smbd: Remove two outdated comments
[Samba.git] / source3 / torture / pdbtest.c
blobfeadcf94120899081e9ed7d3e3fd98a591a08fd7
1 /*
2 Unix SMB/CIFS implementation.
3 passdb testing utility
5 Copyright (C) Wilco Baan Hofman 2006
6 Copyright (C) Jelmer Vernooij 2006
7 Copyright (C) Andrew Bartlett 2012
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "includes.h"
25 #include "popt_common.h"
26 #include "passdb.h"
28 #include "../librpc/gen_ndr/drsblobs.h"
29 #include "../librpc/gen_ndr/ndr_drsblobs.h"
30 #include "../libcli/security/dom_sid.h"
31 #include "../libcli/auth/libcli_auth.h"
32 #include "../auth/common_auth.h"
33 #include "lib/tsocket/tsocket.h"
34 #include "include/auth.h"
36 #define TRUST_DOM "trustdom"
37 #define TRUST_PWD "trustpwd1232"
38 #define TRUST_SID "S-1-5-21-1111111111-2222222222-3333333333"
40 static bool samu_correct(struct samu *s1, struct samu *s2)
42 bool ret = True;
43 uint32 s1_len, s2_len;
44 const char *s1_buf, *s2_buf;
45 const uint8 *d1_buf, *d2_buf;
46 const struct dom_sid *s1_sid, *s2_sid;
48 /* Check Unix username */
49 s1_buf = pdb_get_username(s1);
50 s2_buf = pdb_get_username(s2);
51 if (s2_buf == NULL && s1_buf != NULL) {
52 DEBUG(0, ("Username is not set\n"));
53 ret = False;
54 } else if (s1_buf == NULL) {
55 /* Do nothing */
56 } else if (strcmp(s1_buf,s2_buf)) {
57 DEBUG(0, ("Username not written correctly, want %s, got \"%s\"\n",
58 pdb_get_username(s1),
59 pdb_get_username(s2)));
60 ret = False;
63 /* Check NT username */
64 s1_buf = pdb_get_nt_username(s1);
65 s2_buf = pdb_get_nt_username(s2);
66 if (s2_buf == NULL && s1_buf != NULL) {
67 DEBUG(0, ("NT Username is not set\n"));
68 ret = False;
69 } else if (s1_buf == NULL) {
70 /* Do nothing */
71 } else if (strcmp(s1_buf, s2_buf)) {
72 DEBUG(0, ("NT Username not written correctly, want \"%s\", got \"%s\"\n",
73 pdb_get_nt_username(s1),
74 pdb_get_nt_username(s2)));
75 ret = False;
78 /* Check acct ctrl */
79 if (pdb_get_acct_ctrl(s1) != pdb_get_acct_ctrl(s2)) {
80 DEBUG(0, ("Acct ctrl field not written correctly, want %d (0x%X), got %d (0x%X)\n",
81 pdb_get_acct_ctrl(s1),
82 pdb_get_acct_ctrl(s1),
83 pdb_get_acct_ctrl(s2),
84 pdb_get_acct_ctrl(s2)));
85 ret = False;
88 /* Check NT password */
89 d1_buf = pdb_get_nt_passwd(s1);
90 d2_buf = pdb_get_nt_passwd(s2);
91 if (d2_buf == NULL && d1_buf != NULL) {
92 DEBUG(0, ("NT password is not set\n"));
93 ret = False;
94 } else if (d1_buf == NULL) {
95 /* Do nothing */
96 } else if (memcmp(d1_buf, d2_buf, NT_HASH_LEN)) {
97 DEBUG(0, ("NT password not written correctly\n"));
98 ret = False;
101 /* Check lanman password */
102 d1_buf = pdb_get_lanman_passwd(s1);
103 d2_buf = pdb_get_lanman_passwd(s2);
104 if (d2_buf == NULL && d1_buf != NULL) {
105 DEBUG(0, ("Lanman password is not set\n"));
106 } else if (d1_buf == NULL) {
107 /* Do nothing */
108 } else if (memcmp(d1_buf, d2_buf, NT_HASH_LEN)) {
109 DEBUG(0, ("Lanman password not written correctly\n"));
110 ret = False;
113 /* Check password history */
