netlogon.c

samba最新软件

/* 
   Unix SMB/CIFS implementation.

   test suite for netlogon rpc operations

   Copyright (C) Andrew Tridgell 2003
   Copyright (C) Andrew Bartlett <[e-mail]> 2003-2004
   Copyright (C) Tim Potter      2003
   
   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
   the Free Software Foundation; either version 3 of the License, or
   (at your option) any later version.
   
   This program is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   GNU General Public License for more details.
   
   You should have received a copy of the GNU General Public License
   along with this program.  If not, see <http://www.gnu.org/licenses/>.
*/

#include "includes.h"
#include "torture/torture.h"
#include "lib/events/events.h"
#include "auth/auth.h"
#include "lib/cmdline/popt_common.h"
#include "torture/rpc/rpc.h"
#include "libcli/auth/libcli_auth.h"
#include "librpc/gen_ndr/ndr_netlogon_c.h"
#include "librpc/gen_ndr/ndr_lsa_c.h"
#include "param/param.h"

#define TEST_MACHINE_NAME "torturetest"

static bool test_LogonUasLogon(struct torture_context *tctx, 
			       struct dcerpc_pipe *p)
{
	NTSTATUS status;
	struct netr_LogonUasLogon r;

	r.in.server_name = NULL;
	r.in.account_name = cli_credentials_get_username(cmdline_credentials);
	r.in.workstation = TEST_MACHINE_NAME;

	status = dcerpc_netr_LogonUasLogon(p, tctx, &r);
	torture_assert_ntstatus_ok(tctx, status, "LogonUasLogon");

	return true;
}

static bool test_LogonUasLogoff(struct torture_context *tctx,
				struct dcerpc_pipe *p)
{
	NTSTATUS status;
	struct netr_LogonUasLogoff r;

	r.in.server_name = NULL;
	r.in.account_name = cli_credentials_get_username(cmdline_credentials);
	r.in.workstation = TEST_MACHINE_NAME;

	status = dcerpc_netr_LogonUasLogoff(p, tctx, &r);
	torture_assert_ntstatus_ok(tctx, status, "LogonUasLogoff");

	return true;
}

static bool test_SetupCredentials(struct dcerpc_pipe *p, struct torture_context *tctx,
			   struct cli_credentials *credentials,
			   struct creds_CredentialState **creds_out)
{
	NTSTATUS status;
	struct netr_ServerReqChallenge r;
	struct netr_ServerAuthenticate a;
	struct netr_Credential credentials1, credentials2, credentials3;
	struct creds_CredentialState *creds;
	struct samr_Password mach_password;
        const char *plain_pass;
	const char *machine_name;

	plain_pass = cli_credentials_get_password(credentials);
	machine_name = cli_credentials_get_workstation(credentials);

	torture_comment(tctx, "Testing ServerReqChallenge\n");

	creds = talloc(tctx, struct creds_CredentialState);
	torture_assert(tctx, creds != NULL, "memory allocation");

	r.in.server_name = NULL;
	r.in.computer_name = machine_name;
	r.in.credentials = &credentials1;
	r.out.credentials = &credentials2;

	generate_random_buffer(credentials1.data, sizeof(credentials1.data));

	status = dcerpc_netr_ServerReqChallenge(p, tctx, &r);
	torture_assert_ntstatus_ok(tctx, status, "ServerReqChallenge");

	E_md4hash(plain_pass, mach_password.hash);

	a.in.server_name = NULL;
	a.in.account_name = talloc_asprintf(tctx, "%s$", machine_name);
	a.in.secure_channel_type = SEC_CHAN_BDC;
	a.in.computer_name = machine_name;
	a.in.credentials = &credentials3;
	a.out.credentials = &credentials3;

	creds_client_init(creds, &credentials1, &credentials2, 
			  &mach_password, &credentials3, 
			  0);

	torture_comment(tctx, "Testing ServerAuthenticate\n");

	status = dcerpc_netr_ServerAuthenticate(p, tctx, &a);
	torture_assert_ntstatus_ok(tctx, status, "ServerAuthenticate");

	torture_assert(tctx, creds_client_check(creds, &credentials3), 
		       "Credential chaining failed");

	*creds_out = creds;
	return true;
}

static bool test_SetupCredentials2(struct dcerpc_pipe *p, struct torture_context *tctx,
			    uint32_t negotiate_flags,
			    struct cli_credentials *machine_credentials,
			    int sec_chan_type,
			    struct creds_CredentialState **creds_out)
{
	NTSTATUS status;
	struct netr_ServerReqChallenge r;
	struct netr_ServerAuthenticate2 a;
	struct netr_Credential credentials1, credentials2, credentials3;
	struct creds_CredentialState *creds;
	struct samr_Password mach_password;
	const char *machine_name;
	const char *plain_pass;

	machine_name = cli_credentials_get_workstation(machine_credentials);
	plain_pass = cli_credentials_get_password(machine_credentials);

	torture_comment(tctx, "Testing ServerReqChallenge\n");

	creds = talloc(tctx, struct creds_CredentialState);
	torture_assert(tctx, creds != NULL, "memory allocation");

	r.in.server_name = NULL;
	r.in.computer_name = machine_name;
	r.in.credentials = &credentials1;
	r.out.credentials = &credentials2;

	generate_random_buffer(credentials1.data, sizeof(credentials1.data));

	status = dcerpc_netr_ServerReqChallenge(p, tctx, &r);
	torture_assert_ntstatus_ok(tctx, status, "ServerReqChallenge");

