# # This file and its contents are supplied under the terms of the # Common Development and Distribution License ("CDDL"), version 1.0. # You may only use this file in accordance with the terms of version # 1.0 of the CDDL. # # A full copy of the text of the CDDL should have accompanied this # source. A copy of the CDDL is also available via the Internet at # http://www.illumos.org/license/CDDL. # # # Copyright 2020 Tintri by DDN, Inc. All rights reserved. # .PARALLEL: $(SUBDIRS) SUBDIRS = cfg cmd runfiles tests doc include $(SRC)/test/Makefile.com # # This file and its contents are supplied under the terms of the # Common Development and Distribution License ("CDDL"), version 1.0. # You may only use this file in accordance with the terms of version # 1.0 of the CDDL. # # A full copy of the text of the CDDL should have accompanied this # source. A copy of the CDDL is also available via the Internet at # http://www.illumos.org/license/CDDL. # # # Copyright 2019 Joyent, Inc. # Copyright 2020 Tintri by DDN, Inc. All rights reserved. # include $(SRC)/Makefile.master CFGS = samlogon.config krb5_pac.config ROOTOPTPKG = $(ROOT)/opt/libmlrpc-tests ROOTOPTPKGCFG = $(ROOT)/opt/libmlrpc-tests/cfg ROOTOPTPKGDIRS = $(ROOTOPTPKG) $(ROOTOPTPKGCFG) FILES = $(CFGS:%=$(ROOTOPTPKGCFG)/%) $(FILES) : FILEMODE = 0644 include $(SRC)/test/Makefile.com all: $(CFGS) install: $(ROOTOPTPKG) $(ROOTOPTPKGCFG) $(FILES) clobber: clean $(RM) $(FILES) $(ROOTOPTPKGDIRS): $(INS.dir) $(ROOTOPTPKGCFG)/%: % $(ROOTOPTPKGDIRS) $(INS.file) #!/usr/bin/ksh # # This file and its contents are supplied under the terms of the # Common Development and Distribution License ("CDDL"), version 1.0. # You may only use this file in accordance with the terms of version # 1.0 of the CDDL. # # A full copy of the text of the CDDL should have accompanied this # source. A copy of the CDDL is also available via the Internet at # http://www.illumos.org/license/CDDL. # # Copyright 2020 Tintri by DDN, Inc. All rights reserved. # # # A binary file containing the PAC_LOGON_INFO from a decrypted Kerberos ticket. # This can be exported from the AD-Win2k-PAC (including the MES header) # using Wireshark. # export KRB5_PAC_BIN="$MLRPC_TESTS/tests/netrlogon/krb5_pac_tests/krb5_pac.bin" #!/usr/bin/ksh # # This file and its contents are supplied under the terms of the # Common Development and Distribution License ("CDDL"), version 1.0. # You may only use this file in accordance with the terms of version # 1.0 of the CDDL. # # A full copy of the text of the CDDL should have accompanied this # source. A copy of the CDDL is also available via the Internet at # http://www.illumos.org/license/CDDL. # # Copyright 2020 Tintri by DDN, Inc. All rights reserved. # # The NETBIOS domain name to which the server is joined. export NETBIOS_DOMAIN="DOMAIN" # An FQDN of a dc in the domain. export DC_FQDN="dc.domain.com" # The authenticating user. export USERNAME="user" # The name of the computer from which the user is authenticating. export CLIENT_COMPUTER="client1" # # Binary files exported from Wireshark, containing parts of a # NetrSamLogon(Ex) request. # export CHALLENGE_FILE=/path/to/challenge.bin export NT_RESPONSE_FILE=/path/to/nt_file.bin export LM_RESPONSE_FILE=/path/to/lm_file.bin# # This file and its contents are supplied under the terms of the # Common Development and Distribution License ("CDDL"), version 1.0. # You may only use this file in accordance with the terms of version # 1.0 of the CDDL. # # A full copy of the text of the CDDL should have accompanied this # source. A copy of the CDDL is also available via the Internet at # http://www.illumos.org/license/CDDL. # # # Copyright 2020 Tintri by DDN, Inc. All rights reserved. # include $(SRC)/Makefile.master include $(SRC)/test/Makefile.com ROOTOPTPKG = $(ROOT)/opt/libmlrpc-tests ROOTBIN = $(ROOTOPTPKG)/bin PROGS = libmlrpctest CMDS = $(PROGS:%=$(ROOTBIN)/%) $(CMDS) : FILEMODE = 0555 all lint clean clobber: install: $(CMDS) $(CMDS): $(ROOTBIN) $(ROOTBIN): $(INS.dir) $(ROOTBIN)/%: % $(INS.file) $(ROOTBIN)/%: %.ksh $(INS.rename) #!