114 d1_buf = pdb_get_pw_history(s1, &s1_len);
115 d2_buf = pdb_get_pw_history(s2, &s2_len);
116 if (d2_buf == NULL && d1_buf != NULL) {
117 DEBUG(0, ("Password history is not set\n"));
118 } else if (d1_buf == NULL) {
119 /* Do nothing */
120 } else if (s1_len != s2_len) {
121 DEBUG(0, ("Password history not written correctly, lengths differ, want %d, got %d\n",
122 s1_len, s2_len));
123 ret = False;
124 } else if (strncmp(s1_buf, s2_buf, s1_len)) {
125 DEBUG(0, ("Password history not written correctly\n"));
126 ret = False;
129 /* Check logon time */
130 if (pdb_get_logon_time(s1) != pdb_get_logon_time(s2)) {
131 DEBUG(0, ("Logon time is not written correctly\n"));
132 ret = False;
135 /* Check logoff time */
136 if (pdb_get_logoff_time(s1) != pdb_get_logoff_time(s2)) {
137 DEBUG(0, ("Logoff time is not written correctly: %s vs %s \n",
138 http_timestring(talloc_tos(), pdb_get_logoff_time(s1)),
139 http_timestring(talloc_tos(), pdb_get_logoff_time(s2))));
140 ret = False;
143 /* Check kickoff time */
144 if (pdb_get_kickoff_time(s1) != pdb_get_kickoff_time(s2)) {
145 DEBUG(0, ("Kickoff time is not written correctly: %s vs %s \n",
146 http_timestring(talloc_tos(), pdb_get_kickoff_time(s1)),
147 http_timestring(talloc_tos(), pdb_get_kickoff_time(s2))));
148 ret = False;
151 /* Check bad password time */
152 if (pdb_get_bad_password_time(s1) != pdb_get_bad_password_time(s2)) {
153 DEBUG(0, ("Bad password time is not written correctly\n"));
154 ret = False;
157 /* Check password last set time */
158 if (pdb_get_pass_last_set_time(s1) != pdb_get_pass_last_set_time(s2)) {
159 DEBUG(0, ("Password last set time is not written correctly: %s vs %s \n",
160 http_timestring(talloc_tos(), pdb_get_pass_last_set_time(s1)),
161 http_timestring(talloc_tos(), pdb_get_pass_last_set_time(s2))));
162 ret = False;
165 /* Check password can change time */
166 if (pdb_get_pass_can_change_time(s1) != pdb_get_pass_can_change_time(s2)) {
167 DEBUG(0, ("Password can change time is not written correctly %s vs %s \n",
168 http_timestring(talloc_tos(), pdb_get_pass_can_change_time(s1)),
169 http_timestring(talloc_tos(), pdb_get_pass_can_change_time(s2))));
170 ret = False;
173 /* Check password must change time */
174 if (pdb_get_pass_must_change_time(s1) != pdb_get_pass_must_change_time(s2)) {
175 DEBUG(0, ("Password must change time is not written correctly\n"));
176 ret = False;
179 /* Check logon divs */
180 if (pdb_get_logon_divs(s1) != pdb_get_logon_divs(s2)) {
181 DEBUG(0, ("Logon divs not written correctly\n"));
182 ret = False;
185 /* Check logon hours */
186 if (pdb_get_hours_len(s1) != pdb_get_hours_len(s2)) {
187 DEBUG(0, ("Logon hours length not written correctly\n"));
188 ret = False;
189 } else if (pdb_get_hours_len(s1) != 0) {
190 d1_buf = pdb_get_hours(s1);
191 d2_buf = pdb_get_hours(s2);
192 if (d2_buf == NULL && d2_buf != NULL) {
193 DEBUG(0, ("Logon hours is not set\n"));
194 ret = False;
195 } else if (d1_buf == NULL) {
196 /* Do nothing */
