The branch, master has been updated
via 56b1cff s4 torture: add new rpc torture tests for backup key remote
protocol
via f464955 s4:selftest: skip samba4.rpc.backupkey for now
from 49cfb2e s3:Makefile.in: use waf directly to build smbtorture4 and
ndrdump4
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master
- Log -----------------------------------------------------------------
commit 56b1cff70e9708ce5b3ac5a7980d1d1e858f5cbb
Author: Matthieu Patou <m...@matws.net>
Date: Mon Jul 26 03:01:03 2010 +0400
s4 torture: add new rpc torture tests for backup key remote protocol
Signed-off-by: Stefan Metzmacher <me...@samba.org>
Autobuild-User: Stefan Metzmacher <me...@samba.org>
Autobuild-Date: Sat Feb 5 13:01:42 CET 2011 on sn-devel-104
commit f46495553409e95527cb53f1db2a971dcd22dac2
Author: Stefan Metzmacher <me...@samba.org>
Date: Sat Feb 5 12:14:55 2011 +0100
s4:selftest: skip samba4.rpc.backupkey for now
metze
-----------------------------------------------------------------------
Summary of changes:
source4/selftest/skip | 1 +
source4/torture/rpc/backupkey.c | 1038 +++++++++++++++++++++++++++++++++++++++
source4/torture/rpc/rpc.c | 1 +
source4/torture/wscript_build | 4 +-
4 files changed, 1042 insertions(+), 2 deletions(-)
create mode 100644 source4/torture/rpc/backupkey.c
Changeset truncated at 500 lines:
diff --git a/source4/selftest/skip b/source4/selftest/skip
index 671269a..d46ebc9 100644
--- a/source4/selftest/skip
+++ b/source4/selftest/skip
@@ -84,3 +84,4 @@ smb2.acls # new test which doesn't pass yet
# ktutil might not be installed or from mit...
# we should build a samba4ktutil and use that instead
samba4.blackbox.ktpass # this test isn't portable ...
+samba4.rpc.backupkey # skip until we have the server code
diff --git a/source4/torture/rpc/backupkey.c b/source4/torture/rpc/backupkey.c
new file mode 100644
index 0000000..85c53fe
--- /dev/null
+++ b/source4/torture/rpc/backupkey.c
@@ -0,0 +1,1038 @@
+/*
+ Unix SMB/CIFS implementation.
+ test suite for backupkey remote protocol rpc operations
+
+ Copyright (C) Matthieu Patou 2010-2011
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+#include "../libcli/security/security.h"
+#include "librpc/gen_ndr/ndr_backupkey_c.h"
+#include "librpc/gen_ndr/ndr_backupkey.h"
+#include "librpc/gen_ndr/ndr_lsa_c.h"
+#include "torture/rpc/torture_rpc.h"
+#include "lib/cmdline/popt_common.h"
+#include "heimdal/lib/hx509/hx_locl.h"
+
+/* Our very special and valued secret */
+/* No need to put const as we cast the array in uint8_t
+ * we will get a warning about the discared const
+ */
+static const char secret[] = "tata yoyo mais qu'est ce qu'il y a sous ton
grand chapeau ?";
+
+/* Get the SID from a user */
+static const struct dom_sid *get_user_sid(struct torture_context *tctx,
+ struct dcerpc_pipe *p,
+ TALLOC_CTX *mem_ctx,
+ const char *user)
+{
+ struct lsa_ObjectAttribute attr;
+ struct lsa_QosInfo qos;
+ struct lsa_OpenPolicy2 r;
+ struct lsa_Close c;
+ NTSTATUS status;
+ struct policy_handle handle;
+ struct lsa_LookupNames l;
+ struct lsa_TransSidArray sids;
+ struct lsa_RefDomainList *domains = NULL;
+ struct lsa_String lsa_name;
+ uint32_t count = 0;
+ struct dom_sid *result;
+ TALLOC_CTX *tmp_ctx;
+ struct dcerpc_pipe *p2;
+ struct dcerpc_binding_handle *b;
+
+ const char *domain = cli_credentials_get_domain(cmdline_credentials);
+
+ torture_assert_ntstatus_ok(tctx,
+ torture_rpc_connection(tctx, &p2,
&ndr_table_lsarpc),
+ "could not open lsarpc pipe");
+ b = p2->binding_handle;
+
+ if (!(tmp_ctx = talloc_new(mem_ctx))) {
+ return NULL;
+ }
+ qos.len = 0;
+ qos.impersonation_level = 2;
+ qos.context_mode = 1;
+ qos.effective_only = 0;
+
+ attr.len = 0;
+ attr.root_dir = NULL;
+ attr.object_name = NULL;
+ attr.attributes = 0;
+ attr.sec_desc = NULL;
+ attr.sec_qos = &qos;
