source4/torture/rpc/testjoin.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    utility code to join/leave a domain
   5
   6    Copyright (C) Andrew Tridgell 2004
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 /*
  23   this code is used by other torture modules to join/leave a domain
  24   as either a member, bdc or thru a trust relationship
  25 */
  26
  27 #include "includes.h"
  28 #include "system/time.h"
  29 #include "../lib/crypto/crypto.h"
  30 #include "libnet/libnet.h"
  31 #include "lib/cmdline/popt_common.h"
  32 #include "librpc/gen_ndr/ndr_lsa_c.h"
  33 #include "librpc/gen_ndr/ndr_samr_c.h"
  34
  35 #include "libcli/auth/libcli_auth.h"
  36 #include "torture/rpc/torture_rpc.h"
  37 #include "libcli/security/security.h"
  38 #include "param/param.h"
  39
  40 struct test_join {
  41         struct dcerpc_pipe *p;
  42         struct policy_handle user_handle;
  43         struct policy_handle domain_handle;
  44         struct libnet_JoinDomain *libnet_r;
  45         struct dom_sid *dom_sid;
  46         const char *dom_netbios_name;
  47         const char *dom_dns_name;
  48         struct dom_sid *user_sid;
  49         struct GUID user_guid;
  50         const char *netbios_name;
  51 };
  52
  53
  54 static NTSTATUS DeleteUser_byname(struct dcerpc_binding_handle *b,
  55                                   TALLOC_CTX *mem_ctx,
  56                                   struct policy_handle *handle, const char *name)
  57 {
  58         NTSTATUS status;
  59         struct samr_DeleteUser d;
  60         struct policy_handle user_handle;
  61         uint32_t rid;
  62         struct samr_LookupNames n;
  63         struct samr_Ids rids, types;
  64         struct lsa_String sname;
  65         struct samr_OpenUser r;
  66
  67         sname.string = name;
  68
  69         n.in.domain_handle = handle;
  70         n.in.num_names = 1;
  71         n.in.names = &sname;
  72         n.out.rids = &rids;
  73         n.out.types = &types;
  74
  75         status = dcerpc_samr_LookupNames_r(b, mem_ctx, &n);
  76         if (!NT_STATUS_IS_OK(status)) {
  77                 return status;
  78         }
  79         if (NT_STATUS_IS_OK(n.out.result)) {
  80                 rid = n.out.rids->ids[0];
  81         } else {
  82                 return n.out.result;
  83         }
  84
  85         r.in.domain_handle = handle;
  86         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
  87         r.in.rid = rid;
  88         r.out.user_handle = &user_handle;
  89
  90         status = dcerpc_samr_OpenUser_r(b, mem_ctx, &r);
  91         if (!NT_STATUS_IS_OK(status)) {
  92                 printf("OpenUser(%s) failed - %s\n", name, nt_errstr(status));
  93                 return status;
  94         }
  95         if (!NT_STATUS_IS_OK(r.out.result)) {
  96                 printf("OpenUser(%s) failed - %s\n", name, nt_errstr(r.out.result));
  97                 return r.out.result;
  98         }
  99
 100         d.in.user_handle = &user_handle;
 101         d.out.user_handle = &user_handle;
 102         status = dcerpc_samr_DeleteUser_r(b, mem_ctx, &d);
 103         if (!NT_STATUS_IS_OK(status)) {
 104                 return status;
 105         }
 106         if (!NT_STATUS_IS_OK(d.out.result)) {
 107                 return d.out.result;
 108         }
 109
 110         return NT_STATUS_OK;
 111 }
 112
 113 /*
 114   create a test user in the domain
 115   an opaque pointer is returned. Pass it to torture_leave_domain()
 116   when finished
 117 */
 118
 119 struct test_join *torture_create_testuser_max_pwlen(struct torture_context *torture,
 120                                                     const char *username,
 121                                                     const char *domain,
 122                                                     uint16_t acct_type,
 123                                                     const char **random_password,
 124                                                     int max_pw_len)
 125 {
 126         NTSTATUS status;
 127         struct samr_Connect c;
 128         struct samr_CreateUser2 r;
 129         struct samr_OpenDomain o;
 130         struct samr_LookupDomain l;
 131         struct dom_sid2 *sid = NULL;
 132         struct samr_GetUserPwInfo pwp;
 133         struct samr_PwInfo info;
 134         struct samr_SetUserInfo s;
 135         union samr_UserInfo u;
 136         struct policy_handle handle;
 137         uint32_t access_granted;
 138         uint32_t rid;
 139         DATA_BLOB session_key;
