?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Move waf into third_party/.
[Samba.git] / source4 / torture / rpc / samsync.c
blobe71faf899a557e74848d19da470678f8caa17ca8
1 /*
2 Unix SMB/CIFS implementation.
3
4 test suite for netlogon rpc operations
5
6 Copyright (C) Andrew Tridgell 2003
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003-2004
8 Copyright (C) Tim Potter 2003
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 */
23
24 #include "includes.h"
25 #include "../lib/util/dlinklist.h"
26 #include "../lib/crypto/crypto.h"
27 #include "system/time.h"
28 #include "torture/rpc/torture_rpc.h"
29 #include "auth/gensec/gensec.h"
30 #include "libcli/auth/libcli_auth.h"
31 #include "libcli/samsync/samsync.h"
32 #include "libcli/security/security.h"
33 #include "librpc/gen_ndr/ndr_netlogon.h"
34 #include "librpc/gen_ndr/ndr_netlogon_c.h"
35 #include "librpc/gen_ndr/ndr_lsa_c.h"
36 #include "librpc/gen_ndr/ndr_samr_c.h"
37 #include "librpc/gen_ndr/ndr_security.h"
38 #include "param/param.h"
39
40 #define TEST_MACHINE_NAME "samsynctest"
41 #define TEST_WKSTA_MACHINE_NAME "samsynctest2"
42 #define TEST_USER_NAME "samsynctestuser"
43
44 /*
45 try a netlogon SamLogon
46 */
47 static NTSTATUS test_SamLogon(struct torture_context *tctx,
48 struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
49 struct netlogon_creds_CredentialState *creds,
50 const char *domain, const char *account_name,
51 const char *workstation,
52 struct samr_Password *lm_hash,
53 struct samr_Password *nt_hash,
54 struct netr_SamInfo3 **info3)
55 {
56 NTSTATUS status;
57 struct netr_LogonSamLogon r;
58 struct netr_Authenticator auth, auth2;
59 struct netr_NetworkInfo ninfo;
60 union netr_LogonLevel logon;
61 union netr_Validation validation;
62 uint8_t authoritative;
63 struct dcerpc_binding_handle *b = p->binding_handle;
64
65 ninfo.identity_info.domain_name.string = domain;
66 ninfo.identity_info.parameter_control = 0;
67 ninfo.identity_info.logon_id_low = 0;
68 ninfo.identity_info.logon_id_high = 0;
69 ninfo.identity_info.account_name.string = account_name;
70 ninfo.identity_info.workstation.string = workstation;
71 generate_random_buffer(ninfo.challenge,
72 sizeof(ninfo.challenge));
73 if (nt_hash) {
74 ninfo.nt.length = 24;
75 ninfo.nt.data = talloc_array(mem_ctx, uint8_t, 24);
76 SMBOWFencrypt(nt_hash->hash, ninfo.challenge, ninfo.nt.data);
77 } else {
78 ninfo.nt.length = 0;
79 ninfo.nt.data = NULL;
80 }
81
82 if (lm_hash) {
83 ninfo.lm.length = 24;
84 ninfo.lm.data = talloc_array(mem_ctx, uint8_t, 24);
85 SMBOWFencrypt(lm_hash->hash, ninfo.challenge, ninfo.lm.data);
86 } else {
87 ninfo.lm.length = 0;
88 ninfo.lm.data = NULL;
89 }
90
91 logon.network = &ninfo;
92
93 r.in.server_name = talloc_asprintf(mem_ctx, "\\\\%s", dcerpc_server_name(p));
94 r.in.computer_name = workstation;
95 r.in.credential = &auth;
96 r.in.return_authenticator = &auth2;
97 r.in.logon_level = NetlogonNetworkInformation;
98 r.in.logon = &logon;
99 r.out.validation = &validation;
100 r.out.authoritative = &authoritative;
101
102 ZERO_STRUCT(auth2);
103 netlogon_creds_client_authenticator(creds, &auth);
104
105 r.in.validation_level = 3;
106
107 status = dcerpc_netr_LogonSamLogon_r(b, mem_ctx, &r);
108 if (!NT_STATUS_IS_OK(status)) {
109 return status;
110 }
111
112 if (!netlogon_creds_client_check(creds, &r.out.return_authenticator->cred)) {
113 torture_comment(tctx, "Credential chaining failed\n");
114 }
115
116 if (info3) {
117 *info3 = validation.sam3;
118 }
119
120 return r.out.result;
121 }
122
123 struct samsync_state {
124 /* we remember the sequence numbers so we can easily do a DatabaseDelta */
125 uint64_t seq_num[3];
126 const char *domain_name[2];
127 struct samsync_secret *secrets;
128 struct samsync_trusted_domain *trusted_domains;
129 struct netlogon_creds_CredentialState *creds;
130 struct netlogon_creds_CredentialState *creds_netlogon_wksta;
131 struct policy_handle *connect_handle;
132 struct policy_handle *domain_handle[2];
133 struct dom_sid *sid[2];
134 struct dcerpc_pipe *p;
135 struct dcerpc_binding_handle *b;
136 struct dcerpc_pipe *p_netlogon_wksta;
137 struct dcerpc_pipe *p_samr;
138 struct dcerpc_binding_handle *b_samr;
139 struct dcerpc_pipe *p_lsa;
140 struct dcerpc_binding_handle *b_lsa;
141 struct policy_handle *lsa_handle;
142 };
143
144 struct samsync_secret {
145 struct samsync_secret *prev, *next;
146 DATA_BLOB secret;
147 const char *name;
148 NTTIME mtime;
149 };
150
151 struct samsync_trusted_domain {
152 struct samsync_trusted_domain *prev, *next;
153 struct dom_sid *sid;
154 const char *name;
155 };
156
157 static struct policy_handle *samsync_open_domain(struct torture_context *tctx,
158 TALLOC_CTX *mem_ctx,
159 struct samsync_state *samsync_state,
160 const char *domain,
161 struct dom_sid **sid_p)
162 {
163 struct lsa_String name;
164 struct samr_OpenDomain o;
165 struct samr_LookupDomain l;
166 struct dom_sid2 *sid = NULL;
167 struct policy_handle *domain_handle = talloc(mem_ctx, struct policy_handle);
168 NTSTATUS nt_status;
169
170 name.string = domain;
171 l.in.connect_handle = samsync_state->connect_handle;
172 l.in.domain_name = &name;
173 l.out.sid = &sid;
174
175 nt_status = dcerpc_samr_LookupDomain_r(samsync_state->b_samr, mem_ctx, &l);
176 if (!NT_STATUS_IS_OK(nt_status)) {
177 torture_comment(tctx, "LookupDomain failed - %s\n", nt_errstr(nt_status));
178 return NULL;
179 }
180 if (!NT_STATUS_IS_OK(l.out.result)) {
181 torture_comment(tctx, "LookupDomain failed - %s\n", nt_errstr(l.out.result));
182 return NULL;
183 }
184
185 o.in.connect_handle = samsync_state->connect_handle;
186 o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
187 o.in.sid = *l.out.sid;
188 o.out.domain_handle = domain_handle;
189
190 if (sid_p) {
191 *sid_p = *l.out.sid;
192 }
193
194 nt_status = dcerpc_samr_OpenDomain_r(samsync_state->b_samr, mem_ctx, &o);
195 if (!NT_STATUS_IS_OK(nt_status)) {
196 torture_comment(tctx, "OpenDomain failed - %s\n", nt_errstr(nt_status));
197 return NULL;
198 }
199 if (!NT_STATUS_IS_OK(o.out.result)) {
200 torture_comment(tctx, "OpenDomain failed - %s\n", nt_errstr(o.out.result));
201 return NULL;
202 }
203
204 return domain_handle;
205 }
206
207 static struct sec_desc_buf *samsync_query_samr_sec_desc(struct torture_context *tctx,
208 TALLOC_CTX *mem_ctx,
209 struct samsync_state *samsync_state,
210 struct policy_handle *handle)
211 {
212 struct samr_QuerySecurity r;
213 struct sec_desc_buf *sdbuf = NULL;
214 NTSTATUS status;
215
216 r.in.handle = handle;
217 r.in.sec_info = 0x7;
218 r.out.sdbuf = &sdbuf;
219
220 status = dcerpc_samr_QuerySecurity_r(samsync_state->b_samr, mem_ctx, &r);
221 if (!NT_STATUS_IS_OK(status)) {
222 torture_comment(tctx, "SAMR QuerySecurity failed - %s\n", nt_errstr(status));
223 return NULL;
224 }
225 if (!NT_STATUS_IS_OK(r.out.result)) {
226 torture_comment(tctx, "SAMR QuerySecurity failed - %s\n", nt_errstr(r.out.result));
227 return NULL;
228 }
229
230 return sdbuf;
231 }
232
233 static struct sec_desc_buf *samsync_query_lsa_sec_desc(struct torture_context *tctx,
234 TALLOC_CTX *mem_ctx,
235 struct samsync_state *samsync_state,
236 struct policy_handle *handle)
237 {
238 struct lsa_QuerySecurity r;
239 struct sec_desc_buf *sdbuf = NULL;
240 NTSTATUS status;
241
242 r.in.handle = handle;
243 r.in.sec_info = 0x7;
244 r.out.sdbuf = &sdbuf;
245
246 status = dcerpc_lsa_QuerySecurity_r(samsync_state->b_lsa, mem_ctx, &r);
247 if (!NT_STATUS_IS_OK(status)) {
248 torture_comment(tctx, "LSA QuerySecurity failed - %s\n", nt_errstr(status));
249 return NULL;
250 }
251 if (!NT_STATUS_IS_OK(r.out.result)) {
252 torture_comment(tctx, "LSA QuerySecurity failed - %s\n", nt_errstr(r.out.result));
253 return NULL;
254 }
255
256 return sdbuf;
257 }
258
259 #define TEST_UINT64_EQUAL(i1, i2) do {\
260 if (i1 != i2) {\