+
+ r.in.system_name = "\\";
+ r.in.attr = &attr;
+ r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
+ r.out.handle = &handle;
+
+ status = dcerpc_lsa_OpenPolicy2_r(b, tmp_ctx, &r);
+ if (!NT_STATUS_IS_OK(status)) {
+ torture_comment(tctx,
+ "OpenPolicy2 failed - %s\n",
+ nt_errstr(status));
+ talloc_free(tmp_ctx);
+ return NULL;
+ }
+ if (!NT_STATUS_IS_OK(r.out.result)) {
+ torture_comment(tctx,
+ "OpenPolicy2_ failed - %s\n",
+ nt_errstr(r.out.result));
+ talloc_free(tmp_ctx);
+ return NULL;
+ }
+
+ sids.count = 0;
+ sids.sids = NULL;
+
+ lsa_name.string = talloc_asprintf(tmp_ctx, "%s\\%s", domain, user);
+
+ l.in.handle = &handle;
+ l.in.num_names = 1;
+ l.in.names = &lsa_name;
+ l.in.sids = &sids;
+ l.in.level = 1;
+ l.in.count = &count;
+ l.out.count = &count;
+ l.out.sids = &sids;
+ l.out.domains = &domains;
+
+ status = dcerpc_lsa_LookupNames_r(b, tmp_ctx, &l);
+ if (!NT_STATUS_IS_OK(status)) {
+ torture_comment(tctx,
+ "LookupNames of %s failed - %s\n",
+ lsa_name.string,
+ nt_errstr(status));
+ talloc_free(tmp_ctx);
+ return NULL;
+ }
+
+ if (domains->count == 0) {
+ return NULL;
+ }
+
+ result = dom_sid_add_rid(mem_ctx,
+ domains->domains[0].sid,
+ l.out.sids->sids[0].rid);
+ c.in.handle = &handle;
+ c.out.handle = &handle;
+
+ status = dcerpc_lsa_Close_r(b, tmp_ctx, &c);
+
+ if (!NT_STATUS_IS_OK(status)) {
+ torture_comment(tctx,
+ "dcerpc_lsa_Close failed - %s\n",
+ nt_errstr(status));
+ talloc_free(tmp_ctx);
+ return NULL;
+ }
+
+ if (!NT_STATUS_IS_OK(c.out.result)) {
+ torture_comment(tctx,
+ "dcerpc_lsa_Close failed - %s\n",
+ nt_errstr(c.out.result));
+ talloc_free(tmp_ctx);
+ return NULL;
+ }
+
+ talloc_free(tmp_ctx);
+ talloc_free(p2);
+
+ torture_comment(tctx, "Get_user_sid finished\n");
+ return result;
+}
+
+/*
+ * Create a bkrp_encrypted_secret_vX structure
+ * the version depends on the version parameter
+ * the structure is returned as a blob.
+ * The broken flag is to indicate if we want
+ * to create a non conform to specification structre
+ */
+static DATA_BLOB *create_unencryptedsecret(TALLOC_CTX *mem_ctx,
+ bool broken,
+ int version)
+{
+ TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
+ DATA_BLOB *blob = talloc_zero(mem_ctx, DATA_BLOB);
+ enum ndr_err_code ndr_err;
+
+ if (version == 2) {
+ struct bkrp_encrypted_secret_v2 unenc_sec;
+
+ ZERO_STRUCT(unenc_sec);
+ unenc_sec.secret_len = sizeof(secret);
+ unenc_sec.secret = discard_const_p(uint8_t, secret);
+ generate_random_buffer(unenc_sec.payload_key,
+ sizeof(unenc_sec.payload_key));
+
+ ndr_err = ndr_push_struct_blob(blob, blob, &unenc_sec,
+
(ndr_push_flags_fn_t)ndr_push_bkrp_encrypted_secret_v2);
+ if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+ return NULL;
+ }
+
+ if (broken) {
+ /* The magic value is correctly set by the NDR push
+ * but we want to test the behavior of the server
+ * if a differrent value is provided
+ */
+ ((uint8_t*)blob->data)[4] = 79; /* A great year !!! */
+ }
+ }
+
+ if (version == 3) {
+ struct bkrp_encrypted_secret_v3 unenc_sec;
+
+ ZERO_STRUCT(unenc_sec);
+ unenc_sec.secret_len = sizeof(secret);
+ unenc_sec.secret = discard_const_p(uint8_t, secret);
+ generate_random_buffer(unenc_sec.payload_key,
+ sizeof(unenc_sec.payload_key));
+
+ ndr_err = ndr_push_struct_blob(blob, blob, &unenc_sec,
+
(ndr_push_flags_fn_t)ndr_push_bkrp_encrypted_secret_v3);
+ if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+ return NULL;
+ }
+
+ if (broken) {
+ /*
+ * The magic value is correctly set by the NDR push
+ * but we want to test the behavior of the server
+ * if a differrent value is provided
+ */
+ ((uint8_t*)blob->data)[4] = 79; /* A great year !!! */
+ }
+ }
+ talloc_free(tmp_ctx);
+ return blob;
+}
+
+/*
+ * Create an access check structure, the format depends on the version
parameter.