/usr/bin/ksh # # This file and its contents are supplied under the terms of the # Common Development and Distribution License ("CDDL"), version 1.0. # You may only use this file in accordance with the terms of version # 1.0 of the CDDL. # # A full copy of the text of the CDDL should have accompanied this # source. A copy of the CDDL is also available via the Internet at # http://www.illumos.org/license/CDDL. # # # Copyright (c) 2012 by Delphix. All rights reserved. # Copyright 2020 Tintri by DDN, Inc. All rights reserved. # export MLRPC_TESTS="/opt/libmlrpc-tests" runner="/opt/test-runner/bin/run" function fail { echo $1 exit ${2:-1} } function find_runfile { typeset distro= if [[ -f $MLRPC_TESTS/runfiles/default.run ]]; then distro=default fi [[ -n $distro ]] && echo $MLRPC_TESTS/runfiles/$distro.run } while getopts c: c; do case $c in 'c') runfile=$OPTARG [[ -f $runfile ]] || fail "Cannot read file: $runfile" ;; esac done shift $((OPTIND - 1)) [[ -z $runfile ]] && runfile=$(find_runfile) [[ -z $runfile ]] && fail "Couldn't determine distro" $runner -c $runfile exit $? # # This file and its contents are supplied under the terms of the # Common Development and Distribution License ("CDDL"), version 1.0. # You may only use this file in accordance with the terms of version # 1.0 of the CDDL. # # A full copy of the text of the CDDL should have accompanied this # source. A copy of the CDDL is also available via the Internet at # http://www.illumos.org/license/CDDL. # # # Copyright (c) 2012 by Delphix. All rights reserved. # Copyright 2020 Tintri by DDN, Inc. All rights reserved. # include $(SRC)/Makefile.master READMES = README ROOTOPTPKG = $(ROOT)/opt/libmlrpc-tests FILES = $(READMES:%=$(ROOTOPTPKG)/%) $(FILES) : FILEMODE = 0444 all: $(READMES) install: $(ROOTOPTPKG) $(FILES) clean lint clobber: $(ROOTOPTPKG): $(INS.dir) $(ROOTOPTPKG)/%: % $(INS.file) # # This file and its contents are supplied under the terms of the # Common Development and Distribution License ("CDDL"), version 1.0. # You may only use this file in accordance with the terms of version # 1.0 of the CDDL. # # A full copy of the text of the CDDL should have accompanied this # source. A copy of the CDDL is also available via the Internet at # http://www.illumos.org/license/CDDL. # # # Copyright (c) 2012 by Delphix. All rights reserved. # Copyright 2020 Tintri by DDN, Inc. All rights reserved. # libmlrpc Unit Test Suite README 1. Building and installing this Unit Test Suite 2. Running this Unit Test Suite 3. Test results -------------------------------------------------------------------------------- 1. Building and installing this Unit Test Suite This Test Suite runs under the testrunner framework (which can be installed as pkg:/system/test/testrunner). To build both this Unit Test Suite and the testrunner without running a full nightly: build_machine$ bldenv [-d] build_machine$ cd $SRC/test build_machine$ dmake install build_machine$ cd $SRC/pkg build_machine$ dmake install Then set the publisher on the test machine to point to your repository and install the Utils Unit Test Suite. test_machine# pkg install pkg:/system/test/libmlrpctest Note, the framework will be installed automatically, as this test suite depends on it. 2. Running this Unit Test Suite The pre-requisites for running the this Unit Test Suite are: - A non-root user with the ability to sudo(8) to root without a password or the root user