261 torture_comment(tctx, "%s: uint64 mismatch: " #i1 ": 0x%016llx (%lld) != " #i2 ": 0x%016llx (%lld)\n", \
262 __location__, \
263 (long long)i1, (long long)i1, \
264 (long long)i2, (long long)i2);\
265 ret = false;\
266 } \
267 } while (0)
268 #define TEST_INT_EQUAL(i1, i2) do {\
269 if (i1 != i2) {\
270 torture_comment(tctx, "%s: integer mismatch: " #i1 ": 0x%08x (%d) != " #i2 ": 0x%08x (%d)\n", \
271 __location__, i1, i1, i2, i2); \
272 ret = false;\
273 } \
274 } while (0)
275 #define TEST_TIME_EQUAL(t1, t2) do {\
276 if (t1 != t2) {\
277 torture_comment(tctx, "%s: NTTIME mismatch: " #t1 ":%s != " #t2 ": %s\n", \
278 __location__, nt_time_string(mem_ctx, t1), nt_time_string(mem_ctx, t2));\
279 ret = false;\
280 } \
281 } while (0)
282
283 #define TEST_STRING_EQUAL(s1, s2) do {\
284 if (!((!s1.string || s1.string[0]=='\0') && (!s2.string || s2.string[0]=='\0')) \
285 && strcmp_safe(s1.string, s2.string) != 0) {\
286 torture_comment(tctx, "%s: string mismatch: " #s1 ":%s != " #s2 ": %s\n", \
287 __location__, s1.string, s2.string);\
288 ret = false;\
289 } \
290 } while (0)
291
292 #define TEST_BINARY_STRING_EQUAL(s1, s2) do {\
293 if (!((!s1.array || s1.array[0]=='\0') && (!s2.array || s2.array[0]=='\0')) \
294 && memcmp(s1.array, s2.array, s1.length * 2) != 0) {\
295 torture_comment(tctx, "%s: string mismatch: " #s1 ":%s != " #s2 ": %s\n", \
296 __location__, (const char *)s1.array, (const char *)s2.array);\
297 ret = false;\
298 } \
299 } while (0)
300
301 #define TEST_SID_EQUAL(s1, s2) do {\
302 if (!dom_sid_equal(s1, s2)) {\
303 torture_comment(tctx, "%s: dom_sid mismatch: " #s1 ":%s != " #s2 ": %s\n", \
304 __location__, dom_sid_string(mem_ctx, s1), dom_sid_string(mem_ctx, s2));\
305 ret = false;\
306 } \
307 } while (0)
308
309 /* The ~SEC_DESC_SACL_PRESENT is because we don't, as administrator,
310 * get back the SACL part of the SD when we ask over SAMR */
311
312 #define TEST_SEC_DESC_EQUAL(sd1, pipe, handle) do {\
313 struct sec_desc_buf *sdbuf = samsync_query_ ##pipe## _sec_desc(tctx, mem_ctx, samsync_state, \
314 handle); \
315 if (!sdbuf || !sdbuf->sd) { \
316 torture_comment(tctx, "Could not obtain security descriptor to match " #sd1 "\n");\
317 ret = false; \
318 } else {\
319 if (!security_descriptor_mask_equal(sd1.sd, sdbuf->sd, \
320 ~SEC_DESC_SACL_PRESENT)) {\
321 torture_comment(tctx, "Security Descriptor Mismatch for %s:\n", #sd1);\
322 ndr_print_debug((ndr_print_fn_t)ndr_print_security_descriptor, "SamSync", sd1.sd);\
323 ndr_print_debug((ndr_print_fn_t)ndr_print_security_descriptor, "SamR", sdbuf->sd);\
324 ret = false;\
325 }\
326 }\
327 } while (0)
328
329 static bool samsync_handle_domain(struct torture_context *tctx, TALLOC_CTX *mem_ctx, struct samsync_state *samsync_state,
330 int database_id, struct netr_DELTA_ENUM *delta)
331 {
332 struct netr_DELTA_DOMAIN *domain = delta->delta_union.domain;
333 struct dom_sid *dom_sid;
334 struct samr_QueryDomainInfo q[14]; /* q[0] will be unused simple for clarity */
335 union samr_DomainInfo *info[14];
336 uint16_t levels[] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 11, 12, 13};
337 int i;
338 bool ret = true;
339
340 samsync_state->seq_num[database_id] =
341 domain->sequence_num;
342 switch (database_id) {
343 case SAM_DATABASE_DOMAIN:
344 break;
345 case SAM_DATABASE_BUILTIN:
346 if (strcasecmp_m("BUILTIN", domain->domain_name.string) != 0) {
347 torture_comment(tctx, "BUILTIN domain has different name: %s\n", domain->domain_name.string);
348 }
349 break;
350 case SAM_DATABASE_PRIVS:
351 torture_comment(tctx, "DOMAIN entry on privs DB!\n");
352 return false;
353 break;
354 }
355
356 if (!samsync_state->domain_name[database_id]) {
357 samsync_state->domain_name[database_id] =
358 talloc_strdup(samsync_state, domain->domain_name.string);
359 } else {
360 if (strcasecmp_m(samsync_state->domain_name[database_id], domain->domain_name.string) != 0) {
361 torture_comment(tctx, "Domain has name varies!: %s != %s\n", samsync_state->domain_name[database_id],
362 domain->domain_name.string);
363 return false;
364 }
365 }
366
367 if (!samsync_state->domain_handle[database_id]) {
368 samsync_state->domain_handle[database_id] =
369 samsync_open_domain(tctx,
370 samsync_state,
371 samsync_state,
372 samsync_state->domain_name[database_id],
373 &dom_sid);
374 }
375 if (samsync_state->domain_handle[database_id]) {
376 samsync_state->sid[database_id] = dom_sid_dup(samsync_state, dom_sid);
377 }
378
379 torture_comment(tctx, "\tsequence_nums[%d/%s]=%llu\n",
380 database_id, domain->domain_name.string,
381 (long long)samsync_state->seq_num[database_id]);
382
383 for (i=0;i<ARRAY_SIZE(levels);i++) {
384
385 q[levels[i]].in.domain_handle = samsync_state->domain_handle[database_id];
386 q[levels[i]].in.level = levels[i];
387 q[levels[i]].out.info = &info[levels[i]];
388
389 torture_assert_ntstatus_ok(tctx,
390 dcerpc_samr_QueryDomainInfo_r(samsync_state->b_samr, mem_ctx, &q[levels[i]]),
391 talloc_asprintf(tctx, "QueryDomainInfo level %u failed", q[levels[i]].in.level));
392 torture_assert_ntstatus_ok(tctx, q[levels[i]].out.result,
393 talloc_asprintf(tctx, "QueryDomainInfo level %u failed", q[levels[i]].in.level));
394 }
395
396 TEST_STRING_EQUAL(info[5]->info5.domain_name, domain->domain_name);
397
398 TEST_STRING_EQUAL(info[2]->general.oem_information, domain->oem_information);
399 TEST_STRING_EQUAL(info[4]->oem.oem_information, domain->oem_information);
400 TEST_TIME_EQUAL(info[2]->general.force_logoff_time, domain->force_logoff_time);
401 TEST_TIME_EQUAL(info[3]->info3.force_logoff_time, domain->force_logoff_time);
402
403 TEST_TIME_EQUAL(info[1]->info1.min_password_length, domain->min_password_length);
404 TEST_TIME_EQUAL(info[1]->info1.password_history_length, domain->password_history_length);
405 TEST_TIME_EQUAL(info[1]->info1.max_password_age, domain->max_password_age);
406 TEST_TIME_EQUAL(info[1]->info1.min_password_age, domain->min_password_age);
407
408 TEST_UINT64_EQUAL(info[8]->info8.sequence_num,
409 domain->sequence_num);
410 TEST_TIME_EQUAL(info[8]->info8.domain_create_time,
411 domain->domain_create_time);
412 TEST_TIME_EQUAL(info[13]->info13.domain_create_time,
413 domain->domain_create_time);
414
415 TEST_SEC_DESC_EQUAL(domain->sdbuf, samr, samsync_state->domain_handle[database_id]);
416
417 return ret;
418 }
419
420 static bool samsync_handle_policy(struct torture_context *tctx,
421 TALLOC_CTX *mem_ctx, struct samsync_state *samsync_state,
422 int database_id, struct netr_DELTA_ENUM *delta)
423 {
424 struct netr_DELTA_POLICY *policy = delta->delta_union.policy;
425
426 switch (database_id) {
427 case SAM_DATABASE_DOMAIN:
428 case SAM_DATABASE_BUILTIN:
429 break;
430 case SAM_DATABASE_PRIVS:
431 torture_comment(tctx, "DOMAIN entry on privs DB!\n");
432 return false;
433 }
434
435 samsync_state->seq_num[database_id] =
436 policy->sequence_num;
437
438 if (!samsync_state->domain_name[SAM_DATABASE_DOMAIN]) {
439 samsync_state->domain_name[SAM_DATABASE_DOMAIN] =
440 talloc_strdup(samsync_state, policy->primary_domain_name.string);
441 } else {
442 if (strcasecmp_m(samsync_state->domain_name[SAM_DATABASE_DOMAIN], policy->primary_domain_name.string) != 0) {
443 torture_comment(tctx, "PRIMARY domain has name varies between DOMAIN and POLICY!: %s != %s\n", samsync_state->domain_name[SAM_DATABASE_DOMAIN],
444 policy->primary_domain_name.string);
445 return false;
446 }
447 }
448
449 if (!dom_sid_equal(samsync_state->sid[SAM_DATABASE_DOMAIN], policy->sid)) {
450 torture_comment(tctx, "Domain SID from POLICY (%s) does not match domain sid from SAMR (%s)\n",
451 dom_sid_string(mem_ctx, policy->sid), dom_sid_string(mem_ctx, samsync_state->sid[SAM_DATABASE_DOMAIN]));
452 return false;
453 }
454
455 torture_comment(tctx, "\tsequence_nums[%d/PRIVS]=%llu\n",
456 database_id,