 140         struct lsa_String name;
 141
 142         int policy_min_pw_len = 0;
 143         struct test_join *join;
 144         char *random_pw;
 145         const char *dc_binding = torture_setting_string(torture, "dc_binding", NULL);
 146         struct dcerpc_binding_handle *b = NULL;
 147
 148         join = talloc(NULL, struct test_join);
 149         if (join == NULL) {
 150                 return NULL;
 151         }
 152
 153         ZERO_STRUCTP(join);
 154
 155         printf("Connecting to SAMR\n");
 156
 157         if (dc_binding) {
 158                 status = dcerpc_pipe_connect(join,
 159                                              &join->p,
 160                                              dc_binding,
 161                                              &ndr_table_samr,
 162                                              cmdline_credentials, NULL, torture->lp_ctx);
 163
 164         } else {
 165                 status = torture_rpc_connection(torture,
 166                                                 &join->p,
 167                                                 &ndr_table_samr);
 168         }
 169         if (!NT_STATUS_IS_OK(status)) {
 170                 return NULL;
 171         }
 172         b = join->p->binding_handle;
 173
 174         c.in.system_name = NULL;
 175         c.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 176         c.out.connect_handle = &handle;
 177
 178         status = dcerpc_samr_Connect_r(b, join, &c);
 179         if (!NT_STATUS_IS_OK(status)) {
 180                 const char *errstr = nt_errstr(status);
 181                 printf("samr_Connect failed - %s\n", errstr);
 182                 return NULL;
 183         }
 184         if (!NT_STATUS_IS_OK(c.out.result)) {
 185                 const char *errstr = nt_errstr(c.out.result);
 186                 printf("samr_Connect failed - %s\n", errstr);
 187                 return NULL;
 188         }
 189
 190         if (domain) {
 191                 printf("Opening domain %s\n", domain);
 192
 193                 name.string = domain;
 194                 l.in.connect_handle = &handle;
 195                 l.in.domain_name = &name;
 196                 l.out.sid = &sid;
 197
 198                 status = dcerpc_samr_LookupDomain_r(b, join, &l);
 199                 if (!NT_STATUS_IS_OK(status)) {
 200                         printf("LookupDomain failed - %s\n", nt_errstr(status));
 201                         goto failed;
 202                 }
 203                 if (!NT_STATUS_IS_OK(l.out.result)) {
 204                         printf("LookupDomain failed - %s\n", nt_errstr(l.out.result));
 205                         goto failed;
 206                 }
 207         } else {
 208                 struct samr_EnumDomains e;
 209                 uint32_t resume_handle = 0, num_entries;
 210                 struct samr_SamArray *sam;
 211                 int i;
 212
 213                 e.in.connect_handle = &handle;
 214                 e.in.buf_size = (uint32_t)-1;
 215                 e.in.resume_handle = &resume_handle;
 216                 e.out.sam = &sam;
 217                 e.out.num_entries = &num_entries;
 218                 e.out.resume_handle = &resume_handle;
 219
 220                 status = dcerpc_samr_EnumDomains_r(b, join, &e);
 221                 if (!NT_STATUS_IS_OK(status)) {
 222                         printf("EnumDomains failed - %s\n", nt_errstr(status));
 223                         goto failed;
 224                 }
 225                 if (!NT_STATUS_IS_OK(e.out.result)) {
 226                         printf("EnumDomains failed - %s\n", nt_errstr(e.out.result));
 227                         goto failed;
 228                 }
 229                 if ((num_entries != 2) || (sam && sam->count != 2)) {
 230                         printf("unexpected number of domains\n");
 231                         goto failed;
 232                 }
 233                 for (i=0; i < 2; i++) {
 234                         if (!strequal(sam->entries[i].name.string, "builtin")) {
 235                                 domain = sam->entries[i].name.string;
 236                                 break;
 237                         }
 238                 }
 239                 if (domain) {
 240                         printf("Opening domain %s\n", domain);
 241
 242                         name.string = domain;
 243                         l.in.connect_handle = &handle;
 244                         l.in.domain_name = &name;
