 ninfo
.lm
.length
= lm_resp
.length
;
693 ninfo
.nt
.data
= nt_resp
.data
;
694 ninfo
.nt
.length
= nt_resp
.length
;
696 ninfo
.identity_info
.parameter_control
= 0;
697 ninfo
.identity_info
.logon_id_low
= 0;
698 ninfo
.identity_info
.logon_id_high
= 0;
699 ninfo
.identity_info
.workstation
.string
= cli_credentials_get_workstation(credentials
);
701 logon
.network
= &ninfo
;
703 r
.in
.server_name
= talloc_asprintf(tctx
, "\\\\%s", dcerpc_server_name(p
));
704 r
.in
.computer_name
= cli_credentials_get_workstation(credentials
);
705 r
.in
.credential
= &auth
;
706 r
.in
.return_authenticator
= &auth2
;
707 r
.in
.logon_level
= NetlogonNetworkInformation
;
709 r
.out
.validation
= &validation
;
710 r
.out
.authoritative
= &authoritative
;
712 if (!test_SetupCredentials2(p
, tctx
, NETLOGON_NEG_AUTH2_ADS_FLAGS
| NETLOGON_NEG_SUPPORTS_AES
,
713 credentials
, secure_channel_type
,
719 netlogon_creds_client_authenticator(creds
, &auth
);
721 r
.in
.validation_level
= 3;
723 status
= dcerpc_netr_LogonSamLogon_r(b
, tctx
, &r
);
724 torture_assert_ntstatus_ok(tctx
, status
, "LogonSamLogon failed");
726 torture_assert(tctx
, netlogon_creds_client_check(creds
,
727 &r
.out
.return_authenticator
->cred
),
728 "Credential chaining failed");
730 status
= make_user_info_dc_netlogon_validation(tmp_ctx
,
731 ninfo
.identity_info
.account_name
.string
,
732 r
.in
.validation_level
,
734 true, /* This user was authenticated */
735 &netlogon_user_info_dc
);
737 torture_assert_ntstatus_ok(tctx
, status
, "make_user_info_dc_netlogon_validation failed");
739 torture_assert_str_equal(tctx
, netlogon_user_info_dc
->info
->account_name
== NULL
? "" : netlogon_user_info_dc
->info
->account_name
,
740 kinit_session_info
->info
->account_name
, "Account name differs for kinit-based PAC");
741 torture_assert_str_equal(tctx
,netlogon_user_info_dc
->info
->account_name
== NULL
? "" : netlogon_user_info_dc
->info
->account_name
,
742 s2u4self_session_info
->info
->account_name
, "Account name differs for S2U4Self");
743 torture_assert_str_equal(tctx
, netlogon_user_info_dc
->info
->full_name
== NULL
? "" : netlogon_user_info_dc
->info
->full_name
, kinit_session_info
->info
->full_name
, "Full name differs for kinit-based PAC");
744 torture_assert_str_equal(tctx
, netlogon_user_info_dc
->info
->full_name
== NULL
? "" : netlogon_user_info_dc
->info
->full_name
, s2u4self_session_info
->info
->full_name
, "Full name differs for S2U4Self");
745 torture_assert_int_equal(tctx
, netlogon_user_info_dc
->num_sids
, kinit_session_info
->torture
->num_dc_sids
, "Different numbers of domain groups for kinit-based PAC");
746 torture_assert_int_equal(tctx
, netlogon_user_info_dc
->num_sids
, s2u4self_session_info
->torture
->num_dc_sids
, "Different numbers of domain groups for S2U4Self");
748 builtin_domain
= dom_sid_parse_talloc(tmp_ctx
, SID_BUILTIN
);
750 for (i
= 0; i
< kinit_session_info
->torture
->num_dc_sids
; i
++) {
751 torture_assert(tctx
, dom_sid_equal(&netlogon_user_info_dc
->sids
[i
], &kinit_session_info
->torture
->dc_sids
[i
]), "Different domain groups for kinit-based PAC");