457 (long long)samsync_state->seq_num[database_id]);
458 return true;
459 }
460
461 static bool samsync_handle_user(struct torture_context *tctx, TALLOC_CTX *mem_ctx, struct samsync_state *samsync_state,
462 int database_id, struct netr_DELTA_ENUM *delta)
463 {
464 uint32_t rid = delta->delta_id_union.rid;
465 struct netr_DELTA_USER *user = delta->delta_union.user;
466 struct netr_SamInfo3 *info3 = NULL;
467 struct samr_Password lm_hash;
468 struct samr_Password nt_hash;
469 struct samr_Password *lm_hash_p = NULL;
470 struct samr_Password *nt_hash_p = NULL;
471 const char *domain;
472 const char *username = user->account_name.string;
473 NTSTATUS nt_status;
474 bool ret = true;
475 struct samr_OpenUser r;
476 struct samr_QueryUserInfo q;
477 union samr_UserInfo *info;
478 struct policy_handle user_handle;
479 struct samr_GetGroupsForUser getgr;
480 struct samr_RidWithAttributeArray *rids;
481
482 switch (database_id) {
483 case SAM_DATABASE_DOMAIN:
484 case SAM_DATABASE_BUILTIN:
485 break;
486 case SAM_DATABASE_PRIVS:
487 torture_comment(tctx, "DOMAIN entry on privs DB!\n");
488 return false;
489 }
490
491 domain = samsync_state->domain_name[database_id];
492
493 if (domain == NULL ||
494 samsync_state->domain_handle[database_id] == NULL) {
495 torture_comment(tctx, "SamSync needs domain information before the users\n");
496 return false;
497 }
498
499 r.in.domain_handle = samsync_state->domain_handle[database_id];
500 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
501 r.in.rid = rid;
502 r.out.user_handle = &user_handle;
503
504 torture_assert_ntstatus_ok(tctx,
505 dcerpc_samr_OpenUser_r(samsync_state->b_samr, mem_ctx, &r),
506 talloc_asprintf(tctx, "OpenUser(%u) failed", rid));
507 torture_assert_ntstatus_ok(tctx, r.out.result,
508 talloc_asprintf(tctx, "OpenUser(%u) failed", rid));
509
510 q.in.user_handle = &user_handle;
511 q.in.level = 21;
512 q.out.info = &info;
513
514 TEST_SEC_DESC_EQUAL(user->sdbuf, samr, &user_handle);
515
516 torture_assert_ntstatus_ok(tctx,
517 dcerpc_samr_QueryUserInfo_r(samsync_state->b_samr, mem_ctx, &q),
518 talloc_asprintf(tctx, "OpenUserInfo level %u failed", q.in.level));
519 torture_assert_ntstatus_ok(tctx, q.out.result,
520 talloc_asprintf(tctx, "OpenUserInfo level %u failed", q.in.level));
521
522 getgr.in.user_handle = &user_handle;
523 getgr.out.rids = &rids;
524
525 torture_assert_ntstatus_ok(tctx,
526 dcerpc_samr_GetGroupsForUser_r(samsync_state->b_samr, mem_ctx, &getgr),
527 "GetGroupsForUser failed");
528 torture_assert_ntstatus_ok(tctx, getgr.out.result,
529 "GetGroupsForUser failed");
530
531 if (!test_samr_handle_Close(samsync_state->b_samr, tctx, &user_handle)) {
532 torture_comment(tctx, "samr_handle_Close failed\n");
533 ret = false;
534 }
535 if (!ret) {
536 return false;
537 }
538
539 TEST_STRING_EQUAL(info->info21.account_name, user->account_name);
540 TEST_STRING_EQUAL(info->info21.full_name, user->full_name);
541 TEST_INT_EQUAL(info->info21.rid, user->rid);
542 TEST_INT_EQUAL(info->info21.primary_gid, user->primary_gid);
543 TEST_STRING_EQUAL(info->info21.home_directory, user->home_directory);
544 TEST_STRING_EQUAL(info->info21.home_drive, user->home_drive);
545 TEST_STRING_EQUAL(info->info21.logon_script, user->logon_script);
546 TEST_STRING_EQUAL(info->info21.description, user->description);
547 TEST_STRING_EQUAL(info->info21.workstations, user->workstations);
548
549 TEST_TIME_EQUAL(info->info21.last_logon, user->last_logon);
550 TEST_TIME_EQUAL(info->info21.last_logoff, user->last_logoff);
551
552
553 TEST_INT_EQUAL(info->info21.logon_hours.units_per_week,
554 user->logon_hours.units_per_week);
555 if (ret) {
556 if (memcmp(info->info21.logon_hours.bits, user->logon_hours.bits,
557 info->info21.logon_hours.units_per_week/8) != 0) {
558 torture_comment(tctx, "Logon hours mismatch\n");
559 ret = false;
560 }
561 }
562
563 TEST_INT_EQUAL(info->info21.bad_password_count,
564 user->bad_password_count);
565 TEST_INT_EQUAL(info->info21.logon_count,
566 user->logon_count);
567
568 TEST_TIME_EQUAL(info->info21.last_password_change,
569 user->last_password_change);
570 TEST_TIME_EQUAL(info->info21.acct_expiry,
571 user->acct_expiry);
572
573 TEST_INT_EQUAL((info->info21.acct_flags & ~ACB_PW_EXPIRED), user->acct_flags);
574 if (user->acct_flags & ACB_PWNOEXP) {
575 if (info->info21.acct_flags & ACB_PW_EXPIRED) {
576 torture_comment(tctx, "ACB flags mismatch: both expired and no expiry!\n");
577 ret = false;
578 }
579 if (info->info21.force_password_change != (NTTIME)0x7FFFFFFFFFFFFFFFULL) {
580 torture_comment(tctx, "ACB flags mismatch: no password expiry, but force password change 0x%016llx (%lld) != 0x%016llx (%lld)\n",
581 (unsigned long long)info->info21.force_password_change,
582 (unsigned long long)info->info21.force_password_change,
583 (unsigned long long)0x7FFFFFFFFFFFFFFFULL, (unsigned long long)0x7FFFFFFFFFFFFFFFULL
584 );
585 ret = false;
586 }
587 }
588
589 TEST_INT_EQUAL(info->info21.nt_password_set, user->nt_password_present);
590 TEST_INT_EQUAL(info->info21.lm_password_set, user->lm_password_present);
591 TEST_INT_EQUAL(info->info21.password_expired, user->password_expired);
592
593 TEST_STRING_EQUAL(info->info21.comment, user->comment);
594 TEST_BINARY_STRING_EQUAL(info->info21.parameters, user->parameters);
595
596 TEST_INT_EQUAL(info->info21.country_code, user->country_code);
597 TEST_INT_EQUAL(info->info21.code_page, user->code_page);
598
599 TEST_STRING_EQUAL(info->info21.profile_path, user->profile_path);
600
601 if (user->lm_password_present) {
602 lm_hash_p = &lm_hash;
603 }
604 if (user->nt_password_present) {
605 nt_hash_p = &nt_hash;
606 }
607
608 if (user->user_private_info.SensitiveData) {
609 DATA_BLOB data;
610 struct netr_USER_KEYS keys;
611 enum ndr_err_code ndr_err;
612 data.data = user->user_private_info.SensitiveData;
613 data.length = user->user_private_info.DataLength;
614 ndr_err = ndr_pull_struct_blob(&data, mem_ctx, &keys, (ndr_pull_flags_fn_t)ndr_pull_netr_USER_KEYS);
615 if (NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
616 if (keys.keys.keys2.lmpassword.length == 16) {
617 lm_hash_p = &lm_hash;
618 }
619 if (keys.keys.keys2.ntpassword.length == 16) {
620 nt_hash_p = &nt_hash;
621 }
622 } else {
623 torture_comment(tctx, "Failed to parse Sensitive Data for %s:\n", username);
624 #if 0
625 dump_data(0, data.data, data.length);
626 #endif
627 return false;
628 }
629 }
630
631 if (nt_hash_p) {
632 DATA_BLOB nt_hash_blob = data_blob_const(nt_hash_p, 16);
633 DEBUG(100,("ACCOUNT [%s\\%-25s] NTHASH %s\n", samsync_state->domain_name[0], username, data_blob_hex_string_upper(mem_ctx, &nt_hash_blob)));
634 }
635 if (lm_hash_p) {
636 DATA_BLOB lm_hash_blob = data_blob_const(lm_hash_p, 16);
637 DEBUG(100,("ACCOUNT [%s\\%-25s] LMHASH %s\n", samsync_state->domain_name[0], username, data_blob_hex_string_upper(mem_ctx, &lm_hash_blob)));
638 }
639
640 nt_status = test_SamLogon(tctx,
641 samsync_state->p_netlogon_wksta, mem_ctx, samsync_state->creds_netlogon_wksta,
642 domain,
643 username,
644 TEST_WKSTA_MACHINE_NAME,
645 lm_hash_p,
646 nt_hash_p,
647 &info3);
648
649 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_ACCOUNT_DISABLED)) {
650 if (user->acct_flags & ACB_DISABLED) {
651 return true;
652 }
653 } else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT)) {
654 if (user->acct_flags & ACB_WSTRUST) {
655 return true;
656 }
657 } else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT)) {
658 if (user->acct_flags & ACB_SVRTRUST) {
659 return true;
660 }
661 } else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT)) {
662 if (user->acct_flags & ACB_DOMTRUST) {
663 return true;
664 }
665 } else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT)) {
666 if (user->acct_flags & ACB_DOMTRUST) {
667 return true;
668 }