 245                         l.out.sid = &sid;
 246
 247                         status = dcerpc_samr_LookupDomain_r(b, join, &l);
 248                         if (!NT_STATUS_IS_OK(status)) {
 249                                 printf("LookupDomain failed - %s\n", nt_errstr(status));
 250                                 goto failed;
 251                         }
 252                         if (!NT_STATUS_IS_OK(l.out.result)) {
 253                                 printf("LookupDomain failed - %s\n", nt_errstr(l.out.result));
 254                                 goto failed;
 255                         }
 256                 } else {
 257                         printf("cannot proceed without domain name\n");
 258                         goto failed;
 259                 }
 260         }
 261
 262         talloc_steal(join, *l.out.sid);
 263         join->dom_sid = *l.out.sid;
 264         join->dom_netbios_name = talloc_strdup(join, domain);
 265         if (!join->dom_netbios_name) goto failed;
 266
 267         o.in.connect_handle = &handle;
 268         o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 269         o.in.sid = *l.out.sid;
 270         o.out.domain_handle = &join->domain_handle;
 271
 272         status = dcerpc_samr_OpenDomain_r(b, join, &o);
 273         if (!NT_STATUS_IS_OK(status)) {
 274                 printf("OpenDomain failed - %s\n", nt_errstr(status));
 275                 goto failed;
 276         }
 277         if (!NT_STATUS_IS_OK(o.out.result)) {
 278                 printf("OpenDomain failed - %s\n", nt_errstr(o.out.result));
 279                 goto failed;
 280         }
 281
 282         printf("Creating account %s\n", username);
 283
 284 again:
 285         name.string = username;
 286         r.in.domain_handle = &join->domain_handle;
 287         r.in.account_name = &name;
 288         r.in.acct_flags = acct_type;
 289         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 290         r.out.user_handle = &join->user_handle;
 291         r.out.access_granted = &access_granted;
 292         r.out.rid = &rid;
 293
 294         status = dcerpc_samr_CreateUser2_r(b, join, &r);
 295         if (!NT_STATUS_IS_OK(status)) {
 296                 printf("CreateUser2 failed - %s\n", nt_errstr(status));
 297                 goto failed;
 298         }
 299
 300         if (NT_STATUS_EQUAL(r.out.result, NT_STATUS_USER_EXISTS)) {
 301                 status = DeleteUser_byname(b, join, &join->domain_handle, name.string);
 302                 if (NT_STATUS_IS_OK(status)) {
 303                         goto again;
 304                 }
 305         }
 306
 307         if (!NT_STATUS_IS_OK(r.out.result)) {
 308                 printf("CreateUser2 failed - %s\n", nt_errstr(r.out.result));
 309                 goto failed;
 310         }
 311
 312         join->user_sid = dom_sid_add_rid(join, join->dom_sid, rid);
 313
 314         pwp.in.user_handle = &join->user_handle;
 315         pwp.out.info = &info;
 316
 317         status = dcerpc_samr_GetUserPwInfo_r(b, join, &pwp);
 318         if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(pwp.out.result)) {
 319                 policy_min_pw_len = pwp.out.info->min_password_length;
 320         }
 321
 322         random_pw = generate_random_password(join, MAX(8, policy_min_pw_len), max_pw_len);
 323
 324         printf("Setting account password '%s'\n", random_pw);
 325
 326         ZERO_STRUCT(u);
 327         s.in.user_handle = &join->user_handle;
 328         s.in.info = &u;
 329         s.in.level = 24;
 330
 331         encode_pw_buffer(u.info24.password.data, random_pw, STR_UNICODE);
 332         u.info24.password_expired = 0;
 333
 334         status = dcerpc_fetch_session_key(join->p, &session_key);
 335         if (!NT_STATUS_IS_OK(status)) {
 336                 printf("SetUserInfo level %u - no session key - %s\n",
 337                        s.in.level, nt_errstr(status));
 338                 torture_leave_domain(torture, join);
 339                 goto failed;
 340         }
 341
 342         arcfour_crypt_blob(u.info24.password.data, 516, &session_key);
 343
 344         status = dcerpc_samr_SetUserInfo_r(b, join, &s);
 345         if (!NT_STATUS_IS_OK(status)) {
 346                 printf("SetUserInfo failed - %s\n", nt_errstr(status));
 347                 goto failed;
 348         }
 349         if (!NT_STATUS_IS_OK(s.out.result)) {
 350                 printf("SetUserInfo failed - %s\n", nt_errstr(s.out.result));
 351                 goto failed;
 352         }
