source4/torture/rpc/testjoin.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    utility code to join/leave a domain
   5
   6    Copyright (C) Andrew Tridgell 2004
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 2 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program; if not, write to the Free Software
  20    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21 */
  22
  23 /*
  24   this code is used by other torture modules to join/leave a domain
  25   as either a member, bdc or thru a trust relationship
  26 */
  27
  28 #include "includes.h"
  29 #include "torture/torture.h"
  30 #include "system/time.h"
  31 #include "lib/crypto/crypto.h"
  32 #include "libnet/libnet.h"
  33 #include "lib/cmdline/popt_common.h"
  34 #include "lib/ldb/include/ldb.h"
  35 #include "librpc/gen_ndr/ndr_samr_c.h"
  36
  37 #include "libcli/auth/libcli_auth.h"
  38 #include "torture/rpc/rpc.h"
  39 #include "libcli/security/security.h"
  40
  41 struct test_join {
  42         struct dcerpc_pipe *p;
  43         struct policy_handle user_handle;
  44         struct libnet_JoinDomain *libnet_r;
  45         struct dom_sid *dom_sid;
  46         struct dom_sid *user_sid;
  47 };
  48
  49
  50 static NTSTATUS DeleteUser_byname(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
  51                                   struct policy_handle *handle, const char *name)
  52 {
  53         NTSTATUS status;
  54         struct samr_DeleteUser d;
  55         struct policy_handle user_handle;
  56         uint32_t rid;
  57         struct samr_LookupNames n;
  58         struct lsa_String sname;
  59         struct samr_OpenUser r;
  60
  61         sname.string = name;
  62
  63         n.in.domain_handle = handle;
  64         n.in.num_names = 1;
  65         n.in.names = &sname;
  66
  67         status = dcerpc_samr_LookupNames(p, mem_ctx, &n);
  68         if (NT_STATUS_IS_OK(status)) {
  69                 rid = n.out.rids.ids[0];
  70         } else {
  71                 return status;
  72         }
  73
  74         r.in.domain_handle = handle;
  75         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
  76         r.in.rid = rid;
  77         r.out.user_handle = &user_handle;
  78
  79         status = dcerpc_samr_OpenUser(p, mem_ctx, &r);
  80         if (!NT_STATUS_IS_OK(status)) {
  81                 printf("OpenUser(%s) failed - %s\n", name, nt_errstr(status));
  82                 return status;
  83         }
  84
  85         d.in.user_handle = &user_handle;
  86         d.out.user_handle = &user_handle;
  87         status = dcerpc_samr_DeleteUser(p, mem_ctx, &d);
  88         if (!NT_STATUS_IS_OK(status)) {
  89                 return status;
  90         }
  91
  92         return NT_STATUS_OK;
  93 }
  94
  95 /*
  96   create a test user in the domain
  97   an opaque pointer is returned. Pass it to torture_leave_domain()
  98   when finished
  99 */
 100
 101 struct test_join *torture_create_testuser(const char *username,
 102                                           const char *domain,
 103                                           uint16_t acct_type,
 104                                           const char **random_password)
 105 {
 106         NTSTATUS status;
 107         struct samr_Connect c;
 108         struct samr_CreateUser2 r;
 109         struct samr_OpenDomain o;
 110         struct samr_LookupDomain l;
 111         struct samr_GetUserPwInfo pwp;
 112         struct samr_SetUserInfo s;
 113         union samr_UserInfo u;
 114         struct policy_handle handle;
 115         struct policy_handle domain_handle;
 116         uint32_t access_granted;
 117         uint32_t rid;
 118         DATA_BLOB session_key;
 119         struct lsa_String name;
 120
 121         int policy_min_pw_len = 0;
 122         struct test_join *join;
 123         char *random_pw;
 124
 125         join = talloc(NULL, struct test_join);
 126         if (join == NULL) {
 127                 return NULL;
 128         }
 129
 130         ZERO_STRUCTP(join);
 131
 132         printf("Connecting to SAMR\n");
 133
 134         status = torture_rpc_connection(join,
 135                                         &join->p,
 136                                         &dcerpc_table_samr);
 137         if (!NT_STATUS_IS_OK(status)) {
 138                 return NULL;
 139         }
 140
 141         c.in.system_name = NULL;
 142         c.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 143         c.out.connect_handle = &handle;
 144
 145         status = dcerpc_samr_Connect(join->p, join, &c);
 146         if (!NT_STATUS_IS_OK(status)) {
 147                 const char *errstr = nt_errstr(status);
 148                 if (NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
 149                         errstr = dcerpc_errstr(join, join->p->last_fault_code);
 150                 }
 151                 printf("samr_Connect failed - %s\n", errstr);
 152                 return NULL;
 153         }
 154
 155         printf("Opening domain %s\n", domain);
