source/torture/rpc/schannel.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    test suite for schannel operations
   5
   6    Copyright (C) Andrew Tridgell 2004
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 2 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program; if not, write to the Free Software
  20    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21 */
  22
  23 #include "includes.h"
  24 #include "librpc/gen_ndr/ndr_samr.h"
  25 #include "librpc/gen_ndr/ndr_netlogon.h"
  26 #include "lib/cmdline/popt_common.h"
  27
  28 #define TEST_MACHINE_NAME "schannel"
  29
  30 /*
  31   do some samr ops using the schannel connection
  32  */
  33 static BOOL test_samr_ops(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx)
  34 {
  35         NTSTATUS status;
  36         struct samr_GetDomPwInfo r;
  37         struct samr_Connect connect;
  38         struct samr_OpenDomain opendom;
  39         int i;
  40         struct lsa_String name;
  41         struct policy_handle handle;
  42         struct policy_handle domain_handle;
  43
  44         name.string = lp_workgroup();
  45         r.in.domain_name = &name;
  46
  47         connect.in.system_name = 0;
  48         connect.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
  49         connect.out.connect_handle = &handle;
  50
  51         printf("Testing Connect and OpenDomain on BUILTIN\n");
  52
  53         status = dcerpc_samr_Connect(p, mem_ctx, &connect);
  54         if (!NT_STATUS_IS_OK(status)) {
  55                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
  56                         printf("Connect failed (expected, schannel mapped to anonymous): %s\n",
  57                                nt_errstr(status));
  58                 } else {
  59                         printf("Connect failed - %s\n", nt_errstr(status));
  60                         return False;
  61                 }
  62         } else {
  63                 opendom.in.connect_handle = &handle;
  64                 opendom.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
  65                 opendom.in.sid = dom_sid_parse_talloc(mem_ctx, "S-1-5-32");
  66                 opendom.out.domain_handle = &domain_handle;
  67
  68                 status = dcerpc_samr_OpenDomain(p, mem_ctx, &opendom);
  69                 if (!NT_STATUS_IS_OK(status)) {
  70                         printf("OpenDomain failed - %s\n", nt_errstr(status));
  71                         return False;
  72                 }
  73         }
  74
  75         printf("Testing GetDomPwInfo with name %s\n", r.in.domain_name->string);
  76
  77         /* do several ops to test credential chaining */
  78         for (i=0;i<5;i++) {
  79                 status = dcerpc_samr_GetDomPwInfo(p, mem_ctx, &r);
  80                 if (!NT_STATUS_IS_OK(status)) {
  81                         if (!NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
  82                                 printf("GetDomPwInfo op %d failed - %s\n", i, nt_errstr(status));
  83                                 return False;
  84                         }
  85                 }
  86         }
  87
  88         return True;
  89 }
  90
  91
  92 /*
  93   do some lsa ops using the schannel connection
  94  */
  95 static BOOL test_lsa_ops(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx)
  96 {
  97         struct lsa_GetUserName r;
  98         NTSTATUS status;
  99         BOOL ret = True;
 100         struct lsa_StringPointer authority_name_p;
 101
 102         printf("\nTesting GetUserName\n");
 103
 104         r.in.system_name = "\\";
 105         r.in.account_name = NULL;
 106         r.in.authority_name = &authority_name_p;
 107         authority_name_p.string = NULL;
 108
 109         /* do several ops to test credential chaining and various operations */
 110         status = dcerpc_lsa_GetUserName(p, mem_ctx, &r);
 111
 112         if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROTSEQ_NOT_SUPPORTED)) {
 113                 printf("not considering %s to be an error\n", nt_errstr(status));