 353
 354         ZERO_STRUCT(u);
 355         s.in.user_handle = &join->user_handle;
 356         s.in.info = &u;
 357         s.in.level = 21;
 358
 359         u.info21.acct_flags = acct_type | ACB_PWNOEXP;
 360         u.info21.fields_present = SAMR_FIELD_ACCT_FLAGS | SAMR_FIELD_DESCRIPTION | SAMR_FIELD_COMMENT | SAMR_FIELD_FULL_NAME;
 361
 362         u.info21.comment.string = talloc_asprintf(join,
 363                                                   "Tortured by Samba4: %s",
 364                                                   timestring(join, time(NULL)));
 365
 366         u.info21.full_name.string = talloc_asprintf(join,
 367                                                     "Torture account for Samba4: %s",
 368                                                     timestring(join, time(NULL)));
 369
 370         u.info21.description.string = talloc_asprintf(join,
 371                                          "Samba4 torture account created by host %s: %s",
 372                                          lpcfg_netbios_name(torture->lp_ctx),
 373                                          timestring(join, time(NULL)));
 374
 375         printf("Resetting ACB flags, force pw change time\n");
 376
 377         status = dcerpc_samr_SetUserInfo_r(b, join, &s);
 378         if (!NT_STATUS_IS_OK(status)) {
 379                 printf("SetUserInfo failed - %s\n", nt_errstr(status));
 380                 goto failed;
 381         }
 382         if (!NT_STATUS_IS_OK(s.out.result)) {
 383                 printf("SetUserInfo failed - %s\n", nt_errstr(s.out.result));
 384                 goto failed;
 385         }
 386
 387         if (random_password) {
 388                 *random_password = random_pw;
 389         }
 390
 391         return join;
 392
 393 failed:
 394         torture_leave_domain(torture, join);
 395         return NULL;
 396 }
 397
 398 /*
 399  * Set privileges on an account.
 400  */
 401
 402 static void init_lsa_StringLarge(struct lsa_StringLarge *name, const char *s)
 403 {
 404         name->string = s;
 405 }
 406 static void init_lsa_String(struct lsa_String *name, const char *s)
 407 {
 408         name->string = s;
 409 }
 410
 411 bool torture_setup_privs(struct torture_context *tctx,
 412                         struct dcerpc_pipe *p,
 413                         uint32_t num_privs,
 414                         const char **privs,
 415                         const struct dom_sid *user_sid)
 416 {
 417         struct dcerpc_binding_handle *b = p->binding_handle;
 418         struct policy_handle *handle;
 419         int i;
 420
 421         torture_assert(tctx,
 422                 test_lsa_OpenPolicy2(b, tctx, &handle),
 423                 "failed to open policy");
 424
 425         for (i=0; i < num_privs; i++) {
 426                 struct lsa_LookupPrivValue r;
 427                 struct lsa_LUID luid;
 428                 struct lsa_String name;
 429
 430                 init_lsa_String(&name, privs[i]);
 431
 432                 r.in.handle = handle;
 433                 r.in.name = &name;
 434                 r.out.luid = &luid;
 435
 436                 torture_assert_ntstatus_ok(tctx,
 437                         dcerpc_lsa_LookupPrivValue_r(b, tctx, &r),
 438                         "lsa_LookupPrivValue failed");
 439                 if (!NT_STATUS_IS_OK(r.out.result)) {
 440                         torture_comment(tctx, "lsa_LookupPrivValue failed for '%s' with %s\n",
 441                                 privs[i], nt_errstr(r.out.result));
 442                         return false;
 443                 }
 444         }
 445
 446         {
 447                 struct lsa_AddAccountRights r;
 448                 struct lsa_RightSet rights;
 449
 450                 rights.count = num_privs;
 451                 rights.names = talloc_zero_array(tctx, struct lsa_StringLarge, rights.count);
 452                 for (i=0; i < rights.count; i++) {
 453                         init_lsa_StringLarge(&rights.names[i], privs[i]);
 454                 }
 455
 456                 r.in.handle = handle;
 457                 r.in.sid = discard_const_p(struct dom_sid, user_sid);
 458                 r.in.rights = &rights;
 459
 460                 torture_assert_ntstatus_ok(tctx,
 461                         dcerpc_lsa_AddAccountRights_r(b, tctx, &r),
 462                         "lsa_AddAccountRights failed");
 463                 torture_assert_ntstatus_ok(tctx, r.out.result,
 464                         "lsa_AddAccountRights failed");