 156
 157         name.string = domain;
 158         l.in.connect_handle = &handle;
 159         l.in.domain_name = &name;
 160
 161         status = dcerpc_samr_LookupDomain(join->p, join, &l);
 162         if (!NT_STATUS_IS_OK(status)) {
 163                 printf("LookupDomain failed - %s\n", nt_errstr(status));
 164                 goto failed;
 165         }
 166
 167         talloc_steal(join, l.out.sid);
 168         join->dom_sid = l.out.sid;
 169
 170         o.in.connect_handle = &handle;
 171         o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 172         o.in.sid = l.out.sid;
 173         o.out.domain_handle = &domain_handle;
 174
 175         status = dcerpc_samr_OpenDomain(join->p, join, &o);
 176         if (!NT_STATUS_IS_OK(status)) {
 177                 printf("OpenDomain failed - %s\n", nt_errstr(status));
 178                 goto failed;
 179         }
 180
 181         printf("Creating account %s\n", username);
 182
 183 again:
 184         name.string = username;
 185         r.in.domain_handle = &domain_handle;
 186         r.in.account_name = &name;
 187         r.in.acct_flags = acct_type;
 188         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 189         r.out.user_handle = &join->user_handle;
 190         r.out.access_granted = &access_granted;
 191         r.out.rid = &rid;
 192
 193         status = dcerpc_samr_CreateUser2(join->p, join, &r);
 194
 195         if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
 196                 status = DeleteUser_byname(join->p, join, &domain_handle, name.string);
 197                 if (NT_STATUS_IS_OK(status)) {
 198                         goto again;
 199                 }
 200         }
 201
 202         if (!NT_STATUS_IS_OK(status)) {
 203                 printf("CreateUser2 failed - %s\n", nt_errstr(status));
 204                 goto failed;
 205         }
 206
 207         join->user_sid = dom_sid_add_rid(join, join->dom_sid, rid);
 208
 209         pwp.in.user_handle = &join->user_handle;
 210
 211         status = dcerpc_samr_GetUserPwInfo(join->p, join, &pwp);
 212         if (NT_STATUS_IS_OK(status)) {
 213                 policy_min_pw_len = pwp.out.info.min_password_length;
 214         }
 215
 216         random_pw = generate_random_str(join, MAX(8, policy_min_pw_len));
 217
 218         printf("Setting account password '%s'\n", random_pw);
 219
 220         s.in.user_handle = &join->user_handle;
 221         s.in.info = &u;
 222         s.in.level = 24;
 223
 224         encode_pw_buffer(u.info24.password.data, random_pw, STR_UNICODE);
 225         u.info24.pw_len = strlen(random_pw);
 226
 227         status = dcerpc_fetch_session_key(join->p, &session_key);
 228         if (!NT_STATUS_IS_OK(status)) {
 229                 printf("SetUserInfo level %u - no session key - %s\n",
 230                        s.in.level, nt_errstr(status));
 231                 torture_leave_domain(join);
 232                 goto failed;
 233         }
 234
 235         arcfour_crypt_blob(u.info24.password.data, 516, &session_key);
 236
 237         status = dcerpc_samr_SetUserInfo(join->p, join, &s);
 238         if (!NT_STATUS_IS_OK(status)) {
 239                 printf("SetUserInfo failed - %s\n", nt_errstr(status));
 240                 goto failed;
 241         }
 242
 243         ZERO_STRUCT(u);
 244         s.in.user_handle = &join->user_handle;
 245         s.in.info = &u;
 246         s.in.level = 21;
 247
 248         u.info21.acct_flags = acct_type;
 249         u.info21.fields_present = SAMR_FIELD_ACCT_FLAGS | SAMR_FIELD_DESCRIPTION | SAMR_FIELD_COMMENT | SAMR_FIELD_FULL_NAME;
 250
 251         u.info21.comment.string = talloc_asprintf(join,
 252                                                   "Tortured by Samba4: %s",
 253                                                   timestring(join, time(NULL)));
 254
 255         u.info21.full_name.string = talloc_asprintf(join,
 256                                                     "Torture account for Samba4: %s",
 257                                                     timestring(join, time(NULL)));
 258
 259         u.info21.description.string = talloc_asprintf(join,
 260                                          "Samba4 torture account created by host %s: %s",
 261                                          lp_netbios_name(), timestring(join, time(NULL)));
 262
 263         printf("Resetting ACB flags, force pw change time\n");
 264
 265         status = dcerpc_samr_SetUserInfo(join->p, join, &s);
 266         if (!NT_STATUS_IS_OK(status)) {
 267                 printf("SetUserInfo failed - %s\n", nt_errstr(status));
 268                 goto failed;
 269         }
 270
 271         if (random_password) {
 272                 *random_password = random_pw;
 273         }
 274
 275         return join;
 276
 277 failed:
 278         torture_leave_domain(join);
 279         return NULL;
 280 }
 281
 282
 283 _PUBLIC_ struct test_join *torture_join_domain(const char *machine_name,
 284                                       uint32_t acct_flags,
