Author: abartlet Date: 2005-10-06 10:29:28 +0000 (Thu, 06 Oct 2005) New Revision: 10763
WebSVN: http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=10763 Log: PROOF of the single, easily understood cause of all of our schannel PAIN! This test currently passes against Win2k3 SP0, but not SP1. The problem was not a convoluted series of changes in policy handles, but a simple rule that schannel logins would be regarded as ANONYMOUS not SYSTEM. Andrew Bartlett Modified: branches/SAMBA_4_0/source/torture/rpc/schannel.c Changeset: Modified: branches/SAMBA_4_0/source/torture/rpc/schannel.c =================================================================== --- branches/SAMBA_4_0/source/torture/rpc/schannel.c 2005-10-06 07:36:29 UTC (rev 10762) +++ branches/SAMBA_4_0/source/torture/rpc/schannel.c 2005-10-06 10:29:28 UTC (rev 10763) @@ -83,6 +83,57 @@ /* + do some lsa ops using the schannel connection + */ +static BOOL test_lsa_ops(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx) +{ + struct lsa_GetUserName r; + NTSTATUS status; + BOOL ret = True; + struct lsa_StringPointer authority_name_p; + int i; + + printf("\nTesting GetUserName\n"); + + r.in.system_name = "\\"; + r.in.account_name = NULL; + r.in.authority_name = &authority_name_p; + authority_name_p.string = NULL; + + /* do several ops to test credential chaining */ + for (i=0;i<5;i++) { + status = dcerpc_lsa_GetUserName(p, mem_ctx, &r); + + if (!NT_STATUS_IS_OK(status)) { + printf("GetUserName failed - %s\n", nt_errstr(status)); + return False; + } else { + if (!r.out.account_name) { + return False; + } + + if (strcmp(r.out.account_name->string, "SYSTEM") != 0) { + printf("GetUserName returned wrong user: %s, expected %s\n", + r.out.account_name->string, "SYSTEM"); + return False; + } + if (!r.out.authority_name || !r.out.authority_name->string) { + return False; + } + + if (strcmp(r.out.authority_name->string->string, "NT AUTHORITY") != 0) { + printf("GetUserName returned wrong user: %s, expected %s\n", + r.out.authority_name->string->string, "NT AUTHORITY"); + return False; + } + } + } + + return ret; +} + + +/* try a netlogon SamLogon */ static BOOL test_netlogon_ops(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx, @@ -146,12 +197,15 @@ uint16_t acct_flags, uint32_t dcerpc_flags, uint32_t schannel_type) { + BOOL ret = True; + void *join_ctx; NTSTATUS status; const char *binding = lp_parm_string(-1, "torture", "binding"); struct dcerpc_binding *b; struct dcerpc_pipe *p = NULL; struct dcerpc_pipe *p_netlogon = NULL; + struct dcerpc_pipe *p_lsa = NULL; struct creds_CredentialState *creds; struct cli_credentials *credentials; @@ -185,8 +239,8 @@ } if (!test_samr_ops(p, test_ctx)) { - printf("Failed to process schannel secured ops\n"); - goto failed; + printf("Failed to process schannel secured SAMR ops\n"); + ret = False; } status = dcerpc_schannel_creds(p->conn->security_state.generic_state, test_ctx, &creds); @@ -229,13 +283,42 @@ /* do a couple of logins */ if (!test_netlogon_ops(p_netlogon, test_ctx, creds)) { - printf("Failed to process schannel secured ops\n"); + printf("Failed to process schannel secured NETLOGON ops\n"); + ret = False; + } + + /* Swap the binding details from SAMR to LSARPC */ + status = dcerpc_epm_map_binding(test_ctx, b, DCERPC_LSARPC_UUID, + DCERPC_LSARPC_VERSION, NULL); + if (!NT_STATUS_IS_OK(status)) { goto failed; } + status = dcerpc_secondary_connection(p, &p_lsa, + b); + + if (!NT_STATUS_IS_OK(status)) { + goto failed; + } + + status = dcerpc_bind_auth_password(p_lsa, + DCERPC_LSARPC_UUID, + DCERPC_LSARPC_VERSION, + credentials, DCERPC_AUTH_TYPE_SCHANNEL, + NULL); + + if (!NT_STATUS_IS_OK(status)) { + goto failed; + } + + if (!test_lsa_ops(p_lsa, test_ctx)) { + printf("Failed to process schannel secured LSA ops\n"); + ret = False; + } + torture_leave_domain(join_ctx); talloc_free(test_ctx); - return True; + return ret; failed: torture_leave_domain(join_ctx);