 114         } else if (!NT_STATUS_IS_OK(status)) {
 115                 printf("GetUserName failed - %s\n", nt_errstr(status));
 116                 return False;
 117         } else {
 118                 if (!r.out.account_name) {
 119                         return False;
 120                 }
 121
 122                 if (strcmp(r.out.account_name->string, "ANONYMOUS LOGON") != 0) {
 123                         printf("GetUserName returned wrong user: %s, expected %s\n",
 124                                r.out.account_name->string, "ANONYMOUS LOGON");
 125                         return False;
 126                 }
 127                 if (!r.out.authority_name || !r.out.authority_name->string) {
 128                         return False;
 129                 }
 130
 131                 if (strcmp(r.out.authority_name->string->string, "NT AUTHORITY") != 0) {
 132                         printf("GetUserName returned wrong user: %s, expected %s\n",
 133                                r.out.authority_name->string->string, "NT AUTHORITY");
 134                         return False;
 135                 }
 136         }
 137         if (!test_many_LookupSids(p, mem_ctx, NULL)) {
 138                 printf("LsaLookupSids3 failed!\n");
 139                 return False;
 140         }
 141
 142         return ret;
 143 }
 144
 145
 146 /*
 147   test a schannel connection with the given flags
 148  */
 149 static BOOL test_schannel(TALLOC_CTX *mem_ctx,
 150                           uint16_t acct_flags, uint32_t dcerpc_flags,
 151                           int i)
 152 {
 153         BOOL ret = True;
 154
 155         void *join_ctx;
 156         NTSTATUS status;
 157         const char *binding = lp_parm_string(-1, "torture", "binding");
 158         struct dcerpc_binding *b;
 159         struct dcerpc_pipe *p = NULL;
 160         struct dcerpc_pipe *p_netlogon = NULL;
 161         struct dcerpc_pipe *p_lsa = NULL;
 162         struct creds_CredentialState *creds;
 163         struct cli_credentials *credentials;
 164
 165         TALLOC_CTX *test_ctx = talloc_named(mem_ctx, 0, "test_schannel context");
 166
 167         join_ctx = torture_join_domain(talloc_asprintf(mem_ctx, "%s%d", TEST_MACHINE_NAME, i),
 168                                        acct_flags, &credentials);
 169         if (!join_ctx) {
 170                 printf("Failed to join domain with acct_flags=0x%x\n", acct_flags);
 171                 talloc_free(test_ctx);
 172                 return False;
 173         }
 174
 175         status = dcerpc_parse_binding(test_ctx, binding, &b);
 176         if (!NT_STATUS_IS_OK(status)) {
 177                 printf("Bad binding string %s\n", binding);
 178                 goto failed;
 179         }
 180
 181         b->flags &= ~DCERPC_AUTH_OPTIONS;
 182         b->flags |= dcerpc_flags;
 183
 184         status = dcerpc_pipe_connect_b(test_ctx,
 185                                        &p, b,
 186                                        DCERPC_SAMR_UUID,
 187                                        DCERPC_SAMR_VERSION,
 188                                        credentials, NULL);
 189         if (!NT_STATUS_IS_OK(status)) {
 190                 printf("Failed to connect with schannel: %s\n", nt_errstr(status));
 191                 goto failed;
 192         }
 193
 194         if (!test_samr_ops(p, test_ctx)) {
 195                 printf("Failed to process schannel secured SAMR ops\n");
 196                 ret = False;
 197         }
 198
 199         /* Also test that when we connect to the netlogon pipe, that
 200          * the credentials we setup on the first pipe are valid for
 201          * the second */
 202
 203         /* Swap the binding details from SAMR to NETLOGON */
 204         status = dcerpc_epm_map_binding(test_ctx, b, DCERPC_NETLOGON_UUID,
 205                                         DCERPC_NETLOGON_VERSION, NULL);
 206         if (!NT_STATUS_IS_OK(status)) {
 207                 goto failed;
 208         }
 209