 465         }
 466
 467         test_lsa_Close(b, tctx, handle);
 468
 469         return true;
 470 }
 471
 472 struct test_join *torture_create_testuser(struct torture_context *torture,
 473                                           const char *username,
 474                                           const char *domain,
 475                                           uint16_t acct_type,
 476                                           const char **random_password)
 477 {
 478         return torture_create_testuser_max_pwlen(torture, username, domain, acct_type, random_password, 255);
 479 }
 480
 481 NTSTATUS torture_delete_testuser(struct torture_context *torture,
 482                                  struct test_join *join,
 483                                  const char *username)
 484 {
 485         NTSTATUS status;
 486
 487         status = DeleteUser_byname(join->p->binding_handle,
 488                                    torture,
 489                                    &join->domain_handle,
 490                                    username);
 491
 492         return status;
 493 }
 494
 495 _PUBLIC_ struct test_join *torture_join_domain(struct torture_context *tctx,
 496                                                const char *machine_name,
 497                                       uint32_t acct_flags,
 498                                       struct cli_credentials **machine_credentials)
 499 {
 500         NTSTATUS status;
 501         struct libnet_context *libnet_ctx;
 502         struct libnet_JoinDomain *libnet_r;
 503         struct test_join *tj;
 504         struct samr_SetUserInfo s;
 505         union samr_UserInfo u;
 506
 507         tj = talloc_zero(tctx, struct test_join);
 508         if (!tj) return NULL;
 509
 510         libnet_r = talloc_zero(tj, struct libnet_JoinDomain);
 511         if (!libnet_r) {
 512                 talloc_free(tj);
 513                 return NULL;
 514         }
 515
 516         libnet_ctx = libnet_context_init(tctx->ev, tctx->lp_ctx);
 517         if (!libnet_ctx) {
 518                 talloc_free(tj);
 519                 return NULL;
 520         }
 521
 522         tj->libnet_r = libnet_r;
 523
 524         libnet_ctx->cred = cmdline_credentials;
 525         libnet_r->in.binding = torture_setting_string(tctx, "binding", NULL);
 526         if (!libnet_r->in.binding) {
 527                 libnet_r->in.binding = talloc_asprintf(libnet_r, "ncacn_np:%s", torture_setting_string(tctx, "host", NULL));
 528         }
 529         libnet_r->in.level = LIBNET_JOINDOMAIN_SPECIFIED;
 530         libnet_r->in.netbios_name = machine_name;
 531         libnet_r->in.account_name = talloc_asprintf(libnet_r, "%s$", machine_name);
 532         if (!libnet_r->in.account_name) {
 533                 talloc_free(tj);
 534                 return NULL;
 535         }
 536
 537         libnet_r->in.acct_type = acct_flags;
 538         libnet_r->in.recreate_account = true;
 539
 540         status = libnet_JoinDomain(libnet_ctx, libnet_r, libnet_r);
 541         if (!NT_STATUS_IS_OK(status)) {
 542                 if (libnet_r->out.error_string) {
 543                         DEBUG(0, ("Domain join failed - %s\n", libnet_r->out.error_string));
 544                 } else {
 545                         DEBUG(0, ("Domain join failed - %s\n", nt_errstr(status)));
 546                 }
 547                 talloc_free(tj);
 548                 return NULL;
 549         }
 550         tj->p = libnet_r->out.samr_pipe;
 551         tj->user_handle = *libnet_r->out.user_handle;
 552         tj->dom_sid = libnet_r->out.domain_sid;
 553         talloc_steal(tj, libnet_r->out.domain_sid);
 554         tj->dom_netbios_name    = libnet_r->out.domain_name;
 555         talloc_steal(tj, libnet_r->out.domain_name);
 556         tj->dom_dns_name        = libnet_r->out.realm;
 557         talloc_steal(tj, libnet_r->out.realm);
 558         tj->user_guid = libnet_r->out.account_guid;
 559         tj->netbios_name = talloc_strdup(tj, machine_name);
 560         if (!tj->netbios_name) {
 561                 talloc_free(tj);
 562                 return NULL;
 563         }
 564
 565         ZERO_STRUCT(u);
 566         s.in.user_handle = &tj->user_handle;
 567         s.in.info = &u;
 568         s.in.level = 21;
 569
 570         u.info21.fields_present = SAMR_FIELD_DESCRIPTION | SAMR_FIELD_COMMENT | SAMR_FIELD_FULL_NAME;
 571         u.info21.comment.string = talloc_asprintf(tj,
 572                                                   "Tortured by Samba4: %s",