197 } else if (memcmp(d1_buf, d2_buf, MAX_HOURS_LEN)) {
198 DEBUG(0, ("Logon hours is not written correctly\n"));
199 ret = False;
203 /* Check profile path */
204 s1_buf = pdb_get_profile_path(s1);
205 s2_buf = pdb_get_profile_path(s2);
206 if (s2_buf == NULL && s1_buf != NULL) {
207 DEBUG(0, ("Profile path is not set\n"));
208 ret = False;
209 } else if (s1_buf == NULL) {
210 /* Do nothing */
211 } else if (strcmp(s1_buf, s2_buf)) {
212 DEBUG(0, ("Profile path is not written correctly\n"));
213 ret = False;
216 /* Check home dir */
217 s1_buf = pdb_get_homedir(s1);
218 s2_buf = pdb_get_homedir(s2);
219 if (s2_buf == NULL && s1_buf != NULL) {
220 DEBUG(0, ("Home dir is not set\n"));
221 ret = False;
222 } else if (s1_buf == NULL) {
223 /* Do nothing */
224 } else if (strcmp(s1_buf, s2_buf)) {
225 DEBUG(0, ("Home dir is not written correctly\n"));
226 ret = False;
229 /* Check logon script */
230 s1_buf = pdb_get_logon_script(s1);
231 s2_buf = pdb_get_logon_script(s2);
232 if (s2_buf == NULL && s1_buf != NULL) {
233 DEBUG(0, ("Logon script not set\n"));
234 ret = False;
235 } else if (s1_buf == NULL) {
236 /* Do nothing */
237 } else if (strcmp(s1_buf, s2_buf)) {
238 DEBUG(0, ("Logon script is not written correctly\n"));
239 ret = False;
242 /* Check user and group sids */
243 s1_sid = pdb_get_user_sid(s1);
244 s2_sid = pdb_get_user_sid(s2);
245 if (s2_sid == NULL && s1_sid != NULL) {
246 DEBUG(0, ("USER SID not set\n"));
247 ret = False;
248 } else if (s1_sid == NULL) {
249 /* Do nothing */
250 } else if (!dom_sid_equal(s1_sid, s2_sid)) {
251 DEBUG(0, ("USER SID is not written correctly\n"));
252 ret = False;
255 return ret;
258 static bool test_auth(TALLOC_CTX *mem_ctx, struct samu *pdb_entry)
260 struct auth_usersupplied_info *user_info;
261 struct auth_context *auth_context;
262 static const uint8_t challenge_8[8] = {1, 2, 3, 4, 5, 6, 7, 8};
263 DATA_BLOB challenge = data_blob_const(challenge_8, sizeof(challenge_8));
264 struct tsocket_address *tsocket_address;
265 unsigned char local_nt_response[24];
266 DATA_BLOB nt_resp = data_blob_const(local_nt_response, sizeof(local_nt_response));
267 unsigned char local_nt_session_key[16];
268 struct netr_SamInfo3 *info3_sam, *info3_auth;
269 struct auth_serversupplied_info *server_info;
270 NTSTATUS status;
272 SMBOWFencrypt(pdb_get_nt_passwd(pdb_entry), challenge_8,
273 local_nt_response);
274 SMBsesskeygen_ntv1(pdb_get_nt_passwd(pdb_entry), local_nt_session_key);
276 if (tsocket_address_inet_from_strings(NULL, "ip", NULL, 0, &tsocket_address) != 0) {
277 return False;
280 status = make_user_info(mem_ctx,
281 &user_info, pdb_get_username(pdb_entry), pdb_get_username(pdb_entry),
282 pdb_get_domain(pdb_entry), pdb_get_domain(pdb_entry), lp_netbios_name(),
283 tsocket_address, NULL, &nt_resp, NULL, NULL, NULL,
284 AUTH_PASSWORD_RESPONSE);
285 if (!NT_STATUS_IS_OK(status)) {
286 DEBUG(0, ("Failed to test authentication with check_sam_security_info3: %s\n", nt_errstr(status)));
287 return False;