 210         status = dcerpc_secondary_connection(p, &p_netlogon,
 211                                              b);
 212
 213         if (!NT_STATUS_IS_OK(status)) {
 214                 goto failed;
 215         }
 216
 217         status = dcerpc_bind_auth(p_netlogon,
 218                                   DCERPC_NETLOGON_UUID,
 219                                   DCERPC_NETLOGON_VERSION,
 220                                   credentials, DCERPC_AUTH_TYPE_SCHANNEL,
 221                                   NULL);
 222
 223         if (!NT_STATUS_IS_OK(status)) {
 224                 goto failed;
 225         }
 226
 227         status = dcerpc_schannel_creds(p_netlogon->conn->security_state.generic_state, test_ctx, &creds);
 228         if (!NT_STATUS_IS_OK(status)) {
 229                 goto failed;
 230         }
 231
 232         /* do a couple of logins */
 233         if (!test_netlogon_ops(p_netlogon, test_ctx, credentials, creds)) {
 234                 printf("Failed to process schannel secured NETLOGON ops\n");
 235                 ret = False;
 236         }
 237
 238         /* Swap the binding details from SAMR to LSARPC */
 239         status = dcerpc_epm_map_binding(test_ctx, b, DCERPC_LSARPC_UUID,
 240                                         DCERPC_LSARPC_VERSION, NULL);
 241         if (!NT_STATUS_IS_OK(status)) {
 242                 goto failed;
 243         }
 244
 245         status = dcerpc_secondary_connection(p, &p_lsa,
 246                                              b);
 247
 248         if (!NT_STATUS_IS_OK(status)) {
 249                 goto failed;
 250         }
 251
 252         status = dcerpc_bind_auth(p_lsa,
 253                                   DCERPC_LSARPC_UUID,
 254                                   DCERPC_LSARPC_VERSION,
 255                                   credentials, DCERPC_AUTH_TYPE_SCHANNEL,
 256                                   NULL);
 257
 258         if (!NT_STATUS_IS_OK(status)) {
 259                 goto failed;
 260         }
 261
 262         if (!test_lsa_ops(p_lsa, test_ctx)) {
 263                 printf("Failed to process schannel secured LSA ops\n");
 264                 ret = False;
 265         }
 266
 267         torture_leave_domain(join_ctx);
 268         talloc_free(test_ctx);
 269         return ret;
 270
 271 failed:
 272         torture_leave_domain(join_ctx);
 273         talloc_free(test_ctx);
 274         return False;
 275 }
 276
 277 /*
 278   a schannel test suite
 279  */
 280 BOOL torture_rpc_schannel(void)
 281 {
 282         TALLOC_CTX *mem_ctx;
 283         BOOL ret = True;
 284         struct {
 285                 uint16_t acct_flags;
 286                 uint32_t dcerpc_flags;
 287         } tests[] = {
 288                 { ACB_WSTRUST,   DCERPC_SCHANNEL | DCERPC_SIGN},
 289                 { ACB_WSTRUST,   DCERPC_SCHANNEL | DCERPC_SEAL},
 290                 { ACB_WSTRUST,   DCERPC_SCHANNEL | DCERPC_SIGN | DCERPC_SCHANNEL_128},
 291                 { ACB_WSTRUST,   DCERPC_SCHANNEL | DCERPC_SEAL | DCERPC_SCHANNEL_128 },
 292                 { ACB_SVRTRUST,  DCERPC_SCHANNEL | DCERPC_SIGN },
 293                 { ACB_SVRTRUST,  DCERPC_SCHANNEL | DCERPC_SEAL },
 294                 { ACB_SVRTRUST,  DCERPC_SCHANNEL | DCERPC_SIGN | DCERPC_SCHANNEL_128 },
 295                 { ACB_SVRTRUST,  DCERPC_SCHANNEL | DCERPC_SEAL | DCERPC_SCHANNEL_128 }
 296         };
 297         int i;
 298
 299         mem_ctx = talloc_init("torture_rpc_schannel");
 300
 301         for (i=0;i<ARRAY_SIZE(tests);i++) {
 302                 if (!test_schannel(mem_ctx,
 303                                    tests[i].acct_flags, tests[i].dcerpc_flags,
 304                                    i)) {
 305                         printf("Failed with acct_flags=0x%x dcerpc_flags=0x%x \n",
 306                                tests[i].acct_flags, tests[i].dcerpc_flags);
 307                         ret = False;
 308                         break;
 309                 }
 310         }
 311
 312         talloc_free(mem_ctx);
 313
 314         return ret;
 315 }