669 } else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_ACCOUNT_LOCKED_OUT)) {
670 if (user->acct_flags & ACB_AUTOLOCK) {
671 return true;
672 }
673 } else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_PASSWORD_EXPIRED)) {
674 if (info->info21.acct_flags & ACB_PW_EXPIRED) {
675 return true;
676 }
677 } else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_WRONG_PASSWORD)) {
678 if (!lm_hash_p && !nt_hash_p) {
679 return true;
680 }
681 } else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_PASSWORD_MUST_CHANGE)) {
682 /* We would need to know the server's current time to test this properly */
683 return true;
684 } else if (NT_STATUS_IS_OK(nt_status)) {
685 TEST_INT_EQUAL(user->rid, info3->base.rid);
686 TEST_INT_EQUAL(user->primary_gid, info3->base.primary_gid);
687 /* this is 0x0 from NT4 sp6 */
688 if (info3->base.acct_flags) {
689 TEST_INT_EQUAL(user->acct_flags, info3->base.acct_flags);
690 }
691 /* this is NULL from NT4 sp6 */
692 if (info3->base.account_name.string) {
693 TEST_STRING_EQUAL(user->account_name, info3->base.account_name);
694 }
695 /* this is NULL from Win2k3 */
696 if (info3->base.full_name.string) {
697 TEST_STRING_EQUAL(user->full_name, info3->base.full_name);
698 }
699 TEST_STRING_EQUAL(user->logon_script, info3->base.logon_script);
700 TEST_STRING_EQUAL(user->profile_path, info3->base.profile_path);
701 TEST_STRING_EQUAL(user->home_directory, info3->base.home_directory);
702 TEST_STRING_EQUAL(user->home_drive, info3->base.home_drive);
703 TEST_STRING_EQUAL(user->logon_script, info3->base.logon_script);
704
705
706 TEST_TIME_EQUAL(user->last_logon, info3->base.logon_time);
707 TEST_TIME_EQUAL(user->acct_expiry, info3->base.kickoff_time);
708 TEST_TIME_EQUAL(user->last_password_change, info3->base.last_password_change);
709 TEST_TIME_EQUAL(info->info21.force_password_change, info3->base.force_password_change);
710
711 /* Does the concept of a logoff time ever really
712 * exist? (not in any sensible way, according to the
713 * doco I read -- abartlet) */
714
715 /* This copes with the two different versions of 0 I see */
716 /* with NT4 sp6 we have the || case */
717 if (!((user->last_logoff == 0)
718 || (info3->base.logoff_time == 0x7fffffffffffffffLL))) {
719 TEST_TIME_EQUAL(user->last_logoff, info3->base.logoff_time);
720 }
721
722 TEST_INT_EQUAL(rids->count, info3->base.groups.count);
723 if (rids->count == info3->base.groups.count) {
724 int i, j;
725 int count = rids->count;
726 bool *matched = talloc_zero_array(mem_ctx, bool, rids->count);
727
728 for (i = 0; i < count; i++) {
729 for (j = 0; j < count; j++) {
730 if ((rids->rids[i].rid ==
731 info3->base.groups.rids[j].rid)
732 && (rids->rids[i].attributes ==
733 info3->base.groups.rids[j].attributes)) {
734 matched[i] = true;
735 }
736 }
737 }
738
739 for (i = 0; i < rids->count; i++) {
740 if (matched[i] == false) {
741 ret = false;
742 torture_comment(tctx, "Could not find group RID %u found in getgroups in NETLOGON reply\n",
743 rids->rids[i].rid);
744 }
745 }
746 }
747 return ret;
748 } else {
749 torture_comment(tctx, "Could not validate password for user %s\\%s: %s\n",
750 domain, username, nt_errstr(nt_status));
751 return false;
752 }
753 return false;
754 }
755
756 static bool samsync_handle_alias(struct torture_context *tctx,
757 TALLOC_CTX *mem_ctx, struct samsync_state *samsync_state,
758 int database_id, struct netr_DELTA_ENUM *delta)
759 {
760 uint32_t rid = delta->delta_id_union.rid;
761 struct netr_DELTA_ALIAS *alias = delta->delta_union.alias;
762 bool ret = true;
763
764 struct samr_OpenAlias r;
765 struct samr_QueryAliasInfo q;
766 union samr_AliasInfo *info;
767 struct policy_handle alias_handle;
768
769 switch (database_id) {
770 case SAM_DATABASE_DOMAIN:
771 case SAM_DATABASE_BUILTIN:
772 break;
773 case SAM_DATABASE_PRIVS:
774 torture_comment(tctx, "DOMAIN entry on privs DB!\n");
775 return false;
776 }
777
778 if (samsync_state->domain_name[database_id] == NULL ||
779 samsync_state->domain_handle[database_id] == NULL) {
780 torture_comment(tctx, "SamSync needs domain information before the users\n");
781 return false;
782 }
783
784 r.in.domain_handle = samsync_state->domain_handle[database_id];
785 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
786 r.in.rid = rid;
787 r.out.alias_handle = &alias_handle;
788
789 torture_assert_ntstatus_ok(tctx,
790 dcerpc_samr_OpenAlias_r(samsync_state->b_samr, mem_ctx, &r),
791 talloc_asprintf(tctx, "OpenUser(%u) failed", rid));
792 torture_assert_ntstatus_ok(tctx, r.out.result,
793 talloc_asprintf(tctx, "OpenUser(%u) failed", rid));
794
795 q.in.alias_handle = &alias_handle;
796 q.in.level = 1;
797 q.out.info = &info;
798
799 TEST_SEC_DESC_EQUAL(alias->sdbuf, samr, &alias_handle);
800
801 torture_assert_ntstatus_ok(tctx,
802 dcerpc_samr_QueryAliasInfo_r(samsync_state->b_samr, mem_ctx, &q),
803 "QueryAliasInfo failed");
804 if (!test_samr_handle_Close(samsync_state->b_samr, tctx, &alias_handle)) {
805 return false;
806 }
807
808 if (!NT_STATUS_IS_OK(q.out.result)) {
809 torture_comment(tctx, "QueryAliasInfo level %u failed - %s\n",
810 q.in.level, nt_errstr(q.out.result));
811 return false;
812 }
813
814 TEST_STRING_EQUAL(info->all.name, alias->alias_name);
815 TEST_STRING_EQUAL(info->all.description, alias->description);
816 return ret;
817 }
818
819 static bool samsync_handle_group(struct torture_context *tctx,
820 TALLOC_CTX *mem_ctx, struct samsync_state *samsync_state,
821 int database_id, struct netr_DELTA_ENUM *delta)
822 {
823 uint32_t rid = delta->delta_id_union.rid;
824 struct netr_DELTA_GROUP *group = delta->delta_union.group;
825 bool ret = true;
826
827 struct samr_OpenGroup r;
828 struct samr_QueryGroupInfo q;
829 union samr_GroupInfo *info;
830 struct policy_handle group_handle;
831
832 switch (database_id) {
833 case SAM_DATABASE_DOMAIN:
834 case SAM_DATABASE_BUILTIN:
835 break;
836 case SAM_DATABASE_PRIVS:
837 torture_comment(tctx, "DOMAIN entry on privs DB!\n");
838 return false;
839 }
840
841 if (samsync_state->domain_name[database_id] == NULL ||
842 samsync_state->domain_handle[database_id] == NULL) {
843 torture_comment(tctx, "SamSync needs domain information before the users\n");
844 return false;
845 }
846
847 r.in.domain_handle = samsync_state->domain_handle[database_id];
848 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
849 r.in.rid = rid;
850 r.out.group_handle = &group_handle;
851
852 torture_assert_ntstatus_ok(tctx,
853 dcerpc_samr_OpenGroup_r(samsync_state->b_samr, mem_ctx, &r),
854 talloc_asprintf(tctx, "OpenUser(%u) failed", rid));
855 torture_assert_ntstatus_ok(tctx, r.out.result,
856 talloc_asprintf(tctx, "OpenUser(%u) failed", rid));
857
858 q.in.group_handle = &group_handle;
859 q.in.level = 1;
860 q.out.info = &info;
861
862 TEST_SEC_DESC_EQUAL(group->sdbuf, samr, &group_handle);
863
864 torture_assert_ntstatus_ok(tctx,
865 dcerpc_samr_QueryGroupInfo_r(samsync_state->b_samr, mem_ctx, &q),
866 "QueryGroupInfo failed");
867 if (!test_samr_handle_Close(samsync_state->b_samr, tctx, &group_handle)) {
868 return false;
869 }
870
871 if (!NT_STATUS_IS_OK(q.out.result)) {
872 torture_comment(tctx, "QueryGroupInfo level %u failed - %s\n",
873 q.in.level, nt_errstr(q.out.result));
874 return false;
875 }
876
877 TEST_STRING_EQUAL(info->all.name, group->group_name);
878 TEST_INT_EQUAL(info->all.attributes, group->attributes);
879 TEST_STRING_EQUAL(info->all.description, group->description);
880 return ret;
881 }
882
883 static bool samsync_handle_secret(struct torture_context *tctx,
884 TALLOC_CTX *mem_ctx, struct samsync_state *samsync_state,
885 int database_id, struct netr_DELTA_ENUM *delta)
886 {
887 struct netr_DELTA_SECRET *secret = delta->delta_union.secret;
888 const char *name = delta->delta_id_union.name;
889 struct samsync_secret *nsec = talloc(samsync_state, struct samsync_secret);