must run the test. (The samlogon test requires a user with 'solaris.smf.read.smb' authorization, such as root.) - The libmlrpc library must be installed. - The system must be joined to the domain. - Certain information must be collected from a packet capture performing NTLM authentication against the system using a domain user, all from the NetrSamLogon(Ex) request: - IDENTITY_INFO/Domain - IDENTITY_INFO/Acct Name - IDENTITY_INFO/Wkst Name - three binary files, exported from Wireshark: 1. NETWORK_INFO/Challenge (8 bytes) 2. First NETWORK_INFO/'LM Chal resp'/Bytes array/'LM Chal resp' (variable - the first is NT) 3. Second NETWORK_INFO/'LM Chal resp'/Bytes array/'LM Chal resp' (variable - the second is LM) - Enter configuration data in /opt/libmlrpc-tests/cfg/samlogon.config. Once the pre-requisites are satisfied, simply run the script: test_machine$ /opt/libmlrpc-tests/bin/libmlrpctest 3. Test results While the Unit Test Suite is running, one informational line is printed at the end of each test, and a results summary is printed at the end of the run. The results summary includes the location of the complete logs, which is of the form /var/tmp/test_results/.# # This file and its contents are supplied under the terms of the # Common Development and Distribution License ("CDDL"), version 1.0. # You may only use this file in accordance with the terms of version # 1.0 of the CDDL. # # A full copy of the text of the CDDL should have accompanied this # source. A copy of the CDDL is also available via the Internet at # http://www.illumos.org/license/CDDL. # # # Copyright (c) 2012 by Delphix. All rights reserved. # Copyright 2020 Tintri by DDN, Inc. All rights reserved. # include $(SRC)/Makefile.master SRCS = default.run ROOTOPTPKG = $(ROOT)/opt/libmlrpc-tests RUNFILES = $(ROOTOPTPKG)/runfiles CMDS = $(SRCS:%=$(RUNFILES)/%) $(CMDS) : FILEMODE = 0444 all: $(SRCS) install: $(CMDS) clean lint clobber: $(CMDS): $(RUNFILES) $(SRCS) $(RUNFILES): $(INS.dir) $(RUNFILES)/%: % $(INS.file) # # This file and its contents are supplied under the terms of the # Common Development and Distribution License ("CDDL"), version 1.0. # You may only use this file in accordance with the terms of version # 1.0 of the CDDL. # # A full copy of the text of the CDDL should have accompanied this # source. A copy of the CDDL is also available via the Internet at # http://www.illumos.org/license/CDDL. # # # Copyright 2020 Tintri by DDN, Inc. All rights reserved. # [DEFAULT] pre = verbose = False quiet = False timeout = 60 post = outputdir = /var/tmp/test_results [/opt/libmlrpc-tests/tests/netrlogon/krb5_pac_tests] tests = ['run_krb5_pac_tests'] [/opt/libmlrpc-tests/tests/netrlogon/samlogon_tests] user = root tests = ['run_samlogon_tests'] # # This file and its contents are supplied under the terms of the # Common Development and Distribution License ("CDDL"), version 1.0. # You may only use this file in accordance with the terms of version # 1.0 of the CDDL. # # A full copy of the text of the CDDL should have accompanied this # source. A copy of the CDDL is also available via the Internet at # http://www.illumos.org/license/CDDL. # # # Copyright 2020 Tintri by DDN, Inc. All rights reserved. # SUBDIRS = \ netrlogon ROOTOPTDIR = $(ROOT)/opt/libmlrpc-tests/tests all : TARGET = all install : TARGET = install clean : TARGET = clean clobber : TARGET = clobber lint : TARGET = lint .KEEP_STATE: install: $(SUBDIRS) all: $(SUBDIRS) clean lint: $(SUBDIRS) $(ROOTOPTDIR): $(INS.dir) clobber: $(SUBDIRS) $(SUBDIRS): FRC @cd $@; pwd; $(MAKE) $(TARGET) FRC: # # This file and its contents are supplied under the terms of the # Common Development and Distribution License ("CDDL"), version 1.0. # You may only use this file in accordance with the