 573                                                   timestring(tj, time(NULL)));
 574         u.info21.full_name.string = talloc_asprintf(tj,
 575                                                     "Torture account for Samba4: %s",
 576                                                     timestring(tj, time(NULL)));
 577
 578         u.info21.description.string = talloc_asprintf(tj,
 579                                                       "Samba4 torture account created by host %s: %s",
 580                                                       lpcfg_netbios_name(tctx->lp_ctx), timestring(tj, time(NULL)));
 581
 582         status = dcerpc_samr_SetUserInfo_r(tj->p->binding_handle, tj, &s);
 583         if (!NT_STATUS_IS_OK(status)) {
 584                 printf("SetUserInfo (non-critical) failed - %s\n", nt_errstr(status));
 585         }
 586         if (!NT_STATUS_IS_OK(s.out.result)) {
 587                 printf("SetUserInfo (non-critical) failed - %s\n", nt_errstr(s.out.result));
 588         }
 589
 590         *machine_credentials = cli_credentials_init(tj);
 591         cli_credentials_set_conf(*machine_credentials, tctx->lp_ctx);
 592         cli_credentials_set_workstation(*machine_credentials, machine_name, CRED_SPECIFIED);
 593         cli_credentials_set_domain(*machine_credentials, libnet_r->out.domain_name, CRED_SPECIFIED);
 594         if (libnet_r->out.realm) {
 595                 cli_credentials_set_realm(*machine_credentials, libnet_r->out.realm, CRED_SPECIFIED);
 596         }
 597         cli_credentials_set_username(*machine_credentials, libnet_r->in.account_name, CRED_SPECIFIED);
 598         cli_credentials_set_password(*machine_credentials, libnet_r->out.join_password, CRED_SPECIFIED);
 599         cli_credentials_set_kvno(*machine_credentials, libnet_r->out.kvno);
 600         if (acct_flags & ACB_SVRTRUST) {
 601                 cli_credentials_set_secure_channel_type(*machine_credentials,
 602                                                         SEC_CHAN_BDC);
 603         } else if (acct_flags & ACB_WSTRUST) {
 604                 cli_credentials_set_secure_channel_type(*machine_credentials,
 605                                                         SEC_CHAN_WKSTA);
 606         } else {
 607                 DEBUG(0, ("Invalid account type specificed to torture_join_domain\n"));
 608                 talloc_free(*machine_credentials);
 609                 return NULL;
 610         }
 611
 612         return tj;
 613 }
 614
 615 struct dcerpc_pipe *torture_join_samr_pipe(struct test_join *join)
 616 {
 617         return join->p;
 618 }
 619
 620 struct policy_handle *torture_join_samr_user_policy(struct test_join *join)
 621 {
 622         return &join->user_handle;
 623 }
 624
 625 static NTSTATUS torture_leave_ads_domain(struct torture_context *torture,
 626                                          TALLOC_CTX *mem_ctx,
 627                                          struct libnet_JoinDomain *libnet_r)
 628 {
 629         int rtn;
 630         TALLOC_CTX *tmp_ctx;
 631
 632         struct ldb_dn *server_dn;
 633         struct ldb_context *ldb_ctx;
 634
 635         char *remote_ldb_url;
 636
 637         /* Check if we are a domain controller. If not, exit. */
 638         if (!libnet_r->out.server_dn_str) {
 639                 return NT_STATUS_OK;
 640         }
 641
 642         tmp_ctx = talloc_named(mem_ctx, 0, "torture_leave temporary context");
 643         if (!tmp_ctx) {
 644                 libnet_r->out.error_string = NULL;
 645                 return NT_STATUS_NO_MEMORY;
 646         }
 647
 648         ldb_ctx = ldb_init(tmp_ctx, torture->ev);
 649         if (!ldb_ctx) {
 650                 libnet_r->out.error_string = NULL;
 651                 talloc_free(tmp_ctx);
 652                 return NT_STATUS_NO_MEMORY;
 653         }
 654
 655         /* Remove CN=Servers,... entry from the AD. */
 656         server_dn = ldb_dn_new(tmp_ctx, ldb_ctx, libnet_r->out.server_dn_str);
 657         if (! ldb_dn_validate(server_dn)) {
 658                 libnet_r->out.error_string = NULL;
 659                 talloc_free(tmp_ctx);
 660                 return NT_STATUS_NO_MEMORY;
 661         }
 662
 663         remote_ldb_url = talloc_asprintf(tmp_ctx, "ldap://%s",
 664                 dcerpc_binding_get_string_option(libnet_r->out.samr_binding, "host"));
 665         if (!remote_ldb_url) {
 666                 libnet_r->out.error_string = NULL;
 667                 talloc_free(tmp_ctx);
 668                 return NT_STATUS_NO_MEMORY;