890 struct samsync_secret *old = talloc(mem_ctx, struct samsync_secret);
891 struct lsa_QuerySecret q;
892 struct lsa_OpenSecret o;
893 struct policy_handle sec_handle;
894 struct lsa_DATA_BUF_PTR bufp1;
895 struct lsa_DATA_BUF_PTR bufp2;
896 NTTIME nsec_mtime;
897 NTTIME old_mtime;
898 bool ret = true;
899 DATA_BLOB lsa_blob1, lsa_blob_out, session_key;
900 NTSTATUS status;
901
902 nsec->name = talloc_strdup(nsec, name);
903 nsec->secret = data_blob_talloc(nsec, secret->current_cipher.cipher_data, secret->current_cipher.maxlen);
904 nsec->mtime = secret->current_cipher_set_time;
905
906 DLIST_ADD(samsync_state->secrets, nsec);
907
908 old->name = talloc_strdup(old, name);
909 old->secret = data_blob_const(secret->old_cipher.cipher_data, secret->old_cipher.maxlen);
910 old->mtime = secret->old_cipher_set_time;
911
912 o.in.handle = samsync_state->lsa_handle;
913 o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
914 o.in.name.string = name;
915 o.out.sec_handle = &sec_handle;
916
917 torture_assert_ntstatus_ok(tctx,
918 dcerpc_lsa_OpenSecret_r(samsync_state->b_lsa, mem_ctx, &o),
919 "OpenSecret failed");
920 torture_assert_ntstatus_ok(tctx, o.out.result,
921 "OpenSecret failed");
922
923 /*
924 We would like to do this, but it is NOT_SUPPORTED on win2k3
925 TEST_SEC_DESC_EQUAL(secret->sdbuf, lsa, &sec_handle);
926 */
927 status = dcerpc_fetch_session_key(samsync_state->p_lsa, &session_key);
928 if (!NT_STATUS_IS_OK(status)) {
929 torture_comment(tctx, "dcerpc_fetch_session_key failed - %s\n", nt_errstr(status));
930 return false;
931 }
932
933
934 ZERO_STRUCT(nsec_mtime);
935 ZERO_STRUCT(old_mtime);
936
937 /* fetch the secret back again */
938 q.in.sec_handle = &sec_handle;
939 q.in.new_val = &bufp1;
940 q.in.new_mtime = &nsec_mtime;
941 q.in.old_val = &bufp2;
942 q.in.old_mtime = &old_mtime;
943
944 bufp1.buf = NULL;
945 bufp2.buf = NULL;
946
947 torture_assert_ntstatus_ok(tctx,
948 dcerpc_lsa_QuerySecret_r(samsync_state->b_lsa, mem_ctx, &q),
949 "QuerySecret failed");
950 if (NT_STATUS_EQUAL(NT_STATUS_ACCESS_DENIED, q.out.result)) {
951 /* some things are just off limits */
952 return true;
953 } else if (!NT_STATUS_IS_OK(q.out.result)) {
954 torture_comment(tctx, "QuerySecret failed - %s\n", nt_errstr(q.out.result));
955 return false;
956 }
957
958 if (q.out.old_val->buf == NULL) {
959 /* probably just not available due to ACLs */
960 } else {
961 lsa_blob1.data = q.out.old_val->buf->data;
962 lsa_blob1.length = q.out.old_val->buf->length;
963
964 status = sess_decrypt_blob(mem_ctx, &lsa_blob1, &session_key, &lsa_blob_out);
965 if (!NT_STATUS_IS_OK(status)) {
966 torture_comment(tctx, "Failed to decrypt secrets OLD blob: %s\n", nt_errstr(status));
967 return false;
968 }
969
970 if (!q.out.old_mtime) {
971 torture_comment(tctx, "OLD mtime not available on LSA for secret %s\n", old->name);
972 ret = false;
973 }
974 if (old->mtime != *q.out.old_mtime) {
975 torture_comment(tctx, "OLD mtime on secret %s does not match between SAMSYNC (%s) and LSA (%s)\n",
976 old->name, nt_time_string(mem_ctx, old->mtime),
977 nt_time_string(mem_ctx, *q.out.old_mtime));
978 ret = false;
979 }
980
981 if (old->secret.length != lsa_blob_out.length) {
982 torture_comment(tctx, "Returned secret %s doesn't match: %d != %d\n",
983 old->name, (int)old->secret.length, (int)lsa_blob_out.length);
984 ret = false;
985 } else if (memcmp(lsa_blob_out.data,
986 old->secret.data, old->secret.length) != 0) {
987 torture_comment(tctx, "Returned secret %s doesn't match: \n",
988 old->name);
989 DEBUG(1, ("SamSync Secret:\n"));
990 dump_data(1, old->secret.data, old->secret.length);
991 DEBUG(1, ("LSA Secret:\n"));
992 dump_data(1, lsa_blob_out.data, lsa_blob_out.length);
993 ret = false;
994 }
995
996 }
997
998 if (q.out.new_val->buf == NULL) {
999 /* probably just not available due to ACLs */
1000 } else {
1001 lsa_blob1.data = q.out.new_val->buf->data;
1002 lsa_blob1.length = q.out.new_val->buf->length;
1003
1004 status = sess_decrypt_blob(mem_ctx, &lsa_blob1, &session_key, &lsa_blob_out);
1005 if (!NT_STATUS_IS_OK(status)) {
1006 torture_comment(tctx, "Failed to decrypt secrets OLD blob\n");
1007 return false;
1008 }
1009
1010 if (!q.out.new_mtime) {
1011 torture_comment(tctx, "NEW mtime not available on LSA for secret %s\n", nsec->name);
1012 ret = false;
1013 }
1014 if (nsec->mtime != *q.out.new_mtime) {
1015 torture_comment(tctx, "NEW mtime on secret %s does not match between SAMSYNC (%s) and LSA (%s)\n",
1016 nsec->name, nt_time_string(mem_ctx, nsec->mtime),
1017 nt_time_string(mem_ctx, *q.out.new_mtime));
1018 ret = false;
1019 }
1020
1021 if (nsec->secret.length != lsa_blob_out.length) {
1022 torture_comment(tctx, "Returned secret %s doesn't match: %d != %d\n",
1023 nsec->name, (int)nsec->secret.length, (int)lsa_blob_out.length);
1024 ret = false;
1025 } else if (memcmp(lsa_blob_out.data,
1026 nsec->secret.data, nsec->secret.length) != 0) {
1027 torture_comment(tctx, "Returned secret %s doesn't match: \n",
1028 nsec->name);
1029 DEBUG(1, ("SamSync Secret:\n"));
1030 dump_data(1, nsec->secret.data, nsec->secret.length);
1031 DEBUG(1, ("LSA Secret:\n"));
1032 dump_data(1, lsa_blob_out.data, lsa_blob_out.length);
1033 ret = false;
1034 }
1035 }
1036
1037 return ret;
1038 }
1039
1040 static bool samsync_handle_trusted_domain(struct torture_context *tctx,
1041 TALLOC_CTX *mem_ctx, struct samsync_state *samsync_state,
1042 int database_id, struct netr_DELTA_ENUM *delta)
1043 {
1044 bool ret = true;
1045 struct netr_DELTA_TRUSTED_DOMAIN *trusted_domain = delta->delta_union.trusted_domain;
1046 struct dom_sid *dom_sid = delta->delta_id_union.sid;
1047
1048 struct samsync_trusted_domain *ndom = talloc(samsync_state, struct samsync_trusted_domain);
1049 struct lsa_OpenTrustedDomain t;
1050 struct policy_handle trustdom_handle;
1051 struct lsa_QueryTrustedDomainInfo q;
1052 union lsa_TrustedDomainInfo *info[9];
1053 union lsa_TrustedDomainInfo *_info = NULL;
1054 int levels [] = {1, 3, 8};
1055 int i;
1056
1057 ndom->name = talloc_strdup(ndom, trusted_domain->domain_name.string);
1058 ndom->sid = dom_sid_dup(ndom, dom_sid);
1059
1060 t.in.handle = samsync_state->lsa_handle;
1061 t.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1062 t.in.sid = dom_sid;
1063 t.out.trustdom_handle = &trustdom_handle;
1064
1065 torture_assert_ntstatus_ok(tctx,
1066 dcerpc_lsa_OpenTrustedDomain_r(samsync_state->b_lsa, mem_ctx, &t),
1067 "OpenTrustedDomain failed");
1068 torture_assert_ntstatus_ok(tctx, t.out.result,
1069 "OpenTrustedDomain failed");
1070
1071 for (i=0; i< ARRAY_SIZE(levels); i++) {
1072 q.in.trustdom_handle = &trustdom_handle;
1073 q.in.level = levels[i];
1074 q.out.info = &_info;
1075 torture_assert_ntstatus_ok(tctx,
1076 dcerpc_lsa_QueryTrustedDomainInfo_r(samsync_state->b_lsa, mem_ctx, &q),
1077 "QueryTrustedDomainInfo failed");
1078 if (!NT_STATUS_IS_OK(q.out.result)) {
1079 if (q.in.level == 8 && NT_STATUS_EQUAL(q.out.result, NT_STATUS_INVALID_PARAMETER)) {
1080 info[levels[i]] = NULL;
1081 continue;
1082 }
1083 torture_comment(tctx, "QueryInfoTrustedDomain level %d failed - %s\n",
1084 levels[i], nt_errstr(q.out.result));
1085 return false;
1086 }
1087 info[levels[i]] = _info;
1088 }
1089
1090 if (info[8]) {
1091 TEST_SID_EQUAL(info[8]->full_info.info_ex.sid, dom_sid);
1092 TEST_STRING_EQUAL(info[8]->full_info.info_ex.netbios_name, trusted_domain->domain_name);
1093 }
1094 TEST_STRING_EQUAL(info[1]->name.netbios_name, trusted_domain->domain_name);
1095 TEST_INT_EQUAL(info[3]->posix_offset.posix_offset, trusted_domain->posix_offset);
1096 /*
1097 We would like to do this, but it is NOT_SUPPORTED on win2k3
1098 TEST_SEC_DESC_EQUAL(trusted_domain->sdbuf, lsa, &trustdom_handle);
1099 */
1100 DLIST_ADD(samsync_state->trusted_domains, ndom);
1101
1102 return ret;
1103 }