+ * If broken is specified then we create a stucture that isn't conform to the
+ * specification.
+ *
+ * If the structure can't be created then NULL is returned.
+ */
+static DATA_BLOB *create_access_check(struct torture_context *tctx,
+ struct dcerpc_pipe *p,
+ TALLOC_CTX *mem_ctx,
+ const char *user,
+ bool broken,
+ uint32_t version)
+{
+ TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
+ DATA_BLOB *blob = talloc_zero(mem_ctx, DATA_BLOB);
+ enum ndr_err_code ndr_err;
+ const struct dom_sid *sid = get_user_sid(tctx, p, tmp_ctx, user);
+
+ if (sid == NULL) {
+ return NULL;
+ }
+
+ if (version == 2) {
+ struct bkrp_access_check_v2 access_struct;
+ struct sha sctx;
+ uint8_t nonce[32];
+
+ ZERO_STRUCT(access_struct);
+ generate_random_buffer(nonce, sizeof(nonce));
+ access_struct.nonce_len = sizeof(nonce);
+ access_struct.nonce = nonce;
+ access_struct.sid = *sid;
+
+ ndr_err = ndr_push_struct_blob(blob, blob, &access_struct,
+
(ndr_push_flags_fn_t)ndr_push_bkrp_access_check_v2);
+ if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+ return NULL;
+ }
+
+ /*
+ * We pushed the whole structure including a null hash
+ * but the hash need to be calculated only up to the hash field
+ * so we reduce the size of what has to be calculated
+ */
+
+ SHA1_Init(&sctx);
+ SHA1_Update(&sctx, blob->data,
+ blob->length - sizeof(access_struct.hash));
+ SHA1_Final(blob->data + blob->length -
sizeof(access_struct.hash),
+ &sctx);
+
+ /* Altering the SHA */
+ if (broken) {
+ blob->data[blob->length - 1]++;
+ }
+ }
+
+ if (version == 3) {
+ struct bkrp_access_check_v3 access_struct;
+ struct hc_sha512state sctx;
+ uint8_t nonce[32];
+
+ ZERO_STRUCT(access_struct);
+ generate_random_buffer(nonce, sizeof(nonce));
+ access_struct.nonce_len = sizeof(nonce);
+ access_struct.nonce = nonce;
+ access_struct.sid = *sid;
+
+ ndr_err = ndr_push_struct_blob(blob, blob, &access_struct,
+
(ndr_push_flags_fn_t)ndr_push_bkrp_access_check_v3);
+ if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+ return NULL;
+ }
+
+ /*We pushed the whole structure including a null hash
+ * but the hash need to be calculated only up to the hash field
+ * so we reduce the size of what has to be calculated
+ */
+
+ SHA512_Init(&sctx);
+ SHA512_Update(&sctx, blob->data,
+ blob->length - sizeof(access_struct.hash));
+ SHA512_Final(blob->data + blob->length -
sizeof(access_struct.hash),
+ &sctx);
+
+ /* Altering the SHA */
+ if (broken) {
+ blob->data[blob->length -1]++;
+ }
+ }
+ talloc_free(tmp_ctx);
+ return blob;
+}
+
+
+static DATA_BLOB *encrypt_blob(struct torture_context *tctx,
+ TALLOC_CTX *mem_ctx,
+ DATA_BLOB *key,
+ DATA_BLOB *iv,
+ DATA_BLOB *to_encrypt,
+ const AlgorithmIdentifier *alg)
+{
+ hx509_crypto crypto;
+ hx509_context hctx;
+ heim_octet_string ivos;
+ heim_octet_string *encrypted;
+ DATA_BLOB *blob = talloc_zero(mem_ctx, DATA_BLOB);
+ int res;
+
+ ivos.data = talloc_array(mem_ctx, uint8_t, iv->length);
+ ivos.length = iv->length;
+ memcpy(ivos.data, iv->data, iv->length);
+
+ hx509_context_init(&hctx);
+ res = hx509_crypto_init(hctx, NULL, &alg->algorithm, &crypto);
+ if (res) {
+ torture_comment(tctx,
+ "error while doing the init of the crypto
object\n");
+ hx509_context_free(&hctx);
+ return NULL;
+ }
+ res = hx509_crypto_set_key_data(crypto, key->data, key->length);
+ if (res) {
+ torture_comment(tctx,
+ "error while setting the key of the crypto
object\n");
+ hx509_context_free(&hctx);
+ return NULL;
+ }
+
+ hx509_crypto_set_padding(crypto, HX509_CRYPTO_PADDING_NONE);
+ res = hx509_crypto_encrypt(crypto,
+ to_encrypt->data,
+ to_encrypt->length,
+ &ivos,
+ &encrypted);
+ if (res) {
+ torture_comment(tctx, "error while encrypting\n");
+ hx509_crypto_destroy(crypto);
+ hx509_context_free(&hctx);
+ return NULL;
+ }
+
+ *blob = data_blob_talloc(blob, encrypted->data, encrypted->length);
+ der_free_octet_string(encrypted);
+ free(encrypted);
+ hx509_crypto_destroy(crypto);
+ hx509_context_free(&hctx);
+ return blob;
+}
+
+/*
+ * Certs used for this protocol have a GUID in the issuer_uniq_id field.
