source4/torture/winbind/winbind.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    SMB torture tester
   4    Copyright (C) Stefan Metzmacher 2007
   5    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2012
   6    Copyright (C) Christof Schmit <christof.schmitt@us.ibm.com> 2012
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "torture/smbtorture.h"
  24 #include "torture/winbind/proto.h"
  25 #include "auth/auth.h"
  26 #include "auth/auth_sam_reply.h"
  27 #include "auth/gensec/gensec.h"
  28 #include "system/kerberos.h"
  29 #include "auth/kerberos/kerberos.h"
  30 #include "auth/credentials/credentials.h"
  31 #include "param/param.h"
  32 #include "lib/cmdline/cmdline.h"
  33 #include "auth/kerberos/pac_utils.h"
  34 #include "wbclient.h"
  35
  36 struct pac_data {
  37         DATA_BLOB pac_blob;
  38 };
  39
  40 /* A helper function which avoids touching the local databases to
  41  * generate the session info, as we just want to verify the PAC
  42  * details, not the full local token */
  43 static NTSTATUS test_generate_session_info_pac(struct auth4_context *auth_ctx,
  44                                                TALLOC_CTX *mem_ctx,
  45                                                struct smb_krb5_context *smb_krb5_context,
  46                                                DATA_BLOB *pac_blob,
  47                                                const char *principal_name,
  48                                                const struct tsocket_address *remote_address,
  49                                                uint32_t session_info_flags,
  50                                                struct auth_session_info **session_info)
  51 {
  52         NTSTATUS nt_status;
  53         struct auth_user_info_dc *user_info_dc;
  54         TALLOC_CTX *tmp_ctx;
  55         struct pac_data *pac_data;
  56
  57         if (pac_blob == NULL) {
  58                 DBG_ERR("pac_blob missing\n");
  59                 return NT_STATUS_NO_IMPERSONATION_TOKEN;
  60         }
  61
  62         tmp_ctx = talloc_named(mem_ctx, 0, "gensec_gssapi_session_info context");
  63         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
  64
  65         auth_ctx->private_data = pac_data = talloc_zero(auth_ctx, struct pac_data);
  66
  67         pac_data->pac_blob = *pac_blob;
  68
  69         talloc_steal(pac_data, pac_data->pac_blob.data);
  70         nt_status = kerberos_pac_blob_to_user_info_dc(tmp_ctx,
  71                                                       *pac_blob,
  72                                                       smb_krb5_context->krb5_context,
  73                                                       &user_info_dc,
  74                                                       NULL, NULL);
  75         if (!NT_STATUS_IS_OK(nt_status)) {
  76                 talloc_free(tmp_ctx);
  77                 return nt_status;
  78         }
  79
  80         if (!(user_info_dc->info->user_flags & NETLOGON_GUEST)) {
  81                 session_info_flags |= AUTH_SESSION_INFO_AUTHENTICATED;
  82         }
  83
  84         session_info_flags |= AUTH_SESSION_INFO_SIMPLE_PRIVILEGES;
  85         nt_status = auth_generate_session_info(mem_ctx,
  86                                                NULL,
  87                                                NULL,
  88                                                user_info_dc, session_info_flags,
  89                                                session_info);
  90         if (!NT_STATUS_IS_OK(nt_status)) {
  91                 talloc_free(tmp_ctx);
  92                 return nt_status;
  93         }
  94
  95         talloc_free(tmp_ctx);
  96         return nt_status;
  97 }
  98
  99 static bool torture_decode_compare_pac(struct torture_context *tctx,
 100                                        DATA_BLOB pac)
 101 {
 102         struct wbcAuthUserParams params;
 103         struct wbcAuthUserInfo *info;
 104         struct wbcAuthErrorInfo *error;
 105         struct PAC_LOGON_INFO *logon_info;