1104
1105 static bool samsync_handle_account(struct torture_context *tctx,
1106 TALLOC_CTX *mem_ctx, struct samsync_state *samsync_state,
1107 int database_id, struct netr_DELTA_ENUM *delta)
1108 {
1109 bool ret = true;
1110 struct netr_DELTA_ACCOUNT *account = delta->delta_union.account;
1111 struct dom_sid *dom_sid = delta->delta_id_union.sid;
1112
1113 struct lsa_OpenAccount a;
1114 struct policy_handle acct_handle;
1115 struct lsa_EnumPrivsAccount e;
1116 struct lsa_PrivilegeSet *privs = NULL;
1117 struct lsa_LookupPrivName r;
1118
1119 int i, j;
1120
1121 bool *found_priv_in_lsa;
1122
1123 a.in.handle = samsync_state->lsa_handle;
1124 a.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1125 a.in.sid = dom_sid;
1126 a.out.acct_handle = &acct_handle;
1127
1128 torture_assert_ntstatus_ok(tctx,
1129 dcerpc_lsa_OpenAccount_r(samsync_state->b_lsa, mem_ctx, &a),
1130 "OpenAccount failed");
1131 torture_assert_ntstatus_ok(tctx, a.out.result,
1132 "OpenAccount failed");
1133
1134 TEST_SEC_DESC_EQUAL(account->sdbuf, lsa, &acct_handle);
1135
1136 found_priv_in_lsa = talloc_zero_array(mem_ctx, bool, account->privilege_entries);
1137
1138 e.in.handle = &acct_handle;
1139 e.out.privs = &privs;
1140
1141 torture_assert_ntstatus_ok(tctx,
1142 dcerpc_lsa_EnumPrivsAccount_r(samsync_state->b_lsa, mem_ctx, &e),
1143 "EnumPrivsAccount failed");
1144 torture_assert_ntstatus_ok(tctx, e.out.result,
1145 "EnumPrivsAccount failed");
1146
1147 if ((account->privilege_entries && !privs)) {
1148 torture_comment(tctx, "Account %s has privileges in SamSync, but not LSA\n",
1149 dom_sid_string(mem_ctx, dom_sid));
1150 return false;
1151 }
1152
1153 if (!account->privilege_entries && privs && privs->count) {
1154 torture_comment(tctx, "Account %s has privileges in LSA, but not SamSync\n",
1155 dom_sid_string(mem_ctx, dom_sid));
1156 return false;
1157 }
1158
1159 TEST_INT_EQUAL(account->privilege_entries, privs->count);
1160
1161 for (i=0;i< privs->count; i++) {
1162
1163 struct lsa_StringLarge *name = NULL;
1164
1165 r.in.handle = samsync_state->lsa_handle;
1166 r.in.luid = &privs->set[i].luid;
1167 r.out.name = &name;
1168
1169 torture_assert_ntstatus_ok(tctx,
1170 dcerpc_lsa_LookupPrivName_r(samsync_state->b_lsa, mem_ctx, &r),
1171 "\nLookupPrivName failed");
1172 torture_assert_ntstatus_ok(tctx, r.out.result,
1173 "\nLookupPrivName failed");
1174
1175 if (!r.out.name) {
1176 torture_comment(tctx, "\nLookupPrivName failed to return a name\n");
1177 return false;
1178 }
1179 for (j=0;j<account->privilege_entries; j++) {
1180 if (strcmp(name->string, account->privilege_name[j].string) == 0) {
1181 found_priv_in_lsa[j] = true;
1182 break;
1183 }
1184 }
1185 }
1186 for (j=0;j<account->privilege_entries; j++) {
1187 if (!found_priv_in_lsa[j]) {
1188 torture_comment(tctx, "Privilege %s on account %s not found in LSA\n", account->privilege_name[j].string,
1189 dom_sid_string(mem_ctx, dom_sid));
1190 ret = false;
1191 }
1192 }
1193 return ret;
1194 }
1195
1196 /*
1197 try a netlogon DatabaseSync
1198 */
1199 static bool test_DatabaseSync(struct torture_context *tctx,
1200 struct samsync_state *samsync_state,
1201 TALLOC_CTX *mem_ctx)
1202 {
1203 TALLOC_CTX *loop_ctx, *delta_ctx, *trustdom_ctx;
1204 struct netr_DatabaseSync r;
1205 const enum netr_SamDatabaseID database_ids[] = {SAM_DATABASE_DOMAIN, SAM_DATABASE_BUILTIN, SAM_DATABASE_PRIVS};
1206 int i, d;
1207 bool ret = true;
1208 struct samsync_trusted_domain *t;
1209 struct samsync_secret *s;
1210 struct netr_Authenticator return_authenticator, credential;
1211 struct netr_DELTA_ENUM_ARRAY *delta_enum_array = NULL;
1212
1213 const char *domain, *username;
1214
1215 ZERO_STRUCT(return_authenticator);
1216
1217 r.in.logon_server = talloc_asprintf(mem_ctx, "\\\\%s", dcerpc_server_name(samsync_state->p));
1218 r.in.computername = TEST_MACHINE_NAME;
1219 r.in.preferredmaximumlength = (uint32_t)-1;
1220 r.in.return_authenticator = &return_authenticator;
1221 r.out.return_authenticator = &return_authenticator;
1222 r.out.delta_enum_array = &delta_enum_array;
1223
1224 for (i=0;i<ARRAY_SIZE(database_ids);i++) {
1225
1226 uint32_t sync_context = 0;
1227
1228 r.in.database_id = database_ids[i];
1229 r.in.sync_context = &sync_context;
1230 r.out.sync_context = &sync_context;
1231
1232 torture_comment(tctx, "Testing DatabaseSync of id %d\n", r.in.database_id);
1233
1234 do {
1235 loop_ctx = talloc_named(mem_ctx, 0, "DatabaseSync loop context");
1236 netlogon_creds_client_authenticator(samsync_state->creds, &credential);
1237
1238 r.in.credential = &credential;
1239
1240 torture_assert_ntstatus_ok(tctx,
1241 dcerpc_netr_DatabaseSync_r(samsync_state->b, loop_ctx, &r),
1242 "DatabaseSync failed");
1243 if (!NT_STATUS_IS_OK(r.out.result) &&
1244 !NT_STATUS_EQUAL(r.out.result, STATUS_MORE_ENTRIES)) {
1245 torture_comment(tctx, "DatabaseSync - %s\n", nt_errstr(r.out.result));
1246 ret = false;
1247 break;
1248 }
1249
1250 if (!netlogon_creds_client_check(samsync_state->creds, &r.out.return_authenticator->cred)) {
1251 torture_comment(tctx, "Credential chaining failed\n");
1252 }
1253
1254 r.in.sync_context = r.out.sync_context;
1255
1256 for (d=0; d < delta_enum_array->num_deltas; d++) {
1257 delta_ctx = talloc_named(loop_ctx, 0, "DatabaseSync delta context");
1258
1259 if (!NT_STATUS_IS_OK(samsync_fix_delta(delta_ctx, samsync_state->creds,
1260 r.in.database_id,
1261 &delta_enum_array->delta_enum[d]))) {
1262 torture_comment(tctx, "Failed to decrypt delta\n");
1263 ret = false;
1264 }
1265
1266 switch (delta_enum_array->delta_enum[d].delta_type) {
1267 case NETR_DELTA_DOMAIN:
1268 if (!samsync_handle_domain(tctx, delta_ctx, samsync_state,
1269 r.in.database_id, &delta_enum_array->delta_enum[d])) {
1270 torture_comment(tctx, "Failed to handle DELTA_DOMAIN\n");
1271 ret = false;
1272 }
1273 break;
1274 case NETR_DELTA_GROUP:
1275 if (!samsync_handle_group(tctx, delta_ctx, samsync_state,
1276 r.in.database_id, &delta_enum_array->delta_enum[d])) {
1277 torture_comment(tctx, "Failed to handle DELTA_USER\n");
1278 ret = false;
1279 }
1280 break;
1281 case NETR_DELTA_USER:
1282 if (!samsync_handle_user(tctx, delta_ctx, samsync_state,
1283 r.in.database_id, &delta_enum_array->delta_enum[d])) {
1284 torture_comment(tctx, "Failed to handle DELTA_USER\n");
1285 ret = false;
1286 }
1287 break;
1288 case NETR_DELTA_ALIAS:
1289 if (!samsync_handle_alias(tctx, delta_ctx, samsync_state,
1290 r.in.database_id, &delta_enum_array->delta_enum[d])) {
1291 torture_comment(tctx, "Failed to handle DELTA_ALIAS\n");
1292 ret = false;
1293 }
1294 break;
1295 case NETR_DELTA_POLICY:
1296 if (!samsync_handle_policy(tctx, delta_ctx, samsync_state,
1297 r.in.database_id, &delta_enum_array->delta_enum[d])) {
1298 torture_comment(tctx, "Failed to handle DELTA_POLICY\n");
1299 ret = false;
1300 }
1301 break;
1302 case NETR_DELTA_TRUSTED_DOMAIN:
1303 if (!samsync_handle_trusted_domain(tctx, delta_ctx, samsync_state,
1304 r.in.database_id, &delta_enum_array->delta_enum[d])) {
1305 torture_comment(tctx, "Failed to handle DELTA_TRUSTED_DOMAIN\n");
1306 ret = false;
1307 }
1308 break;
1309 case NETR_DELTA_ACCOUNT:
1310 if (!samsync_handle_account(tctx, delta_ctx, samsync_state,
1311 r.in.database_id, &delta_enum_array->delta_enum[d])) {
1312 torture_comment(tctx, "Failed to handle DELTA_ACCOUNT\n");
1313 ret = false;
1314 }
1315 break;
1316 case NETR_DELTA_SECRET:
1317 if (!samsync_handle_secret(tctx, delta_ctx, samsync_state,
1318 r.in.database_id, &delta_enum_array->delta_enum[d])) {
1319 torture_comment(tctx, "Failed to handle DELTA_SECRET\n");
1320 ret = false;
1321 }
1322 break;
1323 case NETR_DELTA_GROUP_MEMBER:
1324 case NETR_DELTA_ALIAS_MEMBER:
1325 /* These are harder to cross-check, and we expect them */
1326 break;
1327 case NETR_DELTA_DELETE_GROUP:
1328 case NETR_DELTA_RENAME_GROUP:
1329 case NETR_DELTA_DELETE_USER:
1330 case NETR_DELTA_RENAME_USER:
1331 case NETR_DELTA_DELETE_ALIAS:
1332 case NETR_DELTA_RENAME_ALIAS:
1333 case NETR_DELTA_DELETE_TRUST:
1334 case NETR_DELTA_DELETE_ACCOUNT:
1335 case NETR_DELTA_DELETE_SECRET:
1336 case NETR_DELTA_DELETE_GROUP2:
1337 case NETR_DELTA_DELETE_USER2:
1338 case NETR_DELTA_MODIFY_COUNT:
1339 default:
1340 torture_comment(tctx, "Uxpected delta type %d\n", delta_enum_array->delta_enum[d].delta_type);
1341 ret = false;
1342 break;
1343 }
1344 talloc_free(delta_ctx);
1345 }
1346 talloc_free(loop_ctx);
1347 } while (NT_STATUS_EQUAL(r.out.result, STATUS_MORE_ENTRIES));
1348
1349 }
1350
1351 domain = samsync_state->domain_name[SAM_DATABASE_DOMAIN];
1352 if (!domain) {
1353 torture_comment(tctx, "Never got a DOMAIN object in samsync!\n");
1354 return false;
1355 }
1356
1357 trustdom_ctx = talloc_named(mem_ctx, 0, "test_DatabaseSync Trusted domains context");
1358
1359 username = talloc_asprintf(trustdom_ctx, "%s$", domain);
1360 for (t=samsync_state->trusted_domains; t; t=t->next) {
1361 char *secret_name = talloc_asprintf(trustdom_ctx, "G$$%s", t->name);
1362 for (s=samsync_state->secrets; s; s=s->next) {
1363 if (strcasecmp_m(s->name, secret_name) == 0) {
1364 NTSTATUS nt_status;
1365 struct samr_Password nt_hash;
1366 mdfour(nt_hash.hash, s->secret.data, s->secret.length);
1367
1368 torture_comment(tctx, "Checking password for %s\\%s\n", t->name, username);
1369 nt_status = test_SamLogon(tctx,
1370 samsync_state->p_netlogon_wksta, trustdom_ctx, samsync_state->creds_netlogon_wksta,
1371 t->name,
1372 username,
1373 TEST_WKSTA_MACHINE_NAME,
1374 NULL,
1375 &nt_hash,
1376 NULL);
1377 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_LOGON_SERVERS)) {
1378 torture_comment(tctx, "Verifiction of trust password to %s failed: %s (the trusted domain is not available)\n",
1379 t->name, nt_errstr(nt_status));
1380
1381 break;
1382 }
1383 if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT)) {
1384 torture_comment(tctx, "Verifiction of trust password to %s: should have failed (nologon interdomain trust account), instead: %s\n",
1385 t->name, nt_errstr(nt_status));
1386 ret = false;
1387 }
1388
1389 /* break it */
1390 nt_hash.hash[0]++;
1391 nt_status = test_SamLogon(tctx,
1392 samsync_state->p_netlogon_wksta, trustdom_ctx, samsync_state->creds_netlogon_wksta,
1393 t->name,
1394 username,
1395 TEST_WKSTA_MACHINE_NAME,
1396 NULL,
1397 &nt_hash,
1398 NULL);
1399
1400 if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_WRONG_PASSWORD)) {
1401 torture_comment(tctx, "Verifiction of trust password to %s: should have failed (wrong password), instead: %s\n",
1402 t->name, nt_errstr(nt_status));
1403 ret = false;
1404 }
1405
1406 break;
1407 }
1408 }
1409 }
1410 talloc_free(trustdom_ctx);
1411 return ret;
1412 }
1413
1414
1415 /*
1416 try a netlogon DatabaseDeltas
1417 */
1418 static bool test_DatabaseDeltas(struct torture_context *tctx,
1419 struct samsync_state *samsync_state, TALLOC_CTX *mem_ctx)
1420 {
1421 TALLOC_CTX *loop_ctx;
1422 struct netr_DatabaseDeltas r;
1423 struct netr_Authenticator credential;
1424 struct netr_Authenticator return_authenticator;
1425 struct netr_DELTA_ENUM_ARRAY *delta_enum_array = NULL;
1426 const uint32_t database_ids[] = {0, 1, 2};
1427 int i;
1428 bool ret = true;
1429
1430 ZERO_STRUCT(return_authenticator);
1431
1432 r.in.logon_server = talloc_asprintf(mem_ctx, "\\\\%s", dcerpc_server_name(samsync_state->p));
1433 r.in.computername = TEST_MACHINE_NAME;
1434 r.in.credential = &credential;
1435 r.in.preferredmaximumlength = (uint32_t)-1;
1436 r.in.return_authenticator = &return_authenticator;
1437 r.out.return_authenticator = &return_authenticator;
1438 r.out.delta_enum_array = &delta_enum_array;
1439
1440 for (i=0;i<ARRAY_SIZE(database_ids);i++) {
1441
1442 uint64_t seq_num = samsync_state->seq_num[i];
1443
1444 r.in.database_id = database_ids[i];
1445 r.in.sequence_num = &seq_num;
1446 r.out.sequence_num = &seq_num;
1447
1448 if (seq_num == 0) continue;
1449
1450 /* this shows that the bdc doesn't need to do a single call for
1451 * each seqnumber, and the pdc doesn't need to know about old values
1452 * -- metze
1453 */
1454 seq_num -= 10;
1455
1456 torture_comment(tctx, "Testing DatabaseDeltas of id %d at %llu\n",
1457 r.in.database_id, (long long)seq_num);
1458
1459 do {
1460 loop_ctx = talloc_named(mem_ctx, 0, "test_DatabaseDeltas loop context");
1461 netlogon_creds_client_authenticator(samsync_state->creds, &credential);
1462
1463 torture_assert_ntstatus_ok(tctx,
1464 dcerpc_netr_DatabaseDeltas_r(samsync_state->b, loop_ctx, &r),
1465 "DatabaseDeltas failed");
1466 if (!NT_STATUS_IS_OK(r.out.result) &&
1467 !NT_STATUS_EQUAL(r.out.result, STATUS_MORE_ENTRIES) &&
1468 !NT_STATUS_EQUAL(r.out.result, NT_STATUS_SYNCHRONIZATION_REQUIRED)) {
1469 torture_comment(tctx, "DatabaseDeltas - %s\n", nt_errstr(r.out.result));
1470 ret = false;
1471 }
1472
1473 if (!netlogon_creds_client_check(samsync_state->creds, &return_authenticator.cred)) {
1474 torture_comment(tctx, "Credential chaining failed\n");
1475 }
1476
1477 seq_num++;
1478 talloc_free(loop_ctx);
1479 } while (NT_STATUS_EQUAL(r.out.result, STATUS_MORE_ENTRIES));
1480 }
1481
1482 return ret;
1483 }
1484
1485
1486 /*
1487 try a netlogon DatabaseSync2
1488 */
1489 static bool test_DatabaseSync2(struct torture_context *tctx,
1490 struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
1491 struct netlogon_creds_CredentialState *creds)
1492 {
1493 TALLOC_CTX *loop_ctx;
1494 struct netr_DatabaseSync2 r;
1495 const uint32_t database_ids[] = {0, 1, 2};
1496 int i;
1497 bool ret = true;
1498 struct netr_Authenticator return_authenticator, credential;
1499 struct netr_DELTA_ENUM_ARRAY *delta_enum_array = NULL;
1500 struct dcerpc_binding_handle *b = p->binding_handle;
1501
1502 ZERO_STRUCT(return_authenticator);
1503
1504 r.in.logon_server = talloc_asprintf(mem_ctx, "\\\\%s", dcerpc_server_name(p));
1505 r.in.computername = TEST_MACHINE_NAME;
1506 r.in.preferredmaximumlength = (uint32_t)-1;
1507 r.in.return_authenticator = &return_authenticator;
1508 r.out.return_authenticator = &return_authenticator;
1509 r.out.delta_enum_array = &delta_enum_array;
1510
1511 for (i=0;i<ARRAY_SIZE(database_ids);i++) {
1512
1513 uint32_t sync_context = 0;
1514
1515 r.in.database_id = database_ids[i];
1516 r.in.sync_context = &sync_context;
1517 r.out.sync_context = &sync_context;
1518 r.in.restart_state = 0;
1519
1520 torture_comment(tctx, "Testing DatabaseSync2 of id %d\n", r.in.database_id);
1521
1522 do {
1523 loop_ctx = talloc_named(mem_ctx, 0, "test_DatabaseSync2 loop context");
1524 netlogon_creds_client_authenticator(creds, &credential);
1525
1526 r.in.credential = &credential;
1527
1528 torture_assert_ntstatus_ok(tctx,
1529 dcerpc_netr_DatabaseSync2_r(b, loop_ctx, &r),
1530 "DatabaseSync2 failed");
1531 if (!NT_STATUS_IS_OK(r.out.result) &&
1532 !NT_STATUS_EQUAL(r.out.result, STATUS_MORE_ENTRIES)) {
1533 torture_comment(tctx, "DatabaseSync2 - %s\n", nt_errstr(r.out.result));
1534 ret = false;
1535 }
1536
1537 if (!netlogon_creds_client_check(creds, &r.out.return_authenticator->cred)) {
1538 torture_comment(tctx, "Credential chaining failed\n");
1539 }
1540
1541 talloc_free(loop_ctx);
1542 } while (NT_STATUS_EQUAL(r.out.result, STATUS_MORE_ENTRIES));
1543 }
1544
1545 return ret;
1546 }
1547
1548
1549
1550 bool torture_rpc_samsync(struct torture_context *torture)
1551 {
1552 NTSTATUS status;
1553 TALLOC_CTX *mem_ctx;
1554 bool ret = true;
1555 struct test_join *join_ctx;
1556 struct test_join *join_ctx2;
1557 struct test_join *user_ctx;
1558 const char *machine_password;
1559 const char *wksta_machine_password;
1560 struct dcerpc_binding *b;
1561 struct dcerpc_binding *b_netlogon_wksta;
1562 struct samr_Connect c;