 285                                       struct cli_credentials **machine_credentials)
 286 {
 287         NTSTATUS status;
 288         struct libnet_context *libnet_ctx;
 289         struct libnet_JoinDomain *libnet_r;
 290         struct test_join *tj;
 291         struct samr_SetUserInfo s;
 292         union samr_UserInfo u;
 293
 294         tj = talloc(NULL, struct test_join);
 295         if (!tj) return NULL;
 296
 297         libnet_r = talloc(tj, struct libnet_JoinDomain);
 298         if (!libnet_r) {
 299                 talloc_free(tj);
 300                 return NULL;
 301         }
 302
 303         libnet_ctx = libnet_context_init(NULL);
 304         if (!libnet_ctx) {
 305                 talloc_free(tj);
 306                 return NULL;
 307         }
 308
 309         tj->libnet_r = libnet_r;
 310
 311         libnet_ctx->cred = cmdline_credentials;
 312         libnet_r->in.binding = lp_parm_string(-1, "torture", "binding");
 313         if (!libnet_r->in.binding) {
 314                 libnet_r->in.binding = talloc_asprintf(libnet_r, "ncacn_np:%s", lp_parm_string(-1, "torture", "host"));
 315         }
 316         libnet_r->in.level = LIBNET_JOINDOMAIN_SPECIFIED;
 317         libnet_r->in.netbios_name = machine_name;
 318         libnet_r->in.account_name = talloc_asprintf(libnet_r, "%s$", machine_name);
 319         if (!libnet_r->in.account_name) {
 320                 talloc_free(tj);
 321                 return NULL;
 322         }
 323
 324         libnet_r->in.acct_type = acct_flags;
 325         libnet_r->in.recreate_account = True;
 326
 327         status = libnet_JoinDomain(libnet_ctx, libnet_r, libnet_r);
 328         if (!NT_STATUS_IS_OK(status)) {
 329                 if (libnet_r->out.error_string) {
 330                         DEBUG(0, ("Domain join failed - %s\n", libnet_r->out.error_string));
 331                 } else {
 332                         DEBUG(0, ("Domain join failed - %s\n", nt_errstr(status)));
 333                 }
 334                 talloc_free(tj);
 335                 return NULL;
 336         }
 337         tj->p = libnet_r->out.samr_pipe;
 338         tj->user_handle = *libnet_r->out.user_handle;
 339         tj->dom_sid = libnet_r->out.domain_sid;
 340         talloc_steal(tj, libnet_r->out.domain_sid);
 341
 342         ZERO_STRUCT(u);
 343         s.in.user_handle = &tj->user_handle;
 344         s.in.info = &u;
 345         s.in.level = 21;
 346
 347         u.info21.fields_present = SAMR_FIELD_DESCRIPTION | SAMR_FIELD_COMMENT | SAMR_FIELD_FULL_NAME;
 348         u.info21.comment.string = talloc_asprintf(tj,
 349                                                   "Tortured by Samba4: %s",
 350                                                   timestring(tj, time(NULL)));
 351         u.info21.full_name.string = talloc_asprintf(tj,
 352                                                     "Torture account for Samba4: %s",
 353                                                     timestring(tj, time(NULL)));
 354
 355         u.info21.description.string = talloc_asprintf(tj,
 356                                                       "Samba4 torture account created by host %s: %s",
 357                                                       lp_netbios_name(), timestring(tj, time(NULL)));
 358
 359         status = dcerpc_samr_SetUserInfo(tj->p, tj, &s);
 360         if (!NT_STATUS_IS_OK(status)) {
 361                 printf("SetUserInfo (non-critical) failed - %s\n", nt_errstr(status));
 362         }
 363
 364         *machine_credentials = cli_credentials_init(tj);
 365         cli_credentials_set_conf(*machine_credentials);
 366         cli_credentials_set_workstation(*machine_credentials, machine_name, CRED_SPECIFIED);
 367         cli_credentials_set_domain(*machine_credentials, libnet_r->out.domain_name, CRED_SPECIFIED);
 368         if (libnet_r->out.realm) {
 369                 cli_credentials_set_realm(*machine_credentials, libnet_r->out.realm, CRED_SPECIFIED);
 370         }
 371         cli_credentials_set_username(*machine_credentials, libnet_r->in.account_name, CRED_SPECIFIED);
 372         cli_credentials_set_password(*machine_credentials, libnet_r->out.join_password, CRED_SPECIFIED);
 373         if (acct_flags & ACB_SVRTRUST) {
 374                 cli_credentials_set_secure_channel_type(*machine_credentials,
 375                                                         SEC_CHAN_BDC);
 376         } else if (acct_flags & ACB_WSTRUST) {
 377                 cli_credentials_set_secure_channel_type(*machine_credentials,
 378                                                         SEC_CHAN_WKSTA);
 379         } else {
 380                 DEBUG(0, ("Invalid account type specificed to torture_join_domain\n"));
 381                 talloc_free(*machine_credentials);
 382                 return NULL;
 383         }
 384
 385         return tj;
 386 }
 387
 388 struct dcerpc_pipe *torture_join_samr_pipe(struct test_join *join)
 389 {
 390         return join->p;