terms of version # 1.0 of the CDDL. # # A full copy of the text of the CDDL should have accompanied this # source. A copy of the CDDL is also available via the Internet at # http://www.illumos.org/license/CDDL. # # # Copyright (c) 2012 by Delphix. All rights reserved. # Copyright 2014 Garrett D'Amore # Copyright 2020 Tintri by DDN, Inc. All rights reserved. # include $(SRC)/Makefile.master include $(SRC)/cmd/Makefile.cmd include $(SRC)/test/Makefile.com # # Note: NDR currently is only supported in 32-bit programs. # OBJS = $(PROG).o util_common.o SRCS = $(PROG).c $(TESTCOMMONDIR)/util_common.c CSTD = $(CSTD_GNU99) CPPFLAGS += -I$(TESTCOMMONDIR) ROOTOPTPKG = $(ROOT)/opt/libmlrpc-tests TESTDIR = $(ROOTOPTPKG)/tests/$(TESTSUBDIR) CMDS = $(PROG:%=$(TESTDIR)/%) $(KSHPROG:%=$(TESTDIR)/%) $(CMDS) : FILEMODE = 0555 BINS = $(BINFILES:%=$(TESTDIR)/%) $(BINS) : FILEMODE = 0444 all: $(PROG) $(KSHPROG) $(SUBDIRS) $(PROG): $(OBJS) $(LINK.c) $(OBJS) -o $@ $(LDLIBS) $(POST_PROCESS) $(KSHPROG): $(KSHPROG).ksh $(RM) $@ $(CP) $(KSHPROG).ksh $(@) $(CHMOD) +x $@ %.o: %.c $(COMPILE.c) -o $@ $(CFLAGS_$(MACH)) $< %.o: $(TESTCOMMONDIR)/%.c $(COMPILE.c) -o $@ $(CFLAGS_$(MACH)) $< install: $(SUBDIRS) $(CMDS) $(BINS) lint: lint_SRCS clobber: clean -$(RM) $(PROG) $(KSHPROG) clean: -$(RM) $(OBJS) $(CMDS): $(TESTDIR) $(PROG) $(KSHPROG) $(BINS): $(TESTDIR) $(TESTDIR): $(INS.dir) $(TESTDIR)/%: % $(INS.file) /* * This file and its contents are supplied under the terms of the * Common Development and Distribution License ("CDDL"), version 1.0. * You may only use this file in accordance with the terms of version * 1.0 of the CDDL. * * A full copy of the text of the CDDL should have accompanied this * source. A copy of the CDDL is also available via the Internet at * http://www.illumos.org/license/CDDL. */ /* * Copyright 2020 Tintri by DDN, Inc. All rights reserved. */ /* * Common utilities for libmlrpc tests. */ #include #include #include #include #include #include uchar_t * read_buf_from_file(char *file, uint32_t *size) { struct stat stats; uchar_t *buf; FILE *fp; size_t nread; int rc; errno = 0; rc = stat(file, &stats); if (rc < 0) { fprintf(stderr, "stat failed with rc %d:\n", rc); perror(file); return (NULL); } buf = malloc(stats.st_size); if (buf == NULL) { fprintf(stderr, "couldn't allocate buffer\n"); return (NULL); } errno = 0; fp = fopen(file, "r"); if (fp == NULL) { fprintf(stderr, "fopen failed to open file:\n"); perror(file); free(buf); return (NULL); } errno = 0; nread = fread(buf, 1, stats.st_size, fp); if (nread == EOF && errno != 0) { fprintf(stderr, "fread failed:\n"); perror(file); free(buf); return (NULL); } (void) fclose(fp); if (nread == EOF) { free(buf); buf = NULL; } *size = nread; return (buf); } /* * smb_token_log() outputs to syslog. The library defines syslog to be * smb_syslog, which it defines as NODIRECT to allow fksmbd to provide * its own version. We use that to redirect syslog to stderr, so that * we can print the token output to a useful location. */ void smb_syslog(int pri, const char *fmt, ...) { va_list ap; va_start(ap, fmt); (void) vfprintf(stderr, fmt, ap); va_end(ap); fprintf(stderr, "\n"); } /* * This file and its contents are supplied under the terms of the * Common Development and Distribution License ("CDDL"), version 1.0. * You may only use this file in accordance with the terms of version * 1.0 of the CDDL. * * A full copy of the text of the CDDL should have accompanied this * source. A copy of the CDDL is also available via the Internet at * http://www.illumos.org/license/CDDL. */ /* * Copyright 2020 Tintri by DDN, Inc. All rights reserved. */ #ifndef _UTIL_COMMON_H #define _UTIL_COMMON_H /* * Common utilities for libmlrpc tests. */ #ifdef __cplusplus extern "C" { #endif