1 /* 2 Unix SMB/CIFS implementation. 3 test suite for lsa rpc operations 4 5 Copyright (C) Andrew Tridgell 2003 6 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005 7 8 This program is free software; you can redistribute it and/or modify 9 it under the terms of the GNU General Public License as published by 10 the Free Software Foundation; either version 3 of the License, or 11 (at your option) any later version. 12 13 This program is distributed in the hope that it will be useful, 14 but WITHOUT ANY WARRANTY; without even the implied warranty of 15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 16 GNU General Public License for more details. 17 18 You should have received a copy of the GNU General Public License 19 along with this program. If not, see <http://www.gnu.org/licenses/>. 20 */ 21 22 #include "includes.h" 23 #include "librpc/gen_ndr/ndr_lsa_c.h" 24 25 #include "libcli/auth/libcli_auth.h" 26 #include "torture/rpc/torture_rpc.h" 27 #include "lib/cmdline/popt_common.h" 28 #include "param/param.h" 29 30 static void init_lsa_String(struct lsa_String *name, const char *s) 31 { 32 name->string = s; 33 } 34 35 static bool test_CreateSecret_basic(struct dcerpc_pipe *p, 36 struct torture_context *tctx, 37 struct policy_handle *handle, 38 struct policy_handle *sec_handle) 39 { 40 NTSTATUS status; 41 struct lsa_CreateSecret r; 42 struct lsa_SetSecret r3; 43 struct lsa_QuerySecret r4; test_netlogon_ex_ops(struct dcerpc_pipe * p,struct torture_context * tctx,struct cli_credentials * credentials,struct netlogon_creds_CredentialState * creds)44 struct lsa_DATA_BUF buf1; 45 struct lsa_DATA_BUF_PTR bufp1; 46 DATA_BLOB enc_key; 47 DATA_BLOB session_key; 48 NTTIME old_mtime, new_mtime; 49 DATA_BLOB blob1; 50 const char *secret1 = "abcdef12345699qwerty"; 51 char *secret2; 52 char *secname; 53 struct dcerpc_binding_handle *b = p->binding_handle; 54 55 secname = talloc_asprintf(tctx, "torturesecret-%08x", (unsigned int)random()); 56 57 torture_comment(tctx, "Testing CreateSecret of %s\n", secname); 58 59 init_lsa_String(&r.in.name, secname); 60 61 r.in.handle = handle; 62 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED; 63 r.out.sec_handle = sec_handle; 64 65 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_CreateSecret_r(b, tctx, &r), 66 "CreateSecret failed"); 67 torture_assert_ntstatus_ok(tctx, r.out.result, "CreateSecret failed"); 68 69 status = dcerpc_fetch_session_key(p, &session_key); 70 torture_assert_ntstatus_ok(tctx, status, "dcerpc_fetch_session_key failed"); 71 72 enc_key = sess_encrypt_string(secret1, &session_key); 73 74 r3.in.sec_handle = sec_handle; 75 r3.in.new_val = &buf1; 76 r3.in.old_val = NULL; 77 r3.in.new_val->data = enc_key.data; 78 r3.in.new_val->length = enc_key.length; 79 r3.in.new_val->size = enc_key.length; 80 81 torture_comment(tctx, "Testing SetSecret\n"); 82 83 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_SetSecret_r(b, tctx, &r3), 84 "SetSecret failed"); 85 torture_assert_ntstatus_ok(tctx, r3.out.result, "SetSecret failed"); 86 87 r3.in.sec_handle = sec_handle; 88 r3.in.new_val = &buf1; 89 r3.in.old_val = NULL; 90 r3.in.new_val->data = enc_key.data; 91 r3.in.new_val->length = enc_key.length; 92 r3.in.new_val->size = enc_key.length; 93 94 /* break the encrypted data */ 95 enc_key.data[0]++; 96 97 torture_comment(tctx, "Testing SetSecret with broken key\n"); 98 99 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_SetSecret_r(b, tctx, &r3), 100 "SetSecret failed"); 101 torture_assert_ntstatus_equal(tctx, r3.out.result, NT_STATUS_UNKNOWN_REVISION, 102 "SetSecret should have failed UNKNOWN_REVISION"); 103 104 data_blob_free(&enc_key); 105 106 ZERO_STRUCT(new_mtime); 107 ZERO_STRUCT(old_mtime); 108 109 /* fetch the secret back again */ 110 r4.in.sec_handle = sec_handle; 111 r4.in.new_val = &bufp1; 112 r4.in.new_mtime = &new_mtime; 113 r4.in.old_val = NULL; 114 r4.in.old_mtime = NULL; 115 116 bufp1.buf = NULL; 117 118 torture_comment(tctx, "Testing QuerySecret\n"); 119 torture_assert_ntstatus_ok(tctx, dcerpc_lsa_QuerySecret_r(b, tctx, &r4), 120 "QuerySecret failed"); 121 torture_assert_ntstatus_ok(tctx, r4.out.result, "QuerySecret failed"); 122 if (r4.out.new_val == NULL || r4.out.new_val->buf == NULL) 123 torture_fail(tctx, "No secret buffer returned"); 124 blob1.data = r4.out.new_val->buf->data; 125 blob1.length = r4.out.new_val->buf->size; 126 127 secret2 = sess_decrypt_string(tctx, &blob1, &session_key); 128 129 torture_assert_str_equal(tctx, secret1, secret2, "Returned secret invalid"); 130 131 return true; 132 } 133 134 struct secret_settings { 135 uint32_t bindoptions; 136 bool keyexchange; 137 bool ntlm2; 138 bool lm_key; 139 }; 140 141 static bool test_secrets(struct torture_context *torture, const void *_data) 142 { 143 struct dcerpc_pipe *p; 144 struct policy_handle *handle; 145 struct dcerpc_binding *binding; 146 const struct secret_settings *settings = 147 (const struct secret_settings *)_data; 148 NTSTATUS status; 149 struct dcerpc_binding_handle *b; 150 struct policy_handle sec_handle = {0}; 151 bool ok; 152 153 lpcfg_set_cmdline(torture->lp_ctx, "ntlmssp client:keyexchange", settings->keyexchange?"True":"False"); 154 lpcfg_set_cmdline(torture->lp_ctx, "ntlmssp_client:ntlm2", settings->ntlm2?"True":"False"); 155 lpcfg_set_cmdline(torture->lp_ctx, "ntlmssp_client:lm_key", settings->lm_key?"True":"False"); 156 157 torture_assert_ntstatus_ok(torture, torture_rpc_binding(torture, &binding), 158 "Getting bindoptions"); 159 160 status = dcerpc_binding_set_flags(binding, settings->bindoptions, 0); 161 torture_assert_ntstatus_ok(torture, status, "dcerpc_binding_set_flags"); 162 163 status = dcerpc_pipe_connect_b(torture, &p, binding, 164 &ndr_table_lsarpc, 165 popt_get_cmdline_credentials(), 166 torture->ev, 167 torture->lp_ctx); 168 169 torture_assert_ntstatus_ok(torture, status, "connect"); 170 b = p->binding_handle; 171 172 if (!test_lsa_OpenPolicy2(b, torture, &handle)) { 173 talloc_free(p); 174 return false; 175 } 176 177 torture_assert(torture, handle, "OpenPolicy2 failed. This test cannot run against this server"); 178 179 ok = test_CreateSecret_basic(p, torture, handle, &sec_handle); 180 181 if (is_valid_policy_hnd(&sec_handle)) { 182 struct lsa_DeleteObject d; 183 184 d.in.handle = &sec_handle; 185 d.out.handle = &sec_handle; 186 187 status = dcerpc_lsa_DeleteObject_r(b, torture, &d); 188 if (!NT_STATUS_IS_OK(status) || 189 !NT_STATUS_IS_OK(d.out.result)) { 190 torture_warning(torture, 191 "Failed to delete secrets object"); 192 } 193 } 194 195 talloc_free(p); 196 return ok; 197 } 198 199 static struct torture_tcase *add_test(struct torture_suite *suite, uint32_t bindoptions, 200 bool keyexchange, bool ntlm2, bool lm_key) 201 { 202 char *name = NULL; 203 struct secret_settings *settings; 204 205 settings = talloc_zero(suite, struct secret_settings); 206 settings->bindoptions = bindoptions; 207 208 if (bindoptions == DCERPC_PUSH_BIGENDIAN) 209 name = talloc_strdup(suite, "bigendian"); 210 else if (bindoptions == DCERPC_SEAL) 211 name = talloc_strdup(suite, "seal"); 212 else if (bindoptions == 0) 213 name = talloc_strdup(suite, "none"); 214 else 215 name = talloc_strdup(suite, "unknown"); 216 217 name = talloc_asprintf_append_buffer(name, " keyexchange:%s", keyexchange?"yes":"no"); 218 settings->keyexchange = keyexchange; 219 220 name = talloc_asprintf_append_buffer(name, " ntlm2:%s", ntlm2?"yes":"no"); 221 settings->ntlm2 = ntlm2; 222 223 name = talloc_asprintf_append_buffer(name, " lm_key:%s", lm_key?"yes":"no"); 224 settings->lm_key = lm_key; 225 226 return torture_suite_add_simple_tcase_const(suite, name, test_secrets, 227 settings); 228 } 229 230 static const bool bool_vals[] = { true, false }; 231 232 /* TEST session key correctness by pushing and pulling secrets */ 233 struct torture_suite *torture_rpc_lsa_secrets(TALLOC_CTX *mem_ctx) 234 { 235 struct torture_suite *suite = torture_suite_create(mem_ctx, "lsa.secrets"); 236 int keyexchange, ntlm2, lm_key; 237 238 for (keyexchange = 0; keyexchange < ARRAY_SIZE(bool_vals); keyexchange++) { 239 for (ntlm2 = 0; ntlm2 < ARRAY_SIZE(bool_vals); ntlm2++) { 240 for (lm_key = 0; lm_key < ARRAY_SIZE(bool_vals); lm_key++) { 241 add_test(suite, DCERPC_PUSH_BIGENDIAN, bool_vals[keyexchange], bool_vals[ntlm2], 242 bool_vals[lm_key]); 243 add_test(suite, DCERPC_SEAL, bool_vals[keyexchange], bool_vals[ntlm2], bool_vals[lm_key]); 244 add_test(suite, 0, bool_vals[keyexchange], bool_vals[ntlm2], bool_vals[lm_key]); 245 } 246 } test_samr_ops(struct torture_context * tctx,struct dcerpc_binding_handle * b)247 } 248 249 return suite; 250 } 251