 391 }
 392
 393 struct policy_handle *torture_join_samr_user_policy(struct test_join *join)
 394 {
 395         return &join->user_handle;
 396 }
 397
 398 NTSTATUS torture_leave_ads_domain(TALLOC_CTX *mem_ctx, struct libnet_JoinDomain *libnet_r)
 399 {
 400         int rtn;
 401         TALLOC_CTX *tmp_ctx;
 402
 403         struct ldb_dn *server_dn;
 404         struct ldb_context *ldb_ctx;
 405
 406         char *remote_ldb_url;
 407
 408         /* Check if we are a domain controller. If not, exit. */
 409         if (!libnet_r->out.server_dn_str) {
 410                 return NT_STATUS_OK;
 411         }
 412
 413         tmp_ctx = talloc_named(mem_ctx, 0, "torture_leave temporary context");
 414         if (!tmp_ctx) {
 415                 libnet_r->out.error_string = NULL;
 416                 return NT_STATUS_NO_MEMORY;
 417         }
 418
 419         ldb_ctx = ldb_init(tmp_ctx);
 420         if (!ldb_ctx) {
 421                 libnet_r->out.error_string = NULL;
 422                 talloc_free(tmp_ctx);
 423                 return NT_STATUS_NO_MEMORY;
 424         }
 425
 426         /* Remove CN=Servers,... entry from the AD. */
 427         server_dn = ldb_dn_new(tmp_ctx, ldb_ctx, libnet_r->out.server_dn_str);
 428         if (! ldb_dn_validate(server_dn)) {
 429                 libnet_r->out.error_string = NULL;
 430                 talloc_free(tmp_ctx);
 431                 return NT_STATUS_NO_MEMORY;
 432         }
 433
 434         remote_ldb_url = talloc_asprintf(tmp_ctx, "ldap://%s", libnet_r->out.samr_binding->host);
 435         if (!remote_ldb_url) {
 436                 libnet_r->out.error_string = NULL;
 437                 talloc_free(tmp_ctx);
 438                 return NT_STATUS_NO_MEMORY;
 439         }
 440
 441         ldb_set_opaque(ldb_ctx, "credentials", cmdline_credentials);
 442
 443         rtn = ldb_connect(ldb_ctx, remote_ldb_url, 0, NULL);
 444         if (rtn != 0) {
 445                 libnet_r->out.error_string = NULL;
 446                 talloc_free(tmp_ctx);
 447                 return NT_STATUS_UNSUCCESSFUL;
 448         }
 449
 450         rtn = ldb_delete(ldb_ctx, server_dn);
 451         if (rtn != 0) {
 452                 libnet_r->out.error_string = NULL;
 453                 talloc_free(tmp_ctx);
 454                 return NT_STATUS_UNSUCCESSFUL;
 455         }
 456
 457         DEBUG(0, ("%s removed successfully.\n", libnet_r->out.server_dn_str));
 458
 459         talloc_free(tmp_ctx);
 460         return NT_STATUS_OK;
 461 }
 462
 463 /*
 464   leave the domain, deleting the machine acct
 465 */
 466
 467 _PUBLIC_ void torture_leave_domain(struct test_join *join)
 468 {
 469         struct samr_DeleteUser d;
 470         NTSTATUS status;
 471
 472         if (!join) {
 473                 return;
 474         }
 475         d.in.user_handle = &join->user_handle;
 476         d.out.user_handle = &join->user_handle;
 477
 478         /* Delete machine account */
 479         status = dcerpc_samr_DeleteUser(join->p, join, &d);
 480         if (!NT_STATUS_IS_OK(status)) {
 481                 printf("Delete of machine account failed\n");
 482         } else {
 483                 printf("Delete of machine account was successful.\n");
 484         }
 485
 486         if (join->libnet_r) {
 487                 status = torture_leave_ads_domain(join, join->libnet_r);
 488         }
 489
 490         talloc_free(join);
 491 }
 492
 493 /*
 494   return the dom sid for a test join
 495 */
 496 _PUBLIC_ const struct dom_sid *torture_join_sid(struct test_join *join)
 497 {
 498         return join->dom_sid;
 499 }
 500
 501 const struct dom_sid *torture_join_user_sid(struct test_join *join)
 502 {
 503         return join->user_sid;
 504 }
 505
 506
 507 struct test_join_ads_dc {
 508         struct test_join *join;
 509 };
 510
 511 struct test_join_ads_dc *torture_join_domain_ads_dc(const char *machine_name,
 512                                                     const char *domain,
 513                                                     struct cli_credentials **machine_credentials)
 514 {
 515         struct test_join_ads_dc *join;
 516
 517         join = talloc(NULL, struct test_join_ads_dc);
 518         if (join == NULL) {
 519                 return NULL;
 520         }
 521
 522         join->join = torture_join_domain(machine_name,
 523                                         ACB_SVRTRUST,
 524                                         machine_credentials);
 525
 526         if (!join->join) {
 527                 return NULL;
 528         }
 529
 530 /* W2K: */
 531         /* W2K: modify userAccountControl from 4096 to 532480 */
 532
 533         /* W2K: modify RDN to OU=Domain Controllers and skip the $ from server name */
 534
 535         /* ask objectVersion of Schema Partition */
 536
 537         /* ask rIDManagerReferenz of the Domain Partition */
 538
 539         /* ask fsMORoleOwner of the RID-Manager$ object
 540          * returns CN=NTDS Settings,CN=<DC>,CN=Servers,CN=Default-First-Site-Name, ...