uchar_t *read_buf_from_file(char *, uint32_t *); void smb_syslog(int, const char *, ...); #ifdef __cplusplus } #endif #endif /* _UTIL_COMMON_H */ # # This file and its contents are supplied under the terms of the # Common Development and Distribution License ("CDDL"), version 1.0. # You may only use this file in accordance with the terms of version # 1.0 of the CDDL. # # A full copy of the text of the CDDL should have accompanied this # source. A copy of the CDDL is also available via the Internet at # http://www.illumos.org/license/CDDL. # # # Copyright 2020 Tintri by DDN, Inc. All Rights Reserved. # .PARALLEL: $(SUBDIRS) SUBDIRS = samlogon_tests krb5_pac_tests include $(SRC)/test/Makefile.com # # This file and its contents are supplied under the terms of the # Common Development and Distribution License ("CDDL"), version 1.0. # You may only use this file in accordance with the terms of version # 1.0 of the CDDL. # # A full copy of the text of the CDDL should have accompanied this # source. A copy of the CDDL is also available via the Internet at # http://www.illumos.org/license/CDDL. # # # Copyright 2020 Tintri by DDN, Inc. All rights reserved. # include $(SRC)/Makefile.master TESTSUBDIR = netrlogon/krb5_pac_tests TESTCOMMONDIR = ../../common PROG = krb5_pac_decode KSHPROG = run_krb5_pac_tests BINFILES = krb5_pac.bin include ../../Makefile.com LDFLAGS += -R/usr/lib/smbsrv # Hammerhead: GNU ld needs rpath-link for transitive deps via libmlsvc: # libmlrpc.so.2 in /usr/lib, libsmbns.so.1 in /usr/lib/smbsrv, mech_krb5.so.1 in /usr/lib/gss LDFLAGS += -Wl,-rpath-link,$(ROOT)/usr/lib -Wl,-rpath-link,$(ROOT)/usr/lib/smbsrv -Wl,-rpath-link,$(ROOT)/usr/lib/gss LDLIBS += -L$(ROOT)/usr/lib/smbsrv LDLIBS += -lmlsvc -lsmb CPPFLAGS += -Dsyslog=smb_syslog # Hammerhead: Suppress incompatible pointer type warning CERRWARN += -Wno-incompatible-pointer-types ̸KK @ !   $(,grps800!;4, ]    l  ~ nt q]  U   t ^N jG  M z2 )` v T r J 7 \    <  ZdN ` f n     n l x p u  Y b m % Q  O w =e E =     E F  $: > ;   $  f -B {t z  -&   [  * a i V 7(  ) * A  `0 w  !G  ~xpz  9 c <  :-   5  0) [  1 @  Z g ?s\ :8 |r  WE7u  Hi . I q e  K   Y  nTk   21 F j o  3 o r   :  >   L  c uk  4U8 k<gS R, R   4 rM "L   a b {G\*6  (/5 Z , I  h  Q% 09 ^  t%  m wp #X; d  3 g | K@ + P V YS 8  vW q *2 v y/ +H    ) < > d /m # + .   / [X 2 |     J J W  m?5 #  8fc  A D 9  &A  3 } 5 H   l(aI &  ?    U y, R _o _ qo  } l  C bi 0  B- " V _ $  @v  s ^ s    6.' S C  ! y ( K    >7 j  {  FT O  ] }   D ; s  k w  M 91=1 =    3 ~  xO X B P  'p   4  6 " + C'!h N? D   6   e  L Q . u h P WIN2012R2-DC1BLUEh#z{0/* * This file and its contents are supplied under the terms of the * Common Development and Distribution License ("CDDL"), version 1.0. * You may only use this file in accordance with the terms of version * 1.0 of the CDDL. * * A full copy of the text of the CDDL should have accompanied this * source. A copy of the CDDL is also available via the Internet at * http://www.illumos.org/license/CDDL. */ /* * Copyright 2020 Tintri by DDN, Inc. All rights reserved. */ /* * Test the ability to decode PAC data from AD Kerberos tickets. */ #include #include #include #include enum KPAC_RC { KPC_SUCCESS = 0, KPC_ARGC, KPC_PAC_FILE, KPC_TOKEN_ALLOC, KPC_DECODE_PAC }; int main(int argc, char *argv[]) { char *pac_file; uchar_t *pac_buf; size_t buflen; smb_token_t *token; uint32_t status; if (argc < 2) { fprintf(stderr, "usage: %s \n", argv[0]); return (-KPC_ARGC); } pac_file = argv[1]; pac_buf = read_buf_from_file(pac_file, &buflen); if (pac_buf == NULL) { fprintf(stderr, "failed to read pac data\n"); return (-KPC_PAC_FILE); } token = calloc(1, sizeof (*token)); if (token == NULL) { fprintf(stderr, "failed to allocate token\n"); return (-KPC_TOKEN_ALLOC); } /* Initialize only those bits on which smb_decode_krb5_pac depends */ (void) smb_lgrp_start(); status = smb_decode_krb5_pac(token, (char *)pac_buf, buflen); if (status != 0) { fprintf(stderr, "smb_decode_krb5_pac failed with 0x%x\n", status); return (-KPC_DECODE_PAC); } smb_token_log(token); return (KPC_SUCCESS); } #!