 669         }
 670
 671         ldb_set_opaque(ldb_ctx, "credentials", cmdline_credentials);
 672         ldb_set_opaque(ldb_ctx, "loadparm", cmdline_lp_ctx);
 673
 674         rtn = ldb_connect(ldb_ctx, remote_ldb_url, 0, NULL);
 675         if (rtn != LDB_SUCCESS) {
 676                 libnet_r->out.error_string = NULL;
 677                 talloc_free(tmp_ctx);
 678                 return NT_STATUS_UNSUCCESSFUL;
 679         }
 680
 681         rtn = ldb_delete(ldb_ctx, server_dn);
 682         if (rtn != LDB_SUCCESS) {
 683                 libnet_r->out.error_string = NULL;
 684                 talloc_free(tmp_ctx);
 685                 return NT_STATUS_UNSUCCESSFUL;
 686         }
 687
 688         DEBUG(0, ("%s removed successfully.\n", libnet_r->out.server_dn_str));
 689
 690         talloc_free(tmp_ctx);
 691         return NT_STATUS_OK;
 692 }
 693
 694 /*
 695   leave the domain, deleting the machine acct
 696 */
 697
 698 _PUBLIC_ void torture_leave_domain(struct torture_context *torture, struct test_join *join)
 699 {
 700         struct samr_DeleteUser d;
 701         NTSTATUS status;
 702
 703         if (!join) {
 704                 return;
 705         }
 706         d.in.user_handle = &join->user_handle;
 707         d.out.user_handle = &join->user_handle;
 708
 709         /* Delete machine account */
 710         status = dcerpc_samr_DeleteUser_r(join->p->binding_handle, join, &d);
 711         if (!NT_STATUS_IS_OK(status)) {
 712                 printf("DeleteUser failed\n");
 713         }
 714         if (!NT_STATUS_IS_OK(d.out.result)) {
 715                 printf("Delete of machine account %s failed\n",
 716                        join->netbios_name);
 717         } else {
 718                 printf("Delete of machine account %s was successful.\n",
 719                        join->netbios_name);
 720         }
 721
 722         if (join->libnet_r) {
 723                 status = torture_leave_ads_domain(torture, join, join->libnet_r);
 724         }
 725
 726         talloc_free(join);
 727 }
 728
 729 /*
 730   return the dom sid for a test join
 731 */
 732 _PUBLIC_ const struct dom_sid *torture_join_sid(struct test_join *join)
 733 {
 734         return join->dom_sid;
 735 }
 736
 737 const struct dom_sid *torture_join_user_sid(struct test_join *join)
 738 {
 739         return join->user_sid;
 740 }
 741
 742 const char *torture_join_netbios_name(struct test_join *join)
 743 {
 744         return join->netbios_name;
 745 }
 746
 747 const struct GUID *torture_join_user_guid(struct test_join *join)
 748 {
 749         return &join->user_guid;
 750 }
 751
 752 const char *torture_join_dom_netbios_name(struct test_join *join)
 753 {
 754         return join->dom_netbios_name;
 755 }
 756
 757 const char *torture_join_dom_dns_name(struct test_join *join)
 758 {
 759         return join->dom_dns_name;
 760 }
 761
 762 const char *torture_join_server_dn_str(struct test_join *join)
 763 {
 764         if (join->libnet_r) {
 765                 return join->libnet_r->out.server_dn_str;
 766         }
 767         return NULL;
 768 }
 769
 770
 771 #if 0 /* Left as the documentation of the join process, but see new implementation in libnet_become_dc.c */
 772 struct test_join_ads_dc {
 773         struct test_join *join;
 774 };
 775
 776 struct test_join_ads_dc *torture_join_domain_ads_dc(const char *machine_name,
 777                                                     const char *domain,
 778                                                     struct cli_credentials **machine_credentials)
 779 {
 780         struct test_join_ads_dc *join;
 781
 782         join = talloc(NULL, struct test_join_ads_dc);
 783         if (join == NULL) {
 784                 return NULL;
 785         }
 786
 787         join->join = torture_join_domain(machine_name,
 788                                         ACB_SVRTRUST,
 789                                         machine_credentials);
 790
 791         if (!join->join) {
 792                 return NULL;
 793         }
 794
 795 /* W2K: */
 796         /* W2K: modify userAccountControl from 4096 to 532480 */
 797
 798         /* W2K: modify RDN to OU=Domain Controllers and skip the $ from server name */
 799
 800         /* ask objectVersion of Schema Partition */
 801
 802         /* ask rIDManagerReferenz of the Domain Partition */
 803
 804         /* ask fsMORoleOwner of the RID-Manager$ object
 805          * returns CN=NTDS Settings,CN=<DC>,CN=Servers,CN=Default-First-Site-Name, ...