 541          */
 542
 543         /* ask for dnsHostName of CN=<DC>,CN=Servers,CN=Default-First-Site-Name, ... */
 544
 545         /* ask for objectGUID of CN=NTDS Settings,CN=<DC>,CN=Servers,CN=Default-First-Site-Name, ... */
 546
 547         /* ask for * of CN=Default-First-Site-Name, ... */
 548
 549         /* search (&(|(objectClass=user)(objectClass=computer))(sAMAccountName=<machine_name>$)) in Domain Partition
 550          * attributes : distinguishedName, userAccountControl
 551          */
 552
 553         /* ask * for CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
 554          * should fail with noSuchObject
 555          */
 556
 557         /* add CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
 558          *
 559          * objectClass = server
 560          * systemFlags = 50000000
 561          * serverReferenz = CN=<machine_name>,OU=Domain Controllers,...
 562          */
 563
 564         /* ask for * of CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
 565          * should fail with noSuchObject
 566          */
 567
 568         /* search for (ncname=<domain_nc>) in CN=Partitions,CN=Configuration,...
 569          * attributes: ncName, dnsRoot
 570          */
 571
 572         /* modify add CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
 573          * serverReferenz = CN=<machine_name>,OU=Domain Controllers,...
 574          * should fail with attributeOrValueExists
 575          */
 576
 577         /* modify replace CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
 578          * serverReferenz = CN=<machine_name>,OU=Domain Controllers,...
 579          */
 580
 581         /* DsAddEntry to create the CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
 582          *
 583          */
 584
 585         /* replicate CN=Schema,CN=Configuration,...
 586          * using DRSUAPI_DS_BIND_GUID_W2K ("6abec3d1-3054-41c8-a362-5a0c5b7d5d71")
 587          *
 588          */
 589
 590         /* replicate CN=Configuration,...
 591          * using DRSUAPI_DS_BIND_GUID_W2K ("6abec3d1-3054-41c8-a362-5a0c5b7d5d71")
 592          *
 593          */
 594
 595         /* replicate Domain Partition
 596          * using DRSUAPI_DS_BIND_GUID_W2K ("6abec3d1-3054-41c8-a362-5a0c5b7d5d71")
 597          *
 598          */
 599
 600         /* call DsReplicaUpdateRefs() for all partitions like this:
 601          *     req1: struct drsuapi_DsReplicaUpdateRefsRequest1
 602          *           naming_context           : *
 603          *                 naming_context: struct drsuapi_DsReplicaObjectIdentifier
 604          *                     __ndr_size               : 0x000000ae (174)
 605          *                     __ndr_size_sid           : 0x00000000 (0)
 606          *                     guid                     : 00000000-0000-0000-0000-000000000000
 607          *                     sid                      : S-0-0
 608          *                     dn                       : 'CN=Schema,CN=Configuration,DC=w2k3,DC=vmnet1,DC=vm,DC=base'
 609          *           dest_dsa_dns_name        : *
 610          *                 dest_dsa_dns_name        : '4a0df188-a0b8-47ea-bbe5-e614723f16dd._msdcs.w2k3.vmnet1.vm.base'
 611          *           dest_dsa_guid            : 4a0df188-a0b8-47ea-bbe5-e614723f16dd
 612          *           options                  : 0x0000001c (28)
 613          *                 0: DRSUAPI_DS_REPLICA_UPDATE_ASYNCHRONOUS_OPERATION
 614          *                 0: DRSUAPI_DS_REPLICA_UPDATE_WRITEABLE
 615          *                 1: DRSUAPI_DS_REPLICA_UPDATE_ADD_REFERENCE
 616          *                 1: DRSUAPI_DS_REPLICA_UPDATE_DELETE_REFERENCE
 617          *                 1: DRSUAPI_DS_REPLICA_UPDATE_0x00000010
 618          *
 619          * 4a0df188-a0b8-47ea-bbe5-e614723f16dd is the objectGUID the DsAddEntry() returned for the
 620          * CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
 621          */
 622
 623 /* W2K3: */
 624         /*
 625          * lookup DC:
 626          * - using nbt name<1C> request and a samlogon mailslot request
 627          * or
 628          * - using a DNS SRV _ldap._tcp.dc._msdcs. request and a CLDAP netlogon request
 629          */
 630         /*
 631          * Open 1st LDAP connection to the DC using admin credentials
 632          */
 633
 634         /*
 635          * LDAP search 1st LDAP connection:
 636          *
 637          * Request:
 638          *      basedn: ""
 639          *      scope:  base
 640          *      filter: (objectClass=*)
 641          *      attrs:  *
 642          * Result:
 643          *      ""
 644          *              currentTime:            ...
 645          *              subschemaSubEntry:      ...
 646          *              dsServiceName:          CN=<netbios_name>,CN=Servers,CN=<site_name>,CN=Sites,CN=Configuration,<domain_partition>
 647          *              namingContexts:         <domain_partition>
 648          *                                      CN=Configuration,<domain_partition>
 649          *                                      CN=Schema,CN=Configuration,<domain_partition>
 650          *              defaultNamingContext:   <domain_partition>
 651          *              schemaNamingContext:    CN=Schema,CN=Configuration,<domain_partition>
 652          *              configurationNamingContext:CN=Configuration,<domain_partition>
 653          *              rootDomainNamingContext:<domain_partition>
 654          *              supportedControl:       ...