 106         struct netr_SamInfo3 *info3;
 107         struct netr_SamBaseInfo *base;
 108         struct PAC_DOMAIN_GROUP_MEMBERSHIP *resource_groups = NULL;
 109         wbcErr wbc_err;
 110         NTSTATUS status;
 111         int sid_idx, i;
 112         char sid_str[50];
 113
 114         /* Let winbind decode the PAC */
 115         memset(&params, 0, sizeof(params));
 116         params.level = WBC_AUTH_USER_LEVEL_PAC;
 117         params.password.pac.data = pac.data;
 118         params.password.pac.length = pac.length;
 119
 120         wbc_err = wbcAuthenticateUserEx(&params, &info, &error);
 121         torture_assert(tctx, WBC_ERROR_IS_OK(wbc_err), wbcErrorString(wbc_err));
 122
 123         /* Decode the PAC internally */
 124         status = kerberos_pac_logon_info(tctx, pac, NULL, NULL, NULL, NULL, 0,
 125                                          &logon_info);
 126         torture_assert(tctx, NT_STATUS_IS_OK(status), "pac_logon_info");
 127         info3 = &logon_info->info3;
 128         base = &info3->base;
 129         resource_groups = &logon_info->resource_groups;
 130
 131         /* Compare the decoded data from winbind and from internal call */
 132         torture_assert(tctx, info->user_flags == base->user_flags, "user_flags");
 133         torture_assert_str_equal(tctx, info->account_name, base->account_name.string, "account_name");
 134         torture_assert_str_equal(tctx, info->full_name, base->full_name.string, "full_name");
 135         torture_assert_str_equal(tctx, info->domain_name, base->logon_domain.string, "domain_name");
 136         torture_assert(tctx, info->acct_flags == base->acct_flags, "acct_flags");
 137         torture_assert(tctx, info->logon_count == base->logon_count, "logon_count");
 138         torture_assert(tctx, info->bad_password_count == base->bad_password_count, "bad_password_count");
 139         torture_assert(tctx, info->logon_time == nt_time_to_unix(base->logon_time), "logon_time");
 140         torture_assert(tctx, info->logoff_time == nt_time_to_unix(base->logoff_time), "logoff_time");
 141         torture_assert(tctx, info->kickoff_time == nt_time_to_unix(base->kickoff_time), "kickoff_time");
 142         torture_assert(tctx, info->pass_last_set_time == nt_time_to_unix(base->last_password_change), "last_password_change");
 143         torture_assert(tctx, info->pass_can_change_time == nt_time_to_unix(base->allow_password_change), "allow_password_change");
 144         torture_assert(tctx, info->pass_must_change_time == nt_time_to_unix(base->force_password_change), "force_password_change");
 145         torture_assert(tctx, info->num_sids == 2 + base->groups.count + info3->sidcount + resource_groups->groups.count, "num_sids");
 146
 147         sid_idx = 0;
 148         wbcSidToStringBuf(&info->sids[sid_idx].sid, sid_str, sizeof(sid_str));
 149         torture_assert(tctx,
 150                        dom_sid_equal(dom_sid_parse_talloc(tctx, sid_str),
 151                                      dom_sid_add_rid(tctx, base->domain_sid, base->rid)),
 152                        sid_str);
 153
 154         sid_idx++;
 155         wbcSidToStringBuf(&info->sids[sid_idx].sid, sid_str, sizeof(sid_str));
 156         torture_assert(tctx,
 157                        dom_sid_equal(dom_sid_parse_talloc(tctx, sid_str),
 158                                      dom_sid_add_rid(tctx, base->domain_sid, base->primary_gid)),
 159                        sid_str);
 160
 161         for(i = 0; i < base->groups.count; i++ ) {
 162                 sid_idx++;
 163                 wbcSidToStringBuf(&info->sids[sid_idx].sid,
 164                                   sid_str, sizeof(sid_str));
 165                 torture_assert_sid_equal(tctx,
 166                                          dom_sid_parse_talloc(tctx, sid_str),
 167                                          dom_sid_add_rid(tctx, base->domain_sid,
 168                                                          base->groups.rids[i].rid),