290 status = check_sam_security_info3(&challenge, NULL, user_info, &info3_sam);
291 if (!NT_STATUS_IS_OK(status)) {
292 DEBUG(0, ("Failed to test authentication with check_sam_security_info3: %s\n", nt_errstr(status)));
293 return False;
296 if (memcmp(info3_sam->base.key.key, local_nt_session_key, 16) != 0) {
297 DEBUG(0, ("Returned NT session key is incorrect\n"));
298 return False;
301 status = make_auth_context_fixed(NULL, &auth_context, challenge.data);
303 if (!NT_STATUS_IS_OK(status)) {
304 DEBUG(0, ("Failed to test authentication with check_sam_security_info3: %s\n", nt_errstr(status)));
305 return False;
308 status = auth_check_ntlm_password(mem_ctx,
309 auth_context,
310 user_info,
311 &server_info);
313 if (!NT_STATUS_IS_OK(status)) {
314 DEBUG(0, ("Failed to test authentication with auth module: %s\n", nt_errstr(status)));
315 return False;
318 info3_auth = talloc_zero(mem_ctx, struct netr_SamInfo3);
319 if (info3_auth == NULL) {
320 return False;
323 status = serverinfo_to_SamInfo3(server_info, info3_auth);
324 if (!NT_STATUS_IS_OK(status)) {
325 DEBUG(0, ("serverinfo_to_SamInfo3 failed: %s\n",
326 nt_errstr(status)));
327 return False;
330 if (memcmp(info3_auth->base.key.key, local_nt_session_key, 16) != 0) {
331 DEBUG(0, ("Returned NT session key is incorrect\n"));
332 return False;
335 if (!dom_sid_equal(info3_sam->base.domain_sid, info3_auth->base.domain_sid)) {
336 DEBUG(0, ("domain_sid in SAM info3 %s does not match domain_sid in AUTH info3 %s\n",
337 dom_sid_string(NULL, info3_sam->base.domain_sid),
338 dom_sid_string(NULL, info3_auth->base.domain_sid)));
339 return False;
342 /* TODO:
343 * Compre more details from the two info3 structures,
344 * then test that an expired/disabled/pwdmustchange account
345 * returns the correct errors
348 return True;
351 static bool test_trusted_domains(TALLOC_CTX *ctx,
352 struct pdb_methods *pdb,
353 bool *error)
355 NTSTATUS rv;
356 /* test trustdom calls */
357 struct pdb_trusted_domain *td;
358 struct pdb_trusted_domain *new_td;
359 struct trustAuthInOutBlob taiob;
360 struct AuthenticationInformation aia;
361 enum ndr_err_code ndr_err;
363 td = talloc_zero(ctx ,struct pdb_trusted_domain);
364 if (!td) {
365 fprintf(stderr, "talloc failed\n");
366 return false;
369 td->domain_name = talloc_strdup(td, TRUST_DOM);
370 td->netbios_name = talloc_strdup(td, TRUST_DOM);
371 if (!td->domain_name || !td->netbios_name) {
372 fprintf(stderr, "talloc failed\n");
373 return false;
376 td->trust_auth_incoming = data_blob_null;
378 ZERO_STRUCT(taiob);
379 ZERO_STRUCT(aia);
380 taiob.count = 1;
381 taiob.current.count = 1;
382 taiob.current.array = &aia;
383 unix_to_nt_time(&aia.LastUpdateTime, time(NULL));
384 aia.AuthType = TRUST_AUTH_TYPE_CLEAR;
385 aia.AuthInfo.clear.password = (uint8_t *) talloc_strdup(ctx, TRUST_PWD);
386 aia.AuthInfo.clear.size = strlen(TRUST_PWD);
388 taiob.previous.count = 0;
389 taiob.previous.array = NULL;
391 ndr_err = ndr_push_struct_blob(&td->trust_auth_outgoing,
392 td, &taiob,
393 (ndr_push_flags_fn_t) ndr_push_trustAuthInOutBlob);