+ * This function fetch it.
+ */
+static struct GUID *get_cert_guid(struct torture_context *tctx,
+ TALLOC_CTX *mem_ctx,
+ uint8_t *cert_data,
+ uint32_t cert_len)
+{
+ hx509_context hctx;
+ hx509_cert cert;
+ heim_bit_string subjectuniqid;
+ DATA_BLOB data;
+ int hret;
+ uint32_t size;
+ struct GUID *guid = talloc_zero(mem_ctx, struct GUID);
+ NTSTATUS status;
+
+ hx509_context_init(&hctx);
+
+ hret = hx509_cert_init_data(hctx, cert_data, cert_len, &cert);
+ if (hret) {
+ torture_comment(tctx, "error while loading the cert\n");
+ hx509_context_free(&hctx);
+ return NULL;
+ }
+ hret = hx509_cert_get_issuer_unique_id(hctx, cert, &subjectuniqid);
+ if (hret) {
+ torture_comment(tctx, "error while getting the
issuer_uniq_id\n");
+ hx509_cert_free(cert);
+ hx509_context_free(&hctx);
+ return NULL;
+ }
+
+ /* The subjectuniqid is a bit string,
+ * which means that the real size has to be divided by 8
+ * to have the number of bytes
+ */
+ hx509_cert_free(cert);
+ hx509_context_free(&hctx);
+ size = subjectuniqid.length / 8;
+ data = data_blob_const(subjectuniqid.data, size);
+
+ status = GUID_from_data_blob(&data, guid);
+ der_free_bit_string(&subjectuniqid);
+ if (!NT_STATUS_IS_OK(status)) {
+ return NULL;
+ }
+
+ return guid;
+}
+
+/*
+ * Encrypt a blob with the private key of the certificate
+ * passed as a parameter.
+ */
+static DATA_BLOB *encrypt_blob_pk(struct torture_context *tctx,
+ TALLOC_CTX *mem_ctx,
+ uint8_t *cert_data,
+ uint32_t cert_len,
+ DATA_BLOB *to_encrypt)
+{
+ hx509_context hctx;
+ hx509_cert cert;
+ heim_octet_string secretdata;
+ heim_octet_string encrypted;
+ heim_oid encryption_oid;
+ DATA_BLOB *blob;
+ int hret;
+
+ hx509_context_init(&hctx);
+
+ hret = hx509_cert_init_data(hctx, cert_data, cert_len, &cert);
+ if (hret) {
+ torture_comment(tctx, "error while loading the cert\n");
+ hx509_context_free(&hctx);
+ return NULL;
+ }
+
+ secretdata.data = to_encrypt->data;
+ secretdata.length = to_encrypt->length;
+ hret = _hx509_cert_public_encrypt(hctx, &secretdata,
+ cert, &encryption_oid,
+ &encrypted);
+ hx509_cert_free(cert);
+ hx509_context_free(&hctx);
+ if (hret) {
+ torture_comment(tctx, "error while encrypting\n");
+ return NULL;
+ }
+
+ blob = talloc_zero(mem_ctx, DATA_BLOB);
+ if (blob == NULL) {
+ der_free_oid(&encryption_oid);
+ der_free_octet_string(&encrypted);
+ return NULL;
+ }
+
+ *blob = data_blob_talloc(blob, encrypted.data, encrypted.length);
+ der_free_octet_string(&encrypted);
+ der_free_oid(&encryption_oid);
+ if (blob->data == NULL) {
+ return NULL;
+ }
+
+ return blob;
+}
--
Samba Shared Repository