 655          *              supportedLDAPVersion:   3
 656          *                                      2
 657          *              supportedSASLmechanisms:...
 658          *              dnsHostName:            <dns_host_name>
 659          *              ldapServiceName:        <domain_dns_name>:<netbios_name>$@<REALM>
 660          *              serverName:             CN=Servers,CN=<site_name>,CN=Sites,CN=Configuration,<domain_partition>
 661          *              supportedCapabilities:  ...
 662          *              isSyncronized:          TRUE
 663          *              isGlobalCatalogReady:   TRUE
 664          *              domainFunctionality:    0
 665          *              forestFunctionality:    0
 666          *              domainControllerFunctionality: 2
 667          */
 668
 669         /*
 670          * LDAP search 1st LDAP connection:
 671          *
 672          * Request:
 673          *      basedn: CN=Configuration,<domain_partition>
 674          *      scope:  one
 675          *      filter: (cn=Partitions)
 676          *      attrs:  msDS-Behavior-Version
 677          * Result:
 678          *      CN=Partitions,CN=Configuration,<domain_partition>
 679          *              msDS-Behavior-Version:  0
 680          */
 681
 682         /*
 683          * LDAP search 1st LDAP connection:
 684          *
 685          * NOTE: this seems to be a bug! as the messageID of the LDAP message is corrupted!
 686          *
 687          * Request:
 688          *      basedn: CN=Schema,CN=Configuration,<domain_partition>
 689          *      scope:  one
 690          *      filter: (cn=Partitions)
 691          *      attrs:  msDS-Behavior-Version
 692          * Result:
 693          *      <none>
 694          *
 695          */
 696
 697         /*
 698          * LDAP search 1st LDAP connection:
 699          *
 700          * Request:
 701          *      basedn: <domain_partition>
 702          *      scope:  base
 703          *      filter: (objectClass=*)
 704          *      attrs:  msDS-Behavior-Version
 705          * Result:
 706          *      <domain_partition>
 707          *              msDS-Behavior-Version:  0
 708          */
 709
 710         /*
 711          * LDAP search 1st LDAP connection:
 712          *
 713          * Request:
 714          *      basedn: CN=Schema,CN=Configuration,<domain_partition>
 715          *      scope:  base
 716          *      filter: (objectClass=*)
 717          *      attrs:  objectVersion
 718          * Result:
 719          *      CN=Schema,CN=Configuration,<domain_partition>
 720          *              objectVersion:  30
 721          */
 722
 723         /*
 724          * LDAP search 1st LDAP connection:
 725          *
 726          * Request:
 727          *      basedn: ""
 728          *      scope:  base
 729          *      filter: (objectClass=*)
 730          *      attrs:  defaultNamingContext
 731          *              dnsHostName
 732          * Result:
 733          *      ""
 734          *              defaultNamingContext:   <domain_partition>
 735          *              dnsHostName:            <dns_host_name>
 736          */
 737
 738         /* START: Infrastructure FSMO */
 739         /*
 740          * LDAP search 1st LDAP connection:
 741          *
 742          * Request:
 743          *      basedn: <WKGUID=2fbac1870ade11d297c400c04fd8d5cd,domain_partition>
 744          *      scope:  base
 745          *      filter: (objectClass=*)
 746          *      attrs:  1.1
 747          * Result:
 748          *      CN=Infrastructure,<domain_partition>
 749          */
 750
 751         /*
 752          * LDAP search 1st LDAP connection:
 753          *
 754          * Request:
 755          *      basedn: CN=Windows2003Update,CN=DomainUpdates,CN=System,<domain_partition>
 756          *      scope:  base
 757          *      filter: (objectClass=*)
 758          *      attrs:  revision
 759          * Result:
 760          *      CN=Windows2003Update,CN=DomainUpdates,CN=System,<domain_partition>
 761          *              revision:       8
 762          */
 763
 764         /*
 765          * LDAP search 1st LDAP connection:
 766          *
 767          * Request:
 768          *      basedn: CN=Infrastructure,<domain_partition>
 769          *      scope:  base
 770          *      filter: (objectClass=*)
 771          *      attrs:  fSMORoleOwner
 772          * Result:
 773          *      CN=Infrastructure,<domain_partition>
 774          *              fSMORoleOwner:  CN=NTDS Settings,<infrastructure_fsmo_server_object>
 775          */
 776
 777         /*
 778          * LDAP search 1st LDAP connection:
 779          *
 780          * Request:
 781          *      basedn: <infrastructure_fsmo_server_object>
 782          *      scope:  base
 783          *      filter: (objectClass=*)
 784          *      attrs:  dnsHostName
 785          * Result:
 786          *      <infrastructure_fsmo_server_object>
 787          *              dnsHostName:    <dns_host_name>
 788          */
 789
 790         /*
 791          * LDAP search 1st LDAP connection:
 792          *
 793          * Request:
 794          *      basedn: CN=NTDS Settings,<infrastructure_fsmo_server_object>
 795          *      scope:  base
 796          *      filter: (objectClass=*)
 797          *      attrs:  objectGUID
 798          * Result:
 799          *      CN=NTDS Settings,<infrastructure_fsmo_server_object>
 800          *              objectGUID:     <object_guid>
 801          */
 802         /* END: Infrastructure FSMO */
 803
 804         /* START: RID Manager FSMO */
 805         /*
 806          * LDAP search 1st LDAP connection:
 807          *
 808          * Request:
 809          *      basedn: <domain_partition>
 810          *      scope:  base
 811          *      filter: (objectClass=*)
 812          *      attrs:  rIDManagerReference
 813          * Result:
 814          *      <domain_partition>
 815          *              rIDManagerReference:    CN=RID Manager$,CN=System,<domain_partition>
 816          */
 817
 818         /*
 819          * LDAP search 1st LDAP connection:
 820          *
 821          * Request:
 822          *      basedn: CN=RID Manager$,CN=System,<domain_partition>
 823          *      scope:  base
 824          *      filter: (objectClass=*)
 825          *      attrs:  fSMORoleOwner
 826          * Result:
 827          *      CN=Infrastructure,<domain_partition>
 828          *              fSMORoleOwner:  CN=NTDS Settings,<rid_manager_fsmo_server_object>
 829          */
 830
 831         /*
 832          * LDAP search 1st LDAP connection:
 833          *
 834          * Request:
 835          *      basedn: <rid_manager_fsmo_server_object>
 836          *      scope:  base
 837          *      filter: (objectClass=*)
 838          *      attrs:  dnsHostName
 839          * Result:
 840          *      <rid_manager_fsmo_server_object>
 841          *              dnsHostName:    <dns_host_name>
 842          */
 843
 844         /*
 845          * LDAP search 1st LDAP connection:
 846          *
 847          * Request:
 848          *      basedn: CN=NTDS Settings,<rid_manager_fsmo_server_object>
 849          *      scope:  base
 850          *      filter: (objectClass=*)
 851          *      attrs:  msDs-ReplicationEpoch
 852          * Result:
 853          *      CN=NTDS Settings,<rid_manager_fsmo_server_object>
 854          */
 855         /* END: RID Manager FSMO */
 856
 857         /*
 858          * LDAP search 1st LDAP connection:
 859          *
 860          * Request:
 861          *      basedn: CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
 862          *      scope:  base
 863          *      filter: (objectClass=*)
 864          *      attrs:
 865          * Result:
 866          *      CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
 867          *              objectClass:    top
 868          *                              site
 869          *              cn:             <new_dc_site_name>
 870          *              distinguishedName:CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
 871          *              instanceType:   4
 872          *              whenCreated:    ...
 873          *              whenChanged:    ...
 874          *              uSNCreated:     ...
 875          *              uSNChanged:     ...
 876          *              showInAdvancedViewOnly: TRUE
 877          *              name:           <new_dc_site_name>
 878          *              objectGUID:     <object_guid>
 879          *              systemFlags:    1107296256 <0x42000000>
 880          *              objectCategory: CN=Site,C=Schema,CN=Configuration,<domain_partition>
 881          */
 882
 883         /*
 884          * LDAP search 1st LDAP connection:
 885          *
 886          * Request:
 887          *      basedn: <domain_partition>
 888          *      scope:  sub
 889          *      filter: (&(|(objectClass=user)(objectClass=computer))(sAMAccountName=<new_dc_account_name>))
 890          *      attrs:  distinguishedName
 891          *              userAccountControl
 892          * Result:
 893          *      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 894          *              distinguishedName:      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 895          *              userAccoountControl:    4096 <0x1000>
 896          */
 897
 898         /*
 899          * LDAP search 1st LDAP connection:
 900          *
 901          * Request:
 902          *      basedn: CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
 903          *      scope:  base
 904          *      filter: (objectClass=*)
 905          *      attrs:
 906          * Result:
 907          *      <noSuchObject>
 908          *      <matchedDN:CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>>
 909          */
 910
 911         /*
 912          * LDAP search 1st LDAP connection:
 913          *
 914          * Request:
 915          *      basedn: CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 916          *      scope:  base
 917          *      filter: (objectClass=*)
 918          *      attrs:  serverReferenceBL
 919          *      typesOnly: TRUE!!!