/usr/bin/ksh # # This file and its contents are supplied under the terms of the # Common Development and Distribution License ("CDDL"), version 1.0. # You may only use this file in accordance with the terms of version # 1.0 of the CDDL. # # A full copy of the text of the CDDL should have accompanied this # source. A copy of the CDDL is also available via the Internet at # http://www.illumos.org/license/CDDL. # # # Copyright 2020 Tintri by DDN, Inc. All rights reserved. # if [[ -z $MLRPC_TESTS ]]; then echo "MLRPC_TESTS not set" >&2 exit 1 fi . $MLRPC_TESTS/cfg/krb5_pac.config $MLRPC_TESTS/tests/netrlogon/krb5_pac_tests/krb5_pac_decode $KRB5_PAC_BIN exit $? # # This file and its contents are supplied under the terms of the # Common Development and Distribution License ("CDDL"), version 1.0. # You may only use this file in accordance with the terms of version # 1.0 of the CDDL. # # A full copy of the text of the CDDL should have accompanied this # source. A copy of the CDDL is also available via the Internet at # http://www.illumos.org/license/CDDL. # # # Copyright 2020 Tintri by DDN, Inc. All rights reserved. # include $(SRC)/Makefile.master TESTSUBDIR = netrlogon/samlogon_tests TESTCOMMONDIR = ../../common PROG = samlogon KSHPROG = run_samlogon_tests include ../../Makefile.com LDFLAGS += -R/usr/lib/smbsrv # Hammerhead: GNU ld needs rpath-link for transitive deps via libmlsvc: # libmlrpc.so.2 in /usr/lib, libsmbns.so.1 in /usr/lib/smbsrv, mech_krb5.so.1 in /usr/lib/gss LDFLAGS += -Wl,-rpath-link,$(ROOT)/usr/lib -Wl,-rpath-link,$(ROOT)/usr/lib/smbsrv -Wl,-rpath-link,$(ROOT)/usr/lib/gss LDLIBS += -L$(ROOT)/usr/lib/smbsrv LDLIBS += -lmlsvc -lsmb CPPFLAGS += -Dsyslog=smb_syslog #!/usr/bin/ksh # # This file and its contents are supplied under the terms of the # Common Development and Distribution License ("CDDL"), version 1.0. # You may only use this file in accordance with the terms of version # 1.0 of the CDDL. # # A full copy of the text of the CDDL should have accompanied this # source. A copy of the CDDL is also available via the Internet at # http://www.illumos.org/license/CDDL. # # # Copyright 2020 Tintri by DDN, Inc. All rights reserved. # if [[ -z $MLRPC_TESTS ]]; then echo "MLRPC_TESTS not set" >&2 exit 1 fi . $MLRPC_TESTS/cfg/samlogon.config $MLRPC_TESTS/tests/netrlogon/samlogon_tests/samlogon $NETBIOS_DOMAIN $DC_FQDN \ $USERNAME $CLIENT_COMPUTER $CHALLENGE_FILE $NT_RESPONSE_FILE \ $LM_RESPONSE_FILE exit $? /* * This file and its contents are supplied under the terms of the * Common Development and Distribution License ("CDDL"), version 1.0. * You may only use this file in accordance with the terms of version * 1.0 of the CDDL. * * A full copy of the text of the CDDL should have accompanied this * source. A copy of the CDDL is also available via the Internet at * http://www.illumos.org/license/CDDL. */ /* * Copyright 2020 Tintri by DDN, Inc. All rights reserved. */ /* * Test NetrSamLogon and NetrSamLogonEx, uses for NTLM pass-thru auth. */ #include #include #include #include #include extern void netr_initialize(void); extern uint32_t netlogon_logon(smb_logon_t *, smb_token_t *, smb_domainex_t *); boolean_t compare_tokens(const smb_token_t *src, const smb_token_t *dst) { int i; const smb_ids_t *src_wgrps, *dst_wgrps; smb_id_t *src_grp, *dst_grp; char src_sid[SMB_SID_STRSZ] = "NULL", dst_sid[SMB_SID_STRSZ] = "NULL"; if (strcmp(src->tkn_domain_name, dst->tkn_domain_name) != 