1563 struct samr_SetDomainInfo s;
1564 struct policy_handle *domain_policy;
1565
1566 struct lsa_ObjectAttribute attr;
1567 struct lsa_QosInfo qos;
1568 struct lsa_OpenPolicy2 r;
1569 struct cli_credentials *credentials;
1570 struct cli_credentials *credentials_wksta;
1571
1572 struct samsync_state *samsync_state;
1573
1574 char *test_machine_account;
1575
1576 char *test_wksta_machine_account;
1577
1578 mem_ctx = talloc_init("torture_rpc_netlogon");
1579
1580 test_machine_account = talloc_asprintf(mem_ctx, "%s$", TEST_MACHINE_NAME);
1581 join_ctx = torture_create_testuser(torture, test_machine_account,
1582 lpcfg_workgroup(torture->lp_ctx), ACB_SVRTRUST,
1583 &machine_password);
1584 if (!join_ctx) {
1585 talloc_free(mem_ctx);
1586 torture_comment(torture, "Failed to join as BDC\n");
1587 return false;
1588 }
1589
1590 test_wksta_machine_account = talloc_asprintf(mem_ctx, "%s$", TEST_WKSTA_MACHINE_NAME);
1591 join_ctx2 = torture_create_testuser(torture, test_wksta_machine_account, lpcfg_workgroup(torture->lp_ctx), ACB_WSTRUST, &wksta_machine_password);
1592 if (!join_ctx2) {
1593 talloc_free(mem_ctx);
1594 torture_comment(torture, "Failed to join as member\n");
1595 return false;
1596 }
1597
1598 user_ctx = torture_create_testuser(torture, TEST_USER_NAME,
1599 lpcfg_workgroup(torture->lp_ctx),
1600 ACB_NORMAL, NULL);
1601 if (!user_ctx) {
1602 talloc_free(mem_ctx);
1603 torture_comment(torture, "Failed to create test account\n");
1604 return false;
1605 }
1606
1607 samsync_state = talloc_zero(mem_ctx, struct samsync_state);
1608
1609 samsync_state->p_samr = torture_join_samr_pipe(join_ctx);
1610 samsync_state->b_samr = samsync_state->p_samr->binding_handle;
1611 samsync_state->connect_handle = talloc_zero(samsync_state, struct policy_handle);
1612 samsync_state->lsa_handle = talloc_zero(samsync_state, struct policy_handle);
1613 c.in.system_name = NULL;
1614 c.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1615 c.out.connect_handle = samsync_state->connect_handle;
1616
1617 torture_assert_ntstatus_ok_goto(torture,
1618 dcerpc_samr_Connect_r(samsync_state->b_samr, mem_ctx, &c),
1619 ret, failed,
1620 "samr_Connect failed");
1621 torture_assert_ntstatus_ok_goto(torture, c.out.result,
1622 ret, failed,
1623 "samr_Connect failed");
1624
1625 domain_policy = samsync_open_domain(torture, mem_ctx, samsync_state, lpcfg_workgroup(torture->lp_ctx), NULL);
1626 if (!domain_policy) {
1627 torture_comment(torture, "samrsync_open_domain failed\n");
1628 ret = false;
1629 goto failed;
1630 }
1631
1632 s.in.domain_handle = domain_policy;
1633 s.in.level = 4;
1634 s.in.info = talloc(mem_ctx, union samr_DomainInfo);
1635
1636 s.in.info->oem.oem_information.string
1637 = talloc_asprintf(mem_ctx,
1638 "Tortured by Samba4: %s",
1639 timestring(mem_ctx, time(NULL)));
1640 torture_assert_ntstatus_ok_goto(torture,
1641 dcerpc_samr_SetDomainInfo_r(samsync_state->b_samr, mem_ctx, &s),
1642 ret, failed,
1643 "SetDomainInfo failed");
1644
1645 if (!test_samr_handle_Close(samsync_state->b_samr, torture, domain_policy)) {
1646 ret = false;
1647 goto failed;
1648 }
1649
1650 torture_assert_ntstatus_ok_goto(torture, s.out.result,
1651 ret, failed,
1652 talloc_asprintf(torture, "SetDomainInfo level %u failed", s.in.level));
1653
1654 status = torture_rpc_connection(torture,
1655 &samsync_state->p_lsa,
1656 &ndr_table_lsarpc);
1657
1658 if (!NT_STATUS_IS_OK(status)) {
1659 ret = false;
1660 goto failed;
1661 }
1662 samsync_state->b_lsa = samsync_state->p_lsa->binding_handle;
1663
1664 qos.len = 0;
1665 qos.impersonation_level = 2;
1666 qos.context_mode = 1;
1667 qos.effective_only = 0;
1668
1669 attr.len = 0;
1670 attr.root_dir = NULL;
1671 attr.object_name = NULL;
1672 attr.attributes = 0;
1673 attr.sec_desc = NULL;
1674 attr.sec_qos = &qos;
1675
1676 r.in.system_name = "\\";
1677 r.in.attr = &attr;
1678 r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1679 r.out.handle = samsync_state->lsa_handle;
1680
1681 torture_assert_ntstatus_ok_goto(torture,
1682 dcerpc_lsa_OpenPolicy2_r(samsync_state->b_lsa, mem_ctx, &r),
1683 ret, failed,
1684 "OpenPolicy2 failed");
1685 torture_assert_ntstatus_ok_goto(torture, r.out.result,
1686 ret, failed,
1687 "OpenPolicy2 failed");
1688
1689 status = torture_rpc_binding(torture, &b);
1690 if (!NT_STATUS_IS_OK(status)) {
1691 ret = false;
1692 goto failed;
1693 }
1694
1695 status = dcerpc_binding_set_flags(b,
1696 DCERPC_SCHANNEL | DCERPC_SIGN,
1697 DCERPC_AUTH_OPTIONS);
1698 torture_assert_ntstatus_ok(torture, status, "set flags");
1699
1700 credentials = cli_credentials_init(mem_ctx);
1701
1702 cli_credentials_set_workstation(credentials, TEST_MACHINE_NAME, CRED_SPECIFIED);
1703 cli_credentials_set_domain(credentials, lpcfg_workgroup(torture->lp_ctx), CRED_SPECIFIED);
1704 cli_credentials_set_username(credentials, test_machine_account, CRED_SPECIFIED);
1705 cli_credentials_set_password(credentials, machine_password, CRED_SPECIFIED);
1706 cli_credentials_set_secure_channel_type(credentials,
1707 SEC_CHAN_BDC);
1708
1709 status = dcerpc_pipe_connect_b(samsync_state,
1710 &samsync_state->p, b,
1711 &ndr_table_netlogon,
1712 credentials, torture->ev, torture->lp_ctx);
1713
1714 if (!NT_STATUS_IS_OK(status)) {
1715 torture_comment(torture, "Failed to connect to server as a BDC: %s\n", nt_errstr(status));
1716 ret = false;
1717 goto failed;
1718 }
1719 samsync_state->b = samsync_state->p->binding_handle;
1720
1721 samsync_state->creds = cli_credentials_get_netlogon_creds(credentials);
1722 if (samsync_state->creds == NULL) {
1723 ret = false;
1724 }
1725
1726
1727
1728 status = torture_rpc_binding(torture, &b_netlogon_wksta);
1729 if (!NT_STATUS_IS_OK(status)) {
1730 ret = false;
1731 goto failed;
1732 }
1733
1734 status = dcerpc_binding_set_flags(b_netlogon_wksta,
1735 DCERPC_SCHANNEL | DCERPC_SIGN,
1736 DCERPC_AUTH_OPTIONS);
1737 torture_assert_ntstatus_ok(torture, status, "set flags");
1738
1739 credentials_wksta = cli_credentials_init(mem_ctx);
1740
1741 cli_credentials_set_workstation(credentials_wksta, TEST_WKSTA_MACHINE_NAME, CRED_SPECIFIED);
1742 cli_credentials_set_domain(credentials_wksta, lpcfg_workgroup(torture->lp_ctx), CRED_SPECIFIED);
1743 cli_credentials_set_username(credentials_wksta, test_wksta_machine_account, CRED_SPECIFIED);
1744 cli_credentials_set_password(credentials_wksta, wksta_machine_password, CRED_SPECIFIED);
1745 cli_credentials_set_secure_channel_type(credentials_wksta,
1746 SEC_CHAN_WKSTA);
1747
1748 status = dcerpc_pipe_connect_b(samsync_state,
1749 &samsync_state->p_netlogon_wksta,
1750 b_netlogon_wksta,
1751 &ndr_table_netlogon,
1752 credentials_wksta, torture->ev, torture->lp_ctx);
1753
1754 if (!NT_STATUS_IS_OK(status)) {
1755 torture_comment(torture, "Failed to connect to server as a Workstation: %s\n", nt_errstr(status));
1756 ret = false;
1757 goto failed;
1758 }
1759
1760 samsync_state->creds_netlogon_wksta = cli_credentials_get_netlogon_creds(credentials_wksta);
1761 if (samsync_state->creds_netlogon_wksta == NULL) {
1762 torture_comment(torture, "Failed to obtail schanel creds!\n");
1763 ret = false;
1764 }
1765
1766 if (!test_DatabaseSync(torture, samsync_state, mem_ctx)) {
1767 torture_comment(torture, "DatabaseSync failed\n");
1768 ret = false;
1769 }
1770
1771 if (!test_DatabaseDeltas(torture, samsync_state, mem_ctx)) {
1772 torture_comment(torture, "DatabaseDeltas failed\n");
1773 ret = false;
1774 }
1775
1776 if (!test_DatabaseSync2(torture, samsync_state->p, mem_ctx, samsync_state->creds)) {
1777 torture_comment(torture, "DatabaseSync2 failed\n");
1778 ret = false;
1779 }
1780 failed:
1781
1782 torture_leave_domain(torture, join_ctx);
1783 torture_leave_domain(torture, join_ctx2);
1784 torture_leave_domain(torture, user_ctx);
1785
1786 talloc_free(mem_ctx);
1787
1788 return ret;
1789 }
Samba GIT mirror