 169                                          "base SID mismatch");
 170         }
 171
 172         for(i = 0; i < info3->sidcount; i++) {
 173                 sid_idx++;
 174                 wbcSidToStringBuf(&info->sids[sid_idx].sid,
 175                                   sid_str, sizeof(sid_str));
 176                 torture_assert_sid_equal(tctx,
 177                                          dom_sid_parse_talloc(tctx, sid_str),
 178                                          info3->sids[i].sid,
 179                                          "extra SID mismatch");
 180         }
 181
 182         for (i = 0; i < resource_groups->groups.count; i++) {
 183                 sid_idx++;
 184                 wbcSidToStringBuf(&info->sids[sid_idx].sid,
 185                                   sid_str, sizeof(sid_str));
 186                 torture_assert_sid_equal(tctx,
 187                                          dom_sid_parse_talloc(tctx, sid_str),
 188                                          dom_sid_add_rid(tctx, resource_groups->domain_sid,
 189                                                          resource_groups->groups.rids[i].rid),
 190                                          "resource SID mismatch");
 191         }
 192
 193         sid_idx++;
 194         torture_assert_int_equal(tctx, sid_idx, info->num_sids, "some SIDs still unaccounted for");
 195
 196         wbcFreeMemory(info);
 197
 198         return true;
 199 }
 200
 201 static bool torture_winbind_pac(struct torture_context *tctx,
 202                                 const char *sasl_mech,
 203                                 const char *mech)
 204 {
 205         NTSTATUS status;
 206
 207         struct gensec_security *gensec_client_context;
 208         struct gensec_security *gensec_server_context;
 209         struct cli_credentials *machine_credentials;
 210
 211         DATA_BLOB client_to_server, server_to_client;
 212
 213         struct auth4_context *auth_context;
 214         struct auth_session_info *session_info;
 215         struct pac_data *pac_data;
 216
 217         TALLOC_CTX *tmp_ctx = talloc_new(tctx);
 218         torture_assert(tctx, tmp_ctx != NULL, "talloc_new() failed");
 219
 220         machine_credentials = cli_credentials_init_server(tmp_ctx,
 221                                                           tctx->lp_ctx);
 222         torture_assert(tctx, machine_credentials != NULL, "cli_credentials_init() failed");
 223
 224         auth_context = talloc_zero(tmp_ctx, struct auth4_context);
 225         torture_assert(tctx, auth_context != NULL, "talloc_new() failed");
 226
 227         auth_context->generate_session_info_pac = test_generate_session_info_pac;
 228
 229         status = gensec_client_start(tctx, &gensec_client_context,
 230                                      lpcfg_gensec_settings(tctx, tctx->lp_ctx));
 231         torture_assert_ntstatus_ok(tctx, status, "gensec_client_start (client) failed");
 232
 233         status = gensec_set_target_hostname(gensec_client_context, cli_credentials_get_workstation(machine_credentials));
 234         torture_assert_ntstatus_ok(tctx, status, "gensec_set_target_hostname (client) failed");
 235
 236         status = gensec_set_credentials(gensec_client_context,
 237                         samba_cmdline_get_creds());
 238         torture_assert_ntstatus_ok(tctx, status, "gensec_set_credentials (client) failed");
 239
 240         if (sasl_mech) {
 241                 status = gensec_start_mech_by_sasl_name(gensec_client_context, sasl_mech);
 242                 torture_assert_ntstatus_ok(tctx, status, "gensec_start_mech_by_sasl_name (client) failed");
 243         } else {
 244                 status = gensec_start_mech_by_name(gensec_client_context, mech);
 245                 torture_assert_ntstatus_ok(tctx, status, "gensec_start_mech_by_name (client) failed");
 246         }
 247
 248
 249         status = gensec_server_start(tctx,
 250                                      lpcfg_gensec_settings(tctx, tctx->lp_ctx),