0) { fprintf(stderr, "src domain %s does not match dst %s\n", src->tkn_domain_name, dst->tkn_domain_name); return (B_FALSE); } if (strcmp(src->tkn_account_name, dst->tkn_account_name) != 0) { fprintf(stderr, "src account %s does not match dst %s\n", src->tkn_account_name, dst->tkn_account_name); return (B_FALSE); } if (src->tkn_user.i_attrs != dst->tkn_user.i_attrs) { fprintf(stderr, "src attrs 0x%x does not match dst 0x%x\n", src->tkn_user.i_attrs, dst->tkn_user.i_attrs); return (B_FALSE); } if (!smb_sid_cmp(src->tkn_user.i_sid, dst->tkn_user.i_sid)) { smb_sid_tostr(src->tkn_user.i_sid, src_sid); smb_sid_tostr(dst->tkn_user.i_sid, dst_sid); fprintf(stderr, "src usersid %s does not match dst %s\n", src_sid, dst_sid); return (B_FALSE); } /* tkn_owner can be NULL if we haven't called smb_token_setup_common */ if (src->tkn_owner.i_sid != dst->tkn_owner.i_sid && !smb_sid_cmp(src->tkn_owner.i_sid, dst->tkn_owner.i_sid)) { smb_sid_tostr(src->tkn_owner.i_sid, src_sid); smb_sid_tostr(dst->tkn_owner.i_sid, dst_sid); fprintf(stderr, "src ownersid %s does not match dst %s\n", src_sid, dst_sid); return (B_FALSE); } if (!smb_sid_cmp(src->tkn_primary_grp.i_sid, dst->tkn_primary_grp.i_sid)) { smb_sid_tostr(src->tkn_primary_grp.i_sid, src_sid); smb_sid_tostr(dst->tkn_primary_grp.i_sid, dst_sid); fprintf(stderr, "src primarysid %s does not match dst %s\n", src_sid, dst_sid); return (B_FALSE); } src_wgrps = &src->tkn_win_grps; dst_wgrps = &dst->tkn_win_grps; if ((src_wgrps->i_ids == NULL && dst_wgrps->i_ids != NULL) || (src_wgrps->i_ids != NULL && dst_wgrps->i_ids == NULL)) { fprintf(stderr, "src wingrp nullness 0x%p does not match dst 0x%p\n", src_wgrps->i_ids, dst_wgrps->i_ids); return (B_FALSE); } if (src_wgrps->i_ids != NULL) { src_grp = &src_wgrps->i_ids[0]; dst_grp = &dst_wgrps->i_ids[0]; if (src_wgrps->i_cnt != dst_wgrps->i_cnt) { fprintf(stderr, "src wingrp count %d does not match dst %d\n", src_wgrps->i_cnt, dst_wgrps->i_cnt); return (B_FALSE); } for (i = 0; i < src_wgrps->i_cnt; i++, src_grp++, dst_grp++) { if ((src_grp->i_sid == NULL && dst_grp->i_sid != NULL) || (src_grp->i_sid != NULL && dst_grp->i_sid == NULL)) { fprintf(stderr, "src wgrp %d nullness 0x%p does not " "match dst 0x%p\n", i, src_grp->i_sid, dst_grp->i_sid); return (B_FALSE); } if (src_grp->i_sid != NULL && !smb_sid_cmp(src_grp->i_sid, dst_grp->i_sid)) { smb_sid_tostr(src_grp->i_sid, src_sid); smb_sid_tostr(dst_grp->i_sid, dst_sid); fprintf(stderr, "src wingrp %d sid %s " "does not match dst %s\n", i, src_sid, dst_sid); return (B_FALSE); } } } if ((src->tkn_posix_grps == NULL && dst->tkn_posix_grps != NULL) || (src->tkn_posix_grps != NULL && dst->tkn_posix_grps == NULL)) { fprintf(stderr, "src pgrp nullness 0x%p does not match " "dst 0x%p\n", src->tkn_posix_grps, dst->tkn_posix_grps); return (B_FALSE); } if (src->tkn_posix_grps != NULL) { if (src->tkn_posix_grps->pg_ngrps != dst->tkn_posix_grps->pg_ngrps) { fprintf(stderr, "src pgrp count %d does not match dst %d\n", src->tkn_posix_grps->pg_ngrps, dst->tkn_posix_grps->pg_ngrps); return (B_FALSE); } for (i = 0; i < src->tkn_posix_grps->pg_ngrps; i++) { if (src->tkn_posix_grps->pg_grps[i] != dst->tkn_posix_grps->pg_grps[i]) { fprintf(stderr, "src pgrp num %d %d does not match " "dst %d\n", i, src->tkn_posix_grps->pg_grps[i], dst->tkn_posix_grps->pg_grps[i]); return (B_FALSE); } } } return (B_TRUE); } enum SAMLOGON_RC { SL_SUCCESS = 0, SL_ARGC, SL_DC_FQDN, SL_NB_DOMAIN, SL_CHALLENGE, SL_NT_PASS, SL_LM_PASS, SL_TOKEN_ALLOC, SL_NETLOGON, SL_TOKEN_COMP, SL_NETLOGON_LOOP, SL_NETLOGON_SAMLOGON, SL_NETLOGON_NOVERIFY }; int main(int argc, char *argv[]) { smb_logon_t user_info = { .lg_secmode = SMB_SECMODE_DOMAIN, .lg_domain_type = SMB_DOMAIN_PRIMARY, .lg_level = NETR_NETWORK_LOGON }; smb_token_t *token = NULL; smb_token_t cmp_token; smb_domainex_t di = {0}; char *nb_domain, *dc_name, *user_name, *workstation, *chall_file; char *nt_file, *lm_file; uint32_t status; int i; if (argc < 8) { fprintf(stderr, "usage: %s " " " " " " \n", argv[0]); return (-SL_ARGC); } nb_domain = argv[1]; dc_name = argv[2]; user_name = argv[3]; workstation = argv[4]; chall_file = argv[5]; nt_file = argv[6]; lm_file = argv[7]; if (strlcpy(di.d_dci.dc_name, dc_name, sizeof (di.d_dci.dc_name)) >= sizeof (di.d_dci.dc_name)) { fprintf(stderr, "DC FQDN %s is too long\n", dc_name); return (-SL_DC_FQDN); } if (strlcpy(di.d_primary.di_nbname, nb_domain, sizeof (di.d_primary.di_nbname)) >= sizeof (di.d_primary.di_nbname)) { fprintf(stderr, "Netbios Domain %s is too long\n", nb_domain); return (-SL_NB_DOMAIN); } user_info.lg_domain = nb_domain; user_info.lg_e_domain = user_info.lg_domain; user_info.lg_username = user_name; user_info.lg_workstation = workstation; user_info.lg_challenge_key.val = read_buf_from_file(chall_file, &user_info.lg_challenge_key.len); if (user_info.lg_challenge_key.val == NULL) { fprintf(stderr, "failed to get challenge\n"); return (-SL_CHALLENGE); } user_info.lg_nt_password.val = read_buf_from_file(nt_file, &user_info.lg_nt_password.len); if (user_info.lg_nt_password.val == NULL) { fprintf(stderr, "failed to get NT pass\n"); return (-SL_NT_PASS); } user_info.lg_lm_password.val = read_buf_from_file(lm_file, &user_info.lg_lm_password.len); if (user_info.lg_lm_password.val == NULL) { fprintf(stderr, "failed to get LM pass\n"); return (-SL_LM_PASS); } /* Initialize only those bits on which netlogon_logon depends */ (void) smb_lgrp_start(); smb_ipc_init(); netr_initialize(); token = calloc(1, sizeof (*token)); if (token == NULL) { fprintf(stderr, "failed to allocate token\n"); return (-SL_TOKEN_ALLOC); } status = netlogon_logon(&user_info, token, &di); if (status != NT_STATUS_SUCCESS) { fprintf(stderr, "netlogon_logon failed: 0x%x\n", status); return (-SL_NETLOGON); } smb_token_log(token); /* struct copy */ cmp_token = *token; for (i = 0; i < 10; i++) { token = calloc(1, sizeof (*token)); if (token == NULL) { fprintf(stderr, "iter %d: failed to allocate token\n", i); return (-SL_TOKEN_ALLOC); } status = netlogon_logon(&user_info, token, &di); if (status != NT_STATUS_SUCCESS) { fprintf(stderr, "iter %d: netlogon_logon failed: 0x%x\n", i, status); return (-SL_NETLOGON_LOOP); } if (!compare_tokens(&cmp_token, token)) { fprintf(stderr, "iter %d: tokens didn't match\n", i); smb_token_log(token); return (-SL_TOKEN_COMP); } if (i != 9) smb_token_destroy(token); } smb_token_log(token); smb_token_destroy(token); token = calloc(1, sizeof (*token)); if (token == NULL) { fprintf(stderr, "failed to allocate token\n"); return (-SL_TOKEN_ALLOC); } /* Turn off SamLogonEx */ netlogon_init_global(0x00000004); status = netlogon_logon(&user_info, token, &di); if (status != NT_STATUS_SUCCESS) { fprintf(stderr, "NoSamLogonEx: netlogon_logon failed: 0x%x\n", status); return (-SL_NETLOGON_SAMLOGON); } smb_token_log(token); if (!compare_tokens(&cmp_token, token)) { fprintf(stderr, "tokens didn't match\n"); return (-SL_TOKEN_COMP); } smb_token_destroy(token); token = calloc(1, sizeof (*token)); if (token == NULL) { fprintf(stderr, "failed to allocate token\n"); return (-SL_TOKEN_ALLOC); } /* Don't verify responses */ netlogon_init_global(0x00000002); status = netlogon_logon(&user_info, token, &di); if (status != NT_STATUS_SUCCESS) { fprintf(stderr, "NoVerify: netlogon_logon failed: 0x%x\n", status); return (-SL_NETLOGON_NOVERIFY); } smb_token_log(token); if (!compare_tokens(&cmp_token, token)) { fprintf(stderr, "tokens didn't match\n"); return (-SL_TOKEN_COMP); } smb_token_destroy(token); return (SL_SUCCESS); }