394 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
395 fprintf(stderr, "ndr_push_struct_blob failed.\n");
396 return false;
399 td->trust_direction = LSA_TRUST_DIRECTION_OUTBOUND;
400 td->trust_type = LSA_TRUST_TYPE_DOWNLEVEL;
401 td->trust_attributes = 0;
402 td->trust_forest_trust_info = data_blob_null;
404 rv = pdb->set_trusted_domain(pdb, TRUST_DOM, td);
405 if (!NT_STATUS_IS_OK(rv)) {
406 fprintf(stderr, "Error in set_trusted_domain %s\n",
407 get_friendly_nt_error_msg(rv));
408 *error = true;
411 rv = pdb->get_trusted_domain(pdb, ctx, TRUST_DOM, &new_td);
412 if (!NT_STATUS_IS_OK(rv)) {
413 fprintf(stderr, "Error in set_trusted_domain %s\n",
414 get_friendly_nt_error_msg(rv));
415 *error = true;
418 if (!strequal(td->domain_name, new_td->domain_name) ||
419 !strequal(td->netbios_name, new_td->netbios_name) ||
420 !dom_sid_equal(&td->security_identifier,
421 &new_td->security_identifier) ||
422 td->trust_direction != new_td->trust_direction ||
423 td->trust_type != new_td->trust_type ||
424 td->trust_attributes != new_td->trust_attributes ||
425 td->trust_auth_incoming.length != new_td->trust_auth_incoming.length ||
426 td->trust_forest_trust_info.length != new_td->trust_forest_trust_info.length ||
427 data_blob_cmp(&td->trust_auth_outgoing, &new_td->trust_auth_outgoing) != 0) {
428 fprintf(stderr, "Old and new trusdet domain data do not match\n");
429 *error = true;
432 return true;
436 int main(int argc, const char **argv)
438 TALLOC_CTX *ctx;
439 struct samu *out = NULL;
440 struct samu *in = NULL;
441 NTSTATUS rv;
442 int i;
443 struct timeval tv;
444 bool error = False;
445 struct passwd *pwd;
446 uint8 *buf;
447 uint32 expire, min_age, history;
448 struct pdb_methods *pdb;
449 poptContext pc;
450 static const char *backend = NULL;
451 static const char *unix_user = "nobody";
452 struct poptOption long_options[] = {
453 {"username", 'u', POPT_ARG_STRING, &unix_user, 0, "Unix user to use for testing", "USERNAME" },
454 {"backend", 'b', POPT_ARG_STRING, &backend, 0, "Backend to use if not default", "BACKEND[:SETTINGS]" },
455 POPT_AUTOHELP
456 POPT_COMMON_SAMBA
457 POPT_TABLEEND
460 ctx = talloc_stackframe();
462 load_case_tables();
464 pc = poptGetContext("pdbtest", argc, argv, long_options, 0);
466 poptSetOtherOptionHelp(pc, "backend[:settings] username");
468 while(poptGetNextOpt(pc) != -1);
470 poptFreeContext(pc);
472 /* Load configuration */
473 lp_load_global(get_dyn_CONFIGFILE());
474 setup_logging("pdbtest", DEBUG_STDOUT);
475 init_names();
477 if (backend == NULL) {
478 backend = lp_passdb_backend();
481 rv = make_pdb_method_name(&pdb, backend);
482 if (NT_STATUS_IS_ERR(rv)) {
483 fprintf(stderr, "Error initializing '%s': %s\n", backend, get_friendly_nt_error_msg(rv));
484 exit(1);
487 if (!(out = samu_new(ctx))) {
488 fprintf(stderr, "Can't create samu structure.\n");
489 exit(1);
492 if ((pwd = Get_Pwnam_alloc(ctx, unix_user)) == NULL) {
493 fprintf(stderr, "Error getting user information for %s\n", unix_user);