 251                                      auth_context, &gensec_server_context);
 252         torture_assert_ntstatus_ok(tctx, status, "gensec_server_start (server) failed");
 253
 254         status = gensec_set_credentials(gensec_server_context, machine_credentials);
 255         torture_assert_ntstatus_ok(tctx, status, "gensec_set_credentials (server) failed");
 256
 257         if (sasl_mech) {
 258                 status = gensec_start_mech_by_sasl_name(gensec_server_context, sasl_mech);
 259                 torture_assert_ntstatus_ok(tctx, status, "gensec_start_mech_by_sasl_name (server) failed");
 260         } else {
 261                 status = gensec_start_mech_by_name(gensec_server_context, mech);
 262                 torture_assert_ntstatus_ok(tctx, status, "gensec_start_mech_by_name (server) failed");
 263         }
 264
 265         server_to_client = data_blob(NULL, 0);
 266
 267         do {
 268                 /* Do a client-server update dance */
 269                 status = gensec_update(gensec_client_context, tmp_ctx, server_to_client, &client_to_server);
 270                 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {;
 271                         torture_assert_ntstatus_ok(tctx, status, "gensec_update (client) failed");
 272                 }
 273
 274                 status = gensec_update(gensec_server_context, tmp_ctx, client_to_server, &server_to_client);
 275                 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {;
 276                         torture_assert_ntstatus_ok(tctx, status, "gensec_update (server) failed");
 277                 }
 278
 279                 if (NT_STATUS_IS_OK(status)) {
 280                         break;
 281                 }
 282         } while (1);
 283
 284         /* Extract the PAC using Samba's code */
 285
 286         status = gensec_session_info(gensec_server_context, gensec_server_context, &session_info);
 287         torture_assert_ntstatus_ok(tctx, status, "gensec_session_info failed");
 288
 289         pac_data = talloc_get_type(auth_context->private_data, struct pac_data);
 290
 291         torture_assert(tctx, pac_data != NULL, "gensec_update failed to fill in pac_data in auth_context");
 292         torture_assert(tctx, pac_data->pac_blob.data != NULL, "pac_blob not present");
 293         torture_decode_compare_pac(tctx, pac_data->pac_blob);
 294
 295         return true;
 296 }
 297
 298 static bool torture_winbind_pac_gssapi(struct torture_context *tctx)
 299 {
 300         return torture_winbind_pac(tctx, "GSSAPI", NULL);
 301 }
 302
 303 static bool torture_winbind_pac_gss_spnego(struct torture_context *tctx)
 304 {
 305         return torture_winbind_pac(tctx, "GSS-SPNEGO", NULL);
 306 }
 307
 308 static bool torture_winbind_pac_krb5(struct torture_context *tctx)
 309 {
 310         return torture_winbind_pac(tctx, NULL, "krb5");
 311 }
 312
 313 NTSTATUS torture_winbind_init(TALLOC_CTX *ctx)
 314 {
 315         struct torture_suite *suite = torture_suite_create(ctx, "winbind");
 316         struct torture_suite *pac_suite;
 317         torture_suite_add_suite(suite, torture_winbind_struct_init(suite));
 318         torture_suite_add_suite(suite, torture_wbclient(suite));
 319
 320         pac_suite = torture_suite_create(ctx, "pac");
 321         torture_suite_add_simple_test(pac_suite,
 322                                       "GSSAPI", torture_winbind_pac_gssapi);
 323         torture_suite_add_simple_test(pac_suite,
 324                                       "GSS-SPNEGO", torture_winbind_pac_gss_spnego);
 325         torture_suite_add_simple_test(pac_suite,
 326                                       "krb5", torture_winbind_pac_krb5);
 327
 328         pac_suite->description = talloc_strdup(suite, "Winbind Kerberos PAC tests");
 329
 330         torture_suite_add_suite(suite, pac_suite);
 331
 332         suite->description = talloc_strdup(suite, "WINBIND tests");
 333
 334         torture_register_suite(ctx, suite);
 335
 336         return NT_STATUS_OK;
 337 }