	E_md4hash(plain_pass, mach_password.hash);

	a.in.server_name = NULL;
	a.in.account_name = talloc_asprintf(tctx, "%s$", machine_name);
	a.in.secure_channel_type = sec_chan_type;
	a.in.computer_name = machine_name;
	a.in.negotiate_flags = &negotiate_flags;
	a.out.negotiate_flags = &negotiate_flags;
	a.in.credentials = &credentials3;
	a.out.credentials = &credentials3;

	creds_client_init(creds, &credentials1, &credentials2, 
			  &mach_password, &credentials3, 
			  negotiate_flags);

	torture_comment(tctx, "Testing ServerAuthenticate2\n");

	status = dcerpc_netr_ServerAuthenticate2(p, tctx, &a);
	torture_assert_ntstatus_ok(tctx, status, "ServerAuthenticate2");

	torture_assert(tctx, creds_client_check(creds, &credentials3), 
		"Credential chaining failed");

	torture_comment(tctx, "negotiate_flags=0x%08x\n", negotiate_flags);

	*creds_out = creds;
	return true;
}


static bool test_SetupCredentials3(struct dcerpc_pipe *p, struct torture_context *tctx,
			    uint32_t negotiate_flags,
			    struct cli_credentials *machine_credentials,
			    struct creds_CredentialState **creds_out)
{
	NTSTATUS status;
	struct netr_ServerReqChallenge r;
	struct netr_ServerAuthenticate3 a;
	struct netr_Credential credentials1, credentials2, credentials3;
	struct creds_CredentialState *creds;
	struct samr_Password mach_password;
	uint32_t rid;
	const char *machine_name;
	const char *plain_pass;

	machine_name = cli_credentials_get_workstation(machine_credentials);
	plain_pass = cli_credentials_get_password(machine_credentials);

	torture_comment(tctx, "Testing ServerReqChallenge\n");

	creds = talloc(tctx, struct creds_CredentialState);
	torture_assert(tctx, creds != NULL, "memory allocation");

	r.in.server_name = NULL;
	r.in.computer_name = machine_name;
	r.in.credentials = &credentials1;
	r.out.credentials = &credentials2;

	generate_random_buffer(credentials1.data, sizeof(credentials1.data));

	status = dcerpc_netr_ServerReqChallenge(p, tctx, &r);
	torture_assert_ntstatus_ok(tctx, status, "ServerReqChallenge");

	E_md4hash(plain_pass, mach_password.hash);

	a.in.server_name = NULL;
	a.in.account_name = talloc_asprintf(tctx, "%s$", machine_name);
	a.in.secure_channel_type = SEC_CHAN_BDC;
	a.in.computer_name = machine_name;
	a.in.negotiate_flags = &negotiate_flags;
	a.in.credentials = &credentials3;
	a.out.credentials = &credentials3;
	a.out.negotiate_flags = &negotiate_flags;
	a.out.rid = &rid;

	creds_client_init(creds, &credentials1, &credentials2, 
			  &mach_password, &credentials3,
			  negotiate_flags);

	torture_comment(tctx, "Testing ServerAuthenticate3\n");

	status = dcerpc_netr_ServerAuthenticate3(p, tctx, &a);
	torture_assert_ntstatus_ok(tctx, status, "ServerAuthenticate3");
	torture_assert(tctx, creds_client_check(creds, &credentials3), "Credential chaining failed");

	torture_comment(tctx, "negotiate_flags=0x%08x\n", negotiate_flags);

	*creds_out = creds;
	return true;
}

/*
  try a change password for our machine account
*/
static bool test_SetPassword(struct torture_context *tctx, 
			     struct dcerpc_pipe *p,
			     struct cli_credentials *machine_credentials)
{
	NTSTATUS status;
	struct netr_ServerPasswordSet r;
	const char *password;
	struct creds_CredentialState *creds;

	if (!test_SetupCredentials(p, tctx, machine_credentials, &creds)) {
		return false;
	}

	r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
	r.in.account_name = talloc_asprintf(tctx, "%s$", TEST_MACHINE_NAME);
	r.in.secure_channel_type = SEC_CHAN_BDC;
	r.in.computer_name = TEST_MACHINE_NAME;

	password = generate_random_str(tctx, 8);
	E_md4hash(password, r.in.new_password.hash);

	creds_des_encrypt(creds, &r.in.new_password);

	torture_comment(tctx, "Testing ServerPasswordSet on machine account\n");
	torture_comment(tctx, "Changing machine account password to '%s'\n", 
			password);

	creds_client_authenticator(creds, &r.in.credential);

	status = dcerpc_netr_ServerPasswordSet(p, tctx, &r);
	torture_assert_ntstatus_ok(tctx, status, "ServerPasswordSet");

	if (!creds_client_check(creds, &r.out.return_authenticator.cred)) {
		torture_comment(tctx, "Credential chaining failed\n");
	}