 806          */
 807
 808         /* ask for dnsHostName of CN=<DC>,CN=Servers,CN=Default-First-Site-Name, ... */
 809
 810         /* ask for objectGUID of CN=NTDS Settings,CN=<DC>,CN=Servers,CN=Default-First-Site-Name, ... */
 811
 812         /* ask for * of CN=Default-First-Site-Name, ... */
 813
 814         /* search (&(|(objectClass=user)(objectClass=computer))(sAMAccountName=<machine_name>$)) in Domain Partition
 815          * attributes : distinguishedName, userAccountControl
 816          */
 817
 818         /* ask * for CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
 819          * should fail with noSuchObject
 820          */
 821
 822         /* add CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
 823          *
 824          * objectClass = server
 825          * systemFlags = 50000000
 826          * serverReferenz = CN=<machine_name>,OU=Domain Controllers,...
 827          */
 828
 829         /* ask for * of CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
 830          * should fail with noSuchObject
 831          */
 832
 833         /* search for (ncname=<domain_nc>) in CN=Partitions,CN=Configuration,...
 834          * attributes: ncName, dnsRoot
 835          */
 836
 837         /* modify add CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
 838          * serverReferenz = CN=<machine_name>,OU=Domain Controllers,...
 839          * should fail with attributeOrValueExists
 840          */
 841
 842         /* modify replace CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
 843          * serverReferenz = CN=<machine_name>,OU=Domain Controllers,...
 844          */
 845
 846         /* DsAddEntry to create the CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
 847          *
 848          */
 849
 850         /* replicate CN=Schema,CN=Configuration,...
 851          * using DRSUAPI_DS_BIND_GUID_W2K ("6abec3d1-3054-41c8-a362-5a0c5b7d5d71")
 852          *
 853          */
 854
 855         /* replicate CN=Configuration,...
 856          * using DRSUAPI_DS_BIND_GUID_W2K ("6abec3d1-3054-41c8-a362-5a0c5b7d5d71")
 857          *
 858          */
 859
 860         /* replicate Domain Partition
 861          * using DRSUAPI_DS_BIND_GUID_W2K ("6abec3d1-3054-41c8-a362-5a0c5b7d5d71")
 862          *
 863          */
 864
 865         /* call DsReplicaUpdateRefs() for all partitions like this:
 866          *     req1: struct drsuapi_DsReplicaUpdateRefsRequest1
 867          *           naming_context           : *
 868          *                 naming_context: struct drsuapi_DsReplicaObjectIdentifier
 869          *                     __ndr_size               : 0x000000ae (174)
 870          *                     __ndr_size_sid           : 0x00000000 (0)
 871          *                     guid                     : 00000000-0000-0000-0000-000000000000
 872          *                     sid                      : S-0-0
 873          *                     dn                       : 'CN=Schema,CN=Configuration,DC=w2k3,DC=vmnet1,DC=vm,DC=base'
 874          *           dest_dsa_dns_name        : *
 875          *                 dest_dsa_dns_name        : '4a0df188-a0b8-47ea-bbe5-e614723f16dd._msdcs.w2k3.vmnet1.vm.base'
 876          *           dest_dsa_guid            : 4a0df188-a0b8-47ea-bbe5-e614723f16dd
 877          *           options                  : 0x0000001c (28)
 878          *                 0: DRSUAPI_DS_REPLICA_UPDATE_ASYNCHRONOUS_OPERATION
 879          *                 0: DRSUAPI_DS_REPLICA_UPDATE_WRITEABLE
 880          *                 1: DRSUAPI_DS_REPLICA_UPDATE_ADD_REFERENCE
 881          *                 1: DRSUAPI_DS_REPLICA_UPDATE_DELETE_REFERENCE
 882          *                 1: DRSUAPI_DS_REPLICA_UPDATE_0x00000010
 883          *
 884          * 4a0df188-a0b8-47ea-bbe5-e614723f16dd is the objectGUID the DsAddEntry() returned for the
 885          * CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
 886          */
 887
 888 /* W2K3: see libnet/libnet_become_dc.c */
 889         return join;
 890 }
 891
 892 #endif