 920          * Result:
 921          *      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 922          */
 923
 924         /*
 925          * LDAP add 1st LDAP connection:
 926          *
 927          * Request:
 928          *      CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 929          *      objectClass:    server
 930          *      systemFlags:    50000000 <0x2FAF080>
 931          *      serverReference:CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 932          * Result:
 933          *      <success>
 934          */
 935
 936         /*
 937          * LDAP search 1st LDAP connection:
 938          *
 939          * Request:
 940          *      basedn: CN=NTDS Settings,CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>
 941          *      scope:  base
 942          *      filter: (objectClass=*)
 943          *      attrs:
 944          * Result:
 945          *      <noSuchObject>
 946          *      <matchedDN:CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>>
 947          */
 948
 949         /*
 950          * LDAP search 1st LDAP connection:
 951          *
 952          * Request:
 953          *      basedn: CN=Partitions,CN=Configuration,<domain_partition>
 954          *      scope:  sub
 955          *      filter: (nCName=<domain_partition>)
 956          *      attrs:  nCName
 957          *              dnsRoot
 958          *      controls: LDAP_SERVER_EXTENDED_DN_OID:critical=false
 959          * Result:
 960          *      <GUID=<hex_guid>>;CN=<domain_netbios_name>,CN=Partitions,<domain_partition>>
 961          *              nCName:         <GUID=<hex_guid>>;<SID=<hex_sid>>;<domain_partition>>
 962          *              dnsRoot:        <domain_dns_name>
 963          */
 964
 965         /*
 966          * LDAP modify 1st LDAP connection:
 967          *
 968          * Request (add):
 969          *      CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>>
 970          *      serverReference:CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 971          * Result:
 972          *      <attributeOrValueExist>
 973          */
 974
 975         /*
 976          * LDAP modify 1st LDAP connection:
 977          *
 978          * Request (replace):
 979          *      CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>>
 980          *      serverReference:CN=<new_dc_netbios_name>,CN=Computers,<domain_partition>
 981          * Result:
 982          *      <success>
 983          */
 984
 985         /*
 986          * Open 1st DRSUAPI connection to the DC using admin credentials
 987          * DsBind with DRSUAPI_DS_BIND_GUID_W2K3 ("6afab99c-6e26-464a-975f-f58f105218bc")
 988          * (w2k3 does 2 DsBind() calls here..., where is first is unused and contains garbage at the end)
 989          */
 990
 991         /*
 992          * DsAddEntry to create the CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
 993          * on the 1st DRSUAPI connection
 994          */
 995
 996         /*
 997          * Open 2nd and 3rd DRSUAPI connection to the DC using admin credentials
 998          * - a DsBind with DRSUAPI_DS_BIND_GUID_W2K3 ("6afab99c-6e26-464a-975f-f58f105218bc")
 999          *   on the 2nd connection
1000          */
1001
1002         /*
1003          * replicate CN=Schema,CN=Configuration,...
1004          * on the 3rd DRSUAPI connection and the bind_handle from the 2nd connection
1005          */
1006
1007         /*
1008          * replicate CN=Configuration,...
1009          * on the 3rd DRSUAPI connection and the bind_handle from the 2nd connection
1010          */
1011
1012         /*
1013          * LDAP unbind in the 1st LDAP connection
1014          */
1015
1016         /*
1017          * Open 2nd LDAP connection to the DC using admin credentials
1018          */
1019         /* ldap modify userAccountControl from 4096 to 532480 */
1020
1021         /* ldap modify RDN to OU=Domain Controllers and skip the $ from server name */
1022
1023         /*
1024          * replicate Domain Partition
1025          * on the 3rd DRSUAPI connection and the bind_handle from the 2nd connection
1026          */
1027
1028         /* call DsReplicaUpdateRefs() for all partitions like this:
1029          *     req1: struct drsuapi_DsReplicaUpdateRefsRequest1
1030          *           naming_context           : *
1031          *                 naming_context: struct drsuapi_DsReplicaObjectIdentifier
1032          *                     __ndr_size               : 0x000000ae (174)
1033          *                     __ndr_size_sid           : 0x00000000 (0)
1034          *                     guid                     : 00000000-0000-0000-0000-000000000000
1035          *                     sid                      : S-0-0
1036          *                     dn                       : 'CN=Schema,CN=Configuration,DC=w2k3,DC=vmnet1,DC=vm,DC=base'
1037          *           dest_dsa_dns_name        : *
1038          *                 dest_dsa_dns_name        : '4a0df188-a0b8-47ea-bbe5-e614723f16dd._msdcs.w2k3.vmnet1.vm.base'
1039          *           dest_dsa_guid            : 4a0df188-a0b8-47ea-bbe5-e614723f16dd
1040          *           options                  : 0x0000001c (28)
1041          *                 0: DRSUAPI_DS_REPLICA_UPDATE_ASYNCHRONOUS_OPERATION
1042          *                 0: DRSUAPI_DS_REPLICA_UPDATE_WRITEABLE
1043          *                 1: DRSUAPI_DS_REPLICA_UPDATE_ADD_REFERENCE
1044          *                 1: DRSUAPI_DS_REPLICA_UPDATE_DELETE_REFERENCE
1045          *                 1: DRSUAPI_DS_REPLICA_UPDATE_0x00000010
1046          *
1047          * 4a0df188-a0b8-47ea-bbe5-e614723f16dd is the objectGUID the DsAddEntry() returned for the
1048          * CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
1049          * on the 2nd!!! DRSUAPI connection
1050          */
1051
1052         /*
1053          * Windows does opens the 4th and 5th DRSUAPI connection...
1054          * and does a DsBind() with the objectGUID from DsAddEntry() as bind_guid
1055          * on the 4th connection
1056          *
1057          * and then 2 full replications of the domain partition on the 5th connection
1058          * with the bind_handle from the 4th connection
1059          */
1060         return join;
1061 }
1062
1063 void torture_leave_domain_ads_dc(struct test_join_ads_dc *join)
1064 {
1065
1066         if (join->join) {
1067                 torture_leave_domain(join->join);
1068         }
1069
1070         talloc_free(join);
1071 }