752 torture_assert(tctx
, dom_sid_equal(&netlogon_user_info_dc
->sids
[i
], &s2u4self_session_info
->torture
->dc_sids
[i
]), "Different domain groups for S2U4Self");
753 torture_assert(tctx
, !dom_sid_in_domain(builtin_domain
, &s2u4self_session_info
->torture
->dc_sids
[i
]), "Returned BUILTIN domain in groups for S2U4Self");
754 torture_assert(tctx
, !dom_sid_in_domain(builtin_domain
, &kinit_session_info
->torture
->dc_sids
[i
]), "Returned BUILTIN domain in groups kinit-based PAC");
755 torture_assert(tctx
, !dom_sid_in_domain(builtin_domain
, &netlogon_user_info_dc
->sids
[i
]), "Returned BUILTIN domian in groups from NETLOGON SamLogon reply");
761 static bool test_S2U4Self_bdc(struct torture_context
*tctx
,
762 struct dcerpc_pipe
*p
,
763 struct cli_credentials
*credentials
)
765 return test_S2U4Self(tctx
, p
, credentials
, SEC_CHAN_BDC
, TEST_MACHINE_NAME_S2U4SELF_BDC
);
768 static bool test_S2U4Self_workstation(struct torture_context
*tctx
,
769 struct dcerpc_pipe
*p
,
770 struct cli_credentials
*credentials
)
772 return test_S2U4Self(tctx
, p
, credentials
, SEC_CHAN_WKSTA
, TEST_MACHINE_NAME_S2U4SELF_WKSTA
);
775 struct torture_suite
*torture_rpc_remote_pac(TALLOC_CTX
*mem_ctx
)
777 struct torture_suite
*suite
= torture_suite_create(mem_ctx
, "pac");
778 struct torture_rpc_tcase
*tcase
;
780 /* It is important to use different names, so that old entries in our credential cache are not used */
781 tcase
= torture_suite_add_machine_bdc_rpc_iface_tcase(suite
, "netr-bdc-arcfour",
782 &ndr_table_netlogon
, TEST_MACHINE_NAME_BDC
);
783 torture_rpc_tcase_add_test_creds(tcase
, "verify-sig-arcfour", test_PACVerify_bdc_arcfour
);
785 tcase
= torture_suite_add_machine_bdc_rpc_iface_tcase(suite
, "netr-bdc-aes",
786 &ndr_table_netlogon
, TEST_MACHINE_NAME_BDC
);
787 torture_rpc_tcase_add_test_creds(tcase
, "verify-sig-aes", test_PACVerify_bdc_aes
);
789 tcase
= torture_suite_add_machine_workstation_rpc_iface_tcase(suite
, "netr-mem-arcfour",
790 &ndr_table_netlogon
, TEST_MACHINE_NAME_WKSTA
);
791 torture_rpc_tcase_add_test_creds(tcase
, "verify-sig-arcfour", test_PACVerify_workstation_arcfour
);
793 tcase
= torture_suite_add_machine_workstation_rpc_iface_tcase(suite
, "netr-mem-aes",
794 &ndr_table_netlogon
, TEST_MACHINE_NAME_WKSTA
);
795 torture_rpc_tcase_add_test_creds(tcase
, "verify-sig-aes", test_PACVerify_workstation_aes
);
797 tcase
= torture_suite_add_machine_workstation_rpc_iface_tcase(suite
, "netlogon-member-des",
798 &ndr_table_netlogon
, TEST_MACHINE_NAME_WKSTA_DES
);
799 torture_rpc_tcase_add_test_join(tcase
, "verify-sig", test_PACVerify_workstation_des
);
801 tcase
= torture_suite_add_machine_bdc_rpc_iface_tcase(suite
, "netlogon-bdc",
802 &ndr_table_netlogon
, TEST_MACHINE_NAME_S2U4SELF_BDC
);
803 torture_rpc_tcase_add_test_creds(tcase
, "s2u4self", test_S2U4Self_bdc
);
805 tcase
= torture_suite_add_machine_workstation_rpc_iface_tcase(suite
, "netlogon-member",
806 &ndr_table_netlogon
, TEST_MACHINE_NAME_S2U4SELF_WKSTA
);
808 torture_rpc_tcase_add_test_creds(tcase
, "s2u4self", test_S2U4Self_workstation
);