	/* by changing the machine password twice we test the
	   credentials chaining fully, and we verify that the server
	   allows the password to be set to the same value twice in a
	   row (match win2k3) */
	torture_comment(tctx, 
		"Testing a second ServerPasswordSet on machine account\n");
	torture_comment(tctx, 
		"Changing machine account password to '%s' (same as previous run)\n", password);

	creds_client_authenticator(creds, &r.in.credential);

	status = dcerpc_netr_ServerPasswordSet(p, tctx, &r);
	torture_assert_ntstatus_ok(tctx, status, "ServerPasswordSet (2)");

	if (!creds_client_check(creds, &r.out.return_authenticator.cred)) {
		torture_comment(tctx, "Credential chaining failed\n");
	}

	cli_credentials_set_password(machine_credentials, password, CRED_SPECIFIED);

	torture_assert(tctx, 
		test_SetupCredentials(p, tctx, machine_credentials, &creds), 
		"ServerPasswordSet failed to actually change the password");

	return true;
}

/*
  try a change password for our machine account
*/
static bool test_SetPassword2(struct torture_context *tctx, 
			      struct dcerpc_pipe *p, 
			      struct cli_credentials *machine_credentials)
{
	NTSTATUS status;
	struct netr_ServerPasswordSet2 r;
	const char *password;
	struct creds_CredentialState *creds;
	struct samr_CryptPassword password_buf;

	if (!test_SetupCredentials(p, tctx, machine_credentials, &creds)) {
		return false;
	}

	r.in.server_name = talloc_asprintf(tctx, "\\\\%s", dcerpc_server_name(p));
	r.in.account_name = talloc_asprintf(tctx, "%s$", TEST_MACHINE_NAME);
	r.in.secure_channel_type = SEC_CHAN_BDC;
	r.in.computer_name = TEST_MACHINE_NAME;

	password = generate_random_str(tctx, 8);
	encode_pw_buffer(password_buf.data, password, STR_UNICODE);
	creds_arcfour_crypt(creds, password_buf.data, 516);

	memcpy(r.in.new_password.data, password_buf.data, 512);
	r.in.new_password.length = IVAL(password_buf.data, 512);

	torture_comment(tctx, "Testing ServerPasswordSet2 on machine account\n");
	torture_comment(tctx, "Changing machine account password to '%s'\n", password);

	creds_client_authenticator(creds, &r.in.credential);

	status = dcerpc_netr_ServerPasswordSet2(p, tctx, &r);
	torture_assert_ntstatus_ok(tctx, status, "ServerPasswordSet2");

	if (!creds_client_check(creds, &r.out.return_authenticator.cred)) {
		torture_comment(tctx, "Credential chaining failed\n");
	}

	cli_credentials_set_password(machine_credentials, password, CRED_SPECIFIED);

	if (!torture_setting_bool(tctx, "dangerous", false)) {
		torture_comment(tctx, 
			"Not testing ability to set password to '', enable dangerous tests to perform this test\n");
	} else {
		/* by changing the machine password to ""
		 * we check if the server uses password restrictions
		 * for ServerPasswordSet2
		 * (win2k3 accepts "")
		 */
		password = "";
		encode_pw_buffer(password_buf.data, password, STR_UNICODE);
		creds_arcfour_crypt(creds, password_buf.data, 516);
		
		memcpy(r.in.new_password.data, password_buf.data, 512);
		r.in.new_password.length = IVAL(password_buf.data, 512);
		
		torture_comment(tctx, 
			"Testing ServerPasswordSet2 on machine account\n");
		torture_comment(tctx, 
			"Changing machine account password to '%s'\n", password);
		
		creds_client_authenticator(creds, &r.in.credential);
		
		status = dcerpc_netr_ServerPasswordSet2(p, tctx, &r);
		torture_assert_ntstatus_ok(tctx, status, "ServerPasswordSet2");
		
		if (!creds_client_check(creds, &r.out.return_authenticator.cred)) {
			torture_comment(tctx, "Credential chaining failed\n");
		}
		
		cli_credentials_set_password(machine_credentials, password, CRED_SPECIFIED);
	}

	torture_assert(tctx, test_SetupCredentials(p, tctx, machine_credentials, &creds), 
		"ServerPasswordSet failed to actually change the password");

	/* now try a random password */
	password = generate_random_str(tctx, 8);
	encode_pw_buffer(password_buf.data, password, STR_UNICODE);
	creds_arcfour_crypt(creds, password_buf.data, 516);

	memcpy(r.in.new_password.data, password_buf.data, 512);
	r.in.new_password.length = IVAL(password_buf.data, 512);