494 exit(1);
497 samu_set_unix(out, pwd);
499 pdb_set_profile_path(out, "\\\\torture\\profile", PDB_SET);
500 pdb_set_homedir(out, "\\\\torture\\home", PDB_SET);
501 pdb_set_logon_script(out, "torture_script.cmd", PDB_SET);
503 pdb_set_acct_ctrl(out, ACB_NORMAL, PDB_SET);
505 pdb_get_account_policy(PDB_POLICY_PASSWORD_HISTORY, &history);
506 if (history * PW_HISTORY_ENTRY_LEN < NT_HASH_LEN) {
507 buf = (uint8 *)TALLOC(ctx, NT_HASH_LEN);
508 } else {
509 buf = (uint8 *)TALLOC(ctx, history * PW_HISTORY_ENTRY_LEN);
512 /* Generate some random hashes */
513 GetTimeOfDay(&tv);
514 srand(tv.tv_usec);
515 for (i = 0; i < NT_HASH_LEN; i++) {
516 buf[i] = (uint8) rand();
518 pdb_set_nt_passwd(out, buf, PDB_SET);
519 for (i = 0; i < LM_HASH_LEN; i++) {
520 buf[i] = (uint8) rand();
522 pdb_set_lanman_passwd(out, buf, PDB_SET);
523 for (i = 0; i < history * PW_HISTORY_ENTRY_LEN; i++) {
524 buf[i] = (uint8) rand();
526 pdb_set_pw_history(out, buf, history, PDB_SET);
528 pdb_get_account_policy(PDB_POLICY_MAX_PASSWORD_AGE, &expire);
529 pdb_get_account_policy(PDB_POLICY_MIN_PASSWORD_AGE, &min_age);
530 pdb_set_pass_last_set_time(out, time(NULL), PDB_SET);
532 if (min_age == (uint32)-1) {
533 pdb_set_pass_can_change_time(out, 0, PDB_SET);
534 } else {
535 pdb_set_pass_can_change_time(out, time(NULL)+min_age, PDB_SET);
538 pdb_set_logon_time(out, time(NULL)-3600, PDB_SET);
540 pdb_set_logoff_time(out, time(NULL), PDB_SET);
542 pdb_set_kickoff_time(out, time(NULL)+3600, PDB_SET);
544 /* Create account */
545 if (!NT_STATUS_IS_OK(rv = pdb->add_sam_account(pdb, out))) {
546 fprintf(stderr, "Error in add_sam_account: %s\n",
547 get_friendly_nt_error_msg(rv));
548 exit(1);
551 if (!(in = samu_new(ctx))) {
552 fprintf(stderr, "Can't create samu structure.\n");
553 exit(1);
556 /* Get account information through getsampwnam() */
557 rv = pdb->getsampwnam(pdb, in, out->username);
558 if (NT_STATUS_IS_ERR(rv)) {
559 fprintf(stderr, "Error getting sampw of added user %s: %s\n",
560 out->username, nt_errstr(rv));
561 if (!NT_STATUS_IS_OK(rv = pdb->delete_sam_account(pdb, out))) {
562 fprintf(stderr, "Error in delete_sam_account %s\n",
563 get_friendly_nt_error_msg(rv));
565 TALLOC_FREE(ctx);
566 exit(1);
569 /* Verify integrity */
570 if (samu_correct(out, in)) {
571 printf("User info written correctly\n");
572 } else {
573 printf("User info NOT written correctly\n");
574 error = True;
577 if (test_auth(ctx, out)) {
578 printf("Authentication module test passed\n");
579 } else {
580 printf("Authentication module test failed!\n");
581 error = True;
585 /* Delete account */
586 if (!NT_STATUS_IS_OK(rv = pdb->delete_sam_account(pdb, out))) {
587 fprintf(stderr, "Error in delete_sam_account %s\n",
588 get_friendly_nt_error_msg(rv));
591 if (pdb_capabilities() & PDB_CAP_TRUSTED_DOMAINS_EX) {
592 if (!test_trusted_domains(ctx, pdb, &error)) {
593 fprintf(stderr, "failed testing trusted domains.\n");
594 exit(1);
598 TALLOC_FREE(ctx);
600 if (error) {
601 return 1;
603 return 0;